Morning, everyone. I'm Justin Leger. I'm the CEO of Cybeats Technologies. Cybeats is a SaaS cybersecurity company. I see a lot of familiar faces, so I'll try to put in something new, and for those of you who aren't familiar with our story, I'll make sure to hit all the key points for you. We are in some unprecedented times. Feels like that's been my entire career of unprecedented times. AI's changing the conversation that we're having around software vulnerabilities, cybersecurity, and the very real impacts that we feel as a society and individually. This is something that Cybeats has been working to address in a very serious way over the last few years.
As bad as it is to see the rise of cyberattacks attacking the software supply chain, it's a little bit validating to see that, hey, we had the right idea, and we are going after the problem in a way that's been validated by industry, been validated by governments that are implementing more and more regulation around this. Of course, it's something that our investors and customers continue to validate all of the time. Just to give you a quick view of the company, we supply software that addresses software supply chain security by automating something called SBOM management or Software Bill of Materials for enterprises that produce or consume digital products. Just a reminder, an SBOM is simply an ingredients list for software. It catalogs all of the components and libraries that make up a software product.
We use that to cross-reference over 100 different sources of vulnerability data that we pull into our data lake, and we identify those vulnerabilities. As I said, this is meeting new regulatory requirements. It's helping companies save a lot of time and money in hunting down those vulnerabilities, helping them identify where they're affected, how they're affected, and helping developers get after that very quickly. We first started this in 2022, and we're going stronger than ever. Just a quick look at numbers. Last reported ARR is around CAD 4 million. We currently have 11 proof of concepts in progress or that are scheduled here in the near term. We enjoy 111% net revenue retention. We see a lot of growth among our existing clients with 80% gross margins. You'd expect that from a SaaS company.
Average contract size around $250K , and we have a 78% conversion rate maintaining right now. Once a customer comes into a proof of concept, they get their hands on it, they love it, and then we go into contract negotiation and getting that closed. We're proven where the stakes are highest, keeping the lights on, keeping the water flowing, the medical devices that keep us alive. These make up the bulk of our customers today in industrial control systems, medical device manufacturing. We're now seeing other areas, financial services, automotive, telecom. These are all verticals that drive everything, and if you're paying attention to the news at all lately, you'll see more governments advising us to do things like keep 72 hours of water and food, keep batteries ready to go in the case of not just increasing weather events, but potential cyberattacks.
This is the domain of warfare going forward, and this is something that we're helping to help protect you all from. Working with reference customers like this, obviously good for all of us, but also good for the business. They're reference clients that we're able to leverage into future deals. I actually will go back really quick here. I should address that we can't name all of our customers. It's a security solution, and not everyone wants to identify that they're a customer for obvious reasons. We put the logo when we can. We offer incentive to get that. We want to communicate as much as possible with all of you. We do our best, but they don't always want to do that. Although I will say that recently, the U.S. National Security Agency did mention publicly that they were a client of ours.
We're not putting that up on the website, but I will mention it to you here. We're trusted, and not just among small providers, but those really big demanding customers that have been with us now for multiple years and continue to grow their licenses with us, we're proven to deliver. We're getting recognition not just commercially, but also among groups like Gartner. We're featured in 11 Hype Cycle reports. We're a reference vendor for AI Bill of Materials, which is a very important new area of software supply chain security. We've now got a partner, Keysight, selling a joint solution to their customers. This is a $56 billion enterprise with the global sales force to match, and they're out there selling our product at no cost to us. We're unlocking new geographies by working with them, like India and Japan.
Regulation is the main driver here. We are in a market that is forced. There's forced adoption because of this regulation, particularly coming out of the European Union. Started a few years ago in the medical device space with the FDA in the U.S. requiring submissions of Software Bill of Materials for any new medical device for sale in the U.S. Not only that, but they're required to monitor that in an ongoing way in perpetuity for any release they have for a medical device. Our solution directly addresses that regulatory requirement. As of September this year, the EU Cyber Resilience Act requires vendors in the European market to identify to the European Cybersecurity Agency, ENISA, within 24 hours of a known security vulnerability. They have a week to identify if they're affected once that vulnerability's been notified to the public.
These are very strict and short timelines that are quite expensive, frankly, to dedicate people to tracking those down. Last week, we saw the PHP2Shell vulnerability come out. It was across the news. It was a big deal because it affected something like half the internet. This is right in our wheelhouse. You had business leaders asking questions like, "Are we affected? What's our exposure? How do we fix it? How much is it going to cost?" These are questions that are hard to answer. These are questions that are expensive to answer unless you're using our solution. Type it in, PHP2Shell. Where is it? It points you right at it all across your stack.
There's a Software Bill of Materials in there that has that ingredient listed, which we can point you right at it, and we're saving you thousands of hours, in some cases, of effort. We saw that with previous vulnerabilities that have been announced. If you look at some of the thought leaders and AI leaders today, they say that we're going to look back at this time of new vulnerability disclosures as quaint because the number is going to skyrocket. It's going to continue to happen. Events like PHP2Shell aren't going to be a black swan event. They're not going to be a once a year type of thing, or once every few years type of thing. It's going to be a regular occurrence, and that is why it's so important for these companies to do that.
That's why it's been regulated, and that's what's driving our market. AI has been an incredible tailwind for this. It's increased the urgency across the regulatory space and certainly amongst our prospective customers. In December 2027, that's the real deadline in our space. Software Bill of Materials are going to be required in Europe, period. If you sell a product or service that has a software element to it, you must use SBOMs and be prepared to disclose those to ENISA as of December next year. What do we have to address all of this? Cybeats has two products, SBOM Studio for the software producers, SBOM Consumer for those companies that want to assess all of the third-party risk that they're bringing into their company. In essence, we offer ingest.
You ingest the SBOM, you manage and monitor that, so you can slice and dice them, depending on the solution. Think of it like an Adobe Acrobat for SBOMs. Of course, we provide that continuous monitoring. When I say continuous, I mean continuous. It's not like a once a day thing or a once a week thing. It is updated continuously. We are catching vulnerabilities, in some cases, before they're announced. So we're able to give our customers visibility before the rest of the world, including the rest of the world's hackers, that there's an exposure. Of course, we offer a secure way to share. SBOMs are safer. They're metadata. They're not the crown jewel code, but they're still sensitive.
When we're sharing that information from vendor to vendor, from customer to vendor, from vendor to customer, you want to be able to do that in a secure way that you can manage and you know who's got your information. That's something that we provide. It's not just for Software Bill of Materials. Software Bill of Materials is sort of the overarching concept, but now we're seeing definitions going deeper into AI Bill of Materials. What model is driving that AI product? What was it trained on? What are its biases? Hardware Bill of Materials. Those have been around forever. If you have any kind of manufacturing experience, you want to be able to track all of the inputs, the provenance of what you're making. Of course, Cryptography Bill of Materials as we move into the quantum realm and want to assess the risk associated with that.
As I mentioned, we have 111% net revenue retention. A lot of our growth is coming from existing customers. These blue-chip customers that have started, in some cases, relatively small and scaled up their business with us over the years to a full enterprise rollout. In 2026, you are going to start to see more bars like that one on the far right where customers have come in and grown their account to the point where we do not want to be counting SBOMs anymore, basically. We have too many. All of these tailwinds, the implementation of AI, the use of that in detecting vulnerabilities and exploiting vulnerabilities, the use of it in creating code, that is less transparency into software.
There is less human visibility and we need to be able to operate at the speed of AI now, and that is something that we are enabling our customers to do. All of this, the regulatory tailwinds, the general cybersecurity environment today is driving a new urgency. I mentioned that our last reported ARR was around CAD 4 million back in Q2. We have over CAD 5 million ARR in the pipeline today. We have 16, and I have gotten really specific, I went and updated this last night, 16 very high-quality near-term opportunities across our channels. As I said, 78% of those are likely to convert. We are backed up by that very big partner in Keysight.
That relationship, I should mention, has been growing over the last year or so. They are starting to see wins. I have been reticent to speak to their pipeline specifically because they are a different company, but it does affect us. We have closed multiple deals with them. They have multiples of that in their pipeline, and we are very happy with how that has gone.
I said that by Q3 of this year, I would want to start to see traction, and we are definitely seeing traction with them now, so we are very excited about where that is going to take us. Just a quick sample of some of the new opportunities. If you have seen this presentation before, you will recognize this slide, but it is new information. We are seeing more uptake in Japan. That is a very interesting market. They have grabbed onto that regulatory side of things, adopting this new standard of using Software Bill of Materials. We are seeing a lot of traction in that market, and we are really able to get after that because of our partnership relationships. We continue to see a lot of traction among industrial control systems providers and medical device manufacturers.
These are the folks that are most regulated and get the most scrutiny, and as these new regulations come in, they are the folks that regulators are going after first. That is why we see them now. But like I mentioned, the financial sector is definitely coming online. We have multiple of those in our pipeline at different stages and some very advanced. It is really, I will not say more of the same. We are seeing an increase in the number, we are seeing an increase in the speed and the urgency to get ahead of these deadlines. But I think most companies are going to avoid spending money to meet regulatory requirements until they have to.
That is, I think, where Cybeats is in a very strong position because we have those reference customers, we have those examples where we have been very successful, and that means a lot for these blue-chip customers.
Quick look at our capital structure. Some things have changed here. Today, we've got 26% of the company locked up recently. That was announced with NorthPalm Capital. Their holding is locked up here for a year. We have a good number of warrants that are actually set to expire. 42% of them are going to expire here in the next 30 days, and they'll all expire or be exercised here by August of next year. So we'll see that clear out. I wanted to leave time for questions. It's been a busy year. It's been a building year. They're all building years. But the environment around us has changed so much that, on one hand, we were right and we were doing the right things.
But on the other, we've had to change a little bit how we talk about it and how we think about it. I think we're going to be able to have some more interesting conversations over the next couple of days, because there's so much more awareness around this issue, and that awareness is only increasing as the challenges increase, and they're going to increase. So buckle up, I guess. Got a question back here. Cool kids in the back.
Hey, thanks for the presentation, Justin. Two questions now. First one pertaining to Keysight. You said that you're reluctant, I think you used that word, to talk too much about the opportunity set there. The numbers that you pointed there, 11 POC, 16 near-term opportunities, were those including Keysight or ex-Keysight opportunities? That's question number one. Number two, are there any gating factors? Obviously, tailwinds are quite strong for the company. Anything that you see as kind of holding back the pace of growth? Thank you.
Yeah. To answer your first question, I included one POC that Keysight is conducting right now, and I included that one because they asked for our participation in that. It's a fairly sizable one. We have more experience with this product than they do, so they wanted our assistance on that one. I included two opportunities among the 16. They have much more than that, I can tell you, but I don't have a specific number to share. To answer your question about gates right now, I think for us we're obviously worked off our feet and we're pretty disciplined about growth. We don't want to get out in front of our skis, so to speak. But I think it's sustainable currently, although we're always sort of on the edge of not sustainable, always on the edge of needing to add more.
We are always in the process of looking for talent on the go-to-market side, adding more salespeople. If you have any experience with that, you do get some churn on salespeople. You have to make sure to keep them motivated. As far as general things that hold us back, I think 2026 has been a bit of a challenging year in that folks in the market were not really sure how all of these new AI cybersecurity tools, the SaaSpocalypse, all of that was going to impact what tool set they needed to address the problem. There was a little bit of wait and see going on, certainly amongst customers and verticals that do not have experience with this.
What we saw in reality with the customers that are using the solution is that this is mission-critical, we need to deploy it across the enterprise, and it is relevant in the new paradigm. So we are taking that story, we are getting it out there. I think things have settled a little bit in terms of what do we need to tackle this problem, and it is very clear that SBOM adoption is not going anywhere. It is only increasing, both from the regulatory side and from the cybersecurity side. So I think things are improving for us amongst the things that are outside of our control. Otherwise, I do not see any huge gates. We have leaned into that partner model. We have other partners that are going to help us scale the go-to-market side of the business.
I know I have said it before, but we like to get the details right with our partnerships, and we have continued to work on those same partnerships that I have mentioned to you before. So I hope to have something to announce related to that soon. Yes.
How long does the average proof of concept take? The 16 near-term opportunities, does that include those 11? Or is it those 11 proof of concepts and then in addition to, you have got 16 near-term that might progress to a proof of concept?
Yeah. There's crossover amongst those numbers. These are very mature opportunities. I wouldn't throw the number 16 out there lightly. We're very confident in those. There's many more at other stages of the pipeline. To your other question, remind me. Proof of concept, yeah. The length of a proof of concept is fixed. Typically, we'll do it for two weeks. We make sure that we go into that proof of concept with an established success criteria that we know we're going to be able to be successful and we've got buy-in from the customer. If they want to do anything more than that, we'll often talk about doing a paid pilot, and we do have paid pilots.
What sales cycle that is.
The sales cycle is anything we've seen as short as three months, and we've seen as long as 18 months. The proof of concept would be the last stage of the selection, and then we go into the contract negotiation and that stage of it. We're running short on time here, so we- We've got one back there, and then we'll come up here.
Just quickly, can you talk to margins, like the difference between the Keysight stuff and the stuff you bring in yourselves?
Yeah. We've never disclosed the exact terms of the split with Keysight. But I have said that it's very favorable, and whatever you're thinking is probably better than that. So yeah. We don't want to talk about exact splits with partners, but it's a very fair split.
Those three, four quarters, 12 months, you had operating cash flow from operations minus CAD 3.7 million due to recent financing in July of CAD 2 million gross, which basically means you are going to be running out of cash in Q1 of 2027. Looks like you have got almost more than double your sales to hit break even. Your 11 proof of concepts may bring in, looks like CAD 2 million worth of sales. I guess the question is, are you going to need to do more money raising in Q1 of next year?
No. If we do not earn an extra dollar, like we would get zero more customers, we would run out of money in August of 2027. All our revenue is recurring, so we have money coming in all the time from existing customers. And we are adding to the pool all the time with new customers. Our break-even is at around CAD 6 million, and that is not that far off. So we are feeling pretty confident, and we certainly will not need to raise money for survival anytime in the near future.