The CEO of NCC Group PLC (LSE:NCC, Financial), Adam Palser, has managed to steady the ship in his four and half years in charge of the U.K.-based cybersecurity company. Prior to his arrival, the company had been dogged by accounting issues and lack of direction.
Palser steps down soon, and incoming CEO Mike Maddison, until recently in charge of cybersecurity for the Europe, Middle East and Africa region at private professional networking services company EY, takes the reigns at an exciting time for the more resilient and better focused group.
I believe this stock is undervalued by the market due to the company's historical issues, which have now been resolved, as well as the uncertainty that comes with a new CEO. Combine this with operating in the high-growth cybersecurity industry and I see a recipe for returns.
Assurance
NCC has two segments: assurance and software. The larger, assurance, is a cybersecurity consultancy and advisory service that helps clients better identify cyber risks and reduce threats, which includes recommending and deploying the most appropriate software. This is more of a solutions business than a software company.
Due to the constantly developing nature of cyberattacks, people still have an important role to play in setting up defences. In the first half of NCC’s financial year, which ended in May, assurance segment revenues came in at 123 million British pounds ($154 million), or 82% of the group total. This was up 5% from the same period in the previous year. Meanwhile, the gross margin rose 1.2 percentage points to 36%.
NCC has managed to improve efficiencies by utilizing its global workforce via remote working, which has helped offset wage inflation. The result, NCC says, is that the whole workforce “can now be deployed on high value engagements, smoothing out peaks and troughs of demand or skill shortages.”
Management has guided assurance segment revenues to grow about 15% in the second half of the year, which would translate to a double-digit percentage growth in revenues for full fiscal 2022. This comes from a rise in both volume and prices. This means NCC believes it has the pricing power to pass rising costs on to customers without giving up market share.
Software
NCC’s other segment has had a difficult time recently. The software segment provides both on-site and back-up cloud services in case a customer’s software provider breaks down. NCC helps the customers “maintain or recreate an application from the original source, should it ever be needed.”
In the first half of last year, continuing revenue from the software segment fell 3.3% on a constant currency basis. This drop was a little bit surprising and came from issues related to “attracting and retaining sufficient sales resources,” which meant a fall in U.K. and U.S. contracts. A tight labor market has made it difficult to attract the right people.
This should all be in the past now. In a trading update published on May 9, the company said it expected software to return to revenue growth in the second half of this year. This should be driven by last June’s $220 million acquisition of U.S. intellectual property management business IPM from Iron Mountain (IRM, Financial).
Management says the integration of this new business is “significantly advanced” with clients already successfully migrated. NCC also expects to bring £5 million of extra cost savings by 2024 thanks to synergies coming from economies of scale as the acquisition gives it access to the far larger U.S. market.
Although Iron Mountain is a large player in the U.S., it has been slow to develop its software as a service solution. NCC expects revenue growth from offering “cloud and wider cyber resilience services to IPM’s extensive customer base over the medium term." Software resilience is a less important part of the business, but its chunky gross margin of 71.7% is almost double the gross margin in the assurance segment. If revenues pick up post acquisition, then it could drive group margins higher and support earnings growth.
Cybersecurity market growth
In the last two years, many companies sped up their digital adoption and built up cloud capabilities and capacity. This allows people to work more flexibly, but also creates more scope for security risk in company computer networks.
The cybersecurity market is expected to grow at a compound annual growth rate of around 11% from 2021 to 2028 globally, according to business consulting firm Grand View Research. This has helped support high valuation multiples in the sector. Artificial intelligence software company Darktrace (LSE:DARK, Financial) is currently trading at a forward price-sales ratio of about 11, for example, while CrowdStrike (CRWD, Financial) is worth about 23 times its forward sales estimates.
NCC is viewed differently by the market, as demonstrated by its price-sales ratio of 3. The company generates a lot of cash because it doesn’t use much working capital. In the first half of this year, the cash conversion ratio was 74.7%. When the £6.4 million in IPM acquisition costs are taken out, it was an even better at 99.2%.
I believe NCC’s low valuation is probably thanks to a combination of its historical mismanagement and the more recent difficulties in its software arm. However, I think we have reason to look beyond these temporary issues. Palser’s tenure has fixed many management issues, and the recent acquisition of IPM gives the group a runway for growth in the resilience business.
The company has a strong Piotroski F-Score of 7 out of 9 and a strong Altman Z-score of 3.3, so financially it is sound. The GF Value chart rates it as fairly valued too.
