VirnetX Holding Corp

Previous wording

We had a net loss of $3.7 million for the quarter ended March 31, 2025. We had a net loss of $18.2 million for the year ended December 31, 2024. As of March 31, 2025, we had an accumulated deficit of $208.3 million. Our operating results have fluctuated in the past due to several factors and may fluctuate in the future due to the same or similar factors, which include but are not limited to the following:

Current wording

We had a net loss of $7.3 million for the six months ended June 30, 2025 and a net loss of $18.2 million for the year ended December 31, 2024. As of June 30, 2025, we had an accumulated deficit of $212.0 million. Our operating results have fluctuated in the past due to several factors and may fluctuate in the future due to the same or similar factors, which include but are not limited to the following:

Previous wording

The sales cycle between initial customer contact and execution of a contract or license agreement with a customer or purchaser of our products can vary widely. We expect that our sales cycles will be long and unpredictable due to several factors, including but not limited to:

Current wording

The sales cycle between initial customer contact and the execution of a contract or license agreement with a customer or purchaser of our products can vary widely. We expect that our sales cycles will be long and unpredictable due to several factors, including but not limited to:

Previous wording

We expect to retain certain confidential and proprietary customer information in our secure data centers and secure domain name registry, as well as personal data and other confidential and proprietary information relating to our business. It will be critical to our business strategy that our facilities and infrastructure, including our secure domain name servers, remain secure and are perceived by the marketplace to be secure. Our secure domain name registry operations will also depend on our ability to maintain our computer and telecommunications equipment in effective working order and to reasonably protect our systems against interruption, and potentially depend on protection by other registrars in the shared registration system. Additionally, we maintain confidential and proprietary business information, including trade secrets. We expect to have to expend significant time and money to maintain or increase the security of our products, facilities, and infrastructure. Security technologies are constantly being tested by computer professionals, academics and “hackers.” Advances in computer capabilities and the techniques for attacking security solutions, new discoveries in the field of cryptography or other events or developments could result in compromises or breaches of our security measures and could make some or all our products obsolete or unmarketable. Likewise, we may need to dedicate engineering and other resources to mitigate or eliminate security vulnerabilities and may find it necessary or appropriate to repair or replace products already sold or licensed to our customers. Despite the security measures that we and our service providers utilize, our infrastructure and that of our service providers may be vulnerable to physical break-ins, ransomware, computer viruses, other malicious code attacks by hackers, phishing attacks, social engineering, or similar disruptive problems. There can be no assurances our security measures or those of our service providers will prevent security breaches or incidents. Any disruption or security breach or incident that we or our service providers suffer or are perceived to suffer, including any such disruption, breach or incident resulting in a loss of, or damage to, data or systems, or inappropriate disclosure, access, loss, or other processing of confidential, financial, proprietary or personal information, including data related to our personnel, could result in loss, disclosure or other unauthorized processing of such data, could delay our research and development or commercialization efforts, could compel us to comply with breach notification laws and regulations, subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information. It is possible that we may have to expend additional financial and other resources to address such problems. Remote work by our personnel and those of third parties ha…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We expect to retain certain confidential and proprietary customer information in our secure data centers and secure domain name registry, as well as personal data and other confidential and proprietary information relating to our business. It will be critical to our business strategy that our facilities and infrastructure, including our secure domain name servers, remain secure and are perceived by the marketplace to be secure. Our secure domain name registry operations will also depend on our ability to maintain our computer and telecommunications equipment in effective working order and to reasonably protect our systems against interruption, and potentially depend on protection by other registrars in the shared registration system. Additionally, we maintain confidential and proprietary business information, including trade secrets. We expect to continue to have to expend significant time and money to maintain or increase the security of our products, facilities, and infrastructure. Security technologies are constantly being tested by computer professionals, academics and “hackers.” Advances in computer capabilities and the techniques for attacking security solutions, new discoveries in the field of cryptography or other events or developments could result in compromises or breaches of our security measures and could make some or all our products obsolete or unmarketable. Likewise, we may need to dedicate engineering and other resources to mitigate or eliminate security vulnerabilities and may find it necessary or appropriate to repair or replace products already sold or licensed to our customers. Despite the security measures that we and our service providers utilize, our infrastructure and that of our service providers may be vulnerable to physical break-ins, ransomware, computer viruses, other malicious code attacks by hackers, phishing attacks, social engineering, or similar disruptive problems. There can be no assurances our security measures or those of our service providers will prevent security breaches or incidents. Any disruption or security breach or incident that we or our service providers suffer or are perceived to suffer, including any such disruption, breach or incident resulting in a loss of, or damage to, data or systems, or inappropriate disclosure, access, loss, or other processing of confidential, financial, proprietary or personal information, including data related to our personnel, could result in loss, disclosure or other unauthorized processing of such data, could delay our research and development or commercialization efforts, could compel us to comply with breach notification laws and regulations, subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information. It is possible that we may have to expend additional financial and other resources to address such problems. Remote work by our personnel and those of thir…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

We also expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, the EU, and other jurisdictions. For example, the European Commission maintains a General Data Protection Regulation (the “GDPR”) that imposes stringent data protection requirements and provides for substantial penalties for noncompliance. The United Kingdom has enacted a Data Protection Act and legislation referred to as the UK GDPR that substantially implements the GDPR and provides for a penalty regime similar to the GDPR. We may be required to incur substantial expense in order to make significant changes to our products and operations to address compliance with the GDPR and similar legislation, such as the UK GDPR and UK Data Protection Act, all of which may adversely affect our revenue and product sales. California has enacted legislation, the California Consumer Privacy Act (the “CCPA”) that, among other things, requires covered companies to provide disclosures to California consumers, and afford such consumers abilities to opt-out of certain sales of personal information. The CCPA was modified and expanded by the California Privacy Rights Act (the “CPRA”), which was approved by California voters in the November 2020 election. Additionally, other U.S. states continue to propose, and in certain cases adopt, privacy-focused legislation. For example, Connecticut, Virginia, Utah and Colorado enacted legislation similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have enacted similar legislation that has become effective in 2024; Delaware, Nebraska, Maryland, New Hampshire, New Jersey, Minnesota, Tennessee, and Iowa have enacted similar legislation that has or will become effective in 2025; and Indiana, Kentucky, and Rhode Island have enacted similar legislation that will become effective in 2026. We cannot yet fully determine the impact these or future laws, regulations and standards may have on our business, but they may require us to modify our data processing practices and policies and to incur substantial costs and expenses in efforts to comply. Privacy, data protection and information security laws and regulations are often subject to differing interpretations, may be inconsistent among jurisdictions, and may be alleged to be inconsistent with our current or future practices. Additionally, we may be bound by contractual requirements applicable to our collection, use, processing, and disclosure of various types of data, including personal data, and may be bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters. These and other requirements could reduce demand for our products, increase our costs, impair our ability to grow our business, or restrict our ability to store and process data or, in some cases, impact our ability to offer our service in some locations and may s…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We also expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, the EU, and other jurisdictions. For example, the European Commission maintains a General Data Protection Regulation (the GDPR) that imposes stringent data protection requirements and provides for substantial penalties for noncompliance. The United Kingdom has enacted a Data Protection Act and legislation referred to as the UK GDPR that substantially implements the GDPR and provides for a penalty regime similar to the GDPR. The United Kingdom made targeted amendments to the Data Protection Act and the UK GDPR in the UK Data (Use and Access) Act, effective June 19, 2025. We may be required to incur substantial expense in order to make significant changes to our products and operations to address compliance with the GDPR and similar legislation, such as the UK GDPR and UK Data Protection Act, all of which may adversely affect our revenue and product sales. California has enacted legislation, the California Consumer Privacy Act (CCPA) that, among other things, requires covered companies to provide disclosures to California consumers, and afford such consumers abilities to opt-out of certain sales of personal information. The CCPA was modified and expanded by the California Privacy Rights Act (CPRA), which was approved by California voters in the November 2020 election. Additionally, other U.S. states continue to propose, and in certain cases adopt, privacy-focused legislation. For example, Connecticut, Virginia, Utah and Colorado enacted legislation similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have enacted similar legislation that has become effective in 2024; Delaware, Nebraska, Maryland, New Hampshire, New Jersey, Minnesota, Tennessee, and Iowa have enacted similar legislation that has or will become effective in 2025; and Indiana, Kentucky, and Rhode Island have enacted similar legislation that will become effective in 2026. The U.S. Department of Justice has also issued regulations regarding certain bulk sensitive personal data transfers. We cannot yet fully determine the impact these or future laws, regulations and standards may have on our business, but they may require us to modify our data processing practices and policies and to incur substantial costs and expenses in efforts to comply. Privacy, data protection and information security laws and regulations are often subject to differing interpretations, may be inconsistent among jurisdictions, and may be alleged to be inconsistent with our current or future practices. Additionally, we may be bound by contractual requirements applicable to our collection, use, processing, and disclosure of various types of data, including personal data, and may be bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters. These and ot…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

The exercise of our outstanding stock options and warrants, and the issuance of RSUs and restricted stock would result in a dilution of our current stockholders’ voting power and an increase in the number of shares eligible for future resale in the public market which may negatively impact the market price of our stock.

Current wording

The exercise of our outstanding stock options and the issuance of RSUs and restricted stock would result in a dilution of our current stockholders’ voting power and an increase in the number of shares eligible for future resale in the public market which may negatively impact the market price of our stock.

Previous wording

The exercise of our outstanding vested stock options and warrants, and the vesting of RSUs and restricted stock dilutes the ownership interests of our existing stockholders. As of March 31, 2025, we had 263,790 outstanding options, warrants and RSUs to purchase shares of common stock representing approximately 6% of our total shares outstanding of which 245,586 were vested. To the extent outstanding stock options or warrants are exercised and RSUs vest, additional shares of common stock will be issued, existing stockholders’ percentage voting interests will decline and the number of shares eligible for resale in the public market will increase. Such increase may have a negative effect on the value or market trading price of our common stock.

Current wording

The exercise of our outstanding vested stock options and the vesting of RSUs and restricted stock dilutes the ownership interests of our existing stockholders. As of June 30, 2025, we had 248,488 outstanding options and RSUs to purchase shares of common stock representing approximately 6% of our total shares outstanding of which 238,785 were vested. To the extent outstanding stock options or warrants are exercised and RSUs vest, additional shares of common stock will be issued, existing stockholders’ percentage voting interests will decline and the number of shares eligible for resale in the public market will increase. Such increase may have a negative effect on the value or market trading price of our common stock.

Previous wording

On August 28, 2024, we received a written notification from the NYSE that as of August 27, 2024, we were not in compliance with the continued listing standards set forth in Section 802.01B of the NYSE Listed Company Manual because the average global market capitalization over a consecutive 30 trading-day period and stockholders’ equity were both less than $50 million. In accordance with applicable NYSE procedures, we submitted a plan to the NYSE on October 11, 2024, and provide quarterly updates advising it of the definitive actions we have taken, are taking and plan to take that would bring us into conformity with the standard set forth in Section 802.01B within 18 months of receipt of the written notification. The written notification has no immediate impact on our ongoing business operations, reporting requirements with the SEC or the listing of our common stock on the NYSE at this time, subject to the Company’s continued compliance with the plan and NYSE’s other continued listing standards. We are considering all available options to regain compliance with NYSE’s continued listing standards but can provide no assurances that we will be able to satisfy the requirements of the NYSE.

Current wording

On August 28, 2024, we received a written notification from the NYSE that as of August 27, 2024, we were not in compliance with the continued listing standards set forth in Section 802.01B of the NYSE Listed Company Manual because the average global market capitalization over a consecutive 30 trading-day period and stockholders’ equity were both less than $50 million. In accordance with applicable NYSE procedures, we submitted a plan to the NYSE on October 11, 2024, and provide quarterly updates advising it of the definitive actions we have taken, are taking and plan to take that would bring us into conformity with the standard set forth in Section 802.01B within 18 months of receipt of the written notification. The written notification has no immediate impact on our ongoing business operations, reporting requirements with the SEC or the listing of our common stock on the NYSE at this time, subject to the Company’s continued compliance with the plan and NYSE’s other continued listing standards. We are considering all of our available options, including efforts to regain compliance with NYSE’s continued listing standards, but can provide no assurances that we will be able to satisfy the requirements of the NYSE.

Previous wording

Our common stock is currently listed on the NYSE and was previously listed on the NYSE American LLC (formerly the NYSE MKT LLC). Over the past years, the market price of our common stock has experienced significant fluctuations. Between April 1, 2024, and March 31, 2025, the adjusted closing price on the NYSE for our common stock ranged between $3.62 and $9.32. The price of our common stock may continue to be volatile as a result of several factors, some of which are beyond our control. These factors include, but are not limited to, the following:

Current wording

Our common stock is currently listed on the NYSE and was previously listed on the NYSE American LLC (formerly the NYSE MKT LLC). Over the past years, the market price of our common stock has experienced significant fluctuations. Between July 1, 2024, and June 30, 2025, the adjusted closing price on the NYSE for our common stock ranged between $3.86 and $11.39. The price of our common stock may continue to be volatile as a result of several factors, some of which are beyond our control. These factors include, but are not limited to, the following:

Previous wording

In addition, an entity that, among other things, is or holds itself out as being engaged primarily, or proposes to engage primarily, in the business of investing, reinvesting, owning, trading, or holding certain types of securities would be deemed an Investment Company under the Investment Company Act of 1940 (the “1940 Act”). If we do not manage our investments and business in a manner that meets the requirements for an exemption under the 1940 Act, we may be deemed to be an investment company under the 1940 Act and subject to additional limitations on operating our business including limitations on the issuance of securities, which may make it difficult for us to raise capital.

Current wording

In addition, an entity that, among other things, is or holds itself out as being engaged primarily, or proposes to engage primarily, in the business of investing, reinvesting, owning, trading, or holding certain types of securities would be deemed an Investment Company under the Investment Company Act of 1940 (1940 Act). If we do not manage our investments and business in a manner that meets the requirements for an exemption under the 1940 Act, we may be deemed to be an investment company under the 1940 Act and subject to additional limitations on operating our business including limitations on the issuance of securities, which may make it difficult for us to raise capital.