CORERO NETWORK SECURITY PLC (CNS) — Investment Research Note

Executive summary

Corero is an AIM-listed cybersecurity specialist providing automated, real-time DDoS protection to Tier-1 telcos, cloud/hosting providers and enterprises, historically priced at ~$0.5-2m per multi-year contract and delivered as on-premise appliances, subscriptions and DDoS-Protection-as-a-Service ("DDPaaS"). The last five years show revenue creeping from $16.9m (2020) to $25.5m (2025) with margin choppiness — the 2025 transition to a subscription-heavy mix depressed EBITDA and provoked a guidance downgrade, followed by a striking H1 2026 rebound (revenue +42% YoY, EBITDA $2.6m vs -$1.4m loss) 2026-08 half-year trading update. The single most important valuation point today: at a £37m market cap, Corero trades on ~1.1x annualised H1 2026 sales / ~7x an implied FY26 EBITDA run-rate, while it is finally demonstrating the operating leverage that its 90-93% gross margin should have always implied.

Fair value estimate

Methodology: blended forward EV/Sales and EV/EBITDA on FY26E, cross-checked against ARR multiple. Company reports in USD; converted to GBP at £1 = $1.30.

Assumptions:

• FY26E revenue: $30-33m (H1 2026 delivered $15.5m; management guided "confidence in H2"; ~10-15% H2 seasonal uplift historically) → £23-25m
• FY26E EBITDA: $4.5-5.5m (H1 $2.6m annualised + operating leverage on H2 seasonality – reinvestment) → £3.5-4.2m
• ARR at 1 Jan 2026: $24.1m growing ~15% → £19-21m
• Applied EV/Sales 2.0-2.5x (software peers Radware ~2x sales, Cloudflare 15x+ but at scale) and EV/EBITDA 10-13x
• No net debt; add ~£1.5m net cash

Range:

• Sales multiple: £46-63m EV → 9-12p / share
• EBITDA multiple: £35-55m EV → 7-11p / share
• ARR multiple 2.5-3x: £48-63m EV → 9-12p / share

Fair value range: 8-12p per share, midpoint ~10p → implied market cap £41-61m (mid £51m).

Vs current 7.25p / £37.1m mcap: absolute upside ~+38% to midpoint, range −0% to +66%.

Sector context

Correctly classified as Technology / Software & Computer Services. Within that, Corero is a specialist cybersecurity (network security / DDoS mitigation) sub-vertical player. Growth is above traditional software peers (mid-teens ARR), gross margin 90%+ is peer-leading, but scale (<$30m revenue) and lumpy order intake are well below typical sector maturity. Balance sheet is stronger than typical AIM tech peers (no debt) but cash cushion is thin. Listed peer set: Radware (NASDAQ: RDWR) — closest direct competitor; NetScout (NASDAQ: NTCT) — network security overlap; Cloudflare (NYSE: NET) — indirect via managed DDoS cloud service.

Investment thesis

1. Operating leverage now visible. After 2025 absorbed the DDPaaS mix shift, H1 2026 delivered revenue +42% and swung EBITDA from -$1.4m to +$2.6m at 93% gross margin, demonstrating that the fixed-cost base ($21m opex in 2025) needs only modest incremental revenue to compound EBITDA rapidly 2026-08 half-year trading update; 2026-03 final results.
2. AI-tailwind via cybersecurity buildout. DDoS attack volumes are rising with AI-enabled botnets and hacktivism; management cites 800% surge in US attacks post-Iran strike and 37% growth in attack frequency since 2018. Corero's own CDIS is an AI-assisted mitigation service, and its addressable DDoS market is forecast to more than double from $7.2bn (2025) to $15.9bn (2030), 17% CAGR 2026-03 final results.
3. Tier-1 validation and ARR compounding. Post-H1 2026 win of a $1.4m 3-year Tier-1 US telco contract (competitive displacement) and 2025's $6.8m US cloud provider renewal+expansion demonstrate the product wins at the highest tier; ARR up 23% in 2025 to $23.9m against 96-98% retention builds durable base 2026-08 half-year trading update; 2026-03 final results.

Key risks

1. Guidance track record is patchy. FY25 was cut in July 2025 from $28.75m consensus to a $24.0-25.5m range with EBITDA moving from $3.95m consensus to a $0-1.5m loss range — a material downgrade — and FY22 also missed on revenue and EBITDA versus prior guidance 2025-07 half-year trading update; 2023-01 trading update.
2. Thin cash cushion & working-capital risk. Cash at 30 June 2026 was just $2.1m (from $4.0m at YE 2025), and management put in place a $2.0m overdraft to manage subscription-driven cash deferral. Small operating misses could rapidly consume liquidity, though no debt is drawn 2026-08 half-year trading update.
3. Customer concentration and revenue lumpiness. Individual contract wins ($6.8m from one US cloud customer, $1.8m TierPoint) drive material quarterly outcomes; a single lost renewal at Tier-1 scale could reverse a full year's ARR progress. Aggressive R&D capitalisation ($3.5m in 2025 vs $1.5m EBITDA) also flatters headline earnings quality 2026-03 final results.

Operating leverage

Corero is close to a textbook example of the profile this strategy targets. Gross margin is 90-93%; cost of sales is ~$2.5m on $25.5m revenue 2026-03 final results. Operating expenses before D&A ran at $21.5m in 2025 and are essentially fixed R&D, sales & marketing and G&A — H1 2026 opex barely moved despite the revenue jump. The observable proof: H1 2026 revenue +$4.6m YoY drove EBITDA +$4.0m — an incremental contribution margin above 80%. If FY26 revenue reaches $30m (vs $25.5m in 2025), EBITDA should plausibly triple from $1.5m to $4.5-5.5m. If H2 2026 continues H1 momentum ($15.5m + seasonal H2 uplift, plus post-period Tier-1 win recognition), revenue could exceed $32m and EBITDA >$6m. Inflection points: (a) subscription mix now approaching steady state (ARR $24m of $30m+ implied FY26 revenue) so the 2025 headwind is fading; (b) channel/alliance partners (Akamai, Juniper, HPE, TechEnabler) leverage the same fixed cost base into new geographies at essentially zero incremental cost 2026-03 final results.

Value-trap signals

• Repeated guidance misses (2022 and 2025 materially below consensus at issuance).
• Persistent flatlining of PBT (losses in 2023 and 2025, tiny profits in 2024).
• Aggressive R&D capitalisation ($3.5m in 2025) inflates reported EBITDA — cash R&D outflow is real.
• Thin balance sheet cushion; reliant on overdraft facility for working capital.
• CEO changes (Chmilewsky replaced by Herberger Jan 2024) and CFO change (Goulden May 2024) reflect execution reset.

Not sufficient to conclude structural value trap — end market growth is real, product traction is validated, and cash is generative in H2s.

Earnings vs. expectations

• FY2020: no explicit consensus given, but delivered EBITDA loss $1.4m — largely met.
• FY2021: Delivered $20.9m revenue and $4.0m EBITDA vs pre-close guidance — beat materially on EBITDA (including $0.6m PPP loan credit).
• FY2022: Guided in October to 15-25% order intake growth and 5-10% revenue growth; delivered $20.1m revenue vs implied ~$22m — missed revenue; adjusted EBITDA guided $1.0-2.0m, delivered $1.7m — met.
• FY2023: Delivered $22.3m revenue, adjusted EBITDA $2.2m — broadly met.
• FY2024: Guidance $25.35m revenue / $2.45m EBITDA; delivered $24.6m / $2.5m EBITDA — slight revenue miss, met EBITDA.
• FY2025: Consensus $28.75m / $3.95m EBITDA at start of year; cut in July to $24.0-25.5m / $-1.5-0m EBITDA — large miss; then closed at $25.5m / $1.5m EBITDA (upper end of revised range, ahead of downgraded EBITDA).
• H1 2026: No explicit consensus in filings but +42% revenue and $2.6m EBITDA are clearly above the trajectory implied at last downgrade — appears to be a beat.

Pattern: consistent history of over-promising and under-delivering on annual guidance until 2025 reset; H2 2025 and H1 2026 look like a genuine inflection but require another two quarters to confirm.

Conviction: 3 (moderate)

Supports: clean disclosure of ARR, order intake and EBITDA drivers; two convergent valuation methods (EV/Sales, EV/EBITDA, ARR multiple) all land in a similar 8-12p range; peer benchmarks (Radware, A10) exist and confirm the multiple range is reasonable.

Limits: H1 2026 EBITDA inflection is only one half of data and could reverse; small-scale means a single lost tier-1 renewal could re-rate the stock; aggressive R&D capitalisation and thin cash cushion mean quality-of-earnings deduction is warranted.