CynergisTek, Inc.

Good day, ladies and gentlemen, and welcome to the Synergistic 2020 Third Quarter Earnings Conference Call. Today's conference is being recorded. Joining us today from the company includes Mr. Caleb Barlow, President and Chief Executive Officer, and Mr. Paul Anthony, Chief Financial Officer. Before we begin the formal presentation, I'd like to remind everyone that some statements made on the call and webcasts, including those regarding future financial results and industry prospects, among others, are forward-looking and may be subject to a number of risks and uncertainties that could cause actual results to differ materially from those described in the conference call. Certain of these risks and uncertainties are or will be described in greater detail in the company's SEC filing. Synergistic is under no obligation to expressly disclaim any such obligation to update or alter its forward-looking statements, whether as a result of new information, future results, or otherwise. At this time, I'd like to turn the conference over to our CEO, Caleb Barlow. Please go ahead.

Good afternoon, everyone. A little breaking news to start us off today. Early today, for the second year in a row, Black Book Market Research has awarded Synergistic as the top cybersecurity consultants for assessment, audit, strategy and implementation in the healthcare industry. This is an award, well, we're really proud of. As it's an independent survey from 705 healthcare providers, we don't pay for placement, and frankly, did not even know it was coming until we saw the press release this morning. 2020 has been a bit of a crazy year for everyone, but to get this type of recognition from the industry and from our clients further demonstrates that our strategy is working. We've worked aggressively to add new capabilities to deal with a changing threat landscape, including compromise assessments, security validation, and we've been on the front lines helping clients address these recent ransomware attacks. With all of that, it's a real honor to continue to get recognized by our clients in the industry in a really tough year like this. Beating out some major players, including Clearwater, Booz Allen, KPMG, EY, IBM, Fortify, and a host of others. So I wanted to make sure I mentioned this before we got into the details of the quarter. Now, towards the end of Q3 and into the beginning of the fourth quarter, we started to see signs of market recovery. This has shown itself in a number of ways. First, we're seeing clients, particularly those that have a more mature security posture, Realizing that the pandemic, the move to work from home, the rapid deployment of telemedicine, and new expectations for interoperability have created new vulnerabilities in our security posture. Concluding that these trends are not temporary has created an increased willingness to enter into long-term contracts with a focus on shoring up their defenses in this new world. This was highlighted in our two recent releases with Valley Health and Fairview Health. both new logos to the Synergistic family. These customers were interested in the combination of our core managed services along with our strategy to go beyond just security assessments and into the validation of security controls. We also saw some recent renewals with long-standing customers that included the addition of some of these new services, increasing their commitment to security. Second, we saw progress in our efforts to diversify beyond our base. which is primarily made up of health care providers and into the broader industry of health care. A good example of this is the recent managed services signing with a large State Department of Public Health on the West Coast. Now, as you can imagine, health departments across the U.S. are front and center in the effort to track infections and manage contact tracing. As such, they're generating volumes of information that must be properly assessed, protected, and secured. Born in healthcare, our organization and our consultants are ideally suited for this mission. I also want to mention our recent traction with RedStim, a synergistic-owned brand that focuses on offensive security testing outside of our traditional healthcare market. One of our strategic imperatives last year was to rebuild and upskill our penetration testing team. This now offensive security team has new people along with new offerings. which has allowed us to win consulting contracts in one of the nation's largest media companies and a well-known consumer electronics company, Logitech. These are early contract wins for our team, and they demonstrate the expertise and capabilities we've brought to Redspin. Now, we're optimistic about our ability to expand these services over the coming months as we continue to prove our capabilities opportunistically in the broader markets. Now, not all of our clients are out of the woods when it comes to COVID-19 and the associated financial repercussions. This has had a significant impact on healthcare providers. When they run into financial instability, it can impact us, and this included a recent situation where a client exercised a termination for convenience clause, stepping away from a long-term contract in an effort to reduce costs. This impacted our pre-sold revenue during the quarter, as Paul will discuss. Now, moving into next year, we anticipate budget uncertainty in health care providers will continue. It's important to note that while we see a pullback, we believe this generally does not represent losses to competition, but rather an increase in the technical debt our clients are experiencing and temporary deferment of investments in security and privacy. Unfortunately, this growing technical debt has also been noted by adversaries that are becoming more brazen in an effort to take down America's hospitals right in the middle of a pandemic. Increasing attacks, increasing consequences, and an increasing regulatory footprint will drive demand for our services. Remember, when a hospital is locked up with ransomware, they're essentially down, diverting patients, canceling elective procedures, and struggling through crisis operations with limited capabilities. Hospitals learn that the impact of limited operations can be financially devastating at the start of COVID. In just the past few weeks, about a dozen systems experienced the same impact, but it wasn't due to COVID. It was due to an orchestrated and brazen ransomware attack. Now, putting this into perspective, in just the last month, we've seen the first death attributed to ransomware, where a patient had to be diverted to another hospital and die in transit. In another incident, the governor of Vermont deployed the Vermont National Guard to assist in the significant recovery of a hospital system that was infected with ransomware. That incident is still ongoing today. Healthcare is rapidly realizing that investments in cybersecurity are very similar to investments in masks, gowns, and telemedicine. It's simply something that's going to be required to remain operational in this new world. And now that that has the attention of CEOs and boards, it's not how I want to see demand evolve, but it is happening. And we're well-positioned to do everything we can to help keep America's hospitals open and seeing patients. Now, a year ago, as I completed my first 100 days as the CEO, I outlined a set of strategic imperatives that would guide our strategy to transform the business and return it to growth. Now, we had this call before COVID-19 hit, but we found that those imperatives held true as we navigated the pandemic. It even helped us to galvanize our decisions as we worked through some of the challenges we faced in our own COVID response. So a year later, let's review where things stand. The first thing that was very clear a year ago was we needed to rebalance our costs in both overhead and infrastructure. Over the last year, we pulled $4 million out of our annual cost structure and reduced headcount by more than 25. Other than public company costs, which is limited opportunity to influence, we're running lean, with 90% of our employees directly in front of customers servicing or selling. A year ago, we also discussed the need to rebuild our go-to-market. Fast forward today, and we've rebuilt our sales team, have pivoted to be completely remote, and have significantly improved our pipeline. We slow-rolled our marketing spend as we entered COVID, as that was an expense we could pull back on. And we're just now starting to rebuild our web presence, and reinvest in promoting our brand digitally. This is an important initiative, as all of our go-to-market efforts have gone virtual, with face-to-face interactions shut down due to COVID. Over the last month, we've promoted an internal candidate to be our VP of marketing, we conducted our annual customer conference, albeit virtually, and our web presence will be a source of investment moving forward. Now turning to our team, in many ways we're a different company than we were a year ago. Our executive team has many new faces coming to us with a great depth of expertise for both healthcare and security. Our board is also very different than it was a year ago, and we will continue to retool and upskill our team. On the delivery front, we talked a year ago about the delivery backlog. Long backlogs lead to dissatisfied clients, and I was concerned not only the time it took to deliver on the contract, but also the size of our project management organization that was required to manage it. This has been a major area of focus, and we're far more efficient than a year ago. We've found new ways to deliver by cross-training individuals, allowing us to dramatically reduce the number of consultants on an engagement by nearly half. We've reduced our project management overhead by becoming more optimized, using newer tools, and ensuring that all of our managers are also capable of providing hourly work to handle search capacity. As we go into Q4, our utilization is nearing capacity, as work that had been deferred during COVID shutdowns now returns. Lastly, and most importantly, we set out a target to return to growth. That is our last remaining imperative. And with a significantly reduced cost structure, a more efficient team, and several new offerings, this provides us with that pathway. With that, let me turn it over to Paul to review our financial performance.

Thanks, Caleb. As Caleb mentioned, we're still seeing an impact from COVID during the quarter as a result of its impact on health care providers. Again, this impact was primarily felt in a reduction in our pre-sold revenue, which dropped from $19 million to $16 million, primarily due to one larger managed services customer that had significant budget issues. This contract will term at the end of this year, giving us some time to respond. We made significant strides towards this response with the better-than-expected Q3 bookings. Although still below historical levels, it's an improvement from Q2, and we see positive signs going forward in the macro environment, which we will continue to take steps to keep you updated as things progress. Additionally, we continue to react to the impact from COVID by reducing expenses and focusing on opportunities to reduce further. This was a key driver to our improved margins, gross and operating margins in Q3 when compared to the first half of this year. As we highlighted in Q2, we took steps to significantly reduce operating expenses with both permanent and temporary measures that have reduced our cash burn to around $300 per month at these revenue levels. A couple other reminders. We received the $2.8 million under the Paycheck Protection Program and expect the majority of the loan will be forgiven, and we're also expecting tax relief as a result of the CARES Act, which when we carry back available losses from this year, to the extent possible, which we think at this point will exceed $1 million. In addition, the Board just approved an at-the-market equity program that will allow the company from time to time to issue up to a total of $5 million of shares of the company's common stock to the public at the company's discretion. The funds raised will be used for ongoing operations and growth initiatives. Outlining our standard financial disclosures, revenue decreased by 0.3 million to 4.5 million due to lower revenue for managed services, which reduced 0.4 million to 2.7 million due to the impact of some customers canceling or delaying renewals and a reduction in net new customers due to COVID. Professional and consulting services increased 0.1 million to 1.8 million due to Lower revenue from the synergistic business as a result of the COVID offset, though, by $0.8 million in new and consulting professional services revenues from the acquisition of Backbone in Q4 last year. We're starting to see Backbone's business recovered from the COVID impact, and we expect them to be back to historical levels and growing by Q1 next year. Gross margin was 35% for Q3 2020 compared to 34% in 2019 and 27% in Q2 this year. As I mentioned in my highlights, this improvement in gross margin is due to staff and expense reductions we made over the last couple quarters, along with reduced travel in reaction to the lower revenue and COVID-related travel restrictions. Sales and marketing expenses increased 1.3 million for Q2 2020 compared to 1.1 for the same period in 2019. This increase was due to the addition of backbone. G&A expense decreased by 0.2 million to 1.5 million. for Q3 2020 compared to the same period in 2019. The decrease is due to 0.4 million in expense reduction efforts taken to improve operating margins offset by 0.2 million in additional costs for backbone. Non-GAAP adjusted EBITDA loss was 0.8 million for Q3 2020 compared to 0.4 million for Q3 2019 and 1.3 million in Q2 of this year. The full financials and reconciliation of GAAP to non-GAAP information can be found in the earnings release that came out today. This concludes the financials and prepared remarks for Q3 2020. Operator, you can open the floor to questions.

Thank you. Ladies and gentlemen, if you'd like to ask a question, you may do so by pressing star 1 on your telephone keypad. Please make sure the mute function on your phone is turned off so the signal can be read by our equipment. Star 1 for questions or comments. We'll pause a moment to assemble the queue. We'll take our first question from Jeff Bash with FinTech. Please go ahead. Good afternoon, gentlemen.

Hi, Jeff. You mentioned that the sales trends were strengthening at the end of Q3. To what extent do you think this is reflecting the more publicized incidents that you described, you know, the cyber incidents?

Well, there's two components to this, Jeff, right? I mean, one is that we've significantly retooled our sales team, go to market, and now have a much more robust and reliable pipeline than we had a year ago. So I'll call that the basic blocking and tackling. The second piece of this is that while in the midst of COVID, especially, you know, kind of in February, March, April-ish, you know, when we were all really locked down and everyone was trying to figure out which end was up, we used that opportunity to retool. We switched to an agile management methodology. Our team met every single day, and we continue to today. And we used that time to bring forward several new offerings, such as compromise assessments in our partnership with Awake Security, security validation assessments, reviewing runbooks. Interestingly enough, we knew and were public for some time that ransomware was likely the biggest threat that was going to impact healthcare. And unfortunately, we were right. So as we started to see these brazen attacks over the last couple of weeks, we were very well positioned. I mean, really, only in the last few days has this not been back-to-back-to-back-to-back calls for myself and my team, helping our clients work through this crisis and figuring out what they need to do. So, you know, I guess the long-winded answer to your question is it's all of it, but, you know, a lot of this is trying to figure out where the puck is going to be and being well-positioned for that.

Okay. There's been a lot of press in the last... you know, a couple weeks or so about rapidly increasing outbreaks of COVID in the United States. And I'm wondering if that's concerning you about another phase two of shutdowns and all that, which adversely affect your business, or do you think hospitals and other health systems are better set up now to weather it and not affect you as much as you might otherwise have thought?

Well, I think there's two dynamics here, right? So first of all, at least at the moment, unlike back in kind of February and March, hospitals are still seeing elected patients, right? So elected surgeries are continuing. They're not completely shut down just to handle the COVID surge. And I think we've, in a lot of ways, hospitals have found ways to get through this. Now, That is not true in all areas of the country. There are some places that are being severely impacted, and, you know, that does seem to go in waves. What has also happened in this is procurement departments, I think, have started to figure out that the answer isn't that you can shut everything off. They're going to need certain capabilities. And, you know, we've started to see that to return, I wouldn't say completely to normal because we're not face-to-face with clients. But we are processing deals. Things are a little slower than anyone would like because you can't go meet with a client. But if we look at this, I don't think we're going to see the same impact. Now, the second factor in this is that these recent ransomware incidents, this is a little bit different than anything we've ever seen on U.S. soil before. Up to this point, generally speaking, attacks on U.S. soil involve people stealing data maybe shutting something down with a denial of service attack for a few hours that they take down a website and stealing a whole lot of data and intellectual property. But in all of those attacks we've seen of late, people were not directly impacted in a way that could potentially harm them from a life safety perspective. This is different. This is a change in adversarial intent where bad guys are knowingly targeting large hospital systems with the express intent to find their electronic healthcare records, lock them up, and prevent the hospital from seeing patients. That is, you know, what we call a kinetic impact, and it's devastating, right? But it also represents a significant escalation in that adversarial intent. But what it means to the hospital system And I temper my comment here by saying I don't want to sound alarmist, but the simple reality is all of these hospitals in the last few weeks have realized that if they don't move to shore up their defenses, it's going to be hard to remain open. And that's the difference in this. It's very analogous, frankly, to wearing a mask. It's kind of the analogy of the day. You might not get ransomware if you don't invest in your security defenses, but if you do, the impact can be pretty devastating.

Yeah, it lends a lot of urgency to the issue.

That's right.

Okay, I have a couple questions for Paul. I think it was two quarters ago you had mentioned the possibility of reaching mid-to-high 40s on gross margin by the end of the year. This obviously has been delayed or deferred, but I'm wondering if you still see the business as eventually being able to still achieve that goal.

We've definitely been impacted in the short term, Jeff, on that, so we do not anticipate that we'll get there this year. But at least from our perspective, we can get there. It's going to take getting back to growth and getting back to that 5 to 5.5 million run rate, which is kind of that critical revenue level for us. And so as we get back to there, that's when I think we'll have the ability to get back in those 40-plus margin ranges.

Okay, and with respect to this $5 million worth of shares, which was referred to, what's the status of the earlier arrangement you had, I think, with a large institutional owner where you've already issued some warrants?

Yeah, so we'll put that on hold for now. Yeah, we'll put that on hold as we work through the ATM. Okay. revisit the need for that if necessary based on the results of the ATM.

Okay. And lastly, you have a couple of million dollars on your balance sheet for the backbone earn out. Where do you think you stand with respect to that?

At least in the initial year, they did not hit the year one earn out. And so we're still working and evaluating their ability and opportunity to hit years two and three. And so that's kind of the status of that right now. We just closed the books for October, which is the month in which it ended the first year. And so we're still working through and evaluating our next steps there.

Okay. Thanks, guys.

Star one for questions. We'll pause a moment to assemble the queue. Star 1 for questions or comments, please. We'll take our next question from A.V. Fisher with Long Cast Advisors. Please go ahead.

Hey, Paul and Taylor. I had a quick question. I already looked at the queue, and the performance obligations were $15.6 million, 88% to be recognized over 24 months. That infers that sequentially over last quarter and the prior quarter, we have a little more visibility, at least sequentially. I wonder if you could just disclose, given the strength that you've seen, where those performance obligations would be today. Thank you.

Bobby, I'm not sure if I completely understand your question. I may have you.

Yeah, sure. So you disclosed the performance obligations, which are forward long-term contracts, correct?

Yep, correct.

And at the end of the quarter, 930, you had $15.6 million. And I wondered if you could disclose, maybe you can't, maybe you don't have the number available, but if you could disclose, given the strength you've seen, you talked about the strength in your sales pipeline, sales channel, where that would be today.

Oh, yeah, I can't provide that number right now. That's a number we don't traditionally provide at this point, so we don't get into the booking numbers at this point.

Okay. Could you at least disclose if it's up from where it was at the end of the quarter?

It is up since the end of the quarter. I can tell you that.

All right. Thank you.

You bet.

Star 1 for questions. We'll go next to William Brimmer. with Vanquish Capital.

Hey, gentlemen. Good evening.

Hey, Bill.

Hey, Bill. So adding on to Javi's last question, how does your visibility look at right now? I mean, we had unprecedented events that occurred this quarter. It seems as though you guys have announced two major wins. I would assume the sales cycle now, given what has occurred and what has just been articulated, is quicker than ever in this field. So how quickly can your team close a contract with a new entity?

That is all over the map right now. And it's all over the map because In a lot of ways, procurement departments have a new set of muscles that we haven't historically seen built. In some systems, you have just a very draconian, all costs are under control, everything's got to go through multiple levels of approval. I'll give you an example. That recent release on the public health department on the West Coast That deal took quarter after quarter after quarter. We saw that deal deferred because of COVID and various hoops, and then finally got it done all in a week type of thing. There are other situations, especially with what's happened over the last couple weeks, where we'll close the deal in two days. It is a really good question, and I guess my long-winded answer to that is it hasn't stabilized right now, and it's all over the map just depending on what's going on and the temperature. What I will say is interesting to see is that we do see in many cases the incidents over the last couple of weeks are causing some clients to go forward and ask for emergency budget requests. and also go forward asking to reinvestigate, you know, wherever they were in their kind of prospecting on 2021 budget. Now, you know, I would say the one thing I can kind of say overall is larger deals still take longer, as you can imagine. Anything that's public still takes longer because oftentimes they have to take it out to bid. But we are definitely seeing cases where some of the new services were able to get in the door with a new logo in a matter of a week or two. And that's really encouraging because, you know, those are new growth opportunities for us.

No, I agree with that completely. And as I look at your run rate right now, let's just take this last quarter, 4.5 million. Paul just articulated that five, five and a half, depending upon the mix, of course, gets very interesting. I don't see it that far away from that threshold. And I was just wondering, given my first question on visibility, um, and what you and your sales team headed up by Shane is, are seeing maybe quick, quicker turn business. Um, is it possible you have an idea of when we possibly can get there? How close are we to that? It seems as though we're quite close. Am I mistaken? Yeah, I mean, it's a little early to tell.

Go ahead, Paul.

Go ahead. I'll just say it's a little early to tell, Bo, and I'll point you. Unfortunately, that large customer that we lost for the managed services was kind of the – that one hit us, as we mentioned. And so we've got to make up that ground. So I think you're right from the perspective that we're seeing the growth. We're seeing new opportunities. We do have some ground to make up, though, as – bundle that all in with kind of the overall COVID impact. We've got to recover from some of the things that we took the hits on in Q2 and Q3 here. But as it relates to net new logos and renewals and growth in the business, we're seeing it. It's just we've got to dig out of that hole we have because of, again, primarily this one large customer that had budget issues.

I think that's exactly what I was going to comment on. The frustrating thing sitting in our seat right now is you can see the opportunity. We're grabbing at it. It's just we have to make up for that lost ground that we experienced earlier this year. All it took was one or two customers with convenience clauses. It's really an interesting situation where These are not cases where we lost a competition. These are cases where a client literally just decided that they could no longer afford to pay for security provisions. And that's a really tough thing to digest. That being said, I'm hopeful that also when budgets start to turn around here, we may see some of those clients return.

Okay, gentlemen, I just think that the end market has changed here, and your sales cycle is probably quicker than ever. And agreed on the budget side, but the sales cycle, and given the material events that have occurred, we're the top tier and one of the top entities in the country, changes the landscape. And I wish you all the best. I think we'll get there. Thanks.

Thank you, sir. I appreciate the confidence.

Star 1 for questions. We'll pause a moment to assemble the queue. And ladies and gentlemen, this will conclude today's question and answer session and today's conference. We appreciate your participation. You may now disconnect.

Thank you.