INTRUSION INC

Our Corporate Information

We were organized in Texas in September 1983 and reincorporated in Delaware in October 1995. Our principal executive offices are located at 101 East Park Boulevard, Suite 1200, Plano, Texas 75074, and our telephone number is (972) 234-6400. Our website URL is www.intrusion.com. We post the following filings in the “Investors” section of our website as soon as reasonably practicable after they are electronically filed with or furnished to the Securities and Exchange Commission: our Annual Reports on Form 10-K; our Quarterly Reports on Form 10-Q; our current reports on Form 8-K; and any amendments to those reports or statements filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act. All such filings on our website are available free of charge. Additionally, filings are available on the Securities and Exchange Commission’s website (www.sec.gov). In this report, references to the “Company,” “we”, “us,” “our”, “Intrusion” or “Intrusion Inc.” refer to Intrusion Inc. and its subsidiaries.TraceCop andSavant are registered trademarks of the Company. We have also applied for trademark protection forINTRUSIONShield.

Our Business

Intrusion, Inc. is a cybersecurity company based in Plano, Texas. The company offers its customers access to its exclusive threat intelligence database containing the historical data, known associations, and reputational behavior of over 8.5 billion Internet Protocol (“IP”) addresses. After years of gathering global internet intelligence and working exclusively with government entities, the company released its first commercial product in 2021.

For the fiscal years ended December 31, 2023, and 2022, we generated revenues of approximately $5.6 million and $7.5 million, respectively, and reported net loss of approximately $13.9 million and $16.2 million, respectively, and cash flow used in operating activities of approximately $7.8 million and $13.2 million, respectively. As noted in our audited financial statements, as of December 31, 2023, we had stockholders’ deficit of $9.6 million and a working capital deficit of $13.1 million. As a result of our historical recurring losses from operations, negative cash flows from operations, net working capital deficiency as well as our dependence on equity and debt financings, there is a substantial doubt regarding our ability to continue as a going concern.

Our Solutions

INTRUSION Shield™

INTRUSIONShield, our newest cybersecurity solution is a Zero Trust reputation-based Software as a Service (“SaaS”) solution that inspects and kills dangerous network (in and outbound) connections. What makes our approach unique is thatINTRUSIONShield evaluates every packet and analyzes the IP addresses (source and destination), as well as domain information and the ports utilized and, when combined with other threat intelligence data reports, blocks malicious connections. Many breaches today are caused by Zero-Day and malware free compromises that may not trigger alarms in a traditional firewall or endpoint solution.INTRUSIONShield’s capabilities are designed to continuously evolve as the threats and landscape change over time. Unlike traditional industry approaches that rely heavily on signatures, complex rules, and human factors mitigation, which malicious actors and nation states have learned to bypass,INTRUSIONShield*’s* proprietary architecture isolates and neutralizes malicious traffic and network flows that existing solutions are ill equipped to handle.

In September 2022, we expanded theINTRUSIONShield product line to include the Shield Cloud and Shield End-Point solutions. The initialINTRUSIONShield offering released in early 2021, the Shield On-Premise solution, utilizes hardware and is placed behind a firewall in a data center. Shield Cloud extends the effectiveness of the Shield On-Premise solution to Infrastructure as a Service (IaaS), Platform as a Service (PaaS), SaaS and serverless resources in the public cloud. This product serves as a protective gateway to the cloud, providing both Zero Trust access to, and protecting outbound connections from, virtual hosts and serverless functions within the cloud. Shield Endpoint helps protect the network outside of the corporate enclave and data center to include protection for remote workers, mobile, and cloud devices. This product brings the network protection of the Shield On-Premise to these remote user devices establishing a Zero Trust network, both for intra-organization connectivity and external internet connectivity.

INTRUSION TraceCop®

INTRUSIONTraceCop is a big data tool with extensive IP intelligence canvassing the entire internet. It contains what we believe to be the largest existing repository of reputation information on known good and known bad active IP addresses (both IPv4 and IPv6).TraceCop contains an inventory of network selectors and enrichments useful to support forensic investigations***.*** The data contains a history of IPv4 and IPv6 block allocations and transfers, historical mappings of IP addresses to Autonomous Systems (ASNs) as observed through BGP, and approximately one billion historically registered domain names and registration context.TraceCop contains tens of billions of historic DNS resolutions of Fully Qualified Domain Names (FQDNs or hostnames) on each of these domains. Together, the resulting data shows relationships, hosting, and attribution for internet resources.TraceCop* *also contains web server surveys of content, such as natural language and topic of the content on hundreds of millions of websites and servers and OS fingerprints of services showing applications running on a given IP address.TraceCop also contains a history of threat and reputation for each hostname and IP address over time. All these features combine to create a very effective network forensics and cybersecurity analysis tool.

INTRUSION Savant®

INTRUSIONSavant is a network monitoring solution that leverages the rich data available inTraceCop to identify suspicious traffic in real-time.Savant uses several original patents to uniquely characterize and record all network flows.Savant is a network reconnaissance and attack analysis tool used by forensic analysts in United States (“U.S.”) government agencies and corporations with in-house threat research teams. For example,Savant users can create various automated rules to inspect packets matching (or not) certain criteria such as creating a rule to ensure the Source MAC address field in the Ethernet header and Source IP address from the IP header are always the same, failing which could indicate MAC or IP Spoofing in progress. Similarly, threat investigators can create rules using regular expressions to analyze multiple fields in the packet headers.

Our Intellectual Property and Licenses

Our success and our ability to compete are primarily dependent upon our proprietary technology. We principally rely on a combination of contractual rights, trade secrets and copyright laws to establish and protect our proprietary rights in our solutions. In addition, we have received two patents, and we have applied for patents for ourINTRUSIONShield family of solutions. We have also entered into non-disclosure agreements with our suppliers, resellers, and certain customers to limit access to and disclosure of our proprietary information. There can be no assurance that the steps taken by us to protect our intellectual property will be adequate to prevent misappropriation of our technology or that our competitors will not independently develop technologies that are substantially equivalent or superior to our technology, although it would be extremely difficult to replicate the proprietary and comprehensive internet databases we have developed over the past 25+ years.

We have entered into software and solution license agreements with various suppliers. These license agreements provide us with additional software and hardware components that add value to our cybersecurity solutions. These license agreements do not provide proprietary rights that are unique or exclusive to us and are generally available to other parties on the same or similar terms and conditions, subject to payment of applicable license fees and royalties. We do not consider any of the solution license, software, or supplier agreements to be material to our business, instead, they are complementary to our business and offerings.

Our Competition

The market for network and data protection security solutions is intensely competitive and subject to frequent introductions of new technologies, and potentially improved price and performance characteristics. Industry suppliers compete in areas such as conformity to existing and emerging industry standards, interoperability with networking and other cybersecurity solutions, management and security capabilities, performance, price, ease of use, scalability, reliability, flexibility, features, and technical support. Our principal competitors in the data mining and advanced persistent threat market include Darktrace, Trellix, and Recorded Futures.

There are numerous companies competing in various segments of the data security market. At this time, we have little or no competitors forTraceCop; however, we believe competitors could emerge in the future. These competitors currently perform only a portion of the functions that we can perform withTraceCop. We have been continuously collecting theTraceCop data for more than twenty years, and we believe that none of our current or future competitors will have the ability to provide and reference this historical data. In our newest market segment, data mining and advanced persistent threat detection, we compete directly and indirectly with companies and open-source technologies in the firewall, intrusion detection and prevention, anti-virus, network analysis, endpoint protection, and insider threat prevention areas of cybersecurity technology.

We believe theINTRUSIONShield product line is novel and unique in our industry because of our proprietary threat-enriched big data. We believe that ourINTRUSIONShield family of solutions complement our customer’s existing cybersecurity processes and third-party solutions. If theINTRUSIONShield receives widespread acceptance in the market, we anticipate that other businesses will seek to compete withINTRUSIONShield; however, we believe our existing, mature, and proprietary database which is integral to the operation ofINTRUSIONShield will be difficult, if not impossible, for other companies in our industry to replicate and will be a significant barrier to entry of competitors in the near- and long-term future of cyber security solutions.

Our Customers: Government Sales

Sales to U.S. government customers accounted for 46.2% of our revenues for the year ended December 31, 2023, compared to 65.8% of our revenue in 2022. We expect to continue to derive a substantial portion of our revenues from sales to governmental entities in the future as we continue to market our products and data mining products to the government, and we intend to marketINTRUSIONShield not only to our long-standing governmental customer base but to expand our efforts to include more traditionally administrative and civilian governmental entities. Sales to government clients present risks in addition to those involved in sales to commercial customers that could adversely affect our revenues, including potential disruption due to irregularities in or interruptions to appropriation and spending patterns, delays in approving a federal budget and the government’s reservation of the right to cancel contracts and purchase orders for its convenience.

We make our sales under purchase orders and contracts. Our customers, including government customers, may cancel their orders or contracts with little or no prior notice and without penalty. Although we transact business with various government entities, we believe that the cancellation of any order in itself could have a material adverse effect on our financial results. Because we derive and expect to continue to derive a substantial portion of our revenue from sales to government entities, a large number of cancelled or renegotiated government orders or contracts could have a material adverse effect on our financial results.

Third-Party Products

We currently utilize commercially available computers and servers from various vendors which we integrate with our software products for implementation into our customer networks. We do not consider any of these third party relationships to be material to the Company’s business or results of operations.

Customer Services

Our solutions may include installation, operation of our technology and threat data interpretation and reporting.

Sales, Marketing and Customers

Field Sales Force. Our sales organization focuses on major account sales, channel partners including distributors, value added resellers (“VARs”) and integrators; promotes our solutions to current and potential customers; and monitors evolving customer requirements. The field sales and technical support force provides training and technical support to our resellers and end users and assists our customers in designing cyber secure data networking solutions. We currently conduct sales and marketing efforts from our principal office in Plano, Texas.

Resellers. Resellers such as domestic and international system integrators and VARs sell our solutions as stand-alone solutions to end users and integrate our solutions with products sold by other vendors into network security systems that are sold to end users. Our field sales force and technical support organization provide support to these resellers. Our agreements with resellers are non-exclusive, and our resellers generally sell other products and solutions that may compete with our solutions. Resellers may place higher priority on products or solutions of other suppliers who are larger and have more name recognition, and there can be no assurance that resellers will continue to sell and support our solutions.

Foreign Sales. Export sales did not account for any revenue in 2023 and 2022.

Marketing. We have implemented several methods to market our solutions, including participation in trade shows and seminars, distribution of sales literature and solution specifications and ongoing communication with our resellers and installed base of end-user customers.

Customers. Our end-user customers include U.S. federal government, state and local government entities, large and diversified conglomerates, and manufacturing entities. Sales to certain customers and groups of customers can be impacted by seasonal capital expenditure approval cycles, and sales to customers within certain geographic regions can be subject to seasonal fluctuations in demand.

In 2023, 46.2% of our revenue was derived from a variety of U.S. government entities through direct sales and indirectly through system integrators and resellers. These sales are attributable to six U.S. Government customers through direct and indirect channels; two U.S. government customers individually exceeded 10% of total revenue in 2023. A reduction in our sales to U.S. government entities could have a material adverse effect on our business and operating results if not replaced.

Backlog. We believe that only a small portion of our order backlog is non-cancelable, and that the dollar amount associated with the non-cancelable portion is immaterial. Commercial orders are generally fulfilled within two days to two weeks following receipt of an order. Certain orders may be scheduled over several months, generally not exceeding one year.

Customer Support, Service and Warranty. We service, repair, and provide technical support for our solutions. Our field sales and technical support force works closely with resellers and end-user customers on-site and by telephone to assist with pre- and post- sales support services such as network security design, system installation and technical consulting. By working closely with our customers, our employees increase their understanding of end-user requirements and are then able to provide specific input in our solution development process.

We warrant all our solutions against defects during the service period. Before and after expiration of the solution warranty period, we offer both on-site and factory-based support, parts replacement, and repair services. Extended warranty services are separately invoiced on a time and materials basis or under an annual maintenance contract.

Employees

As of December 31, 2023, we employed a total of forty-nine persons, five of which are part time. None of our employees are represented by a labor organization, and we are not a party to any collective bargaining agreement. Competition in the recruiting of personnel in the networking and data security industry is intense. We believe that our future success will depend in part on our continued ability to hire, motivate and retain qualified management, sales, marketing, and technical personnel.

Our Code of Conduct

The Company’s directors and employees are required to abide by the Company’s Code of Business Conduct and Ethics, which the Company adopted on September 14, 2020, as amended on March 16, 2022 (the “Code”) to ensure that the Company’s business is conducted in a consistently legal and ethical manner and to avoid instances of insider trading. The Code covers areas of professional conduct that include conflicts of interest, fair dealing and the strict adherence to all laws and regulations applicable to the conduct of the Company’s business.

The full text of the amended Code is published on the Company’s website under the investor relations tab at www.intrusion.com. The Company intends to disclose future amendments to, or waivers from, certain provisions of the Codes of Ethics on the Company’s website within four business days following the date of such amendment or waiver. Upon the written request of any stockholder, the Company will furnish, without charge, a copy of the Code. This request should be directed to the Company’s Secretary at 101 East Park Blvd., Suite 1200, Plano, TX 75074.

Reverse Stock Split

On March 22, 2024, we effected a 1-for-20 reverse stock split of our common stock. All share and per share amounts set forth in the Consolidated Financial Statements have been retroactively restated to reflect the split effected in March 2024 as if it had occurred as of the earliest period presented and unless otherwise stated, all other share and per share amounts for all periods presented in this Annual Report have been adjusted to reflect the reverse stock split effected in March 2024.