Summary
- CISO Global says it reached positive adjusted EBITDA (unaudited) in the last quarter of the fiscal year ended December 31, 2024.
- The company credits the full integration of 13 acquired services businesses, AI-driven efficiencies and a shift toward higher-margin software.
- For the full year it still reported a net loss, on revenue of about $30.8 million.
- CEO David Jemmett called the milestone “a defining moment” for the company.
- For 2025 it expects at least $34 million in adjusted EBITDA-profitable services revenue, plus about $5 million in software bookings.
What CISO Global announced
CISO Global (Nasdaq: CISO), a Scottsdale, Arizona, managed security and compliance company, announced on March 27, 2025, that it had reached a profitability milestone. The milestone is narrower than the headline suggests. The company reached unaudited positive adjusted EBITDA in the fourth quarter of 2024, a measure that excludes interest, taxes, depreciation and other items. On a GAAP basis, it reported a net loss for the year.
How it got there
The turnaround followed a strategic realignment. CISO Global says it has fully integrated the 13 services businesses it bought in recent years and used its own AI-driven penetration testing and automation software to deliver services more cheaply.
It is also shifting toward software, where it expects margins of roughly 75 percent, and it recently paid off its highest-interest term loans.
Start your morning with the signal that matters.
Get the weekday cyber brief for the product, threat, and vendor moves that mattered after this guide was published.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Customers and partners
The company says it has more than 500 customers and sells its software through three insurance partnerships as well as to its existing client base.
“This is a defining moment for CISO Global,” Jemmett said in the announcement. “Our vision of a software-led business is now a reality, with our AI technology not only enhancing cybersecurity outcomes for our clients but also driving significant financial efficiency.”
Leadership and the 2025 outlook
Jemmett has led CISO Global through a run of acquisitions and now the move to software. Chief Financial Officer Deb Smith said the company’s financial discipline had made it “more resilient and profitable” and pointed to a software pipeline that was stronger than expected.
The company’s 2025 targets are at least $34 million in services revenue that is profitable on an adjusted EBITDA basis and about $5 million in additional software bookings. Like most forecasts in a press release, these are forward-looking statements and carry risk.
Why services firms are moving to software
CISO Global’s shift reflects a wider trend among managed security providers. Pure services businesses grow only as fast as they can hire. Software lets them sell to more clients without adding analysts at the same rate.
Start your morning with the signal that matters.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Whether that works depends on customers buying the software, not just the services.
What investors should watch
Positive adjusted EBITDA for a single quarter is progress for a company that has been losing money. It is not the same as full-year GAAP profit.
The next test is whether CISO Global can keep adjusted EBITDA positive through 2025 and grow software sales as planned. Its quarterly filings will show whether it does.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Citrix NetScaler CVE-2026-19490: The Auth Bypass That Went From PoC to Probes in a Day
CVE-2026-19490 is a CVSS 9.3 NetScaler Gateway/AAA auth bypass. A public PoC on Sept 2 was followed by live probes within a...
PaperCut NG/MF: The Print Server That Learned Remote Code Execution Again
CVE-2026-81578 and CVE-2026-82078 chain to pre-auth RCE on PaperCut Application Server. Confirm Emergency Patch Release 2, restrict admin exposure, and hunt like...
JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners
CVE-2026-82329 lets attackers forge Artifactory admin tokens via a deterministic empty join key. Mass scanning peaked near 406,000 attempts; patch fixed builds...
Friday’s brief: Apache’s HTTP/2 fix, then Check Point break-ins, a ScreenConnect add-on and a GitHub secret stealer
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.