SSH Communications Security Oyj (SSH1V) Earnings Call Transcript & Summary

So we'll start. Valued shareholders, investors, customers and media, welcome to our investor call on SSH Communications Security's Corporation financial statements release of the year 2022. Meeting will be, of course, recorded and recording alongside with the presentation will be available on our web page after this call. My name is Lauri Koponen, I am the communication manager at the SSH Communications Security. The financial results will be presented by our CEO, Teemu Tunkelo this time. [Operator Instructions] And we can proceed. So please Teemu, you can start.

Thank you, Lauri. As you probably all know, we have a little bit of transition period here with Niklas leaving the CFO position, and we have [indiscernible] on the call who has been covering the transition in the last months, and we'll be helping Michael to onboard in the CFO role. So [indiscernible] has been, to me, like for [indiscernible] sitting on my shoulder and trying to keep me cool and concentrate on the right things. So let's go through the business highlights, very briefly with the financial results and then a little bit what we are doing in the business. So if we look at the full year, I am really proud of the team, our hands on deck. We grew well. And I remember some years ago, I said that the team is on boat, the boat clean, the sails are on and the wind is in the boat. But it takes some inertia to get the boat going, and that is providing results to us now. For the full year with our 5 product lines in different life cycle strategies, we were able to achieve 21% growth. We continued to grow ARR. So the growth side, our portfolio, I'm really proud of what we were able to achieve with our customers. We also got some new significant logos. We got longer deals than before with UKM, with NQX and PrivX. So we are getting the customer confidence coming up that they are willing to make longer-term commitments with us and not to rely on annual subscriptions only. So because of these longer-term contracts, we have customers paid in advance. All in all, the invoices we were able to send grew significantly more than our revenue based on the subscription model that actually when we got the deals in the last quarter, it didn't really contribute to revenues, but it contributed to invoicing. And we are looking at ways that we could describe better the orders received in our business compared to revenue because if you sell boxes, you ship boxes, you can say easily orders reviewed and shipped. But in subscription business, it is more difficult. So -- but the invoicing, which leads to deferred revenue, the money we got from the customers, real money grew a lot, and it will be converting revenue -- to the revenues in the future, which, of course, gives us a solid base for future growth. Profitability also improved and following the logic over the last 7 quarters, I think we are ahead of the game of our competition in the sense that we are already going for the Rule 40 that we want to be over 40, if you combine our growth and our EBIT percent in the last quarter, we were there. For the full year, we are still lagging behind, but I think we are on the right track. And we continue to invest in our future. We have proven and used products. We are developing future-proof products like NQX and PrivX and we continue to invest significantly to R&D. We have clarified our marketing position to share our trust operational technologies and postpone to safe solutions. And we have put a lot of effort in last year on revamping our partner network, and integrating the partner network management for all product lines in that sense completing the merger of Deltagon to be 1 product line of the whole SSH. Next slide, please. So if we look at the numbers with the pictures, which is more interesting for me. So you can see that we have been able to grow in the last 7 quarters, top line, we were very close to the quarter last year, even though we didn't have any major license orders like last year on the last quarter, we still made extremely good last quarter. So that also built for the future growth. It also -- if I look at the regional level, Europe was the hero and Europe has become our biggest region and it is on a solid base moving forward. Asia, which is dependent on partners on the major revamp with the partners and the local management, which kind of maybe a little bit change pain that we have to go through. And U.S. is still the huge opportunity. We have been able to defend our base. And we are working very hard to get U.S. to challenge Europe, who is the biggest region in 2023. So compared to the current market phase where the rule of 40 is becoming more visible, we have gone that way already for 7 quarters. We are focused on keeping EBITDA at a good level and growing at the same time. And doing that with the portfolio management, we are really making PrivX, which is growing to the adult age in our portfolio, the core platform of our solutions, and we are launching SSH zero trust suite, which is access management for key users for accessing people exiting applications, applications talking to other applications in 3 areas. We started with traditional IT, we have gone successfully now to manage service providers, also in the U.S. with the latest deals we did last year. And operational technology, we have really especially in Europe, got grown with major logos in using our technology to connect the factories, harbors, airports to the cloud and back. If we look at the whole journey from a technology point of view, we started with digital keys some 20 years ago with SSH keys, which basically had 2 fundamental problems. They don't have a best before date, and they are not connected to identity. They are like who -- like the physical key to your home, the 1 who has the key can use it. Digital keys, which is the future, you can't use it if you are not -- if your identity hasn't been verified. And that's what UKM does, which was our first generation on the certificate environment. The market went for digital SSH certificates and password rotation, which we think is old-fashioned. And we jumped the gun with PrivX already 10 years ago, to go to password-less to key-less world. And that, especially in the OT environment where SSH keys are used a lot for applications, application communications and remote maintenance, it is key that you don't have passwords and you don't have permanent keys. And that's where we are today, and we are also ready for the future. Zero Trust is the core of our offering today. And a lot of the time we now spend with our customers is actually teaching them that the next generation, the next wave will be postponed. It gives limited revenue today, NQX is in early stages, NQX is where PrivX was 3 years ago. And we see that the post-quantum is coming to PrivX, it's coming to Tectia, big customers of ours having major projects and saying, how do we go to post-quantum world, which is for them a big project taking years. So we can provide them the 2 last waves for the future, easy-to-use, cloud-native solutions that gets rid of password rotation, it gets rid of static keys that are not connected to identity. And that is the message that we feel that we are getting very good traction in the market. And customers understand that the traditional certificates that last for a year or 2 enough changing password is not the way moving forward. You have to go Zero Trust, you have to go post-quantum and we have readymade products that you can use in your environment, and we can help you to get to that journey. So the key message we tell to our customers is password-less, key-less and defensive cybersecurity. We talk about defensive cybersecurity because we are not about hackers. We are about protecting your critical data. And very often, cybersecurity as such is -- that's the bad boys, actually, the biggest risk in most cybersecurity environment and other people working inside the companies or the third parties accessing the systems in the company. So we provide not only the user access, which is maybe 20% of the system access. 80% of our customers' data traffic is applications to applications in different ways or systems between systems. With Deltagon, we went to the space of sharing information between people with the Deltagon suite. And then with NQX, we are providing the backbone graphic between your subsidiary and the Claudio factory in the cloud in a way that is really over secure that you don't need to use least lines to connect your critical infrastructure. You have a high performance over Internet link, which is fully tunneled in a tunnel that can run any data, any protocol you need from the physical network layer, and that's where we are absolutely unique with NQX because the way we've developed NQX provides a significant performance improvement compared to the competition because we have built our own implementation of PCPIP stack in user space. So by architectural design, NQX is the most performing point-to-point connection to connect data centers or offices to cloud. And we are also expanding our approach not to develop everything ourselves. We are building integrations to key topics and key topic is the ease of use, get rid of the past with biometric recognition, getting rid of bins, getting rid of SMS messages, multifactor authentication in a different way is a key part of the story. A lot of the digital gatekeeping also has to do with being able to control access real time from your mobile phone that you don't have to be at a computer. And all in all, of low products are Zero Trust capable, and they will be quantum-safe capable. And that's why we believe that we are in a very good position with the total portfolio to go for future-proof solutions that is based on technology that is done by a team who have been doing proven and new solutions, especially to the finance sector and government sectors which is great because if we can help our customers to protect money related data, I think we can help factories to protect their production-critical data as well. So our portfolio focus continues to be Zero Trust, that's the traction is that the PrivX is making its growth. Operational technology, I think we were already a year or 2 ago ahead of the game. We started to talk about operational technology when the market didn't. Now we can see all the competition is following us. We can see that we have gotten traction with machine builders, which maintenance provide us with production facilities and it has been hugely helped by the last year with situation in Ukraine that people have understood that actually critical infrastructure, heating, cooling, electricity, water has to work under every condition. And cyber risk is huge because you can stop a client without going there. So we need to build a digital sense. We need to have the digital gatekeeper, and we have the technology already for banks and governments. Now we want to bring it to OT. And both of these have the risk of the quantum computing, which not necessarily is sure when compute -- quantum computers come, but our customers tell us we might not know when they come, but we have to be prepared for it at least for our most critical data. So our customers are looking at their critical users and their most critical data and they talk with us, and we are helping them with our professional services to build a sustainable and defensible future also in the cyber space. So moving forward, this year, we have transitioned to subscription model, and we are doing that in all product lines. It is -- we still like to have licensed deals if the customer wants to buy it, but we prefer strongly the subscription model because that provides us better performance overall because if we take a license deal, you get the money in the first year. If you get the subscription deal, you get more money over the years. So this is not a quarter business we are doing. We are doing a long-term future because our customers use our products for 10, 20 years, like they do traditional industrial production equipment, we are just an industrial production in the digital phase. Already mentioned the numbers on the last year performance, which I think the team did with the help of our customers' great work. And we want to maintain with our outlook for this year. Our main focus is to grow and we want to grow, keeping EBITDA and cash flow from operating activities to be positive on the year as well. So with these words, I would like to hand over back to Lauri and please type your questions and/or ask online and we will be happy to provide answers to you.

Yes. Thank you, Teemu, for your good presentation. And definitely, let's have a question-and-answer section. [Operator Instructions] And we had actually first -- so Frederic, the floor is yours.

Good morning, Teemu and Lauri. Thanks for taking my questions here. I want to ask you -- you talked a bit about Asia and that it was weak. And usually, Q4 is pretty strong in licensing sales. But in the quarter, it was pretty weak. What is the take rate going forward, do you think?

Well, actually, the quarter was weak because we did revamp on our partner network. So we had to reshuffle them. We also are moving also in Asia to subscription model with the Tectia post-quantum, Tectia being the biggest product in Asia. And that means that when you get subscription deals, they don't come to revenue. So these 2 elements moving Tectia to subscription business and revamping the channel partners reducing the number of them and moving customers to the remaining partners did impact our numbers, but I'm very confident that the work we've done with Asia over last year will bear fruit this year.

Okay. And looking at Europe, it's your largest region and it grew pretty nicely in the quarter. And I know we talked about it before that the U.S. is pretty hard on the competition. We continue to focus more in Europe going forward or can we see something else here?

I think we focused both on Europe and U.S. I think U.S. has a lot more potential. The competition is harder. But the great thing is that the market is also reforming from a point of view that people are focusing more on also the financial performance, not only on growth. And the late merger from the competition also helped us because they are focusing on internal topics. So I do believe that we will continue to position in Europe to be the European player. And that really seems to be working well. In U.S. we want to position to be the best technology player that is on a solid ground. And so, from our marketing expenditure, we will focus to put efforts in the U.S. market, because the market is bigger and it is more cloud ready for our solutions which are future-proof. So Europe has become a contender for U.S. for us because traditionally, U.S. was the bigger market and Rami has announced the competition that, hey, show me U.S., can you be bigger than we are in Europe. And I'm happy to see that race being on.

Okay. That's good. And then PrivX grew 96%, continued to grow very strongly. What is the trend for the full year? You're going to continue to be around here or it's going to come down?

I would say we are in a very good position to continue the trend, of course, when the absolute numbers go bigger, mainly maintaining the gross numbers at 100% will be tougher. On the other hand, we have been able to increase the average deal size of PrivX. So I can see it possible. Of course, that creates the challenge of that the PrivX business is granular that if we get the deal that is 30% of the current PrivX deal it's great, if that slips a quarter, it's not great. So it's not really a statistical mass, but I think it is the right direction that we go for better deals because PrivX works best in organizations that have tens of thousands of servers. And that means that you have to go to promise that you know anyhow in the market.

So then the last question for me, and I'm going to let Anders in. You just talked about the outlook for 2023 and you're going to be positive on the EBITDA margin. But do you think the margin is going to stay around 14% -- 10%, 14% or manage to put higher?

It is my intent to keep the margins higher. So I am a strong believer of the Rule of 40. So last quarter, we already were able to be inside the quarter of 40, which is if you combine the growth percent of the revenue plus your EBIT margin, if you are over 40 as a SaaS company, you're okay. And we did it last quarter, last quarter is our best quarter. Now we want to do it on the full year. I can't promise it, but I'm putting all the effort with the team that we make sure that we will go for the target.

Thank you, Frederic. And then we have in the chat question, I will read it out loud. The invoicing has grown significantly from EUR 15.1 million to EUR 24.2 million. Can you elaborate on the main drivers of the improvement? Do you have longer invoicing intervals than 12 months?

That's a smaller part, but it's a significant part as well. So there are 2 elements. One is that we got a lot of subscription deals in December, which means we could invoice the whole '23, the money will come, but it doesn't come to revenue, but we were able to send a lot of invoices in December that don't convert to revenue. Also, some customers have been worried about the inflation. So they want to fix their price for the next 2 years, 3 years, and they want to pay upfront to secure that they don't get the hit from the inflation, which what we generally are doing is we target for 5% increase on the prices. So the customers are willing to make longer-term contract. Typically, they do the ones who want to do multiyear contracts and pay them upfront want to go for 3-year contracts. There are some that go for 5-year -- and there are -- especially in Japan, they are interested in 7-year fixed price contract, I pay you upfront, which is great for us for our cash management and it also shows the customers' commitment that they are going to use the product for a longer period. I personally like automatically renewing annual contracts better. But I'm also happy to see that the customers are willing to make long-term commitments and pay upfront because that shows that they trust in our portfolio.

[Operator Instructions] In the between, I have a couple of questions which came in advance. So first question is, has the closer cooperation between Finland and NATO or, let's say, NATO joining process and the pattern of industrial cooperation in Fighter producement had a concrete impact on SSH business opportunities?

Opportunities for sure and a lot of discussions with customers, professional services engagements. So the customers are looking at what does the new world look like. It hasn't really converted to business. On the chip factor side, the difference is different because nowadays, there is no hard commitment on countertrade [indiscernible], but there is a possibility for technological operation, getting access to algorithms, getting access to technologies which doesn't have monetary value, but would have a time value in R&D and especially in post-quantum area, we are looking at accelerating our development by getting access to post-quantum technologies that are being developed in the U.S. and that comes to the industrial corporation. So I think NATO will impact us a lot, I think also European Union and their secret policies. So generally, government awareness of cybersecurity based on the geopolitical situation in Europe. So who is interested, NATO is interesting. And from a technology point of view, the fighter jet opens us opportunities that we otherwise might not have been able to go for.

Next question, which came in advance was in 2020, a contract for the supply of cryptographic products and services were around EUR 20 million was announced. So far, the order has came for EUR 2 million, what does the implementation of remaining EUR 18 million currently looks like?

It looks positive. Of course, 2 years, it's a long time in this technology. So a lot of the customer requirements have been changing in 2 years. So we have ended up doing for these customers and other customers, more professional services on the architectural design of the network topology and architect check getting prepared for quantum safe. So at the moment, parallel to the frame contract we are getting from our customers more work. And that work will lead to the implementation of the rest of the frame contract. But there, of course, I would say, let's see hopefully, when we get the NATO through that we are really, really in NATO, I feel that the frame contract implementation will go faster. European Union gets also clarified with these 2 activities, what does it mean? So I'm confident that we are on the right road. I think the customer is happy what we have delivered, and we are more limited on the customers' capability of executing the rollout than our capability to deliver. So we are trying to help the customer to get their plans clear and move on with the project.

I've still 4 question in advance, but let's take 1 from the chat between, how is Deltagon progressing outside the Nordics?

Deltagon as maybe being a little bit of a disappointment for me outside Nordics. One of the things that we found out that with our traditional SSH customers, the decision makers who buy Tectia, UKM and PrivX, there are different decision-makers who buy people-to-people communications. So building market access to them has been slower than I would have anticipated. I think for Europe, we are on the right way. I do believe that Asia is also -- especially with the big customers, they might be coming up something very interesting. And once we give out of Scandinavia, the average deal size will be significantly bigger, which will easily help us. So we are pretty well covering Scandinavia in the sense that the additional deals and our lead -- land and expand strategy means that the Deltagon average deal sizes are small. When you go for these bigger markets, the deals are 10, 100x bigger, but also then the lead times to close the deals are longer. So that's where we are today.

One question again in advance. Well, maybe related to this, how well and with which products in particular has SSH bind a foothold in the Nordic countries?

In Nordic, Deltagon is important, I would say, also PrivX OT addition has been doing extremely well. PrivX MSP addition has been doing well and traditional PrivX has been doing well. Nordics has very limited customers that are big enough for major implementation of Tectia, a major implementation of UKM and NQX, we have been focusing on the Finnish customer. So it's not yet even in Scandinavia, but we see a lot of potential for also expanding the nongovernmental use of NQX, both in Scandinavia and in other -- especially European countries.

Then question from the chat, cybersecurity company, Nixu reserved a purchase order lately and Nixu's board is supporting that. What's your thinking on M&A and possibilities in that area in the coming months for SSH point of view?

I think we are not in the M&A market on either side of the table. But we see the mix of purchase order absolutely interesting because it has raised a lot of connection from customers saying, who is my trusted friend because what is PMV going to do with it. It's going to be a consulting house for 27001. It's not going to provide maybe the services like security operation center and we can do a lot of automation, helping customers to do their continued surveillance of their networks better. So Nixu offers us opportunities or the change in Nixu's landscape and questions about Nixu's future have been a positive impact for us. But to the original question, at the moment in the coming months, we are not on either side of the table on the M&A activities.

We have 3 questions in advance. [Operator Instructions] What are the factors that make the NQX and crypto particularly competitive and innovative?

I would like to call Cisco on this because Cisco has defined the future of firewall in a way that it does more than firewall that opens and closes ports. It also looks at the behavior, it looks at the access control. It looks at the identity and activities that is going between networks. And NQX is already there, especially with the NQX Zero Trust edition where it's integrated with PrivX. It does exactly what Cisco says what is the future of firewalls. So we don't see increases of firewall. We see this a next-generation firewall, it does more at a lower price. The other thing, which is really unique with NQX, it's a pure software product. We sell it also with the hardware when customer bonds, but it is fully implemented in software. And for the ones who have unique competence, we implemented it, and that was the big investment we did for 1 of our first customers that we implemented NQX in user space application, to intercommunications without system calls that take a lot of time. So by design, we are more performing than any other firewall in the market. And especially if you need to put more demanding algorithms like post-quantum. The fact that we are 100% software based and that we run in the user space, we are more performing. We are not dependent on proprietary hardware, you can run it on any PC, which just the better your network card, the better it from your network connection to the CP with small performance you get. So the hardware has an impact, but it's -- there is no -- I have not found any other company in the world who would have done the next-generation firewall discounts, actually, pretty much to -- back to the NATO question that when you want to implement EU secret or NATO secret level connections between countries or organization's performance becomes a major issue. And we have run some benchmarks that we are 10 to 20x more performing than the people who are running it on proprietary hardware. So we have more performance. We are software-based. And those are the key topics. And with the integration of PrivX and NQX, we are already there with the product that Cisco says they will be made later. So those are the 3 key elements where I believe that NQX in the nongovernmental space and also in the governmental space is technologically superior which is typical Scandinavia and engineering companies. We make the best products, we just don't know how to sell them.

Okay. Then we have new questions in the chat. Thank you for your activity. You have set targets to reach Rule of 40 for the whole year in '23. Rule of 40 is defined as growth plus profitability. Rule of 40 could be achieved by 40% growth and general profitability. SSH is still in the early stage of global scale. Why not to focus more on the growth component now?

Well, first of all, I set the Rule of 40 for this kind of my personal ambition. It's not really a company goal, but it's my ambition to go that way. And I really truly believe that we have to maintain profitability. So we need to be positive EBITDA. I agree, growth is the primary target, but not at any cost. And that's also based on our strength in our firepower in the balance sheet. We cannot ignore the fact that cash from operations has to remain positive, so we can only grow as much as we get money from our customers. That's the reason why I raised the Rule of 40 as my personal ambition, we want to keep EBITDA positive, but the primary reason is to grow, but not at any price.

We are reaching the end of advanced questions. How has the market taken up SSH quantum ready products and in which area do you consider SSH to be ahead of its main competitors?

I think the main thing where we are ahead is that we have the NQX team over 10 people who have been working on this technology for years. We got the funding from the horizon program from EU to develop it. We have 1 of the first products in the market. We have for mainframe computers already, we believe, the first product in the whole world that can do quantum computing for IBM mainframes. And this is all based on the fact that we have the people who know what does it mean to make products that are postponed in sales. We have constantly getting questions, our key people are referring the world talking about it. And the point is we just were in 1 week government fair in Singapore where they really wanted us to come and they said, we get a lot of university people to come and talk about quantum-safe. But we want to get somebody who makes products that are quantum-safe. And that's where we are. We have products. We are delivering them to customers, and we have a development team that has been premium drive together for years. We are -- we have a team, we have a product, and most of the competition is still talking. And most of the money made with quantum computing also with us is actually professional services that we help our customers to make a road map to postpone them. So I think we are considered a thought leader, especially because we have quantum-safe products in the market, and those are few and far apart.

Definitely. Then 1 question from the chat. How do you see personnel development in 2023? Are the major needs in R&D or marketing?

I would say that we have all hands on deck. We have done a lot of development last year. This year, I don't see major need for total team size improvement, I think we have -- if I would invest something extra now, it's more on the go-to-market, out-of-pocket marketing spend than getting more people. So don't expect a lot of headcount increase. I expect that we are driving for growth with the current team with all hands on deck.

And then your last question, which came in advance. And you have still time to raise a question, dear guests. So last question. When do you expect SSH to be included in the PAM Gartner Magic Quadrant? What is the key?

1 key is the size of the PrivX business, they take only typically companies that have -- on the Magic Quadrant and relevant base revenues at the level of EUR 10 million plus where PrivX is not yet today. However, we have been able lately to be in 2 analysis from Gartner Group. We have gotten a lot of peer reviews about 20, giving very good remarks. So I feel confident that we are on the radar for the Gartner Group that makes Magic Quadrant, we have a constant dialogue with Rami and me with the Gartner guys. So they know we are here. They know what we are doing and they want to see more hard evidence that we are really continuing the PrivX growth be in critical mass that we can be compared to companies that are focusing only on PAM, and they are 10x bigger than we as a whole company. So we need to grow PrivX as we have done, keep the percent growth as it has been, even though it means more absolute dollars, then I think we can get to the Magic Quadrant in the near future, but it's not my choice. I really can't say a timeline.

Yes. So looking at the chat and the e-mail, I don't have any more questions to raise, if you will have some more questions, you can always write us, write me and I will find the answers for you. Thank you, dear guests for participating in our call for your activity. We have, again, a lot of different good questions. Materials for this call is actually already on our sites, but the recording will come also soon later this day. My name is Lauri Koponen, and I work as a company's Communication Manager. And we have a lot of different content webinars and events, again, coming. We are going next week already to London, Gartner events and so on. So please follow our channels, LinkedIn, especially and Twitter and our web page and join the discussion about the future of defensive cybersecurity. So thank you, Teemu, and thank you. Yes, and have a good rest of the day.

Thank you.