VirnetX Holding Corp
For the period ended Sep 30, 2024. Filed Nov 13, 2024.
View on SEC.govAbout this filing
A company's report for each of its first three quarters. The financial statements are not audited. It shows how the business has moved since the last annual report, and what management says changed.
Sep 30, 2024 · Filed Nov 13, 2024
VHC$9.71+2.9%Stored close · as of Nov 6, 2026
What changed in Risk Factors?
Read the current filingPrevious report: 10-Q
Period ended 2024-06-30; filed 2024-08-14.
0001140361-24-037312
Item 1A. — Risk FactorsCurrent report: 10-Q
Period ended 2024-09-30; filed 2024-11-13.
0001140361-24-046446
Item 1A. — Risk FactorsThe baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.
Compared 83 previous paragraphs and 86 current paragraphs.
73 unchanged; 8 reworded; 5 added; 2 removed; 0 previous and 0 current paragraphs rearranged.
Tables are not compared: 34 previous and 34 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.
A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.
Added paragraphs (5)
Current report
We have limited ability to influence the operations of companies we invest in and could lose some or all of our investment.
Current report
In 2023, we invested $2,000 in L2 Holdings, LLC (“OmniTeq”) and $500 in OP Media, Inc. These companies operate in the artificial intelligence sector and have agreed to integrate our family of products and services into their solutions and to resell them to their current and future customers. We do not control these companies and have limited ability to influence the operation or financial activities of either company. If either of these companies is unsuccessful in their endeavors we could lose some or all of our $2,500 investment.
Current report
On August 28, 2024, we received a written notification from the NYSE that as of August 27, 2024, we were not in compliance with the continued listing standards set forth in Section 802.01B of the NYSE Listed Company Manual because the average global market capitalization over a consecutive 30 trading-day period and stockholders’ equity were both less than $50 million. In accordance with applicable NYSE procedures, we submitted a plan to the NYSE on October 11, 2024, advising it of the actions we have taken, are taking and plan to take that would bring us into conformity with the standard set forth in Section 802.01B within 18 months of receipt of the written notification. Upon receipt of our plan, the NYSE has up to 45 days to evaluate the plan and determine whether we have made a reasonable demonstration of our ability to come into conformity with the relevant listing standards. The written notification has no immediate impact on our ongoing business operations, reporting requirements with the SEC or the listing of our common stock on the NYSE at this time, subject to the NYSE’s acceptance of our plan, any further processes required by the NYSE as well as our continued compliance with the plan and the NYSE’s other continued listing standards. We are considering all available options to regain compliance with NYSE’s continued listing standards but can provide no assurances that we will be able to satisfy the requirements of the NYSE.
Removed paragraphs (2)
Previous report
On May 12, 2023, we received a written notification from the NYSE that as of May 11, 2023, we were not in compliance with the continued listing standard set forth in Section 802.01C of the NYSE Listed Company Manual because the average closing price of our common stock was less than $1.00 per share over a consecutive 30 trading-day period. Pursuant Section 802.01C, there is a period of six months following the receipt of the notification to regain compliance with the minimum price criteria. A 1-for-20 reverse stock split was approved by stockholders at the special meeting held on October 24, 2023, a certificate of amendment to our Restated Charter was filed and became effective as of October 25, 2023, and our common stock began trading on a post-split basis on October 26, 2023. As of the end of the cure period, our common stock share price met the applicable requirements and we regained compliance with the minimum share price requirement. However, there can be no assurances that we will maintain compliance as there may be continued volatility and fluctuations in the market price of our common stock.
Reworded paragraphs (8)
Previous wording
Our operating results have fluctuated in the past due to several factors. We expect that our future operating results may also fluctuate due to the same or similar factors. We had a net loss of $3.8 million for the quarter ended June 30, 2024. We had a net loss of $27.9 million for the year ended December 31, 2023. As of June 30, 2024, we had an accumulated deficit of $194.6 million. The following include some of the factors that may cause our operating results to fluctuate:
Current wording
Our operating results have fluctuated in the past due to several factors. We expect that our future operating results may also fluctuate due to the same or similar factors. We had a net loss of $4 million for the quarter ended September 30, 2024. We had a net loss of $27.9 million for the year ended December 31, 2023. As of September 30, 2024, we had an accumulated deficit of $198.5 million. The following include some of the factors that may cause our operating results to fluctuate:
Previous wording
In addition, potential customers of our products include local, state, federal and foreign government agencies, as well as institutions in the defense industry. Sales to government authorities can be extensive and unpredictable. Government authorities generally have complex budgeting, purchasing, and regulatory processes that govern their capital spending, and their spending is likely to be adversely impacted by economic conditions. In addition, in many instances, sales to government authorities may require field trials and may be delayed by the time it takes for government officials to evaluate multiple competing bids, negotiate terms, and award contracts.
Current wording
In addition, potential customers of our products include local, state, federal and foreign government agencies, as well as institutions in the defense industry. Sales processes to government authorities can be extensive and unpredictable. Government authorities generally have complex budgeting, purchasing, and regulatory processes that govern their capital spending, and their spending is likely to be adversely impacted by economic conditions. In addition, in many instances, sales to government authorities may require field trials and may be delayed by the time it takes for government officials to evaluate multiple competing bids, negotiate terms, and award contracts.
Previous wording
For these reasons, the sales cycle associated with our products is subject to a number of significant risks that are beyond our control. Consequently, if customer orders are not realized or delayed, our revenues and results of operations could be materially and adversely affected.
Current wording
For these reasons, the sales cycle associated with our products is subject to a number of significant risks that are beyond our control. Consequently, if customer orders are delayed or not realized, our revenues and results of operations could be materially and adversely affected.
Previous wording
We expect to retain certain confidential and proprietary customer information in our secure data centers and secure domain name registry, as well as personal data and other confidential and proprietary information relating to our business. It will be critical to our business strategy that our facilities and infrastructure remain secure and are perceived by the marketplace to be secure. Our secure domain name registry operations will also depend on our ability to maintain our computer and telecommunications equipment in effective working order and to reasonably protect our systems against interruption, and potentially depend on protection by other registrars in the shared registration system. The secure domain name servers that we will operate will be critical hardware to our registry services operations. Additionally, we maintain confidential and proprietary business information, including trade secrets. We expect to have to expend significant time and money to maintain or increase the security of our products, facilities, and infrastructure. Security technologies are constantly being tested by computer professionals, academics and “hackers.” Advances in computer capabilities and the techniques for attacking security solutions, new discoveries in the field of cryptography or other events or developments could result in compromises or breaches of our security measures and could make some or all our products obsolete or unmarketable. Likewise, we may need to dedicate engineering and other resources to mitigate or eliminate security vulnerabilities and may find it necessary or appropriate to repair or replace products already sold or licensed to our customers. Despite the security measures that we and our service providers utilize, our infrastructure and that of our service providers may be vulnerable to physical break-ins, ransomware, computer viruses, other malicious code attacks by hackers, phishing attacks, social engineering, or similar disruptive problems. There can be no assurances our security measures or those of our service providers will prevent security breaches or incidents. Any disruption or security breach or incident that we or our service providers suffer or are perceived to suffer, including any such disruption, breach or incident resulting in a loss of, or damage to, data or systems, or inappropriate disclosure, access, loss, or other processing of confidential, financial, proprietary or personal information, including data related to our personnel, could result in loss, disclosure or other unauthorized processing of such data, could delay our research and development or commercialization efforts, could compel us to comply with breach notification laws and regulations, subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information. It is possible that we may have to expend additional financial and other resources to address s…
Excerpt shortened here; the source contains the full paragraph.
Current wording
We expect to retain certain confidential and proprietary customer information in our secure data centers and secure domain name registry, as well as personal data and other confidential and proprietary information relating to our business. It will be critical to our business strategy that our facilities and infrastructure remain secure and are perceived by the marketplace to be secure. Our secure domain name registry operations will also depend on our ability to maintain our computer and telecommunications equipment in effective working order and to reasonably protect our systems against interruption, and potentially depend on protection by other registrars in the shared registration system. The secure domain name servers that we will operate will be critical hardware to our registry services operations. Additionally, we maintain confidential and proprietary business information, including trade secrets. We expect to have to expend significant time and money to maintain or increase the security of our products, facilities, and infrastructure. Security technologies are constantly being tested by computer professionals, academics and “hackers.” Advances in computer capabilities and the techniques for attacking security solutions, new discoveries in the field of cryptography or other events or developments could result in compromises or breaches of our security measures and could make some or all our products obsolete or unmarketable. Likewise, we may need to dedicate engineering and other resources to mitigate or eliminate security vulnerabilities and may find it necessary or appropriate to repair or replace products already sold or licensed to our customers. Despite the security measures that we and our service providers utilize, our infrastructure and that of our service providers may be vulnerable to physical break-ins, ransomware, computer viruses, other malicious code attacks by hackers, phishing attacks, social engineering, or similar disruptive problems. There can be no assurances our security measures or those of our service providers will prevent security breaches or incidents. Any disruption or security breach or incident that we or our service providers suffer or are perceived to suffer, including any such disruption, breach or incident resulting in a loss of, or damage to, data or systems, or inappropriate disclosure, access, loss, or other processing of confidential, financial, proprietary or personal information, including data related to our personnel, could result in loss, disclosure or other unauthorized processing of such data, could delay our research and development or commercialization efforts, could compel us to comply with breach notification laws and regulations, subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information. It is possible that we may have to expend additional financial and other resources to address s…
Excerpt shortened here; the source contains the full paragraph.
Previous wording
Personal privacy, information security, and data protection are significant issues in the United States, Europe, and many other jurisdictions where we have operations or offer our products. The regulatory framework governing the collection, processing, storage and use of confidential and proprietary business information and personal data is rapidly evolving. The United States federal and various state and foreign governments have adopted or proposed requirements regarding the collection, distribution, use, security and storage of personally identifiable information and other data relating to individuals, and federal and state consumer protection laws are being applied to enforce regulations related to the online collection, use and dissemination of data.
Current wording
Personal privacy, information security, and data protection are significant issues in the United States, Europe, and many other jurisdictions where we have operations or offer our products. The regulatory framework governing the collection, processing, storage and use of confidential and proprietary business information and personal data is rapidly evolving. The United States federal, various state and foreign governments have adopted or proposed requirements regarding the collection, distribution, use, security and storage of personally identifiable information and other data relating to individuals, and federal and state consumer protection laws are being applied to enforce regulations related to the online collection, use and dissemination of data.
Previous wording
We also expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, the EU, and other jurisdictions. For example, the European Commission adopted a General Data Protection Regulation (the “GDPR”) that became fully effective on May 25, 2018, superseding prior EU data protection legislation, imposing more stringent EU data protection requirements, and providing for greater penalties for noncompliance. The United Kingdom has enacted a Data Protection Act and legislation referred to as the UK GDPR that substantially implements the GDPR and provides for a penalty regime similar to the GDPR. We may be required to incur substantial expense in order to make significant changes to our product and business operations in connection with obtaining and maintaining compliance with the GDPR and similar legislation, such as the UK GDPR and UK Data Protection Act, all of which may adversely affect our revenue and product sales. California has enacted legislation, the California Consumer Privacy Act (the “CCPA”) that, among other things, requires covered companies to provide disclosures to California consumers, and afford such consumers abilities to opt-out of certain sales of personal information. The CCPA was modified and expanded by the California Privacy Rights Act (the “CPRA”), which was approved by California voters in the November 2020 election. Additionally, other U.S. states continue to propose, and in certain cases adopt, privacy-focused legislation. For example, Connecticut, Virginia, Utah and Colorado enacted legislation similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have enacted similar legislation that has or will become effective in 2024; Delaware, Nebraska, Maryland, New Hampshire, New Jersey, Minnesota, Tennessee, and Iowa have enacted similar legislation that will take effect in 2025; and Indiana, Kentucky, and Rhode Island have enacted similar legislation that will become effective in 2026. We cannot yet fully determine the impact these or future laws, regulations and standards may have on our business, but they may require us to modify our data processing practices and policies and to incur substantial costs and expenses in efforts to comply. Privacy, data protection and information security laws and regulations are often subject to differing interpretations, may be inconsistent among jurisdictions, and may be alleged to be inconsistent with our current or future practices. Additionally, we may be bound by contractual requirements applicable to our collection, use, processing, and disclosure of various types of data, including personal data, and may be bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters. These and other requirements could reduce demand for our products, increase our costs, impair our ability to grow our business, or …
Excerpt shortened here; the source contains the full paragraph.
Current wording
We also expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, the EU, and other jurisdictions. For example, the European Commission adopted a General Data Protection Regulation (the “GDPR”) that became fully effective on May 25, 2018, superseding prior EU data protection legislation, imposing more stringent EU data protection requirements, and providing for greater penalties for noncompliance. The United Kingdom has enacted a Data Protection Act and legislation referred to as the UK GDPR that substantially implements the GDPR and provides for a penalty regime similar to the GDPR. We may be required to incur substantial expense in order to make significant changes to our product and business operations in connection with obtaining and maintaining compliance with the GDPR and similar legislation, such as the UK GDPR and UK Data Protection Act, all of which may adversely affect our revenue and product sales. California has enacted legislation, the California Consumer Privacy Act (the “CCPA”) that, among other things, requires covered companies to provide disclosures to California consumers, and afford such consumers abilities to opt-out of certain sales of personal information. The CCPA was modified and expanded by the California Privacy Rights Act (the “CPRA”), which was approved by California voters in the November 2020 election. Additionally, other U.S. states continue to propose, and in certain cases adopt, privacy-focused legislation. For example, Connecticut, Virginia, Utah and Colorado enacted legislation similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have enacted similar legislation that has become effective in 2024; Delaware, Nebraska, Maryland, New Hampshire, New Jersey, Minnesota, Tennessee, and Iowa have enacted similar legislation that will take effect in 2025; and Indiana, Kentucky, and Rhode Island have enacted similar legislation that will become effective in 2026. We cannot yet fully determine the impact these or future laws, regulations and standards may have on our business, but they may require us to modify our data processing practices and policies and to incur substantial costs and expenses in efforts to comply. Privacy, data protection and information security laws and regulations are often subject to differing interpretations, may be inconsistent among jurisdictions, and may be alleged to be inconsistent with our current or future practices. Additionally, we may be bound by contractual requirements applicable to our collection, use, processing, and disclosure of various types of data, including personal data, and may be bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters. These and other requirements could reduce demand for our products, increase our costs, impair our ability to grow our business, or restrict…
Excerpt shortened here; the source contains the full paragraph.
Previous wording
The exercise of our outstanding vested stock options and warrants, and the vesting of RSUs and restricted stock dilutes the ownership interests of our existing stockholders. As of June 30, 2024, we had outstanding options, warrants and RSUs to purchase an aggregate of 305,781 shares of common stock representing approximately 9% of our total shares outstanding of which 268,703 were vested and therefore exercisable. To the extent outstanding stock options or warrants are exercised and RSUs vest, additional shares of common stock will be issued, existing stockholders’ percentage voting interests will decline and the number of shares eligible for resale in the public market will increase. Such increase may have a negative effect on the value or market trading price of our common stock.
Current wording
The exercise of our outstanding vested stock options and warrants, and the vesting of RSUs and restricted stock dilutes the ownership interests of our existing stockholders. As of September 30, 2024, we had outstanding options, warrants and RSUs to purchase an aggregate of 287,908 shares of common stock representing approximately 8% of our total shares outstanding of which 258,432 were vested and therefore exercisable. To the extent outstanding stock options or warrants are exercised and RSUs vest, additional shares of common stock will be issued, existing stockholders’ percentage voting interests will decline and the number of shares eligible for resale in the public market will increase. Such increase may have a negative effect on the value or market trading price of our common stock.
Previous wording
Our common stock is currently listed on the NYSE and was previously listed on the NYSE American LLC (formerly the NYSE MKT LLC). Over the past years, the market price of our common stock has experienced significant fluctuations. Between July 1, 2023, and June 30, 2024, the adjusted closing price on the NYSE for our common stock ranged between $3.53 and $10.20, adjusted for a 1-for-20 reverse stock split effective October 26, 2023. The price of our common stock may continue to be volatile as a result of several factors, some of which are beyond our control. These factors include, but not limited to, the following:
Current wording
Our common stock is currently listed on the NYSE and was previously listed on the NYSE American LLC (formerly the NYSE MKT LLC). Over the past years, the market price of our common stock has experienced significant fluctuations. Between October 1, 2023, and September 30, 2024, the adjusted closing price on the NYSE for our common stock ranged between $3.53 and $9.22, adjusted for a 1-for-20 reverse stock split effective October 26, 2023. The price of our common stock may continue to be volatile as a result of several factors, some of which are beyond our control. These factors include, but not limited to, the following: