# SideChannel, Inc. - **Type:** Advisory firm - **Website:** https://www.sidechannel.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A small US cyber security firm selling virtual CISO retainers and fixed-scope SOC 2 and ISO 27001 readiness projects, alongside its own security software. ## SideChannel scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 2/5 No named case studies or verifiable examples of guiding a client through a live regulatory probe or breach are published; only unverifiable aggregate stats like '$8.54B revenue protected' appear. ### Qualifications of the people who do the work: 3/5 CEO is a named, published NIST CSF co-author with DoD/Pentagon pedigree, but the firm's own 10-K discloses unremediated material weaknesses in its internal financial controls. ### What it publishes about fees: 4/5 Publishes specific dollar ranges on its own site: $3,000-$12,000/month vCISO retainer and $15,000-$75,000 fixed-scope SOC 2/ISO 27001 readiness projects. ### Knowledge of your sector: 4/5 Dedicated service page names SOC 2 Type I/II and ISO 27001 readiness scope and timelines, with reported past clients including DoD, CRISPR Therapeutics and Panduit. ### Independence from what it sells: 2/5 10-K confirms SideChannel sells its own Enclave security software as a core revenue line alongside its advisory engagements, a clear funnel risk. ### Who carries the risk if the advice is wrong: 2/5 Neither the company website nor its 10-K discloses professional-liability or errors-and-omissions insurance covering advisory engagements. ## Sources for SideChannel Every line carries the page it was read on and the date it was checked. - SideChannel, Inc. is a Delaware corporation and SEC-reporting company (formerly Cipherloc Corp, formerly National Scientific Corp/AZ) - Source: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001022505&type=10-K - Checked: 2026-09-20 - SideChannel's common stock trades over-the-counter, not on a national exchange - Source: https://www.sec.gov/Archives/edgar/data/1022505/000149315225028364/form10-k.htm - Checked: 2026-09-20 - SideChannel is a small firm by headcount - Source: https://www.sec.gov/Archives/edgar/data/1022505/000149315225028364/form10-k.htm - Checked: 2026-09-20 - SideChannel's most recent 10-K discloses unremediated internal-control weaknesses - Source: https://www.sec.gov/Archives/edgar/data/1022505/000149315225028364/form10-k.htm - Checked: 2026-09-20 - SideChannel publishes specific fee ranges for its compliance-readiness and vCISO engagements - Source: https://www.sidechannel.com/services/cybersecurity-compliance - Checked: 2026-09-20 - SideChannel CEO Brian Haugli has a named, published cybersecurity credential - Source: https://www.sidechannel.com/team/brian-haugli/ - Checked: 2026-09-20 - SideChannel's own FY2025 Form 10-K (fiscal year ended 30 September 2025, filed 18 December 2025) states under Item 3, Legal Proceedings: as of the filing date there are no material pending legal proceedings against the company. - Source: https://www.sec.gov/Archives/edgar/data/1022505/000149315225028364/form10-k.htm - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Published - Indemnity cover: Not published - Credentials: Not published - Independent accreditation: Not published - Client results: Not published - How it uses AI: Not published ## Strengths - Named, credentialed practice lead: CEO Brian Haugli co-authored a Wiley NIST CSF reference book and led DoD/Pentagon security programs for 20+ years, backed by a stated bench of '25+ CISOs'. - Publishes concrete, itemized fee ranges for both SOC 2/ISO 27001 fixed-scope readiness work and ongoing vCISO retainers on its own site, rare transparency for this sector. - Has a genuinely named SOC 2/ISO 27001 readiness service page with realistic timelines (Type I readiness in 60-90 days) rather than a generic compliance blurb. - As an SEC-reporting company it files audited 10-Ks and 8-Ks, giving outside parties a public paper trail most private boutique consultancies do not have. ## Things to check Each one carries the factual basis it rests on. - SideChannel's own FY2025 10-K discloses that its disclosure controls and internal control over financial reporting were previously found to have material weaknesses and are currently ineffective. - Basis: 10-K text: 'our disclosure controls and procedures and internal controls over financial reporting are currently ineffective' - SideChannel sells its own proprietary Enclave zero-trust/microsegmentation software as a distinct revenue line alongside its vCISO and compliance-readiness advisory work, a structural incentive to steer readiness clients toward its own product. - Basis: 10-K business description lists Enclave software and vCISO Services as separate revenue categories - No named case studies, client testimonials, or professional-liability/errors-and-omissions insurance disclosure appear on the company's About, team, or compliance service pages. - Basis: About/team/compliance pages checked contain only aggregate marketing stats, no named cases - SideChannel is a publicly traded microcap formed by reverse merger into two prior shell registrants, a corporate lineage distinct from a purpose-built advisory partnership. - Basis: SEC EDGAR lists former names Cipherloc Corp and National Scientific Corp/AZ ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Which data protection, AI governance and cyber security providers publish a price?](https://theassurancedesk.com/lists/providers-that-publish-a-price) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.