27 September 2022

ECSC Group plc

('ECSC' or the 'Company' or the 'Group')

Unaudited interim results for the six months ended 30 June 2022

ECSC Group plc (AIM: ECSC), the provider of cyber security services, announces its unaudited interim results for the six months ended 30 June 2022.

Financial Highlights

·    MDR order book up 30% to £2.9m (31 December 2021: £2.2m)

·      Group revenue of £2.77m (H1 2021: £3.01m)

·    Assurance division (testing, standards and certification services) revenue of £1.48m (H1 2021: £1.49m)

Post-Period Highlights

·    Mid-Sept 2022 Assurance booking level up 30% upon the year-to-date mid-month average

·    Appointment of new CEO

·    Return to a level of MDR new service wins comparable to pre-COVID levels

·    Partnership with Securonix, joining their global Managed Service Provider (MSP) programme

Matthew Briggs, Chief Executive Officer of ECSC, commented:

"H1 was a challenging period, however, we have a firm handle on what caused the under performance. Some changes have already been implemented. With several more tactical and strategic initiatives now identified and being executed, I am expecting to see improvements in H2 with further improvements during 2023."

Enquiries:

Notes to Editors:

Founded in 2000, ECSC Group plc (AIM: ECSC) is the UK's longest running full-service cyber security service provider. With an extensive range of in-house developed proprietary technologies, including advanced Artificial Intelligence (AI) systems, ECSC provides expert security breach prevention and advisory support to organisations across all sectors.

ECSC operates from two Security Operations Centres (SOCs): one in Yorkshire, UK, and the other in Brisbane, Australia. ECSC offers flexible 24/7/365 cyber security monitoring, detection, and response support to its clients, either as a fully managed service or to enhance an organisation's existing cyber security systems.  In addition, ECSC's Assurance division provides guidance, certification to industry standards, and extensive testing services to allow organisations to assess their cyber security protection.

ECSC is led by a highly experienced senior management team with over 80 years' combined experience within the company and has delivered consecutive organic growth for the last 20 years.

The Company's broad client base ranges from e-commerce start-ups to global blue-chip organisations, including 10% of the FTSE 100.

For more information, please visit the following: https://investor.ecsc.co.uk/

Chairman's Statement

Following fresh challenges in H1, I am pleased to see how the group has responded, as reflected in the recent MDR recurring revenue wins and the current level of Assurance consulting bookings.  Increases of 30% in both MDR order book and current Assurance booking levels illustrate the up-turn we are seeing on a range of internal KPIs.

There is now strong evidence that post COVID-19, cyber security has returned as the number one priority for most organisational boards.  ECSC is the ideal partner to advise and secure these organisations.

I am delighted with the recent appointment of Matthew Briggs as our new Chief Executive Officer (CEO).  He brings a wealth of senior commercial experience, placing him in an ideal position to lead us through the next stage of our development.  As a previous client of ECSC, with a good understanding of our services, he has worked rapidly to understand the opportunities for the group and brought with him the highest expectations for the whole team.

We intend to fully report the current, and planned, board structure in our annual report.  However, in line with QCA guidance, my position as Chairman will be temporary, and reviewed in light of future non-executive appointments.

On behalf of the Board, I would like to thank all of our clients, staff, partners and wider stakeholders for their continued support.

Ian Mann

Executive Chairman

27 September 2022

Chief Executive Officer's Statement

Having commenced the CEO role in August this year, I am still identifying the mission critical tasks which need to be executed along with their sequencing. That said, our overall focus on profitable, sustainable growth remains unaltered and very much central to our strategic intentions.

It is clear from what has been observed so far, and what I know of the market, that there are significant opportunities for ECSC. And whilst at a macro level, there may be some headwinds from inflation, cost of living, salary costs and interest rate rises, history tells us that the cyber security industry is resilient compared to many other sectors.

Some of the areas which will be getting my attention over the coming weeks and months include re-energising the culture of our people and ensuring they feel empowered to deliver very clearly defined targets and objectives. We will be implementing enhanced KPIs and reporting to ensure full performance transparency exists across the business. We will also be co-creating our 3 year business strategy. Essentially, this will produce a roadmap for how we will stay relevant and appealing so we deliver P&L growth over the coming years, whilst also ensuring we don't get distracted from business as usual activities.

Two particular aspects which have struck me since joining are that firstly, the business has been very inward looking. In turn, understanding a client's wants and needs and competitor intelligence is lacking. However, with the combination of Ian's new role and my connections we can remedy this in relativity short order. Secondly, ECSC has many significant opportunities to build different partner relationships, moving away from IT resellers towards like minded 'trusted advisor' businesses. From a standing start since I joined, we already have over 25 conversations in play many of which are with blue chip brand's with extensive client banks potentially interested in offering our services to their clients.

Whilst revenue growth during 2022 will not have been at a level the Board would have wished, one of the overwhelming reasons for me joining ECSC was the opportunity for significant profitable growth, and the early signs are indicating that this is within our gift.

Key Performance Indicators

The following Key Performance Indicators:

* Percentage change when compared to the prior comparable period.

Matthew Briggs

Chief Executive Officer

27 September 2022

Financial Review

Principal Activities

The principal activity of the Group during the period continued to be the provision of professional cyber security services, including Assurance, Managed Detection and Response Services and the sale of Vendor Products.

* Adjusted Operating Loss and Adjusted EBITDA excludes one-off charges and share based charges

**  EBITDA is defined as Earnings before Interest, Tax, Depreciation and Amortisation

Revenue & Organic Growth

Total revenue in the period ended 30 June 2022 was £2.77m, down 8% on the comparable prior period (revenue in the six months ended 30 June 2021 was £3.01m).  Within this, Assurance revenue was down 1% to £1.48m (June 2021: £1.49m).

Managed Detection and Response division revenue was down by 16% to £1.22m (June 2021: £1.45m). This was due to MDR pipeline issues caused by COVID which are now resolved. Within this division, Incident Response revenues decreased to £0.09m (June 2021: £0.14m) during the period.

Vendor Products revenue remained at £0.05m, (June 2021: £0.05m), and remains a small part of ECSC's business, contributing only 2% of revenues.

Margin Generation

Gross Profit in the period was £1.40m representing a 50% gross margin (prior year interim period: £1.82m representing a 60% gross margin).

Assurance margin fell to 58% in the period (prior year interim period: 61%). This was due to a 5% increase in costs over the prior period.

Managed Detection and Response margin fell to 46% (prior year interim period: 64%) due to a 16% decrease in revenue and a 27% increase in costs due to wage inflation and additional headcount in the MDR division during the period.

EBITDA & Operating Loss

Adjusted EBITDA for the period, which excludes one-off charges and share based charges, was a loss of £0.36m (June 2021: Adjusted EBITDA profit of £0.02m). EBITDA in the period was a loss of £0.53m (June 2021: EBITDA loss of £0.08m).

Adjusted Operating loss in the period was £0.56m (June 2021: Adjusted Operating loss of £0.19m). The Operating loss in the period was £0.72m (June 2021: Operating loss of £0.28m).

Cash Flow

Cash and cash equivalents decreased by £0.87m to £0.30m as at 30 June 2022, primarily due to wage inflation pressures and reduced revenues compared to the prior year. 

During H1 2022, the Group took action to reduce cash burn by cost control, resulting in costs of over £500k per year being removed from the business.

The Group will continue to prioritise cash management and closely monitor this to ensure that the Group has adequate liquidity to meet all of its financial commitments as they arise. The budget figures are closely monitored against actuals on a monthly basis. Variances that may arise are discussed at Board level on a monthly basis. The Directors also consider a sensitivity analysis based on lower revenue growth and margins achieved and have formulated appropriate contingency plans which enable the Group to preserve its financial resources.

Gemma Basharan

Chief Financial Officer

27 September 2022

Consolidated Statement of Comprehensive Income

For the 6 months ended 30 June 2022

Consolidated Statement of Financial Position

As at 30 June 2022

Consolidated Statement of Changes in Equity

For the 6 months ended 30 June 2022

Consolidated Cash Flow Statement

For the 6 months ended 30 June 2022

Notes to the Financial Statements

For the 6 months ended 30 June 2022

1.         Corporate Information

ECSC Group plc is incorporated in England and Wales and quoted on the London Stock Exchange's Alternative Investment Market (AIM: ECSC). Further copies of these financial statements will be available at the Company's registered office: 28 Campus Road, Listerhills Science Park, Bradford, West Yorkshire, BD7 1HR. These condensed consolidated interim financial statements as at and for the six months ended 30 June 2022 were approved by the Board of Directors on 26 September 2022.

2.         General Information

These financial statements may contain certain statements about the future outlook of ECSC Group plc. Although the Directors believe their expectations are based on reasonable assumptions, any statements about future outlook may be influenced by factors that could cause actual outcomes and results to be materially different.

3.         Basis of Preparation

These interim financial statements for the period ended 30 June 2022 have been prepared in accordance with UK adopted international accounting standards (collectively 'UKIAS) and as applied in accordance with the provisions of the Companies Act 2006.

The financial statements for the period ended 30 June 2022 (and comparative) have been prepared on a consolidated basis.  The consolidated financial statements present the results of the Company and its subsidiaries ('the Group') as if they formed a single entity. The financial statements of the Group and Company are both prepared in accordance with UKIAS. They do not include all of the information required for a complete set of UK IFRS financial statements. However, selected explanatory notes are included to explain events and transactions that are significant to an understanding of changes in the Group's financial position and performance since the last annual statements.

Alternative performance measures (APM)

In the reporting of financial information, the Directors have adopted the APM 'Adjusted EBITDA' (APMs were previously termed 'Non-GAAP measures'), which is not defined or specified under International Financial Reporting Standards (IFRS).

This measure is not defined by IFRS and therefore may not be directly comparable with other companies' APMs, including those in the Group's industry. APMs should be considered in addition to, and are not intended to be a substitute for, or superior to, IFRS measurements.

Purpose

The Directors believe that this APM assists in providing additional useful information on the underlying trends, performance and position of the Group. This APM is also used to enhance the comparability of information between reporting periods and business units, by adjusting for non-recurring or uncontrollable factors which affect IFRS measures, to aid the user in understanding the Group's performance.

Consequently, APMs are used by the Directors and management for performance analysis, planning, reporting and incentive setting purposes and this remains consistent with the prior year.  Adjusted APMs are used by the Group in order to understand underlying performance and exclude items which distort compatibility, as well as being consistent with public broker forecasts and measures (see note 10).

The financial statements have been presented in thousands of Pounds Sterling (£'000, GBP) as this is the currency of the primary economic environment that the Company operates in.

4.         Accounting Policies

The principal accounting policies applied in the preparation of the financial statements are set out below. These policies have been consistently applied to all periods presented, unless otherwise stated.

4.1       Basis of Accounting

The financial statements have been prepared on the historical cost basis except as stated.

4.2       Going Concern

The Directors have reviewed whether the Group has adequate resources to continue in operational existence for the foreseeable future. In conducting this review, the Directors have considered a range of factors, including the market prospects for cyber security services, client relationships and dependency, supplier relationships and dependency, actual or potential litigation, staff retention and reliance, relationships with HMRC and regulators, financing arrangements, historic trading and cash flow performance, current trading and cash flow performance, and future trading and cash flow expectations.

The budget figures continue to be closely monitored against actuals on a monthly basis. Variances that may arise are discussed a Board level on a monthly basis during a review of the monthly numbers. In the event that this revenue and cost performance is not achieved, the Directors have also considered a sensitivity analysis based on lower revenue growth and have formulated contingency plans for this scenario, which enable the Group to preserve its financial resources.

During H1 the Group took action to reduce cash burn by cost control, costs of over £500k were removed from the business.

As at 30 June 2022, the Group had cash and cash equivalents of £0.30m (2021: £0.59m) and achieved an Adjusted EBITDA loss of £0.36m (2021: profit of £0.02m) and an operating loss of £0.72m (2021: £0.28m).

Based on this review, the Directors have concluded that the Group has adequate resources to meet its liabilities as they fall due and continue in operational existence for the foreseeable future, which is considered to be at least the next 12 months. Consequently, the Directors have adopted the going concern basis in preparing the interim financial statements.

4.3       Revenue Recognition

The core principle is that revenue should only be recognised as the client receives the benefit of the goods or services provided under a commercial contract, in an amount that reflects the consideration to which the provider expects to be entitled for the transfer of the goods or services.

Performance obligations and timing of revenue recognition

Revenue comprises the sales value of goods and services supplied during the year, exclusive of Value Added Tax and trade discounts. Revenue from the provision of Consulting services is recognised as services are rendered, based on the contracted daily billing rate and the number of days delivered during the period.

Revenue from Pre-paid contracts are deferred in the balance sheet and recognised on utilisation of service by the client. Pre-paid revenue is included within Assurance in note 5. Revenue from MDR contracts includes:

Hardware - hardware revenue is recognised on delivery and is included within other revenue as set out in note 5. This is when control of hardware passes to the customer.

Device build - Device build revenue is deferred and recognised on a straight line basis over the term of the contract.

Licensing - deferred and recognised on a straight line basis over the invoice period, due to the performance obligation not being considered distinct from management and monitoring performance obligation.

Management and monitoring - deferred and recognised on a straight line basis over the invoice period.

Performance obligations and timing of revenue recognition

Management and monitoring - deferred and recognised on a straight line basis over the invoice period.

Revenue from the sale of products (vendor) is recognised when control passes to the customer, which is considered to occur when the software or hardware product has been delivered to the client.

Determining the transaction price

The Group's revenue is derived from fixed price contracts and therefore the amount of revenues to be earned from each contract is determined by reference to those fixed prices.

Costs of obtaining long-term contracts and costs of fulfilling contracts

Commissions paid to sales staff for work in obtaining Managed Service contracts are prepaid and amortised over the terms of the contract on a straight line basis.

Commissions paid to sales staff for work in obtaining the Prepaid Consultancy contracts are recognised in the month of invoice.

These costs are recognised in the Consolidated Statement of Comprehensive Income within Sales & Marketing costs.

Contract Balances

4.4       Finance Income

Finance income is accrued on an annual basis, by reference to the principal outstanding at the applicable effective credit interest rate.

4.5       Government Grant Income

A government grant is recognised only when there is reasonable assurance that (a) the entity will comply with any conditions attached to the grant; and (b) the grant will be received.

The grant is recognised as income over the period necessary to match them with the related costs, for which they are intended to compensate, on a systematic basis.

Government Grant Income is recognised in the Statement of Comprehensive Income over the period in which the Company recognises expenses for the related costs for which the grants are intended to compensate. Grants relating to income are deducted from the related expense.

Government tax credits available on eligible Research and Development expenditure ('R&D Tax Credits') and not reclaimable through other means are recognised as Other Income.

5.         Revenue and Segment Information

The Group's principal revenue is derived from the provision of cyber security professional services.

During this period, the Directors received information on financial performance on a divisional basis. The Directors consider that there are three reportable operating segments: Assurance (including Remote Support services), Managed Detection and Response, and Vendor Products. There were a small number of other transactions recorded during each period which are not considered to be part of either of the three reportable operating segments. These are presented below within the 'Other' caption and are not significant.

The Directors do not receive any information on the financial position of each segment, including information on assets and liabilities. Accordingly, such information has not been presented.

The Group is not reliant on any single client, with no single client accounting for 10% or more of revenue. All revenue recognised is derived from external clients.

The Group's revenue and gross profit by operating segment for the period ended 30 June 2021 and comparative periods is as follows:

6.         Other Income

7.         Earnings per Share

Basic Earnings per Share is calculated by dividing the Profit for the period Attributable to Equity Holders of the Company by the weighted average number of Ordinary Shares outstanding during the period ('Basic Number of Ordinary Shares').

Diluted Earnings per Share is calculated by dividing the Profit for the period attributable to Equity Holders of the Company by the weighted average number of Ordinary Shares outstanding during the period plus the weighted average number of Ordinary Shares that would be issued on conversion of all the potential dilutive Ordinary Shares ('Diluted Number of Ordinary Shares'), subject to the effect of anti-dilutive potential shares being ignored in accordance with IAS 33.

Adjusted Earnings per Share is calculated by dividing Adjusted Profit by Diluted Number of Ordinary Shares.

The calculation of Basic, Diluted and Adjusted Earnings per Share is as follows:

** In accordance with IAS 33, the effect of anti-dilutive potential shares has been ignored

8.         Intangible Assets

GROUP & COMPANY

Development Costs

9.         Cash & Cash Equivalents

10.        Adjusted (Loss) before Taxation and Adjusted EBITDA

Adjusted (Loss)/Profit before Taxation

Adjusted EBITDA:

* Adjusted Operating Loss and EBITDA excludes one-off charges and share based charges.

* *  EBITDA is defined as Earnings before Interest, Tax, Depreciation and Amortisation.

11.    Subsidiary Undertakings

ECSC Group plc currently has the following wholly-owned subsidiaries, which are incorporated and registered in England and Wales:

ECSC Australia Limited currently has the following wholly-owned subsidiary, which is incorporated and registered in Australia:

The share capital of each Group entity is as follows:

* AUD = Australian dollars