Cycurion, Inc.

2. SIGNIFICANT ACCOUNTING POLICIES

(a)Basis of Presentation and Principles of Consolidation

The accompanying unaudited consolidated financial statements for the Company have been prepared in accordance with accounting principles generally accepted in the United States ("U.S. GAAP") and pursuant to the rules and regulations of the SEC. The consolidated financial statements include the accounts of the Company and its wholly-owned subsidiaries.

These financial statements include the accounts of Cycurion, Inc. (f/k/a KAE Holdings, Inc.; f/k/a Cyber Secure Solutions, Inc.) and its wholly owned subsidiaries: Axxum, Cloudburst and Cycurion Innovation. Additionally, the financial statements include the accounts of SLG Innovation Inc. (“SLG”) as a result of the master service agreement entered into between the Company and SLG. The Company has determined that the SLG transaction constitutes a business combination as defined by ASC 805, Business Combinations (“ASC 805”). ASC 805 establishes principles and requirements as to how the acquirer of a business recognizes and measures in its financial statements the identifiable assets acquired, the liabilities assumed and any non-controlling interest in the acquiree. The assets acquired and liabilities assumed were recognized provisionally in the accompanying consolidated balance sheets at their estimated fair values as of March 31, 2025, and adjusted in the second and third quarter of 2025. All significant inter-company balances, fees, and expenses have been eliminated in consolidation.

The accompanying unaudited consolidated financial statements should be read in conjunction with the Company’s audited financial statements and notes thereto, included in the Annual Report on Form 10-K filed with the SEC on April 17, 2025.

(b)Basis of Presentation for Interim Periods

Certain information and footnote disclosures normally included for the annual financial statements prepared in accordance with U.S. GAAP have been omitted for the interim periods presented and accordingly, they do not include all of the information and footnotes required by GAAP for audited financial statements. Management believes that the unaudited interim financial statements include all adjustments (which are normal and recurring in nature) necessary to present fairly the financial position of the Company and the results of operations and cash flows for the periods presented.

The results of operations for the periods presented are not necessarily indicative of the results that may be expected for the year ending December 31, 2025. Seasonal changes, political and other conditions can affect the sales volumes of the Company's products. Therefore, the financial results for any interim period do not necessarily indicate the expected results for the year.

(c)Reclassification

Certain amounts have been reclassified to improve the clarity and comparability of the financial statements. These reclassifications had no impact on previously reported total assets, liabilities, equity, net income (loss), or cash flows for any periods presented.

(d)Emerging Growth Company

The Company is an emerging growth company as defined in Section 102(b)(1) of the Jumpstart Our Business Start-ups Act of 2012 (the “JOBS Act”) which exempts emerging growth companies from being required to comply with new or revised financial accounting standards until private companies (that is, those that have not had a Securities Act registration statement declared effective or do not have a class of securities registered under the Exchange Act) are required to comply with the new or revised financial accounting standards. The JOBS Act provides that an emerging growth company can elect to opt out of the extended transition period and comply with the requirements that apply to non-emerging growth companies, but any such an election to opt out is irrevocable. The Company has elected not to opt out of such extended transition period, which means that when a standard is issued or revised, and it has different application dates for public or private companies. The Company, as an emerging growth company, can adopt the new or revised standard at the time private companies adopt the new or revised standard.

This may make comparison of the Company’s financial statements with another public company that is neither an emerging growth company nor an emerging growth company that has opted out of using the extended transition period difficult or impossible because of the potential differences in accounting standards used.

(e)Use of estimates

The preparation of financial statements in conformity with GAAP, requires management to make estimates and assumptions that affect the reported amounts of assets, liabilities, and disclosures regarding contingent liabilities at the date of the financial statements. These estimates may affect the reported amounts for certain revenues and expenses incurred during the reporting period; actual results may materially differ from these estimates.

(f)Commitments and contingencies

Liabilities for loss contingencies arising from claims, assessments, litigation, fines and penalties and other sources are recorded when it is probable that a liability has been incurred and the amount of the assessment can be reasonably estimated.

(g)Recently Issued Accounting Pronouncements

In November 2024, the FASB issued ASU 2024-03, Income Statement-Reporting Comprehensive Income-Expense Disaggregation Disclosures (Subtopic 220-40): Disaggregation of Income Statement Expenses, requiring public entities to disclose additional information about specific expense categories in the notes to the financial statements on an interim and annual basis. ASU 2024-03 is effective for fiscal years beginning after December 15, 2026, and for interim periods beginning after December 15, 2027, with early adoption permitted. The Company is currently evaluating the impact of adopting ASU 2024-03.

In March 2024, the FASB issued ASU 2024-02 “Codification Improvements – Amendments to Remove References to the Concepts Statements” (“ASU 2024-02”), which contains amendments to the codification to remove references to various

FASB Concepts Statements. In most instances, the references are extraneous and not required to understand or apply the guidance. Generally, ASU 2024-02 is not intended to result in significant accounting changes for most entities. ASU 2024-02 is effective for the Company for fiscal years beginning after December 15, 2024. The Company does not expect this update to have a material impact on its financial statements.

The Company has considered all other recently issued accounting pronouncements and does not believe the adoption of such pronouncements will have a material impact on its financial statements.

3. REVENUE RECOGNITION

We recognize revenue in accordance with ASC Topic 606, "Revenue from Contracts with Customers," as, or when, we satisfy performance obligations under a contract. We account for a contract when the parties approve the contract and are committed to perform on it, the rights of each party and the payment terms are identified, the contract has commercial substance, and it is probable that we will collect substantially all of the consideration. A performance obligation is a promise in a contract to transfer a distinct good or service, or a series of distinct goods or services, to a customer. The transaction price of a contract must be allocated to each performance obligation and recognized as the performance obligation is satisfied.

In most cases, we view our performance obligations as promises to transfer a series of distinct services to our customer that are substantially the same and which have the same pattern of service. We recognize revenue over the performance period as a customer receives the benefits of our services. Typically, the performance obligations in the contract are the delivery of service hours. When the Company has obtained evidence that the service has been delivered and the performance obligations have been fulfilled, it will record revenue and recognize an asset such as accounts receivable.

Advisory Consulting

The Company enters into service agreements with customers that will set forth the responsibilities of both parties, including the type of service to be delivered, the timing of the delivery of those services, and the associated price per unit for such services. The unit of measure in the agreement is typically hours. The advisory consulting services represent a single performance obligation, as they constitute a series of distinct hourly services that are substantially the same and transferred to the customer over time. The revenue from advisory service agreement will also set forth the timing of payments by the customers which is typically between 60 and 90 days from the date that an invoice is issued to the customer. The Company issues invoices when management has received acknowledgment from the customer that it has rendered service as measured in hours to the customer. As a practical matter, the Company continuously delivers service to customers, and the customer receives benefits from those services over time. The revenue advisory consulting is recognized over time as services are rendered, based on contractual hourly rates, and when the Company has received the aforementioned acknowledgement from its customers that service has been rendered related to hours accumulated over period of time, such as a week, or two weeks, or a month, which is determined on a customer-by-customer basis. The Company’s contracts do not include terms for returns, or warranties, or guarantees, or rebates, or discounts on the services rendered. The Company also enters into annual contracts with customers to provide ongoing advisory and consulting services. Services are delivered continuously over the contract term and customers are billed periodically. The annual service contract represents a single performance obligation because the services are a series of distinct, substantially similar acts that are inseparable and transferred over time. Revenue is recognized over time straight-line over the contract term.

Managed Security Service Practice (MSSP)

Management has determined that its managed security service practice is a bundle of cybersecurity software tools, and expert 24x7x365 monitoring and breach resolution service that is accounted for as a single performance obligation that is delivered over time which is typically a month. The components of the bundle have individual commercial value. However, management believes assigning stand-alone value to each component is impractical because each component would not be able to be fully implemented or utilized if not packaged with the other components. Therefore, management believes the MSSP can only be sold as a bundle package over time. At the time that the Company recognizes revenue, it is has either already received funds in advance from its customer or it is reasonably assured that it will collect funds from its customer. In the event that funds that are received in advance, they are accounted for as contract liabilities in the deferred revenue account until the Company fulfills the performance obligation. A majority of the Company’s contracts call for the Company to first deliver service and collect fees thereafter. The Company typically receives payment for these contracts within thirty to ninety days of delivery of service. The Company does not sell monitoring time, security software-tools, and breach resolution as stand-alone services, as the customer would not receive the benefits of these items if they were not sold as an integrated package. The cybersecurity needs to monitor the customer cybersecurity environment regularly, stay up to date on cyberthreats and solutions, maintain its software tools, and then address threats identified, or rectify situations when customer environments have been breached. It is not practical or viable to sell these components separately, as customers expect comprehensive solutions. While the components are separately identifiable, management does not believe they could market the components individually. The Company’s management does not believe their customers can benefit from the individual components alone, and there are not readily available resources in the market that can be obtained to make those components viable. The continuous monitoring allows the Company to identify and either neutralize and or rectify breaches by having up to the minute first-hand information, and the tools allow the Company to implement solutions rapidly. The absence all of the components would render the solutions and service offering significantly devalued and non-competitive in the marketplace.

The Company believes MSSP meets the criteria to combine the goods and services under a single performance obligation. The Company believes combined integrated solution is delivered continuously over a period of time. In accordance with the terms of the contract between the Company and its customers, the Company receives prepayments in advance from its customers, and recognizes those payments to revenues over a period of time, which is typically each month.

Managed Service Provider (MSP)

The Company’s managed service provider (MSP) service offering is the provision of IT infrastructure support to customers, specifically in the areas of desktop support, on-site troubleshooting, and cloud-based network infrastructure troubleshooting. This service is accounted for as a single performance obligation that is delivered over time, which is typically a month; At the time that the Company recognizes revenue, it either already received funds in advance from its customer, or it is reasonably assured that it will collect funds from its customer. In the event that funds that are received in advance, they are accounted for as contract liabilities in the deferred revenue account until the Company fulfills the performance obligation. A majority of the Company’s contracts call for the Company to first deliver service and collect fees thereafter. The Company typically receives payment for these contracts within thirty to ninety days of delivery of service.

MSP requires the integration of tools and labor in order for a customer to receive any benefit from the services provided. The Company refers to the guidance in ASC 606-10-25-19 to provide an analysis regarding this accounting recognition of this integrated service. Under MSP, the customer cannot receive any benefit purely from labor or individual software tools as a stand-alone service. The tools that the Company deploys require engineers to decipher results and develop solutions to problems during the service period covered in a contract.

While components can be separately identified, they must be used in conjunction with each other to serve the Company’s customers. The Company must continuously make available support engineers to customers whenever they need support and troubleshooting. The service includes remote resolution of issues or going onsite to customer locations to solve problems. The Company’s contracts with customers require the Company to have these resources available during the length of the contract. Therefore, these services are continuously delivered as a service over time. Accordingly, the Company recognizes revenue for such MSP contract on a monthly basis.

Software as a service (SaaS)

Management has determined that its software as a service is a suite of cybersecurity tools that are delivered either remotely or on customer premises. The service is delivered on a monthly basis. The cybersecurity tools are typically sold as a package. However, the individual components of the suite of tools can either be sold individually or bundled together. Nevertheless, if they are sold individually, or as a bundle, they are all delivered over time. Accordingly, the Company recognizes revenue over time, which is typically monthly; At the time that the Company recognizes revenue it is has either already received funds in advance from its customer, or it is reasonably assured that it will collect funds from its customer. In the event that funds that are received in advance, they are accounted for as contract liabilities in the deferred revenue account until the Company fulfills the performance obligation. A majority of the Company’s contracts call for the Company to first deliver service and collect fees thereafter. The Company typically receives payment for these contracts within thirty to ninety days of delivery of service.

The Company’s SaaS is delivered continuously over time. It is a subscription service where the Company provisions a suite of security software tools to its customers accessed via the internet that allows the customers to protect themselves from cyber-attacks using multiple tools within the suite. This subscription service is recognized to revenue monthly.