VirnetX Holding Corp

Previous wording

We had a net loss of $6.2 million for the quarter ended December 31, 2024. We had a net loss of $18.2 million for the year ended December 31, 2024. As of December 31, 2024, we had an accumulated deficit of $204.7 million. Our operating results have fluctuated in the past due to several factors and may fluctuate in the future due to the same or similar factors, which include but are not limited to the following:

Current wording

Our operating results have fluctuated in the past due to several factors and may fluctuate in the future due to the same or similar factors, which include but are not limited to the following:

Previous wording

These fluctuations may make our business particularly difficult to manage, adversely affect our business and operating results, make our operating results difficult for investors to predict and, further, cause our results to fall below investor’s expectations and adversely affect the market price of our common stock. If we fail to increase our revenue to offset any increases in our operating expenses, we may not achieve or sustain profitability in the future.

Current wording

These fluctuations may make our business particularly difficult to manage, adversely affect our business and operating results, make our operating results difficult for investors to predict and, further, cause our results to fall below investor’s expectations and adversely affect the market price of our common stock. If we fail to increase our revenue, we may not achieve or sustain profitability in the future.

Previous wording

Part of our business strategy is to enter into partnerships, strategic investments, and other cooperative arrangements with other companies and government agencies. We have invested in and we continue to seek to invest in or acquire businesses, technologies, or other assets that we believe could complement or expand our business. In addition, we are regularly involved in cooperative efforts with respect to the incorporation of our products into products of others and vice versa, collaborative research and development efforts with government and university laboratories, distributor and reseller arrangements and service provider partnerships. These relationships are generally non-exclusive, and some of our partners also have cooperative relationships with certain of our competitors or offer some products and services that are competitive with ours. If we lose third-party relationships, if these relationships are not commercially successful, or if we are unable to enter into third-party relationships on commercially reasonable terms in the future, our business could be negatively impacted.

Current wording

Our business strategy is to enter into partnerships, strategic investments, and other cooperative arrangements with other companies and government agencies. We have invested in and we continue to seek to invest in or acquire businesses, technologies, or other assets that we believe could complement or expand our business. In addition, we are regularly involved in cooperative efforts with respect to the incorporation of our products into products of others and vice versa, collaborative research and development efforts with government and university laboratories, distributor and reseller arrangements and service provider partnerships. These relationships are generally non-exclusive, and some of our partners also have cooperative relationships with certain of our competitors or offer some products and services that are competitive with ours. If we lose third-party relationships, if these relationships are not commercially successful, or if we are unable to enter into third-party relationships on commercially reasonable terms in the future, our business could be negatively impacted.

Previous wording

The sales cycle between initial customer contact and execution of a contract or license agreement with a customer or purchaser of our products can vary widely. We expect that our sales cycles will be long and unpredictable due to several factors, including but not limited to:

Current wording

The sales cycle between initial customer contact and the execution of a contract or license agreement with a customer or purchaser of our products can vary widely. We expect that our sales cycles will be long and unpredictable due to several factors, including but not limited to:

Previous wording

We have limited technical resources and are at an early stage in commercialization of our VirnetX One™ platform and software products.

Current wording

We have limited technical resources and are at an early stage in commercialization of our VirnetX One™ platform and software products, as well as our DE, DTE methods, MBSE, and cyber threat assessment services.

Previous wording

The market for ZTNA security solutions is rapidly evolving and highly competitive as new entrants and traditional network solutions companies offer cloud-based cybersecurity solutions. Many of our competitors and potential competitors have established brand recognition, larger customer bases, and greater resources than we do. Our primary competitors in the ZTNA market include Appgate, Cloudflare, and Illumio. In the enterprise market, our primary competitors include Zscaler (ZPA), Palo Alto Networks (Prisma Access), Cisco (Umbrella), Citrix (Secure Private Access), Netskope (Private Access for ZTNA) and Cato Networks. As we expand our product offerings and use cases, we will begin to compete with companies that offer bundled security-as-a-service solutions that include Secure Access Service Edge (SASE) and Security Service Edge (SSE). With the introduction of new technologies and market entrants, we expect competition to intensify in the future. For example, disruptive technologies such as generative AI has and may continue to fundamentally alter the market for our services in unpredictable ways and reduce customer demand. If we fail to compete effectively, our business will be harmed. Some of our competitors offer their products or services at lower prices or for free as part of a broader bundled product sale or enterprise license arrangement, which has placed pricing pressure on our business. If we are unable to achieve our target pricing levels, our operating results will be negatively impacted. For us to compete effectively, we need to introduce new products and services in a timely and cost-effective manner, meet customer expectations and needs at prices that customers are willing to pay, and continue to enhance the features and functionalities of our cloud content management platform. In addition, pricing pressures and increased competition could result in reduced sales, lower margins, losses or the failure of our services to achieve or maintain widespread market acceptance, any of which could harm our business.

Current wording

Many of our competitors and potential competitors have established brand recognition, larger customer bases, and greater resources than we do. Our primary competitors in the ZTNA market include Appgate, Cloudflare, and Illumio. In the enterprise market, our primary competitors include Zscaler (ZPA), Palo Alto Networks (Prisma Access), Cisco (Umbrella), Citrix (Secure Private Access), Netskope (Private Access for ZTNA) and Cato Networks. As we expand our product offerings and use cases, we will begin to compete with companies that offer bundled security-as-a-service solutions that include Secure Access Service Edge (SASE) and Security Service Edge (SSE). With the introduction of new technologies and market entrants, we expect competition to intensify in the future. For example, disruptive technologies such as generative AI has and may continue to fundamentally alter the market for our services in unpredictable ways and reduce customer demand. If we fail to compete effectively, our business will be harmed. Some of our competitors offer their products or services at lower prices or for free as part of a broader bundled product sale or enterprise license arrangement, which has placed pricing pressure on our business. If we are unable to achieve our target pricing levels, our operating results will be negatively impacted. For us to compete effectively, we need to introduce new products and services in a timely and cost-effective manner, meet customer expectations and needs at prices that customers are willing to pay, and continue to enhance the features and functionalities of our cloud content management platform. In addition, pricing pressures and increased competition could result in reduced sales, lower margins, losses, or the failure of our services to achieve or maintain widespread market acceptance, any of which could harm our business.

Previous wording

Many of our competitors are able to devote greater resources to the development, promotion and sale of their products or services. In addition, many of our competitors have established marketing relationships and major distribution agreements with government agencies, channel partners, consultants, system integrators and resellers. Competitors may offer products or services at lower prices or with greater depth than our services. Our competitors may be able to respond more quickly and effectively to new or changing opportunities, technologies, standards or customer requirements. Furthermore, some potential customers, particularly large enterprises, may elect to develop their own internal solutions. For any of these reasons, we may not be able to compete successfully against our competitors.

Current wording

Many of our competitors are able to devote greater resources to the development, promotion and sale of their products or services. In addition, many of our competitors have established marketing relationships and major distribution agreements with government agencies, channel partners, consultants, system integrators, and resellers. Competitors may offer products or services at lower prices or with greater depth than our services. Our competitors may be able to respond more quickly and effectively to new or changing opportunities, technologies, standards, or customer requirements. Furthermore, some potential customers, particularly large enterprises, may elect to develop their own internal solutions. In addition, the U.S. government and foreign governments may develop, construct, launch and operate their own ZTNA security solutions with capabilities comparable or similar to ours, which could reduce their need to rely on us and other commercial suppliers. For any of these reasons, we may not be able to compete successfully against our competitors.

Previous wording

Our business will depend upon, among other things, the capacity, reliability, security, and unimpeded access of the infrastructure owned by third parties that we will use to deploy our offerings. We have no control over the operation, quality, or maintenance of a significant portion of that infrastructure or whether those third parties will upgrade or improve their equipment. We depend on these companies to maintain the operational integrity of our connections. If one or more of these companies is unable or unwilling to supply or expand their levels of service to us in the future, our operations could be severely interrupted. Also, to the extent that the number of users of networks utilizing our current or future products suddenly increases, the technology platform and secure hosting services which will be required to accommodate a higher volume of traffic may result in slower response times or service interruptions. System interruptions or increases in response time could result in a loss of potential or existing users and, if sustained or repeated, could reduce the appeal of the networks to users. In addition, users depend on real-time communications; outages caused by increased traffic could result in delays and system failures. These types of occurrences could cause users to perceive that our solution does not function properly and could therefore adversely affect our ability to attract and retain licensees, strategic partners, and customers.

Current wording

Our business will depend upon, among other things, the capacity, reliability, security, and unimpeded access of the infrastructure owned by third parties that we will use to deploy our offerings. We have no control over the operation, quality, or maintenance of a significant portion of that infrastructure or whether those third parties will upgrade or improve their equipment. We depend on these companies to maintain the operational integrity of our connections. If one or more of these companies is unable or unwilling to supply or expand their levels of service to us in the future, our operations could be severely interrupted.

Previous wording

We expect to retain certain confidential and proprietary customer information in our secure data centers and secure domain name registry, as well as personal data and other confidential and proprietary information relating to our business. It will be critical to our business strategy that our facilities and infrastructure, including our secure domain name servers, remain secure and are perceived by the marketplace to be secure. Our secure domain name registry operations will also depend on our ability to maintain our computer and telecommunications equipment in effective working order and to reasonably protect our systems against interruption, and potentially depend on protection by other registrars in the shared registration system.. Additionally, we maintain confidential and proprietary business information, including trade secrets. We expect to have to expend significant time and money to maintain or increase the security of our products, facilities, and infrastructure. Security technologies are constantly being tested by computer professionals, academics and “hackers.” Advances in computer capabilities and the techniques for attacking security solutions, new discoveries in the field of cryptography or other events or developments could result in compromises or breaches of our security measures and could make some or all our products obsolete or unmarketable. Likewise, we may need to dedicate engineering and other resources to mitigate or eliminate security vulnerabilities and may find it necessary or appropriate to repair or replace products already sold or licensed to our customers. Despite the security measures that we and our service providers utilize, our infrastructure and that of our service providers may be vulnerable to physical break-ins, ransomware, computer viruses, other malicious code attacks by hackers, phishing attacks, social engineering, or similar disruptive problems. There can be no assurances our security measures or those of our service providers will prevent security breaches or incidents. Any disruption or security breach or incident that we or our service providers suffer or are perceived to suffer, including any such disruption, breach or incident resulting in a loss of, or damage to, data or systems, or inappropriate disclosure, access, loss, or other processing of confidential, financial, proprietary or personal information, including data related to our personnel, could result in loss, disclosure or other unauthorized processing of such data, could delay our research and development or commercialization efforts, could compel us to comply with breach notification laws and regulations, subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information. It is possible that we may have to expend additional financial and other resources to address such problems. Remote work by our personnel and those of third parties h…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We face security threats from malicious third parties that could obtain unauthorized access to our systems, network, and data. We expect to retain certain confidential and proprietary customer information in our secure data centers and secure domain name registry, as well as personal data and other confidential and proprietary information relating to our business. It will be critical to our business strategy that our facilities and infrastructure, including our secure domain name servers, remain secure and are perceived by the marketplace to be secure. Our secure domain name registry operations will also depend on our ability to maintain our computer and telecommunications equipment in effective working order and to reasonably protect our systems against interruption, and potentially depend on protection by other registrars in the shared registration system. Additionally, we maintain confidential and proprietary business information, including trade secrets. We expect to continue to have to expend significant time and money to maintain or increase the security of our products, facilities, and infrastructure. Security technologies are constantly being tested by computer professionals, academics and “hackers.” Advances in computer capabilities and the techniques for attacking security solutions, new discoveries in the field of cryptography or other events or developments could result in compromises or breaches of our security measures and could make some or all our products obsolete or unmarketable. Likewise, we may need to dedicate engineering and other resources to mitigate or eliminate security vulnerabilities and may find it necessary or appropriate to repair or replace products already sold or licensed to our customers. Despite the security measures that we and our service providers utilize, our infrastructure and that of our service providers may be vulnerable to physical break-ins, ransomware, computer viruses, other malicious code attacks by hackers, phishing attacks, social engineering, or similar disruptive problems. There can be no assurances our security measures or those of our service providers will prevent security breaches or incidents. Any disruption or security breach or incident that we or our service providers suffer or are perceived to suffer, including any such disruption, breach or incident resulting in a loss of, or damage to, data or systems, or inappropriate disclosure, access, loss, or other processing of confidential, financial, proprietary or personal information, including data related to our personnel, could result in loss, disclosure or other unauthorized processing of such data, could delay our research and development or commercialization efforts, could compel us to comply with breach notification laws and regulations, subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information. It is possible that we may h…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

We also expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, the EU, and other jurisdictions. For example, the European Commission maintains a General Data Protection Regulation (the “GDPR”) that imposes stringent data protection requirements and provides for substantial penalties for noncompliance. The United Kingdom has enacted a Data Protection Act and legislation referred to as the UK GDPR that substantially implements the GDPR and provides for a penalty regime similar to the GDPR. We may be required to incur substantial expense in order to make significant changes to our products and operations to address compliance with the GDPR and similar legislation, such as the UK GDPR and UK Data Protection Act, all of which may adversely affect our revenue and product sales. California has enacted legislation, the California Consumer Privacy Act (the “CCPA”) that, among other things, requires covered companies to provide disclosures to California consumers, and afford such consumers abilities to opt-out of certain sales of personal information. The CCPA was modified and expanded by the California Privacy Rights Act (the “CPRA”), which was approved by California voters in the November 2020 election. Additionally, other U.S. states continue to propose, and in certain cases adopt, privacy-focused legislation. For example, Connecticut, Virginia, Utah and Colorado enacted legislation similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have enacted similar legislation that has became effective in 2024; Delaware, Nebraska, Maryland, New Hampshire, New Jersey, Minnesota, Tennessee, and Iowa have enacted similar legislation that has or will become effective in 2025; and Indiana, Kentucky, and Rhode Island have enacted similar legislation that will become effective in 2026. We cannot yet fully determine the impact these or future laws, regulations and standards may have on our business, but they may require us to modify our data processing practices and policies and to incur substantial costs and expenses in efforts to comply. Privacy, data protection and information security laws and regulations are often subject to differing interpretations, may be inconsistent among jurisdictions, and may be alleged to be inconsistent with our current or future practices. Additionally, we may be bound by contractual requirements applicable to our collection, use, processing, and disclosure of various types of data, including personal data, and may be bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters. These and other requirements could reduce demand for our products, increase our costs, impair our ability to grow our business, or restrict our ability to store and process data or, in some cases, impact our ability to offer our service in some locations and may s…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We also expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, the EU, and other jurisdictions. For example, the European Commission maintains a General Data Protection Regulation (the GDPR) that imposes stringent data protection requirements and provides for substantial penalties for noncompliance. The United Kingdom has enacted a Data Protection Act and legislation referred to as the UK GDPR that substantially implements the GDPR and provides for a penalty regime similar to the GDPR. The United Kingdom made targeted amendments to the Data Protection Act and the UK GDPR in the UK Data (Use and Access) Act, effective June 19, 2025. We may be required to incur substantial expense in order to make significant changes to our products and operations to address compliance with the GDPR and similar legislation, such as the UK GDPR and UK Data Protection Act, all of which may adversely affect our revenue and product sales. California has enacted legislation, the California Consumer Privacy Act (CCPA) that, among other things, requires covered companies to provide disclosures to California consumers, and afford such consumers abilities to opt-out of certain sales of personal information. The CCPA was modified and expanded by the California Privacy Rights Act (CPRA), which was approved by California voters in the November 2020 election. Additionally, other U.S. states continue to propose, and in certain cases adopt, privacy-focused legislation. For example, Connecticut, Virginia, Utah, and Colorado enacted legislation similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have enacted similar legislation that has become effective in 2024; Delaware, Nebraska, Maryland, New Hampshire, New Jersey, Minnesota, Tennessee, and Iowa have enacted similar legislation, and Indiana, Kentucky, and Rhode Island have enacted similar legislation that has become effective in 2026.

Previous wording

The exercise of our outstanding stock options and warrants, and the issuance of RSUs and restricted stock would result in a dilution of our current stockholders’ voting power and an increase in the number of shares eligible for future resale in the public market which may negatively impact the market price of our stock.

Current wording

The exercise of our outstanding stock options and the issuance of RSUs and restricted stock would result in a dilution of our current stockholders’ voting power and an increase in the number of shares eligible for future resale in the public market which may negatively impact the market price of our stock.

Previous wording

The exercise of our outstanding vested stock options and warrants, and the vesting of RSUs and restricted stock dilutes the ownership interests of our existing stockholders. As of December 31, 2024, we had outstanding options, warrants and RSUs to purchase an aggregate of 265,040 shares of common stock representing approximately 6.25% of our total shares outstanding of which 242,352 were vested. To the extent outstanding stock options or warrants are exercised and RSUs vest, additional shares of common stock will be issued, existing stockholders’ percentage voting interests will decline and the number of shares eligible for resale in the public market will increase. Such increase may have a negative effect on the value or market trading price of our common stock.

Current wording

The exercise of our outstanding vested stock options and the vesting of RSUs and restricted stock dilutes the ownership interests of our existing stockholders. As of December 31, 2025, we had 727,884 outstanding options and RSUs to purchase shares of common stock representing approximately 18% of our total shares outstanding of which 234,842 were vested. To the extent restricted stock is awarded, outstanding stock options or warrants are exercised, and RSUs vest, existing stockholders’ percentage voting interests will decline. Also, the number of shares eligible for resale in the public market will increase and such increase may have a negative effect on the value or market trading price of our common stock.

Previous wording

As of December 31, 2024, our executive officers and directors beneficially owned approximately 18% of our outstanding common stock. Because of their beneficial ownership interest, our officers and directors could significantly influence stockholder actions of which you disapprove or that are contrary to your interests. This ability to exercise significant influence could prevent or significantly delay another company from acquiring or merging with us.

Current wording

As of December 31, 2025, our executive officers and directors beneficially owned approximately 16% of our outstanding common stock. Because of their beneficial ownership interest, our officers and directors could significantly influence stockholder actions. This ability to exercise significant influence could prevent or significantly delay another company from acquiring or merging with us.

Previous wording

These and other provisions in our Restated Charter, our Restated Bylaws and under Delaware law could discourage potential takeover attempts, reduce the price that investors might be willing to pay for shares of our common stock in the future and result in the market price being lower than it would be without these provisions.

Current wording

In addition, the provisions of Section 203 of the Delaware General Corporation Law govern us. These provisions may prohibit large stockholders, particularly those owning 15% or more of our outstanding voting stock, from merging or combining with us for a certain period of time. These and other provisions in our Restated Charter, our Restated Bylaws and under Delaware law could discourage potential takeover attempts, reduce the price that investors might be willing to pay for shares of our common stock in the future and result in the market price being lower than it would be without these provisions.

Previous wording

Our business may be adversely affected by instability, disruption, or destruction in a geographic region in which we operate, regardless of cause, including war, terrorism, riot, civil insurrection, or social unrest, and natural or manmade disasters, including famine, flood, fire, earthquake, storm, or pandemic events and spread of disease. Our business may also be adversely affected by further downturn in macroeconomic conditions, including inflation and rising interest rates, tariffs, trade wars, global political and economic uncertainty and tensions, such as the ongoing Russia-Ukraine and Israel-Hamas conflicts, as well as any related political or economic response, counter responses or otherwise, financial services sector instability, a reduction in business confidence and activity, financial market volatility, unexpected changes in tax law or policy, and other factors. Such events can adversely affect our operations or the economy as a whole and may cause our customers to delay their decisions on spending for the services we provide and perpetuate significant changes in regional and global economic conditions and cycles. These events may also pose risks to our personnel and to physical facilities and operations, which could adversely affect our financial results.

Current wording

Our business may be adversely affected by instability, disruption, or destruction in a geographic region in which we operate, regardless of cause, including war, terrorism, riot, civil insurrection, or social unrest, and natural or manmade disasters, including famine, flood, fire, earthquake, storm, or pandemic events and spread of disease. Our business may also be adversely affected by further downturn in macroeconomic conditions, including inflation and rising interest rates, tariffs, trade wars, global political and economic uncertainty and tensions, such as the ongoing Russia-Ukraine and Middle Easts conflicts, as well as any related political or economic response, counter responses or otherwise, financial services sector instability, a reduction in business confidence and activity, financial market volatility, unexpected changes in tax law or policy, and other factors. Such events can adversely affect our operations or the economy as a whole and may cause our customers to delay their decisions on spending for the services we provide and perpetuate significant changes in regional and global economic conditions and cycles. These events may also pose risks to our personnel and to physical facilities and operations, which could adversely affect our financial results.

Previous wording

Our common stock is currently listed on the NYSE and was previously listed on the NYSE American LLC (formerly the NYSE MKT LLC). Over the past years, the market price of our common stock has experienced significant fluctuations. Between January 1, 2024, and December 31, 2024, the adjusted closing price on the NYSE for our common stock ranged between $3.62 and $9.22. The price of our common stock may continue to be volatile as a result of several factors, some of which are beyond our control. These factors include, but are not limited to, the following:

Current wording

Our common stock is currently listed on the Nasdaq Stock Market LLC (Nasdaq) and was previously listed on NYSE and NYSE American LLC (formerly the NYSE MKT LLC). Over the past year, the market price of our common stock has experienced significant fluctuations. Between January 1, 2025, and December 31, 2025, the adjusted closing price for our common stock ranged between $6.80 and $24.84. The price of our common stock may continue to be volatile as a result of several factors, some of which are beyond our control. These factors include, but are not limited to, the following:

Previous wording

In addition, we believe there has been and may continue to be substantial trading in derivatives of our stock, including short selling activity or related similar activities, which are beyond our control, and which may be beyond the full control of the SEC and Financial Institutions Regulatory Authority (“FINRA”). While the SEC and FINRA rules prohibit some forms of short selling and other activities that may result in stock price manipulation, such activity may nonetheless occur without detection or enforcement. We have held conversations with regulators concerning trading activity in our stock; however, there can be no assurance that should there be any illegal manipulation in the trading of our stock, it will be detected, prosecuted, or successfully eradicated. Significant short selling market manipulation could cause our stock trading price to decline, to become more volatile, or both. For more information regarding trading in our common stock and listing on the NYSE, see additional risk factors included elsewhere in this Annual Report on Form 10-K.

Current wording

In addition, we believe there has been and may continue to be substantial trading in derivatives of our stock, including short selling activity or related similar activities, which are beyond our control, and which may be beyond the full control of the SEC and Financial Institutions Regulatory Authority (FINRA). While the SEC and FINRA rules prohibit some forms of short selling and other activities that may result in stock price manipulation, such activity may nonetheless occur without detection or enforcement. We have held conversations with regulators concerning trading activity in our stock; however, there can be no assurance that should there be any illegal manipulation in the trading of our stock, it will be detected, prosecuted, or successfully eradicated. Significant short-selling market manipulation could cause our stock trading price to decline, to become more volatile, or both. For more information regarding trading in our common stock and listing on the Nasdaq, see additional risk factors included elsewhere in this Annual Report on Form 10-K.

Previous wording

In addition, an entity that, among other things, is or holds itself out as being engaged primarily, or proposes to engage primarily, in the business of investing, reinvesting, owning, trading, or holding certain types of securities would be deemed an Investment Company under the Investment Company Act of 1940 (the “1940 Act”). If we do not manage our investments and business in a manner that meets the requirements for an exemption under the 1940 Act, we may be deemed to be an investment company under the 1940 Act and subject to additional limitations on operating our business including limitations on the issuance of securities, which may make it difficult for us to raise capital.

Current wording

In addition, an entity that, among other things, is or holds itself out as being engaged primarily, or proposes to engage primarily, in the business of investing, reinvesting, owning, trading, or holding certain types of securities would be deemed an Investment Company under the Investment Company Act of 1940 (1940 Act). If we do not manage our investments and business in a manner that meets the requirements for an exemption under the 1940 Act, we may be deemed to be an investment company under the 1940 Act and subject to additional limitations on operating our business including limitations on the issuance of securities, which may make it difficult for us to raise capital.