Chief Executive Review

Cyber security market

The dynamics for the cyber security market largely remain unchanged.

The cyber security market is forecast to grow strongly to £353 billion by 2025, at a 14.5% CAGR,^[1] with sophisticated cyber criminals and nation-state bad actors outperforming their targets. Countries such as Russia, North Korea and Iran use cyber attacks against their enemies, both to disrupt critical national infrastructure and to generate hard currency. The attack surface continues to expand dramatically with millions more insecure and exploitable network endpoints due to the increasingly widespread use of IoT (Internet of Things) and remote/hybrid working.

Digital transformation and hybrid working initiatives continue to bring new and different risks. Combined with customer and supply chain pressure to improve security and privacy, and proliferating national and international data protection regulations, cyber and privacy risk is a critical issue for all organisations.

The global shortage in qualified security and privacy professionals continues.^[2] There are millions of vacancies. It is increasingly difficult, therefore, for most organisations to manage day-to-day cyber security and privacy compliance activity in-house, let alone cope with a large-scale cyber attack.

Yet, although a catastrophic ransomware or cyber attack is the number one concern for 47% of companies (double the number in 2021), the reality is that only 20% of company boards are paying attention.[3] At the same time, cyber insurance premiums have increased significantly, the pool of available cyber insurers has shrunk, and the availability of cyber insurance is increasingly dependent on evidence of adequate cyber defence. These factors will generate significant opportunities for the Group. However, it will be somewhat dependent on companies taking more proactive steps to address the issues they face.

Geopolitical instability and macroeconomic headwinds are encouraging finance teams and boards to short-sightedly throttle back on cyber security investments, particularly in the key area of developing internal cyber skills. This will see many more organisations attempting to remediate cyber attacks at cost levels 10 to 100 times greater than an appropriate cyber defence-in-depth investment might have required. And, if they survive the attack, they will still have to make the cyber defence investment - because cyber attackers are increasingly re-attacking previously breached organisations that haven't yet been able to build adequate defences.

This remarkable combination of factors will unquestionably drive longer-term demand for high-margin recovery services and rapid, high-cost deployment of post-event cyber defences, albeit in the shorter term there will be challenges in persuading companies to make this critical investment.

Tightening cyber insurance prerequisites, growing regulatory pressure across the world, direct personal cyber-compliance exposure for directors, and proliferating up-stream customer due diligence will, through the next 12 months and beyond, combine to fuel a surge in cyber investment and provide significant opportunities for the Group.

H1 trading performance

GRC's experience in H1 FY23 very much reflects the global picture. While our enquiry levels continued to be strong, sales cycles are extended. This was compounded by the UK government dithering over retained EU regulation, including UK GDPR, combined with the delayed publication of the revised ISO/IEC 27001 information security management standard. The latter slowed sales of our training courses while boosting training deferred income to a record £0.5m at the end of H1 - which bodes well for H2 training revenues. 

Against this backdrop, GRC's H1 results were in line with our expectations. Revenue was up 11%, recurring and contracted revenue was up 33% and gross margin improved by 200 basis points to 60%, reflecting the investment in high-margin and highly scalable recurring revenue products.

Despite investment in our workforce as well as absorbing the inflationary cost increases that go with providing high-value consultancy services, our H1 EBITDA matched the prior year's H1 result at £0.4m. The investment, funded by H1 growth, is expected to fuel further future growth in H2 and beyond. Cash outflow and the working capital cycle was in line with planned investment, and our debt reduced.

Strategy

Our strategy is to grow internationally, organically and by acquisition. We have a blue-chip and broad customer base. Our widening portfolio of income streams enables us to provide an increasing number of value-added and complementary services to our growing roster of international customers.

The GRC fully integrated and comprehensive 'one-stop' offering is focussed on people and process. It is uniquely positioned to help organisations of all sizes deal with the cyber-crime current and future challenges. From emergency response and data breach services through to integrated cyber defence-in-depth and regulatory compliance offerings, GRC responds quickly to customer requirements.

Our continuing investment in building and improving our online subscription services is driving continual improvements in customer retention and forward revenue visibility, which will widen our gross margin due to the inherent operational gearing in the business.

In addition to building our own IP, we have a strategic focus on our SEO (search engine optimisation). This enables us to dominate search terms, widen our ecosystem, cross-sell more products and services, and drive new online sales.

The fragmented market and our strengthening balance sheet will provide us with opportunities to enhance our capabilities by acquiring products and services both domestically and internationally.

Current trading and outlook

We expect the current conflict between the caution and general cost management agenda of company boards and the clear and present danger that is cyber risk to resolve itself over the medium term in favour of widespread investment in building cyber defence in depth and cyber resilience. The Board believes that the Group is extremely well placed to capitalise on this opportunity as it occurs.

We continue to invest in our E-Commerce and SaaS divisions, and back-office automation. These are clearly a competitive advantage and the roll out of these developments, together with extensive improvements in our outbound lead generation capabilities, will support revenue growth in H2 and particularly in Q4, which is traditionally our busiest period of the financial year.

We expect that our current sales and billings, marketing and delivery activities, supported by deployment of SaaS and e-commerce investments, the October publication of ISO/IEC 27001:2022 and our seasonally strong Q4 will enable us to achieve our FY23 financial objective. Current trading remains in line with market expectations. 

Alan Calder

Chief Executive Officer