NASDAQ: CYCU

We have two first-tier wholly-owned subsidiaries, Cycurion Sub (formerly Cycurion, Inc., until February 14, 2025) and Cycurion Crypto Inc., a Delaware corporation formed in July 2025, and three indirectly wholly-owned second-tier subsidiaries: (i) Axxum Technologies LLC ("Axxum"), a Virginia limited liability company formed in December 2006, (ii) Cloudburst Security LLC ("Cloudburst"), a Virginia limited liability company formed in January 2007, and (iii) Cycurion Innovation, Inc., a Delaware corporation formed in September 2021, in connection with our acquisition of assets from Sabres Security Ltd. ("Sabres"), a leading Israeli-based cybersecurity provider.

In addition, we also integrated SLG Innovation, Inc. ("SLG"), which provides data modernization and technology services to state and local government agencies, expanding our footprint in public-sector IT modernization.

Our Business

We provide innovative custom solutions for our clients by adapting our knowledge base and government-level experience to create dynamic solutions to best serve our client's IT and cybersecurity needs. We assess, secure and advise your organization by leveraging our government proven, cutting edge techniques, custom tools and extensively knowledgeable personnel to revolutionize the client’s cybersecurity posture.

We are committed to surpassing expectations and delivering incomparable value to our clients and partners. We achieve this goal by providing network communications and information technology security services and solutions that are custom-tailored to your environment, as well as your level of need. We are built on a foundation of experts in network communications and information technology who possess unrivaled security expertise and experience. We are committed to hiring the most knowledgeable professionals in order to expand and reinforce our team of experts, leveraging world-class talent to improve and expand upon our already vast understanding of this environment. We pride ourselves on having the capability and resources to successfully implement a management strategy that delivers the solutions you need to stay within budget and on schedule.

We deliver high-quality, cybersecurity solutions to federal government civilian, defense and judicial agencies in addition to commercial clients across a variety of industries. We, through our operating subsidiaries and strategic partnerships, have numerous prime and subcontracts with key government agencies. Our growth engine is driven by organic business solutions and strategic acquisitions of cybersecurity services and technology providers. We leverage our highly skilled workforce to access, secure and advise our clients to improve their cybersecurity posture. Our ability to identify and implement customized solutions is core to driving continued growth.

Our Services

Consulting and Advisory Services

Our consulting services perform a detailed review of our customers' IT security to identify and address vulnerabilities. Using advanced tools and research techniques, we enhance our customers' cybersecurity program to meet regulatory compliance, data confidentiality and privacy standards, and train our customers' personnel accordingly.

Our advisory services supplement our consulting services with a cost-effective alternative to a full-time chief information officer. Our customers gain access to our pool of experienced chief information officers, who are backed by our resources. They deliver tailored advice and training to keep our customers’ organization ahead in the ever-changing cybersecurity landscape.

Our consulting and advisory services include: (i) security control assessments; (ii) security architecture and engineering; (iii) risk management and compliance audits; (iv) staff augmentation; (v) cybersecurity awareness and training; (vi) cloud security; (vii) virtual CISO support; and (viii) digital modernization.

Managed IT Services

Our managed IT services can optimize an organization's IT infrastructure, reduce costs and improve operational efficiency, and it offers comprehensive IT management and support for organizations of all sizes.

Managed IT services is a services model in which a managed service provider ("MSP") remotely manages the day-to-day IT offerings for a client under a service level agreement ("SLA"). This includes remote monitoring and management of servers, disaster recovery, infrastructure as a service ("IaaS"), platform as a service ("PaaS"), and software as a service ("SaaS"). In short, managed IT services provides businesses with IT support and maintenance on an ongoing basis.

IT services are typically provided on a break-fix basis, meaning that the client only calls the provider when there is a problem with its IT infrastructure. Managed IT services, on the other hand, are provided on an ongoing basis under an SLA. This means that the MSP is responsible for the day-to-day maintenance of the client’s IT infrastructure and is always monitoring and managing the system to ensure it is running smoothly.

For example, a company that provides cloud services to businesses would offer managed platform services, remote monitoring and management of servers and security services. The MSP would handle the day-to-day maintenance of the client’s IT infrastructure and offers disaster recovery services in the event of a data breach or other catastrophe.

Our managed IT services include: (i) project and license management; (ii) network infrastructure; (iii) systems engineering and administration; (iv) voice and data infrastructure engineering and management; (iv) application development; (v) IT help desk support; and (vi) staff augmentation.

Managed Security Services

We are a professional and trusted provider of managed security services. We have designed comprehensive security management solution to help organizations protect their digital assets against various cyber threats. Our managed security services include 24/7 monitoring, threat detection, incident response and remediation. Our Security Operations Center ("SOC") as a service offers organizations with a team of security professionals dedicated to monitoring and managing their security infrastructure.

Managed security services ("MSS") are a crucial component of a robust security program. Managed security service providers ("MSSPs") specialize in protecting businesses from cyber threats and deliver a range of security services including, but not limited to, intrusion detection, vulnerability assessments and network security services.

MSSPs offer organizations access to a dedicated team of security professionals who use the latest security architectures and technologies to monitor their clients’ networks and systems, identify potential threats and respond promptly to security incidents. This is especially important for small to mid-sized businesses that may not have the in-house resources to maintain a robust security posture on their own.

MSS plays a critical role in safeguarding businesses from cyber threats in today's digital landscape, making them an essential partner for organizations across industries. MSSPs work with clients ranging from small businesses to large enterprises and are often partnered with internet service providers to provide comprehensive security solutions.

Managed security services can also help organizations meet compliance requirements and reduce the risk of data breaches, which can be costly in terms of lost data, damaged reputation, and regulatory penalties. Additionally, MSSPs can provide SaaS solutions, allowing businesses to access security tools and services on-demand without having to invest in expensive hardware and software.

Our MSS include: (i) managed detection and response; (ii) external attack surface management; (iii) threat hunting and threat intelligence; (iv) end point detection and response; (v) firewall management; (vi) threat and vulnerability management; (vii) vulnerability and penetration testing; (viii) 24/7/365 security monitoring; and (ix) digital forensic and incident response.

Industries We Serve

Government

Government entities face a number of compliance and certification challenges. With constantly changing legislation, meeting government mandate and expectations in the IT environment is often a challenge. We leverage our historical knowledge and extensive experience on the federal level to continue to fulfill all of IT needs across the government organization.

Bad actors attack government agencies by targeted cyber threats, personnel exploitation and creative manipulation to gain access to critical systems and infrastructure through unperceived vulnerabilities. Public platforms, such as social media, surface, deep and dark web, present substantial risks through knowledge gaps in personnel training, presenting high risk and substantial possibility of security failure. We have been defending and optimizing these environments at the federal level for over a decade and, as a result, have created a robust and predictive methodology to defend and optimize government organizational and security gaps in order to mitigate these threats and vulnerabilities before they are compromised. We provide the knowledge, experience and analytical understanding of this environment to evolve our services to meet current and future needs across the IT spectrum.

Our extensive knowledge and real-world experience with government agencies allow us to understand the operational, security and overall IT needs and challenges that such agencies must overcome to achieve their mandate. We leverage our experience in this space allowing us to provide best-practice solutions throughout the IT environment.

Small and Medium Businesses

We offer IT solutions for small and medium businesses through different management plans by offering IT services and solutions with the same resources, concentrations and knowledge-based analytical methodology that are used for our enterprise and government clients. We provide roadmaps to successful integration, streamlining the businesses’ operation for maximum effectiveness by developing comprehensive IT solutions to navigate the modern cyber environment. We leverage our expertise and experience from our work in the federal environment, custom tailoring these solutions to your business, no matter the size, while focusing on our customers’ business needs and budget.

Healthcare

We understand that healthcare organizations must manage a vast array of rapidly evolving complexities. Our company will lead healthcare organizations through the demands of HIPAA / HITECH security and privacy compliance requirements. We offer healthcare IT services to augment and refine an organization through auditing and assessment of the organization, staff, applications, compliance, risk, vulnerability and infrastructure in order to improve the entity’s ability to better serve the healthcare needs of the organization’s clients.

We understand the key drivers of the healthcare market, and continually create focused, innovative and repeatable solutions. We provide technology services to improve service delivery with a focus on system integration, process reengineering, cloud/web/mobile development, solutions for coordinated community care and case management applications. We have extensive experience providing management consulting from strategic planning, IT assessment, project management, application rationalization, enterprise architecture, organizational change management and training.

Enterprise Business

Enterprise level organizations face a litany of challenges when curating and implementing a successful IT environment. Challenges generally evolve from multiple points, such as finding experienced and deeply knowledgeable IT staff that is prepared for all security eventualities, to creating a comprehensive, functional, and compliant interface tends to create a high cost, knowledge deficient, and overwhelmed staff that often lacks in providing a positive return on investment, and at times a cost-prohibitive scenario.

As digitization of operations becomes a necessity in the current environment, we plan to help our customers hire the right personnel and implement proper protocols in a time- and cost-efficient manner. We will take the responsibility from initial analysis to full spectrum implementation of our services, duly optimizing our customers’ organization and digital environment for the future.

We offer an evolutionary solution for this knowledge gap by providing deeply knowledgeable experts and highly trained analysts directly to our customers' organization as a service. Our contract analysts provide more than just their individual expertise to solve specific challenges, but also will leverage Cycurion's entire repository of collective knowledge, techniques and methodologies to our customers' organization, at a cost below that of hiring an IT department, while providing highly efficient, multi-disciplined and deeply knowledgeable expert solutions to our customers.

Higher Education

We offer cybersecurity services and solutions for universities and higher education and protect our customers' systems, information and students from cyber threats and attacks. Our end-to-end managed cybersecurity solutions include: (i) IT and cybersecurity audit, consulting and advisory services; (ii) SOC network services; (iii) virtual chief information security officers; and (iv) cyber awareness and threat intelligence training services. We have over 150 years of experience on our management team and have served over 275,000 students.

Cycurion ARx Platform

The Cycurion ARx platform is a turnkey web application protection and managed security solution that combines the essential cybersecurity layers in a comprehensive, customizable platform. This platform offers: (i) Geo Gate Protection; (ii) DoS Protection (defined below); (iii) WAF (defined below) and API (defined below) Protection; (iv) Endpoint Protection; and (v) Bot Hunter Protection.

•Geo Gate Protection. This reverse proxy server makes geographic restrictions easy, thus reducing unwanted traffic.

•DoS Protection. This denial-of-service ("DoS") protection mitigates the threat from malicious actors attempting to flood the entry point of an application.

•WAF and API Protection. Web Application Firewall ("WAF") protection inspects requests in real-time and filters out harmful traffic, while application programming interfaces ("API") protection is a defense mechanism involving a two-step process of authenticating the data sender and inspecting the data to ensure no malicious data injections have occurred.

•Endpoint Protection. This countermeasure ensures that devices follow compliance and security policies, preventing intrusion from particular vectors.

•Bot Hunter Protection. Our proprietary algorithm provides detection and protection against non-human activity. This can prevent low-level threats like unwanted scraping, and high-level threats like attempted system breaches.

Competitors

The IT and cybersecurity solutions market is fragmented, competitive and always evolving. We compete with a range of established and emerging cybersecurity software and services vendors, as well as organizations that choose to build their own solutions in-house. With new technologies and market entrants, we expect the competitive environment to remain intense going forward.

Our competitors include:

•vulnerability management and assessment vendors;

•diversified security software and services vendors;

•endpoint security vendors with vulnerability assessment capabilities;

•public cloud vendors and other companies that offer solutions for cloud security; and

•providers of point solutions that compete with some of the features present in our solutions.

The key competitive factors in our markets include:

•ability to prepare for, detect and mitigate cybersecurity threats;

•ability to respond to customer needs quickly;

•ability for products to facilitate customer needs;

•total cost and ease-of-use of our products;

•brand awareness and reputation; and

•ability to attract and retain employees.

We believe that the principal competitive factors affecting the market for cybersecurity solutions include product functionality, depth of platform offerings, flexibility of delivery models, ease of deployment and use, integration capabilities such as open APIs and scalability, uptime and performance. Some of our competitors are more established and have greater name recognition, longer operating histories, more established customer relationships, larger marketing budgets and significantly greater resources than we do.

Customers

We have customers in a variety of industries, including enterprise businesses, small and medium businesses, government agencies, healthcare and higher education. During the years ended December 31, 2025 and 2024, purchases from our four largest end-customers accounted for approximately 64.5% and 63.8% of our total revenue, respectively.

Backlog

We define backlog as contractually committed orders to be invoiced under our existing agreements that are not included in deferred revenue on our consolidated balance sheets. We expect the amount of backlog to change from period to period due to the timing of billings for our solutions and professional services. As of December 31, 2025 and 2024, we had committed backlog of approximately $80.0 million and $16.0 million, respectively.

Government Regulation

Our business and operations are subject to extensive federal and state governmental regulation and supervision. The following is a brief summary of certain statutes and rules and regulations that affect or may affect us. This summary is not intended to be an exhaustive description of the statutes or regulations applicable to our business.

In the ordinary course of our business, we process personal information. Accordingly, we are, or may become, subject to numerous data privacy and security obligations, including federal, state, local, and foreign laws, regulations, guidance, and industry standards related to data privacy and security. Such obligations may include, without limitation, the Federal Trade Commission Act, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, or, collectively, the CCPA, the Colorado Privacy Act, Virginia's Consumer Data Protection Act, the Connecticut Privacy Act, the Utah Consumer Privacy Act and similar U.S. state comprehensive privacy laws, the European Union’s General Data Protection Regulation 2016/679, or EU GDPR, the EU GDPR as it forms part of the United Kingdom law by virtue of section 3 of the European Union (Withdrawal) Act of 2018, or UK GDPR, and the ePrivacy Directive.

Human Capital

As of December 31, 2025, we have 74 employees, of which 66 were full-time employees. None of our U.S. employees are represented by a labor union or covered by a collective bargaining agreement. Our senior leadership team has extensive experience with business process management, and while we have grown through a number of acquisitions, we have retained an experienced and cohesive leadership team.

Our key human capital objectives are to attract, retain, engage, reward and develop our highly talented existing and future employees, while cultivating an inclusive workforce and culture to achieve exceptional business results. We are committed to fostering a community of talented individuals from all backgrounds and perspectives by implementing the following.

Research and Development

Rapidly changing technologies, evolving industry standards, changing customer requirements, supply constraints and continuing developments in communications service offerings characterize the markets for our products. Our on-going ability to adapt to these changes and to develop new and enhanced products that meet or anticipate market demand is the main factor influencing our competitive position and our ability to grow.

We continue to invest substantial resources in research and development to enhance our platform offerings by developing new features, functionality, and applications. Our engineering expertise combines extensive security product development experience with individuals who possess deep cloud and user interface design backgrounds.

Our team is staffed by cybersecurity, cloud and data science experts who deliver exposure management intelligence, data science insights, alerts and security advisories. Our team has developed research tools to help improve efficiency and effectiveness in processes such as reverse engineering, code debugging, web app security and visibility into cloud-based tools.

2025 Developments

On April 8, 2025, Cycurion announced an expanded partnership with Journal Technologies. Together, the companies have been awarded a $22 million multi-year contract to deliver a criminal justice case management system to a state police agency.

On April 9, 2025, Cycurion increased the size of its board of directors through the appointment of Irving Minnaker.

On April 29, 2025, Cycurion issued a press release announcing that the Company has been awarded a $6 million contract by a major municipal agency.

From April 1 to May 30, 2025, otherwise unaffiliated persons converted 2,999.3 shares of the Company's Series B Preferred Stock into 200,000 shares of the Company’s common stock and 5,000 shares of the Company’s Series D Preferred Stock into 5,000 shares of the Company's common stock.

On July 2, 2025,the Company issued a press release announcing that the Company had partnered with AgileBlue, an AI-powered security operations platform provider.

On July 10, 2025,the Company issued a press release announcing its diamond level partnership with the National Association of County and City Officials ("NACCHO").

On July 23, 2025,the Company issued a press release announcing its attendance at the NACCHO Annual Conference as a Diamond Affiliate Partner, showcasing its Cyber Shield solution.

On August 7, 2025,the Company issued a press release announcing that it had entered into a memorandum of understanding with iQSTEL Inc. ("iQSTEL") for a stock-for-stock exchange. On September 2, 2025,the Company entered into a stock-for-stock exchange agreement (the "Stock-for-Stock Exchange Agreement") with iQSTEL. Under the terms of the agreement, Cycurion and iQSTEL will issue $1,000,000 worth of its common stock to the other company, with the number of shares being calculated by dividing $1,000,000 by the applicable per-share price of the issuing company's common stock. On September 26, 2025,the Company entered into an amendment to the Stock-for-Stock Exchange Agreement with iQSTEL to, among other things, (i) allow each party, at its sole discretion, to satisfy the $500,000 dividend obligation to its shareholders by distributing either (a) up to 50% of the shares received from the other party (i.e., up to 75,529 shares of iQSTEL common stock for Cycurion, based on 151,058 shares issued to Cycurion, and up to 1,933,488 shares of Cycurion Common Stock for iQSTEL, based on 3,866,976 shares issued to iQSTEL), or (b) an equivalent value of its own authorized common stock, calculated using the valuation methodology set forth in the Stock-for-Stock Exchange Agreement; and (ii) extend the timeline for the issuance and delivery of shares from 30 business days to 60 business days following the effective date of the Stock-for-Stock Exchange Agreement (September 2, 2025) and establish a firm deadline of December 15, 2025 to complete all necessary regulatory filings (e.g., SEC filings, FINRA submissions, and Nasdaq notifications) to facilitate the dividend distribution by December 31, 2025. On November 25, 2025, the Company and iQSTEL announced that each company plans to distribute $500,000 worth of its own shares as a one-time, pro-rata dividend to its own respective shareholders and security holders, while preserving the full $1,000,000 in cross-ownership shares. On December 5, 2025, the Company announced that it plans to distribute a special dividend valued at $500,000 in the form of its shares of Common Stock shares to all of its shareholders of record as of December 15, 2025 on a pro-rata basis. The dividend is payable on or about December 30, 2025. On December 11, 2025, the Company announced an updated dividend distribution ratio of 0.0180 per share of Common Stock to its shareholders and security holders.

On August 20, 2025,the Company issued a press release providing additional information regarding its then current $69 million backlog.

On August 28, 2025,the Company's board of directors amended and restated the Amended and Restated Bylaws, effective immediately, to conform them to the provisions in the Second Amended and Restated Certificate of Incorporation and certain provisions of the Delaware General Corporation Law with respect to the election of directors.

On September 10, 2025,the Company issued a press release announcing an additional $4.6 million in new contracts to be earned over the next year, building on the previously announced $69 million in contracts for a then current total of $73.6 million in AI-powered growth across multiple sectors.The Company announced several key initiatives beginning in September 2025 driving the expanded growth including delivering AI-powered IT and cybersecurity assessment services for a major county government.

On September 25, 2025,the Company's board of directors waived the Series A Convertible Preferred Stock lock-up restrictions. The holders of the Company's Series A Convertible Preferred Stock (and the underlying securities for which the holders have conversion rights) were previously subject to a one-year lock-up of their securities that commenced on the closing of the Business Combination with Western on February 14, 2025, subject to release from the lock-up after six months from the closing if, thereafter, the daily trading value of shares of the Company's common stock is greater than $150,000 for 30 consecutive trading days and the 30-day VWAP for shares of the Company's common stock is greater than $5.00. As the Company's common stock does not meet the conditions set forth above to release the holders of the Series A Convertible Preferred Stock from the lock-up restrictions after six months from the closing of the Business Combination,the Company's board of directors deemed it in the best interests to waive such lock-up restrictions as the Series A Convertible Preferred Stock accrues approximately $120,000 per year in stock or cash payments. If the holders of the Series A Convertible Preferred Stock convert such preferred stock into common stock,the Company could save approximately $120,000 in costs on its income statement, which is part of its strategic recapitalization to strengthen its balance sheet and support growth initiatives.

On October 29, 2025,the Company announced its selection as an approved vendor under the Florida State Term Contract for Information Technology Staff Augmentation Services.

On October 30, 2025,the Company announced a comprehensive three-part webinar series with NACCHO designed to empower healthcare organizations with critical threat intelligence and defensive strategies.

On November 5, 2025, the Company announced that the Company's wholly-consolidated VIE, SLG Innovation, Inc., had been awarded a $1.1 million contract to modernize legacy data systems for one of America’s largest county-level public guardian offices.

On November 10, 2025, the Company announced that it had been awarded a contract by a telecommunication company to deliver network deployment services supporting a critical modernization initiative for one of the federal government’s agencies.

On November 14, 2025, the Company's board of directors amended and restated the Company’s Insider Trading Policy (the "Amended and Restated Insider Trading Policy"), effective immediately, to clarify language around the Company’s trading windows and blackout periods.

Recent Developments

On January 22, 2026, the Company announced that it had entered into a Memorandum of Understanding to acquire the video-solutions division of Kustom Entertainment, Inc., a pioneer in mobile video surveillance technologies, including body-worn cameras, in-car video systems, and digital evidence management solutions for law enforcement, public safety, and commercial sectors.

On February 3, 2026, the Company announced that Litchfield Hills Research had initiated coverage on Cycurion.

On February 11, 2026, the Company announced a strategic business reorganization that will streamline operations, enhance organizational agility, and position the Company for long-term growth.

On March 19, 2026, the Company held a special meeting of stockholders (the "Special Meeting") to vote on the proposals identified in the proxy statement filed with the U.S. Securities and Exchange Commission (the "SEC") and mailed to stockholders on February 2, 2026. As of the record date on January 21, 2026, there were a total of 5,148,411 shares of Voting Stock (as defined below) issued and outstanding, consisting of 4,188,187 shares of common stock, par value $0.0001 per share (the "common stock"), and 960,224 shares of preferred stock, par value $0.0001 per share, having voting rights on as as-if-converted-to- common stock basis (the "Preferred Voting Stock", and together with the common stock, the "Voting Stock"), each of which is entitled to one vote. A total of 2,611,518 shares of the Company's Voting Stock were represented at the Special Meeting either in person or by proxy. At the Special Meeting, the Company's stockholders voted on the following matters and approved the proposal to approve, pursuant to Nasdaq Listing Rule 5635(d), the issuance of up to an aggregate of 3,314,920 shares of common stock upon the exercise of certain common stock purchase warrants issued in connection with our private placement that closed on December 5, 2025, that may be equal to or exceed 20% of our outstanding shares of common stock immediately prior to such offering.

On March 17, 2026, the Company issued a press release in response to an unauthorized press release.

On March 25, 2026, the Company announced two new contract awards which are expected to generate approximately $1.35 million in combined revenue in 2026, including $1.165 million in new annual recurring revenue. The awards include a multi-year engagement with a large healthcare government agency and an expanded relationship with the National Association of County and City Health Officials.

Corporate Information

Our principal executive office is located at 1640 Boro Place, Suite 420C, McLean, Virginia 22102. Our telephone number is (703) 854-1652 and our website address is www.cycurion.com. Axxum's website address is www.axxumtech.com. Cloudburst's website address is www.cloudburstsecurity.com. The SEC maintains an internet site that contains reports, proxy and information statements and other information that we file electronically with the SEC at www.sec.gov. The information contained on the websites referenced in this Annual Report is not incorporated by reference into this filing.