Back to catalogue
№ 402 24 filings · 2021-08-31 → 2026-07-27

SHEARWATER GROUP PLC

SWG
Technology Share price 69.50p Market cap £17m Overall fit 480 /1000

A cheap, cash-rich micro-cap cyber play with genuine AI-attack-surface tailwinds and improving execution — but sub-scale, thin gross margins, limited operating leverage and a history of large misses cap the fit. Right idea, fair price, wrong size and quality profile for a top-band score.

Fair value range 75p–110p Mid case · £22m
Absolute upside +32.8% vs current market cap
Conviction 3/5 confidence in undervalued call
Supports the call
  • two consecutive above-consensus results in FY25/FY26
  • net cash of £5.6m = 40% of market cap
  • cheap on EV/EBITDA (c.3.4x FY26E)
Limits the call
  • repeated goodwill impairments and revenue-recognition changes weaken earnings quality
  • prior FY23/FY24 misses were 30%+ on revenue — base rate of guidance reliability not yet re-established
Methodology

EV/EBITDA multiple (6-8x) on FY27E adjusted EBITDA, plus net cash

In one line · bull case

Cash-rich micro-cap UK cyber-services group trading on c.3x FY26E EV/EBITDA after two consecutive above-consensus results, with imminent buyback/dividend authorisation providing a hard downside anchor.

In one line · biggest risk

Loss or timing slip of a single large Services contract could push the group back to breakeven — as happened in FY23 and FY24, when revenue missed consensus by 30%+.

Drivers
AI beneficiary 55 /100
Legitimate cybersecurity beneficiary of AI-driven threat expansion, but small scale and reseller-heavy Services mix means much of the AI $ flows through to vendors like Proofpoint, not to Shearwater.
Operating leverage 40 /100
Software segment (11% of revenue) has strong leverage at 62-72% GM; Services (89%) is largely pass-through reseller economics with 17-22% gross margin.
Earnings vs expectations 55 /100
Two consecutive material beats (FY25, FY26) follow two material misses (FY23, FY24) — trending positive but base rate not yet re-established.
Growth momentum 70 /100
Revenue +33% annualised in FY26; strong contract pipeline; G-Cloud 15 expansion from 32 to 55 products in FY27.
Moat 30 /100
Narrow — differentiation from customer relationships, defence-cleared MFA products and G-Cloud framework status; no network effects or switching costs.
Earnings quality 40 /100
Revised revenue recognition policy in FY25, £6m goodwill impairment in FY23 and again in FY25, adjusted EBITDA excludes £1-2m of amortisation of acquired intangibles that reflect real M&A economics.
Management quality 50 /100
Higgins/Hall combination has delivered two years of above-consensus results but presides over £47m of accumulated losses; capital-allocation history from prior buy-and-build has been value-destructive at group level.
Cyclicality 25 /100
Cybersecurity spend is largely non-discretionary; prior misses were execution/timing rather than cyclical.
Leverage 10 /100
Net cash of £5.6m, no debt, undrawn RCF previously in place — fortress balance sheet.
Value-trap signals · 5
  • revised revenue recognition policy that dropped headline Services gross margin from 24% to 17%
  • cumulative £12m of goodwill impairments across FY23 and FY25 (30% of prior NAV)
  • £47m accumulated losses vs £22m share capital
  • Software segment revenue declining 12% YoY in H1 FY26 despite being higher-margin
  • concentrated customer book — one customer was 30% of FY23 group revenue

Shearwater Group plc (AIM: SWG) — Investment Research Note

Executive summary

Shearwater is a UK-based cybersecurity buy-and-build group operating two segments — Services (managed security, systems integration, penetration testing, advisory) and Software (SecurEnvoy identity/access management + GeoLang data discovery), selling primarily to UK blue-chip corporates and government. After a painful FY23 (revenue -26%, £6m goodwill impairment) trading has inflected sharply, with FY25 revenue of £39.5m (15-month period) and FY26 tracking to c.£42m and £2.5m adjusted EBITDA — both ahead of consensus 2026-07 FY26 trading update. The single most important valuation point is that at £14.2m market cap the group is trading on c.5.7x FY26E EV/EBITDA (£8.6m EV / £2.5m EBITDA) with £5.6m net cash — a low-teens multiple for a growing niche cyber-services business.

Fair value estimate

  • Fair value range: 75p – 110p per share (implied market cap £17.9m – £26.2m)
  • Methodology: EV/EBITDA multiple on FY27E adjusted EBITDA, cross-checked against EV/sales.
  • Assumptions:
    • FY27E revenue: £46m (c.10% growth from FY26E £42m)
    • FY27E adjusted EBITDA: £3.0m – £3.5m (margin expanding from 6% toward 7-8% on operating leverage)
    • Target EV/EBITDA multiple: 6x – 8x (a discount to listed cyber peers reflecting AIM micro-cap illiquidity, thin margins and mixed track record)
    • Add net cash of £5.6m
    • Low case: 6x × £3.0m + £5.6m = £23.6m ≈ 99p; but I anchor low to £17.9m/75p to reflect the disappointing Software line and the low-quality Services gross margin (17-20% under new revenue recognition)
    • High case: 8x × £3.5m + £5.6m = £33.6m — clipped to £26.2m/110p to avoid crediting the AI-cross-sell narrative
  • Vs. current £14.2m market cap: mid-point £22m implies +55% upside (range: +26% to +85%)
  • Cross-check: on FY26E EV/sales of 0.2x, peers (Kape, Corero, Osirium historically) traded 1-3x; even 0.4x sales for the mid-point would imply a £22m EV / £27m market cap.

Sector context

  • ICB Technology / Software & IT Services confirmed.
  • Quality/growth profile is below typical cybersecurity peers: gross margins are Services-industry-typical low-20s%, not SaaS-like 70-80%; EBITDA margin is 6% vs. 15-25% for scaled cyber names. Balance sheet quality is above peer average (net cash, no debt).
  • Listed comparables: Corero Network Security (LON: CNS — DDoS, UK AIM), Kape Technologies (delisted, prior peer), NCC Group (LON: NCC — larger cyber-services). Also loosely comparable: Osirium Technologies (LON: OSI, PAM software).

Investment thesis

  • Sharp trading inflection with beats above consensus in FY25 and FY26. FY26 revenue of c.£42m and adjusted EBITDA of £2.5m are above broker estimates of £35.5m/£2.4m, extending the run from FY24 (£22.6m / £0.9m) 2026-07 FY26 trading update.
  • Fortress balance sheet at a micro-cap valuation. £5.6m net cash represents c.40% of market cap; the board is now seeking shareholder approval to reallocate reserves to enable buybacks and/or a dividend 2026-07 FY26 trading update. Downside is protected by tangible cash and by G-Cloud framework revenue visibility.
  • Genuine cybersecurity beneficiary of AI-driven attack surface expansion. Management explicitly cites "accelerated integration of AI across our end markets that increasingly fuels the need for secure systems" and has secured major multi-year contracts (£7.3m mobile operator extension, £9m financial services renewal, £12.9m 5G monitoring, $12.8m telco) that speak to real demand 2026-03 interim; 2024-11 interim.

Key risks

  • Gross margin quality is weak and structurally opaque. Under the revised IFRS revenue policy, Services gross margin was 17% in H1 FY26 vs. 24% restated prior year, driven by cloud-hosted/reseller mix. Small changes in mix drive large swings in EBITDA on this cost base 2026-03 interim.
  • Concentration and lumpy revenue. One customer accounted for £8m of FY23 revenue (30% of group); H1 FY26 accounted for £1.5m of receivables timing that pushed period-end cash to £2.2m. Loss or delay of a single major contract is a material profit event 2023-09 final results; 2026-03 interim.
  • Long history of missing expectations and volatile results. FY24 revenue came in at £22.5m vs. £32.5m consensus (a 31% miss), and FY23 also missed materially; the two recent beats need to be seen against a longer pattern of misses, and this remains a sub-scale (£14m cap) AIM stock with limited analyst coverage 2024-04 FY24 trading update; 2023-03 trading update.

Operating leverage

Shearwater's cost base is modestly fixed but not the classic high-operating-leverage SaaS profile. Central group costs of £1.3-1.8m plus divisional overheads of c.£5-6m give a fixed cost floor of c.£7m, against gross profit of £6-10m. The Software segment (11% of revenue) has genuine leverage — 62-72% gross margin and 36-40% EBITDA margin at just £2.6m revenue 2026-03 interim — but is too small to move the group. The Services segment, which dominates, runs at 17-22% gross margin because much revenue is pass-through reseller/licensing where cost of sales scales 1-for-1. The result: a 10-20% revenue beat likely converts to a c.£0.8-1.5m EBITDA uplift (i.e. +30-60% on £2.5m EBITDA) — meaningful but not "multiples of profit." The most promising leverage vector is the Software division scaling on its existing R&D base: incremental software licence revenue would drop at 60%+ contribution margin. The G-Cloud 15 expansion (from 32 to 55 products) is the near-term catalyst 2026-03 interim.

Value-trap signals

  • Revised revenue recognition policy (announced FY25) that materially reduces headline Services gross margin — needs monitoring for further changes.
  • £6m goodwill impairment in FY25 and a further £6m in FY23 across SecurEnvoy/Xcina — 30% of net asset value has been written off since FY22.
  • £47m accumulated losses vs. £22m share capital / £34m share premium — the group has cumulatively destroyed capital across its buy-and-build history.
  • Software revenue declining — down 12% YoY in H1 FY26 despite being the higher-margin segment.
  • Historic pattern of guidance misses (FY23, FY24) before recent beats.
  • 19% related-party (director) stake — governance to watch though voting alignment is a positive.

Earnings vs. expectations

  • FY22 (Jul 2022): revenue £35.9m vs. no explicit prior guidance — beat with EBITDA £4.4m ahead of expectations.
  • FY23 (Mar 2023 update): revenue £27m vs. consensus £37.7m, EBITDA breakeven vs. £4.4m consensus — material miss.
  • FY24 (Apr 2024 update): revenue £22.5m vs. consensus £32.5m, EBITDA £1m vs. £2.5m — material miss.
  • FY25 (Jul 2025 update): revenue £41m vs. consensus £39m, EBITDA £2.2m vs. £2.0m — beat.
  • FY26 (Jul 2026 update): revenue £42m vs. consensus £35.5m, EBITDA £2.5m vs. £2.4m — beat. Pattern: two large misses (FY23, FY24) followed by two consecutive beats (FY25, FY26). Recent execution has clearly improved under Higgins/Hall, but the four-year track record is mixed and the base rate of guidance reliability is not yet re-established.

Conviction

Conviction: 3 (moderate).

Supporting: (i) two years of consistent, above-consensus delivery with the beats confirmed via inside-information RNS; (ii) fortress balance sheet with £5.6m net cash and imminent capital-return authorisation, providing a hard downside anchor; (iii) low multiple (c.3.4x EV/EBITDA on FY26E) means even a conservative peer-relative multiple generates upside without a re-rating narrative.

Limiting: (i) recurring accounting-policy changes and repeated £6m goodwill impairments make historical comparisons unreliable and cast doubt on prior earnings quality; (ii) demonstrated 30%+ downside surprise on revenue in both FY23 and FY24 — a repeat would collapse the thesis, and the concentrated customer book makes this a live risk at this scale.

Driver commentary

  • AI beneficiary: Genuine cybersecurity exposure, augmented by rising AI-driven threat surfaces (management commentary is credible, not just marketing). But scale is tiny and value capture is dominated by reseller pass-through rather than proprietary IP.
  • Operating leverage: Moderate. Software subsegment has real leverage but is 11% of revenue; Services is largely reseller economics.
  • Cyclicality: Low — cyber budgets are non-discretionary; FY23 miss was execution/timing, not cyclical.
  • Moat: Narrow — differentiation is relationships and specific product accreditations (G-Cloud, defence-cleared MFA); no network effects.
  • Leverage: Net cash, no debt — fortress.
  • Earnings quality: Weakest driver. Revenue-recognition changes, large goodwill write-offs, "adjusted EBITDA" that excludes £0.7-1m annual amortisation of acquired intangibles that are real economic costs.
  • Growth momentum: Strong right now — two consecutive beats, contract pipeline visible.
Filings consulted · 26

Every document the LLM read for this note. Click any row to open the source.

  1. 2026-07-27Fy26 Trading Update2026-07-27_9687548_fy26-trading-update.md0.85
  2. 2026-03-17Interim Results2026-03-17_9476941_interim-results.md0.77
  3. 2026-03-03Notice OF Results And Investor Presentation2026-03-03_9454752_notice-of-results-and-investor-presentation.md0.59
  4. 2025-12-16Result OF Agm2025-12-16_9300121_result-of-agm.md0.26
  5. 2025-11-24Notice OF Agm2025-11-24_9251887_notice-of-agm.md0.26
  6. 2025-07-09Fy25 Trading Update2025-07-09_8969876_fy25-trading-update.md0.55
  7. 2024-11-26Interim Results2024-11-26_8572048_interim-results.md0.58
  8. 2024-11-20Notice OF Investor Presentation2024-11-20_8560466_notice-of-investor-presentation.md0.46
  9. 2024-09-24Result OF Agm2024-09-24_8436531_result-of-agm.md0.14
  10. 2024-08-29Notice OF Agm And Posting OF Annual Report2024-08-29_8390903_notice-of-agm-and-posting-of-annual-report.md0.43
  11. 2024-04-03Fy24 Trading Update2024-04-03_8117351_fy24-trading-update.md0.38
  12. 2023-11-22Interim Results2023-11-22_7895753_interim-results.md0.41
  13. 2023-09-29Result OF Agm2023-09-29_7787380_result-of-agm.md0.07
  14. 2023-09-06Notice OF Agm And Posting OF Annual Report2023-09-06_7739562_notice-of-agm-and-posting-of-annual-report.md0.24
  15. 2023-09-05Final Results2023-09-05_7735285_final-results.md0.25
  16. 2023-08-25Update RE Fy23 Results And Trading Update2023-08-25_7716632_update-re-fy23-results-and-trading-update.md0.21
  17. 2023-06-08Trading Update2023-06-08_7565024_trading-update.md0.21
  18. 2023-03-31Trading Update2023-03-31_7380133_trading-update.md0.21
  19. 2022-09-21Result OF Agm2022-09-21_7415091_result-of-agm.md0.07
  20. 2022-09-05Notice OF Agm2022-09-05_7210351_notice-of-agm.md0.07
  21. 2022-08-25Posting OF Annual Report2022-08-25_7047264_posting-of-annual-report.md0.24
  22. 2022-07-29Final Results2022-07-29_6916567_final-results.md0.25
  23. 2022-04-27Year End Trading Update2022-04-27_7085487_year-end-trading-update.md0.21
  24. 2021-11-02Trading Update2021-11-02_6626416_trading-update.md0.21
  25. 2021-09-22Result OF Agm2021-09-22_6557085_result-of-agm.md0.03
  26. 2021-08-31Notice OF Agm And Posting OF Annual Report2021-08-31_6696194_notice-of-agm-and-posting-of-annual-report.md0.10

This research note was authored by a large language model after reading 24 regulatory filings published between 2021-08-31 and 2026-07-27. Each citation refers to a specific RNS announcement in the underlying data set. The note is an opinion, not advice. Do your own work before risking capital.