SSH Communications Security Oyj (SSH1V) Earnings Call Transcript & Summary

Welcome to SSH Communications Securities Investor Call for Q2 of 2024. I'm [indiscernible]. I'm a finance member here at SSH and I'm responsible for our Investor Relations. Presenting the results is our Interim CEO, Rami Raulas; and our CFO, Michael Kommonen. After the presentation, we will have a Q&A session. [Operator Instructions] This call is hosted with our own solution, SSH Secure Messaging. The call will be recorded, and the recording along with the presentation slides will be available on our website. And now it's time to start the presentation. So I would like to give the floor to our CFO, Michael. So please go ahead.

Thank you very much, [indiscernible], and good morning also on my behalf. So let's jump into the numbers of the second quarter of 2024. In the second quarter of this year, our net sales grew by 4% and EBITDA was EUR 0.5 million. This was an improvement from the year-ago quarter when the EBITDA was EUR 0.1 million, so EUR 400,000 improvement. Net sales reached EUR 5.1 million, and on the sales side, we can also see that subscription ARR grew 8.2%, while actual subscription sales of PrivX grew 21.2% in the second quarter. The improvement in profitability in the second quarter was mainly driven by cost optimization and cost controls throughout the organization, as the overall sales growth was relatively modest in the second quarter. On the market and portfolio side, in the second quarter, we received new orders for NQX, and we also invoiced the first installment of the cryptographic solution that we announced in the first quarter of this year. Our pipeline grew across all geographies in the second quarter, and we also announced -- or we've also achieved both new partnerships, and we also closed new deals through partners in the second quarter. On the product side, we launched SalaXâ„¢ solutions for secure communication, and we also achieved the first customer wins. Rami will talk about that in a moment in a bit more detail. On PrivX, we had PrivXâ„¢, 35 launched in the second quarter with significant improvements in functionalities in the PrivX product. Here, we can see the trend of the sales and EBITDA performance over the quarters. So overall, the overall subscription sales grew nearly 11%, 10.9% for the second quarter and the deferred revenues declined, somewhat reaching EUR 11.3 million or being EUR 11.3 million at the end of the second quarter. The deferred revenues' fluctuation mostly has to do with timing of the invoicing in between quarters and months. EBITDA, as mentioned, EUR 0.5 million, EBIT still negative EUR 0.5 million and the cash flow from operations in the second quarter, which is typically seasonally weak, on the cash flow side, was negative, EUR 0.8 million. So with this, I will hand over to Rami, who will go through the business highlights in greater detail in the second quarter.

Thank you, Michael. Good morning, and good afternoon to some of you. [ Well star ] revenue growth was maybe just moderate. In Q2, we had progress in multiple fronts. For instance, our business in APAC grew 44%, slight growth in U.S., Europe was a bit flat. Many of the deals that we were anticipating were being delayed. And we, as Michael mentioned, we were able to get quite a bit more invoicing from new orders in Q2, which will show in revenue later on because of the subscription model. And we also, as said, we're able to increase our pipeline fairly significantly in Q2 in all the three regions. So with that, I'd like to share a bit more of the progress or background of other activities and achievements that we had in quarter 2. So we continue -- subscription-based sales is now 95% of our business. We work through partners. Our growth is driven by partnerships and building stronger partnerships and building more partnerships globally. We are a security company, so we need to be a secure company. So we achieved yet another certification for that. SalaXâ„¢ came to market for deliveries. We announced -- maybe the biggest announcement ever for PrivX since its birth in 2017. And we finished the organizational changes in 2 steps: first, on the top management and then throughout the whole organization with the restructuring altogether. So those are the main areas. And I would like to go a little bit deeper in some of them as well. So like I said, we had 11% growth for subscription-based sales. PrivX still continues to be our growth engine. We had some significant progress in many fronts in that product and solution area, especially integrating that with key management. And we -- our ambition always has been, in the past couple of years, to move Tectia also to subscription business. And now we are seeing some early ties on that as well, moving to subscription-based revenue for our main product there. So we further strengthened our partner network. So we got a few interesting and important deals [ through ] partners, for instance, for banking, for main frame security in Italy, and in Europe, heavy engineering, manufacturing, operational technology security, [ case ], fairly significant, also IT/OT convergent solution there and an insurance company win through a partner in South Korea. And like I said, we achieved also a security certificate for the ISO 27001, which is the international standard for information security management systems. So we passed that. We worked with [ DNV ] as an auditing company for that. And this is incremental to our earlier certifications that we have as a secure company. So I thought I would explain a little bit more what's being a secure company, delivering cybersecurity solutions actually entails. So like I said, the ISO 27001 certificate was received. This is me and Pauli Haikonen, who is responsible for the process with us, proudly receiving the certification in Q2 in June. But we also have been certified by the Finnish Defense Forces as a facilities security company. [Foreign Language] Apologies for the Finnish language. For the international audience here, this was received multiple years ago and has been renewed since. So it's just a statement of our secure operations and secured premises. We make sure that our solutions and products are safe and secure as opposed to perhaps companies using open source, needing them to find support wherever. So PrivX, NQX, SalaXâ„¢, Universal Key Manager and Tectia . And the way that we work there is that for certain of our solutions, we also get accredited or certified by the National Cybersecurity agencies for confidential and restricted level, Tier-III, Tier-IV level. So we received yet another certification for that for NQX, the Network Security Solution, the latest version of that. And we do a very rigorous testing of our products, and we use external partners to do pen-testing and security code security testing quarterly. Actually, here is a result of the most recent pen-testing for PrivX as our lead product, where the rating for security was awarded to be excellent by the external auditor. Okay. So that was about security. Then a few words about -- on products and organization. So on the solutions side, we brought to market now, Secure Collaboration. It was rebranded SalaXâ„¢, and [indiscernible] and so on and so forth. And we achieved first customers for the solution suite for secure mail, secure messaging, secure chats, secure rooms, secure file sharing, and secure video and audio calls as well, like today, where everything is encrypted, so no data can leak from the system to external parties. And we were engaging with campaigns to promote a new solution in the Nordics especially, and we actually have now first trials in Central Europe as well. As I mentioned earlier, PrivXâ„¢, 35, it's come a long way in a few years, was released in Q2. It is the biggest individual product launch since its birth. And we are driving the market to modern architecture, microservice architecture, immutable architecture, ephemeral certificate-based access, or ephemeral access to modernize and get away from the huge overhead on infrastructure and having to manage with passwords, or having to rotate passwords. That's where we have gained traction with PrivX in the past years but we also have recognized that there's a journey, there's a transition, so customers need to move, first, getting control of their current secrets and then moving to a modern way of handling them without having any keys or passwords to be rotated or to be renewed. So with that in mind, we released a few new functionalities into PrivX. One is the discovery of existing accounts and onboarding of Domain Accounts and automatically then embedding them with Password Rotation if customers are not yet ready to move to ephemeral short-lived token-based access control. We made enhancements to Secrets Vault for Secrets Management and Password Rotation, once again, just to help customers take first step in under control and then move to the modern architecture of [indiscernible] computing and ephemeral access. And in that area for the ephemeral access, we made significant gains in the performance of the system for that and Zero Downtime update. So there's no gap when the solution is updated. And as you can see, we're already in version 35. So it will be updated a couple of times a year. That there's no downtime. Now we have a customer in the manufacturing area, semiconductor area, and there's about 0.5 million connections per day going through PrivX between systems. Now first of all, you need to have -- we need to have the performance so that there's no lag in those. And because of the architecture of PrivX, it can actually handle -- we have tested up to 1 million concurrent sessions per day, which is, I think, unique. I don't think any of the legacy PAMs that we compete against would work. They would choke simply or will be too expensive to facilitate them to work with that amount of traffic. But then when you have a million connections per day between systems, then there can't be any downtime. It has to be up and running all the time and those are the improvements in that solution area. And then we finished the organizational model in March. We moved to a more simplified leadership model with 3 regions: Americas, APAC, and EMEA and 3 business units: Secure Collaboration, Network Security and Zero Trust. And those changes were now taken further in the whole company and the necessary changes in personnel and organization structure were implemented. And now we are starting off with a new base. It's actually quite significant change. There are 12, well 13, me included, managers in new positions, new or enhanced positions, which I trust will give us a much more effort in instigating even a higher performance culture than maybe before. And on the organizational front, we are continuing to invest in resourcing in -- especially in the United States market. That is the biggest market. We haven't been able to show that significant growth there. We renewed the [ theme ] a couple of years ago, and now we're making further enhancements to have more capabilities to win more business in the U.S. market as well. Yes. So those were the advances in quite a few areas. So we're trying to improve in many fronts. It's not just on the products, it's not just on the sales and marketing side, it's also on the operational and organizational model. So, I wanted to finish here talking a little bit about the kind of tailwind or opportunities that we may have moving forward. And I'll show you a few slides on those. Okay. So we've been talking about Zero Trust, OT, and Quantum Safe. That's future investment for us for future growth markets remains, no change in that. But on the post-Quantum or Quantum Safe market, there is a couple of advancements coming out. On this, the standardization organization in the U.S. is releasing now as we speak, the post-Quantum crypto so-called [indiscernible] protocol choice, which then companies like us need to implement. And also in Europe, the [indiscernible] which is another algorithm, is also being standardized upon. And we are bringing those to our products as we speak. So we are one of the first ones. We were one of the first ones with preset key sharing for Quantum Safe and now with the key exchange and encryption algorithms as well. So we've been in the forefront of that, and we will continue to be so. But there's also government focused now in Europe as a whole, U.S., Singapore, and elsewhere. This is the latest news from the Finnish NCSA just about a month ago, saying that and I'll turn on the English text there. The National Cybersecurity Agency recommends that organizations start making preparations for the adoption of Quantum Safe algorithms. So there's more and more mandates for organizations to actually do something about it, not just wait or not just ponder whether this will be important or not. In the U.S., it's a law, the legislation mandates this. It's a nation -- national or nation-topic. It's important enough to protect the whole national secrets. We've been having success with SSH Key Management, no surprise. I mean, we are the founder of SSH and the SSH Keys and also the first one on the market with management of those key [ scores ]. They spread like wildfire or cancer, if not controlled. But we have been struggling maybe a little bit. I mean customers not seeing the real importance of that. I mean even if you have a password vault or secrets vault, even if you have a PrivX Access Management solution in place, they are fairly easy to bypass by just using SSH keys. We talk about PAM-bypass or transitive trust or rogue keys for access. But now there was a significant change in the market with the market consolidation. So the market leader CyberArk bought Venafi, and I feel that this is a really strong statement for the recognition that this topic has to be taken now, finally, more seriously. And we have a very competitive solution there. It is much more competent and has many more features than the competition there. And we're the only ones who can provide automatic transition for managed keys. So not knowing where keys are into managed keys and from managed keys to ephemeral access, so fully automated without having to manage or rotate or renew keys anymore. It will all be done automatically in a highly secure manner. And for that, we have -- we started 3 new proof of concepts with major finance institutions across the globe actually, in all regions. We have now 3 projects that have been committed to that will start later on for the migration from key management to ephemeral access. So customers are even now asking for this. And additional to that, many customers are coming to us looking for an alternative or future alternative to just vaulting secrets, using products like [indiscernible], wanting to kind of mitigate the risk of secrets vault and finding a way to migrate to ephemeral automated immutable access, which is the future, definitely, as all the analysts are saying as well. And thirdly, there's a really clear need for secure collaboration, you know, Teams, Slack, whatever people are using on-premise, Skype in governmental institutions. Of course in many of the secure organizations or secret organizations, they won't let their communication to be handled in the cloud by international companies. They want -- they need to have their own [ instances ], they need to govern the data. They need to have their own data, sovereignty to handle it. And there's a few drivers there. First of all, on-premise Skype, which is used by many governmental organizations across the globe, will come to an end. It has been end-of-lifed already some time ago. So there needs to be a replacement for that. Customers are concerned with the data sovereignty. The recent one was from 2 days ago from Disney. So Disney's Slack was robbed and thousands of channels. So for instance, all the information about new upcoming products like movies is now out in the open, that's not good. So we used to protect servers and databases, that's where we all come from Privileged Access Management. But now we need to protect the same way also the secure communications platform. So the communication platforms, Teams or Signal or WhatsApp or Slack, as we mentioned. And that is unique, the way that we do it is that, for instance, if you store files in the secure messaging platform, they are all encrypted individually. So nobody can steal them, nobody can do anything with them. And indeed, we have now trials and negotiations ongoing for SalaXâ„¢ with multiple customers. So this, I feel are very positive trends for us that we can bank on, and we don't have to change our offering, we don't have to change our tactic or strategies, which [indiscernible] have to do more. And finally, on OT, the OT market demand itself is accelerating. There are a couple of drivers for that. First of all, demand to fix OT security is becoming more prevalent in all companies. I mean the attacks and ransomwares are just happening all the time. And OT by design, as we have mentioned many times over, OT by design is not really protected. It's isolated but not protected. And the access methods are not encrypted. They are open text with the industrial protocols. So there's a need to change that. There's a need to take more control of that, especially when more and more of the control of critical infrastructure: electricity, water, and manufacturing sites are being controlled from outside, not just on the site, on the plant. There's also a need for converging IT and OT [indiscernible] they are separated now. Networks will continue to be separated, but the convergence of IT and OT is a big topic at the moment. And we stand in a very lucky -- in the planned manner, in the lucky situation that our solution, PrivX together with NQX, actually works both for OT with OT-specific functionalities and services and network structure support and for IT. And indeed, we have now 2 customers recently, which are implementing either first IT and then OT with our solution or first OT and then IT with our solution. So that seems to be working pretty well. Our OT team is making good strides in building the pipeline. We've been in some -- quite a few events, creating new leads. And with the lead of Massimo Nardone, who joined us for Q2 for the lead of OT team, we are now pushing that forward. And we indeed have had quite a few events. We had 2 webinars, one on the paper and pulp front, together with Stora Enso, very happy customers, satisfied customers in that front. And another one for port operators and maritime together with Port Technology International, Ericsson, and OneLayer, a very successful webinar as well. And that was really timely topic these ports. And you see a couple of our use cases there in the picture as well from our customers in that space because we had a briefing for a [ Gartner ] analyst, [ Patel ], the other week, and she brought up also that one of the kind of hot topics or urgent topics, especially in the U.S., is maritime and ports and port operators. So we are right on the right topics there. So, I remain positive for our opportunity to find avenues for growth and to improve our profitability. And with that, I would like Michael to join me here to say a few words about the outlook as well. Thank you very much.

Okay. So the outlook for 2024, we are -- it's basically unchanged. We are reiterating the same outlook we've given previously. So we expect net sales to grow during 2024 compared to '23. We estimate EBITDA and cash flow from operating activities to be positive for 2024. And at the end of last year, ARR was EUR 19.3 million and in 2023, our net sales grew by 5.4% to EUR 20.3 million, and EBITDA was EUR 1.8 million.

And that brings us to an end of our presentation today. Back to you, [indiscernible].

We will now move on to the Q&A session, and I will shortly check the chat for any questions. But as has been tradition, the first questions will come from Redeye's equity analyst, Fredrik Reuterhall. So Fredrik, if you're ready, please go ahead.

So my first question is regarding the subscription sales and PrivX. Is the performance growth from the new partners you mentioned? Or if not, can you talk more about what region and type of customers that is driving the -- especially the PrivX growth?

Yes, I mentioned one new customer in Q2, which is a manufacturing -- heavy-duty manufacturing. That was an order, not yet revenue. And then we had some MSP expansions and most of the business comes through partners. So we have engaged, like the one that I mentioned, CANCOM in Central Europe. They're a large partner, EUR 1.5 billion revenue, 5,000 employees. There's a lot of pipeline there and some initial wins now from there. So not particularly any specific domain or any specific partners but kind of across the board.

And Michael, can you remind me the PrivX growth were in Q1?

Yes, a bit higher above 44%, if I remember correctly.

And then you talked about the new certification of the NQX and you just released an updated version there. And you announced some orders coming in. Is this due to a positive NATO boost? Or is an overall demand from, I mean, defense and infrastructure industry?

Yes, this is continuing on the major deal that we announced a couple of years ago already. So it's expansion of that. And of course, all the new versions need to be certified for that. So of course, there's more NATO members nowadays. So it's related in a way but not driven by that, per se. But we're also one of the new customer wins for NQX was from the communications and defense area. We cannot mention the name of the company, but the area they operate is in communications and defense related activities.