NCC Group plc (NCC) Earnings Call Transcript & Summary

Well, welcome, everybody. Thank you so much for spending time with me and Tim this morning. What I'm going to do, if you'll allow me, is spend 2 minutes reminding you of the highlights, hopefully. And I'm sure you have -- you all had an opportunity to read the RNS. There is an excellent presentation, if I may say so, recorded and available for you all to have a look at. So in a minute, we'll get into Q&A. Before we do, I would just like to remind you all of some of the highlights of our half year results. And again, this will take me no more than a couple of minutes. So it's a pleasure to be talking about these results this morning. And as we dive into them, I think it's really important that we don't miss the wood for the trees. The wood, as we can see, is in very good health. Down the left-hand side, compared to 12 months previously, revenue was up 14.2%. Gross profit is up. Gross margin is up. Adjusted EBIT is up. And of course, something we're particularly fond of, free cash flow is up 30% to GBP 20 million. And so overall, NCC continues to be the thing that we're very proud of, a growing, profitable, cash-generative business with loads of upside, thanks to the market in which we work. If we then zoom in to have a look at some of the trees in particular. We can see here crucially good Assurance growth and improved gross margin. So we've seen growth across all our Assurance geographies in what was a difficult year, right? We were all expecting 2021 to be easy after 2020. Of course, it was nothing but, right? The world was coming and going. But look, North America, up 9%; Europe, 12%; U.K. and APAC, 7.5%, all at constant currency, so pleasing to be able to show you that our Assurance business is back to growth after the COVID years and thriving crucially because there's been a lot of doom and gloom out there about attrition and wage inflation and all the rest of it. We've managed to do 2 things. We've increased capacity by 150 heads -- 150 technical heads, I should say, and also improved gross margin using the levers of utilization, price increases, global resourcing, and we can talk about all of those in a minute in a bit more detail. But that's so important. In Assurance, good revenue growth and improved gross margin. And we have been busy, right? Our new propositions for the future, our Sentinel managed services -- sorry, I didn't mean to click on that. Our Sentinel managed services proposition and our remediation proposition, which were pretty nascent 12 months ago, now up to GBP 5.5 million. And over the course of the next few periods, those are going to become more and more material parts of our growth and of our revenue. We did see a bit of a slowdown in managed services but still, 7% growth at constant currency. And it's against a very strong comparator 12 months ago where we posted over 20% growth rates. And when you've got slightly bigger order pipelines, there is some volatility. We've enjoyed some good orders over the course of December, and we're looking forward to a second half with stronger growth rates. Over at Software Resilience. We've had some organic weakness. We were expecting a couple of points of decline here because of the disruption to our sales teams in the first half of 2021 calendar year, as our management team was focused on the integration plans and bringing in IPM. But overall, a business that has been transformed by the acquisition of that unit, and I'm pleased to say it's exactly what we thought it was, trading on plan, integration on plan and with a great future. Crucially, our sales teams are back to full strength. Our marketing engine is running well. We've seen year-on-year growth in December. We've seen year-on-year growth where we're heading for it in January. And so we do expect that to grow year-on-year in this second half, helped by our Escrow as a Service offering, which continues to grow at rapid rates. And once again, when you look through to the future and the growth that, that's going to deliver, we're quite excited. So all online for an exciting second half and delivering a full year in line with management expectations. But as I said, there is a presentation for you on the web. Please do take an opportunity to have a look if you haven't already. So with that, we will begin to take some questions.

So we got some hands up. I think to be fair, Julian, I think you were first out of the blocks. If you -- we'll go to you first.

Just a couple of questions, one on Assurance and one on escrow, if that's okay. On Assurance, yes, good to see there's some decent revenue traction in there coming through, I guess, across the board. In terms of the gross margins, they clearly went up H1-on-H1. They went down slightly versus H2, about 1 percentage point or so. I'm just trying to understand, is that a -- would you see that as a trend from H2 to H1 and then slightly moderating in H2 as well in terms of declines in gross margins? Or are you happy with where they are in the current period and you think you can withstand those for the reasons that you articulated in terms of how the model is working? So that's, I guess, the first one. And any geographical differences that you think are pertinent will be useful. The second question is -- this is on IPM and/or escrow profitability. It seems as though you had a sort of GBP 8 million to GBP 9.3 million in terms of operating profit for the business, but that assumes the contribution of IPM in there. So I'm trying to understand what happened to underlying IPM profitability. It seems that the margins there were quite low. Or was it that you had a decent IPM contribution but the core escrow IPM -- the core escrow operating margin was pretty much impacted and what that means for H2? I'm just trying to sort of get a gauge on how that full year sort of dynamics works.

Yes. That's absolutely fine. Thank you. So what we'll do, Tim, in a minute, will probably tackle the IPM question because we've had -- the punch line on that second question is we've had a very strong trading contribution from IPM. But of course, we've had integration costs. We've also had the revenue haircut, which is a joyous accounting artifact that Tim will enjoy talking you through in a bit more detail. I'll tackle first, if I may, the GM point in Assurance. Now I would encourage you, to be honest with you, not to obsess too much about those slight variations half to half. We do tend to get a fairly busy finish to our H2, which can drive up gross margin a little bit under the hood. There's quite a lot of moving parts. We're hiring a lot more people. We're bringing on a lot of juniors. We're training people up, which gives us great capacity for the future. We've also been hiring a lot of salespeople, right, which also, if you'll recall, our gross margin, perhaps unusually for businesses of our type, includes both sales and delivery costs in cost of sale. So the punch line, Julian, is we are comfortable managing gross margin within the parameters, right, which is roughly where we are now, thanks to the various levers of utilization, price rises, global resourcing and all the rest of it. I think you asked me about geographic variances as well. So some of the year-on-year growth is going to be a little bit of an artifact depending on what you were comparing with 12 months ago. So the 12% growth we've seen in Europe, for example, slightly flattened by a weak comparative period. The North American growth of 9%, slightly depressed by a very strong comparative period. Overall, when we look at the market, we're seeing very strong demand growth in North America. There's a wonderful set of clients that we're privileged to enjoy over there. We expect that to continue, notwithstanding the irritating footnote which is America -- North America having a real flap about Omicron. At the moment, they're going through the peak of that. We expect that to subside and more normal service to resume over the second half. U.K. hasn't been the sort of exciting robust market that we've all seen for tech in North America driving some of our demand but steady Eddie and, as I think we can all relate to, less affected by the general COVID flap. We expect to see that market just gently continue to improve through H2. Europe, much more locked down from a restriction perspective than either U.K. or North America. So I would say business as usual operations have been more impacted over there. And again, we're just seeing that ease really in our core territories of the Nordics and the Netherlands. So I hope that helps. Tim, over to you for the IPM piece, if that's all right.

Yes. So on the IPM piece, what you have -- you asked about core business margins, Julian. So what you have is you have the GBP 2 million cost, your IPM, and you have the core. What's happened is, as Adam said, the development team were obviously focused on the acquisition itself and getting into the integration. So there's a slight -- that's why we have that tied to us going into last year. Coming into this year then, they're on the integration, and that's going well. Margins in IPM are higher than the core business because the nature of their model. But what has happened is, as you will recall, we increased a lot of capacity within IPM. We've been investing in salespeople, who were down in the last half and are now being put back up into full strength, and that goes into the margin. We've invested below the sales and [indiscernible] and have been professionalized. We put a lot of management team structure into the core business. So we've just developed a new thing, which is called SDRs, sales development reps. They come in. We put them in there, the people who generate the leads, before it gets to the account managers that we just invested in them to generate growth in the second half. And that is going to margins as well. So all of that has pulled it down slightly in the core. But obviously, it's an investment for the future growth. And as you know, we mentioned in December and January, we're back into positive growth on sales and revenue in Software Resilience. So that's the early seats -- early doors, and that's the early start of the turnaround.

So in terms of the actual profitability of IPM in the first half, are you able to give the EBIT number so we can sort of understand that number under core?

Yes. I think the EBIT number, kind of within it, if you recall, it had the -- I was thinking about [indiscernible], we had the -- yes, I think -- just wait and I'll have to check. So we have within it the revenue haircut. So I don't want you to give you the wrong number.

So the GBP 9.3 million of overall EBIT resilience...

Yes. The GBP 9.3 million, expect it to have the revenue haircut to get us to GBP 12 million on the sales. And then you double it to get to GBP 24 million on revenue. Yes.

And out of the GBP 9.3 million, how much came from IPM? How should we sort of think about that?

The IPM, in terms of the actual EBIT revenue margin?

Yes. Not just the EBIT number. And so resilience was GBP 9.3 million. I'm just wondering how much came from IPM, how much...

GBP 4.4 million off the top of my head, but I'll consult with you.

And then the remainder would have come from core escrow?

Yes.

Okay. Yes. It's just helpful to get the split.

Okay. And worth bearing in mind, Julian, we're taking integration costs above the line, so not as exceptional as that revenue haircut, which is the accounting around the acquisition, is also -- and is [indiscernible] you don't intuitively expect. So we can take you through that in more detail. Thank you. Ken?

Thanks to Tim also for talking us through the accounting chicane of the haircut. I got 3 questions. Firstly, on day rates, you talked about the increase in the first half. But presumably, there's a -- and it's notably a first increase for a couple of years. Presumably, there's a kind of timing effect of that gradually feeding through. Can you talk a little bit about the sort of momentum there and how much you need to increase day rates to cover a certain level of wage inflation? Second question was just regulatory. I mean, we had some statements at the back end of the year, Joe Biden calling in kind of U.S. tech chiefs' political action on the importance of best-in-class cybersecurity and so on. Is that actually making a kind of a genuine sort of step change difference? Because it really did feel like a new level of beyond the normal kind of increased threat level, increased regulation, that felt like a step-up. And finally, just -- again, you kind of mentioned it. But it is a kind of -- it would be a landmark really for Software Resilience to be growing again for the first time since FY '18. And to me, having a plus number rather than a minus number, even if it's kind of minus a couple to plus a couple, is a big symbolic difference there. Is any of that because of IPM that you're seeing in the second half? Or is that genuinely the business and the sales force kind of beginning to kind of get back into their stride?

Lovely. Thank you, Ken. Well, let's take these 3 in turn, shall we? So first of all, day rates, you're absolutely right. Yes, we've increased our day rates for the first time in a little while. I mean, look, going through the pandemic, we were pretty considerate of our customers. It wasn't the time to be forcing through price rises even if we could have been able to, I suppose. The other thing to bear in mind is a lot of our contracts come up for renewal annually. And as those contracts are coming up, of course, we're pushing through more and more price rises, again, respectful of our customers. We have to respect the fact that they can choose where they place their work, but we're very confident in the value that we deliver. So as those contracts come up for renewal, we are pushing through more and more price rises. And of course, they're very powerful because an X percent rise in day rate, it will compensate for more than a 2x rise in wages, for example. So it wouldn't be appropriate for people to think that we need to match wage inflation point for point with price rises. And we also have, as I pointed out, other levers like utilization and in particular, our global resourcing, which have got a lot further to run than they have so far. The second piece, yes, the regulatory piece is -- I mean, you're absolutely right, Ken. There's been an uptick, and there have been some quite seismic points like Biden's focus on this and the obligations people now have to patch and keep themselves secure. We point out, as we always do, the 4 secular drivers of cyber growth. And the fourth and I think the most powerful is the relentless increase in legislation and regulation because it comes with costs of compliance failure. It's what makes cyber move from the CIO's budget to the CFO's budget. And then it gets ingrained into the budget. And the CFO can't cut it, which is always really very helpful. I would say, Ken, I'm not going to call out any particular spike that's come from that, but it is just one of the trends that means more and more people will be forced to spend more and more money on cybersecurity, which will benefit everybody working in the sector. And finally, in terms of the Software Resilience growth, you're absolutely right. It will be a landmark, and we're very excited. The growth that we've been seeing in December, for example, and we're on course for in January, is not to do with IPM. It is to do with the core business, which is so important, getting that sales and marketing machine working properly. And of course, we're working with the IPM unit on revenue synergies. We have a decent pipeline there to be able to increase the number of verification tests they sell and also to offer the Escrow as a Service proposition. And we've got a nice pipeline measuring in the hundreds of thousands, which we look forward to converting over the course of the rest of the year and into next year. Thank you, Ken. Caspar?

I just had a few very quick questions, one around the Assurance side of the business and then a couple on escrow. Within Assurance, I mean, obviously, the spike in attrition must be sort of quite a difficult metric to look at. But I mean, the hiring performance has been exceptionally impressive. And I was just wondering how much that is a function of being able to access new pools of talent away from traditional hubs. I realize your global resourcing mechanism is probably part of that. But is it sort of remote working playing into that as well? And is there a cost benefit to that, too, of being able to access a broader reach of talent? On the escrow side, the -- how much is sale of cloud escrow an opportunity to stabilize the contract base? And then just looking at the contract base, you talk about revenue stabilization or even growth going forward. And as you mentioned, that would be a landmark. Is that more a function of verification upsell? Or do you see contracts that -- the attrition rate beginning to sort of lower going forward and maybe even stabilize in the longer term?

Thank you, Caspar. Look, let me come to those as we go through. So let's start over in Assurance, and let's look at that attrition. I mean, look, it's always painful to see attrition spike. And frankly, I always take it really personally when people choose to go and work somewhere else. But it's the world we live. Colleagues who have worked at NCC Group have gone off to do the most wonderful things for the most wonderful companies. We have alumni who are present in all of the great names that you would recognize. And in fact, some them will come back for a second stint. And we've launched our alumni network actually since the start of H2, which is looking to formalize that network, build upon the shared experience that a lot of people in the security industry have had at NCC Group. So there we go. But I think where I'm tempted to be a little bit cheeky and tease a lot of people in the wider world who are having a bit of an inflation flap, we've been living with inflation in cybersecurity for 10 years, frankly. So the one thing you know is that you're going to lose people. And the one thing you know is that the cost of hiring those people is just going to go up. Sometimes it will go up gently. Sometimes it will go up a little bit faster, but you've got to be able to handle it. I have a really stupid phrase for it. I call it the All Blacks strategy because you can't score points against the All Blacks, but they will score more points than you. So we know we're going to lose people. And therefore, we just have to hire more people than we lose. Isn't management a brilliant and subtle science? So coming to some of your more subtle points, we've been doing a lot of work to try and reach into pools of talent that we haven't tapped into before. We are working on flexible working. We've worked really hard on the inclusivity of our recruitment processes as well to ensure that we are not, unconsciously or otherwise, excluding people. And we do reach into people who have nothing to do with cyber and import them from other areas, which is great. The remote working certainly helps, I would say, in every single one of our territories. And I wouldn't underestimate the sheer amount of work we've put into our wellness programs and the -- yes, if you look on the social media feeds for NCC Group, you see quite a lot of fun, right, which I think is going to be part of attracting people to our company. But I will say, Caspar, at the end of the day, a lot of it is down to just good old-fashioned planning, execution and horsepower. How many people are we going to need? Let's make sure we attract them. Let's make sure we get them into the training cohorts. Let's get them through. Let's understand the impact on our cost base. Let's get them deployed and on we go. But so far, so good. And it's what we do, right? We have an amazing talent acquisition and training capability, which is at the heart of this business. Over to escrow, so a couple of things there. So cloud escrow, I mean, look, it is still a small absolute number. But the growth rates have been tremendous over the first couple of years of operation. And we've had another good growth rate in the first half, which, frankly, we think we can beat in the second half if things go well. So we're hoping that we're going to do that. With all of the key propositions for the future, whether it's Sentinel, whether it's remediation, whether it's Escrow as a Service, what I want to encourage you all to do is to look forward, right, look through the noise of the current business to what those are going to be in a few years' time because the upside potential of continuing those is absolutely fantastic. And that will play into your sort of question 2b, as it were, what impact will that have on the contract base. At the moment, if and when we finish the full year in growth for Software Resilience, it will be thanks to a good verification performance coming on top of a stabilizing contracts base. But I don't expect the contracts base to increase this year. We're tackling that, though, from 3 different angles: Number one, improved retention. Our retention rates are okay, but we're putting a lot more work down to customer success because every percentage point of retention we can improve is contracts that we don't have to sell to get back to net positive. Of course, Tim has talked about the SDRs and the marketing automation engine and the sales force, which are very focused on getting more contracts. And over time, that would get us back to a net positive. And then finally, of course, we've got the Escrow as a Service coming through on top. So all in all, we know where we're heading, right, which is net positive contracts year-on-year. And when we get there, this is going to be a phenomenal place of business. Steve, Mr. Robertson, are you out there?

Yes. Yes. Can you hear me?

We can now.

Brilliant. Quick question, it's a really simple one. And it's -- I probably should know this from reading through the statement, but I can't actually find it. The integration costs of IPM included in the half 1 adjusted EBIT of GBP 20.2 million, what were the integration costs that have been included in that GBP 20.2 million?

You happen to have that one, [ Tim ]?

Yes. So the integration cost was GBP 1.2 million. Sorry, if you include the -- just the integration costs, yes, not the acquisition costs. Yes.

Great.

That's all right, Steve. We always say, no question is too easy. It's absolutely fine. Thank you, Steve. That's okay. We've got hands up still from Ken and Julian. I don't know whether those are follow-ups or whether you just left your hands up. But either way, we've got...

I could follow up. Is that okay?

Let's do that. Over to you, Ken, and then we'll bring Damindu in after you.

Sorry, excuse me, Damindu. Right. Sorry, I was just going to ask perhaps just a few more words on the kind of slowdown -- admittedly, last year was a sort of start-up year and a big one. But the slowdown in MDR and kind of the changed client behavior and you do indicate that you feel that you've kind of adapted to that and things are back on track. But a little -- a few more words on that sort of GMS, MDR, which is really the only thing I can see that's kind of not seeming like it's improving this year.

Yes. Yes, sure. Well, look, thank you. And as I say, it's -- I think there are 2 mundane things and 1 interesting thing. So we'll see if we can get to those. The mundane things are we had a very strong comparative period, the year before. That's all fine. The other mundane thing is sometimes you win bids, sometimes you lose bids. And in particular, we've seen a pretty reasonable performance over in Europe, where we've got some wonderful client opportunities in universities, for example, and other customer demographics, if you like, where we've seen some really good traction. Over in the U.K., a bit slower and a combination of things. We've got a bunch of lumpy bits. On the whole, there are slightly higher values than we've dealt with before. Customers not spending with unconstrained freedom in the U.K. yet. So we're still seeing a couple more sign-offs required, maybe at the CFO and so on and so forth. And so a bit of delay. We win some, we lose some. But the pipeline and the opportunity for us in H2, I'm just not concerned about this, Ken. It comes and goes, right, in terms of the phase. I think the interesting piece is that we can sit here and talk about MDR or managed services with -- and it's easy, right, because it's just 3 letters. Of course, under the hood, there's a whole technology shift going on. And I do find the speed with which Microsoft Sentinel is being adopted by a number of players, both big and small, to be absolutely fascinating. I think that's a technology shift that is going faster than we expected. It's going to have an impact on, I think, a number of MDR providers in the business who are working on more legacy opportunities. I think it will have some kind of impact on the SIEM solutions we've traditionally operated in. But of course, we're very pleased to be surfing the Microsoft Sentinel wave. We've been seeing a high explosion of growth. I mean, the stat that somebody gave to me, Ken, although you'll have to go and verify it somewhere else, is that Microsoft got 9,000 customers in the first year of operation with Sentinel, right, which is quite astonishing. But it just goes to show that when the hyperscalers choose to get into something, it's very wise to hang on to their coattails and get into. So we're very pleased to be working closely with Microsoft to support them. For us, plenty of opportunity. Damindu, over to you, if we may.

I -- well, actually, Ken actually asked the question I wanted to ask, but I have a couple of more to ask actually. One is, could you give some color around the largest customer relationships you have like the tech giants? Have you had a good level of repeat business from them, renewals from them? Because I think you tend to sign those contracts around this time of the year. After you answer that, I'll follow up with the others.

Yes. Absolutely. And look, we were good to you at the full year results. So we did show you the level of repeat and sort of behaviorally recurring revenue that we got from our top customers. And we haven't given you that. There's no reason why not actually, and we will make a point of giving you that at the full year results. The short answer, Damindu, is I'm very pleased to say that our biggest customers are staying with us and spending more with us than ever before. And in fact, January will be a record -- it already is, right, a record month for orders for us, driven by the continued purchases that we're getting from our biggest customers over in North America. So hopefully, that's a straightforward answer to your question.

No. Perfect. That's what I wanted to hear, basically, are they spending more with you guys. The second one I wanted to ask was, obviously, a number of people already commended you on the impressive hiring you've done in this environment. I'm more actually excited by the focus on hiring juniors and training them, as you say in the statement. Can you provide a bit more color as to how you will deploy that talent? For example, are you thinking of using them in the more commodity end like pen testing, for example, which, I guess, is a way of allocating resources. I just want to get a little bit more color because you always hear of experienced hires in this industry. And I think it's the first time I've seen a cybersecurity consultancy talking about a training program.

Well, yes, absolutely right. Well, look, it's so important to have experienced people in your business because they are great enablers, aren't they, of client relationships and of more complicated pieces of work. But at the end of the day, there are not enough people in cybersecurity to meet the problems that we have today, let alone the problems of the future. And therefore, the only way for we, as a firm, and if I may extemporize, as a society, to be successful is to train up loads of people who are new to this industry. So we're really excited about our junior training programs. We've had them for a long time. But of course, we've been supercharging them over the last couple of years when it became apparent just what volume we were going to handle. So we have cohorts running all over the world, in North America, in the U.K., obviously. We've got trainees over in Europe as well. I'm trying to think of my way into the second half of your question here. So we have a fairly progressive way of training people up and then putting them on sequentially more complicated jobs, which, of course, gives them the real experience they need to battle harden them and then move them through so that after 18 months, 2 years, they are really very effective indeed. We're doing a lot of work on career paths. And we've recently reorganized our global professional services -- service line into 5 practice areas so that you've got application testing, you've got cloud, you've got strategy, you've got various other things so that people are able to have a primary alignment with one practice but also dot over other practices so that they can get a blend of skills and become rounded security consultants as they go. And the final thing I wanted to add, Damindu, is that on the other side of the equation, we're working hard to break down the work that we do so that it is easier for juniors to do -- we call it the juniorization of our work. Don't get me wrong. You're always going to need some rabidly brilliant ninja to do some stuff. But like almost all work in the entire world actually, a lot of it can be process-driven, systemized and juniorized so that it is done not from scratch every time but then in a more organized way. And so those 2 things together, right, the juniorization of our work, coupled with junior training programs, means that we're very confident of the sustainability of what we're doing.

That's very, very clear. And the last one I wanted to ask you, I don't know if you want to give any color, but I'm just throwing it out there anyway. Obviously, I think not many people believe you could push through price increases, not having done them for 2 years. But are you able to do that on a broad basis? You said that in Denmark, it's easier to put the prices up. But maybe in East Coast, it's slightly more harder to put the prices up. Or is it the case that, in fact, you are catching up with pricing because you've almost not pushed prices up, and therefore, a lot more people are accepting of the new price, new rate cards, for example?

Yes. Look, there's -- it's a great question. So what's the best way of answering it? I suppose, yes, the starting point for answering it is that if you think about where we come from, which is fairly geographically separate ways of operating, people had historically set different rate cards and, therefore, expectations with customers in different parts of the world. And so it's not as if we're coming off one rate card with one rate, and that's the thing that we are clicking up 1%, 2%, 3%, 4%, 5% every year. Of course, the rate card we have with a customer reflects the work that we do for that customer, the skills that we deploy, the scarcity of those skills, how good they are at negotiating, the volume that they give us and all sorts of other things. But the tools that we have at our disposal are starting to increase the minimum rates at which certain skill sets are sold. We have better visibility today into the different day rates that have been sold in different territories than ever before and which allows us to make just more informed decisions. Actually, people in that territory will now focus on working for clients in this territory because we just can't get the same day rates over here as we can get over there. And so all of that means we should continue to see, Damindu, just a relentless increase in day rates. Steve, is that hand out for a follow-up or a legacy hand up, should we say? Lovely. Okay. Anything from anybody else? We'll just give it a few more seconds. Lovely. Well, look, once again, thank you very much for joining us this morning, giving us your time. We're excited about these results. I hope you are, too. We look forward to seeing some of you over the course of the next weeks. Take care. All the best.