Corero Network Security plc (CNS) Earnings Call Transcript & Summary

March 24, 2026

AIM GB Information Technology Software earnings 49 min

Earnings Call Speaker Segments

Operator

operator
#1

Good afternoon, ladies and gentlemen, and welcome to the Corero Network Security plc Full Year Results 2025 Investor Presentation. [Operator Instructions] Before we begin, we'd like to submit the following poll, and I'm sure the company will be most grateful for your participation. And I'd like to hand over to the management team. Carl, good afternoon.

Carl Herberger

executive
#2

Thank you very much, Mark. Good afternoon. And for the American attendees, good morning, and thank you for joining us today. I'm joined today with my colleagues, Chris Goulden and with Michelle McBain, a recent hire for us in our Head of Channels. So she'd be here if you need to ask some questions along the way. I'll start on how the business has evolved over the last year and what we're seeing in the market and how that's shaping our direction. Chris will then take you through the financials in detail. We look forward to the questions at the end. So let's first talk about Corero. Corero protects organizations from the growing threat of distributed denial of service attacks. And we are evolving to a resiliency platform that help networks and cloud services stay up and online. What's changed over the last year is the nature of the problem that we're solving. This evolves like all other problems in this space. It's no longer just a large -- it's about large visible attacks. Now there's a pervasive smaller, persistent and often encrypted traffic that degrades performance over time and is much harder to detect. That's where we're seeing strong alignment with our platform. As you can see on this slide, that's translating into real traction, strong recurring revenue growth, high retention, which reflects how embedded we are with our customer environments, continued product adoption, particularly with our next-generation platform and a nice amount of early core deployments and expanding reach throughout both direct and partner-led growth, especially in regions like Lat Am, extending into South APAC and also into Continental Europe. That taken together, this is a business that is not just growing, but becoming more predictable, more integrated and critical in customers' infrastructure. All right. So let's take it to the numbers, Chris.

Chris Goulden

executive
#3

Yes. I think these are the highlight numbers that we also put out in January as the trading update. I think for anybody who wasn't following the story through 2025 or just a refresh, just to cover what actually happened through 2025. So Q1 for us was relatively weak in terms of the order intake. We have global uncertainty, particularly around U.S. tariffs was delaying customer decision-making. And then as we move through the rest of the first half of the year, we saw quite a significant shift in customers' buying behavior. So historically -- so I mean, we sell in 2 different selling motions. So customers will either buy in a way where they pay upfront what we call CapEx deals, if you've heard us refer to that before or they buy on a subscription basis as our DDPaaS service or other kind of subscription offerings. Now the upfront revenue has a larger portion of revenue that gets recognized in year. And the subscription basis, the revenue is recognized over the contract term, which is typically 3 years. Now 2024 and previous, roughly 40% of our revenue came from deals where we sold on an upfront revenue basis. And what we saw through the first half of 2025 was that percentage moved down to 30% as customers were more interested in purchasing on a subscription basis. So if you take that on our bookings number, so the bookings in the year, we did $33.8 million. Effectively, 10% of those bookings previously would have had revenue recognized in the year, whereas now we're being pushed into a subscription basis. So less revenue in the current year, but growing the ARR, the annual recurring revenue numbers. Now because of that at the half year, we changed. We had to lower our revenue expectations for the full year because as I say, we were still winning, but less of those orders were being recognized as revenue in the current year and we're being pushed out to future years. Through the second half of the year, we saw that trend continue but we did see a couple of nice deals come through in the second half of the year. So by the end of 2025, we were able to overdeliver on the revised forecast, both from a revenue perspective and an EBITDA perspective. So we exited the year with ARR of $23.9 million, which was a 23% growth over the prior year. That's really the kind of key metric from a revenue perspective that really enables the growth in 2026 and beyond. So this is contracted revenue that we already have visible at the 1st of January before we start selling and growing. Adjusted EBITDA of $2 million. So this was a reduction versus 2024, and that's largely because the investments that we put in place, particularly around sales and marketing, they showed themselves in bookings and the 23% growth -- sorry, the 20% growth we had in sales bookings in the year. But as we said, with more of those bookings now being recognized as revenue across the contract term rather than upfront, that cost investment is going to be returned in revenue in '26 and '27. Pleasingly, despite the change in the sales mix, the gross margin isn't impacted. So regardless of whether we sell deals where the revenue is recognized upfront or over the contract term, the gross margin isn't materially different. Within that, we continue to offer amazing service and product to our customers and have a 98% renewal rate. That's consistent as it has been over the past few years. We're currently upwards of 90 people worldwide and plan to grow this year, and we're in a significant portion of the global economy now, particularly as we've added sales resources over the past 12 to 18 months in some of the geographies that we didn't previously look after.

Carl Herberger

executive
#4

Thanks. So let me -- let's take a look at some of the metrics that are reflecting the shift of the business, a shift right and a shift to an acceleration. The high renewal levels are pointing to increased dependency on our platform. There's just no other way to look at it. We're proud to report that the customer signs with us, they stay with us. It's a key metric for us, and we believe that this is something that is -- it speaks louder than just the metric itself. It talks to everything about the platform, the capability and the value proposition to our customers. The recurring revenue growth reflects deeper adoption, and we're taking share as part of that recurring revenue growth. And the booking momentum, which we had 20% bookings growth on top of year-on-year, reflects continued demand and also share -- we're taking share from our competitors. We continue to take business away from what was an existing portfolio of states from our competitors when contracts are coming up, and we continue to make meaningful progress in these takeouts across all different geographies and all different solution sets. We're expanding in Lat Am. We're expanding in APAC. We're expanding in the Middle East. And it's translating into tangible results, supported by growing momentum across our channel partnerships, particularly in larger enterprises and Tier 1 deployments. It's led to Michelle McBain's coming on board to our business and growing out a whole portfolio now of channel managers and increasing our partnerships. So let's talk about the threat landscape. It's one of the major motivating factors to reach to a Corero portfolio, but it is not the only factor in people purchasing Corero. Each year seems to bring a new wave of threats, but last year marked a clear shift in the threat environment. Even highly capable operators such as DeepSeek AI, Cloudflare, giants with sophisticated threat management systems in place have taken huge outages. Even they experienced disruptions that exposed how interconnected and vulnerable modern infrastructures have become. What stood out to us was not just the size of the attacks, but how they're structured. They're stronger. They're smarter. They're more adaptable. The targets keep expanding from data centers to telecom to financial services. Fundamentally, no one is fundamentally safe in the interconnected world. Many of these attacks are small and persistent. They're designed to evade detection, while others are coordinated across multiple vectors, including encrypted traffic. The objective is no longer disruption. It's gradual degradation. It's increasing the latency of service over time. Fundamentally, this business has turned to resiliency cyber protection to protect your business at all costs from being able to be degraded. Next slide. All right. So at the same time, another motivating factor to buy our solutions, and this is new as of the last 12 months that in our space, the regulators have come. They've written legislation. They have written -- they have promulgated directives in each region around the world, and some of them are becoming really ominous. So the regulatory and infrastructure trends are accelerating. Governments are increasing requirements around resiliency and incident reporting, while data centers and AI-driven workloads are raising the cost of downtime significantly. Together, these forces are turning to DDoS protection regardless of the threat landscape increase into a required layer of infrastructure, essentially a platform of software that allows for protection of their discretionary investments. This is the boating for Corero. This is the growth engine for Corero. Next slide. So how does it work? Well, there is a tremendous amount of now need for sovereignty. I think we all can recognize that the world has turned inward with the way that they want to be able to do their cloud, the way that they want to do their technology, the way that they want to service their businesses is all about sovereignty. And sovereignty bodes well for on-premise technology. This is where our approach to DDoS becomes particularly relevant operating directly with the traffic path allows us to respond immediately, maintain performance and retain control over sensitive data and satisfy sovereignty concerns in all regions. This is different from us compared to other competitors. As environments become more latency sensitive and more regulated, these characteristics become increasingly vital, paramount. Next slide. So when the legacy solutions fall short, which is fundamentally the characteristic of where we feel the past legacy solutions are. This is where our approach to DDoS becomes particularly relevant. Many of the legacy approaches were designed for different threat models. They rely on thresholds, on rerouting, on manual intervention, approaches that are increasingly ineffective and against persistent and multi-vector threats. This creates a growing gap between what organizations need and what traditional solutions can deliver. Next slide. So what is our ongoing strategic process? What are we doing about this? How are we taking advantage of this? Operationally, in 2025, we defined by execution across 3 areas. First, we expanded the global footprint, particularly in key growth regions where demand is accelerating. Second, this was to take advantage of the growing addressable market, make sure that we were participating in that addressable market. Second, we strengthened our partner ecosystem, which is now contributing meaningfully to deal flow and needs better management, procedural management, process management. So we're building out this year, and I'm very happy to announce the onboarding of Michelle McBain and her organization. We're building out an entire set of new capabilities in our partner management function, especially for larger enterprises and now we really turn our sights to Tier 1 telco providers. Third, we continue to advance the platform. So that's in line with how customer requirements are evolving, particularly around visibility, around automation, around application layer, especially around encrypted traffic problems. Our parity with our competitors are at best or we're leading in features across the board. Together, these efforts are translating into a business that is scaling, not just commercially, but geographically and operationally. We continue to invest across sales, channels, regional capabilities, which is now starting to show through in the pipeline quality and in conversion. At the same time, we're maintaining discipline, continuing to invest in R&D while aligning the business more closely with a subscription-led model. That transition is important. It improves visibility for you, for us. It strengthens our customer relationships and our partner relationships, and it strengthens our positions as well as the market continues to evolve. Next slide. So the product footprint I'm excited to show you is a new visual that we've come up with to be able to more demonstrably demonstrate our capabilities. We have a capability that provides, of course, increased security across a number of important and powerful feature sets, increased visibility with being able to give dashboards and quick ideas about what's going on in the marketplace as well as deployment options. We have now the best deployment options in the industry. We can meet you where you are, when you are, what you are and it factors into that sovereignty issue. And of course, our operations are world-class because we're the only operator that offers a fully managed, completely turnkey solution in the marketplace. This is what moves the platform from a point solution to a more comprehensive security layer, what we like to call a resiliency platform. Next slide. We're not the only ones that have recognized this, but the industry has taken note. We have taken tremendous amount of info security awards. In fact, 2 of them are being announced this week at RSA in California, a global conference on security, 2 additional ones that are not listed here. And you can see here when they, on a yearly basis, map the capabilities of DDoS providers, Corero, for the first time, moved into the leader quadrant and we're now matched with competitors that are 10x our size in capabilities or I should say 10x our size in revenue, but we have the same capabilities as them. As our -- as the competition comes to understand that we are an eligible option, we will be picked more often than not because of our capabilities in the marketplace. Next slide.

Chris Goulden

executive
#5

Okay. So just picking up again on some of the financial highlights, and you can see the trend here on those KPIs across the 5-year period. We've touched on revenue and ARR previously. I think the gross margin metric is really key because when we look at 2026 and beyond, if you combine ARR and gross margin as the kind of 1st of January metric coming into the year, puts us in a really strong position in terms of forecasting and seeing the growth. So opening the year with $23.9 million of contracted revenue and knowing that whether we sell upfront revenues or subscription revenues still averages at 90% gross margin, it really gives us an opportunity or a significant opportunity to grow that revenue in 2026 and beyond. I guess cash is the other point to talk around on here. So I guess if you look at the chart and look at 2021 into 2022, much higher kind of year-end cash positions because of, I guess, particularly large customer wins in Q4 in those years, over 2023 and 2024, that kind of averaged out to where the cash was sitting on that previous 40% upfront revenue sales ratio. 2025, through the year, we've seen some cash burn down to $4 million. That's as a result of this move away from upfront revenues and upfront cash to revenues and cash over the term of the contract. What is positive in that metric is from H1 through to the end of the year, we did generate cash. So cash was $3.1 million at the half. So we were cash generative in the second half of the year despite the fact that we're still going through this transition of revenues and cash moving from point in time to over the contract term. It gives us confidence moving into 2026 that we can continue that cash generation. Looking at some revenue segments then. I guess just to cover on the right-hand side, we've talked ARR, but this chart just shows the trend over the prevailing years. And you can see the uptick in the acceleration of the graph on the right-hand side into 2025 with that 23% ARR growth. If we look on the left-hand side, if we look at geography, so Americas, clearly the most difficult -- the largest but the most difficult market to crack for challenger brands. So 70% of our business comes through the Americas, which is great for our business. It's great visibility. There's great need and spend availability in that region. What is interesting though is we've talked previously about expanding our sales representation globally. In 2024, Americas represented 79% of our sales. So a lower reliance on Americas, if you like, because we now have presence more globally, particularly in the U.K. and particularly in the Middle East is where we've seen that trend. Actually, Lat Am is also a big contributor, particularly Brazil in that region. Down in the left-hand side, where we look at by category, the dark blue one in the top right-hand side is this is our software license and appliance revenue. So this is effectively the upfront revenue contracts that we talk about. So 32% of our revenue in 2025 came from contracts where it was upfront revenue recognition. The green section is maintenance and support and the, I guess, lighter section is subscription revenue, such as DDPaaS and core. Now this is where we've seen the real change in the mix from 2024 into 2025 because that 32% for software license and appliances, remember, this is the upfront revenue section. That was 41% in 2024. So this is the key trend difference that we've seen in 2025. And we saw -- we reported at the half year that this was a change. We've seen a similar mix through the second half of the year, and that's what we expect at this stage to continue through 2026.

Carl Herberger

executive
#6

So how do we feel about 2026? Not surprisingly, we feel great. We believe we have continued momentum. We believe that our sales pipeline remains strong and demand drivers are firmly in place. Our focus is on 3 priorities: deepening automation, expanding geographically and increasing recurring revenue through platform adoption and managed services. In this idea of deepening automation, we have strong pushes in leveraging AI internally for enablement programs and for acceleration programs, but also AI is driving our business because AI is so sensitive to latency and disruptions in their algorithms that DDoS is a fundamental part of AI protection sets. Next slide. So as I close out, I just want to step back, 2025 reflects a business that is transitioning from proving the model to scaling the model. We're becoming more embedded with our customer environments where our technology is not optional, but critical to maintaining availability performance. That shift is driving greater visibility in terms of pipeline and revenue and a more predictable foundation for growth. At the same time, the broader environment continues to move in our direction as networks become more distributed, more complex, more exposed, bigger. The requirement for real-time in-line protection is only increasing. It's not just a progress within the business, it's alignment with where the market is going. And as we move forward, our focus remains consistent to convert that positioning into sustained commercial momentum and long-term value creation. Said simply, all we really need to do is make sure that we're an eligible option for what is already a spend in the marketplace, and we believe we'll be winning share throughout 2026. Thank you, and I look forward to any questions that you have.

Operator

operator
#7

That's great. Chris, Carl, thank you very much indeed for updating investors. I will bring your camera back up for the Q&A. [Operator Instructions] I'd just like to remind you a recording of this presentation along with a copy of the slides and the published Q&A is available via Investor Meet Company dashboard. Now Carl, Chris, I know I haven't given you a lot of time, but you've received a number of questions from investors. Thank you to everybody for your engagement this afternoon. If I may just hand back to you guys just to take us through the Q&A, if I could ask you to read out the questions, and then I'll pick up from you at the end.

Chris Goulden

executive
#8

Great. Thanks, Mark. Well, thank you. We've got lots of questions already. So let's dive in. The first question is, after a strong start to FY 2026, what evidence supports your expectation that FY 2026 and beyond will deliver improved financial performance for Corero? Well, I guess I'll open from, I guess, a numbers perspective. I think I touched on it earlier that the ARR growth that we saw in 2025 has really positioned us strongly coming into 2026 and beyond. Having that recurring contractual revenue in place, it gives us the visibility to see what the baseline revenue is for this year. It reduces the requirement of go get in year to initiate growth. And I guess more than that, from a management perspective, having greater visibility on recurring contractual revenue coming into the year, it gives us that visibility and the ability to make investment decisions or organizational decisions sooner. Where we -- in previous years where we've had to rely on winning CapEx deals to start generating revenue in the year, you have to delay some of the investment decisions sometimes. They effectively are funded by the revenue generation that you create. Having that revenue kind of pre-populated, if you like, through ARR allows us to make those decisions in advance decisions that hopefully will accelerate the growth potential of the organization forward.

Carl Herberger

executive
#9

Very nice. I guess I'll take the second question. How does the management team plan to deliver a robust and successful go-to-market strategy following improved sales and marketing capabilities? The business has been characterized for approximately the last 10 years is what I would call hunt and feast. We would develop a selling model that we would hunt a deal and then feast on that deal. And while we're hunting a deal, it was difficult to scale to the next hunt. This is the importance and the fundamentals around managing the partner community properly. Michelle is with me here today, and maybe I'll give her a second to mention why she came aboard to Corero, where she's come from and what the opportunity is at Corero, which is a fundamental piece to answering this question about how do we make this a transaction-based business.

Michelle Ragusa-McBain

executive
#10

Sure. Well, thank you, Carl, and pleasure to meet everyone. As Carl mentioned, my name is Michelle Ragusa-McBain, and I am the Global VP of Channels and Alliances at Corero. I spent 22-plus years in the channel ecosystem and predictively or most commonly in cybersecurity and networking. I was at Cisco for 14 years, and I was at SonicWall most recently as their Global Channel Chief. And I am a huge advocate and champion of the channel alliances and the partners around the world and the opportunity that they present for a company like Corero. Why did I join? Really, it was because of Carl and the executive leadership team and the Board and their vision for what the art of the possible could be for this company. And it's a huge opportunity for myself to not only reimagine channel programs as I've done at Cisco and SonicWall, but to build out a very key differentiated program that not only will match and mirror the amazing differentiation our product provides, but allows our partners to be more profitable so that we can co-sell and co-innovate together. For me, partner ecosystem, our alliances are really a key driver for exponential growth opportunity in the total addressable market that exists for this space in cybersecurity. Carl mentioned the regulatory compliance requirement needs, the improvement or the significant acceleration of AI and data centers, which are driving the possibilities, geopolitical world as we know it. There's so much going on right now. Partners are the trusted advisers to many of the end customers in every vertical, in every segment around the world. And working with them side by side, we can really lean in to not only add a layer of security that is required and needed to keep their customers safe, but also give them incentives to drive more revenue for their business.

Carl Herberger

executive
#11

Thank you, Michelle. We're so excited to have her on board. And I think it talks to also the quality of the opportunity that we have here at Corero.

Chris Goulden

executive
#12

Okay. Next question then is what proportion of sales is now generated through channel partners? And how important are they to Corero's business model? I guess I'll start and then hand over to you, Michelle. So in terms of numbers, well, actually, if you take nonrenewals, almost all of our sales go through channel partners to some extent. If we're going to narrow that down to our alliance partners that being GTT, HPE, Juniper and Akamai. Typically, that falls in about 25% of our sales go through the alliances. Yes, I think I'll let you talk about the -- how important they are to Corero and the business.

Michelle Ragusa-McBain

executive
#13

I personal bias. But I do think they're extremely important and pivotal. I think our alliances are a critical piece of our infrastructure, and they allow us to really have a very large breadth and scope and reach to the opportunities that exist today. In addition to that, I think that we have an opportunity to educate partners that are in this space, but think that they are covered from a DDoS attack, but they are not today. There's really only 3 companies that are purpose-built in this space. And our technology is not only superior to those competitors, both in speed and in mitigation, but also we meet our partners where they are in their journey. We're agnostic, hardware, software. We can integrate in various ways, as Carl mentioned, do it with you, do it for you, a white-glove concierge experience for our partners, which is something that only we do. And so this is not only very attractive for the partner community, but allows them to be an expert what they do and allows us to have the expertise in what we do and work side by side to drive that success.

Chris Goulden

executive
#14

Okay. Next question then is, do you expect the company to achieve profitability in FY 2026? Trying to nail me to a mess here. Let's think about it this way. In 2025, net loss was around $700,000. So if you reverse engineer the P&L to look at how we achieve profitability in 2026, as I mentioned earlier, with a strong gross margin of 90%, 91%, it means that a significant portion of revenue growth can pull through to profitability as long as we are managing OpEx and development spend appropriately. We had a huge push on development in particularly the second half of 2025. There's no material change in development expected -- in development spend expected for 2026. We are continuing to look to improve -- sorry, increase development and product output. But as we've mentioned, the use of AI within our development processes means we can do that much more efficiently than in the past. If you combine that with the ARR that we're coming into the year with, the revenue growth requirement to achieve net profitability in 2026, that is visible and that is achievable. Okay. The next question then, in the current year, should we expect more new customer wins or a greater focus on contract extensions?

Carl Herberger

executive
#15

Yes. So I'll take this. We have almost one quarter behind us. And I can say in terms of number of deals, I'm happy to report that 50% of our deals thus far in the first quarter are net new logos to the company. So we are not only taking orders from existing customers and, of course, add-on and upgrades of existing customers, but we're bringing many more people into our portfolio. I'm happy to say we have over 400 direct customers at Corero with 98% retention of those customers. Every time we bring a new logo in, we have a high degree of confidence we'll continue to grow that new logo as time moves on.

Chris Goulden

executive
#16

Thank you, Carl. Next question then is, what level of investment in sales and marketing should we expect in FY 2026?

Carl Herberger

executive
#17

As a percentage of sales, I think we're expecting the same level of investment, right, Chris?

Chris Goulden

executive
#18

Yes, we're certainly not looking to increase investment ahead of revenue growth.

Carl Herberger

executive
#19

What differentiates Corero from competitors? Let me take that one. All right. There's 4 or 5 major things, but let's concentrate on a couple or 3. The first is Corero is the only company that started out its life trying to address this cyber resiliency problem. All the other competitors moved into an adjacent opportunity from their legacy platforms. So as a result of that, we are agnostic to the platforms. We're agnostic to hardware. We're agnostic to the cloud. What does that mean that we're agnostic? It means that we don't force you to go through a platform such as a CDN or a cloud. We don't force you to go through our hardware. Said another way, we actually integrate with companies' existing portfolios. It's much more comfortable, very unique, second piece that's extremely unique to us. Of course, we have tremendous efficacy in our products. But the most amazing piece of it is that we make it so easy for you to pick us because we'll manage the solution for you. We're hyper automated. But even with that, if you want to completely turnkey out, we will actually do the management of the solution. That's tremendously different. Nobody else offers that solution in the marketplace. And then the third piece of it is that we're software only. So there's no other solution in the marketplace that's software only. Why is that important to a company? The company, as they decide to make different decisions, move from the cloud, move maybe their product, maybe evolve their product, acquire some new businesses, move data centers and so forth. They want the extensibility to be able to embed the capability in their solution sets. And if you're selling the product, if you're reselling our capability, you want the ability to extend it to your customers. Nobody else can do this. So those 3 things are really powerful to our customer sets, really set us apart, and it provides for tremendous technical and operational challenges to our competition.

Michelle Ragusa-McBain

executive
#20

And might I add is also the innovation that we continue to have for cyber resiliency to build out the platform. So it's not just a point product, but the continued investment in research and development on the solution.

Carl Herberger

executive
#21

100%. We can go on. Another major differentiator is that if you're a customer of Juniper, HPE networks, you're a customer of Akamai, you're a customer of GTT. By the way, these are mammoth organizations in technology. We make those solutions better, and we're the only ones that can do that in DDoS. So that's a massive differentiator.

Chris Goulden

executive
#22

Okay. Next question then. Who are your largest channel partners? And are you continuing to prioritize the expansion of your partner network?

Michelle Ragusa-McBain

executive
#23

Yes. Well, Carl just hit on some of our key alliances strategically are obviously HPE, Juniper, Akamai and GTT. Beyond that, we're continuing to have conversations with other major alliances where they lack DDoS protection in the way that we are able to deliver it and how we can help supplement or complement their solutions. So continued investment in those partnerships is very important to our growth. Beyond that is the channel partners that we work with. And there's various partners that I can name, but WWT, ePlus, some of the biggest and broadest names that are globally recognized are currently partnering with us, and we're continuing to onboard very strategically and intentionally partners that make sense for us to continue to drive development with the ideal customers in every industry and vertical, not just in the telco service provider route to market, but also in the mid-market to enterprise route to markets.

Chris Goulden

executive
#24

Okay. Next then, how do you plan to leverage AI to accelerate product development whilst also reducing costs?

Carl Herberger

executive
#25

Do you want me to take that? Yes, sure. AI has been -- we've been an early adopter of AI and an aggressive adopter. One of the added benefits of being a software-only company is that when AI has the ability to accelerate your software development life cycle and add more quality to your software development, we get to enable that faster than companies that are on platforms such as CDNs or cloud or they're focused on hardware with unique chipsets that AI won't factor into nicely. So we've been, for example, on agentic AI for now over 2 years. And it's led to tremendous obvious quantitative advantages. Our R&D spend has not dramatically increased, yet we've had 6 new product launches last year, the most ever in our company. We've expanded from a single product to over 7 products in the portfolio, and that's all because of the enablement of AI and doing more with functionally less.

Chris Goulden

executive
#26

Great. Thanks, Carl. Next question then, how much of growth came from new sales versus expansion and upselling with existing customers? I guess I'll take that one. So typically, what we see is of our bookings number, roughly 25% of that comes from renewals. Renewals obviously being very key to us for revenue continuation and obviously supported by the 98% retention that we have. Now of the remaining 75%, we typically see a 50-50 split between new customers and add-ons. And that sounds like quite maybe a low portion of new business versus add-ons. But in this -- in our customer space, in the service provider world, the growth in that sphere is huge and the growth of traffic across their network and across the Internet continues to expand. So a significant portion of our growth each year comes from the growth of our customers, and I'm really pleased with that. It kind of adds the importance to the 98% customer retention because we're not just retaining the revenue, but we're retaining the opportunity to add on and expand with those customers at the same time. Okay. So the next question, bear with me, it's quite a long one. In the outlook, you referenced that Q1 2026 has been significantly ahead of Q1 2025. But of course, early 2025 was a period of change in customer spend patterns and H1 2025 revenues were down 10%. Could you please comment on how early 2026 has started with reference to the level of revenue growth seen in H2 2025 when revenues increased by 18% year-over-year? I'll let you give some flavor to it, but we haven't closed the quarter yet. So we haven't issued any results on Q1. But what I can say is the momentum that we've taken from the sales growth in the second half of last year definitely showed itself in the pipeline coming into H1 and the conversion of that pipeline has been strong. So we're very comfortable and confident in that growth continuation, not just in Q1 2026, but across the year.

Carl Herberger

executive
#27

Yes. I would echo that. We have renewed optimism in the quarter and in the half based upon the same sort of momentum that we were seeing in the second half of last year. Of course, there's still a lot of pipeline to be executed on, and the proof is always in the British pudding. But we feel that we don't have the same kind of situation that we had last year, this period.

Chris Goulden

executive
#28

So next question, can you comment on how the enterprise opportunities are looking after the major financial institution win in 2025? Now this looks to be referring to the announcement we made midyear about a European bank deal that we secured through our partner -- our alliance partner, Akamai.

Carl Herberger

executive
#29

Yes. We've taken on a number of newer enterprise projects, but not at the same dollar amounts or same scale, regional utilities, government entities and so forth in the U.S. and otherwise. And we continue to pervade and make our way in that case. Pipeline is filling opportunities in names that are kitchen table and table stake kind of companies have approached us, and we're going through some proof of concepts as we speak. So we feel strong that, that addressable market, which is net new to Corero is becoming quite readily available to us. So we remain incredibly optimistic on that and believe that our competitiveness, especially with our new encrypted traffic capability is becoming a formidable competitive differentiator.

Chris Goulden

executive
#30

Next question then. Your global diversification is impressive. Can you explain how you've achieved this growth?

Carl Herberger

executive
#31

Yes. Some of this has to do with the fact that we have essentially changed the tires and a lot of our selling processes over the last 2.5 years, where most of the existing sales team comes from competitors and comes from regions that they were selling in those regions, these kinds of products for competitors in the past. So essentially, they knew their routes to market, they knew the customers, they knew the budgets, they knew the local customs and the local currencies, and they have decided to join Corero because of the story, the story on the product, the story and unique differentiation, the story how competitive we can be, and they've essentially taken our products to market. We've done this in the Middle East. We've done this in Brazil. We've done this in South APAC, Australia, increasingly, Australia and New Zealand. Now we take it to Continental Europe as we move into 2026. And of course, we're continuing to do a yeoman's job in both the U.S. and the U.K., which is our heritage.

Michelle Ragusa-McBain

executive
#32

And might I add to that also, the diversification of -- as I build out our team in the partner and alliance community, we'll have more direct liaison into additional partners that can expand the brand and scope and reach of where we're in 50 countries today, but continuing to drive and penetrate global markets.

Carl Herberger

executive
#33

We still have plenty of opportunity before us to go into other markets where we're not materially in today, for example, Japan or South Korea are still large markets, which we don't participate with local customs and courtesy personnel, but this is an opportunity for the future.

Chris Goulden

executive
#34

Okay. Another long one here. Another European security software provider recently noted a change in attitude among EU customers to favor purchasing IT security solutions from EU-based providers and reduce dependence on U.S. tech companies for such vital services in recognition of the evolving geopolitical landscape. Is this something you're seeing? If so, how would this affect Corero?

Carl Herberger

executive
#35

100%, we see this. We don't just see this in the EU. We see this essentially this sovereignty sentiment everywhere we go. I'll give you an example real quickly. We just won a deal in Turkey for a large telco provider there. And in Turkey, they had 4 solutions that they were evaluating inclusive of our solution. The solutions ironically were represented for different flag nations, one in the U.S., of course, one in Israel, of course, one in China, of course, and one in the U.K. represented by Corero. In Turkey, the American and the Israeli solution were primarily not politically available to them. And the Chinese solution quickly fell off for reasons. And the U.K. solution is considered to be more or less a neutral solution set in this world of sovereign selections. So essentially, our solution competes with solutions from essentially 4 geographies and your election is either U.K., U.S., Israel or China. And often, we now in that selection criteria alone are the resounding favorite.

Chris Goulden

executive
#36

Okay. Last question then. Do you see the recent geopolitical changes, Middle East, et cetera, to be a net positive? Cyber-attacks are clearly rising, but is there any hesitancy in purchasing decisions being seen?

Carl Herberger

executive
#37

Do you want to take that?

Chris Goulden

executive
#38

Yes. I think we maybe had that worry given that that's what happened to us last year with the uncertainty, particularly on the U.S. tariffs. We haven't seen that so far in Q1 in 2026. Now that might be the purchasing decisions have been made ahead of recent changes in the geopolitical landscape. We're clearly seeing more opportunity. One of the things that we are seeing in that particular region with what's going on is we are seeing an increase in attack vectors coming out of that region towards Europe, towards the U.S. So there's demand coming our way from customers who are seeing an increase in the threat landscape. Equally in region, I think a few of the analysts will point out that the Middle East is the largest growing region in the world in terms of cybersecurity spend. We are seeing that from a pipeline perspective. We are still seeing that in terms of the opportunities we're working on. At this stage, we haven't seen any delay either in that region or globally related to the current geopolitical landscape. But I guess it's quite early in that scenario. So that's not to say that, that won't change in the coming months. We just haven't seen that yet.

Michelle Ragusa-McBain

executive
#39

And to add upon that is my recent conversations with partners are seeing not only due to the increase of the attack vectors and the need, but there's a definite need for more protection and sovereign security on-premises that is changing the landscape more frequently.

Carl Herberger

executive
#40

One of the things that's happened with the most recent attacks, and I don't know if it's made mind share to many people, but in the first salvo of the physical attacks on Iran, when Iran counterattacked, their first target sets were -- among them were Amazon's data centers and regions. Now people, I guess, are coming to understand that even the cloud at the end of the day, resides in a data center. So this idea that the cloud can be bombed is a net new idea and is accelerating the idea that premise-based solutions and local and sovereign solutions have to have all sorts of protection sets, not just cloud protection sets.

Chris Goulden

executive
#41

Thank you for answering that, Carl. And so I hand back to you Mark.

Operator

operator
#42

That's great. Carl, Chris, thank you so much for taking those questions, and thank you to everybody for your engagement this afternoon once again. Carl, I know investor feedback is particularly important to you and to the team. I'll shortly redirect those on the call to give you their feedback. But before doing so, I wondered if I may just ask you for a couple of closing comments, and then I'll say, redirect investors.

Carl Herberger

executive
#43

Sure. I just want to thank you again for the interest in Corero and for what we're doing. For a cybersecurity company now that we've reached mid-$20s million in terms of recurring revenue growing at 20% a year, we feel strong and encouraged that, that gives us both the wind at our back and the ability to invest in the business. And from my perspective, 2.5 years in the business, has never been a better time to come to Corero and to see what we got going.

Operator

operator
#44

That's great. Chris, Carl, thanks once again. If I could please ask investors not to close this session as we'll now automatically redirect you for the opportunity to provide your feedback in order the company can better understand your views and expectations. It will take a couple of moments to complete, which will be greatly valued by the company. On behalf of the management team of Corero, I'd like to thank you for attending today's presentation. Good afternoon to you all.

This call discussed

For developers and AI pipelines

Programmatic access to Corero Network Security plc earnings transcripts and 32,000+ others is available through the EarningsCalls.dev REST API. Plans from $24.99/month — full transcripts, speaker segments, full-text search, and the recently-added /api/v1/transcripts/recent polling endpoint for ETL pipelines.