VirnetX Holding Corp

Previous wording

We had a net loss of $11.6 million for the nine months ended September 30, 2025 and a net loss of $18.2 million for the year ended December 31, 2024. As of September 30, 2025, we had an accumulated deficit of $216.3 million. Our operating results have fluctuated in the past due to several factors and may fluctuate in the future due to the same or similar factors, which include but are not limited to the following:

Current wording

Our operating results have fluctuated in the past due to several factors and may fluctuate in the future due to the same or similar factors, which include but are not limited to the following:

Previous wording

The sales cycle between initial customer contact and the execution of a contract or license agreement with a customer or purchaser of our products can vary widely. We expect that our sales cycles will be long and unpredictable due to several factors, including but not limited to:

Current wording

The sales cycle between initial customer contact and the execution of a contract can vary widely. We expect that our sales cycles will be long and unpredictable due to several factors, including but not limited to:

Previous wording

For these reasons, the sales cycle associated with our products is subject to a number of significant risks that are beyond our control. Consequently, if customer orders are delayed or not realized, our revenues and results of operations could be materially and adversely affected.

Current wording

In addition, potential customers include local, state, federal and foreign government agencies, as well as institutions in the space and defense industries. Sales processes to government authorities can be extensive and unpredictable. Government authorities generally have complex budgeting, purchasing, and regulatory processes that govern their capital spending, and their spending is likely to be adversely impacted by economic conditions. In addition, in many instances, sales to government authorities may require field trials and may be delayed by the time it takes for government officials to evaluate multiple competing bids, negotiate terms, and award contracts. For these reasons, the sales cycle associated with our products is subject to a number of significant risks that are beyond our control. Consequently, if customer orders are delayed or not realized, our revenues and results of operations could be materially and adversely affected.

Previous wording

We plan to offer our products to government entities, which are subject to a number of challenges and risks.

Current wording

We offer our products to government entities, which are subject to a number of challenges and risks.

Previous wording

We have limited technical resources and are at an early stage in commercialization of our VirnetX One™ platform and software products.

Current wording

We have limited technical resources and are at an early stage in commercialization of our VirnetX One™ platform and software products, as well as our DE, DTE methods, MBSE, and cyber threat assessment services.

Previous wording

Many of our competitors and potential competitors have established brand recognition, larger customer bases, and greater resources than we do. Our primary competitors in the ZTNA market include Appgate, Cloudflare, and Illumio. In the enterprise market, our primary competitors include Zscaler (ZPA), Palo Alto Networks (Prisma Access), Cisco (Umbrella), Citrix (Secure Private Access), Netskope (Private Access for ZTNA) and Cato Networks. As we expand our product offerings and use cases, we will begin to compete with companies that offer bundled security-as-a-service solutions that include Secure Access Service Edge (SASE) and Security Service Edge (SSE). With the introduction of new technologies and market entrants, we expect competition to intensify in the future. For example, disruptive technologies such as generative AI has and may continue to fundamentally alter the market for our services in unpredictable ways and reduce customer demand. If we fail to compete effectively, our business will be harmed. Some of our competitors offer their products or services at lower prices or for free as part of a broader bundled product sale or enterprise license arrangement, which has placed pricing pressure on our business. If we are unable to achieve our target pricing levels, our operating results will be negatively impacted. For us to compete effectively, we need to introduce new products and services in a timely and cost-effective manner, meet customer expectations and needs at prices that customers are willing to pay, and continue to enhance the features and functionalities of our cloud content management platform. In addition, pricing pressures and increased competition could result in reduced sales, lower margins, losses or the failure of our services to achieve or maintain widespread market acceptance, any of which could harm our business.

Current wording

Many of our competitors and potential competitors have established brand recognition, larger customer bases, and greater resources than we do. Our primary competitors in the ZTNA market include Appgate, Cloudflare, and Illumio. In the enterprise market, our primary competitors include Zscaler (ZPA), Palo Alto Networks (Prisma Access), Cisco (Umbrella), Citrix (Secure Private Access), Netskope (Private Access for ZTNA) and Cato Networks. As we expand our product offerings and use cases, we will begin to compete with companies that offer bundled security-as-a-service solutions that include Secure Access Service Edge (SASE) and Security Service Edge (SSE). With the introduction of new technologies and market entrants, we expect competition to intensify in the future. For example, disruptive technologies such as generative AI have and may continue to fundamentally alter the market for our services in unpredictable ways and reduce customer demand. If we fail to compete effectively, our business will be harmed. Some of our competitors offer their products or services at lower prices or for free as part of a broader bundled product sale or enterprise license arrangement, which has placed pricing pressure on our business. If we are unable to achieve our target pricing levels, our operating results will be negatively impacted. For us to compete effectively, we need to introduce new products and services in a timely and cost-effective manner, meet customer expectations and needs at prices that customers are willing to pay, and continue to enhance the features and functionalities of our cloud content management platform. In addition, pricing pressures and increased competition could result in reduced sales, lower margins, losses, or the failure of our services to achieve or maintain widespread market acceptance, any of which could harm our business.

Previous wording

Our business will depend upon, among other things, the capacity, reliability, security, and unimpeded access of the infrastructure owned by third parties that we will use to deploy our offerings. We have no control over the operation, quality, or maintenance of a significant portion of that infrastructure or whether those third parties will upgrade or improve their equipment. We depend on these companies to maintain the operational integrity of our connections. If one or more of these companies is unable or unwilling to supply or expand their levels of service to us in the future, our operations could be severely interrupted. Also, to the extent that the number of users of networks utilizing our current or future products suddenly increases, the technology platform and secure hosting services which will be required to accommodate a higher volume of traffic may result in slower response times or service interruptions. System interruptions or increases in response time could result in a loss of potential or existing users and, if sustained or repeated, could reduce the appeal of the networks to users. In addition, users depend on real-time communications; outages caused by increased traffic could result in delays and system failures. These types of occurrences could cause users to perceive that our solution does not function properly and could therefore adversely affect our ability to attract and retain licensees, strategic partners, and customers.

Current wording

Our business will depend upon, among other things, the capacity, reliability, security, and unimpeded access of the infrastructure owned by third parties that we will use to deploy our offerings. We have no control over the operation, quality, or maintenance of a significant portion of that infrastructure or whether those third parties will upgrade or improve their equipment. We depend on these companies to maintain the operational integrity of our connections. If one or more of these companies is unable or unwilling to supply or expand their levels of service to us in the future, our operations could be severely interrupted.

Previous wording

We expect to retain certain confidential and proprietary customer information in our secure data centers and secure domain name registry, as well as personal data and other confidential and proprietary information relating to our business. It will be critical to our business strategy that our facilities and infrastructure, including our secure domain name servers, remain secure and are perceived by the marketplace to be secure. Our secure domain name registry operations will also depend on our ability to maintain our computer and telecommunications equipment in effective working order and to reasonably protect our systems against interruption, and potentially depend on protection by other registrars in the shared registration system. Additionally, we maintain confidential and proprietary business information, including trade secrets. We expect to continue to have to expend significant time and money to maintain or increase the security of our products, facilities, and infrastructure. Security technologies are constantly being tested by computer professionals, academics and “hackers.” Advances in computer capabilities and the techniques for attacking security solutions, new discoveries in the field of cryptography or other events or developments could result in compromises or breaches of our security measures and could make some or all our products obsolete or unmarketable. Likewise, we may need to dedicate engineering and other resources to mitigate or eliminate security vulnerabilities and may find it necessary or appropriate to repair or replace products already sold or licensed to our customers. Despite the security measures that we and our service providers utilize, our infrastructure and that of our service providers may be vulnerable to physical break-ins, ransomware, computer viruses, other malicious code attacks by hackers, phishing attacks, social engineering, or similar disruptive problems. There can be no assurances our security measures or those of our service providers will prevent security breaches or incidents. Any disruption or security breach or incident that we or our service providers suffer or are perceived to suffer, including any such disruption, breach or incident resulting in a loss of, or damage to, data or systems, or inappropriate disclosure, access, loss, or other processing of confidential, financial, proprietary or personal information, including data related to our personnel, could result in loss, disclosure or other unauthorized processing of such data, could delay our research and development or commercialization efforts, could compel us to comply with breach notification laws and regulations, subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information. It is possible that we may have to expend additional financial and other resources to address such problems. Remote work by our personnel and those of thir…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We expect to expend significant time and money to maintain or increase the security of our products, facilities, and infrastructure. Security technologies are constantly being tested by computer professionals, academics and “hackers.” Advances in computer capabilities and the techniques for attacking security solutions, new discoveries in the field of cryptography or other events or developments could result in compromises or breaches of our security measures and could make some or all our products obsolete or unmarketable. Remote work by our personnel and those of third parties has resulted in increased vulnerability to cyber-attacks. We may need to dedicate engineering and other resources to mitigate or eliminate security vulnerabilities and may find it necessary or appropriate to repair or replace products already sold or licensed to our customers. Despite the security measures that we and our service providers utilize, our infrastructure and that of our service providers may be vulnerable to physical break-ins, ransomware, computer viruses, other malicious code attacks by hackers, phishing attacks, social engineering, or similar disruptive problems. There can be no assurances our security measures or those of our service providers will prevent security breaches or incidents. Any disruption or security breach or incident that we or our service providers suffer or are perceived to suffer, including any such disruption, breach or incident resulting in a loss of, or damage to, data or systems, or inappropriate disclosure, access, loss, or other processing of confidential, financial, proprietary or personal information, including data related to our personnel, could result in loss, disclosure or other unauthorized processing of such data. Such events could delay our research and development or commercialization efforts, could compel us to comply with breach notification laws and regulations, subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information. It is possible that we may have to expend additional financial and other resources to address such problems, which could have a material adverse impact on our operations.

Previous wording

We also expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, the EU, and other jurisdictions. For example, the European Commission maintains a General Data Protection Regulation (the GDPR) that imposes stringent data protection requirements and provides for substantial penalties for noncompliance. The United Kingdom has enacted a Data Protection Act and legislation referred to as the UK GDPR that substantially implements the GDPR and provides for a penalty regime similar to the GDPR. The United Kingdom made targeted amendments to the Data Protection Act and the UK GDPR in the UK Data (Use and Access) Act, effective June 19, 2025. We may be required to incur substantial expense in order to make significant changes to our products and operations to address compliance with the GDPR and similar legislation, such as the UK GDPR and UK Data Protection Act, all of which may adversely affect our revenue and product sales. California has enacted legislation, the California Consumer Privacy Act (CCPA) that, among other things, requires covered companies to provide disclosures to California consumers, and afford such consumers abilities to opt-out of certain sales of personal information. The CCPA was modified and expanded by the California Privacy Rights Act (CPRA), which was approved by California voters in the November 2020 election. Additionally, other U.S. states continue to propose, and in certain cases adopt, privacy-focused legislation. For example, Connecticut, Virginia, Utah and Colorado enacted legislation similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have enacted similar legislation that has become effective in 2024; Delaware, Nebraska, Maryland, New Hampshire, New Jersey, Minnesota, Tennessee, and Iowa have enacted similar legislation that has or will become effective in 2025; and Indiana, Kentucky, and Rhode Island have enacted similar legislation that will become effective in 2026. The U.S. Department of Justice has also issued regulations regarding certain bulk sensitive personal data transfers. We cannot yet fully determine the impact these or future laws, regulations and standards may have on our business, but they may require us to modify our data processing practices and policies and to incur substantial costs and expenses in efforts to comply. Privacy, data protection and information security laws and regulations are often subject to differing interpretations, may be inconsistent among jurisdictions, and may be alleged to be inconsistent with our current or future practices. Additionally, we may be bound by contractual requirements applicable to our collection, use, processing, and disclosure of various types of data, including personal data, and may be bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters. These and ot…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We also expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, the EU, and other jurisdictions. For example, the European Commission maintains a General Data Protection Regulation (the GDPR) that imposes stringent data protection requirements and provides for substantial penalties for noncompliance. The United Kingdom has enacted a Data Protection Act and legislation referred to as the UK GDPR that substantially implements the GDPR and provides for a penalty regime similar to the GDPR. The United Kingdom made targeted amendments to the Data Protection Act and the UK GDPR in the UK Data (Use and Access) Act, effective June 19, 2025. We may be required to incur substantial expense in order to make significant changes to our products and operations to address compliance with the GDPR and similar legislation, such as the UK GDPR and UK Data Protection Act, all of which may adversely affect our revenue and product sales. California has enacted legislation, the California Consumer Privacy Act (CCPA) that, among other things, requires covered companies to provide disclosures to California consumers, and afford such consumers abilities to opt-out of certain sales of personal information. The CCPA was modified and expanded by the California Privacy Rights Act (CPRA), which was approved by California voters in the November 2020 election. Additionally, other U.S. states continue to propose, and in certain cases adopt, privacy-focused legislation. For example, Connecticut, Virginia, Utah, and Colorado enacted legislation similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas enacted similar legislation that took effect in 2024; Delaware, Nebraska, Maryland, New Hampshire, New Jersey, Minnesota, Tennessee, and Iowa enacted similar legislation that took effect in 2025; and Indiana, Kentucky, and Rhode Island enacted similar legislation that took effect in 2026; and Alabama and Oklahoma enacted similar legislation that takes effect in 2027.

Previous wording

The exercise of our outstanding vested stock options and the vesting of RSUs and restricted stock dilutes the ownership interests of our existing stockholders. As of September 30, 2025, we had 242,300 outstanding options and RSUs to purchase shares of common stock representing approximately 6% of our total shares outstanding of which 228,615 were vested. To the extent restricted stock is awarded, outstanding stock options or warrants are exercised, and RSUs vest, existing stockholders’ percentage voting interests will decline. Also, the number of shares eligible for resale in the public market will increase and such increase may have a negative effect on the value or market trading price of our common stock.

Current wording

The exercise of our outstanding vested stock options and the vesting of RSUs dilutes the ownership interests of our existing stockholders. As of March 31, 2026, we had 697,758 outstanding RSUs and options to purchase shares of common stock representing approximately 18% of our total shares outstanding of which 227,490 were vested. To the extent restricted stock is awarded, outstanding stock options are exercised, and RSUs vest, existing stockholders’ percentage voting interests will decline. Also, the number of shares eligible for resale in the public market will increase and such increase may have a negative effect on the value or market trading price of our common stock.

Previous wording

As of September 30, 2025, our executive officers and directors beneficially owned approximately 17% of our outstanding common stock. Because of their beneficial ownership interest, our officers and directors could significantly influence stockholder actions. This ability to exercise significant influence could prevent or significantly delay another company from acquiring or merging with us.

Current wording

As of March 31, 2026, our executive officers and directors beneficially owned approximately 16% of our outstanding common stock. Because of their beneficial ownership interest, our officers and directors could significantly influence stockholder actions. This ability to exercise significant influence could prevent or significantly delay another company from acquiring or merging with us.

Previous wording

These and other provisions in our Restated Charter, our Restated Bylaws and under Delaware law could discourage potential takeover attempts, reduce the price that investors might be willing to pay for shares of our common stock in the future and result in the market price being lower than it would be without these provisions.

Current wording

In addition, the provisions of Section 203 of the Delaware General Corporation Law govern us. These provisions may prohibit large stockholders, particularly those owning 15% or more of our outstanding voting stock, from merging or combining with us for a certain period of time. These and other provisions in our Restated Charter, our Restated Bylaws and under Delaware law could discourage potential takeover attempts, reduce the price that investors might be willing to pay for shares of our common stock in the future and result in the market price being lower than it would be without these provisions.

Previous wording

We may need to raise additional capital to support our business growth, and this capital may be dilutive, may cause our stock price to drop or may not be available on acceptable terms, if at all.

Current wording

We may need to raise additional capital to support our business in the near term; such capital may be dilutive, may cause our stock price to drop or may not be available on acceptable terms, if at all.

Previous wording

We may need to raise additional capital, which may not be available to us when needed or may not be available on terms acceptable to us, to support our business growth or to respond to business opportunities, challenges, or unforeseen circumstances, including sales under our past and any future shelf registration statements. Our ability to obtain additional capital, if and when required, will depend on our business plans, investor demand, our operating performance, the condition of the capital markets, the terms of our current contractual obligations and other factors.

Current wording

To the extent we are unable to secure additional revenue over the next several months, we will need to raise additional capital in the near term. Based on our current level of operating expenditures, we project that our existing cash, cash equivalents and short-term investments will be insufficient to fund the current level of operations, and we have therefore concluded that the conditions for a going concern disclosure under U.S. GAAP are present, as described notes to our consolidated financial statements. Ourability to obtain additional capital, if and when required, will depend on our business plans, investor demand, our operating performance, the condition of the capital markets, the terms of our current contractual obligations and other factors.

Previous wording

Our business may be adversely affected by instability, disruption, or destruction in a geographic region in which we operate, regardless of cause, including war, terrorism, riot, civil insurrection, or social unrest, and natural or manmade disasters, including famine, flood, fire, earthquake, storm, or pandemic events and spread of disease. Our business may also be adversely affected by further downturn in macroeconomic conditions, including inflation and rising interest rates, tariffs, trade wars, global political and economic uncertainty and tensions, such as the ongoing Russia-Ukraine and Israel-Hamas conflicts, as well as any related political or economic response, counter responses or otherwise, financial services sector instability, a reduction in business confidence and activity, financial market volatility, unexpected changes in tax law or policy, and other factors. Such events can adversely affect our operations or the economy as a whole and may cause our customers to delay their decisions on spending for the services we provide and perpetuate significant changes in regional and global economic conditions and cycles. These events may also pose risks to our personnel and to physical facilities and operations, which could adversely affect our financial results.

Current wording

Our business may be adversely affected by instability, disruption, or destruction in a geographic region in which we operate, regardless of cause, including war, terrorism, riot, civil insurrection, or social unrest, and natural or manmade disasters, including famine, flood, fire, earthquake, storm, or pandemic events and spread of disease. Our business may also be adversely affected by further downturn in macroeconomic conditions, including inflation and rising interest rates, tariffs, trade wars, global political and economic uncertainty and tensions, such as the ongoing Russia-Ukraine and Middle East conflicts, as well as any related political or economic response, counter responses or otherwise, financial services sector instability, a reduction in business confidence and activity, financial market volatility, unexpected changes in tax law or policy, and other factors. Such events can adversely affect our operations or the economy as a whole and may cause our customers to delay their decisions on spending for the services we provide and perpetuate significant changes in regional and global economic conditions and cycles. These events may also pose risks to our personnel and to physical facilities and operations, which could adversely affect our financial results.

Previous wording

Changes to U.S. federal, state, and local, and foreign tax laws that may be enacted in the future could impact the tax treatment of our business operations. Our effective tax rate could be adversely affected by several factors, many of which are outside of our control, including changes in the mix of earnings and losses in countries with differing statutory tax rates, changes in the valuation of deferred tax assets and liabilities, changes in tax laws, rates, treaties and regulations or the interpretation of the same, changes to the financial accounting rules for income taxes, the outcome of current and future tax audits, examinations or administrative appeals and certain non-deductible expenses. In addition, many jurisdictions, including the United States, are actively considering changes to existing tax laws or have proposed or enacted new laws, such as the recently enacted U.S. federal tax legislation commonly referred to as the One Big Beautiful Bill Act (OBBB Act), that could increase our tax obligations in countries where we do business or cause us to change the way we operate our business. We are currently evaluating the full impact of the OBBB Act on us.

Current wording

Changes to U.S. federal, state, and local, and foreign tax laws that may be enacted in the future could impact the tax treatment of our business operations. Our effective tax rate could be adversely affected by several factors, many of which are outside of our control, including changes in the mix of earnings and losses in countries with differing statutory tax rates, changes in the valuation of deferred tax assets and liabilities, changes in tax laws, rates, treaties and regulations or the interpretation of the same, changes to the financial accounting rules for income taxes, the outcome of current and future tax audits, examinations or administrative appeals and certain non-deductible expenses. In addition, many jurisdictions, including the United States, are actively considering changes to existing tax laws or have proposed or enacted new laws, such as the recently enacted U.S. federal tax legislation commonly referred to as the One Big Beautiful Bill Act (OBBB Act), that could increase our tax obligations in countries where we do business or cause us to change the way we operate our business. We are currently evaluating the full impact of the OBBB Act on us. As of March 31, 2026, the OBBB Act has had no material income tax impact on our financial statements.

Previous wording

In addition, the Organization for Economic Cooperation and Development has proposed imposing a 15% global minimum tax under the Pillar Two Model Rules (Pillar Two), and this proposal has been adopted or is being considered by a number of countries, which could impact our business if we expand internationally. However, on June 28, 2025, the G7 released a joint statement that it had reached an understanding with the United States for a side-by-side system based on certain accepted principles, including that U.S.-parented groups, such as ours, would be exempt from certain provisions of Pillar Two. Any of these developments or changes in U.S. federal, state or international tax laws or tax rulings could adversely affect our effective tax rate and our operating results.

Current wording

In addition, the Organization for Economic Cooperation and Development has proposed imposing a 15% global minimum tax under the Pillar Two Model Rules (Pillar Two), and this proposal has been adopted or is being considered by a number of countries, which could impact our business if we expand internationally. However, on June 28, 2025, the G7 released a joint statement that it had reached an understanding with the United States for a side-by-side system based on certain accepted principles, including that U.S.-parented groups, such as ours, would be exempt from certain provisions of Pillar Two. Any of these developments or changes in U.S. federal, state or international tax laws or tax rulings could adversely affect our effective tax rate and our operating results. As of March 31, 2026, we are not yet subject to Pillar Two due to the level of gross receipts.

Previous wording

Our common stock is currently listed on Nasdaq and was previously listed on NYSE and NYSE American LLC (formerly the NYSE MKT LLC). Over the past year, the market price of our common stock has experienced significant fluctuations. Between October 1, 2024, and September 30, 2025, the adjusted closing price for our common stock ranged between $3.86 and $20.91. The price of our common stock may continue to be volatile as a result of several factors, some of which are beyond our control. These factors include, but are not limited to, the following:

Current wording

Our common stock is currently listed on the Nasdaq Stock Market LLC (Nasdaq) and was previously listed on NYSE and NYSE American LLC (formerly the NYSE MKT LLC). Over the past year, the market price of our common stock has experienced significant fluctuations. Between April 1, 2025, and March 31, 2026, the adjusted closing price for our common stock ranged between $7.50 and $24.84. The price of our common stock may continue to be volatile as a result of several factors, some of which are beyond our control. These factors include, but are not limited to, the following: