F-Secure Oyj (FSECURE) Earnings Call Transcript & Summary

A warm welcome, everybody, to F-Secure's quarter 1 interim results session, both here in the room as well as everybody else who are attending the session online. Straight into the summary of the quarter. So our revenue grew by 2%. Still during quarter 1, the U.S. dollar exchange rate was clearly favorable. Towards the end of March, that started changing. And naturally, we've seen in April that it's been quite different from what we've been experiencing in the past couple of years as dollar has been weakening. But with regards to quarter 1, it was still favorable to us as we're a very heavily Euro-focused company. Profitability exceeded our expectations. That was good. We forged new partnerships, one partnership in the Nordics, which is completely new. And then in Central Europe, Orange, that I'll talk a bit more about later. And then we had a few number -- a small number of partners who enhanced their contracts. Typically our contracts are in the range of 3 to 5 years, and those came up for renewal, and they renewed, and not only renewed, they expanded the scope with F-Secure. In terms of quarter 1 and Embedded, clear developments once again on AI-powered scam detection specifically, more about that a bit later. Our new organization is now in place. At the end of '24, we ran change negotiations to go for a more customer-centric operational model and organizational structure. That's now in place and fully operational. And then I would say that with regards to AI, we've gone forward in leaps and bounds in quarter 1 all across the company in every single function in practically everything we do. Like many companies, we are still in the early phase of thorough AI-native solutions and processes across the company, but we have really made excellent strides in the first quarter. So that's just a quick snapshot. I'll then dig into a bit more detail. So these are the main themes that we are focusing on with regards to our strategy in '25. First of all, we want to continue to transform as a company to accelerate our growth. Secondly, we definitely want to claim a leadership position in scam protection. And thirdly, we are driving innovation and also productivity and quality gains through use of data and AI. If I start from the left, there's a whole number of big names there. Some of them we serve today. Many of them we don't yet serve. But that's, in a way, our hit list of who we are after in terms of transformative growth. So these are the primary targets that we're going for. And we see that every single one of them, as we've mentioned before, should have the potential of generating EUR 8 million per year or more once fully operational, which may take a few years from launch or which may come faster in case they migrate existing user bases to F-Secure protection solutions. But that's crucial. Secondly, I joined F-Secure 12 years ago. And at that time and already before that for some 10 years or so, the big thing in consumer cyber security was all about antivirus. Since then, we've had some pockets of the consumer security market that have been growing, like VPN solutions, password management solutions, router security and so forth. But now we see that with scam protection for the first time we're seeing a massive new development that is presenting itself as a market opportunity to all of the players, top of mind for consumers, something that people are experiencing practically every day. So the awareness of the need for something like scam protection is now much more pronounced than it was before. Also, in terms of the threat landscape out there, this technological landscape, the criminal activity and the protections needed for scam protection are also evolving at a fast pace. So when you want to go after growth, a new, let's say, potentially significant space is a good one to be in. That's why we're aiming for #1 position over there. And finally, AI and data-powered F-Secure, that's what we are envisioning. I'll talk a bit more about that later, but I can only say that I've been in technology business for quite some time. And I have never seen anything develop at the same pace as I'm seeing AI develop right now. The fundamental technologies, their capabilities, their scalability, the kind of, in a way, how far you can go in terms of AI power, just in 6 months, it's going forward at a breakneck speed. And we intend to lead with AI, not adapt to AI. So first of all, about transforming to accelerate our growth. So during this quarter, as you can see on the left there, we had 3 partners going fully commercially live with our services, SoftBank with a service where identity protection from F-Secure forms part of the solution. AT&T went out with ActiveArmor 2.0, which is the next-generation version of their ActiveArmor application that we developed for them. And then thirdly, anonymous partner who has gone out with an identity protection service now in quarter 1. These 2 services, AT&T, ActiveArmor and the identity protection service launch, they haven't been yet as actively promoted by our service provider partners as we would want to see, but we are working actively with them to make sure that they also put their body behind these new services. On the new partnership front, we signed up as we sent out a release some 5 days ago. We signed up Orange Group, and they have roughly or precisely 3 different geographies that they serve; Orange Europe, France, and Middle East and Africa. And for the first, the European operating companies, 7 or 8 of them are very keen to start rolling out F-Secure services. And in this case, it is a strategic partner who's working with Total, not with embedded security at this point in time. Embedded security is something which may be an expansion in the future. One has to keep in mind that if you want to provide holistic solution to consumers, Total secures laptops and mobile devices, whereas embedded serves only mobile devices. So Orange has decided to go for the most holistic solution to begin with and potentially complement that with embedded in the future remains to be seen. But massive group, absolutely one of the top ones in Europe. And this is the first group-wide contract that we now have with a strategic partner or Tier 1 partner. Big step for us. Around end of quarter 3 is when we expect the first country or countries from Orange Group to go live with Total. Then the second area of our focus areas in 2025 is scam protection. So beginning of the year, we launched something we call Scam Kill Chain, which is a framework which has been used in enterprise security already for quite some time to analyze the criminal behavior and the steps they take in their attacks. We have now transposed this methodology to cover how criminals are attacking consumers. How do they go about the kill chain? What kind of steps do they go through to create trust and to get people to fall for scams? And how does the scam then become a reality? How are they going after typically your money? So we have now created a methodical framework for understanding how these attacks happen so that we can then come up with the industry's best detection and protection capabilities to stop scams. Secondly, we won the coveted AV-TEST award once again, which is naturally proof to the fact that our product does what it says on the tin. It does protect and it does so very effectively. Then with regards to our SMS scam protection in quarter 1, roughly 450,000 messaging scams were prevented with over 10,000 in some of the peak days of messages that were blocked. So this is a real threat happening out there, and this is a real protection against those threats. Then with regards to the enterprise security world, the holy book of enterprise security in terms of data breaches and what's going on in terms of criminal activity in the cyber space is the Verizon Data Breach Investigations Report. And our research for the first time contributed to this very prestigious report. And finally, in terms of embedded security, we have developed new capabilities, especially to stop crypto mining activities, so we can both identify and block malicious cryptojacking activities, which are very common now in North America comparatively with other regions, but not only there. So especially in North America, where we are actually working naturally actively to expand our footprint, this has been very much in demand. So that's just one example of what we've added now in quarter 1. So here is the award for AV-TEST, test protection. And then here is the Data Breach Report coming from Verizon. With regards to utilizing data and AI, so over 25% of our workforce are already using Claude, which is our choice over ChatGPT as the standard tool. Over 25% of our workforce are already using it daily in their work. And at a staggering 20% to 25% growth weekly, we are seeing the usage growing from its current level. We are building in every single new protection capability that we're coming out with. There is an AI engine underneath, and that's going to be not only the case for protecting our customers, but we're also seeing in our engineering and technology that we are using AI now to enhance the entire software life cycle, speeding up deployment, improving quality. For example, one of our new deliverables that we created during the first quarter, the whole quality process was run end-to-end using AI tools faster and reliably. So this is definitely something that not only has to do with protection, but also our capability to run a more agile and nimble organization. And then overall, operational efficiency, we are busy reimagining our customer care function powered by AI. And also with regards to our people and culture, we already have tools that we have been developing for career planning and hiring, which are fully AI-powered. So many of our functions, our legal has been running AI services for a long time already. Our marketing is generating deliverables, videos, content, campaigns based on AI already today since the end of last year. So boosting efficiency, service quality, innovation and naturally also eliminating some mundane tasks that we all have in our work. So this is taking on, I would say, like a wildfire right now. That's all from me. I will now hand over to Sari Somerkallio, our Chief Financial Officer.

Thank you, and good afternoon to everybody. Let's look into the numbers and start with a new slide. Happy to show you something that we have not had before. So starting with the partner channel revenue, we have now split the revenue into Embedded and Security Suite. In our strategy, we talk about this, we refer even to the profitability of these. And earlier, we have not quantified the size of the business. What we have here in Embedded, I think from our references, you know AT&T and DOCOMO have embedded services and [sense] businesses in there and then a number of smaller partners. But just to get a picture of what we have in there. If we start with the Security Suite, growth of 2.9%. This is like okay number considering that we still have this in Germany, there is a customer who is clearly showing negative numbers and which is in hundreds of thousands the size in this one quarter only. So the trend continues that we've seen already in the past. But there are many positives in Security Suite. Total conversion continues to develop nicely and thus the ARPU is increasing in that channel. Poland, which has been negative for years, all this time that I've worked in the company, we have talked about challenges there. So now this was the first quarter that it was clearly positive after a couple of flattish quarters. And Switzerland was positive in this month and in the Nordics, especially Sweden, continues a very nice development. Then on Embedded side, we have mentioned in several places in the report is EUR 300,000 one-off correcting an earlier revenue recognition mistake. So on the group level, annual level, EUR 300,000 is not a lot. But in the one quarter embedded numbers and in the Japan numbers, it is a significant one. So that's why we have highlighted it. So even if now Embedded is minus 0.3%. So without this mistake, it would be positive 5.4%. And of course, it's important for us that this continues to grow and also in Japan, where we have said that we have historically had a good performance. So that underlying good performance continues, even though due to this mistake, it's not visible. Then if we look at the Direct channel revenue, so slightly positive, which is good considering that we have continued this strategy of not doing any paid customer acquisition. The positive development is mainly thanks to previous better quarters. In general, we can say that ARPU is growing. Renewal rates are high. So there is good development, but with this strategy, so new customer acquisition. So even if we have assumed that it's not going to be great. So that's the area where we hope that we can still improve. But considering the strategy, an okay result. And then looking at the full revenue, so we have the 2% growth, like Timo said, so helped by FX underlying is plus 0.5%. And again, considering that it would have been better with this -- without the EUR 300,000 correction. And in the geographies, like mentioned, so Nordic countries is already on this mid-single-digit rate, which is the target for us this year and Sweden is a driver there. And rest of Europe is burdened by this development in Germany and others are then much more positive. And North America supported by dollar in this quarter. And if world continues like it is today, so it will turn the other way around in the following quarters. And Rest of World, again, burdened by the correction. Otherwise, continuing on good track. Looking at the cost side. So OpEx is slightly lower than corresponding quarter last year. And this is thanks to those change negotiations. We got savings in this area. Overall, during the change negotiations, we said that there will not be savings because we are reinvesting, but there is a slight timing difference. So we've been filling the new positions during the quarter. So not like full load yet in the first quarter. And the CapEx level was a little bit lower in this quarter than last year at the same time. But overall, our guidance remains that similar levels of CapEx on full year level can be expected even if the Q1 level was similar. In terms of profitability, gross margin, similar ballpark as last year during this time, no big changes as there has not been any major changes in the business mix of what kind of products we've been selling. And the overall profitability then in terms of adjusted EBITDA, it is higher than last year, thanks to the lower OpEx level. So we can say that this -- in terms of profitability, this was a good quarter. In terms of cash flow, similar cash flow -- cash conversion as last year, slightly better, also a little bit better cash flow as the CapEx was lower in this quarter. But I think no drama here. Equity ratio continues to improve. Of course, it was still very low last year at the same time. And our guidance for this year remains the same. So we see that this is the lowest growth quarter, and it should accelerate to get to this mid-single digit for the full year. And otherwise, no changes here. So thank you, and we are happy to answer any questions with Timo here.

Waltteri Rossi from Danske Bank. What's your currency exchange rate assumptions behind the guidance given earlier this year? And what I'm trying to get at is what the headwinds is going to look like for the rest of the year?

Yes. I think when we made the budget, USD was around $1.05. But of course, this is still a view that is valid with today's rates.

All right. Thank you. Then, what caused the profits to exceed your expectations in Q1? Was it only the still ongoing recruitments? And in a way, should we expect the OpEx to increase slightly from Q1 for the rest of the year?

Yes. Yes. As I said, so in -- after the changes in the organization, so a number of jobs were cut and we got the savings, but we also added new positions, and we've been filling them, but it's not been full during Q1. So we expect it to grow from Q1. And maybe still when -- of course, when we gave the guidance in early February, we knew a lot already, but, of course, all the recruitments were not completed. Salary costs are a big part of our cost. So of course there are always timings and -- but yes, we can say that it was a good quarter.

All right. One last question regarding the new Nordic partner you announced. What's the revenue potential there? And when should we expect to see that start generating revenues?

So the service is going live at the end of June, and it will start piling up month by month from nothing. So still a mystery how much that will generate, but it is one of our major partner, business unit partners. So that shows that it should be -- once it's fully ramped up, it should be a high 6-digit number, if not a 7-digit number.

Atte Riikola from Inderes. Let's continue on the partner side and the new Orange partnership. So can you say anything about what kind of expectations you have for that for the coming years? And are you basically starting from the scratch? Or are you replacing some existing cyber security vendor on Orange?

Both. So what we know for sure is that there are countries which do not have an existing base to migrate, and there are some where such an opportunity is existing. And Orange is still taking their own time in considering if they will only provide F-Secure to new customers in the places where they already have a security service available or if they will go and migrate all of them. So certainty on the fact that we will have several countries joining who will be starting gradual growth. And then it depends on Orange's own go-to-market decisions country by country where they might migrate.

Maybe I can continue a little bit. So Orange is a company with many country organizations. So it is entity by entity that we need to do things. And that's why there is always timing uncertainty. And of course, we try to do faster, but it's not only in our hands. But obviously, this is one of these reasons why we expect the growth to accelerate towards the year-end. So of course, we have expectations.

Yes. Our expectation currently is that first 2 countries are live this year, both sizable countries.

Okay. And do you need to make any new technological investments for this Orange partnership? I think some earlier Tier 1s have required some investment.

Yes. So as a difference to other Tier 1 partners, this one is based on Total. So with regards to the product, no significant changes from that point of view. We will get an additional threat feed from -- around cyber defense, which is an integration we will need to do, but that's a good one. It's going to be improving the rate of detections as there is another threat feed coming into our cloud. So that's the only thing that I can think off the cuff.

All right. And then if you look at the underlying growth in Embedded Security in Q1, it was like 5%. If you exclude that one-off, was there already some impact from the SoftBank and AT&T service ramp-up?

Very little at this time. So that was very early on still. So I would say that minimum impact at this point in time.

Okay. And last question for the full year growth guidance, I think you mentioned earlier that like your growth is split between half and half to Embedded and Total. So is that assumption still correct?

I think it is fair. Of course, it is approximately that, yes, both need to grow and both are expected to grow.

It's Matti Riikonen, Carnegie. A couple of questions. Maybe first of all, the Embedded top line, it did grow, excluding the EUR 0.3 million, but it was still a fairly low growth rate. Were you kind of happy with it? Because I was thinking that since you were starting with some fairly new deals, they would start to accumulate revenue a bit faster. Was that kind of what you expected? Should we expect an acceleration towards the end of the year?

We expected more. No 2 ways about it. We expect it more, not massively, but some. And we need to work very actively with our Tier 1 partners to make sure that their whole commercial engine and go-to-market machine is actually doing an effective work in taking the good product out that they have built together with us. So there's always the product and service development side, and then there is the go-to-market engine. So we need to do much more work on that side now that the product is available. So we fell short of our own expectations slightly, but a strong focus area for us.

It is very much a question of these ramp-up times. So there was this one partner with basically a soft launch in December and where we basically start from 0. So first months have been slow and marketing has kicked in only later on. So also one of those where we expect more growth later on.

So with regards to product split, we clearly percentage-wise are looking forward to much higher percentage growth in Embedded as in Security Suite and strategic partners or Tier 1s than others. But growth, we are expecting everywhere.

Right. Then about the EUR 0.3 million, was that kind of evenly distributed the mistake in previous quarters? Or was it isolated in some particular quarter? I'm just trying to get the comparison right.

Yes. It is actually something that happened already in year '23 in 1 quarter. And we noticed the mistake, and it was corrected now in 1 quarter because from the overall group point of view, it's not so significant that we would do a restatement or anything like that. But it was a long time ago, one-time mistake.

It was an error over 2 months. That's it.

Right. So basically, all quarters except Q1 in '24 are comparable.

Yes. Yes.

All right. That's good. Then a bit more on this Orange deal. So what does exactly the strategic partnership mean other than it's big?

It means for us that we see that when we deliver to the full potential of the partnership and they are working actively together with us, we can get to EUR 8 million or more per year revenue. That's what it means for us. And we see that possibility there.

Right. But it doesn't include any exclusivity from Orange's part with you? Or is it just -- is it an exclusive deal?

Now that question should be potentially posed to Orange, not my position to say so. What I do know is that CSPs or communication service providers typically work with one partner for one area of solution because it's hard to manage a number of different vendors or different partners. So they want to minimize the number. They may have complementary partners to do different things. But in one area, typically they work with one. You could call it exclusivity, but it's not anything on paper, naturally, from their point of view. They want to keep their options open.

More preference.

Yes, it is their preference.

Right. And your basic expectation is that if and when they would go to embedded services, then you would have the privilege to be the service partner also in there? Orange starts to do embedded services, you would be the only one providing them.

Yes. Yes. I am absolutely certain that any good large enterprise actually opens up anything like that for competition. But I would say that, as they say in baseball, we would have the first bat. We would be first stepping up to the plate and having a whack at the ball. I think we would have a clear, clear opportunity, potentially, over others. But naturally Orange would still evaluate other options.

Sure. Then finally, to Sari, what do you think that we should expect of your cost accumulation in 2025? Now Q1 was clearly kind of a better-than-expected quarter in terms of lower cost. But when you go into these deals, does it mean that you will incur more operating costs just to get the launches done and others? So do you think that when your activity with the large customers increases, does it also increase your costs? Or have you already kind of put in the cost for those that you plan to need?

Yes. Of course, in our own plans, top line and the cost required to deliver that revenue, so is included. Projects, of course, always delivery projects take some resources, but we also have quite a big team of those. And for some big cases, if there are some timing differences, we might need to increase. But mostly it's included. And I think the main change is in how we now ramp up based on the future development that we want to do in terms of AI and new products and so on. And also then the CapEx, there is always some phasing. So it's not same every month. And CapEx also can be a function of what kind of deliveries we do to the customers that if it's something that we can reuse and or it's like -- clearly, this is a product for a certain purpose and lifetime. So then we do those as CapEx. And it's not always like decided when we, for example, do the budget. So some changes.

So I would add to that one. There are different kinds of cases that we're working on, on the Tier 1 side. Some of them are banking fully on the kind of embedded security portfolio we already have. And then working with that base, our incremental cost additional is absolutely minimal, like Sari says, included already. And then there are some where we may see that there is a massive user base that we might be able to migrate from day 1, then we're willing to invest more into that if there is a requirement to do so. So against certain money, we may be very happy to invest more. So there are those options that we want to keep open. I think that with regards to the assets that we now have and the skills that we've built in the last 1.5 years roughly, we're already in a really good position, but we want to keep the option open to even invest more if there is guaranteed money.

And is it so that your guidance, which was basically for flat margins in '25 based on the idea that you would perhaps need to invest more if certain embedded deals would surface on your plate and then you would have to meet the challenge?

We want to keep that option open. And if and when such deals would happen, we would definitely tell you and the market about what kind of effect that may have on our finances.

Yes. And also during '24, we ramped up our cost when we were getting prepared for taking care of Tier 1 partners. So if you like multiply the Q4 cost, it's higher than '24 was. So already that was included, that we've already like improved our capabilities, which comes with the cost.

Right. So basically, we should be assuming that the fixed cost in Q1 is a good base for fixed cost in the next quarter unless then you end up in a situation where it's kind of positive phase.

I think we said that we have not ramped up everything yet in Q1. So it might be that it's a bit higher than Q1. Q1 was still low cost.

All right. Then finally, I think you mentioned only Germany as the European countries that where top line declined. So was that really the only one?

Of course, we are not separating every declining customer. So you always have those who grow fast and grow a bit and who are flat or maybe a small decline. Earlier we have referred to Germany and U.K., where we've had like challenges that are like beyond a normal declining customer because they have been big and declining fast. Now this Germany case is so much bigger than the U.K., we didn't include that in the commentary. So but of course, it doesn't mean that it's the only one. There is always a range of development within the customer base.

Waltteri Rossi, Danske Bank. Follow-up question on the currencies. So the Euro-USD rate was $1.05, as you said, when you gave the guidance, but now it's $1.14, right? So should I understand that the unchanged guidance today is still based on the $1.05 and the guidance is -- it's not currency adjusted, right?

No. So $1.05 was when we made the budget. But actually, when we gave the guidance, it was probably $1.04 or even lower because it was in the early parts of this year. The guidance is given as reported. It's not currency neutral. So it is valid even with today's FX. Valid until we tell something else. But yes, it's not currency-neutral, but it's as reported.

Okay. Thank you, audience here in the room. And next, we'll take couple of questions from the online audience. "So you have previously said that couple of customers continues to see their own customer base churning. Was the impact of this on a similar level than seen in 2024? Or has the customers' churn accelerated?

Yes. Well, we already briefly discussed this topic, and we have not given any specific numbers. Earlier we talked about Germany and U.K., and now U.K. was not on the list because it's small -- so much smaller than Germany and getting smaller. The decline is a bit less than in '24, but it is still significant numbers. And as I said, I can say Q1 was 100, and I will not tell more. Let's say, it's more than 200 and less than 1 million.

Thank you. The next, a bit similar, that, "You mentioned that some partners have not been selling your products to the end customers as fast or as well as you expected. What concrete actions? And how well are you able to effect on that?

Okay. So this is actually a relatively complex response. I'll try to be brief. So the main thing is that we need to engage -- so when we are typically engaging with communication service providers, our engagement is mostly towards the people who are defining the offering of a service provider, the ones who develop it and who manage it. Now we need to extend our engagements in these partnerships, which are big companies, practically almost like a separate company within a company with the sales and marketing focused organizations. That's what we need to do. And work alongside them the very same way as we do with our long served partners in the major partner section, the KPNs and Swisscoms and Elisas and so forth. We are very used to working side-by-side with their sales and marketing and go-to-market organizations to help them define propositions, messaging, build campaigns, drive sales incentives and so forth. And now we need to activate similar kind of activity also with strategic partners or Tier 1s, which we have not traditionally done before.

Thank you. And the final question regarding threat feeds. "So do those threat feeds that you mentioned play a big role in your competitiveness? Meaning, how much of a competitive edge do you really get when you get more and more threat feeds imported when starting to work with new big CSPs?

So the changes are relatively incremental. So they are not, in a way, massive, but they make a difference. So for instance, for Orange, they have a massive unit focusing on cyber defense, and they have worked over the years to build a very strong threat feed, which they believe adds value to what we already do. So from that perspective, Orange clearly sees that there is benefit from this. Maybe it is a few percent points, but that can make a difference between a successful attack and protected attack.

Thank you. So any further questions here in Helsinki? That was all from the online…

Now when you split up the sales with Embedded and the Total business, can you say anything about the gross margins of those separate businesses? Or should we just make some own assumptions?

Yes. I think there we still continue with the old world, that you need to make your own assumptions. But like we have said that Embedded has lower margins. And it's because some of the work is put to the partner side and also pricing is different because of that and because it's bigger volumes, so we can accept a lower price. So a combination of those. But now as we've been talking about this relationship, so now you at least have one more data point.

Logical question.

That's all.

Okay. Thank you very much. I hope this was informative and helpful to you with regards to understanding better once again how far we've come in driving our -- both financial -- towards our financial targets as well as our strategic targets. So thank you, everybody, for attending, and we hope to see you once again latest in July when we go out with our quarter 2 interim report. Thank you.

Thank you.