NCC and the tech megatrend that stalled

‘Digital transformation’ is a hacker’s dream. As more of the world moves online, it creates not just connections, but a plethora of new vulnerabilities. The massive cyberattack on FireEye (US:FEYE) last December, reportedly coordinated by Russia, practically declared open season on private companies by state actors. The higher volume of risk, combined with the threat of more advanced malefactors, should be excellent news for cybersecurity companies. But unlike other big tech firms, they have not all rallied in the past year. 

The market shows a more mixed reaction. While tech companies like Zscaler (US:ZS), Okta (US:OKTA) and Cloudfare (US:NET) have all soared in the year to date, a number - including traditional players like NortonLifeLock (US:NLOK) - have lagged behind the US benchmark index. 

This is in part because of company-specific challenges. But cybersecurity firms also find themselves spinning two narratives that do not quite add up. Firstly, that their services are now bordering on essential due to the changes brought about by the pandemic. Secondly, that demand is not very strong at the moment despite the changes. 

UK-listed cybersecurity firm NCC (NCC) told a similar story this week. “I perfectly understand some of our clients being more cautious on their spending,” said chief executive Adam Palser, who flagged that some customers were less willing to commit to big orders and long-term contracts, despite the fact that “hackers have never had it so good”. 

In the six months ended in November, NCC’s revenues were largely flat, with gross profits ticking up 5 per cent to £54.4m. This is not to be sniffed at, in a macro environment that has obliterated other businesses. But compare that to astronomical figures coming out of other tech megatrends such as online retail or cloud adoption: 50 per cent sales growth at Microsoft’s (US:MSFT) cloud computing business Azure, or 47 per cent at Amazon’s (US:AMZN) equivalent. 

With companies’ digital footprints growing rapidly, cybersecurity companies are right to insist that their services have never been so important. But for some, largely flat demand implies that corporate clients are not spending their money as wisely as they should. 

Evidently, senior management teams across the market have been allocating their resources elsewhere, shoring-up balance sheets, or perhaps even concentrating IT budgets on customer-facing digital transformation projects. 

Either way, it seems that corporate tech spending on security is taking a backseat. Indeed, this week ComputerWeekly found that just under a third of UK & Ireland firms had furloughed their IT staff in 2020. 

While these companies may have gotten away with skimping on cybersecurity expenditure last year, they will need to clean up their growing online presence.  Market research group Gartner has predicted that IT spending will grow by 6.2 per cent this year (compared to a 3.2 per cent drop in 2020), and that two-fifths of corporate boards will even have a dedicated cybersecurity committee by 2025, ranking cyber risk as second-highest for large businesses. 

At NCC, management believes that the pandemic is only temporarily holding cybersecurity revenue from its full potential. “Spending decisions delayed in some customer segments, has built up a "compliance debt" that must be paid down in the future.” This year then, it should be able to build on its modest revenue growth, as well as an improved cash conversion rate of 100 per cent, compared to its usual 85 per cent target. A confident commitment to the half-year dividend and a move to a net cash position (excluding lease liabilities) lead us to believe NCC can withstand the wider hesitancy in corporate IT - a trend that cannot continue for long while digital transformation projects still feature in various earning reports. Hold. 

Last IC view: Hold, 187p, 3 Sep 2020