NCC Group plc (NCC.L) Earnings Call Transcript & Summary

Hello. I'm Mike Maddison, CEO of NCC Group. And along with my colleague, Guy Ellis, the CFO, we are pleased to bring you our full year results for 30 September 2025 in this presentation. I want to start with some important points. First of all, as predicted, this was a year of 2 halves. We had a challenging first half, as we talked about at our interims on the 19th of June. But as highlighted in our trading update in October, we saw improved performance in the second half. Overall, the results are in line with the Board's expectations and good strategic progress is being made across both the Cyber and the Escode businesses. As a reminder, we have 2 reviews in progress. The Escode review and the strategic review of the Cyber Security business, which is independent from both the process and the outcome of the Escode review. Regardless of the outcome of the Escode review and as announced in our October trading update, we will launch the initial share buyback program once the Escode review concludes. Now I know you'll have lots of questions, but as a reminder, NCC Group remains in an offer period under the Takeover Code rules. This does restrict what we can say about current trading and the financial outlook for the group. So with that context, let me give you an overview of our 2 businesses in FY '25. For those unfamiliar with the business, let me first provide you with an overview of who NCC Group is. Our strategy recognizes and reflects that we have 2 distinct businesses, both operate with the goal of providing increased operational resilience. And while there is some overlap in clients, the buyers and buying cycles are fundamentally different. Both our businesses provide services to clients where we are a trusted partner. And by that, I mean, we support a significant client base at both the enterprise and SME level, and it's in every sector and with a global footprint. We bring deep skills that address compliance issues and/or provide solutions to build Cyber resilience. Both of our businesses have multiple growth drivers. In Cyber Security, this relates to the ever-increasing threat landscape, digital adoption and the shortage of necessary skills to meet these evolving client needs. In Escode, the drivers are linked to regulatory requirements, particularly in the critical infrastructure arena. Our group retains strong financials with an increased mix of recurring revenues and importantly, an improved balance sheet, which gives us increased optionality. And I'm delighted that our Escode business has now delivered 12 consecutive quarters of growth. So let me give you some color on each of the businesses in FY '25. Firstly, let me talk about Escode. The Escode business continues to perform consistently, and I think I've already mentioned this. Delighted to say that we've delivered 12 consecutive quarters of growth. We've continued to execute on our plan for this business consistently. Highlights include: we've reorganized the sales structure by industry verticals to deliver deeper sector expertise, create greater value for customers in finance, critical infrastructure and commercial markets. We've been establishing a new customer acquisition team focused on ideal customer profiles within our growth sectors in the U.K. and also the U.S. market. We've seen an expansion of our software verification offering to include fully independent builds of cloud-hosted solutions, ensuring greater reliability and trust. And we've been broadening our regional presence with an extended focus into the Middle East, which we've highlighted previously. Let me give you the highlights for the Cyber Security business in FY '25. While the economic conditions are doing us no favors, as I said, this year was 1 of 2 halves. It's worth noting that our Technical Assurance Services is intrinsically linked to economic conditions. And as a result, customer buying reflects the economic cycle. Despite this, and as Guy will talk to in more detail in his section, we've made good progress against our strategy in FY '25, and it continued very much in line with the areas we highlighted in June at our trading update. So those key highlights. We've had investment in strategic sales capability to build deeper relationships in each of our markets. For example, we put in place market leadership with experience of strategic consultative selling. We've launched client propositions with embedded technology at their heart. For example, our Continuous Offensive Security service was launched, highlighting our emphasis on moving to increased subscription services as part of our strategy to increase ARR and to build longer-term, more strategic engagements with our clients. The investments we made in consulting and implementation services, in particular, operation technology and information technology convergence and identity and digital access management is generating value, which Guy again will highlight in the financials. We've put the foundations in place for an enhanced global account management approach, which will deepen relationships and unlock revenue opportunities. And I really want to emphasize this point. We've put in place a global sales operation capability, and we've improved our management information. This enabled us to highlight the positive deal quote creation trajectory in December 2024, which turned into sales and then into revenue in the second half. This allowed us to make informed decisions on balancing supply and demand in January as we were confident in the forward look. We've now also fully implemented global scheduling, time sheets and pricing tools, which is a significant cultural shift within NCC Group. We've also completed the DetACT and Fox Crypto sales, fully separating those businesses and the operational efficiencies that come with it. Now I'm now going to hand over to Guy to bring to life some of these points through the financials, and I'll then talk a little bit more about our strategy and our future focus. Guy, over to you.

Thank you, Mike. Hello, everyone. I want to spend a few minutes to walk through the highlights of the group and both businesses in a bit more detail, linking the outcomes in Mike's strategy and commercial activities through into our financial performance. So this slide here shows our financial key highlights of the business, excluding Fox Crypto, which we divested on the 31st of March, so you can see the underlying performance of the focused Cyber and Escode Group. Revenue declined by 2.6%, and that's GBP 11.3 million on a like-for-like basis. Escode continued in growth and Cyber delivered a better performance as we expected in the second half of the year. Gross margin for the group expanded by 0.6 percentage points up year-on-year. That was as a result of Escode stepping forward and Cyber remaining broadly consistent. This is overall a GBP 3.1 million decline in the absolute gross margin cash as a result of the revenue reduction. Actions taken to transform our processes in the back office in year helped reduce the overheads and thus mitigate the GBP 3.1 million reduction in gross margin to a GBP 1.5 million decline at adjusted EBITDA level. It has been a year of great change in our finance, IT and HR functions, where we've refocused our resources around the U.K. and Manila operations and have resulted in a saving of GBP 1.6 million in the year and ongoing annualized savings of GBP 4 million. Our operating profit on the bottom left step change by GBP 41.8 million year-on-year. That brought us to a profit of GBP 22.8 million. This was in large part due to a GBP 40.9 million reduction in ISI or individually significant items charges, but also an underlying improvement in group performance as well of GBP 0.9 million. At the start of the strategy we launched 3 years ago, the group carried a net debt of GBP 52.4 million. The transformation of the balance sheet has been achieved with excellent cash conversion and the successful refocusing of the Cyber business around our 4 key capabilities and the resulting disposal of our Fox DetACT and Fox Crypto businesses at excellent multiples. This means the group finished FY '25 with a net cash balance of GBP 13.1 million. This financial robustness and consistency underpin the Board's decisions and stated intention to execute a share buyback on the conclusion of the Escode strategic review. Let's go into the numbers in a bit more detail. So this slide shows our group income statement, including Fox Crypto on a statutory basis. Before looking at the 2 divisions in detail, I'd like to reflect on our delivery against the FY '25 financial framework objectives that we set out this time last year. The financial framework is anchored around 4 key pillars: sustaining revenue growth, improving gross margin, delivering efficient cost savings to fund the growth and maintaining strong capital resources. There are 13 measures, which you can see on here, and we've delivered on 11 of them. Mike has already referenced a number of these, so I'll not talk through them in detail. But I'd like to thank all of our colleagues on their efforts to deliver on these. I'm confident we're fundamentally a more operationally and financially robust group, which will help us drive sequential profit growth as we return to revenue growth. Looking at the businesses in turn. So first of all, in Escode. So this is a consistent slide format you would have seen before. On the top left-hand side, you can see the half-by-half cash revenue performance in each of our 3 market areas. We had superb years in both the U.K. and Europe, which grew at 5% on a like-for-like basis year-on-year. North America was slightly down by 0.6%, but has recently returned back into growth following the realignment of the sales teams. Looking at performance at the top right by sales line, so in terms of our contracts performance and verifications, our 2 main services, we grew in both areas. So Escode contracts grew by 1.2% and verifications by 4%. Gross margin rose from 68.8% to 71.4% as a consequence of really good operational management and positive returns on investments. And our overheads reduced by GBP 0.4 million, resulting in an overall adjusted EBITDA of GBP 30.9 million, up from GBP 28.4 million the year before. Let's look at Cyber now. So we saw a better second half revenue performance as we forecasted. This resulted in a full year like-for-like decline of 4%, but we've seen a return to growth in the first quarter of FY '26. The U.K. delivered a really strong second half. So the first half of the year inside the U.K. on its own declined by 6%, but the second half grew by 7% up year-on-year, driven by consistent managed services growth and performance and outstanding consulting growth. The EU was broadly flat year-on-year. And with Fox Crypto and DetACT now fully detangled, we're confident in the refocused EU cyber business is positioned well to continue the return to growth we've seen in the first quarter of FY '26. After a material half-to-half decline in the first half of last year, the North American business saw stabilization in the second half and has started FY '26 in growth, albeit, of course, this is far more weighted towards our testing business in North America than managed services consulting or incident response. Gross margin percentage held broadly flat. We made a conscious decision from a resourcing point of view at the turn of the calendar year when clients' buying cycles in the autumn of 2024 caused a dip in utilization at that time. We could see strong opportunities and qualified sales opportunities coming through for the remainder of the year in our data, and this gave us the confidence to hold our resourcing levels to support the improvement, which did then come through in the second half. As with Escode, we saw a reduction in overheads in Cyber as a result of efficiencies. So this slide shows our performance across our 4 capabilities. At the bottom of the page, you can see the revenue by each of them over the last 4 halves. So if I start second from the right, Managed Services delivered another year of growth, but the most eye-catching capability was consulting and implementation, which is second from the left, and that grew 16.6% in year and 39% in the second half. This followed the investments we've made in the prior 12 months bearing fruit, especially in identity and access management and the operational technology spaces. Testing to the left-hand side here, declined sequentially from half 1 to half 2 to GBP 42.8 million, but this has seen a return to growth in the first quarter in FY '26 in all markets and sales data that we have indicates that the first half should remain in growth. Testing demand is closely tied to the macroeconomic investment environment for our clients. But between 85% and 95% of our testing clients repurchased the following year. Loyalty and retention is strong. It's too early to call this a permanent turning point for testing growth, but it's certainly very encouraging. Now if I can talk through our net debt bridge. We concluded FY '22, which is the beginning of Mike's strategy with a net debt of GBP 54.2 million. This has reduced to GBP 45.3 million, the far left of this chart at the start of FY '25. During the last year, we've returned GBP 19 million of cash to shareholders in dividends. This has consisted of GBP 14.6 million for the 12-month period to the end of May '24, plus GBP 4.6 million for the 4-month stub period we've had to the end of September 2024. In addition, we purchased GBP 5.8 million of shares to the Employees Trust, demonstrating our conviction in the group's strength and resilience. Overall, the group's net debt of GBP 45.3 million improved by GBP 58.4 million, GBP 56.3 million of which was a result of the Fox Crypto disposal, the remaining improvement as a result of really good cash conversion, 96.6%. So then what does this mean to our financial framework for next year? So this slide shows the evolution of our financial framework for FY '26 and the key levers to drive enhanced shareholder returns. The execution of our strategy over the last 3 years and the efforts of our colleagues provides a fantastic platform for growth. It's an evolution which with revenue growth will convert more efficiently into profit and shareholder growth. And with that, I'm going to hand back to Mike.

Thanks, Guy. I think that really helps to bring to life some of the points I made in the introduction. Now I just want to spend a few moments building on this and focusing specifically on the Cyber business. The team believe that the year 2025 was a pivotal year for the Cyber business. And we believe we've demonstrated we will do what we say and that we have demonstrated the strategy can unlock our potential, positioning to drive growth going forward. I'll just take a few moments to maybe reflect on where we started. At the beginning of the strategy, we operated a business that was isolated boutiques in siloed regions. We had significant revenue concentration in U.S. major clients, a high reliance on transactional single capability projects globally, duplicate processes and inefficiency across all of our entities. And we set out a strategy to transform this business. And in the full year 2025, we have unified that global business, simplified the business through disposal of noncore cyber assets and built a model that includes a global delivery hub in Manila. We've developed entirely new capabilities led by client need, creating market-relevant propositions with technology at the heart, powered by strategic alliances. This is why we are the go-to choice for many of the world's leading companies. To give you a few examples, in the U.S., when F5, a technology company that provides multi-cloud application security and delivery solutions faced a major breach, they turned to us. We had more than 75 consultants responding as a global team to conduct a security code review of over 100 million lines of code, supporting the client in a very challenging time. Another example, we were chosen to secure the NATO Summit in The Hague recently, not only because of our cooperation with Dutch and international intelligence services, but also because of our client-led approach and our incredibly talented security experts. And most recently, again, a public example, where we were called upon by 3 London Borough councils to help them respond and recover from high-profile cyber attacks, collaborating with a broad group of agencies, including the National Cybersecurity Center, the Metropolitan Police Service and the National Crime Agency. We are seeing momentum from Q4 FY '25 flow through into the first quarter of this financial year, which gives us great confidence for FY '26 and beyond to unlock our potential and drive growth. So if I think about FY '26 and our focus, it remains very much consistent with the execution of our strategy, creating value from the investments we've made. We now have outstanding capabilities, so we are absolutely focused on driving sales. It's simply about selling more through investing in our go-to-market, which we saw benefits of in FY '25 with the reengagements of nearly 200 legacy accounts resuming spending for the first time with us since before the full year 2022. And we had 285 new accounts, which were wins with the average customer spend growing by 5% between 2024 and 2025. We have taken an end-to-end approach on our lead to cash redesign and integration of key systems. This is aimed at reducing the admin burden on our sales teams and to increase productivity. We are streamlining processes to simplify our business using technology better. We're continuing to grow our Manila office to support clients both with delivery capacity, but also by expanding our enabling function capability. I've mentioned our focused alliance and technology partners. We've already seen an increase in partner and portal deal referrals, which increased by 63% between quarter 2 and quarter 3 in FY '25. We're driving efficiency by embedding technology in our delivery approach for our clients. We've deployed technology to automate delivery and reflecting our market-leading thinking with automation and improvements in data flows to bring additional value. To ensure we continue to drive improvements to our focus areas, we've appointed a transformation lead with a view to reducing underlying operating costs, which will be informed by the strategic reviews currently underway. We laid out our strategy and have executed against it despite a difficult external environment that has not been in our favor, but we can control what we can control. By continuing on our current trajectory, working together, we are already well on our way to create a very different NCC Group that will have the following features: recurring revenue growing through a focus on managed services and increasingly as-a-service cyber solutions. We've already started to see the shift with technical assurance services revenue as a proportion of overall revenue reducing from 60% to 40% in the period FY '22 to FY '25, with managed services and our consulting and implementation capability rising from 35% to over 55% in that same period. Consulting and implementation services and capability is the mindset that connects our services and capabilities to solve clients' complex problems. Growth in this area has been driven predominantly by operational technology and IT convergence and the investment in identity and access management capability. Over the last 3 years, 43% of our overall customers bought more than one service line. However, when consulting colleagues are engaged, that increases to 72% of clients using one or more service line. We will remain renowned as a global leader in regulatory and complex testing and continue to provide, for example, services to the likes of Google and AWS, the capability to undertake public research in emerging technologies. Today, we are recognized by industry analysts, IDC, Forrester, for example, and endorsed by major software players such as Microsoft and Splunk, affirming our standing as one of the leading cybersecurity service providers. Going forward, we will ensure our costs are proportionate to our business, and we've made some great strides in this area and already rationalized our property estate, and we've grown our support functions in Manila, delivering GBP 1.6 million in-year savings with an annualized benefit of GBP 4 million. We're focused on relationships that drive higher value opportunities. More than half of our FY '25 cyber revenue comes from our top 100 large accounts who are typically consistent spenders and purchase across multiple service lines. And of course, we'll be recognized for quality and insights across our whole business. We are playing a leading role in shaping the cyber industry and ecosystem and recognized by the U.K. government in the U.K. industrial policy as exporting world-leading cyber solutions and services around the globe, driven by cutting-edge innovation and trusted expertise that is quite an endorsement. I was delighted to see recognition of my colleagues when we were named Enterprise Consultancy of the Year at the National Cyber Awards as well as being named as Splunk's U.K. and Ireland Security Partner of the Year for the second year running. When I pause and look back, it's clear we've achieved a great deal together. I want to recognize the outstanding contribution of the NCC team in making this happen. Now there's still a lot more to do, but we should take pride on how far we've come and the momentum we've built. So in terms of outlook, we are confident in our strategy and the medium-term growth prospects for both businesses. We expect cybersecurity to return to revenue growth in FY '26, while Escode is projected to deliver single-digit growth. Adjusted EBITDA, excluding noncore disposals, will be in line with Board expectations. The Escode review continues, and we'll provide an update in due course. We are in the early stages of a review of all strategic options for the Cyber business should the Escode business be sold and no decision has yet been made. Dividend maintained for FY '25 and initial share buyback announced. In closing, I would like to thank our colleagues, clients and partners for their continued trust and support. Together, we are building a stronger, more resilient NCC Group, well positioned for sustainable growth and long-term success.

[Operator Instructions] Our first question comes from Julian Yates from Investec. Can you outline what's being done to reduce churn in Managed Services and also what trends are like in new business wins?

Thanks, Julian. So let me address -- and I think we talked about churn in our previous results where we had seen an uptick. I think as we said at that time, a bit of our churn was to do with legacy contracts and obviously changing dynamics within technology. What we've done in the recent months is focused very explicitly on ensuring that we have the right hypercare teams to support clients. We have had an ongoing program of engagement with our clients to ensure that we can demonstrate value throughout the contracts. I think there's also an element of -- and I think we did again mention this, there has been a degree of consolidation in the market. We did notice quite an aggressive attempts and some competition in the market where there was -- I think we've categorized it as quite -- as buying contracts, and that resulted in some challenges for some of the -- some of our competitors, which we were also able to capitalize on. So overall, I think we've seen a significant improvement in that churn. And also from a new business perspective, I don't have the numbers to hand, but we are seeing a strong pipeline, which, again, our improved MI, which we highlighted in the presentation, is something which gives us far more confidence in the forward look than we've perhaps historically been able to get. So it gives us some confidence that Managed Services remains a very strong proposition in the market and that we have good forward sight to growth.

Next question comes from Craig McDougall from ORA Capital. Please clarify the quantum and timing of your share buyback program. Will you be buying 10% of issued equity starting immediately? How will the anticipated Escode sale impact future buyback plans?

So we will start the buyback that we've announced when we are able to per market regulations, which will be on the conclusion one way or another of the Escode program. We can't start that project. We can't start it before that. Our intention is to buy up to 10% of share capital. And in terms of the impact that an Escode disposal were that to happen has on this, it's something the Board will consider at that point in time, and we'll look at whether we consider a larger return of capital back to shareholders via one mechanism or another.

Next question is from Andrew Ripper at Panmure Liberum. What was Cyber organic growth in Q4 '25? And what is it expected to be in Q1 '26? And how much visibility do you have in Cyber for the full year?

So it returned to growth in the final quarter, as you said. In terms of the first quarter, what we've seen is mid-single-digit growth. Obviously, we're not closed yet, but that's why we are fairly confident about finishing up. And we've got line of sight now in our sales data, both in terms of opportunity creation and sales forecast to be confident that we should be finished the growth in the first half in growth. So to put a couple of numbers around that, sales orders growth in the first quarter are in the range of -- again, we're not closed, but in the range of somewhere between sort of 8% to 12% up year-on-year kind of out of the back of that.

Another question from Julian Yates. Can you talk about workforce new hiring or reductions in the different areas and regions of the Cyber business in response to the demand signals and the Manila staff expansion?

That's quite a big question and quite complex. I'd rather not go into specific numbers of changes in workforce by region. I don't have them to hand for one of the primary reasons. But I will talk about how we have used the improved management information and supply-demand matching that we've been able to do to actually drive Manila. One of the fundamental parts of the growth of Manila has been to ensure that we have appropriate development plans for resources in that region to be able to use them in increasing numbers of domains within the cyber business. We also have, from a strategic workforce planning perspective, our propositions have effectively models, optimal models for how we would deliver those propositions, whether that's digital identity or managed services or particular elements of our testing component. And we build our resources in Manila and the training plans based around that strategic workforce planning. It is very much driven by market demand in the particular regions and the type of work that we're doing. Obviously, there's also particular requirements based upon whether it's national security requirements or whether it's by client preference and requirements for on-site working, which drives the extent to which we have resources in region. And that does vary very much by region, by vertical and by specific client.

Thank you very much. And we currently have no further questions coming in from the webcast. So I'll hand over to you for any closing remarks.

I would just like to say thank you to colleagues for an incredibly challenging year, but I think demonstrated by our results, a really positive momentum and what has been a pivotal year FY '25. We delivered some amazing progress against our strategic goals. And again, just highlighting, I think, the consistency that we've been able to demonstrate our execution against that plan, including, for example, the consecutive growth within Escode. So thank you to colleagues, and thank you very much for joining.