CynergisTek, Inc.

Thank you, operator. As a reminder, it was a little over a month ago that we provided an update as part of our year-end call.

So today's discussion will really be a continuation of that dialogue. We're continuing to see positive signs of a return to normal in our clients.

Budgets are returning, pandemic-related downward pressures on pricing are easing, and pre-sold revenue continues to grow, coming out of the momentum that we started in Q4. And it's been great to see clients face-to-face again as many of our staff are now fully vaccinated and we've safely opened up travel.

As anticipated, we're also seeing increased consolidation in healthcare providers and an improving awareness of security vulnerabilities across the industries in which we operate, all of which creates new opportunities for growth in existing clients. Now this was highlighted with a recent announcement of a $1.4 million renewal and expansion, the renewal of which was closed in Q1 and an expansion to additional affiliate locations that closed in Q2.

Look, I think consolidation amongst healthcare providers ultimately is a good thing for us. And this is a great example of the add-on business opportunity when our healthcare customers acquire or affiliate with other organizations and leverage our services to raise the maturity of their entire system.

As guided in Q4, the first half of this year is expected to be our trough from a revenue perspective. And early signs in Q2 indicate that we're returning to growth for the second half of the year.

We're also starting to see synergy between our healthcare business and the work we've been doing to prepare for offering services under the Department of Defense's Cybersecurity Maturity Model Certification or CMMC program. You see, several of existing healthcare clients are recognizing that due to the work they do in support of our active military reserves, veterans independents, they too will need to be compliant with CMMC.

This was noted in our recent announcement concerning Pacific Medical Centers, a primary and integrated multispecialty healthcare network, who chose our Redspin business unit to conduct a CMMC readiness assessment as they prepare for eventual certification. Simply put, our strategy to grow in the government sector is also improving our hand in the healthcare sector, while leveraging our existing resources.

Now in related developments, yesterday's announcement that the Biden administration has issued an executive order aimed at helping the U.S. defend itself against sophisticated cyber supply chain attacks, like the recent ones at SolarWinds, the shutdown of the Colonial Pipeline and the incident with Microsoft Exchange are all starting to reinforce the federal government's commitment to tighten its security posture while using the federal contracting process to force changes that will likely trickle down to much of the private sector.

Now I also want to mention that earlier this year, we started increasing our investment in marketing by first establishing a VP of marketing role to drive our strategy to position the company for expansion in new adjacent verticals and larger enterprise health systems. This is important as we needed to shift our messaging to support the more advanced services we developed over the past year.

I'm excited to say that by the end of Q3, the first phase of our marketing strategy will be complete, which includes new brand positioning and websites with an elevated look and better user experience for both the CynergisTek and Redspin brands. Initial testing of our messaging is resonating very well with our clients.

And more importantly, is leading to pipeline growth of our managed services, including our advanced and validation services. Better marketing also opens the door to services being considered in adjacent markets.

Our outlook has given us the confidence to expand our efforts with the addition of multiple new sellers who have experience in adjacent markets, bringing our total to 9 direct sellers. Online, we used the pandemic to completely retool the company and that transformation is largely complete.

We feel good about where we're headed and the initiatives which we have pursued to be more relevant in a changing healthcare cyber market, expected to grow 16% per annum over the next 5 years, and to be one of the first companies to capitalize on the emerging multibillion-dollar business opportunity, securing the defense industrial base. All of this is expected to translate into a more profitable business that grows at a double-digit CAGR over the next 5 years.

With that, let me turn it over to Paul.

Thanks, Caleb. The key metric total revenue continues to grow, following on the strong Q4, increasing by an additional $200,000 to $17.4 million, due to greater demand from our healthcare providers coming out of the pandemic.

Additionally, we saw our cost reduction efforts improve earnings year-over-year by almost $1 million. Our balance sheet ended the quarter with $4.4 million in cash.

Q1 traditionally has a higher cash burn due to annual software subscriptions and other beginning-of-the-year cash outlays, but this was offset by the benefits from the employee retention credit provided under the Cares Act that we qualified for Q1 and expect to have in Q2. Since the end of last year, we have not taken any additional stock issuances under the $5 million ATM, under our shelf registration.

We still have the $2.8 million in debt that we received under the Paycheck Protection Program and still expect the majority of the loan will be forgiven, but are pending word back from the SBA. We are also expecting the tax refund from the carrybacks of available losses from 2020 to the extent possible, which at this point still exceeds over $1 million.

Addressing the Q1 standard financial disclosures, revenue decreased $0.9 million to $4.2 million compared to Q1 2020. The decrease from prior year was due to lower revenue from managed services, which reduced by $0.6 million to $2.4 million due to the impact of some customers canceling or delaying renewals, and the reduction in net new customers due to the pandemic.

Consulting and professional services revenue decreased $0.3 million to $1.7 million due to lower revenue from 2 customers who had completed contract work in the first half of 2020 and less business as a result of pandemic as our customers had continued to minimize spend with third-party contractors. Gross margin was 50% for Q1 2021 or an adjusted 39% when excluding the benefit from the employee retention credits.

This is an improvement when compared to 33% in Q1 2020 and 37% in Q4. The increase in gross margins is due to the staff and expense reductions, the reduced travel and the delivery efficiencies that we've been talking about on the last couple of calls.

Sales and marketing expenses decreased to $1.2 million for Q1 2021 compared to $1.5 million for the same period in 2020. This decrease was due to lower marketing and sales support payroll costs from the headcount reductions, less travel costs as well as the benefit from the employee retention credits.

These were partially offset by higher recruiting costs. We do expect sales and marketing to recover a level similar to 2019 as we increase investment in marketing to support our expanded go-to-market activities.

Our G&A expense decreased by $0.4 million or - to $1.7 million for Q1 2021. This decrease is due to the expense reduction efforts taken last year, a lower professional fees due to 2020 being higher from strategic advisory and recruiting costs, and the benefit from the employee retention credits provided under the Cares Act.

We do expect G&A expense to increase in the second half of the year as we start to reinstate some employee benefits that were suspended in 2020, we start to travel again as well as the employee retention credit going away. Non-GAAP adjusted EBITDA loss was $0.6 million for Q1 2021 compared to $1.4 million last year.

The full year financials and reconciliation of GAAP to non-GAAP information can be found in the earnings release that came out today. In summary, when taking into consideration the drop in revenue, the aggressive steps we took to respond to the pandemic shows in this quarter's results when compared to last year with continued improvement in gross margins, a reduction in our net loss, a reduction in our adjusted EBITDA loss and continued reduction in our cash flow use from operations.

All of this positions us well going into the rest of 2021, where we are seeing things improving throughout the rest of the year. This concludes the financials and the prepared remarks for Q1.

Operator, please open the floor for questions.

Maybe first off, regarding the recent attacks. And you mentioned those in the press release and your prepared remarks.

But I'm curious if you're sensing a change from customers and potential customers following these recent attacks when in the past, it's created maybe a flurry of activity and then things kind of seem to die off. But these seem to be a little bit more critical in nature.

And are you seeing that have an impact in your discussions and quite frankly in the pipeline?

Yes. Great question, Matt.

So the short answer to your question is yes. I mean, look, I don't ever want to tie any level of success to what bad guys do.

But I do think the awareness here is definitely driving changes. I mean, we're sitting here right now with 2 major portions of U.S.

infrastructure impacted this week, right? We have an entire hospital system down with Scripps Health out in the West Coast due to ransomware.

At the same time, we have a U.S. pipeline down due to a ransomware incident.

And not only is this creating additional awareness because I think every organization is realizing that proper preparation is going to be a whole lot less expensive than the cure, but at the same time, I think at the government level, we're also starting to realize that we're going to have to come up with a different way to deal with these adversaries. This is not normal criminal behavior.

This is having a massive impact on the U.S. economy.

There - and the thing is they're outside the reach of traditional law enforcement, right? So I don't know what to call these people.

They're not traditional criminals. They're not necessarily terrorists either.

They're something in between. But I think what you're starting to see the U.S.

government ramp up to is it's time to have a more proportional response to this, the first step of which, though, is getting our defenses in order. And I think a lot of what you saw in that executive order is the desire to use the U.S.

federal procurement process to ultimately drive changes that we see in the public sector - I mean, excuse me, in the private sector. And that's probably a smart way to do it.

But just to put this in context, right, when we look at the 500-plus ransomware incidents that occurred last year, these are starting to have real numbers associated with them. When the University of Vermont Health system went down, they called in the National Guard and ended up costing them over $16 million, and that was one of several of these.

So you quickly realize with those kinds of losses, an ounce of prevention is going to cost you a whole lot less.

Absolutely. So you've got that in the headlines.

And obviously, it appears that the situation is improving from a COVID perspective. I'm curious if that's driving some renewed conversations with some of the customers that had maybe delayed some of the renewals last year.

I know that you were able to sign the one contract in Q1, but are you seeing a similar impact with some of the other customers?

It is. It's creating a - there's a couple of things we're seeing happening at macro level.

So first of all, at the top line things are definitely improving, right? We're seeing far less pricing pressure.

In fact, if anything, we're able to lean in on pricing, we are starting to see people have more control over their budgets and starting to recognize that if they need to invest in security, and in many cases, they've got a technical debt that builds up over the course of the pandemic that they now need to catch up on. One of the other trends that we're seeing that we're following very closely is there's also an emergence of kind of the haves and the have-nots, particularly in our healthcare providers where the larger systems, those that are well-funded, are doing quite well and are starting to lean in very heavily on security.

They're starting to consolidate. The example we gave earlier on the call is a great example where they're now looking out to their affiliates and the rest of the network saying, "Hey, we need to see the same security posture that we have here back at the home office."

We're also seeing the emergence of the have-nots, right, where there are some providers that were beat up very heavily in the - during the crisis. We are continuing to work with them.

That's where they've got a little more pressure. And frankly, in a lot of cases, that's where we're going to see consolidation.

But the strategy we put in place about a year ago, and we talked about it on these calls, to start becoming much more relevant to the larger practices is working out well. So in a lot of ways, we saw this shift at the start of the pandemic, we shifted to make sure our services were relevant, and so far, that's paying off.

That's great. And then maybe shifting gears a little bit.

The gross margin benefit in the quarter, I understand some of it was tax benefit related. But 39% gross margin was a nice improvement year-over-year and sequentially.

I'm curious if that is sustainable? Do we grow from here?

Or how should we be thinking about that base gross margin number?

Paul, I don't know if you want to cover that one?

Yes, we do think it's - no, no, there was no problem. We do think it's sustainable at these revenue levels, but then we obviously would expect it to improve as revenue grows.

Say, just if you could give me and I know it's a moving target quarter-to-quarter, but unless you're adding some of the marketing expenses with growth opportunities. But trying to get a sense on kind of a breakeven revenue of cash flow neutral, what revenue number do you need to get cash flow neutral on an EBITDA basis, adjusted?

Yes. We still target around that 5.5% to 6% range, is our target.

Okay. For the breakeven?

Yes. That's right.

Do you guys know of any restrictions that prevents our Board Members from buying shares? Because I observe a lack of shareholder buying from our current Board, the strategy that they're implementing, one would assume would help lead to growth in the future.

And it's - as a shareholder, it dismays me that they're not investing in it. So I wondered if you - if there's any restrictions on that that you could talk about.

Now we have been in a closed window, Avi, for at least at this point, in excess of 6 months. We've been in a closed trading window.

So yes, there has been some limitations on the Board and their ability to trade currently.

Is that open at any time soon so we can possibly see some insider buying?

That is the expectation. As you know, we didn't file our proxy.

We're still finalizing Board agenda items. Those finalization of Board agenda items will limit our ability to open up that close trading window.

But we do anticipate getting that done in the next few weeks.

Okay. And then Caleb talks about - I mean, obviously, a lot of people are aware of an environment that seems profoundly good for a company that provides cybersecurity services.

But your pre-sold is roughly flat sequentially. Your deferred revenue is down 40%.

I'm trying to get a sense of kind of what are we missing here? What does it take on to take for us to sort of benefit from the overall environment?

I think the biggest thing, Avi, which we talked about last February and March when we entered the pandemic, we purposely pulled back significantly from a marketing perspective. That was a roughly discretionary cost that gave us the ability to throttle back significantly.

And not only was that about saving money at the time, but also it was nearly impossible to get a message out, both with new cycles and being shut down with both COVID as well as all the election crazy and the capital riots. Now we're starting to lean back in on that, both from an investment perspective as well as there's an open window.

I mean, we've had 3 broadcast news segments in the last week including NBC nightly earlier this week. You couldn't have done that 3 or 4 months ago.

So we've still got work to do. But at the end of the day, the barrier there for us is brand awareness and getting that top of the funnel built.

So that's where you're going to see us start to lean in heavily, Avi. The other thing here too, I mean, look, if you take a look at our website, our website looks like it was built in 1995, right?

We've got to get that retooled and that's the other side of this that we're working on. I mean that sounds minor, but it actually makes a really significant difference.

So I just want to dig into this a little bit, Caleb, because you talk about brand awareness, but we constantly come up on top within the healthcare industry of having a great brand. So I'm just - I'm trying to understand, I mean, are we - I'm trying to understand your goals.

Are we pursuing big elephant contracts or smaller contracts? How are we allocating that?

And when I - and one other question is, when I talk to competitors, many of them saw the same things you saw during the COVID - early COVID period, which was a huge retrenchment. But many of them I thought were like it's all rebounded and we're forecasting double-digit growth this year.

Yet we are not seeing the same thing. And I'm just trying to understand why.

I guess we've said, we've delayed your spending, but the whole industry should help lift us up too.

The industry will certainly help, investment in this area will help, and we're starting to create slowly the free cash flow to be able to invest further in that. In addition to that, Avi, I think the - just like healthcare was the first to enter the pandemic, they'll be one of the last to clear out now granted I think they've started to accelerate their cybersecurity investments.

But although restaurants are back open in most places, most emergency rooms still have COVID patients. So we've got a little bit of a delay there.

But like I said in the earlier comments, we're very optimistic on where this is headed. But also the difference here is we're not dependent on one market like we were before.

We've used this time to retool to make sure that we're relevant in adjacencies and we started to see some nice progress there as well.

And finally, can you - would you disclose what pre-sold is as of today? Or at least how it compares to how it was at quarter end?

Yes. But we can't do that right now.

We don't traditionally give guidance. I can tell you that we were - as Caleb mentioned in his comments, we had a nice close that occurred going into Q2.

So we're happy with the way Q2 has started. And so that's a positive sign.

Good tone to the call. And certainly, as you laid out, Caleb, we're having - I mean, the backdrop in the industry seems to be very positive for the growth of this company for this year.

Just a quick question. The bookings for the quarter, can you give us what the bookings number was for Q1?

Yes. We don't traditionally provide the bookings number, Mike.

I mean, you can back into a rough estimate of that number just by looking at the movement in pre-sold and revenue, but we don't provide that number.

Well, can you start? I mean, it'd be very helpful to us if we understood the KPIs that both you and the Board are using to measure the progress of this company.

And certainly for me, bookings is - would be a big contributor to understand how this company is moving forward? Or what is giving you the confidence that this company is moving forward?

Yes. I understand.

And again, we'll take that into consideration and see if we can try to provide some update. At least at this point, pre-sold is kind of where we're focused on as it relates to information that's out there to give you the best indication.

Right. But we have to back into that.

I mean, the prior call we just kind of asked that question and we couldn't get an answer. But bookings would be helpful.

Again, your competitors give out that business. It's - it would be very helpful for us to understand.

And it's a - we're going to see the bookings number increase certainly as we should, prior to seeing a turnaround in the top line.

Yes. Understand.

Like I said, we'll take that into consideration for the next call.

Okay. Caleb, you mentioned that we now have 9 direct resellers.

Is that correct?

No, not resellers, direct sellers.

Direct sellers. Okay.

Sorry. Direct sellers.

And how does that compare to where we were a year ago?

I don't remember off the top of my head exactly where we were a year ago. We had had a significant departure.

I mean, when I started back in August of 2019, we didn't have a head of sales and we were at 4 or 5 sellers, several of which have since left. I mean, we had to completely retool the sales team.

And to be completely transparent there too, we had some turnover of sales during the pandemic as well. So this has been a nothing I'm proud of, but we'll be very transparent there.

We've had some work to do there and I feel like we're getting ahead of that.

Okay. Yes, I know that's been a - that's been a big issue that unfortunately was out of your control, but you've rebuilt the sales team over the past 1.5 years.

So we have 9 direct sales force -

Not only have we built it, we've also tried to really bring in - well, this is true across all positions. Our Head of HR is very good at this.

Every time we have a departure, we really sit back as an executive team and say, okay, what's the profile we need to take next to really try to upscale and up level. And what I'm really also very pleased with is all of our sellers today have a very robust cybersecurity background.

So they can talk the talk and walk the walk.

Okay. Got it.

Okay. Maybe we can talk a little bit.

I don't want to belabor the point and you've already kind of laid the groundwork between SolarWinds, the Colonial Pipeline, Scripps, which is new University of Vermont. There is enough anecdotal evidence out there at this point of some big headlines in the private sector that I would think that this has moved up the priority list for spend for 2021 with a lot of companies in the healthcare system and the industry.

So what more is it going to take before we start seeing more contract announcements and again, our bookings really start to increase?

Well, I mean, obviously that's where we're focused on every day, right? And any time we get something meaningful that we can talk about, a lot of times we have clients that won't allow us to talk about their deals even if blinded just because they're security-related.

But we work hard to give you as much guidance as we can on that. As we said earlier, I've got a high degree of confidence of where we're headed next in terms of that rebound.

And here's the thing, you asked kind of about the mindset. You have to remember, particularly in healthcare, the biggest issues historically were data loss.

And the way you dealt with that risk was to buy cyber insurance, right? If you lost data, it was a bad day, you had to pay fines.

It probably came with a reputation loss, but you could defer that risk to cyber insurance. The reality now that I think every board is realizing is you can't defer the risk of a shutdown to cyber insurance.

First of all, the insurance carriers have gotten very smart. They're starting to require specific features and functions be in place if you're even going to be insured.

But also now you've got the cost of downtime if you're locked up. Now I think everybody on the phone here will understand it takes some time for that to work through boards to realize I got to move money to invest in this, and we're really seeing that movement and that dialogue.

And one of the ways I see that early sign too is we're getting called into more and more board meetings. We are presenting the boards, helping them understand their strategy and where they need to go.

So it's going to take a little bit of time. Some of this is we're digging out of a hole.

But at the same time, I'm very optimistic on where we're starting to see this go.

Okay. And let's touch on CMMC a little bit.

You've had some wins, which has been terrific. Can you kind of walk us through the process of where we are in regards to approvals with the government?

And I guess when is this going to start to be implemented? Or when is the government going to - DOD going to start mandating that this is implemented?

Well, so like all government projects, there are - there have been various starts, stops and iterations on this. As the government stands up, the nonprofit that we'll be managing that is called the CMMC-AB.

They seem to be coming together in coalescing. They've just anointed their first CEO.

So they're kind of moving from volunteers to being a real entity. What we have to do, and we're in the same boat as a few others, we're one of the first in queue.

And what we have to do because there's nobody to assess the initial assessors, we have to go through an assessment that's being run by the DIV CAPE or the Department of Defense. That assessment is underway literally this week.

We've - pretty much the entire executive team has been on calls all week going through that audit. What I will tell you is that, we're learning a lot about this program through being one of the first to go through it.

It is far more in-depth and far more comprehensive than I think anybody understands. I mean just to give you a simple metric, when we're a what, 106-, 107-person company, when I print out our security policies and practices, just the bare minimum, it is 3.5 inches thick.

Every single word in there matters, every single reference has to be proven, and we have to have evidence to back it all up. That's what we're going through now.

Now we have to pass that assessment. And then where we go from there is then we and the initial kind of cadre of assessors get approved to actually get started with this work.

It appears like the DOD is very anxious to get this work going. And they just need now to get the first few companies through this assessment process.

And like I said, we're right now one of the first in que. We've got to pass it.

So far, so good, and we'll obviously let the street know when we get that official nod.

I appreciate that. Caleb, I just wanted to piggyback on some of the questions that some others have basically called out here and it's in regards to revenue being generated in your sales force.

And so I had a couple of questions along those lines. The first question is, does the company have any type of strategic relationships with other companies that may help to, for lack of a better term, shoehorn business into you from a cybersecurity perspective?

We have multiple relationships with technology vendors that provide technology that we use in our services. So for example, our patient privacy monitoring, compromise assessments, incident response as examples, right?

The company historically has been a bit shy of kind of traditional partnership relationships where we're either getting a cut of that business and/or where we might be getting a referral credit. And that is because we really wanted to maintain a level of being agnostic.

I think what we've learned in both Ben Dankers, who really runs our operations and delivery, as well as myself have had a lot of experience doing this in prior companies. And we believe that there is a way to thread that needle right, where you can be agnostic, but you still might have a preferred vendor.

And in a lot of ways, that can be beneficial to our clients as well because oftentimes, it allows them to put an entire solution on one piece of paper, one contract. So we started some early experiments there.

And I think that is an area where we want to lean in more. Certainly not to the extent of being viewed as a reseller, if you will, but I do think there's an opportunity there.

You also have to recognize we sit on a data set that basically articulates everything everybody needs, right? I mean, in every client we go into that we do an assessment, we know all the security solutions they have in place, we know what they don't have in place, we know what their budgets look like, we know what their skills look like.

So we do sit in an interesting position where we cannot only advice, but we can do some matchmaking. And that's an area where Ben and I want to lean in a bit more in the future.

Okay. That's helpful.

And so with that being said, like I said, my questions are more so still around sales and generating the sales because it seems like you've had a lot of really great opportunities over the last year in terms of cost cutting measures. But as some other investors have mentioned, the revenue doesn't seem to be really spiking given the times and given the situation that some of your competitors may have.

And so I'm just wanting to kind of hammer a little bit more at that to kind of understand what the difference is. In terms of, for example, this most recent situation, are you - and if so, how are you planning on incorporating this into kind of your sales process to try and generate business?

Well, Timothy, the first thing to recognize, especially in the midst of a crisis like a pandemic where our clients were, in some cases, going bankrupt or closing down because they needed to only take in COVID patients, you got to survive in order to grow, right? So we quickly switched into survival mode.

The important thing there is we made it out the other side. And now we've got to flip into the growth mode.

Now if you look at the recent situation, the best way for us to capitalize on that is to really flip into the educational mode. We're out there on everything from social media and webcasts talking about it.

But we're also advising our clients privately. I mean one of the things that our investor community doesn't see is that in all of our managed services, we give our clients the opportunity to open a ticket with us and ask us a question at any time and get one of our experts on the phone.

And anytime something like this happens, our tickets will shoot through the roof as clients want to understand, hey, what do I need to do to protect myself against this, what do I need to know about this that may not be in the public realm, and how does this change my strategy. So you can imagine we've been having a lot of those conversations.

And what ultimately comes out of that is helping clients lay out their budgets to deal with this. And as anyone that's worked in any bureaucratic organization like a hospital understands, you help them to lay out their budgets today, you're going to see the return from that 3 to 6 months later when they can actually get that budget approved.

Okay. So with that being the case, I know you've talked about not being able to provide numbers.

But in general, are you guys seeing a pretty big uptick in terms of business being generated now that we are kind of on the back end of the pandemic, well, hopefully? And then finally, this will be my last question on top of the one I just asked, but I'm curious as to what your sales force is saying the main challenges are in terms of getting business and securing contracts.

Is it securing those initial meetings to be able to kind of give the pitch due to the website, potentially discouraging some clients from moving forward with doing business with you or brand recognition as you mentioned? Or is it a matter of them getting the business and not being able to necessarily close the sales?

What are you hearing from your sales force in terms of that?

Top line marketing and lead generation. That's the - we - if you think about also the way in which all of us buy products today, right, and this is going to be surprise to anybody, but we were predominantly face-to-face.

Our marketing traditionally would bring people together face-to-face at events. Well, not only are these things gone, but they're never coming back in the same way.

So having that digital onboarding, that digital presence, that top-of-the-line marketing funnel is more critical today than it ever was. And we've been busy over the last couple of months building the back end for that.

And now what we need to do is turn on the front-end experience. And our sellers have been very involved in that.

They're very excited about where we're headed, but that's exactly what they need.

Well, look, in closing, it's been great to see our employees getting shots in their arms. We're starting to travel again.

Our customers are beginning to open up and they're even being willing to have face-to-face conversations for the first time in a year. I anticipate that our sales team is going to be back on the road, if you will, regularly as we move into Q3.

That said, we do plan to capitalize on certain efficiencies that we've learned throughout the pandemic, including largely remote delivery of our services. And I just want to take a minute here to say thank you to our customers, our employees and our investors for their support throughout this pandemic as we got through it.

And I think in the end, we've all learned a new way to work. With that, thank you.