Cyan — New strategic focus on telco cybersecurity

In our report Reset and regroup, we reviewed several challenges Cyan faced that continued blighting its financial performance throughout 2020. Those challenges continued in H121, and despite many new deals coming in cybersecurity, revenue came in slower than expected and fell to €3.5m, down from H120’s €16.9m, which benefited from non-recurring revenues from the old Virgin Mobile business and a capex contract for 83m end user licences. Revenue from several of these large contracts (Flash Mobile/CAN and Virgin Mobile) was recognised upfront in 2019 and 2020, but as such, did not recur in 2021. However, revenues were in line with H120 when adjusted for those one-offs. Segment revenue came in at 63% BSS/OSS (€2.2m, down from €15.4m in H120) and 39% Cybersecurity (€1.4m, slightly lower than H120’s €1.6m). Most revenues came from the Europe, Middle East and Africa region (~ 65%), up from 11% in H120 due to upgrade or expansion projects in the BSS/OSS segment. The remainder of revenues were split between Asia-Pacific (20%) and the Americas (15%). Unfortunately, EBITDA turned negative, moving to a €7.4m loss from €2.2m profit in H120, primarily due to the falling revenue and increased personnel expenses. Lastly, diluted EPS fell to a loss of €0.75/share from a €0.06/share profit in H120.

There were, however, rays of sunshine in the first half of 2021. Contract extensions were reached for Bangladesh customer Skitto as well as expansions into Magenta’s fixed-network customers and into METL’s Switzerland and German businesses. Two cybersecurity solutions for large telco firm Orange in France were launched in April with growth rates of 20% seen across the first six weeks. The Orange launch marked a milestone and provides a key reference point for future customers, with product rollouts planned for other Orange national companies, though revenues were not expected until late H221 and into 2022. Business with Claro Chile and two other mobile network operators also were added. These contracts should contribute financially in the near future as Cyan builds up its recurring revenue base.

As a result of these ongoing challenges and disappointing H121 financials, Cyan announced a significant restructuring plan with a focus on cybersecurity for telecom customers, or ‘Cybersecurity for the Masses’. The new strategy involves three components:

The new strategy also has an impact on both business segments. Cybersecurity has been a core business for Cyan, and now the primary focus is on the telco industry where Cyan an better leverage its core strengths of its research network, security filter database and cyberthreat intelligence. Telco tends to be a higher margin, scalable business and Cyan’s emphasis will be on implementing, scaling and monetising about 10 existing telco customers, with a narrower pipeline of promising opportunities. In future, Cyan will readdress other markets, such as insurance and automotive, but for now the emphasis is on scaling the business and closing telco deals.

Specifically, Cyan will continue to target two sets of telco customers: mobile network operators (MNOs) and internet service providers (ISPs). Here, management believes longer-term customer retention and increased recurring revenue would occur as customers would have little reason to switch as Cyan’s solutions contribute to revenue and provide a healthy margin once installed. These two customer bases can reach a large mass market, as the end-customer bases of internet/connectivity services are already billions of users. Note that telcos are at the forefront of the cybersecurity challenge as they act as the link between users and the internet. They are looking for opportunities to further engage the user and gain margin in a very competitive market, and Cyan’s products would naturally fulfil these needs. Rather than needing a large salesforce to reach many small businesses, telco sales channels could potentially reach nearly a billion people. Under this model, the initial negotiation is done with the one MNO or ISP, while the cybersecurity contract and customer retention is at the single end-user level with the MNO/ISP, such as a student who owns a mobile phone or parent using their iPad for business. Therefore, any cancellations of the single user would have minimal impact compared to the previous model, where contracts were with large customers whose cancellations could have a material effect on financials. The MNO segment alone offers a total addressable market (TAM) of 2.6 billion customers and management estimates a 10% market share would be potentially worth up to €2.6–7.8bn, although there is substantial progress that needs to be made in building the telco pipeline and improving operational execution to reach this potential.

The competition in the telco space is growing and many competitors are pursuing the same market potential. A key advantage for Cyan is that it provides seamless, multidimensional solutions to cybersecurity. These include covering multiple use cases (smartphones, PCs, fixed-lines, etc.), being both endpoint based and integrated in the network, providing convenient sign-up for the end-customer (where the user signs up directly through the telco, so providing a seamless customer journey rather than going through a 3rd party) , being a white-labelled product so it benefits from clients’ marketing and operating its own integrated proprietary security database instead of relying on third parties or outdated lists. In contrast, its competitors’ offerings are not always integrated or seamless across these key dimensions and do not necessarily offer the same breadth of products and service. Nevertheless, to capture even 1% of the TAM, Cyan must leverage its advantages to truly differentiate itself from competitors such as Norton, Akamai and Allot.

With the move towards cybersecurity, BSS/OSS is no longer part of Cyan’s core strategy, as it does not provide the recurring revenue model management is looking for, has lower scalability and narrow margins. While management has successfully integrated the business and put it on what management believes is a solid foundation, it is no longer the focus of Cyan’s cybersecurity strategy. Therefore, Cyan is reviewing options for that segment’s future, including a potential sale. While Cyan was able to successfully integrate the i-new acquisition and its BSS/OSS segment, synergies did not occur as expected. Management believes the separation should occur within the next six months, freeing up operational and financial resources to concentrate on Cybersecurity.

It should be noted the BSS/OSS segment has historically provided greater revenues than Cybersecurity (see our previous note Reset and Regroup), albeit with lower margins, and the disposal of this business would likely have an unfavourable short-term impact on revenues while the telco cybersecurity segment ramps up. One risk in the shift is that delays in realising Cybersecurity revenue could have a further negative effect with the move away from a segment that since 2018 provided most of Cyan’s revenues and impacted on the bottom line, although management now can devote its attention to the higher-margin, faster-growing cybersecurity business and reinvest the funds from a BSS/OSS sale.

As a result of the strategic shift and disappointing H121 results, management retracted its earlier guidance (c €21m revenues) and now expects FY21 revenue to be lower at c €10–14m with EBITDA remaining negative. Management also expects the impact of the restructuring measures will become evident as soon as late 2021 and in 2022.

To finance the transformation and cost-cutting efforts and address a liquidity gap, Cyan held a capital raise in September. The raise was fully subscribed with about 2.48m shares placed, raising €8.0m and boosting Cyan’s balance sheet liquidity, as net debt (including IFRS 16 leases but excluding the capital raise) was c €10.8m at 30 June 2021. Management aims to be self-sustaining with no further capital or significant debt increases needed, although this depends on meeting its revenue targets and becoming cash flow positive. Otherwise, further debt or equity funding could be required.

On a personnel note, long-time executive and CFO Michael Sieghart has announced his departure and will be replaced by Martin Wachter in December, after a transition period. Mr. Wachter has a long career in banking, with over 35 years of financial experience.

With the rise of digitisation and mobility, the cybersecurity market is experiencing rapid growth as more people use and own mobile phones. The COVID-19 epidemic only accelerated the shift towards online shopping and banking, working from home and mobile payments. In fact, GSMA Intelligence estimates that 5.2bn people globally use mobile phones.

Regrettably, the shift to increased mobile usage has also brought in many bad actors, as potential cyberthreats rose at a c 36% CAGR since 2016, including threats such as malware, ransomware, phishing, adware, etc. These hazards affect a wide range of activity, such as emails, financial payments, social media, etc., further driving the demand for cybersecurity products across all mobile devices, not just phones. As a result, these market drivers should support their business going forward, as Cyan focuses their efforts on cybersecurity for telco, rather than being distracted by the BSS/OSS business and expansion into other industries such as insurance and automotive.

Trading at a recent €3.91, Cyan’s shares are down 61% year to date. Although Cyan is targeting to turn profitable by 2022, consensus does not expect EBITDA to turn positive until 2023. The share price implies an EV of 12.7x consensus FY23e EBITDA, in line with its nearest cybersecurity peers and near the high end of its historical range. Consensus also expects Cyan to grow 2023 revenues at 60%, significantly more than its cybersecurity peers at an average 13% y-o-y in 2023.

Delivering recurring revenue growth and associated higher margins in the expanding cybersecurity segment over the next 12–18 months could restore investor confidence in Cyan’s long-term potential. However, with a valuation that is in line based on a much higher projected growth rate, management needs to execute its restructuring plan and achieve profitability in a timely manner to unlock the potential in the growing cybersecurity market.

.