Intercede Group plc (AIM:IGP)
129.75
-1.75 (-1.33%)
Oct 16, 2026, 4:06 PM GMT
← View all transcripts
Transcript
Oct 12, 2026
Summary
FY26 revenue slipped on delayed U.S. federal orders, which arrived after year-end; recurring revenue grew 11.4%. FY27 revenue guidance remains £21m, backed by a strong pipeline, continued R&D investment and partner-led expansion.
Good afternoon, and welcome to the Intercede Group plc investor presentation. Throughout this recorded presentation, investors will be in listen only mode. Questions are encouraged and can be submitted at any time via the Q&A tab situated on the right-hand corner of your screen. Simply type in your questions and press send. The company may not be in a position to answer every question it receives during the meeting itself. However, the company can review all questions submitted today and publish responses where it is appropriate to do so. Before we begin, I would like to submit the following poll. I would now like to hand you over to the management team. Klaas, good afternoon, sir.
Good afternoon, Lily, and indeed, good afternoon, everyone. My name is Klaas van der Leest, the CEO for Intercede. I would like to welcome both existing investors, potential new private investors, as well as analysts to the session, which will cover the results fiscal year ending March 31st. During the session, I am joined by Nitil Patel, CFO, who is on the right of my screen, and Mr. Storey, Allen Storey, who is our CPO on the left of my screen. We look forward to providing you with an update in the coming 45 minutes. As Lily said, whilst this presentation is us presenting to you, we do look forward to your questions, but also your feedback after the session. Let us start with the presentation and try to make this interactive once we hit the Q&A.
Quick update on company introduction, but before we do company introduction, let us do a quick summary of the year. Our revenues for 2026 was slightly down. We indicated towards middle of March in the trading update that we saw some delays, particularly on our U.S. federal customers. They were not forecasted clearly. We were disappointed with the outcome. But as soon as we knew, we positively updated the market as such. Clearly, those timing delays filtered through. I am pleased to report that post period, we launched an RNS in Q1, actually on the 21st of April, where we highlighted that the deals that had been forecasted for prior fiscal year had now come through. So there were no structural issues there. It was simply a timing delay. It is a very thin margin between a profit warning and an upgrade.
Regardless of that, I do think the financial position is still very, very strong. We have a very strong, robust cash balance at the end of the year, and Nitil will update you later on what the current cash balance is. We are debt-free, and we show very good growth on the recurring revenue side. If you move to the right-hand side of the slide, Allen will talk about progressing our go-to-market model, as particularly existing investors will know, or those who have followed us for a while, we are very much pursuing an indirect go-to-market model, so we really try not to sell direct. So we are highlighting two important relationships we have announced in the market, one Swissbit, one OneSpan. More details to follow. We continue to invest extremely heavily into R&D. We want to be seen to be the market leading company in our strong authentication space.
Nitil will provide detail, but at a very high level, last year, GBP 4.1 million in R&D. The current fiscal year, around GBP 4.4 million to GBP 4.5 million. With regards to Intercede being market leading, recently, we were the first to demonstrate PQC readiness with Swissbit, the partner that we will talk about a little bit more. It shows that we have strong leadership in the area we play in. Now, when we announced on 17th of March our trading update, and we confirmed that trading update on 9th of April, there was a general feeling that we should have downgraded our numbers.
But as a management team, we felt very, very strongly that based on the numbers we had, based on the pipeline we had, based on the recurring revenue, we felt very, very confident of maintaining the numbers and definitely against the backdrop of our recent Q1 RNS update. I think that underpins our belief that we will and can deliver GBP 21 million. If we then move on. For those who are new to us, what do we do? We protect our customers against data breach. How do we do that? We replace weak credentials, such as passwords, with much stronger authentication. Alan will talk about that more in detail. We do that simply, securely, and at scale. What do we mean with simply? It is standard off-the-shelf software, so it is easy to implement, it is easy to maintain, it is easy to upgrade. Second point is securely.
We work with the most security-conscious organizations in the world. Think about U.S. federal agencies. Think about intelligence communities. Think about defense organizations. Typically, before they can put any software in a production environment, they have to pen test it. They have to sometimes do code reviews, and particularly in the U.S., they have to get an authority to operate. So it is quite a complex set of procedures and tests they have to go through before they can put it in a production environment. The final point is its scale. Intercede has built a phenomenal record of issuing licenses at large scale. So anything from thousands of licenses to hundreds of thousands of licenses to millions of licenses. Our largest client is around 6.5 million licenses. So we know we have a platform that will scale out from thousands to millions.
We then move on and say, "Right, who do we" Yeah. Typically, our clients, the challenge we have is that many of the clients we work with, we cannot name. But what we can indicate is the kind of industry sectors we operate in. We do a lot in government. It is not just U.S. government. Yes, U.S. government is quite dominant in our revenues, but we also work with many, many other governments worldwide. We work a lot in defense. We work a lot in the intelligence community. What do I mean with intelligence community? Typically, three-letter agencies that we can see on television. Aerospace, again, very recognizable. Then bottom line is very much corporate enterprise. We do a lot of work in the banking sector. We work a lot in generic industry.
The last one, Citizen, is the Kuwaiti national ID scheme, which is one of the largest implementations we have. Looking at investing in Intercede, where do we play? It is very much regarded as business critical authentication software, and clearly we are in a growing market. Interesting bit here is, more recently we have seen SaaSpocalypse, what is happening. We do not really see ourselves being affected by that. We are not a horizontal implementation. We are very much a vertical play, very heavily integrated. We see ourselves as a market leader in our niche, and we can defend that niche very well. We have very deep domain knowledge in what we do. Typically, there are high switching costs from a customer perspective. Low churn, and has been low churn for a very long time.
The markets we operate in are extremely resilient, and on Net Promoter Score, when we last tested it was 58, which is again, significantly up from where we have been before. Go to market is very much indirect. We very much look to grow our technology partners as well as our distribution and reseller partners. We provide a bit more color on that, and Nitil and the finance team work very hard to make sure that we have tight working capital management, and from an M&A perspective, provide a bit more update later on. The strategy is clear. We continue to innovate, we continue to geodiversify our pipeline, and all of the efforts is driven on pure execution.
If we can move on and say, right, if we now look at specific markets, again, last year we have done a number of updates where we highlighted some of the challenges in the U.S. federal government. Without going through all the points on this slide here, the good news is that some of the funding issues that some of the agencies had last year have very much been resolved. Why were there funding issues? Because the Democrats and Republicans did not really want to agree with each other, particularly in light of the issues around Minnesota, where ICE was very much visible on the streets. Then basically the parties got arguing with each other and basically do not agree with spending. A lot of those issues have been resolved. Main point here on bottom right-hand side is that market sentiments have significantly improved.
The agencies we are working with are fully funded, actually are funded for multiple years going forward, and we actually see no delays at the moment and actively see demands coming through, including the orders we have already highlighted. We have also seen more orders coming through. Market update from a rest of world perspective, basically falls into three categories, Europe, U.K., Middle East and Asia PAC. That is not on the left-hand side. We love regulation. NIS2 and DORA are two regulations within Europe that definitely strengthen our position and they push the companies that need to comply with those regulations towards much stronger authentication. They are not calling out PKI, but they typically do call out phishing resistant, again, which is mainly where we play. Data sovereignty is an interesting one. There has been a lot of noise recently in the Europe on the impact of the U.S. CLOUD Act.
That basically means that anybody who is on one of the U.S. hyperscaler platforms may lose access to their data. Mr. Trump has indicated that anything on a U.S. hyperscaler platform with regards to data may get exposed from a U.S. perspective. Therefore, there is a real push on the continent, whether that is Germany, whether it is France, or whether it is the Netherlands, to push for data sovereignty. That is important for us. Our software is very much installed either on-prem or in hybrid cloud. On a hybrid cloud environment, the client can decide where they have their data hosted. The other point from a European perspective is, and U.K. is Five Eyes impact. I have highlighted this before, since the Ukrainian invasion, the Five Eyes are collaborating significantly more.
U.S. very dominant in those conversations, security posture driven by the U.S., and we are seeing opportunities in the U.K. actually converting into real business with U.K. government, which is good. We have also seen the same happening on Asia PAC. If I jump to the right-hand side, that same Five Eyes impact is also relevant for the relevant countries in that region. Again, what is interesting in Asia, particularly in Singapore, they have very high security requirements. I was out in Singapore less than 2 weeks ago meeting customers, prospects, as well as partners. It is a very buoyant market for us and we definitely hope to provide more updates in the coming months and indeed this fiscal year. Again, we continue to build out new partnerships. Middle East is more difficult with the conflict in the Middle East, and clearly with what is going on there, activities have significantly slowed down.
A lot of our clients, a lot of our partners are still not permanently on-site. There is reduced activity, which is a real shame as we had really forecasted to put a lot of marketing activity and sales activity into the region. That needs to be gone remote now. Remote is not as good because clearly it is a region where personal contacts and personal relationships are quite important. Having said that, we are seeing order flow normalizing, renewals are coming through, so that is good. Also, FCDO since last Friday have lifted the travel restrictions on Emirates, Dubai, so at least we can fly into the region with the view that we are actually insured when we have to go in there. That is updates on rest of world, and I will hand over to Mr. Patel.
Thanks, Klaas. I want to go to the left-hand side, the contracts and the wins in the year. These have generally been announced by RNSs. Just to give you an idea of the flow. We are emphasizing a geodiversified pipeline. Big concentration has been in the U.S. And you will see that in our regional revenue analysis. But we are still focusing on Singapore, Central, Continental Europe, Middle East, as Klaas mentioned, it has slowed down, and the United Kingdom. Revenue has been down and was down on the city forecast. Klaas has explained why. On a constant currency basis, not too bad at 0.5, but you will see an exchange movement loss in the year and I will explain why that is. Most of our revenues are in dollars; most of our expenses are in sterling, and we convert quite quickly. We continue to invest in our product.
It is really important to us. Alan will explain further what the product roadmap is looking like or what innovation is looking like. We have four releases on MyID CMS, four releases on MyID MFA and MyID PSM. This is now being brought together as an integrated solution, and we have also upgraded SecureVault. As Klaas has mentioned, we expand our R&D, our income statement, and you will see our income statement is a very clean statement. We are focusing on subscription revenue. We incentivize our sales team and our clients and our quotes to go down the sales subscription route if they can. It is beholden to the client. The client will have an OpEx and CapEx view, and generally what we find is that most governments have a CapEx view rather than an OpEx because they can borrow at a lot lower rates.
We will continue to emphasize incentivizing subscription, and we see good growth in that, and we will see how that pans out over the coming years. The plan, obviously, is that any new product that we bring to the market will always be on a subscription basis, and you will see that with the one-time offering. The good news is that licensing has gone in the right direction this year. However, the PS has not. I mean, reflection purely, obviously, as Klaas has mentioned, a few delays in the Fed environment, but also as a comparative, the large deployment that we had, successful large deployment, in the previous year has obviously meant less people on that program. We aim to pick this up in FY 2027. Pictorially, graphically, I was just showing you the revenue analysis. As you can see, slightly down to where we were expecting to be.
Obviously, if we had had that order, we would have been in upgrade territory, not just on revenue, but also on profit. Regional revenue in the U.S. continues to dominate and will continue to do so. Just larger budgets, highly regulated, more demand. As we have mentioned, pipeline is diversifying very well. We have got good interaction in APAC, we have got good interaction in Europe, and we are now seeing activity as well across U.K. When the Middle East turns back on, we hope to expand that. Again, the reason why, as Alan will describe in his section, movements away from certain data sovereignty issues that we are experiencing and how we are dealing with that going forward. Adjusted EBITDA and profit before tax. The reason we show you this is a close correlation between the two. We do not have many exceptionals. We do not do many adjustments.
The normal adjustments you would expect us to do are non-cash items, generally, mainly amortization and depreciation. Cash and equity is always going in the right direction. There will be some questions probably on where we are going to do capital allocation. As Klaas has mentioned, he will address that with the M&A strategy going forward. The income statement, I will be quick on this. As I have mentioned, it is very vanilla. It is a straightforward income statement. We do not make any adjustments on it. The key things that we focus on, as you can see in orange, are revenue, controlling operating expenses, focusing on tax where we can, and obviously EPS, both basic and diluted. Revenue, as everyone knows, highly accretive if we get the right mix, especially licensing income. If that feeds nicely down to the bottom line.
If we control costs well, which we tend to do, then the ability to change the margins when the license order is quite high. Tax losses are mostly being utilized. Going forward, we are going to be paying corporation tax at a full rate in quarterly payments, so-called QIPs, and our first payment is due end of this month. Operating expenses, just wanted to show you kind of the movement between last year and this year and how we were able to control it. We did have positions in the staffing, and that was planned from last year. We have recruited where we wanted to recruit. We will continue to recruit in dev test capabilities. We are also looking at how AI is impacting that. Alan will explain what we are looking at and doing there. As I mentioned, there is a high volatility.
The GBP strengthened quite significantly during the year and had an impact on translation as and when we convert the invoices. 80% of our revenue is in dollar denomination, and probably about 70% of our expenses are in sterling. The greens, if we focus on the greens, then obviously the flex we have is the bonus accrual that we put into our budget. If we miss numbers, commissions go down, and of course, if we miss numbers, bonus accrual reduces automatically. The other credit in there is the R&D. I am sure you are all aware of the new HMRC, or not so new rules anymore. HMRC rules change for R&D tax credits. You now take that credit into your operating expense, and then you true up depending on what your tax comp is agreed to.
We had less of an estimation because it is the first time we were doing it. When we actually finalized our R&D tax comps with HMRC, it was a GBP 200,000 credit into the income statement. On the balance sheet, financial position. Again, a very clean balance sheet. The oranges is to show you the focus on working capital. We really are focused on working capital. There is strict internal working capital document, which means that we ring-fence 50% of the forecasted operating expenses in the next financial year. That is for GBP 8 million this year, and we are focused on collecting debt, making sure we have got good cash balances and the deferred revenue is as high as possible. I know people are worried that it has flattened down.
That is just obviously reflecting less invoicing, but also two slight delays in two renewals, which we do not see an issue with at all. As an update, most of that GBP 6 million has been converted into cash. Then consider the cash flow and earnings movements. The company is a good cash generation because obviously if you think about who our clients are, once you are in the procurement cycle, 45, 60 days, you will get paid once you raise an invoice and get the sort of POs. We have good inflows in cash just before September, U.S. year end, December, big renewals, and March, big renewals for us as well. Over to Alan for product innovation.
Thank you, Nick. Just to refresh on where we are product-wise today, we're a multi-product company. We very much focus on replacing weak authentication with stronger authentication to help protect our clients against data breach. Still, the number one cause of data breach, about 75%-80%, is a weak credential being accessed by a hacker and then being used to log in to that environment. This pyramid shows stronger authentication at the top, weaker at the bottom, and we have products that help customers wherever they are on that journey towards stronger authentication. Our key strengths are at the top of the pyramid, so intelligence agencies, government, aerospace, and defense who are constantly under attack by state-sponsored, very well-funded hackers need the strongest levels of security. That's our sweet spot.
We've moved down this pyramid to cover a broader range of authentication, both to increase the addressable market, but also because it puts some key building blocks in place for our product strategy going forward, which I'll talk about. Looking at the short-term roadmap, what are we doing over the next 6-12 months, investing in the product to try and drive and capitalize on those growth opportunities out there? Then I'll look at where we're heading longer term. Within the main credential management system flagship there, one of the big areas here is post-quantum. I'll explain what that is on the slide. Basically, customers are going to need to move towards newer algorithms, new hardware, new software to protect themselves against the threat of quantum computers breaking into their systems.
This is absolutely key to our customer base, therefore, it's absolutely key to us. I'll talk about that a little bit more when I talk about Swissbit, but being able to help customers migrate to that new security is critical to us. I won't go through all of these. I'll pick the highlights. Another one is enterprise-managed passkeys. Passkeys are a cryptographic form of security that came in from the consumer space, but a lot of our customers are now starting to look at using them within the enterprise space. PKI works very well on USB tokens. Smart cards works well on my laptop, for example. More difficult to use on my phone, but because the FIDO standards are baked into the phone, I can hold an NFC token to the back of my phone and I can authenticate.
If I want to use this on my phone today, those passkeys, I use it on my phone, it will be synced to my iPad. I change my phone in a year or two's time, those passkeys credentials will be synced down to my new phone as well, which is really convenient for the end user and great in the consumer space. However, in the enterprise space, what that means is that those passkeys are not in control of the enterprise. Just like I can with a password or my Wi-Fi password, for example, I could use my phone and I could share that credential with somebody, and my enterprise would not know about that. What enterprises are looking for is to have the benefit of that syncing and that sharing, but to do that within their own control. That's another key feature we're looking at there.
Moving over to the right here. This is really all about data sovereignty. We've seen this in the Middle East for a while with a number of our customers who don't want to be on U.S. cloud, as Klaas was talking about. We've seen an increased demand for this in Europe now. So customers in Europe not wanting to have their critical data in U.S. cloud, therefore, the U.S. legal agencies can access their data. Our MFA product, multi-factor authentication product, was originally designed to just plug in and work with Microsoft. We're not losing that capability because that's still a market, but what we are doing is building it so it can be completely decoupled from Microsoft, therefore, you can use it in an environment where you want pure data sovereignty.
You can run it in your own private cloud, you can run it in other platforms, et cetera. I'll talk about post-quantum and what that means to us because it is a big change on the market. The stronger authentication we deal with is based on cryptography. What that means is that there's a private key on a device such as a smart card or a phone, and there's a public key that you can use that's not on the device. I can sign or authenticate with a private key. I can validate that with a public key, but I can't get back to that private key. I can't work out what that private key is and that's the basis of the security. The theory is that with quantum computers becoming so powerful, they will be able to perform so many billion what if calculations per second.
They can work out what the private key is from the public key, which defeats the security of cryptography. The good news is that cryptography has been changing over time anyway. We've been doing this for 25 years. We've helped customers move from older algorithms to newer algorithms and move their security over time anyway. That's called crypto agility, and it's a key part of why customers buy our product. NIST, who the U.S. security authorities set standards in this area and are very much looked at as the gold standard globally. If you talk to our customers in Germany, Middle East, Singapore, they will look to NIST to set the standards in this area.
They have reviewed algorithms produced by scientists around the world, and they've decided that these particular algorithms are quantum resistant, i.e., if a state-sponsored hacking organization had access to a quantum computer, they wouldn't be able to break these algorithms because the math works in a very different way. We've been working with a number of partners in this space. We've been working with NIST on looking at the algorithms. We've been working with the partners who are now embedding those algorithms into the hardware. As Klaas mentioned earlier, delighted to say that we were the first to be able to demonstrate actual use of one of these algorithms on the device at a recent conference, which means we're ahead of the field here. It's an absolute threat if you're not on top of it. We are on top of it.
We are working with key partners and the standards bodies, and we intend to have product in market before any of our competitors here. That gives us migration path. The other interesting opportunity here is that it is quite disruptive in the market. It will be making people move towards newer technologies. What is called Q-day, so when a quantum computer will be available to attack these systems, is predicted around 2030, might come back to 2029. Sounds a long time away, but it takes people time to deploy and manage these new credentials to protect against it. We will probably start to see hardware becoming available and validated probably within 12 months in this space. That does disrupt the market as well. It makes people look at what credentials they are using today. Do they need to upgrade? That might move them towards stronger authentication that we support.
It is also difficult for everybody to implement this, so we might see a few people who are potentially competitors today dropping off the market who cannot deliver this. I mentioned Swissbit, so they are a technology partner, a new technology partner to us. They are a device manufacturer. They have devices that support PKI, that support FIDO, so stronger authentication. Interestingly, they also support physical access of the device, which is unusual for a USB form factor. They wanted to work with somebody who understood cryptography on their post-quantum algorithms, and we do understand it very well because there is no point in them having a device that has a quantum-capable algorithm on it if they cannot show it being used, and they cannot demonstrate it. They worked with us to be able to demonstrate this, but we have now got a very close partnership with them.
It is not a reseller agreement, so they do not resell our product, but we are their first-choice CMS. If they are talking to an end customer, that end customer has a requirement for management, they will point them at us as a first-choice partner because of that close relationship. And they have access to some markets that we do not currently operate in, India, for example. The second key partner I will mention here, new partner, is OneSpan. This is a very different relationship. This is a reseller relationship, so they are reselling our product. They approached us for two reasons. The first one is that OneSpan's customer base were approaching them saying, "We were using one-time passwords as security on your devices. You do not really need a lot of management around a one-time password system. It is very straightforward.
But because of regulations like NIS2, like DORA, we wanted to step up and use FIDO passkeys to get that high level of security. But we need to manage them. We cannot deploy and manage them. We need a system to help us do that. OneSpan, can you provide a system?" The second reason is that OneSpan have an authentication server which they deployed into a large customer base that works on-premise or private cloud, so it ticks that data sovereignty box. However, they have not been investing in that product, so it will not support FIDO passkeys. It will not support quantum-resistant algorithms. Even though their devices will, the software did not, and they did not want to lose that revenue. That is a pure subscription product.
So what we have done is taken our MyID MFA solution, and we have enabled that to work with all the OneSpan devices, but we have also provided a clean migration path for customers. You can install MyID MFA alongside the OneSpan authentication system. We will extract all the data from that and bring it into our system so the customers can carry on managing the existing tokens as they deployed them, and then OneSpan can start to sell additional tokens with capabilities into that environment. That is a SKU. It appears on their price list. They are selling the CMS as a management service along with a token on a subscription basis. Importantly for OneSpan, this helps them move towards more of a subscription model, and then the CMS is a straight replacement, a straight swap out. Again, early days, but very interesting opportunity for us.
They are very strong in the banking space. Again, they are in countries and regions where we currently do not have an active partner. Looking at AI, it is both a risk and an opportunity for us. There is a lot in the press around things like Claude Mythos uncovering and actually being able to exploit security vulnerabilities in software. This will be a wave once it eventually gets released onto the wider market that will hit a lot of software companies. The good news for us is that our software is probably amongst the best-tested software from a security perspective in the world, not just from our own testing, but whenever it is deployed into an intelligence agency, et cetera, defense aerospace organization, they have teams that crawl all over it, look at the code, penetration test it.
We probably have more extensive penetration testing than pretty much any other piece of software out there. We believe we are in a good position anyway. But we will start using it and are already using it to enhance our own security testing. There are some benefits we have there. The other risks out there is we sometimes get asked, could somebody just build your product cheaper and faster with AI? The simple answer is no. A slightly more detailed answer as to why is that no, is that AI is very, very good at coding if it has access to online APIs and documentation. It can copy what is out there, it can build something. But a lot of what we do is not open and public. When we are working with our partners, for example, Swissbit, OneSpan, IDEMIA, Microsoft, a lot of the APIs we access are not public.
We have to enter into non-disclosure agreements with them to get access to that private IP and those private APIs, which means that AI cannot actually copy that because it does not have the information. We think we are very protected there. What we are finding is that certainly over the last six months, in the appropriate area where there are public published standards, AI can absolutely help us accelerate what we do. We are not seeing it as a way of cutting costs and losing heads. We are seeing it a way of accelerating our product roadmap and getting greater efficiencies out of the development team we already have. We see it as a positive. Talking about our strategic direction. Everything I have talked about is active and will certainly be active within the next 12 months within the product. Now we think slightly further ahead.
Today, we very much focus on personal identity. Is it really Sam from an employee perspective? They are logging onto the system, they are getting in the network. Is that the right person? Make sure they are, and then issue and manage their credential. There are multiple other digital credentials that an organization has to deal with. There are machines, so servers, printers, firewalls, routers. Typically, a server would have a certificate. If that certificate expires, that server will not be able to go on the network, and it will not be able to deliver that services into the business. That could be within the enterprise. It could even be an e-commerce service out to a consumer. We have also got more hardware-based devices.
We are starting to see agentic AI appear more and more, so agents acting autonomously on behalf of a person or a system, performing operations based on a preset number of rules. You need to make sure that that agentic AI agent is the right one that is connected to your system and not something pretending to be an agent and faking it. Today, most organizations will deploy a range of point solutions to manage all of this. We believe that based on our customers asking us and approaching us for something that manages this, conversations with analysts and Gartner, KuppingerCole, we have a close relationship with, looking at where the market is heading, that there is a strong possibility in that market to have a product that will manage personal ID, machine ID, and agentic AI ID credentials.
Manage all of these from a single pane of glass. That will give customers the benefit of reducing operational overhead. It will give them improved security, but importantly, it gives them the opportunity to reduce costs as well. That is strategically where we are heading as an organization. It is right in our sweet spot from strength. It is what we understand, and we will be doing this via a combination of build and acquisition where appropriate. With that, I will hand back to Oh, no. One final view. Apologies. This is what that might look like. This does not exist today, but this is conceptually what that might look like. On this dashboard, you can see there are multiple types of credentials in the organization. This will surface up which of those are active, which of those are valid, which of those are recognized.
Hey, there is an agentic AI agent appearing on your system that I do not recognize. You should really have a look at that." Or, "This service certificate is about to expire in 4 weeks. You need to renew that." Or, "I have not got an automatic renewal policy set, so you are at risk there." It is a really simple conceptual dashboard that actually deals with a lot of business critical infrastructure and really helps with that business continuity within the environment. Now I have remembered I have that final slide. I will hand that over to Gus.
Right. If we then try and wrap up before we jump onto Q&A. We said at the beginning, it is all about delivery and execution, and hopefully you got a clear steer where we are investing. We are investing very, very heavily on the people side. Our headcount continues to grow. From a product perspective, we are investing, this year, GBP 4.4 million, nearly GBP 4.5 million in R&D, and through Alan's update, you can see that we are continuing to invest in partners, whether they are technology partners or whether they are reseller partners like OneSpan. But nearly all of our business is contracted indirectly, i.e., through either distribution or channel or resellers. What do we want to achieve? We want to achieve and maintain our leadership in these high-growth categories. We are very much recognized in the very high end of the market.
We take great referencability out of that space, and we believe we can translate that referencability and credibility into other market areas. As per the introduction, we can do this at scale. We can do this at 100 thousands, millions of licenses. Obviously, what we want to drive is an increased focus on recurring revenues, but as most of the listeners will recognize, in the public markets, it is very, very hard to do a hard pivot to go from perpetual to subscription. So we are trying to manage that and work on it on a deal-by-deal basis. But also when we introduce new products like SecureVault, then we have a real opportunity to only offer subscription, and we have seen good returns on those. Obviously, we look at margins, profit. Despite us not hitting the numbers, we are still maintaining good traction.
On the finance side, we are pretty prudent on how we work with the capital structure, Nitil, debt to cash very carefully. You ring-fence some of the cash, some of the other cash we make available from an M&A perspective. So moving on to M&A, right-hand side of the slide, we have a very active M&A pipeline. Through Alan's update, you can clearly see and understand where we are trying to focus on. So we really want to see if we can find the right target in the machine identity space. We have got a good list of contacts there. We are in dialogue with a number of parties. Now, obviously, it will always come back to, okay, what is the valuation? What is commonly known is that the valuations today are very, very different from the valuations five years ago.
Even the valuations today are very, very different from three to six months ago. So it is all about trying to find value for money, find the right IP, make sure there are referenceable customers, make sure it is subscription revenue or sticky revenue, and there is a lot of traction. Ideally profitable, and we want to work with management teams who have got similar culture to ourselves and we believe we can work with. So that is the delivery and execution side. If we then try and wrap up. We are maintaining revenue guidance. I know there are some interesting questions, so let me try and address that a little bit head on here. When we issued a profit warning in March, over 90% of the institutions we had dialogue with were expecting us to drop the numbers, i.e., lower the city forecast. We actually maintained the city forecast.
There are no upgrades at the moment because of some delays. We very much work towards delivering this number. If and when we can do better, we will do so. What does it mean in terms of markets? Provide an update on U.S. Yes, there were some delays last year in some of the U.S. agencies because of funding issues. The good news is those funding issues have been resolved, and we've seen very active order flow coming through, so that's good. From a rest of world perspective, we think there are good tailwinds, both on a relative side, Five Eyes perspective. You can even increase that to nine eyes and 15 eyes. In effect, after the Five Eyes, all you do there is add European countries to it because there is a huge drive there.
It's also driven by the fact that the U.S. administration have made very, very clear to the EU as well as the NATO that they have to do more investment on their side, on their defense and security, and we actually see that coming through. So that's interesting. On left-hand side, very much aligned with what I've just said. We continue to see good momentum, and that's translated last year also in good revenue growth. Andy Darley has got a note out there. The analyst from Cavendish, recurring growth is 11.4%, which puts us in a good position for this year. We know that revenue is very, very sticky, so we continue to focus on that. In wrapping up, we very much position ourselves as business-critical software in high security environments, very much underpinned by the clients we deal with.
The clients and markets we operate in are ideally and frequently regulated, and they tend to be resilient. That's where the money is, that's where we go, and we have deep domain knowledge. From a SaaSpocalypse perspective, we do not believe we fall in the horizontal category. Intercede software is very much into the plumbing, deep into the plumbing of our clients. It's pretty difficult to replace. That ties in quite nicely with customer loyalty. I talked about NPS at 58. I'd like to get that higher to 70. But 58 for a B2B software company is pretty respectable. You can see the numbers on churn there, and that's in terms of revenue. So we lose very, very little. Then finally, we address the market through technology partnerships. Alan referenced Swissbit there. Interestingly enough, OneSpan is both a technology partnership as well as a global reseller partnership.
I think we're well-placed. We have confidence in the business. We have good confidence in our pipeline. Pipeline is very healthy, growing very, very nicely. Yes, there is some instability in the Middle East. The good news is Middle East is a small percentage of our overall revenue, so we don't think that's going to be impacted, and therefore, we are confident in maintaining our GBP 21 million city forecast. At this point, I should be handing over back to Lily.
That's great. Thank you all very much for your presentation this afternoon. Ladies and gentlemen, please do continue to submit your questions just by using the Q&A tab situated on the right-hand corner of your screen. Just while the company takes a few moments to review those questions submitted today, I would like to remind you that a recording of this presentation, along with a copy of the slides and the published Q&A, can be accessed via your Investor Meet Company platform dashboard. As you can see, we have received a number of questions throughout today's presentation. Klaas, could I please ask you to share the Q&A with the team, and I will pick up with you at the end.
All right. Thank you very much, Lily. Question number one is pre-submitted, so I do not know who submitted it, but what do investors most misunderstand about your business? I have the benefit here that I can choose where the question goes, but I will take this one directly. I think the value of our recurring revenues in support and maintenance is very frequently regarded as less valuable than pure subscription. But as we have highlighted, with extremely low attrition and very long-serving clients, 15, 20 years plus, I think this revenue is extremely valuable, and I think it is frequently misunderstood. Hopefully that answers your question. There was another submitted question. In the financial review, you mentioned some delayed support and maintenance renewals. Are you able to say whether these have come in since? Could it represent some loss of business?
Yeah, from time to time, we do see some delays. Typically, they are resolved within the reporting period, so they are not really flagged up. The two that Nitil has referred to, we fully expect these orders to come through very, very shortly. They are long-standing clients. We have very good relationships with them, and when there is a delay, there is typically a very good reason for that. If we then move on to the next question. William, you have got a question. "The groundwork for the POC client has been going on for a long time. When do you expect the rollout to commence?" Now, I do not want to answer all of them, but Nitil, you want to take this one?
Thank you. Thanks, William. Look, this is a cautious client. It is taking its time. Good news is that it has moved into a test environment, but you are beholden to the client. We are adding more PS as and when we can, professional services, to their environment. It is the longest we have ever had. It is in a good shape, but it has moved from POC into test, and we are still in a test environment. We will continue to help the client as best we can to move it into a production environment, but we do not know yet when that will happen.
Thank you, Nitil. Another question from William. I am going to cut this short, but I will answer the second part, and I will respond to you privately, William, on the first part. But you make reference to FSTAC being acquired by G+D. G+D, for those who are not familiar with it, is Giesecke+Devrient in Germany. Will it affect your position in the U.S. market? I do not think so. The predominant income stream for FSTAC is actually the resell of smart cards. There is a very logical reason why G+D may want to dive into that market. G+D also manufactures smart cards, so I suspect there is a connection there. Alan, this one is for you, a question from Adam. "Over the next three to five years, do you expect AI-driven cybercrime threats to be tailwind for demand? Are you already seeing investment because of those concerns?" Alan?
Yes. Good question. The answer is a clear yes. We are already seeing AI being used to de-skill cybercrime. If you look at some of the attacks on Marks & Spencer and Co-op, some of those people were teenagers. They were very young. They were not experienced cybercriminals, but they were using AI-based tools and cybercrime-as-a-service tools online to be able to attack and break into those systems. So it is definitely de-skilling the ability to attack systems. We are also seeing now very sophisticated phishing campaigns. A few years ago, you would have got the email from a Nigerian prince saying, "Hey, just give me some money, I will transfer these funds into your account." They never do, by the way. I have tried, it just does not work. But anyway. But now you will get something saying, "Hey, Alan, it is Nitil here. I have just been talking to Klaas.
You know he is out the country at the moment, and I just need access to this document. Could you just open it for me?" Or something along those lines. And it looks extremely credible, but it is absolutely AI-generated based on information they can pick up from the website, calendars, public emails, Facebook, anything like this. So it is very, very simple now to create incredibly realistic phishing campaigns to steal people's credentials on log on. If you look into legislation such as NIS2 in Europe, they recognize this, and this is starting to push people up towards more phishing-resistant authentication. So absolutely, it is pushing people up our pyramid. The other one that is out there is the threats coming from Claude Mythos. Again, exploiting vulnerabilities.
That in software, I think that will make vendors really look long and hard at, I am using a security system from a software vendor. How seriously do they take this? Do they sign up to all the right protocols saying they have got vulnerability disclosures? Have they got ISO 27001? Are they trustworthy? Do they have secure development practices? So I think the quality of the security software, that that is really going to have to push up as well. And I think both of those play into our strengths.
Thank you. The next question is from Michael. "Hey, Klaas and team. Thanks for the presentation. I was pleased to see the contract delay from FY 2026 arrive early in 2027. I note your forecast for FY 2026 were reduced due to delay. I also know that the FY 2027 forecast remains the same. Why is this when the 2026 delayed contracts have landed? Why don't the FY 2027 contracts reflect this?" I think I tried to wrap this up a little bit earlier, but the general wisdom somehow that the institutions seem to be absolutely convinced in holding true is that these messages tend to come in threes. We don't do threes. We had a miss, a very good reason for a miss. It was a Fed delay on one large order. We basically maintain our city forecast. The general consensus was from the institutions that we should have reduced our numbers.
As a management team, we said, "No, we're going to hold firm." Hopefully, that provides a bit more context. The next question from Malcolm. "Is it possible to actually quantify perceived benefits using AI for Intercede?" Alan?
Yeah. There's a number of areas we're using it for. We're already using it within marketing. We're finding what you used to have to outsource to a creative agency, you can now do in-house as long as you've understood the prompting. That's given us benefits. Competitor analysis is very good. We built an in-house product analyst. We've taught it all about our products. We've taught it all about competitors. That really helps us with competitive positioning. It's great for research. I will get to coding, which is probably what the question was about. It's also, rather than just highlighting its other areas, it benefits us. It's brilliant for research. As we're looking into new areas, we're looking at acquisitions.
It doesn't remove the need to actually talk to people and see if you've got cultural fit with them on an M&A journey, but it can absolutely speed up the research. That's fantastic. From a coding perspective, six months ago, I would have probably given a different answer because of what we do and how secure our code needs to be. It wasn't quite there, but within the last six months, it's certainly very capable of coding things now. I think probably around Christmas time, our CTO spent some time working on it over Christmas in his spare time and came back quite excited that actually this is really good now. It's early days, but we are proactively rolling this out within the teams in a very managed fashion. Every couple of weeks, we get the teams to come back and present.
How did you do this without AI? How have you achieved it with AI? Where are the benefits? It won't code everything we do, but certain areas it will actually speed up. It's very beneficial in testing. We're measuring that at the moment, and then we're measuring that to see what percentage increase in output do we get from people within that team. Have you got any further comment on that one, Nitsan?
No, that's correct. As Alan said, we're rolling this out. We're looking at how we can increase productivity and efficiency, matching that with a concept of a virtual squad. Will it cost us to employ that squad as they're able to be used? The other thing that we're looking at is how we, once we see the benefit of it and we can quantify the kind of productivity gains, how we bring that roadmap forward. When we bring that roadmap forward, what can we generate revenues against those functionalities, increased functionalities. We'll measure all those things when we can. Just adding the other point is that, it's not just as Alan has highlighted, dev and test, it's across all functionalities of the group.
Yeah. On the note that Alan was referring to from a marketing perspective, you may have noticed we've recently updated our IR website that was very much developed with support from Klaas. If anybody's got any views on it, we welcome your feedback. Final questions, unless there's any others coming in, but Malcolm's got another question. Do you have a number for the addressable market that Intercede could capture? Malcolm, unfortunately, in the markets we operate in, particularly on the CMS side, there is no market data available. There is market data available on the size of the overall identity and access management market. You're probably talking 20 billion-25 billion. There is market data available on the authentication, strong authentication market. You're probably talking anywhere between $4 billion and $6 billion, depending on which year.
But we are a subset of that market, and credential management is simply not carved out by the analysts that we're aware of. At some point, we were even considering instructing a bespoke piece of research, but the data is simply not out there. We would have paid a lot of money probably for very poor quality. That's all the questions answered. I hand back to Lily.
That's great. Thank you for answering those questions you have from investors. The company can review all questions submitted today, and we'll publish those responses on the Investor Meet Company platform. Just before redirecting investors to provide you with their feedback, which I know is particularly important to the company, Klaas, could I please just ask you for a few closing comments?
Yeah, thank you, Lily. Clearly, we were disappointed with the order delays in March, but we've updated the market since 21st of April confirming the receipt of these orders. There was no weakness in the pipeline. It was simply a reflection of delays on procurement cycles on the client side. If we reflect on the year, I think we've shown great progress in key deliverables, working with existing clients as well as new logos across different geographies. Alan has outlined our product vision to become a leading supplier of enterprise credential management with the aim of managing employee machine and agentic AI credentials. Innovation, in line with the last few questions, we've adopted the use of AI in our business for our products, as well as leading to product enhancements and faster roadmap delivery.
As we discussed, we have some very good market drivers and dynamics which put Intercede's offering right at the heart of strong identity and our aim remains exactly the same as we've outlined before. Deliver sustainable revenue growth and profitability. Objective number one is organic growth, and as and when we can find the right target, we will layer on any inorganic growth when we feel that will add value to the business. We clearly have a great start to the year, and in terms of order intake and our pipeline's very strong. Clearly, none of this is possible without a very committed team of colleagues who we believe deliver the best code in our part of the industry. We look forward to keeping you updated on progress. Hope you found this session informative. Thanks again for attending. Do provide us with your feedback.
We do take your feedback extremely serious. Please spend 2 minutes on providing feedback. Good, bad, indifferent, constructive. We love your feedback. It will help us to improve any presentations for future updates, and we look forward to providing you with the next update in November 2026. This is the end of the presentation. Thank you.
That's great.
Thank you.
Thank you, guys, for updating investors today. Can I please ask investors not to close this session, as you'll now be automatically redirected to provide your feedback in order that the management team can better understand your views and expectations. This will only take a few moments to complete and I'm sure will be greatly valued by the company. On behalf of the management team, we'd like to thank you for attending today's presentation, and good afternoon to you all.