How Will WhiteHawk Capitalize on New CMMC Rules Starting November?

Quarterly Financial and Contract Highlights

WhiteHawk Limited (ASX – WHK), a global cybersecurity exchange platform, has reported invoiced revenue of US$258,000 for the third quarter ending September 30, 2025, alongside receivables of US$85,000. The company continues to manage its operating expenses tightly, averaging US$272,000 per month, resulting in a net cash outflow of US$406,000 for the quarter. Despite this, WhiteHawk maintains a solid cash position with nearly US$1 million in cash and equivalents, supplemented by an unused credit facility, providing an estimated funding runway of 2.7 quarters.

New Contracts and Strategic Partnerships

WhiteHawk has made significant strides in expanding its contract portfolio. Notably, it secured a new U.S. university cyber research program contract and is progressing an Australian university subscription deal aimed at scaling cyber experiential internships and academic programs. The company also submitted a sole source 90-day proposal worth US$280,000 to the U.S. Office of the Secretary of Defense, targeting critical infrastructure entities.

Further, WhiteHawk is actively responding to government requests for proposals (RFPs), including a potential three-year, US$1 million contract with the State of Maryland Department of Labor and a multi-phase, US$2.2 million per year partnership with the State of Florida to provide cyber resilience programs across multiple universities. These initiatives underscore WhiteHawk’s growing footprint in both U.S. federal and state government sectors as well as Australian markets.

Regulatory Catalyst – CMMC Compliance

A pivotal development for WhiteHawk is the imminent enforcement of the U.S. Defense Federal Acquisition Regulation Supplement (DFARS) rule implementing the Cybersecurity Maturity Model Certification (CMMC) program, effective November 10, 2025. This regulation mandates all U.S. defense contractors to meet specific cybersecurity standards to qualify for contracts. WhiteHawk’s Automated Path to CMMC offering, developed since 2019, is now positioned to meet this surge in compliance demand, allowing the company to sell directly and through partnerships, notably with Dun & Bradstreet.

Two existing clients require CMMC compliance, and WhiteHawk is actively scoping new contracts in this space. The regulatory certainty provided by the final rule is expected to drive significant sales momentum for WhiteHawk’s compliance solutions, which deliver comprehensive baseline assessments and prioritized action plans within 48 hours.

Ongoing Service Delivery and Market Expansion

WhiteHawk continues to deliver cyber risk monitoring and assessment services to a diverse client base, including a global social media platform, U.S. universities such as Georgetown, major U.S. cities, and global investment firms. These contracts involve continuous monitoring, vulnerability analysis, and reporting, reinforcing WhiteHawk’s role as a trusted cybersecurity partner.

Geographically, the company is expanding its channel partnerships across key U.S. states; Maryland, Ohio, Florida, Pennsylvania; and engaging with 30 Australian universities and government agencies. This broadening network supports WhiteHawk’s Cyber Resilience Moonshot initiative, aiming to enhance cybersecurity readiness at regional and institutional levels.

Financial Outlook and Challenges

While WhiteHawk’s revenue growth and contract pipeline are promising, the company’s cash burn rate and net operating cash outflows highlight the need for careful financial management. The current funding runway of under three quarters suggests that additional capital raising or improved cash flow from operations will be necessary to sustain growth momentum. Moreover, some contract awards remain subject to government budget approvals and potential shutdown delays, adding an element of uncertainty to near-term revenue visibility.