CYNERGISTEK, INC - Annual Report: 2017 (Form 10-K)

i

1

Background

As described in more detail in our Current Report on Form 8-K filed with the Securities and Exchange Commission on September 8, 2017, Auxilio, Inc., changed its name and state of incorporation from the State of Nevada to the State of Delaware by merging (the “Reincorporation”) with and into its wholly-owned subsidiary, CynergisTek, Inc., a Delaware corporation, which was established for the purpose of the Reincorporation.   As a result of the Reincorporation, Auxilio ceased to exist as a separate entity.  As of the date of the merger, each outstanding share of Auxilio’s common stock was deemed, by operation of law, to represent the same number of shares of our Common Stock.  In accordance with Rule 12g-3 under the Securities Exchange Act of 1934, as amended, the shares of our Common Stock were deemed to be registered under Section 12(b) of the Exchange Act as a successor to Auxilio.  Effective as of September 8, 2017, the Company’s trading symbol changed to “CTEK.”

As part of the Reincorporation, two wholly owned subsidiaries of the Company also changed their corporate names, as follows: (i) Auxilio Solutions, Inc., a California corporation, changed its name to CTEK Solutions, Inc.; and (ii) CynergisTek, Inc., a Texas corporation, changed its name to CTEK Security, Inc. (“CTEK Security”).

To address growing market needs, CynergisTek recently expanded its professional services by offering several different smart-sourced managed services such as remediation, program development, virtual Chief Information Security Officer (“CISO”) and staffing. We also completed automation of our third-party risk management service (Vendor Security Management) and launched a full suite of incident response services to address the growing ransomware and malware attacks that are plaguing healthcare.

2

Most of the competition in the healthcare industry market for IT security services comes from large or niche consulting and technology firms and regional companies that offer multiple approaches but within a much smaller geographic footprint.  Examples include companies like Accenture, KPMG, Deloitte, Dell Secureworks, Fire Eye, Coal Fire, Fortified Health Security and Clearwater Consulting.

We believe our analysis of the competitive landscape shows a very strong opportunity for fully-outsourced and managed services to the healthcare industry, and we believe that we have a strong competitive position in the marketplace due to several important factors:

·We are primarily focused on the healthcare industry. We are not aware of any other vendor or service provider which has the majority of its business dedicated to addressing HIPAA compliance, including printed and stored documents and improving efficiency for the healthcare industry. Our expertise and knowledge base is unmatched in the market. 

·By focusing on healthcare, we believe we enjoy lower turn-around times for service, greater up-sell opportunities, and a deeper service relationship with the customer. 

·We have technology that simplifies how healthcare providers perform annual HIPAA risk analysis, as well as other regulatory and on-going risk assessments, by making it fast, effective, and affordable.  

·We believe our offering provides a unique approach to managed security services. To address workforce and expertise shortages, we can deploy knowledgeable resources to perform a predefined security role on-site or virtually for a defined amount of time, which results in our customers receiving staff with expertise they need while controlling their costs. 

·We are not restricted to any single supplier, which allows us to bring the best hardware and software solutions to our customers. Our approach is to use the most appropriate technology to provide a superior solution without any prejudice as to manufacturer or developer. 

·We maintain a daily connection with our customers, which allows us to provide a detailed strategy and plan for saving the organization time, effort and money in the processes we manage and support. 

·We believe our relationship with healthcare providers gives us an advantage when targeting the larger pool of potential clients in the business associate category. 

·We have a strong referral base within healthcare as a result of serving more than a thousand hospitals and other healthcare clients under managed services agreements. 

3

4

Fluctuations in demand for our products and services are driven by many factors, and a decrease in demand for our products could adversely affect our financial results.

We are subject to fluctuations in demand for our products and services due to a variety of factors, including market transitions, general economic conditions, competition, product obsolescence, technological change, shifts in buying patterns, financial difficulties and budget constraints of our current and potential customers, awareness of security threats to information systems and other factors. While such factors may, in some periods, increase product sales and services, fluctuations in demand can also negatively impact our product sales and services. If demand for our products and solutions declines, whether due to general economic conditions or a shift in buying patterns, our revenues and margins would likely be adversely affected.

We may be subject to data breaches and cyber-attacks which could materially adversely affect our financial condition, our competitive position and operating results.

Data breaches and cyber-attacks could compromise our trade secrets and other sensitive information, be costly to remediate and cause significant damage to our business and reputation. The secure maintenance of this information is critical to our business and reputation. We believe that companies have been increasingly subject to a wide variety of security incidents, cyber-attacks, hacking and phishing attacks, and other attempts to gain unauthorized access. These threats can come from a variety of sources, all ranging in sophistication from an individual hacker to a state-sponsored attack. Cyber threats may be generic, or they may be custom-crafted against our information systems.

Cyber-attacks have become increasingly more prevalent and much harder to detect and defend against. Our network and storage applications, as well as those of our customers, business partners, and third-party providers, may be subject to unauthorized access by hackers or breached due to operator error, malfeasance or other system disruptions. It is often difficult to anticipate or immediately detect such incidents and the damage caused by such incidents. These data breaches and any unauthorized access, misuse or disclosure of our information or intellectual property could compromise our intellectual property and expose sensitive business information. Cyber-attacks on us or our customers, business partners or third-party providers could also cause us to incur significant remediation costs, result in product development delays, disrupt key business operations and divert attention of management and key information technology resources. These incidents could also subject us to liability, expose us to significant expense and cause significant harm to our reputation and business.

5

In addition, we could be subject to claims for damages resulting from loss of data from alleged vulnerabilities in the security of our processors. We also maintain confidential and personally identifiable information about our workers. The integrity and protection of our worker data is critical to our business and our workers have a high expectation that we will adequately protect their personal information.

A breach of data privacy is likely to cause significant disruption of our business operations. Failure to adequately maintain and update our security systems could materially adversely affect our operations and our ability to maintain worker confidence. Failure to prevent unauthorized access to electronic and other confidential information and data breaches could materially adversely affect our financial condition, our competitive position and operating results.

If our customers experience data losses, our brand, reputation and business could be harmed.

A breach of our customers’ network security and systems or other events that cause the loss or public disclosure of, or access by third parties to, our customers’ files or data could have serious negative consequences for our business, including reduced demand for our services, an unwillingness of our customers to use our services, harm to our brand and reputation. The techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently, often are not recognized until launched against a target, and may originate from less regulated or remote areas around the world. As a result, our customers may be unable to proactively prevent these techniques, implement adequate preventative or reactionary measures, or enforce the laws and regulations that govern such activities. If our customers experience any data loss, or any data corruption or inaccuracies, whether caused by security breaches or otherwise, our brand, reputation and business could be harmed.  We believe our risk here is mitigated by the security we employ and the fact that we do not take possession or control of customer sensitive information.

Our insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our policy may not cover any claim against us for loss of data or other indirect or consequential damages. Defending a suit based on any data loss or system disruption, regardless of its merit, could be costly and divert management’s attention.

Healthcare legislation and regulation.  

We are a cybersecurity and information management consulting firm dedicated to serving the healthcare industry. The healthcare industry is highly regulated.  U.S. government agencies continue to implement the extensive requirements of the Patient Protection and Affordable Care Act (the “ACA”). These have both positive and negative impacts on the U.S. healthcare industry with much remaining uncertain as to how various provisions of the ACA will ultimately affect the industry, including our business.  

The use of electronic medical records does not necessarily mean a hospital’s printing demands will decrease, but we cannot be sure whether this will be the case.  Increased adoption and use of electronic medical records may negatively impact our business.  

New legislation or regulation.

As to prospective legislation and regulation, we cannot determine what effect additional state or federal governmental legislation, regulations, or administrative orders would have on our business in the future. New legislation or regulation may require the reformulation of our business to meet new standards, require us to cease operations, impose stricter qualification and/or registration standards, impose additional record keeping, or require expanded consumer protection measures.  Congressional leaders and the current administration have attempted to repeal or modify the ACA.  At this time the Company is not certain as to the impact of federal health care legislation on its business.

6

Our business depends on generating and maintaining ongoing, profitable customer demand for our services and solutions, including through the adaptation and expansion of our services and solutions in response to ongoing changes in technology and offerings, and a significant reduction in such demand or an inability to respond to the evolving technological environment could materially affect our results of operations.

Our revenue and profitability depend on the demand for our services and solutions with favorable margins, which could be negatively affected by numerous factors, many of which are beyond our control and unrelated to our work product. Volatile, negative or uncertain global economic conditions and lower growth in the markets we serve have adversely affected and could in the future adversely affect customer demand for our services and solutions. Our success depends, in part, on our ability to continue to develop and implement services and solutions that anticipate and respond to rapid and continuing changes in technology and offerings to serve the evolving needs of our customers. Technological developments may materially affect the cost and use of technology by our customers. Some technologies may replace some of our services and solutions in the future. This may cause customers to delay spending under existing contracts and engagements and to delay entering into new contracts while they evaluate new technologies. Such delays can negatively impact our results of operations if the pace and level of spending on new technologies is not sufficient to make up any shortfall.

Developments in the industries we serve, which may be rapid, also could shift demand to new services and solutions. If, as a result of new technologies or changes in the industries we serve, our customers demand new services and solutions, we may be less competitive in these new areas or need to make significant investment to meet that demand. Our growth strategy focuses on responding to these types of developments by driving innovation that will enable us to expand our business into new growth areas. We must continually address the challenges of dynamic and accelerating market trends, such as the emergence of advanced persistent threats in the security space, the continued decline in the PC market and the market shift towards mobility and the increasing transition towards cloud-based solutions. If we do not sufficiently invest in new technology and adapt to industry developments, or evolve and expand our business at sufficient speed and scale, or if we do not make the right strategic investments to respond to these developments and successfully drive innovation, our services and solutions, our results of operations, and our ability to develop and maintain a competitive advantage and to execute on our growth strategy could be negatively affected. New product development and introduction involves a significant commitment of time and resources and is subject to a number of risks and challenges including:

7

·Managing the length of the development cycle for new products and product enhancements; 

·Adapting to emerging and evolving industry standards and to technological developments by our competitors and customers; 

·Extending the operation of our products and services to new and evolving platforms, operating systems and hardware products, such as mobile devices; 

·Entering into new or unproven markets with which we have limited experience; 

·Managing new product and service strategies for the markets in which we operate; and 

·Developing or expanding efficient sales channels. 

If we are not successful in managing these risks and challenges, or if our new products, product upgrades and services are not technologically competitive or do not achieve market acceptance, our business and operating results could be adversely affected. We operate in a rapidly evolving environment in which there currently are, and we expect will continue to be, new technology entrants. New services or technologies offered by competitors or new entrants may make our offerings less differentiated or less competitive when compared to other alternatives, which may adversely affect our results of operations. In addition, companies in the industries we serve sometimes seek to achieve economies of scale and other synergies by combining with or acquiring other companies. If one of our current customers merges or consolidates with a company that relies on another provider for the services and solutions we offer, we may lose work from that customer or lose the opportunity to gain additional work if we are not successful in generating new opportunities from the merger or consolidation.

Many of our contracts allow customers to terminate, delay, reduce or eliminate spending on the services and solutions we provide. Additionally, a customer could choose not to retain us for additional stages of a project, try to renegotiate the terms of its contract or cancel or delay additional planned work. When contracts are terminated or not renewed, we lose the anticipated revenues, and it may take significant time to replace the level of revenues lost. Consequently, our results of operations in subsequent periods could be materially lower than expected. The specific business or financial condition of a customer, changes in management and changes in a customer’s strategy are also all factors that can result in terminations, cancellations or delays.

Achieving the desired benefits of recent acquisitions may be subject to a number of challenges and uncertainties which make it hard to predict the future success of each entity.

We have completed several acquisitions in recent years with expected benefits including, among other things, operating efficiencies, procurement savings, innovation, sharing of best practices and increased market share that may allow for future growth.  Achieving the anticipated benefits may be subject to a number of significant challenges and uncertainties, including, without limitation, whether unique corporate cultures will work collaboratively in an efficient and effective manner, the coordination of separate organizations, the possibility of imprecise assumptions underlying expectations regarding potential synergies and the integration process, unforeseen expenses and delays, and competitive factors in the marketplace.  We could also encounter unforeseen transaction and integration-related costs or other circumstances such as unforeseen liabilities or other issues.  Many of these potential circumstances are outside of our control and any of them could result in increased costs, decreased revenue, decreased synergies and the diversion of management time and attention.  If we are unable to achieve our objectives within the anticipated time frame, or at all, the expected benefits may not be realized fully or at all, or may take longer to realize than expected, which could have an adverse effect on our business, financial condition and results of operations.

Our business and operations expose us to numerous legal and regulatory requirements, and any violation of these requirements could harm our business.

8

We are subject to numerous federal and state legal requirements on matters as diverse as data privacy and protection, employment and labor relations, immigration, taxation, anticorruption, import/export controls, trade restrictions, internal and disclosure control obligations, securities regulation and anti-competition. Compliance with diverse and changing legal requirements is costly, time-consuming and requires significant resources. We also conduct business in certain identified growth areas, such as health information technology, which are highly regulated and may expose us to increased compliance risk. Violations of one or more of these diverse legal requirements in the conduct of our business could result in significant fines and other damages, criminal sanctions against us or our officers, prohibitions on doing business and damage to our reputation. Violations of these regulations or contractual obligations related to regulatory compliance in connection with the performance of customer contracts could also result in liability for significant monetary damages, fines and/or criminal prosecution, unfavorable publicity and other reputational damage, restrictions on our ability to compete for certain work and allegations by our customers that we have not performed our contractual obligations.

We are party with BMO Harris Bank, N.A. (the “Bank”), to, and jointly and severally liable with our subsidiaries for approximately $17.25 million of outstanding debt under term loans issued under our Credit Agreement, with the Bank (the “Credit Agreement”). The maturity date of the term loan is September 12, 2022.  We also have available a revolving line of credit from the Bank of up to $5.0 million.  Further, we are indebted to the former shareholders of CTEK Security, Inc. in the aggregate principal amount of approximately $6.3 million pursuant to promissory notes with maturity dates ranging from January 2019 to March 2023.  Our resulting substantial level of indebtedness and other financial obligations increase the possibility that we may be unable to pay, when due, the principal of, interest on, or other amounts due in respect of, our indebtedness.  Further, under the Credit Agreement, we are subject to certain restrictive covenants that, among other things, may limit our ability to obtain additional financing for working capital requirements, product development activities, debt service requirements, and general corporate or other purposes. These restrictive covenants include, without limitation, restrictions on our ability to: (1) change the nature of our business; (2) incur additional indebtedness; (3) incur liens; (4) make certain investments; (5) make certain dispositions of assets; (6) merge, dissolve, consolidate or sell all or substantially all of our assets; (7) declare or pay dividends, (8) purchase, redeem, acquire or retire any of our capital stock; and (9) enter into certain transactions with affiliates.  If we breach any of these restrictive covenants or are unable to pay our indebtedness under the Credit Agreement when due, this could result in a default under the Credit Agreement. In such event, the Bank may elect (after the expiration of any applicable notice or grace periods) to declare all outstanding borrowings, together with accrued and unpaid interest and other amounts payable under the Credit Agreement, to be immediately due and payable. Any such occurrence would have an immediate and materially adverse impact on our business and results of operations. The Credit Agreement is secured by a security interest in all assets of the Company and its subsidiaries.  

9

Risks Related to the Market for Our Securities

10

Our stockholders may experience dilution.

We anticipate that we may raise substantial additional capital to achieve our business objectives. We have an effective shelf registration statement under which we have the current ability to raise up to $15 million through the issuance of equity or debt securities.  We cannot assure you that we will be able to sell shares or other securities in any offering at a price per share that is equal to or greater than the price per share paid by investors in previous offerings, and investors purchasing shares or other securities in the future could have rights superior to existing stockholders. The price per share at which we sell additional shares of our Common Stock or other securities convertible into or exchangeable for our Common Stock in future transactions may be higher or lower than the price per share in previous offerings. The future issuance of the Company’s equity securities will further dilute the ownership of our outstanding Common Stock.  The market price of our Common Stock has been, and may continue to be, highly volatile, and such volatility could cause the market price of our Common Stock to decrease and could cause stockholders to lose some or all of their investment in our Common Stock.

11

The forward-looking statements contained in this Annual Report may prove incorrect.

This Annual Report contains certain forward-looking statements. These forward-looking statements are based largely on our current expectations and are subject to a number of risks and uncertainties. Actual results could differ materially from these forward-looking statements. In addition to the other risks described elsewhere in this “Risk Factors” discussion, important factors to consider in evaluating such forward-looking statements include: (i) changes to external competitive market factors or in our internal budgeting process which might impact trends in our results of operations; (ii) anticipated working capital or other cash requirements; (iii) changes in our business strategy or an inability to execute our strategy due to unanticipated changes in our industry; and (iv) various competitive factors that may prevent us from competing successfully in the marketplace. In light of these risks and uncertainties, many of which are described in greater detail elsewhere in this “Risk Factors” discussion, there can be no assurance that the events predicted in forward-looking statements contained in this Annual Report will, in fact, transpire.  Any negative change in the factors listed above could adversely affect the financial condition and operating results of the Company and its products and services.  

12

On January 13, 2017, the Company effectuated a reverse stock split of its issued and outstanding shares of common stock at a ratio of 1 for 3 (the “Reverse Stock Split”). As a result of the Reverse Stock Split, the Company’s issued and outstanding stock decreased from 24,557,224 to 8,185,936 shares of common stock, all with a par value of $0.001. All information related to Common Stock, stock options, warrants and share price for prior periods has been retroactively adjusted in this Annual Report to give effect to the Reverse Stock Split.

13

We provide a large selection of testing services offered on a standalone basis or customized into a package of services to fit our customers’ needs or offered as an industry accepted methodology-based Risk Assessment that meets requirements outlined by HIPAA and Meaningful Use.

The HIPAA Risk Assessment is our flagship stand-alone service and combines several of our individual technical and physical assessment components into a single engagement aimed specifically at addressing the requirement for both a risk assessment as well as ongoing risk management processes for all organizations with a requirement to comply with HIPAA. We also offer an annual Risk Assessment as the base component of an ongoing holistic compliance management program, Compliance Assist Partner Program (CAPP).

14

We understand that health information privacy means more than just meeting an organization’s HIPAA compliance requirements – it is a business imperative. Our team of consultants is comprised of experienced professionals who have learned their craft both in the classroom and through years of experience as policy makers and in the health care industry. This allows us to provide our customers with expert HIPAA privacy consulting services that evaluate the rigor and effectiveness of their privacy program to ensure the confidentiality of their patients’ health information.

We offer a menu of services to measure and strengthen an organization’s compliance with the HIPAA Privacy Rule, HITECH Breach Notification Rule, Federal Trade Commission consumer protection guidelines and state privacy standards. Using state of the art assessment tools and applying industry best practices, our teams identify areas to strengthen our customers privacy program, recommend solutions, and provide tools and training materials to enhance the culture of privacy and compliance within your organization.

A variety of consulting advisory services are also offered, ranging from using cutting-edge technologies to monitor user access to patient health information to producing exercises replicating the HIPAA/HITECH audit experience that help guide organizations on how to respond to state or federal regulatory enforcement investigations. We can also customize any assessment to address specific organizational requirements. Working with us enables customers to have resources and expertise that they need to accelerate the effectiveness of their privacy program.

To help organizations prepare for audits and investigations, CynergisTek offers a series of audit solutions that help organizations verify and validate that privacy and security programs meet compliance and business objectives. CynergisTek understands the regulatory and compliance environment and can help organizations enhance their risk management efforts through various types of audits. Our Compliance and Audit Services are delivered by our industry experts and provide an overall assessment of your organization’s audit readiness.

We provide a Compliance Assist Partner Program (“CAPP”) that is a fully customizable managed security services support agreement.  The CAPP is offered to both providers and business associates and provides the basic building blocks to help an organization build and maintain their cybersecurity program. This multi-year program provides a fully managed support environment.

We offer a Patient Privacy Monitoring Service (“PPMS”) that supports multiple platforms allowing the customer to select the tool of choice and have a fully managed solution.  

Our Vendor Security Management service is a fully automated SAAS solution employing our proprietary Risk Sonar application.  Our program provides a cloud-based solution with a client portal that enables CynergisTek to conduct security reviews of the customers third-party supply chain vendors and provide the results back to the customer.

Our incident response service provides a proactive approach to assess, define, and prepare for a variety of cyber incidents. Our program ensures an organization has the right technologies, people and processes in place to respond to an incident in an efficient and effective manner. The services will help improve your organization’s ability to respond and recover from a cyber incident ranging from an attack or breach, to a system outage. We offer them as one-time engagements or as a part of a bundled, ongoing Incident Response Managed Service.

We have been an industry leader in document solutions for the healthcare industry for many years, offering hospitals and health systems comprehensive services and solutions to support the document life cycle. We provide a vendor neutral program that enhances security of printed, stored data and digital documents while driving out costs and inefficiencies within the patient information logistical chain.

15

The Company derives its revenue from four sources: (1) document solution services; (2) equipment and software resales; (3) software subscription services, which is comprised of subscription fees from customers accessing the Company’s enterprise cloud computing services and customers purchasing additional ongoing managed services beyond the standard support that is included in the basic software subscription fees; and (4) cybersecurity professional services such as penetration testing, cybersecurity risk assessments and security program strategy development.

The Company commences revenue recognition when all of the following conditions are satisfied:

·there is persuasive evidence of an arrangement;  

·the service has been or is being provided to the customer;  

·the collection of the fees is reasonably assured; and  

·the amount of fees to be paid by the customer is fixed or determinable. 

·Document Solution Services and Equipment Revenue 

Revenue is recognized pursuant to ASC Topic 605, “Revenue Recognition” (ASC 605).  Monthly service and supply revenue is earned monthly during the term of the contract, as services and supplies are provided. Revenues from equipment sales transactions are earned when there is persuasive evidence of an arrangement, delivery and installation have occurred, the sales price has been determined and collectability has been reasonably assured. For equipment that is to be placed at a customer’s location at a future date, revenue is deferred until the placement of such equipment.

We enter into arrangements that include multiple deliverables, which typically consist of the sale of Multi-Function Device (“MFD”) equipment and a support services contract.  We account for each element within an arrangement with multiple deliverables as separate units of accounting.  Revenue is allocated to each unit of accounting under the guidance of ASC Topic 605-25, Multiple-Deliverable Revenue Arrangements, which provides criteria for separating consideration in multiple-deliverable arrangements by establishing a selling price hierarchy for determining the selling price of a deliverable.  The selling price used for each deliverable is based on vendor-specific objective evidence (“VSOE”) if available, third-party evidence if VSOE is not available, or estimated selling price if neither VSOE nor third-party evidence is available.  We are required to determine the best estimate of selling price in a manner that is consistent with that used to determine the price to sell the deliverable on a standalone basis.  We generally do not separately sell MFD equipment or service on a standalone basis.  Therefore, we do not have VSOE for the selling price of these units. As we purchase the equipment, we have third-party evidence of the cost of this element.  We estimate the proceeds from the arrangement to allocate to the service unit based on historical cost experiences.  Based on the relative costs of each unit to the overall cost of the arrangement, we utilize the same relative percentage to allocate the total arrangement proceeds.

The Company’s contracts with customers may include provisions that relate to guaranteed savings amounts and shared savings. Such provisions are considered by management during the Company’s initial proprietary client assessment and are charged and accrued when deemed by management to be probable. The Company’s historical settlement of such amounts has been within management’s estimates.

16

·Software Subscriptions and Managed Services Revenue  

Software subscriptions and managed services revenues are recognized ratably over the contract terms beginning on the commencement date of each contract, which is the date the Company’s service is made available to customers.

Amounts that have been invoiced are recorded in accounts receivable and in deferred revenue or revenue, depending on whether the revenue recognition criteria have been met.

The Company’s software subscription service arrangements are non-cancelable and do not contain refund-type provisions.

·Cybersecurity Professional Services Revenue  

The majority of the Company’s cybersecurity services contracts are on a time and material basis. When these services are not combined with subscription revenues as a single unit of accounting, these revenues are recognized as the services are rendered for time and material contracts, and when the milestones are achieved and accepted by the customer for fixed price contracts.

In May 2014, the FASB issued guidance which provides a single, comprehensive accounting model for revenue arising from contracts with customers. This guidance supersedes most of the existing revenue recognition guidance, including industry-specific guidance. Under this model, revenue is recognized at an amount that a company expects to be entitled to upon transferring control of goods or services to a customer, as opposed to when risks and rewards transfer to a customer. The new guidance also requires additional disclosures about the nature, timing and uncertainty of revenue and cash flow arising from customer contracts, including significant judgments and changes in judgments. Considering the one-year delay in the required adoption date for the guidance as issued in July 2015, the new guidance is effective for us beginning in 2018 and may be applied retrospectively to all prior periods presented or through a cumulative adjustment to the opening retained earnings balance in the year of adoption. We will adopt this standard beginning January 1, 2018 and expect to use the modified retrospective method of adoption. Under the new guidance, based on the nature of our contracts, we expect to continue to recognize revenue in a similar manner as with the current guidance. Additionally, we expect the unit of accounting, that is, the identification of performance obligations, will be consistent with current revenue guidance. Accordingly, the adoption of this standard is not expected to have an material impact on our revenues.

Accounts Receivable Valuation and Related Reserves

We estimate the losses that may result from that portion of our accounts receivable that may not be collectible as a result of the inability of our customers to make required payments.  Management specifically analyzes customer concentration, customer credit-worthiness, current economic trends and changes in customer payment terms when evaluating the adequacy of the allowance for doubtful accounts.  We review past due accounts on a monthly basis and record an allowance for doubtful accounts where we deem appropriate.

New Customer Implementation Costs

We ordinarily incur additional costs to implement our services for new customers.  These costs are comprised primarily of additional labor and support.  These costs are expensed as incurred, and have a negative impact on our statements of operations and cash flows during the implementation phase.

Impairment Review of Goodwill and Intangible Assets

We periodically evaluate our intangible assets and goodwill relating to acquisitions for impairment. Goodwill is not amortized but is evaluated annually at year end for any impairment in the carrying value. We review our intangible assets for impairment on an annual basis or whenever events or changes in circumstances indicate that the carrying value of such assets may not be recoverable. Factors we consider important which could trigger an impairment review include, but are not limited to, the following: significant underperformance relative to expected historical or projected future operating results; significant changes in the manner of our use of the acquired assets or the strategy for our overall business; and a significant negative industry or economic trend for a sustained period.

17

Goodwill and intangible asset impairment assessments are generally determined based on fair value techniques, including determining the estimated future discounted and undiscounted cash flows over the remaining useful life of the asset. Those models require estimates of future revenue, profits, capital expenditures and working capital for each reporting unit. We estimate these amounts by evaluating historical trends, the current state of the Company’s industries and the economy, current budgets, and operating plans. Determining the fair value of reporting units and goodwill includes significant judgment by management and different judgments could yield different results. Any resulting impairment loss could have a material impact on our financial condition and results of operations.

Stock-Based Compensation

Under the fair value recognition provisions of the authoritative guidance, stock-based compensation cost granted to employees is measured at the grant date based on the fair value of the award and is recognized as expense over the requisite service or performance period, which is the vesting period.  Stock options and warrants issued to consultants and other non-employees as compensation for services to be provided to us are accounted for based upon the fair value of the services provided or the estimated fair value of the option or warrant, whichever can be more clearly determined.  We currently use the Black-Scholes option pricing model to determine the fair value of stock options.  The determination of the fair value of stock-based payment awards on the date of grant using an option-pricing model is affected by our stock price as well as assumptions regarding a number of complex and subjective variables.  These variables include our expected stock price volatility over the term of the awards, the expected term of the award, the risk-free interest rate and any expected dividends.  Compensation cost associated with grants of restricted stock units are also measured at fair value on the date of the grant.  We evaluate the assumptions used to value restricted stock units on a quarterly basis.  When factors change, including the market price of the stock, stock-based compensation expense may differ significantly from what has been recorded in the past.  If there are any modifications or cancellations of the underlying unvested securities, we may be required to accelerate, increase or cancel any remaining unearned stock-based compensation expense.

Income Taxes

Deferred tax assets and liabilities are recognized for the future tax consequences attributable to differences between the financial reporting requirements and those imposed under federal and state tax laws.  Deferred taxes are provided for timing differences in the recognition of revenue and expenses for income tax and financial reporting purposes and are measured using enacted tax rates expected to apply to taxable income in the years in which those temporary differences are expected to be recovered or settled.  The effect on deferred tax assets and liabilities of a change in tax rates is recognized in income in the period that includes the enactment date.  Deferred income tax expense represents the change during the period in the deferred tax assets and liabilities.  Realization of the deferred tax asset is dependent on generating sufficient taxable income in future years.  Deferred tax assets are reduced by a valuation allowance when, in the opinion of management, it is more likely than not that some portion or all the deferred tax assets will not be realized. Use of our net operating loss deferred assets may be limited by changes in our ownership.

18

19

Impairment of Goodwill and Intangible Assets

In 2017, we recognized an impairment charge of $180,726 related to the identified intangible assets we acquired with Delphiis, Inc. and Redspin. In 2016, we recognized an impairment charge of $2,633,701 related to the identified intangible assets and goodwill for these same entities.

Depreciation

Depreciation expense increased by $171,765 to $383,419 for the year ended December 31, 2017 compared to the same period in 2016. The increase is due to the additional property and equipment acquired from CTEK Security, Inc. in January 2017.

Amortization

Amortization expense increased by $1,539,079 to $2,080,746 for the year ended December 31, 2017 compared to the $541,667 for same period in 2016. The increase is primarily due to the amortization of the identified intangibles acquired from CTEK Security, Inc. in January 2017.

At December 31, 2017, we revalued the contingent earn-out liability in connection with the acquisition of CTEK Security, Inc. This resulted in an additional expense of $1,394,000. No such activity took place in 2016.

In 2016, the income tax benefit is primarily a result of the reversal of a previously recorded valuation allowance against our deferred tax assets from NOL carryforwards. Management removed the valuation allowance given four consecutive years of earnings and its determination that it is more likely than not that such assets will be realized in future periods.

20

In January 2017, we borrowed $14,000,000 under a five-year term loan agreement with a financial institution where we also have in place the availability of a $5,000,000 line of credit, subject to borrowing base limits. The term loan was used to finance the acquisition of CTEK Security. In March 2018, we restructured our debt by entering into a $17,250,000 term loan with another financial institution while repaying the original lender term loan and $6,750,000 of $9,000,000 of previously subordinated sellers notes. At this time we also agreed to pay $3,750,000 in a promissory note in lieu of earn-out payments and another $343,750 in a promissory note for severance to one of the sellers of CTEK Security, Inc. We also arranged to have a $5,000,000 line of credit with the new financial institution, subject to borrowing base limits.

On October 10, 2017, we filed a registration statement on Form S-3 to register an indeterminate number of securities.  On November 22, 2017, we filed an Amendment No. 1 to such registration statement on Form S-3 to update the information in the registration statement.  The registration statement covers such indeterminate principal amount or number of shares of common stock, debt securities, warrants and number of units of the registrant with an aggregate initial offering price not to exceed $15,000,000. The registration statement on Form S-3 was declared effective on November 22, 2017.

The $17.25 million of outstanding debt under term loan with a maturity date of September 12, 2022 and the promissory notes to the former shareholders of CTEK Security, Inc. in the aggregate principal amount of approximately $6.3 million with maturity dates ranging from January 2019 to March 2023 substantially increase our level of indebtedness and increase the possibility that we may be unable to pay our debts when they become due.  

We may seek additional financing or equity raises; however, there can be no assurance that additional financing will be available on acceptable terms, if at all. Any financing or equity raises may result in dilution to existing stockholders and any debt financing may include restrictive covenants.  Management believes that cash generated from debt and/or equity financing arrangements along with future cash flows from operations, together with cash reserves will be sufficient to sustain our business operations over the next twelve months.

21

22

On February 10, 2018, the Company entered into a First Amendment to Executive Employment Agreement with Michael H. McMillan, the Company’s President and Chief Executive Officer. (the “McMillan Amendment”).  Pursuant to the McMillan Amendment, Mr. McMillan’s employment term was extended through December 31, 2020 and increased Mr. McMillan’s base salary to $334,700 for 2018, and $359,700 for 2019, with the 2020 base salary to be determined by the Company’s Board of Directors at the end of the 2019 calendar year. Mr. McMillan will also be eligible for a bonus of up to $219,375 and $242,798 in 2018 and 2019, respectively, and his 2020 bonus will be up to 67.5% of his base salary. The effective date of the McMillan Amendment is January 1, 2018.  The foregoing description of the McMillan Amendment does not purport to be complete and is qualified in its entirety by reference to the terms of the McMillan Amendment, which is found as Exhibit 10.44 to this Annual Report on Form 10-K.

On February 10, 2018, the Company entered into a First Amendment to Executive Employment Agreement with Paul Anthony, the Company’s Secretary, Treasurer and Chief Financial Officer. (the “Anthony Amendment”).  Pursuant the Anthony Amendment, Mr. Anthony’s employment agreement term was extended through December 31, 2020 and increased Mr. Anthony’s base salary to $284,700 for 2018, and $309,700 for 2019, with the 2020 base salary to be determined by the Company’s Board of Directors at the end of the 2019 calendar year. Mr. Anthony will also be eligible for a bonus of up to $185,625 and $209,047 in 2018 and 2019, respectively, and his 2020 bonus will be up to 67.5% of his base salary.  The effective date of the Anthony Amendment is January 1, 2018. The foregoing description of the Anthony Amendment does not purport to be complete and is qualified in its entirety by reference to the terms of the Anthony Amendment, which is found as Exhibit 10.45 to this Annual Report on Form 10-K

23

24

We have audited the accompanying consolidated balance sheets of CynergisTek, Inc. (formerly Auxilio, Inc.) (the “Company”) as of December 31, 2017 and 2016, the related consolidated statements of operations, stockholders’ equity, and cash flows for each of the years then ended, and the related notes (collectively, the “consolidated financial statements”).  In our opinion, the consolidated financial statements present fairly, in all material respects, the consolidated financial position of the Company as of December 31, 2017 and 2016, and the consolidated results of its operations and its cash flows for each of the years then ended, in conformity with U.S. generally accepted accounting principles.

Basis for Opinion

These consolidated financial statements are the responsibility of the Company’s management. Our responsibility is to express an opinion on the Company’s consolidated financial statements based on our audits.  We are a public accounting firm registered with the Public Company Accounting Oversight Board (United States) (“PCAOB”) and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audits to obtain reasonable assurance about whether the consolidated financial statements are free of material misstatement, whether due to error or fraud.  The Company is not required to have, nor were we engaged to perform, an audit of its internal control over financial reporting. As part of our audits, we are required to obtain an understanding of internal control over financial reporting but not for the purpose of expressing an opinion on the effectiveness of the Company’s internal control over financial reporting.  Accordingly, we express no such opinion.

We have served as the Company’s auditor since 2005.

F-1

F-2

F-3

F-4

F-5

F-6

As described in more detail in our Current Report on Form 8-K filed with the Securities and Exchange Commission on September 8, 2017, Auxilio, Inc., a Nevada corporation (“Auxilio”) changed its name and state of incorporation from the State of Nevada to the State of Delaware by merging (the “Reincorporation”) with and into its wholly-owned subsidiary, CynergisTek, Inc., a Delaware corporation, which was established for the purpose of the Reincorporation.   As a result of the Reincorporation, Auxilio ceased to exist as a separate entity.  As of the date of the merger, each outstanding share of Auxilio’s Common Stock was deemed, by operation of law, to represent the same number of shares of our Common Stock.  In accordance with Rule 12g-3 under the Securities Exchange Act of 1934, as amended, the shares of our Common Stock were deemed to be registered under Section 12(b) of the Exchange Act as a successor to Auxilio.  Effective as of September 8, 2017, the Company’s trading symbol changed to “CTEK.”  

As part of the Reincorporation, two wholly owned subsidiaries of the Company also changed their corporate names, as follows: (i) Auxilio Solutions, Inc., a California corporation, changed its name to CTEK Solutions, Inc.; and (ii) CynergisTek, Inc., a Texas corporation, changed its name to CTEK Security, Inc. (“CTEK Security”).

Effective on January 13, 2017, the Company effected a reverse stock split of its Common Stock at a ratio of 1-for-3. No fractional shares of Common Stock were issued, and no cash or other consideration were paid as a result of the reverse stock split. Instead, the Company issued one whole share of post-reverse stock split Common Stock in lieu of each fractional share of Common Stock. As a result of the reverse stock split, the Company’s Common Stock was reduced to 8,185,936 shares from 24,557,224 shares as of December 31, 2016. All per share amounts and number of shares in the consolidated financial statements and related notes have been retroactively restated to reflect the reverse stock split.

F-7

Revenue Recognition and Deferred Revenue

The Company derives its revenue from four sources: (1) document solution services; (2) equipment and software resales; (3) software subscriptions and managed services, which is comprised of subscription fees from customers accessing the Company’s enterprise cloud computing services and customers purchasing additional ongoing managed services beyond the standard support that is included in the basic software subscription fees; and (4) cybersecurity professional services such as penetration testing, cybersecurity risk assessments and security program strategy development.

The Company commences revenue recognition when all of the following conditions are satisfied:

•there is persuasive evidence of an arrangement;  

•the service has been or is being provided to the customer;  

•the collection of the fees is reasonably assured; and  

•the amount of fees to be paid by the customer is fixed or determinable. 

·Document Solution Services and Equipment Revenue 

Revenue is recognized pursuant to ASC Topic 605, “Revenue Recognition” (ASC 605).  Monthly service and supply revenue is earned monthly during the term of the contract, as services and supplies are provided. Revenues from equipment sales transactions are earned when there is persuasive evidence of an arrangement, delivery and installation have occurred, the sales price has been determined and collectability has been reasonably assured. For equipment that is to be placed at a customer’s location at a future date, revenue is deferred until the placement of such equipment.

We enter into arrangements that include multiple deliverables, which typically consist of the sale of Multi-Function Device (“MFD”) equipment and a support services contract.  We account for each element within an arrangement with multiple deliverables as separate units of accounting.  Revenue is allocated to each unit of accounting under the guidance of ASC Topic 605-25, Multiple-Deliverable Revenue Arrangements, which provides criteria for separating consideration in multiple-deliverable arrangements by establishing a selling price hierarchy for determining the selling price of a deliverable.  The selling price used for each deliverable is based on vendor-specific objective evidence (“VSOE”) if available, third-party evidence if VSOE is not available, or estimated selling price if neither VSOE nor third-party evidence is available.  We are required to determine the best estimate of selling price in a manner that is consistent with that used to determine the price to sell the deliverable on a standalone basis.  We generally do not separately sell MFD equipment or service on a standalone basis.  Therefore, we do not have VSOE for the selling price of these units. As we purchase the equipment, we have third-party evidence of the cost of this element.  We estimate the proceeds from the arrangement to allocate to the service unit based on historical cost experiences.  Based on the relative costs of each unit to the overall cost of the arrangement, we utilize the same relative percentage to allocate the total arrangement proceeds.

The Company’s contracts with customers may include provisions that relate to guaranteed savings amounts and shared savings. Such provisions are considered by management during the Company’s initial proprietary client assessment and are charged and accrued when deemed by management to be probable. The Company’s historical settlement of such amounts has been within management’s estimates.     

·Software Subscriptions and Managed Services Revenue  

Software subscriptions and managed services revenues are recognized ratably over the contract terms beginning on the commencement date of each contract, which is the date the Company’s service is made available to customers.

F-8

Amounts that have been invoiced are recorded in accounts receivable and in deferred revenue or revenue, depending on whether the revenue recognition criteria have been met.

The Company’s software subscription service arrangements are non-cancelable and do not contain refund-type provisions.

·Cybersecurity Professional Services Revenues  

The majority of the Company’s cybersecurity services contracts are on a time and material basis. When these services are not combined with subscription revenues as a single unit of accounting, these revenues are recognized as the services are rendered for time and material contracts, and when the milestones are achieved and accepted by the customer for fixed price contracts.

New Customer Implementation Costs

We ordinarily incur additional costs to implement our managed print services for new customers.  These costs are comprised primarily of additional labor and support.  These costs are expensed as incurred and have a negative impact on our statements of operations and cash flows during the implementation phase.

F-9

Goodwill and Intangible Assets

F-10

The fair value hierarchy consists of three broad levels, which are described below:

Level 1 - Quoted prices in active markets for identical assets or liabilities that the entity has the ability to access.

Level 2 - Observable inputs, other than quoted prices included in Level 1, such as quoted prices for similar assets and liabilities in active markets; quoted prices for identical or similar assets and liabilities in markets that are not active; or other inputs that are observable or can be corroborated by observable market data.

Level 3 - Unobservable inputs that are supported by little or no market activity and that are significant to the fair value of the assets and liabilities. This includes certain pricing models, discounted cash flow methodologies and similar techniques that use significant unobservable inputs.

We account for stock options granted to consultants using the accounting guidance included in ASC 505-50 “Equity-Based Payments to Non-Employees.”  In accordance with ASC 505-50, we estimate the fair value of service-based stock options and performance-based options at each reporting period using the Black-Scholes pricing model.  The measurement date of the fair value of the equity instrument issued is the earlier of the date on which the counterparty’s performance is complete or the date on which it is probable that performance will occur.

F-11

F-12

In February 2016, the FASB issued a new accounting standard on leasing. The new standard will require companies to record most leased assets and liabilities on the balance sheet, and also proposes a dual model for recognizing expense. This guidance will be effective in the first quarter of 2019 with early adoption permitted. We have evaluated the impact of adopting this guidance and we are preparing for the changes to be made to our consolidated financial statements. We expect the adoption of these accounting changes will materially increase our assets and liabilities but will not have a material impact on our net income or equity.

F-13

In January 2017, the FASB issued a new accounting standard simplifying the test for goodwill impairment. Currently, the fair value of the reporting unit is compared with the carrying value of the reporting unit (identified as "Step 1"). If the fair value of the reporting unit is lower than its carrying amount, then the implied fair value of goodwill is calculated. If the implied fair value of goodwill is lower than the carrying value of goodwill an impairment is recognized (identified as "Step 2"). The new standard eliminates Step 2 from the impairment test; therefore, a goodwill impairment will be recognized as the difference of the fair value and the carrying value. The new standard becomes effective on January 1, 2020 with early adoption permitted. We are currently evaluating the impact that the new standard will have on our financial position, results of operations and cash flows.

In March 2016, the FASB issued new accounting standard which simplified certain aspects of the accounting for stock-based payment transactions, including income taxes, classification of awards and classification in the statement of cash flows. This guidance was effective for annual reporting periods beginning after December 15, 2016 and interim periods within those annual periods. The adoption of this standard did not have a material impact on its consolidated financial statements and disclosures.

In August 2016, the FASB issued new accounting standard which is intended to reduce the existing diversity in practice in how certain cash receipts and cash payments are classified in the statement of cash flows. This guidance is effective for fiscal years beginning after December 15, 2018, including interim periods within those fiscal years with early adoption permitted, provided that all of the amendments are adopted in the same period. We are currently evaluating the impact of adopting this standard on our consolidated financial statements.

In January 2017, the FASB issued new accounting standard which clarifies the definition of a business with the objective of adding guidance to assist entities with evaluating whether transactions should be accounted for as acquisitions or disposals of assets or businesses. This guidance will be effective for the Company for the year ending December 31, 2019 and interim reporting periods within that year. Early adoption is permitted for transactions that have not been reported in financial statements that have been issued or made available for issuance. We are currently evaluating the effect of the adoption of this guidance on our consolidated financial statements.

In May 2017, the FASB issued new accounting standard which provides guidance about which changes to the terms or conditions of a share-based payment award require an entity to apply modification accounting in ASC Topic 718. Under the new guidance, modification accounting is required only if the fair value, the vesting conditions, or the classification of the award (as equity or liability) changes as a result of the change in terms or conditions. This guidance will be effective for the year ending December 31, 2019 and interim reporting periods within that year. Early adoption is permitted. We expect the adoption of this guidance will not have a material effect on our consolidated financial statements or footnotes.

F-14

(4)Intangible Assets and Goodwill 

F-15

The amortization of intangible assets expected in future years is as follows:

Goodwill

Goodwill consists of the following as of December 31, 2017 and 2016:

F-16

When the Company performed its annual impairment testing for Delphiis, Inc. and Redspin as of December 31, 2017 and 2016, we concluded there were indicators of potential intangible asset and goodwill impairment based on the performance of these business units and changes in the Company’s short and long-term strategy and outlook for these units.

The Company first performed a quantitative impairment analysis of the intangible assets and then a quantitative impairment analysis of goodwill as of December 31, 2017 and 2016. With respect to the intangible asset analysis, management estimated future undiscounted free cash flows associated with the intangibles assets and determined that they were less than the related carrying values. As a result, the Company recognized aggregate impairment charges of $180,726 and $1,077,188 for the years ended December 31, 2017 and 2016 respectively. With respect to the goodwill analysis, in 2016 management estimated the fair value of the reporting units and determined that such amounts were less than the carrying values. Management then determined that the implied fair value of goodwill of the reporting units was less than the carrying value of goodwill and an aggregate $1,556,513 impairment charge was recorded. This same analysis was performed in 2017 and management determined no further impairment was evident.

(5)Line of Credit and Term Loan 

On May 4, 2012, we entered into a Loan and Security Agreement (the “Loan and Security Agreement”) with Avidbank Corporate Finance, a Division of Avidbank (“Avidbank”).  On April 26, 2013, we amended the Loan and Security Agreement with Avidbank. On April 25, 2014, we again amended the Loan and Security Agreement with Avidbank (the “Second Avidbank Amendment”). This line of credit was further extended through June 25, 2015 under the third amendment to the Loan and Security Agreement. On June 19, 2015, we again amended the Loan and Security Agreement with Avidbank (the “Fourth Avidbank Amendment”). Under the Fourth Avidbank Amendment, the term of the revolving line-of-credit of up to $2.0 million was extended through June 19, 2017, at an interest rate of prime plus 0.75% per annum.  On January 13, 2017, as part of the acquisition of CTEK Security, Inc. (formerly CynergisTek, Inc.), we entered into an Amended and Restated Credit Agreement (the “A&R Credit Agreement”) with California Bank and Trust and Avidbank (collectively the “Lenders”). Under the A&R Credit Agreement, the term of the revolving line-of-credit is available through January 13, 2019 at an interest rate of prime plus 1.0% per annum. As of December 31, 2017, the interest rate was 5.5%.  There will be no minimum interest payable with respect to any calendar quarter. The amount available to us at any given time is the lesser of (a) $5.0 million, or (b) the amount available under our borrowing base (80% of our eligible accounts receivable, minus (1) accrued client lease payables, and minus (2) accrued equipment pool liability). As of December 31, 2017, and December 31, 2016, no amounts were outstanding under the line of credit.

F-17

The Fourth Avidbank Amendment provided for a term loan facility which allowed for advances up to $4,000,000 through June 19, 2016. Our initial draw was for $2,000,000 in 2015. As of December 31, 2016, outstanding borrowings under the term loan were $1,250,000 at an interest rate of 4.75%. On January 13, 2017, this loan was repaid in full. On that date, we entered into the A&R Credit Agreement which provided a term loan facility for $14,000,000. Term loan repayments are to be made in 48 monthly principal installments of $198,333, plus accrued interest at an interest rate of prime plus 1.5% per annum, followed by 12 monthly principal installments of $373,333, plus accrued interest at an interest rate of prime plus 1.5%.  As of December 31, 2017, outstanding borrowings under the term loan were $11,818,333 at an interest rate of 6.0%.

While there are outstanding credit extensions, we are to maintain an asset coverage ratio of cash plus accounts receivable divided by all obligations owing to the bank within one year of at least 1.50 to 1.00, measured monthly, and a fixed charge coverage ratio, whereby adjusted EBITDA for the most recent twelve months shall be no less than 1.15 to 1.00 of the sum of the following: (i) Non-Financed Capital Expenditures, (ii) taxes paid in cash during such period, (iii) Distributions paid in cash during such period, (iv) any Earnout Payment paid in cash during such period, and (v) Debt Service for such period, all as determined in accordance with GAAP. To our knowledge, we were in compliance with all covenants as of December 31, 2017 and December 31, 2016.

In connection with the A&R Credit Agreement, the Company and its subsidiaries (collectively the “Borrowers”) entered into a security agreement (the “Security Agreement”), pursuant to which each of the Borrowers agreed to grant to Avidbank, in its capacity as contractual representative for itself and the other lender (the “Agent”), for the ratable benefit of itself, the Lenders and the other secured parties, a first priority security interest in certain collateral to secure prompt payment and performance of the secured obligations under the A&R Credit Agreement.  Pursuant to the Security Agreement, the “Collateral” was defined as including any and all (all such terms as defined in the Security Agreement) of the Accounts, Chattel Paper, Commercial Tort Claims, Deposit Accounts, Documents, Equipment, Instruments, Inventory, Investment Property, General Intangibles, Letter of Credit Rights, Negotiable Collateral, Supporting Obligations, Vehicles, Grantors’ Books, in each case whether now existing or hereafter acquired or created, any money or other assets of any Grantor that now or hereafter come into the possession, custody, or control of Agent and any Proceeds or products of any of the foregoing, or any portion thereof.  In connection with the grant of the security interest in the Collateral, each of the Borrowers made standard representations and warranties relating to ownership of the collateral, location and control of the collateral, and certain rights to payment.

F-18

Additionally, in connection with the A&R Credit Agreement and the acquisition of CTEK Security, Inc.  transaction, (see Note 14), Michael Mathews, (“Mathews”), Michael McMillan (“McMillan”), the Company, and Avidbank entered into a subordination agreement (the “Subordination Agreement”), pursuant to which Mathews and McMillan agreed that unless and until all of the Company’s obligations under the A&R Credit Agreement have been repaid in full, Mathews and McMillan would not, except as provided in the Subordination Agreement, ask, demand, sue for, take or receive, or retain, from the Company or any other person or entity, by setoff or in any other manner, payment of all or any part of the Subordinate Debt (as defined below), or take any other action with respect to the Subordinate Debt; forgive, cancel or discharge any of the Subordinate Debt; ask, demand or receive any security for the Subordinate Debt; amend any documents relating to the Subordinate Debt or any other agreement, instrument or document evidencing or executed in connection with the Subordinate Debt in a manner that could reasonably be expected to be adverse to Lenders or Agent (or any other holders of the obligations arising under the A&R Credit Agreement); or bring or join with any creditor in bringing any insolvency proceeding against the Company. Additionally, Mathews and McMillan each directed the Company to make, and the Company agreed to make, such prior payment of the Company’s obligations under the A&R Credit Agreement to Agent and the Lenders.  The Subordination Agreement defines “Subordinate Debt” to include all debt of the Company owing to Mathews and McMillan (or either of them) (a) under the promissory notes due to Mathews and McMillan (the “Seller Notes”) or (b) in respect of the Earn Out Payments (described in Note 14), in either case whether now existing or hereafter arising and including all principal, premium, interest, fees, attorneys’ fees, costs, charges, expenses, reimbursement obligations, any other indemnities or guarantees in each case with respect thereto, in each case whether direct or indirect, absolute or contingent, joint or several, due or not due, primary or secondary, liquidated or unliquidated, secured or unsecured.  So long as the Borrowers are not in default under the terms of the A&R Credit Agreement, the Company may make regular payments to Mathews and McMillan under the Seller Notes.

The foregoing description of the Fourth Amendment to the Loan and Security Agreement between Avidbank and the Company is qualified in its entirety by reference to the terms of the Fourth Amendment to the Loan and Security Agreement, which is found as Exhibit 10.1 of our Form 10-Q filed on August 14, 2015. The foregoing descriptions of the A&R Credit Agreement, Security Agreement and Subordination Agreement are qualified in their entirety by reference to the respective agreements.  These agreements are found in our Form 8-K filed on January 17, 2017 as Exhibits 99.7, 99.8, and 99.9, respectively.

Interest charges associated with borrowings on the line of credit were $1,285 and $0, respectively for the years ended December 31, 2017 and 2016, respectively. In addition, on January 13, 2017, we paid a $25,000 revolving loan commitment fee.

Interest charges associated with the Avidbank term loans, including loan origination costs, totaled $706,872 and $75,801, respectively for the years ended December 31, 2017 and 2016, respectively. In addition, on January 13, 2017, we paid a $70,000 term loan commitment fee.

As additional consideration for the original Loan and Security Agreement, we issued Avidbank a 5-year warrant to purchase up to 24,033 shares of our Common Stock at an exercise price of $4.16 per share. On April 6, 2017 we entered into a warrant repurchase agreement with Avidbank whereby we paid Avidbank $4,743 to repurchase these warrants.

See also Note 15 regarding the March 2018 restructuring of the term loan, line of credit and Sellers Notes.

F-19

(6)Promissory Notes 

In connection with the acquisition of CTEK Security, Inc. (Note 14) we issued two promissory notes totaling $9,000,000 to Dr. Michael G. Mathews and Michael McMillan (the “Seller Notes”), with each of the Seller Notes having an initial principal amount of $4,500,000.  These Seller Notes bear interest at 8% per annum, require quarterly interest-only payments during the first 12 months, quarterly payments of principal and interest during the last 24 months, using a 36-month amortization period commencing from that point, with a balloon payment due on the maturity date.  Amounts due and owing under the Seller Notes are subordinate to the right of payment due under the A&R Credit Agreement pursuant to the Subordination Agreement (Note 5).  The Company has the right to prepay all or any portion of the outstanding principal balance of the Seller Notes, provided that such prepayment is accompanied by accrued interest on the amount of principal prepaid, calculated to the date of such prepayment.

Interest charges associated with the Seller Notes totaled $694,356 for the year ended December 31, 2017.

F-20

F-21

The fair value of restricted stock awards is estimated by the market price of the Company’s Common Stock at the date of grant. Restricted stock activity during the years ended December 31, 2017, and 2016, respectively, are as follows: