Cybersecurity growth comes with cash flow at NCC
When Adam Palser became CEO of NCC (NCC) four and a half years ago he inherited a mess. In 2015, the cybersecurity company raised £126m from shareholders to fund two acquisitions which the previous management team later admitted they had overpaid. An impairment of £62m was eventually booked in 2017. At the same time there were other ‘significant charges’ including provisions for long paid leave and illegally paid dividends from undistributable reserves .
- Exposure to the cybersecurity market
- Strong cash
- Pricing power
- Well-connected new CEO
- Recent recruiting issues
- Historical governance issues
- Slow growth of resilience activities
Broker Peel Hunt called it “the most disruptive times for [a people business] of living memory”. In 2017, NCC recorded an operating loss of £53.4 million, compared to a profit of £11.4 million the previous year.
Palser is stepping down next month and will be replaced by Mike Maddison, until recently head of cybersecurity for Europe, the Middle East and Africa at auditor EY. But thanks to his good work streamlining the business through multiple divestments, the business is in much better shape than when he found it. Peel Hunt, for his part, has seen “a sea change in the management control systems, general professionalism and resilience of NCC”.
The human touch
CNC is made up of two divisions. The largest, assurance, hosts cybersecurity advisory and consulting services that help customers better identify cyber risks and put processes in place to reduce the threat, including recommending and deploying the most appropriate software. Unlike other publicly traded e-businesses, it is a people-run service rather than a software company.
This may seem disappointing for investors eager to obtain a scalable and much-needed slice of technology. But the ever-changing nature of cyberattacks means that humans (who are currently more adaptable than computers) still have an important role to play in defense.
In the first half of NCC’s end-May financial year, insurance revenue reached £123m, or 82% of the group’s total. This is an increase of 5% compared to the same period last year, while the gross margin increased by 1.2 percentage points to reach 36%. Despite wage inflation, NCC has managed to improve efficiency by making better use of its global workforce through remote working. The result, the company says, is that the entire workforce “can now be deployed on high-value assignments, smoothing out peaks and troughs in demand or skill shortages.”
NCC expects insurance revenue to grow by approximately 15% in the second half of the year, which would translate into double-digit revenue growth for fiscal 2022. The increase is due to a increases in both volume and prices – the latter particularly reassuring as inflation bites and a shift that suggests NCC has the power to set prices to pass rising costs onto customers without losing market share .
Software bounces back
NCC’s smaller second division has had a tougher time lately. Software resilience provides both on-premises and backup cloud services in the event of a customer’s software vendor failure. NCC can help customers “maintain or recreate an application from the original source, if needed”. The service is called software escrow.
In the first half of last year, ongoing software resiliency revenue declined 3.3% at constant currencies. This decline was larger than expected due to issues “attracting and retaining sufficient commercial resources”, which led to lower contracts in the UK and US. The tight labor market has made it difficult to attract the right people.
There is hope that this blip is in the rear view mirror. In a recent May 9 business update, management said it expects software resilience to return to revenue growth in the second half. This is set to be bolstered by last June’s $220m (£176m) acquisition of US intellectual property management company IPM from Iron Mountain.
NCC says the integration is “significantly advanced” with customers already successfully migrated. Management has also launched a review of the division’s business processes and expects to achieve an additional £5 million in savings by 2024. The main benefit of this acquisition is that it provides access to the much larger US market – because Iron Mountain is a recognized player in the field. the country’s software escrow industry.
Although Iron Mountain is a big player in the United States, it has been slow to develop its SaaS (software as a service) escrow options. NCC therefore expects revenue opportunities by offering “broader cloud and cyber-resilience services to IPM’s large customer base in the medium term.” Software resiliency is a much smaller part of the business, but its gross margin of 71.7% is nearly double that of insurance divisions. If sales pick up, it will boost the group’s margin significantly – a big part of why analysts are confident cash flow and operating profit will rise steadily over the next four years.
The drivers of cyber growth
During the pandemic, many companies accelerated their digital adoption and invested in improving cloud capabilities and capabilities. While ideal for employees and organizations that want to work more flexibly, this trend creates more entry points into computer networks, making networks more vulnerable to hackers.
The global cybersecurity market is expected to grow at a CAGR of 11% from 2021 to 2028, according to business consulting firm Grand View Research. It is these market forecasts that largely explain the excessive multiples on which most e-businesses trade. UK-based artificial intelligence software company Dark Trace (DARK) is currently trading on a forward price-to-sell ratio of 11 while in the US CrowdStrike (US: CRWD) worth 23 times its revenue in the long term – even if it has not yet made a profit.
These figures are comparable to NCC’s low price-to-earnings ratio of 2.2. Its PE ratio is also an affordable 16.1 – but unlike many unprofitable e-businesses, NCC actually makes a lot of money due to its low working capital. In the first half of the year, the cash conversion ratio was 74.7%. When IPM’s £6.4m acquisition cost is removed, it was a more impressive 99.2%. Analysts expect a 12-month free cash flow return of 4.9% and a return of 7.4% in 2024, according to consensus figures compiled by FactSet.
Given these impressive cash flow projections, NCC’s relatively low valuation is almost certainly due to a combination of its historical mismanagement and more recent struggles in the software arm. Investors have reason to look beyond both: Palser’s tenure has largely resolved governance issues, while the recent acquisition of IPM offers another avenue for growth in the resilience sector.
With NCC in much better shape than Palser found it, its successor can now get things done. Peel Hunt is impressed with Maddison’s track record and reputation as a strong team builder. With the foundations established, it’s time for CNC to shift into a growth mindset.
Last Seen IC: Buy, 215p, Jan 27, 2022
|Company Details||name||Market cap||Price||52 weeks high/low|
|NCC (NCC)||£637 million||206p||348p / 163p|
|Size/debt||NAV per share*||Net Cash / Debt(-)||Net debt / Ebitda||Operating cash/EBITDA|
|Evaluation||PE before (+12 months)||JJ (+12 months)||P/Sales||PEG|
|Quality/ Growth||EBIT margin||ROCE||CAGR of sales over 5 years||CAGR EPS 5 years|
|Forecast / Momentum||Fwd EPS grth NTM||Fwd EPS grth STM||Mom of 3 months||% change in EPS before over 3 months|
|End of year May 31||Sales (millions of pounds sterling)||Profit before tax (millions of pounds sterling)||EPS (p)||DPS(p)|
|Source: FactSet, adjusted PTP and EPS figures|
|NTM = next 12 months|
|STM = second 12 months (i.e. in a year)|
|*Includes intangibles of £204 million or 66 pence per share|