Acuity RM Group Plc (ACRM) Earnings Call Transcript & Summary

Good morning. Welcome to the Acuity RM Group Plc Investor Presentation. [Operator Instructions] Before we begin, I'd like to make the following poll. And now I'd like to hand you over to the management team. David, good morning.

Good morning, and thank you, Charlie. Welcome, everyone. I'd like to take you through why I am so excited about -- to tell you about Acuity Risk Management and the great progress that we've made. So this is quite a turnaround story, and I believe we have, in fact, turned the corner. I'll spend the next 10, 15 minutes explaining why I believe that to be the case. So in 2024, we experienced heavy losses. We are spending at a rate that was unsustainable, that did not keep up with our revenue. And therefore, the market reacted in a rational fashion and marked down our shares. During 2025, we cut costs. We rebuilt the company, adding talent in key areas. So we stripped it back to the essentials, but we also added in some -- we added talent in certain cases as well. We reduced the operating loss to about GBP 200,000 and have been profitable in every quarter since quarter 4 of 2025, which I think is quite an achievement from where we were in 2024. Now we find ourselves in a situation where we have a company that is prepared to accelerate growth. In the first half of 2026, we essentially break even -- we broke even. Very recently, so in the last 4 weeks or so, we've won over GBP 300,000 of new annual recurring revenue, and we've lifted forward contracted revenue to almost GBP 2.3 million. The price in the market that our company is available at is reflective of the loss-making past, and I believe it's not necessarily reflective of where we are today or certainly not where we're going in the near future. As a way of introduction, I'll introduce myself, and then I'll allow my Finance Director, Duncan Harper, also to introduce himself. So I've spent the last 14 years building B2B SaaS companies. I have experienced two highly successful private equity exits, and I've been Chief Executive here at Acuity since the very end of 2024. So 2025 was my first real year to have an impact, and I believe we've had that impact. At this point, I'll turn it over to Duncan to introduce himself as well.

I'm Duncan. I'm the Finance Director at Acuity. I joined the firm back in November. So I've done about 10 months with the firm so far. My background is in professional services, including a previous, I think, 7 years stint as group Finance Director of a listed services business. I've been focusing on, which we'll come on to later in the presentation, cost control and setting up the systems inside the business for the growth that we're looking for over the next couple of years.

And Duncan is too modest to mention it, but he's been very instrumental, not only in providing great information to the business, but also driving change and driving improvements that have impacted profitability and certainly will for the rest of this year and beyond. For those of you who may be new to Acuity, what I'll explain very briefly what the business does. So to this point, we've largely dealt with blue-chip companies, we've dealt with the U.K. public sector. Specifically, we are very strong amongst defense contractors. And we help these large organizations that have a growing cyber threat get organized in terms of how they deal with those threats and how they keep themselves safe from a cybersecurity perspective. Customers pay a subscription to use our software. They generally pay upfront. 86% of first half 2026 revenue was recurring revenue, which is -- and it's generally quite sticky. And I'll get into that reasons why later in this presentation. So our main product is STREAM, and what we're now calling STREAM Classic. So we've got many U.K. public sector organizations as clients. We've got defense contractors, utilities, health care and manufacturing. Any organization that is heavily regulated and also vulnerable to cyber attacks is a potential client for Acuity. Public sector and defense customers are generally sticky. The beauty of STREAM Classic is that it's so configurable that it can adapt to many different processes. And because of that, these organizations have adapted with it over time and build it to the point where it is just part of their organization, and it's part of the way they do business. Alongside our software, we also offer consultancy services. We've gotten a great deal of praise about our ability to adapt the system and not only configure and adapt our system, but also to advise clients on how best to do risk management. And because we've been involved in public sector and defense contractors, for example, for such a long time, we're very familiar with best practice, and customers do value our expertise in these areas. We're highly rated by Gartner and other analysts. And you'll see more of that as time goes along as we bring new products on board and get analysts excited about what we're bringing to the table as well. In terms of where our revenue comes from, I mentioned 86% is from subscriptions, which is sticky and recurs year-on-year. We, to this point, have mostly blue-chip, highly regulated customers, public sector type customers. We have a very strong foothold here in the U.K. We also have a significant foothold in Germany and in Mainland Europe. We have a small portion of our revenue that comes from North America. The strategy really is about establishing ourselves even further in the U.K. and mainland Europe, mainly due to the regulatory climate that's only increasing with regulations such as DORA, a renewed emphasis on supplier assurance and third-party risk management. These are all areas in which we're very strong and in which we feel like there's a large market still to be expanded into, especially within the U.K. and Europe. As we develop our brand further and are known in a wider area, then we'll be able to make the investment to go in deeper into North America and potentially Asia as well.

Okay. So this is a brief summary of the financial turnaround that the company has achieved over the past 3 years. As David said, the business was heavily loss-making in 2024, where the cost had accelerated way past the revenue. David's arrival as Chief Executive towards the start of 2025 as the costs -- he managed to get the costs coming down significantly, and that had a huge impact in 2025 in reducing those losses. And then as we've already said, for the first half of 2026, we're effectively at breakeven costs or breakeven result. The next slide perhaps goes into that in more detail. We've talked about the very big reduction in admin costs that we've achieved. And going forward, we'll obviously be looking to keep those very much in check. The revenue of the business, as we explained in the interim results publication has declined year-on-year as some of the -- we had some cancellations in 2025, which contributed to revenue in the first half of 2025, but not in the first half of 2026. The plan from here is that to keep admin expenses at a similar or low level, grow the revenue, and therefore, the operating result increases or profits increase from there. The gross margin of the business is extremely high being a SaaS software company. So new sales have a significant incremental effect on the bottom line. Customers, as David said, pay upfront. So the cash generation from new customers is significant. I'll hand back to you, David, for the next slide.

Great. Yes. It's important to note, as we bring these new products online, customers generally pay upfront. So it doesn't take a great deal to actually start to become a business where we are generating significant cash. I think that's an important point to make. In terms of some of our recent contract wins, these have generally been in our defense contractor space. So we've had an excellent August and beginning of September, where we've added GBP 300,000 plus of new annual recurring revenue. So this is significant for our business. And as I'll get into in just a moment, this is really only the beginning. We've also seen an increase in our forward contracted revenue from the beginning of the year. So now we're up to GBP 2.27 million with more expected in the days and weeks ahead. In terms of our growth in forward revenue, so we're up 15% from the start of the financial year, which is a good start and something that we'll build on. And I believe by the end of the year, we'll have built upon even further. One of the wins that we've announced -- actually, two of the recent wins that we have announced have dealt with a multi-nation program that we're involved in. And I'm not at liberty to go into detail on what exactly this program is. I will say that if you pay attention to the news and especially defense-related news, you will have heard of this program. It is a very high-profile program, and we are honored to be a part of it. So this is a multi-nation cyber risk program to protect a major international defense procurement involving several prime contractors. We've only realized and we've only won business from one particular defense contractor within one of the nations. So there's a significant amount of pipeline that we've built, that we have visibility of, that we expect to come in, in the weeks and months ahead. We also expect that as we become more entrenched in this program, and we go beyond the prime contractors down into their subcontractors, the same reporting requirements and the same element of control over our cyber programs will flow down into multiple tiers of the supply chain. And that's not something that I can guarantee at the moment. It is something that -- so I have visibility of some pipeline, but there's much more beyond what is just currently visible to myself and to Duncan. So this is a long-term program. This should run through a number of years and is quite an important part of the U.K. defense. Also in terms of what I'll say about U.K. defense spending, for those that are paying attention to news here and budgets, there is an increase in defense spending. There's a new defense investment program that has committed that one of the key pillars is cyber defense because while most people think of defense as a military operation, there are significantly more cyber threats now than there had been in the past. And U.K. and Europe are recognizing this, and they're increasing their investment in these areas, which I believe that Acuity is well placed to take advantage of. These are all elements that are upside in the plan, not reported revenue, and there is a pipeline beyond what we've already announced. In terms of the products that drive our growth, this is a key element to understand is, so STREAM Classic is our cash cow. These are where -- this is where the great majority of our revenue comes from today. And we have satisfied customers especially in the public sector and amongst defense contractors. The Vendor Management Hub is a product that is great for companies that are beginning a third-party risk management journey. STREAM Cloud is a recently released product that we've only started investing significant marketing in following the recent fundraise. So in July, we began to invest further in terms of our ability to get STREAM Cloud and the other products in front of potential clients. This opens up a whole different market for us, because STREAM Classic is quite overengineered for the mid-market. So we're talking companies with 1,000 to 5,000 employees in heavily regulated sectors. So STREAM Classic is just -- it's overengineered for that particular purpose. Now we have STREAM Cloud, which will allow those -- some of those organizations that churned, if we would have had that back in, say, early 2025, we would be in a better place with them. And so going forward, for those organizations that just find STREAM Classic too much, we have another offering that will allow us to keep our current clients and also expand into the private sector mid-market, which is a new customer segment for us. Building upon that, and we'll see how these 2 systems work together. Risk OS is planned to be launched in quarter 4. And which represents a step change in how Cyber GRC is done. And I'll get into that more in a minute. There's also the ability that STREAM Cloud and Risk OS will complement each other to the point where our STREAM Cloud clients will be able to operate independently on STREAM Cloud, but also be able to upsell Risk OS and vice versa. Those that buy Risk OS can use it as a stand-alone product and can then also -- we can then upsell them to STREAM Cloud as well. So I mentioned STREAM Cloud opens up a much bigger market and a faster-moving market at that. So we've modeled STREAM Cloud after STREAM Classic, albeit using a much improved architecture that we can build upon much quicker than we can historically. Built for midsized companies, it's fast to set up. The sales cycles we anticipate being shorter, and we expect our clients to start getting value within hours or days rather than potentially weeks with STREAM Classic. Many organizations, we're not necessarily trying to steal business from other competitors here, but rather we're going after a greenfield environment where organizations are trying to use spreadsheets to get their cyber risk management under control, whereas now we can replace those spreadsheets with a not overbearing cost platform that will handle all of that for them in a much more efficient way. So previously, we were very much suited to big public sector bodies and the mid-market private sector companies were just not available for Acuity, but that has now changed. We've removed those barriers. We're specifically focusing on -- mainly on two areas with STREAM Cloud. One is compliance with DORA, which is a big push now, especially for financial institutions, and also supplier assurance for third-party risk management, which is coming into focus, especially with some of the recent cyber attacks. For instance, Jaguar Land Rover had an attack that was breached through a third party. And so organizations are understanding more and more that they really need to get their act together in terms of how they're managing their suppliers' cyber risk and not just their own. We're in good position to be able to handle that. The product that I'm most excited about out of our entire portfolio is Risk OS, because it represents a step change in how Cyber GRC is done. So today's Cyber GRC software records what is happening. But Risk OS tells you what to do about it and within guardrails, acts upon that information for you. And the reason that's important is because with these AI-based attacks, cyber hackers are now much more able to exploit vulnerabilities than they ever have been in the past. And it's too fast for any human operator to get their head around. But Risk OS allows organizations to defend their cyber landscape at the speed of AI and at the speed of these attackers. And that's why Risk OS is such an important development for us. So it's -- not only is it responding at the speed of AI, but it's orchestrating all of the cyber defense. There's many aspects to cyber defense that Risk OS has, and it's being able to orchestrate all of those areas. And I'll just tell you a brief story about how it will be used. So many cyber attacks occur because people have higher permissions to access data than what they should. And organizations have systems called identity access management. And what Risk OS does is it makes sure that your identity access management settings are matched with your policies. So you -- so someone who has -- someone, say, in the lower levels of the organization should not have access to the entire organization's data. By having that situation, they're exposed to that person either being duped into giving out their, say, password or allowing -- or their credentials to log in or if they are released from the company for whatever reason, and they want to cause harm that they can do. So Risk OS makes sure that, that identity access system is up to date and in line with your own policies. So it provides a great deal of value for clients at not a backbreaking cost. In terms of STREAM Cloud and Risk OS, the two can work separately, so we can lead on sales processes with one or the other, depending on what the clients' needs are. But the fact that they will be able to work together, and for instance, you may be able to go into Risk OS in your chat bot and say, make this particular change in STREAM Cloud. That is a very powerful thing for our clients because the clients will have the system of record, which is STREAM Cloud. And then they'll have the system that allows them to make better decisions and even act autonomously within guardrails to improve their controls. So the two can work together, but it provides a natural path to upsell clients once we get one or the other. And that can lead to compounding growth as we do. So how we manage the company now versus how it was managed previously. One key element is that spend and investment follow evidence. So we are not rushing out to hire an army of salespeople before they have strong sales qualified leads to be able to close deals. So everything works in a logical flow. So we add -- now we're adding to what's called top of the funnel. So we're adding resource to increase the number of leads that we're getting. And as we start to see those leads piling up, then we'll add closer to the bottom of the funnel, then we'll add salespeople. And we'll also -- this also matters in terms of marketing. So we've recently refocused on Google ads, LinkedIn ads and other marketing initiatives that will get our brand in front of potential customers. And once we see what's working, then we'll add to that investment and not before. The core is quite sticky. So public sector bodies, our defense contractors, it's part of their infrastructure, and that will only continue to grow. So we'll protect the core. And some of that some of the revenue that we get from our core will then be used to expand into different customer segments and fast-moving customer segments in which the regulatory environment and also the external threat environment is increasing. And therefore, these mid-market organizations will have more and more of a need to protect themselves and also to explain to their boards because this is becoming a Board-level decision, what they're doing to protect themselves from cyber attacks. So we've got an improved direct sales channel. So our -- following the raise in June, we've begun to invest in marketing. We're already starting to see the green shoots from that, and we expect even more even during this month. Even though it's quite a new initiative, we are seeing and certainly expecting a very big impact quite early on. We've also got an improved channel partner program. So we're going very methodically through an ideal partner profile, and we're reaching out to these organizations that already have pipeline in place and that we should start to see results from in the months and quarters ahead. At this point, I will conclude the presentation and happily take your questions.

Perfect. Thank you guys for updating investors today. [Operator Instructions] For your reference, a recording of today's presentation will be available on the Investor Meet Company platform shortly, after the meeting has ended. As you said, we have received a number of questions during today's presentation. So if I could just hand back to the team now to read out those questions to give responses where appropriate to do so, and I'll pick up from you at the end.

Okay. Thank you very much for all the questions you've submitted. There have been quite a lot of them. I'm not sure we're going to get through absolutely all of them, but we'll give it a try to answer as many as we can. So the first one I was going to pick was we've had a question about when we're expecting the launch of Risk OS. Do you want to take that one, David?

Sure. We are expecting to launch it in quarter 4 of this year. We're looking at ways to -- so because of our new capability and the use of what's called engineering loops, we should be able to accelerate that development. The main thing that would impact the time line is just understanding and getting full validation from customers in our target market. But we -- that is what we're working on as we speak and have been working on over the past 2 months really. So we don't anticipate any delays there, and we should have a quarter 4 launch.

Okay. Thank you for that, David. And we've also had a question about what the annual cost to the business is of maintaining the listing on AIM. The answer to that is probably -- it's a bit difficult to be exact because some of the costs would be incurred anyway. But we've obviously got nomad fees. We've got broker fees. We've got which we wouldn't have if we weren't listed. We've got share registrars. We have couple of -- 3 non-executive directors. The audit fees are probably higher for a listed company than they would otherwise be. There's the LSE fee itself. There's the regulatory announcement fees. There's more company secretarial fees. There is a whole raft of these, which applied to all AIM companies. But in answer to the question, I would guess that if we weren't listed on AIM, we could probably take out between GBP 200,000 and GBP 250,000 of costs each year would be my answer to that question. We are trying proactively to keep those as low as possible, but there's a certain minimum level of things we have to do to maintain our listing. We've had another question about -- asking about what the main reason for the customer cancellations that occurred in 2025 were? I think David has already covered quite a lot of these, but I don't know whether you wanted to spend 30 seconds, just recapping on that, David.

Sure, absolutely. So customers canceling contracts were generally those that -- for which STREAM Classic could do everything they wanted, but it was a bit overengineered for what they needed. And in some cases, they were organizations that had planned to sell it on to their particular clients. And in those cases, they didn't get the full value. So whether -- so it was mainly the product did not quite fit exactly what they were expecting it to. And in those cases, at the current time, we would then shift them to STREAM Cloud which is extremely easy to use. I picked it up, started using it and was able to create my own environment without any sort of user guide or anything else directing me. And so at this point, we would move those clients for which STREAM Classic may be overengineered onto STREAM Cloud and would, therefore, be able to, a, retain them, and also STREAM Cloud opens up, as I've discussed, that whole new customer segment.

Okay. Thank you for that. Okay. The next question we've had is asking if we could elaborate on what DORA is that you referred to earlier? And what the implications are for that and why that presents a sales opportunity for us?

Yes. The Digital Operational Resilience Act, and that is there are different milestones that companies need to have controls in place by. And this is particularly relevant to financial institutions. It makes sure that customers are -- one of the key elements is that they need continuous -- evidence of continuous control in place versus just passing an audit once a year. And we're -- so there is -- so competitors such as say, Vanta is a large one in terms of getting people compliant with, say, ISO 27001 or other standards. But why we're very well placed for in areas like DORA and others is that they are now requiring evidence that you are continuously monitoring the situation rather than just passing an audit in a one-off event. And that is something that Risk OS, in particular, will do extremely well. And there will be no more scrambling around when there's an audit coming up. It will be, here's the report that you need or here's access to our system. And you can see that our controls are working and the evidence is fresh, and we know where our weaknesses are and we're addressing those.