Cyan — Operational and structural transformation

Cyan is a smallish technology company of 27 employees focused on security and related products for internet access with mobile devices. This has been its dominant source of revenue for the last few years, generated by a single customer. It is diversifying its revenue stream with new products, two of which have achieved breakthrough contracts. These new products are aimed at entirely new client industries, which should broaden the customer base enormously as significant turnover is generated.

Ownership of the business is also changing radically. The original Austria-based company (CSG) is passing into the ownership of Cyan AG, which is coming to the market through an IPO on Deutsche Börse’s Scale segment. The process began just under a year ago and once it is complete the large majority of the company will be owned by a group of financial investors, who appear to have had little involvement in the operational side of the business. Public shareholders will own about 16% of the company.

Cyan is issuing 1.39m new shares at €23 each including a Greenshoe for the IPO. None of the existing shareholders are selling and the free float will be 16% post-Greenshoe. The proceeds will mainly be used to finance the last stage the purchase of CSG.

The bulk of Cyan’s resources are devoted to development, which accounts for the large majority of headcount.

Cyan operates two development centres outside Austria: one in the Czech Republic and one in Poland where costs are lower.

As seen in Exhibit 1 there was a significant increase in technology headcount in 2016 as development work got underway for the new products in the financial services and MVNO fields. This appears to have been split evenly between Austria and the international centres.

Cyan’s products fulfil the ever-growing requirement for internet security for connected mobile devices. The roll-out of 3G, and more recently 4G, networks has made connecting to the internet through smartphones and tablets almost universally available and is on its way to becoming the dominant form of internet access. It is exposed to all the risks of internet access and indeed the prevalence of the Android operating system has tended to exacerbate the threat as it has a very open architecture.

Cyan’s products are white-label software, which is integrated into the offering of the mobile network operators (MNO) with no indication that they are sourced externally. The company considers this an important unique selling point (USP). This is unlike the situation for fixed-line internet connections where security products are more usually branded items purchased directly or indirectly from their developers such as Norton or McAfee. The tools are implemented at a network level and do not require downloads to the individual users’ devices. They simply require activation at a central level. Cyan’s products are offered as add-on items to its customers by the T-Mobile companies, which Cyan refers to as a B2B2C model in which its enterprise clients distribute the products to consumers.

Cyan’s launch product was a child-protection module, which was the first of its kind when introduced in 2013. Parents are naturally alert to the convenience and security benefits of giving their children mobile phones but are similarly alert to the risk that children might access unacceptable or disturbing content over the internet such as pornography, violent images or online gambling sites. Excessive use of devices for internet browsing constitutes a problem in its own right.

Cyan’s module gives parents flexible tools to manage their children’s access to the internet. Different categories of sites or even specific YouTube genres can be barred. Psychologically determined, age-related pre-settings can be applied. Searches can be directed through age-suitable channels. Set timetables for internet access can also be established.

Cyan followed up its child-protection software with a broader internet protection tool aimed at all consumers. This serves as a firewall, but rather than barring sites outright it tends to warn users of potentially dangerous URLs before they are accessed or downloaded from, letting the consumer make an informed choice.

As well as social and ethical benefits, Cyan’s B2B2C tools offer financial benefits. They are labelled as add-on modules to consumers, either giving them a sense of extra value for money if the cost is included in their base tariff or generating highly profitable incremental revenue for the operator if they are charged for. The revenue-sharing contract between Cyan and T-Mobile Austria is based on €2 per customer per month but there is a wide range of rates advertised. T-Mobile Austria charges €1.49 per month for the basic protection and €3.49 for enhanced protection, and €2 per six months for basic child protection and €4 for enhanced.

Cyan has also developed tools for enterprise customers to T-Mobile covering the devices with which they provide their employees for commercial purposes. In addition to barring the kind of generally unacceptable or dangerous content that would cause issues for most users, this tool also regulates access to non-work related content such as Facebook during working hours.

The core of Cyan’s cyber-security operation is a network of 200 distributed virtual data centres that continually monitor the internet using 23 different artificial intelligence (AI) processes. They generate and maintain a list of suspect or unacceptable URLs that is refreshed every four hours. The quality and extent of the database and the AI processes benefit from the iterative effect of several years in operation.

MNO clients generated the bulk of turnover in 2017 and this was mainly with two related operators: the Austrian and Polish subsidiaries of T-Mobile, the brand for the mobile phone businesses of Deutsche Telekom, the former German telecoms monopoly incumbent. T-Mobile’s Croatian operation also appears to be a client. T-Mobile Austria accounted for 75% of the business’s total turnover and Poland and other international business for some 9%.

Cyan’s cyber-security business with T-Mobile Austria is governed by a contract recently extended until 2021. Cyan bears half the cost of developing solutions that can be integrated into T-Mobile Austria’s network infrastructure and is compensated by a 50% share of the revenue generated by these products. This incorporates a guide level of €2 per customer per month. Where the Cyan product is bundled into customer contracts, this seems to be the imputed revenue.

The contract with T-Mobile Austria is exclusive provided that revenues for Cyan do not fall below €2.4m per year. If revenues fell below this level, Cyan would be free to licence the products developed for, and with, T-Mobile Austria to other operators in Austria. Actual annual revenue from T-Mobile Austria appears to have been running above the €2.4m trigger level.

Business with other subsidiaries and affiliates of Deutsche Telekom is governed by an overall framework agreement setting basic conditions. Individual local operations can reach agreements with Cyan adhering to these conditions. So far the relevant operations in Poland and Croatia have signed such deals, although negotiations with Croatia are still in progress, presumably to finalise a full-scale commercial contract. Cyan is also negotiating in Bulgaria and Macedonia.

MVNOs operate mobile networks using the physical infrastructure and networks of existing MNOs for which they pay charges based chiefly on volume usage. There is no obvious difference between the service provided to consumers by MVNOs and MNOs. In terms of their attraction to Cyan as potential clients, they not only require security solutions that Cyan already supplies but also have specific commercial requirements of their own.

Cyan has developed a tool specifically for MVNOs that manages their data traffic efficiently. In particular, it compresses data, eliminating material that is of no value to the MVNO. This includes phishing, tracker, advertising and cookie material that is injected into internet traffic by various parties. The MVNOs derive no revenue or other benefit from this yet, but if it is included in their customers’ data transit it swells the volume for which they have to pay the MNOs whose networks they use.

In a live proof-of-concept installation in Mexico, Cyan’s tool succeeded in reducing the volume of data transit paid for by the MVNO by 20%. This would represent a significant margin improvement for MVNOs.

In February 2018 Cyan signed a breakthrough contract for this solution with I-New, a major player in the MVNO field. I-New provides systems platforms for MVNOs on a near-turnkey basis. It is based in Austria like Cyan, but operates globally with a network of centres covering all major regions. There are an estimated 5.4 million end-user customers on the 24 MVNO networks currently enabled by I-New platforms.

The deal takes the form of a cost-savings sharing agreement under which a Cyan subsidiary will receive 25% of the reduction in data transit charges, achieved with its compression tool. I-New is will implement Cyan’s tool with its existing clients as well as to benefit from the enhancement of its proposition to potential new clients for its core offering.

Cyan is also negotiating directly with other MVNOs, offering a similar contract structure, sharing the cost savings achieved but as a direct vendor will receive half of such savings.

The adoption of mobile internet access has spurred the development of extensive consumer access to financial services such as banking over mobile devices. In the UK 34% of current account holders banked via mobile devices in 2015 compared to 8% in 2010. There is no reason to suppose growth has declined since then and the experience of other countries is almost certainly similar. This is predictably enough of a prime target for criminal attack, creating a requirement for security tools to protect users.

Cyan has produced a software development kit (SDK) that gives financial service providers the resource to add extensive security features to the apps they supply their clients so they can access and operate their accounts. The SDK can be applied without Cyan gaining or requiring access to customer personal, account or transaction data. The security features embrace real-time protection against phishing and malware, antivirus scanning and identity verification. As with Cyan’s cyber security tools, these can be offered to end users as add-on modules, potentially generating incremental revenue for the financial service providers (FSPs).

Cyan launched its product on the market in May 2017 and by the end of the year it had already signed breakthrough deals for the SDK with two high profile FSPs:

In 2018 Cyan aims to roll out a version of the SDK that can be used for mobile gaming apps.

Cyan still derives some business from its original network B2B business developing and implementing enterprise firewalls and other security solutions. This still accounts for some 15% of turnover.

Across all its areas of business Cyan has a well-filled sales pipeline. It is already at the draft contract stage with five potential new customers and management puts the probability of signing commercial contracts at 75%. According to the prospectus Cyan was in negotiations with a total of 36 potential new clients that include major enterprises and this figure has grown since the prospectus was finalised. New contract negotiations are split across all product areas with the largest proportion amongst MVNOs, followed by FSPs and then a still-significant number with MNOs. By the end of 2018 the annual run-rate of business from MVNOs is expected to exceed that from T-Mobile Austria, implying annualised incremental revenues from MVNOs alone of €3-3.5m on our estimates.

Revenue from T-Mobile Austria continues to growing significantly and the boost to finances from the IPO will permit additional marketing. The legacy business is largely stable.

Cyan is considering using some €1m of the proceeds of the IPO to invest in a mobile anti-virus software businesses. As yet, this has not been a major focus of CSG’s product offering.

There is a major potential market for a feature already possible in Cyan’s mobile offering: the panic button feature that can be used to alert emergency services, friends or family to a threat to the device user. It can transmit global positioning system (GPS) user location data generated by the device. Here, the likely potential customers are governments. For example, the government of India has attempted to mandate the universal availability of this feature in response to public outcry at well-publicised horrific rape attacks. Potential is especially strong in countries which have no functioning national emergency service alert telephone number on the pattern of the US 911 service.

Cyan is also interested in addressing the potential for security solutions to protect devices connected to the Internet of things. Here the possible threats are driven by malicious acts by outright vandals, criminals attempting extortion or terrorists.

Parallel to the transformation of the operating business model into one far more diversified by product and client, Cyan is undertaking a radical change in its corporate structure that will see it move from a private Austria-domiciled company to a publicly quoted German entity with new shareholders, including a public shareholding of some 16%. The key component in this is the progressive transfer of ownership of the original operating company to a newly created German limited company.

Cyan has a €6m banking facility in place which covers current financing needs. By the end of the IPO and 100% acquisition of CSG we estimate that it will have a neutral net cash/debt position as the €39m cost of buying the 75% of CSG under the option agreement could be met from €3m of cash at end 2017, €6m pre-IPO capital increase and around €30m in IPO proceeds after costs.

Supervisory board and management board

Cyan has a three-man management board and a three-man supervisory board.

Two members of the management board have a long involvement in the business.

The members of the management board receive both fixed and variable remuneration. Between them, they have salaries of €0.8m; Peter Arnoth and Markus Cserna are also receive remuneration of €0.14m as directors of CSG. They are also each to receive 2.45% of Cyan EBITDA as variable remuneration. Michael Sieghart receives 1.7% of EBITDA and is also to receive a one-off fee of €0.2m if the IPO succeeds.

The members of the supervisory board have extensive experience in the investment world.

Shareholders and free float

Apart from the management, which holds 10% of Cyan in its new form, the other pre-IPO shareholders do not appear to have been connected to the company before 2017.

The pre-IPO shareholders are bound by lock-up agreements with the company and the issuing banks. For the first six months after the first day of trading, they are barred from disposing of 87.5% of their holdings in any form. For the following six months they must obtain the written permission of the issuing banks for any disposals. The prospectus anticipates that 73% of the shares will not be traded until March 2019, which appears to recognise that the portion of the pre-IPO’s holdings not covered by the lock-up agreement might be sold on the stock exchange.

The prospectus examines the effect on the net asset value (NAV) of the shares under various IPO scenarios. The general conclusion is that holders of pre-IPO shares will enjoy an immediate uplift to the NAV of their shares. The overall boost to the share premium will be created by the issue of new shares in the IPO at a large premium to par value but will be shared among all holders.

The prospectus puts the pre-IPO NAVPS at €1.52. Assuming an IPO in the middle of the price range at €21.5 and exercise of the Greenshoe the prospectus calculated NAVPS of €4.57. Clearly the final outcome will be somewhat different given the IPO price of €23 but the new shareholders are paying in the region of 5x book value for their shares.

It appears that pre-IPO shareholders acquired their stock at around the-then ruling book value except for two possible exceptions discussed below. There would thus be a substantial gain post IPO.

CSG was at a healthy level of profitability soon after its business with T-Mobile Austria in mobile network security products began. Financial data are only available from 2015 onwards but Cyan has been profitable at all levels in all reporting periods since then. Moreover, it has been able to finance its business without recourse to fresh capital despite the costs of developing the new products aimed at MVNOs and FSPs and distributing much of its net profit to its owners.

The inherent value that the business has attained can be gauged from the fact that Cyan’s 25% holding at 31 December 2017 was valued at €5m on the balance sheet compared to a stated book value for the whole group of only €0.27m.

The established businesses should remain as profitable and cash generative as they have been although remuneration of the management board will absorb approximately the same amount of income and cash as was distributed annually to the owners of CSG. As CSG was able to fund the development of its new products, we do not anticipate that Cyan in its new form will require external financing unless the marketing, client-specific configuration and implementation costs prove to be onerous. Post-IPO, Cyan will not distribute dividends.

The absence of any per-share or pro-forma data (other than NAVPS) makes it hard to apply conventional techniques such as peer group analysis. The valuation of the company on historical data is so demanding it is of limited value; the market capitalisation at the IPO price of €193m compares to turnover and net profit of €3.59m and €1.24m respectively. Clearly by far the dominant influence on the valuation of the shares will be the pace at which the new product areas generate turnover and profit.

We understand the terms under which Cyan acquired the 25% stake in CSG shown in the end December balance sheet at a value of €5m was similar to the price of the shares acquired under option implying a purchase cost of some €52m for 100% of CSG. This can be understood as an unquoted company number and backward-looking figure driven by the goals of founder and other early-stage investors, rather than a forward-looking assessment of the company’s potential.

We believe the following factors may influence the share price: