ECSC : Interim Results

Prior to publication, the information contained within this announcement was deemed by the Company to constitute inside information for the purposes of Article 7 under the Market Abuse Regulation (EU) No. 596/2014 ("MAR"). With the publication of this announcement, this information is now considered to be in the public domain.

23 September 2020

ECSC Group plc

('ECSC' or the 'Company' or the 'Group')

Unaudited interim results for the six months ended 30 June 2020

Return to profit, positive cash flow and a strong outlook for Q4

ECSC Group plc (AIM: ECSC), the provider of cyber security services, announces its unaudited interim results for the six months ended 30 June 2020 and an update on current trading.

Financial Highlights

• Managed Detection and Response ("MDR") division (managed services and incident response) recurring revenue up 25% to £1.17m (H1 2019: £0.94m)
• MDR order book of £2.9m (30 June 2019: £2.7m)
• Assurance* division (testing, standards and certification services) revenue up 4% to £1.24m (H1 2019: £1.19m)
• Group revenue of £2.61m (H1 2019: £2.63m)
• Adjusted** EBITDA*** profit of £52k (H1 2019: £184k loss)
• Partner programme contributing to 27% of new client recurring revenue MDR order book, and 7% of Assurance revenue
• Successful placing in April 2020 to raise £0.5m (gross)
• Cash of £1.26m at period end (30 June 2019: £0.19m), including £0.77m of COVID-19 related medium-term government support relating to VAT and PAYE deferral. The Group's bank facility of £0.5m remains unutilised

Operational Highlights

• 48 new Assurance clients secured (H1 2019: 59)
• Appointment of Gemma Basharan as Chief Financial Officer and Ian Castle as Chief Technology Officer in March 2020
• Launch of AI supported Nebula Cloud cyber security breach detection service in May 2020

Post-Period Highlights

* Previously termed Consulting division

**Adjusted EBITDA excludes one-off charges and share based charges

***EBITDA is defined as Earnings before Interest, Tax, Depreciation and Amortisation

Ian Mann, Chief Executive Officer of ECSC, commented:

"We are delighted to report a return to Adjusted EBITDA profit with record levels of recurring revenues and orders within our Managed Detection and Response division, partly driven by an increase in cyber security incidents as organisations have accelerated the existing trend towards remote and cloud working during the COVID-19 pandemic.

"It is also pleasing to note that our Assurance division is recovering strongly as clients are beginning to resume projects (both on-site and working remotely), with an increase in both revenues and bookings in this sector. We continue to see an uptake in our Partner Programme, with 120 registered partners generating over 160 sales opportunities by the end of the period, which had a material contribution to revenue.

"We have so far exceeded our stated objective of maintaining a break-even Adjusted EBITDA position throughout the COVID-19 crisis. We remain focused on our strategy of growing our Managed Detection and Response division in order to build our recurring revenue streams and target this fast-growing sector of the market. We continue to innovate our technologies and deliver quality services to our expanding client base.

"In summary, ECSC is well positioned in the growing global cyber security marketplace, and we look forward with confidence to delivering improved operating results and shareholder value. We will continue to update the market on our progress in due course."

Annabel Atkins

Matthew McHale

Notes to Editors:

Founded in 2000, ECSC Group plc (AIM: ECSC) is the UK's longest running full-service cyber security service provider. With an extensive range of in-house developed proprietary technologies, including advanced Artificial Intelligence (AI) systems, ECSC provides expert security breach prevention and advisory support to organisations across all sectors.

ECSC operates from two Security Operations Centres (SOCs): one in Yorkshire, UK, and the other in Brisbane, Australia. ECSC offers flexible 24/7/365 cyber security monitoring, detection, and response support to its clients, either as a fully managed service or to enhance an organisation's existing cyber security systems. In addition, ECSC's Assurance division provides guidance, certification to industry standards, and extensive testing services to allow organisations to assess their cyber security protection.

ECSC is led by a highly experienced senior management team with over 80 years' combined experience within the company, and has delivered consecutive organic growth for the last 20 years.

The Company's broad client base ranges from e-commercestart-ups to global blue-chip organisations, including 10% of the FTSE 100.

For more information please visit the following: https://investor.ecsc.co.uk/

Chairman's Statement

The Group has managed its way through COVID-19 so far with excellent remote working practices, and a return to Adjusted EBITDA profitability throughout the period reflects well on the capable and experienced management team who are now focused on the many opportunities arising in the market.

Improved financial performance across the business has led to a return to profit for the period, positive cash flow, and a strong Q4 outlook. Our successful fund-raise in April 2020 further strengthened our cash position.

Cyber security remains a key priority for all Boards, with breaches continuing to attract media attention and an increasing regulatory framework, particularly with the impact of GDPR.

The ECSC Kepler Artificial Intelligence (AI) technology, released in 2018, delivered through the global Security Operation Centres (SOCs), continues to be integral to the growth in the Managed Detection and Response division. Clients increasingly recognise that 24/7/365 cyber security breach detection and expert incident response is vital to the protection of personal information and maintenance of critical IT systems. For all but the largest global organisations, the outsourcing of these critical functions is the logical choice, and ECSC has the technology, expertise and processes to deliver.

On behalf of the Board, I would like to thank all of our clients, staff, channel partners and advisors for their continued support, together with our new institutional shareholders that participated in the fund-raise completed in April 2020.

Despite the temporary interruption to our progress with COVID-19, ECSC is well positioned in a growing cyber security marketplace, and we look forward with confidence to broadening our base of clients and delivering improved operating results.

David Mathewson

Non-Executive Chairman

23 September 2020

Chief Executive Officer's Statement

COVID-19 Strategy

As anticipated, the first significant impact of COVID-19 was seen in April, where a number of Assurance division engagements were postponed.

The management team took early action to mitigate the impact in four areas:

• All services were re-engineered to be delivered remotely, as the Company anticipated that this would be the preferred model of clients until at least the end of 2020.

• Adjustments were made to the cost base and delivery capacity, as forecasted 2020 growth was unlikely to materialise.

• A placing of £0.5m (gross) was completed by mid-April 2020 to reduce overall cash risk through uncertain times. This was fully subscribed by both new and existing investors.

• Once available, government support was utilised where appropriate, in both the UK and Australia.

We are therefore pleased to report that, to date, our stated aim of maintaining a break-even trading position throughout the pandemic has been exceeded, reflected in our growing cash balance.

Ongoing Strategy

Our strategy of delivering sustained and profitable organic growth remains our primary focus.

The Company's Managed Detection and Response division, comprising managed services and incident response, continues to be our priority for growth as we see the opportunity to secure recurring revenue streams through multi- year contracts. ECSC delivers a superior service to clients in this division by deploying and managing its proprietary cyber security technology (including Artificial Intelligence), avoiding the issues end-users continue to have with other vendor companies where cyber security technology is being sold without appropriate in-house resource, expert management or effective 24/7 monitoring.

Success in this area is reflected in the Managed Detection and Response division now accounting for 47% of revenue, compared with 29% at the time of the Company's IPO (end of 2016).

The Assurance division, comprising of testing, standards, and certifications, remains key for new client acquisition, and still sees a relatively large proportion of repeat revenue.

Our Partner Programme, launched in 2019, allows primarily IT Value Added Resellers to directly sell selected ECSC services whilst referring more complex projects to the ECSC sales team to deliver. As of the end of June 2020, 120 partners have signed up to the programme, generating more than 160 sales opportunities and contributing to both new client acquisition and having a material contribution to revenue.

We have continued to invest in ECSC proprietary technologies, including continuing development of our MDR Artificial Intelligence (AI) embedded within many of our managed services.

Outlook

The UK cyber security market remains an attractive segment of the wider IT sector. Against this backdrop, we are confident that the organic growth strategy of ECSC remains appropriate. Managed Detection and Response services remains the strategic focus of the Board, to build our recurring revenue streams and target the fastest growing segment of the market. The team continues to acquire new clients, deliver quality services, develop our technologies, and build a solid base for continuing progress and improving financial performance.

Key Performance Indicators

The following Key Performance Indicators were established in mid-2018, and expanded in 2019, to enable meaningful performance measurement:

Ian Mann

Chief Executive Officer

23 September 2020

This is an excerpt of the original content. To continue reading it, access the original document here.