Corero Network Security plc (CNS.L) — Research Note
Executive summary
Corero is an AIM-listed cybersecurity specialist focused on on-premise and hybrid DDoS protection appliances and "DDoS-Protection-as-a-Service" (DDPaaS), sold mostly into US hosting/cloud/telco providers. Over the 2021–2025 window the headline trajectory is one of slow revenue growth ($20.1m → $25.5m), expanding ARR (FY25: $23.9m, +23% YoY) but declining profitability — peak EBITDA was $4.0m in 2021 and FY25 closed at $1.5m with a small loss before tax, after a meaningful July-2025 profit warning that cut FY25 EBITDA guidance from ~$3.95m consensus to a range of -$1.5m to $0m 2025-07-16 trading update. The single most important point for valuation today is whether the SaaS/DDPaaS mix shift (which mechanically suppresses near-term reported revenue & EBITDA) actually compounds into a materially higher-margin subscription business, or whether competitive pressure from Cloudflare/Akamai/Arbor caps it as a sub-scale niche player.
Fair value estimate
- Fair value range: 10p – 16p per share (mid ~13p)
- Implied market cap range: £52m – £80m (mid ~£66m)
- Methodology: EV/ARR multiple, cross-checked with EV/revenue. Applied 2.5x–4.5x ARR to FY25 ARR of $23.9m (~£17.7m at 1.35), plus ~$4m net cash. Sub-scale cybersecurity SaaS peers (e.g. low-growth, sub-£100m mcap names) trade in a wide 2–6x EV/ARR range; CNS deserves a discount for limited scale, profit-warning track record and concentration but a premium for 98% retention and net-cash balance sheet.
- Vs current £64m mcap (~12.5p): modestly within range; absolute upside ~3% to midpoint.
- Absolute upside: ~+3% (downside ~-20% to low end, upside ~+25% to high end).
Sector context
Confirmed Technology / Software & cybersecurity. CNS sits at the small-cap, sub-scale end of cybersecurity — gross margins (90% in FY25) and 98% retention are in line with quality SaaS peers, but EBITDA margins (~6% in FY25, down from ~19% in 2021) and growth (4% revenue CAGR 2021–25) are well below comparable scaled cybersecurity peers. Listed comparables: NetScout Systems (NTCT) — closest direct DDoS competitor (Arbor), much larger; Cloudflare (NET) and Akamai (AKAM) — both larger DDoS players, the latter being a Corero alliance partner; on AIM, peers include Kape Technologies (now private) and Intercede (IGP). CNS's quality is in-line on margins, below typical on growth.
Investment thesis (3 bullets)
- Subscription transition genuinely accelerating recurring revenue base — ARR up 23% to $23.9m in FY25, with subscription revenue category now $8.3m vs $5.9m prior year, supported by 98% retention and visible DDPaaS-led contract wins like the $6.8m three-year US cloud-provider renewal+expansion 2026-03-24 final results.
- Strong H2 2025 reversal and Q1 2026 momentum — H2 2025 revenue grew 18%, beat reduced EBITDA guidance ($1.5m vs $0m guidance), and management called Q1 2026 "significantly exceeding Q1 2025" with a robust pipeline 2026-01-12 trading update; 2026-03-24 final results.
- Debt-free balance sheet plus durable structural demand tailwind — net cash $4m, undrawn £1.5m overdraft, with industry data pointing to DDoS-protection TAM growing from $7.2bn (2025) to $15.9bn (2030) at 17% CAGR, fuelled by AI-augmented attacks, hacktivism and EU DORA / UK Cyber Resilience regulation 2026-03-24 final results.
Key risks (3 bullets)
- Material guidance miss in 2025 vs consensus — Original FY25 consensus was ~$28.75m revenue and ~$3.95m EBITDA; July cut delivered ~$25.5m revenue and only $1.5m EBITDA, the latest in a pattern of optimistic outlooks followed by softer outcomes (also 2022) 2025-07-16 trading update.
- Customer concentration and competitive squeeze — the single largest deal ($6.8m to a US cloud provider) is meaningful relative to ARR; CNS competes with vastly larger cloud-native DDoS providers (Cloudflare, Akamai, Arbor/NetScout) increasingly bundling DDoS into broader security offerings 2026-03-24 final results; 2025-04-01 final results.
- Cash burn risk if subscription mix-shift continues to outpace cost-base flex — Group invested $3.5m capitalised dev expenditure in 2025 against $1.5m EBITDA, and cash fell from $5.3m to $4.0m despite positive H2 generation; an extended SaaS transition pulls revenue recognition into out-years while opex hits today 2026-03-24 final results.
Operating leverage
Corero has the structural ingredients for high operating leverage: 90% gross margins, ~$23m of largely fixed annual operating costs (R&D ~$3.5m capitalised plus expensed engineering, plus relatively fixed sales/marketing/admin), and a software/appliance product where incremental units carry near-zero variable cost beyond hardware appliance COGS. The recurring revenue base ($23.9m ARR with 98% retention) gives a fixed-cost-covering layer. Mathematically, if FY26 revenue grew 15% above current trajectory (to ~$29m vs implied ~$26m), and contribution margin on incremental revenue was ~80%, that ~$3m incremental revenue would drop ~$2.4m to EBITDA — i.e. doubling EBITDA from $1.5m to ~$4m. The 2021 result ($20.9m revenue, $4.0m EBITDA) shows the model can deliver ~19% EBITDA margins at scale. The frustration is that 2022–2025 demonstrate the reverse leverage when sales & marketing investment outruns revenue growth — opex up while revenue stalled. The operating leverage potential is genuine and high (60–75 band), but execution risk on translating ARR growth into EBITDA flow-through is the open question. 2026-03-24 final results; 2022-04-26 full year results
Value-trap signals
- Profit warning history: H2 2022 guidance miss, July 2025 EBITDA cut to nearly break-even from $3.95m consensus.
- Multi-year EBITDA decline despite revenue growth — peak EBITDA was 2021 ($4.0m) and has fallen every year since to $1.5m in 2025; ARR has grown 87% over the same period.
- Capitalised R&D running at ~14% of revenue ($3.5m on $25.5m) flatters reported EBITDA vs cash performance.
- Persistent management changes — CFO replaced 2024, CEO replaced 2024 (Chmilewsky → Herberger after Chairman briefly executive), suggesting strategy still in flux.
- No dividend, sub-scale AIM listing — typical small-cap liquidity drag.
Earnings vs expectations
| Period | Prior guidance / consensus | Delivered | Outcome |
|---|---|---|---|
| FY 2021 | n/a (maiden profit) | Rev $20.9m, EBITDA $4.0m | Beat — record year |
| FY 2022 | Consensus implied ~$22m rev | Rev $20.1m, EBITDA $2.6m | Miss (Oct-22 warning) |
| FY 2023 | In line at H1 | Rev $22.3m, EBITDA $1.8m | In line |
| FY 2024 | Mkt: $25.35m rev, $2.45m EBITDA | Rev $24.6m, EBITDA $2.5m | Marginal miss revenue, meet EBITDA |
| FY 2025 | Original: $28.75m rev, $3.95m EBITDA → Cut Jul-25 to $24–25.5m rev, -$1.5m to $0m EBITDA | Rev $25.5m, EBITDA $1.5m | Big miss vs original; beat lowered |
Pattern: optimistic initial outlooks followed by mid-year guidance cuts, then in-line-to-modest beats vs the reset bar. Net: more misses than beats against original expectations.
Conviction
Conviction: 3 (moderate). Anchored by: (i) clean disclosure, simple single-segment business, audited unqualified accounts; (ii) ARR is a directly observable forward-revenue anchor; (iii) net-cash balance sheet limits downside scenarios. Limited by: (i) wide reasonable range of revenue multiples for a sub-scale, low-growth cybersecurity name; (ii) the question of whether 2025 EBITDA is a trough or a new run-rate is unresolved — 2026 outcomes will materially shift fair value.