Yubico AB (YUBICO) Earnings Call Transcript & Summary

Welcome to Yubico Q2 2026 Report Presentation. [Operator Instructions] Now, I will hand the conference over to acting CEO, Jerrod Chong; and CFO, Snejana Koleva. Please go ahead.

Hi, everyone. Thanks for joining us. We will walk through the agenda and we'll give you our key highlights. And I'll hand over to Snejana to give you the details on the financial details. For those who are joining us and not familiar with Yubico, we are a very innovative cybersecurity organization that continues to innovate and produce products that help companies around the world be phishing-resistant and prevent account takeovers. We are very excited to share our report, but we do have a good, strong list of our customers around the world. We've been around for more than 20 years and with a very strong direction to continue our global expansion and serve many more customers over the next few years. I want to take a step back and provide an update on how we look at our industry, the trends that we see and the type of news that we are also part of in terms of cyber activities, both on the positive side as well as the threat landscape that we see customers and organizations around the world face. With AI being much more powerful with all the new models, we definitely see that the attacks are not just much larger in scale. We see that they are much more sophisticated. Many of you are aware that even these models have known to attack organizations without the controls that we expect some of them to have. So that is just what we know. And we know that there is a side that many organizations are faced with that is increasing. The good side of that is that we believe that access to these very powerful models must be protected, so that the accounts do not get taken over and the attackers use these very powerful models to attack organizations. So we really believe that this trend will continue to happen. And we continue to help protect organizations from not having their accounts taken over. The other area that we are very much in tune with the industry is how the post-quantum evolution is happening. A quantum computer would break a lot of the -- pretty much all of the existing technology stacks that we use for cryptography. So what that means is that you need a technology that is post-quantum ready and we are part of that journey. So we will talk a little bit more about that type of innovation as we bring a YubiKey that will have post-quantum capabilities. The other trend that we see is that as we continue to see weaknesses of how the software supply chain is being impacted, governments around the world are doing 2 things. They want to make sure that any product has been properly reviewed. And that these products as well as a maturity in how companies build them. And so we continue to invest in making sure our products are compliant with all the new regulation. We also help set some of these new regulations for the authentication industry. But that just gives a disciplined way to build products. And so we are very much in line with how industry should continue to close these loopholes when they build products, so that we don't introduce new risk to companies deploying products in general. And the last area that we see is organizations are definitely concerned with identity, digital identity. We see that they are being attacked by all types of different hackers around the world, mostly because they -- it's much easier and it's much cheaper. But what the attackers are focused on is to downgrade the way that the users authenticate to be able to social-engineer their way into compromising the user accounts. So rather than just focused on the login to an account, a lot of companies are paying attention to how the users recover or get access back to the account when they have a recovery option. So recovery options are typically very weak. And that's where the attackers are focusing their efforts to compromise the accounts. In the next slide, I wanted to give a highlight on where Yubico has been in the last quarter, but more collectively, what we see are the continued investments for our growth. Product innovation takes center stage in the way that we look at our business. We are very focused with delivering products and innovation that solves our customers' problem, namely in the first half and in Q2, releasing 2 types of YubiKeys. One focused on the regulated industries, particularly as we described, companies want to be compliant. We've released our FIPS-validated devices, which is relevant in a lot of markets around the world. And then, we've also released a YubiKey that extends capabilities beyond just authentication to being able to perform authorization. And authorization is really important in the concept where it's not just who you are to be able to identify that you can log in. But do you have the right to do something besides just authenticating? And do you have -- are you the right person that is authorized to access the right system? So authorization plays a very important part of this evolution, particularly in the AI realm where you need to know who you authorized to use what and what agent was authorized to take action on your behalf. From the commercial side, we continue to partner very closely with OpenAI in terms of how they view our technology as part of their defense strategy against account takeovers. And as I mentioned, the goal is to make sure that when you provide the companies with access to the most powerful models that you can add a very high amount of assurance, ensure that it is actually the right user that is accessing those models. And other news, we continue to expand the support for different operating systems and browsers to make the YubiKey and the standard, the FIDO standard, more easy to use. So there's a huge focus on usability. A good security or great security can only be adopted at scale when it's easy to use. From an internal perspective, we continue to make the necessary adjustments for how we view growth in areas that we see huge opportunities. So we continue to rebalance our portfolio of resources and investments to areas where we strongly believe are needed to grow the organization, which also means that we would reallocate resources to those areas. So that is reflected in some of the adjustments for our reduction in force and to really organize our organization for scale and efficiency. We see some of the results in this quarter or in the last quarter. Finally, just to highlight, we continue to want to share details of how we grow. And we are going to have a Capital Markets Day in November. So stay tuned. We look forward to seeing a lot of you there. A summary on top focused verticals that we have invested in and we'll continue to invest in. You can see a significant growth in the key industries over time. We continue to see this trend be fairly stable. The growth areas in the last quarter has focused on high tech and public sector, and public sector includes the defense industrial base. And the reason we see that is part of the evolution of newer threats, and these type of organizations want to be ahead of it. Technology include a lot of our organizations investing in AI. So they certainly want to get ahead of the cyberattack trends, so that they can defend against that. We also continue to expand our relationship with our ecosystem partners, which are also our customers, but they also provide a lot of joint integrations for our customers around the world. For example, companies like IBM, for example, companies like Okta, which is our partners that deliver end-to-end capabilities for protecting user identities. Key figures for Q2. Overall, the numbers are in line with the direction that we're going. The investments that we made to really be efficient affected clearly, obviously, our profitability. But it does also -- when you have a more efficient organization, you also affect our net sales to be able to realize those bookings in the way that we can reflect in the revenue. And from a bookings perspective, it is lower compared to last year. Part of that journey for us is to make sure that we built resilience for differences in how companies buy, the buying cycle. So what we'll explain a little bit more is how that resilience is showing up if you get to the details. So for example, we don't just depend on 1 or 2 deals to hit our targets. We are really looking towards making sure resilience means that we have a portfolio of companies that we can sell and make products to in all segments throughout the world in both small, medium and large. So we'll get to the detail of that. And I think we are positive in the way that we have made those adjustments to provide resilience and scale to our business. With that, I'll hand over to Snejana for the details.

Thank you, Jerrod. So if we take a closer look at the quarter-on-quarter development versus last year, we continue to have a somewhat negative impact from the currency. But this impact is starting to subside as the exchange rates are now kind of more similar to what they were at this time last year. So order bookings, organic development, minus 5%. Net sales perspective, we have 12% organic development, very positive growth. On EBIT, we continue to have negative impact from currency of SEK 10 million. But we have also increased quite substantially the EBIT and the profitability as compared to Q2 2025. So we've added 12 percentage points to the margin this quarter. From an order size point of view, as Jerrod mentioned, the resilience -- the work on resilience continues and it's evident in this quarter. The small and midsized bookings developed very strongly with 18% growth. In Q2 2025, we've had a large multiyear subscription order. And this quarter, we have primarily smaller and midsized bookings, but very good growth in this segment. Also, what I would like to mention is that we have a very strong EMEA growth. We are expanding and working very closely with our channel ecosystem and that is evident in the EMEA growth. YubiKey as a Service, our subscription offering, represent a 24% of the total bookings. Let's zoom in on the perpetual first. The perpetual bookings grew with 7%, again, primarily deals below $3 million. And from a revenue perspective, we grew the net sales with 9%, excluding the currency impact. As Jerrod mentioned, public sector remains our largest contributor in the perpetual bookings for this quarter. Part of this is defense. And we also have very strong performance in the high-tech sector. When it comes to YaaS bookings or Yubico as a Service bookings, as I mentioned, we had a very large booking last year with a multiyear subscription contract. This year, it's primarily small and midsize bookings orders, and the growth there is very healthy. From a subscription net sales, we continue to see very favorable development, 27% growth versus quarter 2 last year. And that is a reflection of our growing annual recurring revenue. The annual recurring revenue bridge, if we compare year-to-date, it has grown 12%. And the growth comes primarily from expansions of our current base. So these are customers that either expand with more licenses or they might be upgrading also to a higher tier of subscription. But we also have new contracts that also drive growth. What we are very proud is that our nonrenewal rate or churn rate is quite low for the industry. So gross retention rate is 98 and the net retention rate is actually 107, driven by the expansions of our customer base. When it comes to profitability, both gross profit and EBIT performed very, very strongly. And in both metrics, the net sales have a high impact. Even in gross profit, we do have a portion of fixed costs for the teams that work with our supply chain and logistics. So a strong sales quarter also supports a strong gross profit margin. So the gross profit of 80% is within the guided range on the higher end of the guided range. From an EBIT perspective, we see the impact, of course, of the cost savings program and the net sales, the good quarter of net sales. So we have reached -- we have reported SEK 79 million of EBIT and 14.4%. The cash flow for the quarter. So strong cash flow from operating activities before working capital changes, of course, driven by the high profitability. We had a negative development in working capital. That was primarily driven by higher current receivables, again, driven by net sales. While the inventory actually continues to decrease and had a positive impact on the cash flow. The investing activities, SEK 19 million. The majority of that is related to capitalized development costs for our R&D activities. Financing activities is primarily lease obligations. So a bit weaker cash flow for the period of SEK 29 million, primarily due to the change in working capital. But we remain with a very healthy and strong cash position of SEK 1.02 billion. And with that, I'll give the word to Jerrod to summarize.

We are driving towards the key areas that we've set out to do since we've communicated to the market earlier this year and also from the last Investor Day, really focusing on the strategic pillars, we call them. And the first 3 of them are very much about product innovation and product execution. So we continue to really focus on driving that really hard, so that we deliver the next-generation products that will help protect the organization from the next-generation threats. That's the way that we look at it. And with that, we have the things we care about, which is the hardware. We care about the hardware. We care about the services that make organizations around adopt the hardware as quickly and effectively as possible. And that's the #2 pillar, and where we are going for the #3 pillar, which is really focusing on not just that hardware, but focusing on the user using their hardware, which is really protecting the user using the hardware. So that if they are -- if they need a recovery solution, if they need to what we consider reenroll because of new things and new threats, they can safely identify themselves to be able to reuse and get access to the systems they need to get to. So thinking of a resilient organization. So those are the services that we want to bring to the table to help the organization be resilient as whatever new threats comes to the organization to protect the individual user, particularly obviously, the digital user identities as they navigate the new digital world. The last 2 pillars are really about driving towards -- this should be consistent throughout the world where we continue to expand both our sales operations, but also our fulfillment operations, so that we can get to customers around the world. And finally, we must focus on making it easy to experience working with Yubico and experience using the technology. The way to simplify to make sure that usability is top of mind to make sure that we take care of our customers in a very holistic way. So those are the key focus areas. We'll certainly dive into all the details when we get to our Capital Markets Day. So I look forward to seeing many of you there while we provide a very deep dive in all these 5 areas. With that, I think we're going to open it up for questions and answers.

[Operator Instructions] The next question comes from Simon Granath from ABG.

Many of your peers have seen a significant share price surge in light of the Mythos moment and some talked about this giving them imminent sales tailwinds, while other anticipate the narrative to give better effects midterm. How would you describe the impact on Yubico so far? Have you seen any changes in demand over the past few months that is trickling into orders? Or is this so far only at an awareness stage? That's my first question and then I have a follow-up.

Yes. In terms of the cyber landscape, we are part of the cyber landscape. We are part of how organizations use technology to both defend and increase productivity in this particular case with the Mythos scenario, which is about how do we equip defenders with the best technology to defend the organization. We're certainly part of that, whether it translates into exactly how things are aligned with the other cyber companies. From our perspective, a lot of the cyber companies themselves use our technology. So really is about a broader adoption of the relevance of the product globally, so not just concentrated in one market. I would say that the way we look at that is there's 2 areas. The first area is we're part of cyber organizations or cybersecurity portfolio of products. But we continue to make sure that our technology can be available everywhere in the world. And sometimes that poses some challenges, right? We have a physical product. We have to make sure that these physical products make it to the users in all locations around. So sometimes we see that there are logistical things that we got to solve. And part of the conversation was that why do we see a lot of smaller orders and what are the conversations with regards to the larger orders. And because of some of the geopolitics, we have a realization that large organizations, some of them do buy locally to move faster, right? So that is part of some of the impact to the physicality of the product, but also because there are geopolitics and tariffs around the world. So it changes the buying pattern. That's what we're trying to say. So demand is not -- demand continues to be strong. But how they actually get the technology can sometimes take certain detours. In terms of the second thing that I would say about the cybersecurity is that we also have to work towards activating beyond the Mythos conversation, which is what is the new threats in terms of the -- what we call the cryptography, which is about the ways technology is built on top of the fundamental cryptography. And that is related to the quantum computing, right? So we think about quantum computing as a next-generation of technology that would further accelerate development of all new products around the world because quantum computer can do a lot more things than, what we consider, a classical computer can do. And because of that, these conversations we're having with our customers that are in the leading edge, right? And we see that they are concerned, the market is concerned, the governments are concerned. So it will ultimately translate into customers wanting to get the latest generation of product. But there's a lot more buildup that will happen as we continue to push on that new front as well. So the long and short of it is we see demand. And -- but we don't always control every single cycle that the organizations are adapting to the new world order of adopting technology.

That is helpful. And on cost levels going forward, you have, of course, recently completed the cost savings program. But demand is now looking to improve with further tailwinds into H2 like the OpenAI mandate that you mentioned in the report. Does that improving backdrop mean that you'll start recruiting again? Or do you see enough capacity in the current cost base to capture this growth without adding more headcount?

I think we want to have disciplined growth. So what we -- we don't want to have knee-jerk reactions to everything. So what we've done internally is to really focus on where we need to invest. So we just have a disciplined approach now to think about investments and how we measure return on investments. Some of it will translate into headcount for sure. But you will see Yubico focusing on areas where it may not always be headcount, right? So we will invest. That's the story there. And some of those investments will translate into headcount.

The next question comes from Predrag Savinovic from DNB Carnegie.

I want to dive a little bit deeper in the comment around the post-quantum key, which is quite interesting. And if you could elaborate a bit further. You say you engage with some key stakeholders around this long-term migration strategy and usage, and you say that this has increased as well. What does this mean in practice? Are they translating to any commitments? It sounds very significant to us, but is it significant?

It is very significant from a technology evolution perspective for the entire world. And we are part of standardizing a lot of the algorithms or implementation of the algorithms into different technology that we created. For example, FIDO, we want to make sure that the FIDO technology, some of you may know the Passkey technology is quantum ready. So we are very much part of that. In terms of discussions, yes, absolutely. We are working with -- you can think about the hyperscalers that are certainly concerned with this risk. Because if you think about what it means, all infrastructure that is provided online in the digital world will be impacted, right? So any type of product services that is online, whether you do compute, whether you do storage, whether you do analysis, whether you do financial transactions, like every system that is digitally bound will be impacted by a quantum computer. So the folks that are spending the most time on this area are the folks that have the most digital assets and the most digital presence and most of them are infrastructure organizations, right? So we work with them. And it's not like Yubico can solve everything. We are part of the bigger puzzle. But by leading the way, we help bring together these ecosystems to discuss and collaborate at scale. And certainly, when those we consider them integrations happen, then we are at having the front seat to the adoption curve.

That sounds very interesting. Do you expect large orders to return? Or do you expect the medium order trend is sustained and that even large customers become more distributed in their purchasing, even one of your large tech companies that they don't buy 200,000 keys. But they get 20 and 20 and 20 again, which seems to have been the trend recently.

Yes. I think -- so the trend, I think it's a larger conversation, right? I would consider the larger conversation to be the state of the wall. And so if you collectively look at the state of the wall and then if you have protectionistic approaches, then you will see some of that happen. But what you also see is that attacks don't really stop. It just continues to expand. And so sometimes there's an inefficiency to buy locally. And I can provide a glimpse that different companies have different strategies when that happens. Some may say, "We'll still take the local approach, which is distributed." But some become like, "We can't really do that because of the way that we model risk." And then they would then anticipate, "I want a central buy." So I do think that the macroeconomics actually affects the way that our customers buy. There are customers at the end of the day, where our focus is to grow our business and protect more users. I would say that there are signs that customers are like deciding that sometimes distributed buys are not as effective or efficient. So we are -- we will see that mix change over time. And I think it's really hard to predict really quarter-by-quarter. But over a long period of time, we will absolutely have large deals. This is just the reality of how if you look at our way that the companies buy in the last 4, 5 years, it's been like that. There are like certain trends of how organizations think about risk and then how do they make purchasing decisions. So I don't want to say when. I don't want to -- but because these are large organizations with a lot of risk implications to how they adopt technology. And then we're not certainly the only company in this type of scenario. But if you look at our trending overall, yes, large deals are part of our strategy to grow.

Okay. Brilliant. And then finally, do you have confidence in that this recovery trajectory for the organic growth as you saw now in the second quarter can be sustained for the remainder of 2026?

As long as we deliver on the products that we've committed to and add the value that we believe that we can achieve, then the numbers would follow accordingly. So I -- and I've said it in the past briefings as well, and presentations, watch for our product announcements because that's the indication of our growth, right? So when we add new products that have new capabilities that solve customer problems. And we have a very strong base. These customers would invest in Yubico. So as long as we do that in a consistent way, in a scalable way, in a quality-driven way, we will absolutely grow.

The next question comes from Erik Lindholm-Rojestal from SEB.

You mentioned e-commerce as a driver to growth in the report. I mean, has there been any changes in activity from consumers after the announcement of the OpenAI partnership? And how much activity do you see from that specific channel in itself? I'll come back with another question.

Yes, mass market is definitely one of our bright spots as we grow the business for Yubico. And it does 2 major things. The first thing, it's a fantastic way for our customers to try the product without -- it's both efficient because it's -- a lot of our customers buy it at the list price, right? So it's very beneficial from our perspective. But the more important thing about the mass market, it drives awareness because those are things that we can see immediate trends to how the growth are. And I would consider mass market not just about the end users. There are a lot of even large enterprises that buy through these mass market channels. And we've also launched the retail business, right, in U.S., we are launching it in Europe as well. We want to make the technology available to customers how they want to buy. Because when you get attacked, you really don't sometimes want the inefficiencies to go through a certain process to get a product. You need to get going right away, right, in certain scenarios or you want to try it out in a certain way. So we want to meet the customers where they are. But the exciting thing about the mass market itself is it really generates the -- I consider the self-awareness within an industry because people can talk about it in forums and it's available. And what we want to continue to invest, particularly in the mass market is to make more venues where users can buy easily, low friction and then help them curate the stories, which means a lot more education and how to set it up and how to use it type of approach, which is self-service. So when we get a self-service engine going -- and I consider product-led growth here. Once we get into some of these product-led growth capabilities, we will really see that engine actually help significantly also in our enterprise business or large deals. So it's hand-in-hand. It's not a separate type of motion. We consider it the Yubico motion. In some ways, the tip of the spear, our indication of the future or whether there's a market, there's a customer base, there's a certain trending. We get a lot of that feedback from the mass market numbers. So that's very encouraging for sure.