Intercede Group plc (AIM:IGP)

Transcript

← View all transcripts

Oct 12, 2026

Good afternoon, ladies and gentlemen. Welcome to the Intercede Group PLC Capital Markets Day. Throughout this recorded meeting, attendees online will be in listen-only mode. Questions are encouraged. They can be submitted at any time using the Q&A tab situated on the right-hand corner of screen. Just please simply type in your questions at any time. I'd now like to hand over to CEO, Klas Lindahl. Good afternoon. Thank you, Mark, and welcome everybody in the room here. It's really nice to see so many of you showing up for what is our first capital markets day. First of all, we tried hard to make something interesting out of it, but we're always willing to learn, so we happily take your feedback afterwards. Also, very much welcome to those who've dialed in online. We've had very high sign-up online. We clearly can't see you, but hopefully you can see what's going on the screen. We'll take you through the presentation today. I'm joined here with a number of colleagues and partners who I will introduce very shortly. Agenda-wise, Nitil, who's the CFO, and myself, will very quickly talk you through a bit of the background on the company, how we position, a little bit about the numbers. Just to be absolutely clear, there is no new financial data. We report back in June, third week in June. So the data that's today presented, particularly on the financial side, is information that's already in the public domain. So no new technical information. Far more important, what we are going to talk about is how we position, how we see the market. We'll have Allen Storey, our Chief Product Officer, talk about the product line, how we're evolving the product line, how we're positioning. We then have one of our partners, Stefan, from a company called Cryptas, who is on recording, but he's been a longstanding partner. He will be introduced by one of my colleagues at the back of the room, Siobhan. We then take that a step further and said, "Hey, we actually know quite a lot about you as individuals, you as companies, domain names about what's out on the dark web." So James Westgate's here, one of our design authorities, but he's got a special role after working hours. He will actually use and show you how that information can be used to actually log into or hack into your business. That's really the starting point for how we position the products going forward, because we then go into product mode and say, "Hey, if these are the threats that are out there, what do some of our customers do?" With that case studies, we'll use some real-life case studies. We'll also show you some live product demonstrations, so you can actually see how our different products actually work. Then really pleased to have Cara here. Cara McFadden from Guidehouse. She has flown in from the U.S. Those who have been following us for a while will recall that we do quite a lot of work with Guidehouse, particularly in U.S. federal market. I asked Cara for a favor. I said, "Hey, could you do us a little speech?" She said, "Yes, that's fine." Then I realized she had never been in London, so I said, "Okay, we will fly you across." Obviously I said, "Hey, it's always nice weather out here, so you will be perfectly fine." Clearly, you have to forget about yesterday, when it rained 24 hours. It is what it is. Then we will close off and summary, obviously have some room for Q&A. Without further ado, these are your headline speakers. Some of them you will recognize, but we also give you a bit of a broader view as to who else is in the room. Normally, the first three on the left, you will see us on the road shows. Cara, as I said, has joined us from Guidehouse. Have somebody calling me at the moment, so I do not know if they are trying to get into the building downstairs. We will leave that for later on. Siobhan Morey-Millington is our head of sales and partners in what we call rest of world. We have our U.S. arm, we have our rest of world arm. Jamie Smith is solution architect based in the U.K. Jamie being with the company 15 years, quite a long time. Sits in Siobhan's team. James Westgate, design authority for both MFA and PSM. The two products we acquired through Authlogics. He is part of Allen Storey's unit. Stefan Bumerl is the CEO for Cryptas. It's an Austrian reseller we have had a very long relationship with. Hopefully that positions a little bit. What we really want to try and do is provide you a bit more insight into what we think is the investment case. I will not go through all the three blocks right now, but we will circle back towards the end. We will particularly focus today about business and market. Like I said, there are no new financials out in the market. Nitil Patel will do a little bit of a recap as to where we are. At this stage, I think the main thing to bear in mind here is we sell in a market that's clearly growing at the moment. It's the wider cybersecurity market. We are all under threat, whether that's individually or as companies. We are constantly under threat. Every minute of the day, we are under threat. We think we are in a very interesting market. First point here, this is not discretionary software. This is business critical software. You can see it in our results. We see very little attrition. It's extremely sticky kind of software that we sell into those markets, and we have clients for 10, 15, 20 years. Ms. McFadden will also talk about playing the long game, and we are in this for the long game. A little bit about how we position. In effect, at the very highest level, what we do is we protect companies against data breach. How do we do that? In effect, we use and replace weak credentials with much stronger authentication, and you will see in the products what we do. We do that simply, we do that securely, we do it at scale. Simply meaning it's standard off-the-shelf software. We sell the same product time and time again, which actually works very well for us because we can turn it around very quickly. We can recognize revenue and profits very quickly. We do it securely. We work with some of the most security conscious organizations out there who test this software right to the hilt, so we know our software is secure. Final point is we can do it at scale. Scale means not just we can do hundreds and thousands, we can do hundreds of thousands and millions of user licenses. Overall, I think we're pretty well positioned into the market, and we know our platform scales out. Data breach is interesting. 5, 10 years ago, data breaches were quite unique. Today, they're normalized. Every day of the week, we see the announcements about data breach. This is probably how companies feel, yeah? This is how they feel. They feel anxious. It's an interesting kind of painting. Wild guess. What's the name of the painting? Go on. "The Scream." "The Scream." Who is it by? Edvard Munch. Very good. Edvard Munch. There are some really interesting facts about this painting, which is why I'm bringing this up. There's two really interesting facts. Anybody wants to have a guess? Graham, you can't, because I think you've heard this one before. Two interesting facts about this painting. There are multiple versions of the same painting. So in effect, there's multiple identities, as in effect, there's multiple credentials. There's another interesting fact about this painting. It got stolen twice. Stolen twice, got recovered twice. So what do I have now? I have, in effect, a stolen painting with credentials, and that also turns out to be the number one reason for data breaches. Stolen credentials, stolen passwords are the number one cause for data breach. This is Verizon research. This is IBM research. There are plenty of reports available. Every year, these reports get launched, and basically, the majority of breaches are happening because of compromised user credentials, compromised passwords. We don't use passwords, do we? Or do we? Because we actually know a lot more about your password use. So we're going to have a little poll, and I need a little bit of participation here. We need to be honest with each other because remember, I know a lot more about you and your companies than you may want me to. Yeah? We also run the poll online because otherwise it becomes very one directional. Mark from IMC will run the poll in a minute. I need a quick show of hands. Who's using passwords for personal use? Oh, well, that's all of us. That's interesting. Who's using passwords at work? Hmm. Quite a few. Who has reused passwords between private use and work use? Don't be shy because I know a lot more about you. Yeah, come on. Yeah, we all do. Yeah. Who's using passwords longer than 12 characters? You see Royston, our chairman, he's actually quite good because he's listened to this story before. Let me quickly check what's happening online. Are you using passwords at home? Yes, nearly 44%. Use passwords at work? Yes, again, a large number. Have you reused passwords? 23%. Hmm, that's a bit skinny by the looks of it. I'm not sure if everybody is open and honest. We have 10% using passwords longer than 12 characters. That is really interesting information. How do we use this going forward? We actually looked at what is happening in this room. We looked at all the companies who registered, we looked at your domain names, we looked at our breach database and said, "Okay, what information can we find about this?" We had 25 companies that got passed on to us. Of the 25, we could find exposed credentials for 22 of you. That is 22 out of 25. I am not a mathematician, but it is 88%. That actually is quite high. More worryingly, 9,710 exposed credentials. What is even more worrying, all of these are clear text credentials, so they are clear passwords. They are not hashed. They are available on the dark web in clear text format. Yeah? We then had James and his team as ethical hackers do a bit more. There were about 400-ish hashed credentials. One of James's team worked on it. He cracked another 49? I think 49 in little or no time. This is just compute power. The more compute power we throw at it, the more we can break. Lots of exposed breach credentials available. The reason why I asked about are you reusing passwords, we can see from our database that actually quite a few of you are reusing passwords. Not particularly good hygiene. You should not be doing that. Moving on to the types of passwords we see. Well, you are quite an inventive bunch. You use wealth and secret and some simple numbers, and this is quite unique to this community. We know this is unique to this community. We do not understand why, but you obviously use those kind of passwords. Relatively weak passwords as well, because a lot of these are less than eight characters. Eight-character passwords, as James will say or update, can be hacked in absolutely no time. With a little bit of compute power, we can hack those down. Lots of them only use lowercase. We shouldn't be doing that. Only 18% is using special characters. Again, not particularly inventive. What we cannot see at this moment, whether the passwords we have in our database, the passwords that in fact exist on the dark web are currently used by you. We can easily check this if we engage with you as individuals or engage with your companies. We can check in less than half an hour whether your staff members are using those passwords or not. It is a simple audit, half an hour. James and his team will run this very cleanly. We then look at some of the breaches. There are 189 breaches that we have picked data from. It is not just the LinkedIn breach that is pretty well known. We found three breaches that are particularly interesting. Evite is an interesting one. Evite got breached in 2013, but they only admitted it in 2019. For six years, this data was happily out there on the dark web and being used. The same for Zacks. I said, "Well, who the heck is Zacks?" Well, Zacks is an investment research platform, yeah, that particularly shows up in this community. They had a hack and leak of 8.8 million passwords, shows up in this database. There is clearly stuff going on that we should be aware of, we need to protect ourselves against, and that is exactly what we do as a company. We protect our companies that we work with against data breach. The last one I will leave for James Westgate to talk about the malware. Malware is something that will be put on your desktop, your laptop, your mobile, and it will just harvest your credentials. It will just harvest your password, make it very easy, and then automatically reuse that. This is quite interesting. It is a bit of a wake-up call, but obviously we started off with, well, we do not really use passwords, do we? Bear this in mind. Then very high level, who is Intercede? We are headquartered in Lutterworth, junction 20 on the M1. We have two offices in the U.K., one in Lutterworth, one in Bracknell. Bracknell through acquisition. Our second office is in Washington. Washington for a very good reason. A lot of our business is U.S. federal, so we are right in the area there. What do we do? Business critical software. This is not discretionary software, it is business critical, and we focus on employee identity. We focus on protecting the credentials that we all use as employees within companies. Just to be clear, we do not focus on consumer identity. Consumer identity is a very different part of the market. We have around 150 high profile clients. I always say we are a small company, but we are the client base to die for by the time you look at the logos we work with, the partners we work with, and the many clients we work with that we cannot put on our website because we are not allowed to, but particularly in the U.S. You can think about interesting shaped buildings. You can think about three-letter acronyms, agencies. You get the gist of what is going on. We are around 105 staff, but they are all subject matter experts. They are highly skilled coders, developers, design authorities, as you hopefully will see some of them today. We have issued millions and millions of credentials. Again, this scalability. If you look at the Kuwait National ID scheme, we have issued north of 6.5 million credentials. This is platform that will scale. Last one is our reach into market is through channel. We decided six years ago, no more direct sales. I think Little will correct me if I am wrong, but around 95% of our new business nowadays goes through channel. It means we have much broader reach. If we then look at the business principles, I go back six years when I was appointed as CEO, the first thing we did is we said, "Look, we are going to focus on the customer." I do not care if we do not understand what the customer wants and needs and requirements are, we are not going to go anywhere. We use that information to invest in product. We invest over GBP 3.5 million a year in R&D, so we are investing a large part of our money into R&D to guarantee market leadership. Clearly we cannot do that without investing in our colleagues. The 105 staff we have, and we added 17 in the last 12 months. We're growing very nicely, and we're pushing quite hard. In order to get that into the market, our go-to-market model, as I said, is very much distribution, resell, and channel. Pricing wise, we've morphed our pricing over the years. Traditionally, it's always been perpetual. We're now offering both perpetual and subscription. We do it for a very good reason, because some of our clients do not want to buy subscription, particularly on the high-ends. They very quickly calculate what's cheaper on a five or a 10-year TCO model, and we need to be flexible on both sides. Final one is M&A. We've got our in-house corporate development. We are actively looking at the market. We clearly have made our first acquisition, successfully integrated that acquisition. We're on the lookout for more, as and when we can share more information, we will. Looking at the market, we always get questions about, okay, what markets are you operating in? We're operating in three distinct kind of markets. The top end of our product is also the top end of this slide. It's the PKI, public key infrastructure market. It's a good size market with good double-digit growth. Through acquisition, we've added the middle layer of multi-factor authentication, password security management. Clearly, these are big numbers, but we're not operating across this entire market. Try and grind this down a little bit. When we look at what we address, we shrink the market a little bit. We focus on enterprise government. Sorry. We focus on federal, government, enterprise. We focus on the three product lines we have, and very specific, we focus on anything that's not multi-tenanted. We're very much on the on-prem side. There are plenty of use cases out there where customers do not want to buy full cloud, full multi-tenanted, and that's where we differentiate. If we then look at the markets we serve, geographical markets, we're very strong in the U.S. Over 80% of our revenues is North America. Obviously in EMEA, Continental Europe. Interestingly enough, we also see growth now in the U.K., particularly since the invasion in Ukraine. We've seen U.K. government investing in the high-end product, the PKI product, which is good for us. Again, that's going through partners. Finally, APAC. We're starting to open up the market in APAC. Beachhead in Singapore. We've got multiple live platforms in Singapore, and we're hoping to expand them going forward. We also got our first client now in Brazil. If we then look at our actual market, we grind the whole thing down. Very high end, high assurance. We position our CMS product, and again, we'll provide more color about what CMS actually stands for. Mid-market MFA, again, regulation will drive that. Bottom end, password security management. You need to start with the basics. If we compare this against five years ago, we had one offering. The only thing we could offer was PKI at the top end of the market, and that was the market we're operating in. We've added functionality. We'll get to the pyramid. Some of you have been following us. You will recognize the authentication pyramid. We've come down that pyramid partially by building functionality, but also through buying functionality, buying IP through acquisition. Our market has grown at least 5 to 10 times compared to where we started before. Where is this growth going to come from? Multiple angles of both organic and inorganic. First of all, land and expand, it's something we're doing, we're pretty good at. We sell 10,000 licenses to a client in year 1. We find a new use case, the client buys 2,000 more CMS licenses a year later or 2 years later. That's relatively straightforward. It's the same for MFA, it's the same for PSM. There was an interesting use case in Germany recently. We had a German hospital that was using password security management for their high-end users. That hospital got breached. Guess what? They need more licenses. Breach sometimes has got an upside. We will upsell. Why is it called land and expand squared? The examples I've used is all about horizontal land and expand, but through the products we've acquired through Authlogics, we can now do vertical land and expand. A customer who's got CMS can now also buy licenses from an MFA and a PSM perspective, since we've integrated the full product set. Clearly, we charge for new functionality, that's pretty common. We're opening up new markets. I talked about Singapore, talked about Brazil. There's plenty of other markets we're opening up. New market segments is interesting. I know there's particularly one listener online who wasn't feeling very well, but he knows who I'm talking about. He's always asking us, "Klaas, what do you do in the middle end and the bottom end of the market? Why are you not positioning there?" Traditionally, from a PKI perspective, we didn't have the product. Now that we have MFA and PSM, we do have the product to really come down that pyramid, to really drive down at the bottom end of the SME market. The opportunity I refer to here is in Germany, we've signed an agreement with a company called Riverbird. Riverbird is a remote monitoring and management platform, and they focus exclusively on SMB. They focus on the bottom end of the market. What they manage is the operating system. They make sure it's safe to run, they do backups, they do AVG. They've now added MFA to their platform. They have millions of users on their platform, and now we're trying to cross and upsell our MFA solution into that. It's a very different market to what we're traditionally in, but because we have route to market, their route to market is through MSPs or MSSPs, managed service providers or managed security service providers. They have that channel into the market. That's a market we will actively pursue. That's obviously aligned with the new distribution model, new channel. We are constantly growing that. Siobhan, who's in the back of the room, has got a real background in channel and distribution, and we have Siobhan's counterpart in the U.S. who basically drives that from the North American angle. Hosted offerings. We don't host our own offerings. We get our clients to host or, sorry, our partners to host the platforms for us. That also enables us to address different parts of the market. We have a partner in the U.S. called WidePoint, a NASDAQ-listed company. They particularly offer hosted PKI, so that's the more complex end to lower-end customers who can't afford to run their own infrastructure. They have a fully shrink-wrapped offering. It's very nice and tidy. Our sales effort is very low because they sell it, we just take the license orders as and when they come in. We focus on new product. Inorganic, as referred to, we've done our first acquisition, fully integrated. We'll provide more color on that. We're always on the lookout for new IP, whether it's new revenue. We're looking at new geographic markets, new market segments that we can move into. Clearly, there's very little I can disclose, but we'll finish off today with our pyramid. Once we've gone through the presentation, you'll recognize the purpose of the pyramid, and I'll provide a little bit of color on the areas that we will explore further as we go along. At this stage, I'll hand over to Nitil, who is our CFO. Thank you, Klaas. Investment case go back on our organic and inorganic. We believe our capital structure is in a good position. We continue to invest in our product and our people. Why do we do that? Well, because it gives us the competitive advantage to then generate the revenues, which gives us the profits. It's a prudent capital structure. As we've mentioned, there's no debt in the group. We have a very tight working capital document and the cash not just in our products, but also in our M&A strategy and the cautious in our M&A strategy. Cautious. Is that right? Trying that? Yeah, okay. We're cautious in our M&A approach. Why are we cautious? We know that if you get this wrong, it has an impact. We liked our M&A play on Authlogics. We learned a lot on that. The key one here is the integration of the company products and how we go about that. That's a fundamental document that we always use to approach an M&A. How are we going to integrate? How are we going to make it better? What does it do with our stack, especially our IP stack? Then focusing on recurring revenues, as all of you like. Recurring revenues means that it continually pays. S&M is really important to us. The reason S&M is really important to us is because it covers a big chunk of our operating costs. If it covers a big 80%-90%, that means that our license income is highly accretive to the bottom line. So continued investment in our product is really important. The good news is that all our expenditure is in the U.K., therefore we are entitled to the tax credit. Slightly less generous going forward. We're also producing more functionality and modules in the future of our product. What does that mean? It means that potentially in the future, we can potentially capitalize that element of that development if we have revenue streams against it. Something we'll look at going forward. At the moment, we expense all our R&D into our income statement. I think we're one of the few software companies that does that. Cash generation is a key KPI. Why is it a key KPI? Because it enables us to go back to the original, invest in our product, invest in our marketing, invest in our people. It enables us to be competitive advantage in our product, which helps us do more sales. There's an exceptional for 2024. If people have been following us, they'll know that we had a big sale in December with a federal agency, and that helped our cash balance to go to GBP 17.2 million as of 31st March 2024. Just wanted to show you how the group revenue is going through the double digit growth in the last six years. You'll see the forecast that this year we're coming in at GBP 20 million, and next year it's going to be GBP 16.1 million. We wanted to show you what, without the exceptional, if you look at the orange, the orange is MFA/PSM revenue, and the gray is the CMS revenue. We were looking to do GBP 13 million of CMS. Obviously, we've done better than that. If you look at the trajectory, it's all double digit growth, and we believe that we can achieve that in the coming years. Finally, what does all that mean? A good share price for us means that we can do a larger M&A, integrate it, and therefore increase shareholder value. We've got a good, strong balance sheet to do that. We're forecasting cash generation in the coming years. Also it means as a listed company, we have access to the capital markets to do an acquisition that we believe will enhance shareholder value in the future. On that basis, I'm going to pass you over to Mr. Storey. If your mic works. See which works. It sounds like this microphone's working. Not working? Working. Excellent. Thank you. Thank you, Nitil. I'm going to take a look at our solutions and what we've actually got in the portfolio. I'm going to do that breaking it up into three, starting off with where we came from, where we are today, then, more importantly, look at where we're actually going. A lot of you have seen this pyramid before. We've used this to describe how strong is your authentication. Weaker authentication towards the bottom, passwords, easily guessed, often reused, stolen. Moving up to the middle, one-time passwords. I'm sure we've all used these to log on to our bank. We've received a code on our phone we've actually type in to a second application. Then moving all the way up to the top of the pyramid, PKI and FIDO. We are really talking about cryptography-based authentication. Historically, we have played very much at the top of this pyramid. PKI is where we have been. That is the market for federal government, aerospace and defense, that sort of organization, intelligence agencies. It is an interesting place to be. Those people tend to keep your product for a long time. They also tend to pay well for that product. It is like the pyramid, it is the smallest part of the market. As you come down the market, you get less secure, but more people will use one-time passwords, multi-factor authentication, and pretty much everybody, as we learned from earlier on, is still using passwords. There is more of the market as we move down this pyramid. We as an organization looked at how do we address that market? Do we build it? Do we buy it? Do we partner? Came to the conclusion that acquisition was the best strategy for us. We acquired a company called Authlogics. Happened to be based in the U.K., though we looked at people in the U.S., we looked at people in Europe, could have been anywhere. The reason we chose them is we thought that the product was very credible. Multi-factor authentication was a very strong product, and we thought the people were very credible. They had some real expertise in what they did. They also had an added bonus for us, and that was the fact that not only did they cover the middle part of the pyramid, the multi-factor authentication, they also had password security management. That interestingly allowed us to be able to cover the whole pyramid, and that is unique. There are people who play at the top end, there are people who play at the bottom end, but there is nobody who plays across the entire pyramid other than Intercede. Very briefly, what did we do with the acquisition? This was my first acquisition on this side of it. I had been acquired before. This is the first one I have been involved in where I had acquired. Much more fun this way round, can let you know that. The first thing we did is to understand. We did not change anything fundamentally. We made sure we understood the product, the code, the business processes, the go-to market. We got out there, we got on the planes, we met the partners, we met the customers. Really started to understand the business. We did an enhancement to the product based on what customers were asking for. This was a push notification. A lot of drive for people wanting to use their mobile phone for strong authentication so you do not have to carry around a special device, a key or a smart card or something. That is what we put in the product. It will now push to you and say, "Hey, Alan, somebody is trying to log on. Is it really you?" "Yes, use my Face ID, use my fingerprint," so I get a very good user experience. We put that in the product, but that at that point was not rebranded. It was still kept Authlogics as a branding. Then as per our strategy, we really moved on, and we integrated the solutions together. Not just integrated as a business, so we have got joint sales team, customer support, et cetera, but from a product level as well. We've now got joint development teams, testing teams, technical author teams, et cetera. This allows us as a product team to look at where do we place our investment? Where do we get the most bang for our buck? We did a complete rebrand. The product is now rebranded MyID MFA and MyID PSM, multi-factor authentication and password security management. That allows us to sell a much simpler story to our customers and partners. Here's the authentication pyramid. We cover all of it. But it also allowed us to capitalize on the credibility we have from some of our very high-end names on the CMS side into the world of MFA and PSM. We introduced some new features into the product, and we brought FIDO passkeys into the product. At the very top end of the pyramid is PKI. There is an argument to say that FIDO is as secure as PKI. FIDO came in from the consumer world. We're probably some of us are using it to log on to our banks today, but it's kind of under the hood. We don't see it. But it is there, and it's very secure. It's based on the cryptography. This was an ability to bring some of the skills and knowledge from the CMS world into that mid-market MFA world. And that's important to us because it allows us to differentiate. That mid-market and multi-factor authentication, it's a very competitive space, so we need to be able to differentiate, and this is one of the ways we can do that. Now the story is we cover the whole authentication pyramid. One way of saying this is to go to a customer, how secure do you need to be? Not everybody needs to be at the absolute top of the pyramid, but everybody's looking at how they want to improve their security, so we can help them wherever they are on that journey. And it is a journey. 10, 15, even 20 years ago, we were involved in conversations about when will the password die? Has the password gone? But we're all still using them. They're all still out there. The story here is very much secure yourself from day one. You're still using passwords, we get it. Let's make those secure as they can possibly be. If you want to move up to multi-factor authentication, we can support you on that. If some or all of your users need to be at the absolute top end of security, we can also help you there. This gives our customers an advantage that they don't need to go to three different vendors for three different parts of the solution. They can come to us. We can give them the flexibility to improve their security over time as they need to. And again, that's unique. There's nobody else that could do that across the whole stack. Just one slide each on each of the actual products here. We're actually going to show you these live later on. This is password security management, and at the heart of that is that password breach database. This is where we were looking into for the companies looking in the room at the moment to see what do the bad actors know about you. We have a small team of ethical hackers who look out there on the dark web. Whenever there's a data breach, Marriott, some of the platforms Klaas was mentioning there, those usernames and passwords will go into that dark web. People will then steal those, and they'll start trying to break into systems with them. We do exactly the same, apart from we don't break into systems with them. If we try to do that, James will be in jail at the moment. I'm glad to say he's not in jail. We stop at that point. All of that's public information. We take that information, we put it into our password breach database, and we help our customers with that information. First thing we can do is we can audit that. What do the bad actors know about your business? Is there information on the dark web that they could use to try and break into your business? Then we can actually do the on-premise audit. Klaas mentioned this earlier. Information in that database might be out of date. It might be that you've changed your passwords. It might be you've moved on to multifactor authentication, but we can find that out with the on-premise audit. We can have a look at your passwords and say, "Are you using passwords now that are out there, and are you at risk?" If you do, the password security management product, PSM, we can install that, and that will verify your passwords. It will check them for you. At that point, if you're using a compromised credential, it will force you to change it. You don't have to wait 30 days, 60 days, 90 days. MFA, this is multifactor authentication. This is everything in between passwords at the bottom and PKI at the top of the pyramid. There are some significant benefits we really like in the solution, which is why we acquired it. It works on and offline. A lot of solutions don't do that. It also protects the Windows logon. Lots of applications will only protect cloud resources. The reality is pretty much organization out there, everybody's got something in the cloud, they've still got some legacy applications on premise, particularly some of our customers in defense, in healthcare. There's a lot of applications that have been developed over time. This application can protect all of that on premise, in the cloud, on and offline. By bringing FIDO into the application there as well, we now have the ability to issue a very high level of assurance, but for something that's very simple to use. One of the things we learned from talking to the customers and partners about this product set and this particular market, that mid-market is ease of use is vital. It almost trumps security. People want to be secure, but if it's not simple to use, people won't deploy it. They don't have the IT teams and skills that some of our government customers have. Mid-market product, now with that high level of security, but very easy to deploy, very easy to use. Our traditional credential management system, I hope the word traditional doesn't sound wrong because it's still a growing market. There's still very good business in that market for us in the credential management, and we are absolutely the market leader in this space. I know I am biased because it is my product, but KuppingerCole, other people, Gartner say that this is the best product on the market from a credential management system. That is all about making sure that the right people get the right credentials and hiding all of that complexity and technology and key management from the end customers. Put simply, there is no point in me having a credential that says I am Bill Gates if I am not Bill Gates. So we need to make sure the right people get the right credentials. There is a lot of integration in that solution. Importantly, it also provides registration and identification of a person before we issue them a credential. We will show you some of that when we talk about one of our customers. It is making sure that person really is who they claim to be at the highest level of assurance before we issue the credential that lets them into the air traffic control tower. So where are we going next? What are we doing with the roadmap? There are three general drivers for our roadmap, and these each take about a third of our resources. So you could put a third of our people onto each of these areas on the left. The first one is support and maintenance. It is not a bad thing. It is a very good thing for us because that funds our support and maintenance revenue, and that is annual recurring revenue. It is very repeatable. It is very reliable revenue. Our government, aerospace, defense, military customers, they want to have that support and maintenance. It is a security product. If there is a security event, something happens, they want to make sure they are on the latest, greatest, they are patched up to the latest level. So that takes that. We then have customer-funded. All of our intellectual property remains our own, but we quite often have occasions where a particular customer will want something accelerated on our roadmap and are willing to fund that. So that is great for us. That means we can get that work funded on our roadmap, but we always maintain the intellectual property. The strategic, the interesting one, is areas we think we can enhance in the product. So that could be a new feature, it could be a new product, it could be a new module within a product. Looking back at the financial figures there, the important thing from my perspective is that as the person who looks at where we go with the product, is that the first two are pretty fixed. The level of support and maintenance, the level of customer funded, are pretty fixed in terms of the people we have each year. Therefore, any new headcount we add in goes straight to that strategic bottom line. So 100% of that new person will go into where can we take the product, what can we do with it? What is going on in the market? What is driving us to make decisions on product or the next acquisition, et cetera? The first one is that the level of cyber attack is increasing, be that criminal, be that state sponsored, be that for what is happening in the Middle East, what is happening in Ukraine. We can see increasing levels of cyber attack, and that is leading to increased levels of cyber spending, particularly around governments and people who believe themselves to be at threat. We are starting to see people demanding more security. We are seeing a trend from bespoke solutions to COTS, commercial off-the-shelf solutions. There is a term in government called GOTS, government off-the-shelf. That is where the government actually pays for the work to be done, they own the intellectual property at that point, and the solution does exactly what they need because it has been built exactly to their requirements. The problem is 3 years, 5 years, 10 years down the line, the world has moved on. There are new technologies, biometrics, AI, post-quantum, FIDO, all the new technologies coming in, and that solution stayed pretty static. We have had a lot of government customers wanting to move away from those bespoke solutions towards more commercial off-the-shelf solutions, therefore they get the upgrades, they get the new technology. Part of that is avoiding vendor lock-in as well. There are lots of different technologies out there. The flexibility to jump between different PKI vendors, card vendors, biometric vendors, is important to them, and that has always been a key strategy for us to keep technology independence. I mentioned a shift to mobile devices, doing some very interesting things with NEC on police digital warrant cards, doing some interesting things in the U.S. on access for non-military personnel to bases where they can currently get in with a plastic card, which is not great. Looking to move that onto a mobile phone, but using some of the mobile driving license standards so we can have cryptographically verifiable identities on a mobile device. The big driver for our business has always been regulation. Regulation drives people to use our particular type of technology. There is more regulation coming out of the U.S. NIST published the standards there. The rest of the world tends to follow NIST standards as they are the best-funded cybersecurity administration. That is pushing people to use more phishing resistance. James will talk about that in a bit more detail. It is also pushing people to use multi-factor authentication everywhere. That is all employees and down the supply chain. Very interesting change for us is in the EU. There is a piece of legislation called NIS2. That has now been passed at the EU level, which says by the end of 2014, each member state must have enacted its own cybersecurity legislation. That is going to be 2024. 2024. Good point, Klaas. I told you I have been doing this a long time. 2024. Thank you. By the end of 2024, they have to have enacted cybersecurity legislation. That is really interesting for us because the U.S. legislation has really driven our business, but there has been a lack of direct legislation around authentication and security in Europe, but that is coming. Even on our own turf in the U.K. now, our own organization have pushed cybersecurity regulation standards and cybersecurity rules. They are saying that multi-factor authentication is the base level, and we are starting to see people not getting cyber insurance unless they are at least at that base level. There is a huge amount of drivers towards more and better, stronger authentication. The roadmap. Today on password security management, we have the breach database. We think that is a great asset. We can sell access to that via APIs. We can do audits against it, and we have the software that you can actually install on-premise to check those passwords. The first thing we are doing is extending that outside of Active Directory. Active Directory is the primary password that most people use, but there are others, so we are extending that to cover those. The second one is simply marketing. Authlogics, we think, had a fantastic product set but didn't really have the arms and legs to take that to market. With an expanded organization, we are now taking that through our channel and our customer base. The main thing we are looking at here is turning this into an enterprise password manager. I will explain what I mean by that in the next couple of slides. Finally, on the right-hand side here, where they have got dot, dot, this is very much research and development items we are looking at. FIDO, one of the advantages with FIDO is that I can sync my passkeys from my phone to my iPad, which is very interesting because I have got a backup, but that tends to happen in my own personal Apple account or my Google account. We think there is an opportunity in the market there for somebody to actually do that backup, but on behalf of the organization, so they own the keys. Multi-factor authentication, very capable product, works on-premise, supports cloud logon, now supports FIDO. First thing we are looking at there is national ID connectors. Some organizations, Singapore, Singpass, UAE Pass, have nationally issued ID credentials that we can then use to protect local resources. How could I use my UAE Pass to protect resources within my organization, we think is interesting. What we are really doing is extending this towards more access control and single sign-on. I will explain what I mean by that on the next slide. On the right-hand side, again, research and development areas we are looking at ongoing authorization. This is something that has been asked for more and more. Sam logged on 10 minutes ago. Is it still Sam? Have they suddenly changed IP address from Europe to China? Is that an impossible travel situation? Are they holding the phone in the right way? Are they typing at the right speed? It is a constant game of almost Whac-A-Mole, where you have to hit the security threat down, and then another one pops up. That is what the security world is like. AI as well, artificial intelligence, we are seeing it used more and more for attacks, phishing campaigns that are virtually impossible to spot from ones that humans have generated. How can we bring that into the product? How can we start making security decisions? Really what we are doing is looking at bringing those two product lines together, MFA password security management, to give an access control solution for the enterprise. We are not unrealistic. We know there are huge players, there are Okta, there are Ping, there are the Microsofts of this world. They tend to work at the very, very high levels. We are not fighting those. There's a lack in the market of a mid-market product that gives you that solution. A lot of companies out there can't afford to go for the Oktas or the Pings. They're just too expensive. What this will do is on the left-hand side, we have somebody authenticating into my desktop, so that gives me the Windows logon. That could be a credential we've issued. It could be their national ID credential. Once they've hit that logon, then they're presented with applications they're allowed to access. Many of those applications are modern applications, so I can use things like OpenID Connect or SAML to just simply pass an authentication ticket in and give people a single sign-on experience. However, there are lots of applications out there that still use passwords, again, particularly in the NHS, particularly in defense. Here, what we'll be doing is combining that with our enterprise password management, where we will learn the password for that application. We will create a huge complicated password that the end user doesn't even know. We will check against the password breach database that that isn't a password that somebody else has already cracked, so it's safe. With that strong authentication, we will play that password at that end application. This gives people a journey. It gives them the ability to move towards stronger authentication over time, but it gives that full solution in the mid-market, and we can't see anybody else who's doing that in that mid-market space at the moment. Particularly relevant for things like NIS2, where there's a lot of smaller organizations. CMS roadmap, again, believe it's the most capable product on the market today, but some of the key things we're looking at there is how do we play with those big players? Passkey registration with an identity provider. What does that mean? It means we issue the FIDO keys with all of the rules and control that our customers expect, but we then pass them into a Microsoft or we pass them into an Okta platform. We can work with very much a strategy of us, we need to work with those big players. That's that part. The other one on the second place here is the flexibility and configuration around the product. Sometimes, we end up configuring or customizing the product for an end customer, but we're moving away from that now. We're moving towards keeping the core product absolutely pure and allowing customers to do their own configuration. There's this more toolkit around the product where customers can configure the system, they can integrate it themselves without having to come back to us to do that for them. I very much like our developers to be working on core product enhancements that enhance us in the market as opposed to an individual customer. Again, other areas we're looking at artificial intelligence. How can we use that to bring in to make risk-based decisions on is this the right person? Post-quantum. At the moment, a lot of cryptography is based on it's incredibly difficult to actually try and crack the keys and work out what the private key is. As computing power increases, it gets more likely to do that. We work closely with NIST to set the standards in this area. We're working with the crypto manufacturers to make sure that we're up to speed and ahead of the game there. Okay. Siobhan. Thank you, Alan. Can you hear me? Great. I'm Siobhan Morey-Millington. I'm Sales Director looking after our rest of world customers. I just wanted to briefly introduce you to one of our European partners. Unfortunately, they're not in the room today, but they have recorded a video that I can share with you. Cryptas are a PKI specialist based in Austria, serving the DACH and Nordic markets. They're a long-standing partner of Intercede for much more than a decade now. They resell, deliver, and deploy our MyID solutions, and they have also integrated their own software with MyID CMS. We've got some 20-plus customers together, into the banking and finance sector, government and defense, and high-end corporate enterprises. in the last year alone, we added a further three customers. We really value this partnership with Cryptas, and we asked Stefan Bumerl, CEO and founder, to answer a few questions that we could share with you. My name is Stefan Bumerl. I'm founder, owner, CEO of Cryptas. That's for already more than 20 years now. Personally, I'm a tech guy, so I have a very strong technical background, working with smart card since the late '90s. Cryptas was always introduced to deliver impact, a positive impact to our customers, and that's what we still do today. We deliver trust to our customers. That means they need to establish their primary security goals, which are providing authenticity, integrity, confidentiality, and of course, also availability is important today. These security goals can be solved in the best way by using cryptography. What Cryptas is doing is using that somewhat complex technology, building complete services to our customers, and try to make that complex technology as simple as possible to consume. That means we have been having a long journey to transform ourselves from really pure tech-driven to get more in an easy-to-consume, easy-to-work-with organization to deliver green checkboxes to our customers. The combination of good technology, focusing on usability of users and also the operational teams in our customer's organization together with proper economics sites deliver the impact. That is what we promise to our customers. Intercede is in that scenario with a very important part. Trust is our currency. That means that customers really fully rely on us and on our services for a long, as we said, on a long period of time. That means that it is important to be there reliably. New is not always good. Being there for a reliable long-term, that is a quality. MyID is in that fact space, really a rocket solid software. It has been proven to be reliable for years. In many organizations, it is the backbone of the security architecture and still meeting the bridge or bridging the gap between convenience on the one hand and the security on the other hand. That is something that for that period of time, not a lot of products and organizations can claim to deliver to their customers. We also like the technology, so we have our own software product as well. As I said, we are also still tech people, even if we sell green checkboxes. So we have virtual smart card technologies, own smart card technologies, and they all need a proper back end to be integrated and orchestrated with other things. What we have been choosing to integrate these things into is MyID because it is a reliable, robust technology. It is impressing how well they are able to manage a really complex technology and a complex product, which is integrating in so many external systems. That complexity is also the orchestration of the security. It is important to know that security is not just a matter of technology, it is a matter of quality. A matter of quality is going the hard way, going the extra mile. MyID and Intercede has proven to have proper documentation, well-thought solutions to real market problems, and that is what we like and what we believe that Intercede's key strength is. It is not always the largest wins that are the most surprising or impressing ones. Sometimes they are rather small ones. Like one recent was a Swiss military organization where we thought, hmm, well, Switzerland, military, they try to have their own suppliers sitting close to each other. However, we said, it is fitting to what we do. Let us do a good job. What was really impressing and surprising is how straightforward and quick and how perfect the feedback on our offering was. So it was an easy win, although we thought that might be lost time to still offer there. That means we seem to have a good proposal to our customers. Well, I am in this market for more than 25 years. So long. It was always a very slow and small one effectively compared to what the total potential would be. Now in Europe, there is a big change. A full set of new regulative standards came along, including the NIS2 and DORA for the banking or for the financial industry. This is not just yet another set of requirements that are imposed by a regulatory authority. It is a big change to the whole industry, and even the draft of the German law calls it is a turning point in history. Why? Because it is going to drive not just a few organizations to implement security means, it is going to change the overall market to implement and to deliver maturity, and maturity is a key for security and for resilience of our whole society. So the European, or in Europe, the set of standards that already are issued, and they will be amended by further ones coming in the soon future, is really changing almost everything. Because you need to get as an organization, as an affected organization, and you are easily an affected organization, so also us, Cryptas, we are affected by three different means, because one, we are a qualified trust service provider. Second, we are delivering managed services and managed security services as well. And third, we are delivering to a lot of critical infrastructure suppliers, which means we are also indirectly affected. And what we said before with the green check boxes, that is actually what their problems are. The market is not doubling, it is a matter of multiplied by 20 or something like that, what the impact is. So the take-up will take some time. That is what we expect. But it is a complete change to the overall setup. I think if you look into other industries, such kind of maturity implementation phases or however you want to call it, took decades. This is now happening to the IT industry, especially in a really short period of time. I think that is a good opportunity for organizations with proper offers and the proper mindset, and I think we are well-positioned here together. Cryptas is a qualified trust service provider, and we managed to get that highest technical standard in the broad market. So we are delivering in that specific market already today, millions of transactions every day with thousands of digital and/or electronic onboardings on the highest security level that is possible to I think more than 165 nations. What I want to tell, even higher security is possible to be delivered for individuals or for small organizations. What we are planning for the future is to take that technology, which was made for the major leading organizations, be consumable as in trust service, like the qualified trust service for corporate trust service to the markets, where we can offer a full service like we do it today already on a qualified level. That is of course, one aspect where MyID product should be part of it. Back to Matt from Stefan now. Yeah. The one thing I have learned from Stefan is that we always talk about how complex it is. He makes it quite simple. We deliver green tick boxes for our clients, and that is what we do, and that is obviously what Cryptas does. The next session is James Westgate. We need the next slide. James has joined the team Intercede through acquisition. Now he is going to take a completely different view on what we do. Go back to the breach data that we have shown, 25 companies, 22 companies, 9,701 breached unhashed credentials. James will show you what he could do as an ethical hacker to break into your company domains. He clearly will not, but he will show you what a hacker will do, might do, could do in order to utilize the data. This data is widely available. James, over to you. Thank you, Matt. All good with the mic? Yep. Okay. How would I hack into a business? Let us first qualify by what I mean by hack. What I am going to do is get hold of one or more user credentials. I am going to get into your network, and I am going to do things like find your IP. Perhaps I am going to impersonate one or more of your employees, get them to do things like pay invoices, et cetera. I could also install some malware, get more credentials, encrypt your data, et cetera. So hack is a very destructive process. Who am I to say I could do this? Well, I am a design authority here at Intercede on the MFA and PSM products. That is a very technical role, but I am also an ethical hacker, specializing in password cracking. I am a member of the HashMob Pro, password cracking team, and we go to conferences and things like DEF CON, and we will take part in password cracking competitions. Our goal really is to prove that passwords by themselves, especially how we use them, are not very secure. To understand password cracking, let us briefly, and I promise you this is as technical as I will get today, let us discuss how we store those passwords. Typically, if you go to a website such as this, LinkedIn, and you sign up, that site will take that password, but they will not actually store that in plain text. They will store that using something called a hash. A hash is a one-way function, and all you need to know about a hash is if I put the same text into that, no matter what that text is, I am going to get a string of bytes back out, called a hash. It is always going to be the same. So same text in, same hash out. But it is a one-way function. So if I am looking at that hash, I cannot tell you the text that you put into that function. How does this work in practice? You come back to LinkedIn, you enter your username, and you type in your password, and what that site is going to do is they are going to take the password you just entered, they are going to hash it again, and then they are going to compare that hash in the database. If those hashes match, we know you've entered the right password. We don't know what the password is, but we know you've entered the right password. That's a really elegant mechanism, and on the surface of it, that sounds like quite a good implementation. But there are a few problems. The first thing, as Klaas was saying, it turns out these databases get breached all the time. For instance, that one on the screen there, that's mother of all breaches, about January this year. That was a whole lot of breaches, including LinkedIn, some other big companies there. How do these breaches happen? Well, a few things. The first thing is something called a SQL injection attack, and that's really where people are using that front end into the database in ways they shouldn't be to get more data out of that database than just what the front end wants. Quite often, those databases are just misconfigured as well or easy to access. Again, get all the data out of that database. Something we're seeing quite often as well is people, administrators will need to back up, move these databases around, and they'll need somewhere to put a large amount of data. They'll put it somewhere in the cloud. They'll forget about it. They won't protect that resource. Weeks or months later, other people will come across these backups. Finally, you might just have careless or disgruntled employees sharing this data in some way. That's not really a problem, right? Because that password is hashed, and no one can tell what it is. But here's the interesting part. As a hacker, if I take, for instance, just take the most common password. In the U.K. last year, those were the most common passwords, and I have this offline data, and I can use this data as much as I like. I can start hashing those passwords, and I can compare them to the database. You can see here I've chosen a really bad password, password1, and those two hashes match. We say I've cracked the password. That now means that I have credentials to access LinkedIn. I could go into LinkedIn using those credentials. Interestingly, the point I access LinkedIn is the point that that becomes illegal. Up to then, cracking, perfectly legal. As soon as I access that resource, that's where we cross the line. The rest of the things I'm going to talk about today, all illegal, by the way. Wouldn't actually do that. Obviously, I think we can see that the more guesses I have, the more chances I have of finding out what the password is. We could start just by opening up a browser. Anyone can do this. You could drop some plain text into that and generate the hash and compare that manually. Let's say that that's cracking at 10 hashes per minute. But I can install just a little bit of software. Any regular machine, this laptop, would do really well. I could take from 10 per minute to 30 million hashes per second. I can really increase the number of guesses I'm having at that password. And to put that in perspective, that is possible passwords, uppercase, lowercase, special characters, up to five characters in about five minutes. Taking that one step further, here is some hardware I built. Off-the-shelf hardware, anyone can get hold of this. That is actually a Bitcoin mining motherboard, and some gaming graphics cards. It does actually go bang like that sometimes if you are not careful. But really what we are doing now is exponentially cracking at a higher rate. So up to roughly 324 billion hashes per second. So just many, many, many guesses. Again, all of those passwords pass up to eight characters in about six hours on this kind of hash. Taking that to the logical conclusion, fewer nations, you have pretty much unlimited hardware. We think that they could go after any password up to about 11 characters in hours or maybe a small number of days. And how do we work that out? We think that is about 95 raised to the 11th power, so 11 characters. Where does the 95 come from? If you look down at your keyboard, you are setting a password. There are about 95 different characters that you can choose on your keyboard. So that is the heuristic we use there. That is obviously very problematic. So take my hacker hat off for a moment and say, "Okay, well, how can we improve the situation?" Well, actually, types by default are probably not suited to storing passwords. So we can use stronger hashes. So hashes specifically designed to slow hackers like me down, technical terms, bcrypt, Argon2 or scrypt. Then we go all the way back down to about 3,000 hashes per second per one of those GPUs that I showed you. So all the way back down to a very, very small number of guesses. So what you can see here is a bit of a. So actually within the password cracking community, we will eventually crack about 97% of all those passwords with a weak hash if it is a poorly chosen hash. But what is really much more interesting here is that we will also crack 50% of all the passwords with a really strong hash. Is this on? Yep. It does not matter how strong that hash is, those are still the numbers we are going to achieve. You will of course wonder how is it possible to achieve that? Really it is because at this point as hackers, we are going beyond brute force. We are going beyond purely a technical exercise and we are thinking more about human behavior. We know that people tend to share passwords or similar passwords between accounts. So what we are going to do is we are going to take those passwords from the easy-to-crack breach, we are going to take your email, we are going to take those passwords over to the really, really hard hash and we are going to try those against the hard hash. So again, we are back to tens or hundreds of guesses and that is how we get to this number of 15%-20%. So that is interesting, James, but how is this a threat to my business? You noticed when we log into LinkedIn, I am most likely going to use my company email account that is LinkedIn. I am going to enter that password. But we know that we are sharing passwords, so we know your employees are going to be logging into these various sites and it is highly likely they are going to use the same credentials. No matter how good your internal security is, if you are using a password, you do not have any control over the poor implementation of password security outside of your organization. You are going to get compromised because of the password sharing problem. Does this happen in the real world? Absolutely. In the last few months we have seen that this has happened to Microsoft. A nation state has found some kind of exposed endpoint and they have managed to use a breach password, a breach credential and gain access to the email accounts of all the senior executives in Microsoft. This happens all the time. If you read through these articles, the interesting thing that people bring up over and over again is this was a legacy account. It was hacked because it had no MFA. Even an organization like Microsoft have still got the ability to access these endpoints, only using password security. Let us talk briefly about MFA. A good way of explaining MFA is it is multiple factors, but these factors are something you know, so that will be a knowledge factor. Normally a password, but can also be a pattern of some sort. It is going to be something you have. So a device or a token of some type and more recently, something you are. So a biometric, a fingerprint, something like that. We combine these factors together in our authentication process to add multiple checks to make things more secure. Quickly just looking at something you have. We have probably all used our mobile devices for MFA. It is a good option. We can also have dedicated devices. You may have used an RSA token in the past, or you may have a YubiKey. These devices typically look like this. This is a nice one. It has got a fingerprint reader on it as well. Or there might be a smart card, something we are very familiar with at Intercede. That is something you have. How do these work? Typically, if it is your mobile device and you set up MFA on something like LinkedIn know your mobile number. They are going to generate any kind of random code, send it to your mobile device. You should be in control of your number. You are going to get that message. You are going to type that random code back in the website, and that website knows that it is you and not someone else. That is SMS. Something a little bit more complicated, or we can pair your phone cryptographically with the server, establish a secret, and then, typically over 30 seconds or a minute, we will be generating a new code for you. Because there is the shared secret, those codes should match. When we challenge you can enter the code, we can recalculate that, and again, we know it is you, because we established that shared secret, when you were verified. This is attractive because it works offline. You do not need to be able to receive SMSs. Then finally, for your sort of gold standard of MFA, you will have something that is plugged directly into the device that you are actually using to access the resource. Then that determination of you have got that factor happens at the protocol level through some kind of cryptographic process. That is something you have. But we also have the something you are factor, and that's generally biometrics. I call Apple out here because they've really driven biometrics in the consumer space, and made it something that we're all familiar with. Touch ID first came out on iPhone 5. Its first use of fingerprint technology for consumers, followed up with Face ID in 2017. I thought I'd just briefly mention Optic ID, which is brand new, and that's a retina scan-based authentication. It's really interesting. If you're wondering what that is, that's come out in the new Apple Vision Pro. That's a VR headset, if you haven't seen it. What I find really interesting about this is that's scanning your retina whilst you're using the device. So that's something Apple calls spatial computing. But what's interesting here is that you're authenticating inside that device, without even realizing it. There's very little friction there for users. That's important because I'll get back to that later. So that's MFA. Obviously, as a hacker, we're going to want to bypass that. The first example would be, how does one commonly bypass the SMS implementations? What we have here, if you can see on the screen, is a map of the U.K. I've taken a representative mobile phone provider that's 337 stores. But your threat model here is that one either disgruntled employee that will take a bribe or perhaps have been placed there by a criminal gang. All that person has to do is issue a SIM card with your mobile number to anyone who's paying for that. They can now receive those SMS messages. So that's called SIM swap. I had a quick look online, and we could already find that, GBP 68 million in losses in 2021, and I'm sure that number is much higher now. So that's an SMS bypass. Really when we talk about bypassing MFA, when you talk about phishing, the interesting fact here is that as we add more technology to the authentication process and we try to put more technical barriers in the way, as hackers, we're going to step back and say, "Okay, what's the weakest link in this process?" That turns out to be the human being. So instead of hacking the device or the technology, we're just going to hack the human instead. That's basically what phishing is. Some examples here. The first one, I like to call authenticate the scammer. So I'm the scammer. I call you up. I'm trying to get into your bank account. This actually happened with Chase in the U.S. I call you up. I keep you on the phone while my accomplice phones the bank. Now the bank need to verify the accomplice. So the bank sends an in-app alert to me. To the target. Target's on the phone to me. They're going to confirm that MFA request. Doesn't really matter what it is. You let the scammer in. I'm on the phone to you. I say, "Ah, thank you very much. Problem solved." I now have access to your account and probably the first thing I'm going to do is change the phone number or add another mobile device. So without really having to have a high level of technical expertise, I've just bypassed all the technology that's been put in place by the bank. Excuse me. Another variation is a push fatigue attack, and this happened with Uber and an external contractor. Around September 2022, hacking group Lapsus$ obtained some credentials. They already obtained some of those breach password credentials, and they took a VPN external access point. What they did is they just started raising MFA requests over and over again, and those appeared as push requests on that external contractor's device. They probably chose late at night or on a weekend. Eventually what happened was that contractor said, "I just want these messages to go away." They pushed accept, and they authenticated the hackers and the hackers got access to Uber's internal systems and did a lot of damage. Again, just using the technologies that's there, very low-tech attack, and exploiting human behavior. The final attack I'd like to talk about here quickly is person-in-the-middle, you may have heard of that as man-in-the-middle. What we have here is two websites. On the right, we have HSBC, and on the left, we have a site that looks very much like HSBC. It actually functions in exactly the same way, but it's running on hsbdirect.co.uk. Difference being, that's a site I control. This is an actual URL, by the way. It works something like this. I'll phone you up and say, "Hey, there's some problem with your account. A couple of thousand pounds has disappeared and you should do something about it. But don't trust me. Here's a link. Click on this link, and take a look for yourself." You'll go onto the site that I control. You'll enter your username, your password, and I'll replay that onto the actual session. That session will raise the MFA requests, whatever process is in place, and I'll gain access to the bank again. On the site that I'm showing you, I'll just say, "Oh, there's a technical problem. Please come back later." Again, a slightly more technical implementation, but again, I've bypassed the extra mitigations that have been put in place by using a phishing attack. What's the solution here? Taking my hacker hat off again. Really, when we think about MFA, we're assuming that the resource we're accessing and the device we're using to do that is co-located with that factor, being a phone, typically, and those are in the same place. But most of the time, it actually doesn't work like that. A mobile phone network, that phone could be anywhere on that network, and with an app generating codes, that app, again, doesn't have to be co-located. If we use something like smart card or USB, Bluetooth, et cetera, those protocols guarantee that those two devices are in the same place. Even better, what we can do is at a cryptographic level, so at a very technical level, when we set up that credential, we can bind that credential to the domain of that website. That authentication will only ever succeed if you are actually visiting that domain in the browser. What I've just described to you basically is the basis of FIDO and passkeys, which you heard earlier. That goes a long way to solving a lot of these phishing problems. I just want to briefly talk about emerging threats and where I see this landscape going. The first thing is something I like to call malware-based credential theft, and Klaas mentioned this earlier. If you've ever logged into something like Facebook or your LinkedIn account, you've authenticated, but then you've closed the browser and you've gone away and you've come back the next day, you open the browser again, it doesn't ask you to authenticate again. You're already logged in. As long as you're on that particular device, those authentication credentials are stored on that device. That's done for convenience. Generally, that's put into something called a cookie. But as a hacker, that's really, really attractive to me. If I can get you to install any small amounts of malware on your device, I'm going to get all those authentication cookies. Now instead of having to phish you or hack you on each one of those separate sites, I'm just going to scoop up all those cookies and I'm going to gain access to all of those sites. And that site may include your password manager or it may include your Gmail account, your email account. And that's very attractive to me. Why? Because if I control your email account, I can go to any website and click on the forgot password link, and it's going to send me a password reset message to the email account that I now control. That's very, very much something on our radar within the product team. The next one is really interesting. AI-generated content, deepfakes are very relevant and topical. We're probably also familiar with those emails you get from time to time, the so-called Nigerian prince scam, promising you a large amount of money. But generally, they've been pretty easy to spot, right? The grammar hasn't quite been correct. The English language is subtly or sometimes not so subtly, right. But with large language models and AI-generated content, pretty much anyone with a browser can now generate really, really convincing email and really, really convincing copy in that email. And taking that a little step further, start integrating personal details about yourself and write that into these phishing mails, but on an automated basis. Just the last few weeks, we're starting to hear about, for instance, there was a U.K. engineering company, big engineering company, financial controller was contacted, said, "Please get onto a video conference call." They got onto the video conference call, senior leadership team, and the leadership team said, "Please transfer £20 million to this account." The thing being that the people on that call were not actually the senior leadership. They were deepfakes generated in AI. Predicting the future, always a little bit risky, a little bit hard, but I think we can see two ways that we're going to start addressing this. The first thing is we're not going to authenticate you just when you log into your network. We're going to need to authenticate you all the time. So when you are doing anything important, signing onto a video conference, sending an email, we are going to reauthenticate you. That is why I said something like retina scanning, even though that is very early days, where the user has got no impediment to completing that authentication process. A very, very easy process. Once we have that, we can start authenticating you all the time, and there is not going to be a pushback from your user base. The other thing with AI-generated content and deepfakes is we are going to have to start identifying you. Where did that content come from? We are also going to have to start signing the actual content as well. So if that video came from Klaas, I need to know, did that really come from Klaas? Also, can I trust that that content was created by Klaas? To do that, we sign that, and we already know how to do that. To sign things, you need PKI. So that is very promising. We already know how to do that. Again, early days there, but potential avenues for R&D. So last slide, which is good. It is getting very hot. Summarize how would I hack into your business. So I am going to check for those endpoints and users where there is no additional MFA. I am going to use breached credentials. So with Intercede, we have over 8 billion credentials. So that is one credential for everyone on the planet. Bad actors are going to have access to that data as well. So if that is not possible, but maybe the target is slightly higher value, I am going to start looking at your weak MFA credentials, and I am probably going to use some kind of social engineering attack against you. Then when you have got really high assurance, so at the top of that pyramid that Allen was talking about, I am going to just bypass that technology completely. I am going to use some kind of phishing attack using some kind of AI-generated content, faked email, faked voice is becoming more and more common, or perhaps even a fake video. So that is all I have for you. Thank you very much. I believe that is the coffee break. Perfect. Ladies and gentlemen, thank you very much. Rick and Ernie, you can probably work out which one of us is which, but we will leave that there. Just before we kick off, James would like to point out that he absolutely did not disappear and start hacking into any of your systems then. Did not happen. Okay, so we are going to show you some product, but we are going to try and make it a little bit more interesting. We are going to pick three customers and what problem did they have and how they actually used our product. So just picking some sample customers to give you a feeling for our customers. On the left-hand side, government customers, very much driven by regulation. This is just a sample. There is probably over 150 customers in total. But the pattern is they all tend to have something to protect that is either driven by regulation or it is driven by they have got a lot of intellectual property, such as BSF, T-Mobile. They have to protect customer data, patient data, the NHS, for example, or financial transactions. All of our customers have something they need to protect. On the left-hand side, we have government, so very strong in U.S. federal government because there is that regulation saying we absolutely need to know who our people are and who is authenticating to our systems. But also strong outside the U.S., so we have Singapore, we have the U.K., we have the Netherlands, we have the Kuwait government, for example. The second one in there, aerospace and defense, tends to be suppliers into government. As Klaas also mentioned, we have got lots of interesting logos we are not allowed to put on this slide as well, which we would love to, but we just cannot. Then we are into the more finance, healthcare industry. These are more generic sectors where people have realized they have got something to protect. What we are going to do is we are going to pick one of each that represents use of the password security management, multi-factor authentication, and the credential management system, and describe that customer and what they needed. The first one we are going to look at is BeyondTrust. These are a U.S.-based company of 1,500 employees. Got about 20,000 customers around the world, with multiple countries. They provide identity and access security, software consulting systems to multiple end clients, a significant number of them in the finance industry. I will be surprised if you were not a customer of these. At least somebody in probably a customer of these. The problem they had, is that they were concerned that passwords were being used for online work services, but those were also being used for online services. The problem that we have described here before, if your organization does what it can to protect its passwords, if that password is also used for buycheapmobilstuff.com or Marriott or LinkedIn or anybody else, it is probably going to end up online, and they were absolutely right to be concerned about this. This is something that genuinely happens. So they were concerned that data breach was recurring, and their employees were reusing passwords. Bad actors would then take those passwords and try and break into the organization. But they also wanted to try and follow best practice. NIST push out rules on what is best password practice. If as a CISO, if as a CTO, you are following best practice, you are far less likely to get fined or lose your job if you can point back at the standards you are following. Standards, yes, they have a real benefit in terms of saying, "I am secure because I am following these standards." But from an organizational point of view, they also point to the fact that you are taking this seriously and you are doing the right thing. That is the problem they had. What we actually deployed was a combination of access into our password breach database. That is in the cloud. That does not go on the customer site. That is our database that we keep populating. When password breaches happen on the dark web, they go into that password breach database. That is then available to Intercede. It is available to our partners. They can look into that portal and say, "What do the bad actors know about this firm?" Next one down then is the MyID PSM product. This is the software that gets installed on the organization's site, and that will do two things. It will check, are you using good quality passwords? But importantly, it will check they are not actually known to be compromised. I will hand over to my colleague, Jamie, who is actually going to show you what experience the end user had with the product. Hi there. My name is Jamie Smith. I am a solution architect/pre-sales consultant for Intercede. To put that easily, I work with the Stefans and the Caros of this world to protect you from the Jameses. I deal with our customers. I put the solutions together as well for them. A key issue that our customers have is understanding the reality of their position at the moment. Like BeyondTrust, what passwords have been compromised? Where do I need to look? This is where our password security portal comes in. It is handy for that purpose. Another purpose we have is when I work with our partners, our systems integrators. When they are talking to new customers, we can actually use this, and we can say, "Look, this is already known about you. This is what the bad actors know about you." That is a huge bit of kudos you can get that is really popular with them when they go in and they talk to their customers. It just gives that whole range of information. If we can play the first video. I have chosen a company called acme.com, not one of the 23 breached ones in the audience today. But this is an example of the portal. Here we can see the domain and you can see all the different breaches. Each little dot on that line is a breach that that company has been involved in. Data from there has come in. This is good for them to know. We were talking around malware incidents. We are getting a lot of calls these days from companies that had a malware incident, and this will tell you what information has been leaked on that malware incident that is available on the dark web. Very good information. We also can look at the different users. Here we can see a user with the most compromised passwords. It is quite interesting when you actually look at the passwords. You can see the password evolving over time. They may add an extra character. They may put the month or the year in or whatever. All that stuff is guessable. Here we can see not only that user and their password, but also other systems that have also had a password breach. I may be jamiesmith@intercede.com. I may be jamiesmith@playstation.com. If my PlayStation password's been hacked, you can bring that back and you can see that same password is available out there and it's on a Rainbow Table and it's very easy for people to guess. That's our security portal. If you want to have a look, by the way, talk to us and we can run a search for you as well. Come and have a talk and we won't tell anyone. But come and have a talk and we can actually show you the information that's available for different companies that's there. What tends to happen from that is when I talk to customers, they look at that. It moves into what we were talking about earlier, which is an audit stage. That doesn't actually touch the customer's network at all. This is just dark web information. What we can then do is go to Audit, look at what's on their Active Directory, look at their password database, and then securely compare that against our breach database. We can do that on premise as well. Again, this is really good information. You can see not only the breached passwords, but you can see if a password's being shared. You may have an administrator who's giving the same password out to every new user and telling them to change it, and when they don't change it's there. Or you've seen with the Microsoft account, you've got accounts that haven't been used for ages, and you've got passwords in there that have sat there for a long period of time. Here, what is a black box of what passwords are in your organization, we actually put levels of control on it. We do risk analysis of it, and you can have that as an audit. Then we put in our password security manager, set up some corrective measures, run that audit again, and you've got actual demonstrable controls there that your organization is putting in better password security policy. That which is great to all these accreditations. Here if we look at our next video. Here we're going to see a user change their password. This is our portal. We also intercept any password changes, so that could be password changes at Windows logon or whatever. You can see here, the little green lights are coming on when they're ticking the various check boxes that we've set up. This is a very complex password, but it's giving very clear information back to that user, what they have met, what they haven't met in real-time. This stops your IT desk being hassled. There's a little line at the bottom there with the date going across. What you can say is if they've got a 12-character password, that's okay for a month. If they start bringing that to a 16-character, then we can maybe have three months or make it so that that password never expires. Now, never expires sounds really odd, but this is being checked against our password breach database. So if they've got a password that's not known by anybody, why change it? And it's not being repeated in your network. You've got that level of control. Make the actual end user happy. Keep them using that password. And we're looking now at sort of pass phrases. So taking three random words, putting them together, something you remember. It's sufficiently long, it's not been breached, and you've got that level of control. If it does get breached, that again, our MyID PSM is aware of that. So a password that was good yesterday might not be good today. We can automatically make that user change their password online. We could actually hold their account until they actually do a password change. So that level of control takes the BeyondTrust of Found, takes what is a black box of password management within an organization into actually something that you can demonstrably control. Over to you. Thank you, Jamie. So what did BeyondTrust get from that? They're protected against password reuse. If people are reusing passwords, this system will spot that, and it will force them to change that password. They get verification of those real-time, so they don't have to wait 30 days, 60 days, 90 days for that to actually appear. They can tell them straight away. But they're also following best password policy guidelines now. So if they get audited, they can point to the NIST rules and they say, "We've implemented it within the software." But importantly, it gives the users more help as well. So the end users get more help to set better passwords, so it's actually improved the user experience. Second one we're going to look at is multi-factor stronger authentication. So this is at Liverpool Heart and Chest Hospital NHS Foundation Trust. During the pandemic, they started working from many different locations, and they actually found some benefits to that. They found that they could perform better if they let people do things like X-ray reviews, procurement, various business processes from home, from a different location without having to come back to the specific office to do this. Some things you obviously have to do in the building, like heart operations, for example. Lots of other things they could do very efficiently at home. They also had a bring your own device policy, so they didn't issue lots of corporate devices to individuals outside the hospitals. They wanted people to use their own devices. So that was the background. The problem they had is that they started using a VPN, virtual private network. I'm sure lots of us use this. This is secure remote access into the hospital network. It was a horrendous user experience. They had a combination of a device generating a code, a password, and a username, and it just got really, really complicated for people. So security was a barrier. It was getting in the way of them being able to do their jobs on a day-to-day basis. They also it was costly. They forgot the token. They needed to deploy software. They had limited IT resources within the hospital, and when they did have IT resources, they wanted them to be focusing on keeping the hospital systems running, not end-user authentication. So they basically wanted something that was more secure but was much simpler. So we deployed multi-factor authentication solution that worked with the hospital VPN, so they didn't have to change their infrastructure. That working with what's there, important to us. We actually used a pattern grid for authentication, which I will let Jamie Smith explain that. But basically, what we are doing now is as we are authenticating into that VPN, that is handed over to the MyID MFA server, which is making sure that person is, are they who they claim to be before we actually let them log onto the systems. Okay. Next slide, please. Yeah. One of our major problems is we deal with human beings. And human beings do not like remembering things, and they do not like remembering complex numbers, et cetera. But what they do like and what they can do, and I am as guilty as this as anyone, is remember patterns. So what we do is we present a pattern grid, which is, as we see here, a grid of numbers. These numbers are repeating. And the user actually remembers a pattern. So here we are seeing from the diagonal pattern going across. And so the user's code there would be, in this case, 224154. Now, what happens is every time the user logs on, so that would be the website, being the VPN and the NHS side, or even Windows authentication, and this also works over mobile as well, is a random set of numbers come up. So every time they log on, it would be a different one-time code, but it will be from that pattern. One of the great benefits of this for the NHS and what we are seeing as well for MSPs is you can give this out. There is no additional footprint for the end user. You are not giving them, and I like these things, but we are not giving them a $10 smart card. We are not giving them a $40 YubiKey. This is a zero cost device effectively to authenticate in as well and give a one-time password. This is why it has been popular with Riverbird, which we are rolling out at the moment, which as an MSP to their MSPs, actually giving their users this as a second form of authentication as well, without them actually having to deal with that end devices. So just to show that in action, we can play the vid. So yeah, here we have Outlook Web Access. We enter the username, Microsoft recognizes that is part of our domain, brings up the pattern grid. The user can then enters their password. So we are actually having this as an additional factor. You can just have it as the grid, but we are actually having this as an additional level of security. So then they type in, they have remembered their code, which yeah, they remember their code and they enter that. We have a desktop client as well. If you're logging into Windows, for example, again, you can have your password and then you can enter your code, which there, excuse me, would be 114230. If you can guess the pattern from that, you'd be doing very well, because that's an example of how with the repeating numbers, even if you're shoulder surfing, if you signal what they type, you won't be able to guess that pattern. That's a straightforward login to Windows. Very quick demonstration because it's very simple technology, but that is able to be replicated at extremely low cost out to customers. That's pattern grid. Thank you, Jamie. The benefits they got from that, they maintained a strong authentication, but they did that with a much, much simpler user experience. The end user didn't have to carry things around with them. They didn't have to remember things. They also saw a reduction in calls to the help desk. As Jamie mentioned, people tend to remember patterns, and they don't tend to remember long and complex passwords, particularly if they don't use them all the time. The help desk cost went down. It worked with the existing VPN, so they didn't have to swap out any additional technology. It supported that bring your own device environment because this is absolutely zero footprint. You don't have to deploy anything out to the endpoint device. You don't get all of those complex help desk calls coming in saying, "My computer's not working." Final one we're going to look at is the Federal Aviation Administration. This is climbing up the pyramid to the top to PKI at the highest levels of authentication. FAA is part of the Department of Transportation. They're responsible for all civil and space aviation. When the billionaires get on their rockets and they fly over now, it's actually the FAA that's responsible for their safety flying into space. Very safety-focused, over 100,000 people. The problem they had is that they needed to comply with the NIST guidelines. FIPS 201 is the name of the standard. PIV, Personal Identity Verification, is its subtitle. That basically means every single federal government employee, we need to know who they are. We need to have done background checks on them. We need to issue them a highly assured, strong credential. They had to comply with that. They had to comply with identity enrollment, so they had to capture information about the people, biometrics, documents, et cetera, before they could do that, and they had to issue high assurance PKI credentials. You need to do both of those two things, check the person and issue the high assurance credential. If you ask the FAA where are they based, they'll kind of point at that map and say, "We're based there." Every single state, they've got multiple locations, some of them really dispersed. I'm not quite sure why Alaska's dropped down to where it is, but you get the idea. Literally, some of their locations are a very small building with about three people in Alaska. As part of the enrollment process for FIPS 201, you have to see the person face to face to do the enrollment. The last thing they wanted to do is to get them back in the office again whenever they needed to do anything such as collect a card, update a card, solve a problem. They had that hugely dispersed environment they needed to cope with. They also had some enrollment data in place, but not everything. They wanted to add to that data to actually get to the level they needed for FIPS 201, but without throwing everything away. Here we deployed our MyID credential management system. What that did is it took data in from the existing systems, working with what's there is a big thing for us. There's lots of APIs to get data in, pass data out, et cetera. We work with a certificate authority. We work with a card production bureau. These are people, the same sort of people who make your credit cards. Generally here, they are geared up for sending cards out to a physical location, and they can deal with that distribution part, which made it easier for the FAA, so they didn't have to get everybody into a central office. We'll explain how that's secure later. We're also using MyID to capture additional enrollment data, so fingerprints, facial biometrics, documents, et cetera. We put in place a secure self-service activation process, so we could actually get the credentials out to the people in a dispersed environment. Okay. Firstly, I'd like to apologize for the model used in this demonstration you're about to see. Yeah, we're now heading into the realm of this is really smart cards. This is PIV devices. This is the ultra-secure area. Part of this is user onboarding. What we're doing here is we're using our operator client, which is a REST React interface. It's a very simple user interface we'll see in a second, and that just allows the initial collection of the data, but also integration with things like LDAPs or any other data source the customer has for that individual. If we play the vid. Thanks, Mark. Yeah. Here we have it. It's very simple. As I say, REST React. All this functionality can be externally driven. You might have an HR system that actually says, "Jamie's a new starter. I would like a new card for Delsey." Somebody, a human being, will then authorize that request. Here, we're looking for Delsey. I, as an operator, can only see users that I can see, so part of my scope, part of my team. We have some information from Delsey from the Active Directory, but we pull that data in. We have a strong binding here between our data source now and that user, and we've requested a device for Delsey. What's going to happen now is we're going to collect the data for Delsey, and that includes reaching out to things like photographic capture and fingerprint capture using federally approved devices. That's all run from MyID. Yeah, next video, please. Here, imagine me as a registrar. Jamie's sat in front of me, and I'm going to collect his biometric data. I enter some details about him, and you will see this wonderful human being turning up. We just connect to that. We are connecting to an external camera here, and we have this person that is not a federally compliant image. He is smiling. He has got glare. You can see on the right the information here. The system has waited until that is FIPS compliant. It could also be ICAO compliant, which is passport-based civil aviation. Of course, it can be compliant already. There we go. It has collected the image. We are now going to do the fingerprints. This is reaching out to a ten-slap. These are the super expensive readers you see whenever you go into America. It is collecting fingerprints and thumbprints. We are rating those fingerprints. As Alan said, you do not want these people coming back. You want to make sure you have got good ones. There we can see there is one that is not up to standard. We have asked that person to re-register that fingerprint, but that stops them coming back for a second time. Here is an example of just using those devices. There we go. Captures four fingers at once, and then two thumbs. This is all driven from MyID, reaching out to these federally compliant devices. Literally systems that have this up and running register millions of users, part of it, things like transport workers in America, et cetera. We collect that in from various different sites. Then what happens is we have got that data. That gets sent off to a card production bureau, and they produce a card like this. This is something you do not want to give out to anybody. You do not want it intercepted in the mail. This is a secure way for somebody to authorize themselves as a federal officer. What you do is they lock it cryptographically, so if it was ever picked up, intercepted in the mail, nobody could actually access this card. The only thing available to it is the serial number. No data on this card is available. We get that sent to Delsey. How does Delsey authorize? You can see on the left there, it is a single fingerprint reader. This is the nice little cheap fingerprint reader with a card in the slot. We take Delsey's fingerprint. We cannot read it from the card yet, even if we have written it to the card, but we can do it against our server data. We are doing a match on server check here. Is this really Delsey? Is this the card we have issued to Delsey? Yes, it is. We go and check that. We check the minutia of the fingerprints, and then we can say, "Yep, Delsey, what pin do you want for your card?" These cards we are looking at now, you can do things like match on card fingerprint from that moving forward. You can use this in FIPS physical access. You can use this against different area, I would. You can use it against different government offices, et cetera. Here we have got a fully working card, the whole data collection, the whole talking to the federal bridge here, which is the American government standard, PKI. The whole issuance process is to FIPS standards. We know because we helped them produce those standards originally. They have a fully working card. That has been out there working to millions of American federal officers. Thank you, Jamie. FAA, every year they get audited. They have to hit what is called an authority to operate, so they have a security audit every year. MyID helps them comply with that security audit. That is a big part of what they do there. They also get that remote self-service, not just for activation of the card. If they have locked it, if they lost it, they need to replace it. We can enable all that securely by that self-service in those remote locations. Hopefully that gave you a feeling for some of our customers and how they actually use our technologies. I think there is a flip side to this as well. Whilst we hear the side from Cara, I think it is also important to hear the side from our perspective because, as Cara said, Department of State, we were nobody in the market, and we were very grateful that Cara and team chose to bid with us. We were exclusive. Subsequently, we have been non-exclusive, and non-exclusive for a very good reason. Even though initially when we had the conversations, it was not well appreciated because I take a simple view. If there are five primes that are bidding, five system integrators, Guidehouse is one of them. If we are exclusive with Guidehouse and we bid with nobody else, then there are four competitive tenders out there that carry different product. That was initially within Guidehouse. Cara got that very quick, but some of the colleagues were less appreciative because you should be exclusive. We said, "No, understand it from my perspective. We provide the same solution to three or four of the bidders. The client will see is three or four bids that include MyID. There is no argument about who the market leader is in this space. Then the client will make a decision about who they think is the best system integrator. This is where Guidehouse skills come into play. This is where the other system integrate. You play at your strengths. You are good at risk mitigation. You are good at lifting and shifting from a GOTS product, old-style product onto a modern platform. You are good at program management. You are good at national rollout. That is not what we do. We are just a simple software provider. We just hack code together, and we do it pretty well. We deliver the same code. Subsequently, that has been very much accepted that we embed ourselves in multiple bids. One of the ones that Cara was referring to, and I am quite shocked about this because we typically do not declare who the end client is, where Cara is very happy to declare. Even the last one that we announced in December last year, there were two final parties bidding or short selected. Both of them carried MyID. Good for us. So we knew we were in a very good space. We clearly had a preference maybe for the party that might win. That is how we get to the end game. That is how we invest. The difference we see with Guidehouse is more often than not, the software vendors are treated like second or third rate. We are the ones that, just give us your data and we will take care of everything. With Guidehouse, we sit on the same side of the table. We work together. These guys are machines. Believe me, they are machines. Guidehouse is a professional services organization. It is all about utilization. So they work the team during the day, and then 5:00 P.M. onwards, we start with the bid cycle. That is the way it works. They get the billable hours out of the way, and then they start bidding. So we basically are an extended part of their team. We work with the team. We sit there until 10:00, 11:00 at night. We work during the weekends. We set up labs. State was an interesting one. We actually did the demo in our offices. Some of the others we have subsequently won, we had to demonstrate at client site. With no external network capacity or access. So in fact, we have to create our own network. Guidehouse invests a lot of money in hardware and software to basically set up a complete rig, and then we demonstrate together. The number of hours that are burned on these bids are phenomenal from both sides. But because we sit on the same side of the table, we enjoy working with them because we are treated like we are like an extended employee. So that really works well. The other thing that came up, is the point about the exclusivity talk about, how we work together, how we roll out together. We try and be responsive, and that goes back to your point, customer first. We start with a customer. In this case, Cara is my customer, but Cara is also my partner. So I need to look after her. So that is absolutely critical in the work we do. So hopefully with Cara’s input and what we heard earlier on from Stefan at Cryptas. On both sides, Stefan also talks about regulation, NIS2, DORA in continental Europe. In the U.S., it is all about regulation. That is why we build our business. Trying to wrap up, and we are trying to stay on time. So how many minutes have I got left? I have literally got 5 minutes left. So where did we start today? We start talking about the company, how we position, ultimately what we try to do. But today was not just about numbers. Numbers are easily accessible to all of you. Today was all about how do we position in the market? Where do we see the market drivers? What are the problems we are trying to solve? We brought James in as our ethical hacker, said, "Okay, what would somebody who is on the dark side do to access your system?" We have shown you there is a lot of data available collectively about you. Clearly, we will never share individual data, but we thought it was quite good fun to demonstrate that actually we can collect loads of data that is freely available on the dark web. Yes, we know how to get it. We know how to analyze it. We know how to crack passwords very well. We got some interesting rigs, and when these rigs are on, we do not need any heating on in the office. There is lots going on. We have looked at some of the case studies. We talked about BeyondTrust. It is not a cybersecurity company, but it is using our technology. Talked about NHS in the U.K. We talked about the FAA, and then clearly with Cara, we are actively working with the other companies. Hopefully that has given you a good view as to who we are. It is our first CMD. We would love feedback. We tried to put this together in addition to the day role. We are busy, which is good. Lots of people flying around, lots of late nights. Hopefully you found that if we go back to where we started, we started about this pyramid, and we frequently get the question, okay, Klaas, but this is all nice and well. Yes, we know where you started five years ago on the top, and then you built some more functionality, and then you added some more functionality through acquisition. What is happening with this pyramid? Of course, the pyramid is flat faced in this case. Actually, the good news is we all know if we go to Egypt, there are multiple sides to this pyramid. Clearly, what we have been working on over the last couple of years is try to understand, where else can we take Intercede. We have gone from an absolute niche company at the top to being far more broad based. What we are seeing here, the front face of this pyramid is all about employee identity. We do not do consumer, we do not do machine. This is employee identity. What have we done over the last couple of years? Also from an M&A perspective, where are we looking around? I cannot tell you which companies, of course, we are looking at, but I can tell you roughly the kind of things we are looking at. If this phase is about employee identity, we clearly have a lot of skills and knowledge here about how to manage certificates, how to manage credentials. That is not too far away from what we call non-person entity. That is about machine. With machines, I need to be clear, we are talking about routers, we are talking about servers. We talk about Wi-Fi access points. That is kind of interesting. We are starting to look at that. U.S., whole new security paradigm with zero trust. Mr. Biden has said, "Look, as U.S. federal government, we need to become far more secure in what we do." Zero trust is a really broad spectrum of things. The good news is there are multiple pillars within zero trust. Pillar number one is employee identity. Well, actually I know a company that does employee identity very well. But we are starting to look at the other pillars of zero trust and say, "Is there anything we can buy? Is there anything we can partner with? Is there anything we can build?" So again, potentially a different side. Again, if I was able to twist that pyramid one more time, I talked about can we access different markets? We have always been in the top end. I always say we are a tin pot outfit based out of Lutterworth. A lot of people think Lutterworth is really interesting, but it is junction 20 on the M1. But we have got a client base to die for. When we say small company, you look at that client list, Caros lifted the lid off some of the other ones that are not even highlighted on our website, but we are capable of doing real good business with some really high profile clients. But that is one side of the business. I think there is another side of the business, which is the one I referred to earlier on, is in Germany, we are working with this company called Riverbird. They have actually re-skinned our MFA solution. They call it TwinVerify, and they are offering TwinVerify into the SMB market. SMB market, you think, well, five users, eight users, 10 users, 12 users. That is not our core business. No, but I like the licenses because if they come in volume, it starts adding up. It is all subscription-based. So, we are now starting to pursue different market segments. We got the partner in Germany. I know Siobhan has had dialogue with a partner here in the U.K. So we are looking at different sides of this pyramid. So coming back to the growth story, the growth story is all about what can we drive organically with what we have got? What can we drive inorganically? And just to be clear, I do not see ourselves, and I repeat, I do not see ourselves as a buy and build. I see ourselves as a company that will grow organically, double digit, and as and when we can, and as and when we find the right kind of target like we did with Authlogics, we will absolutely do that. We got more cash in the bank, as Nitil said, so we can probably look a little bit bigger than we did two or three years ago, but that is a really interesting play. So then coming back to the business case. What do we see as the investment case? Hopefully we can at least agree that we provide business critical software in an interesting market. The cybersecurity market is really interesting. It is growing a good double digit speed. We have a scalable business model. Our costs are very much covered by our recurring revenue. And if we look at our repeatable revenue, we know that if we sell licenses, it is highly accretive as we have shown over the last couple of years. Our operating model is clear. We are a software company. We know how to target the market. Tier 1 client base. I do not think anybody can argue about who we have as clients and whether that is credible. And as Allen has said earlier on, there are many clients we cannot put on there simply because we are not allowed to. Whether our partners do, that is up to them, but we are quite cautious. But again, in the U.S., here in the U.K. as well, we do increasingly more work in the U.K., but again, we cannot talk about it. The other interesting thing is net promoter score. Again, coming back to these business principles, customer first, our net promoter score is 55, zero. For a software company, 50 is a pretty good net promoter score. I would like to push it a little bit higher, I would like to get in the 60s, but net promoter score is ruthless. You find a few more detractors and suddenly your score will tank. I think as a management team, I think we are reasonably credible. We have proven over the last couple of years that from what originally was a turnaround business is now a business that is motoring very nicely. We are showing good growth. We talked about this inorganic versus organic, but the starting point is organic. Market wise, we think we are market leader. We believe we are market leader. It is not just us. Companies like partners like Guidehouse, they assessed the market earlier on when they chose 2019 to approach us. They were of course talking to other parties, but it is not just the partners, it is the clients who are choosing this technology. It is the clients who are choosing to stay on platform for 10, 15, 20 years. Our longest serving client, I think is in the U.K., is either 21 or 22 years now, and it is a bank. Competitive advantage, we know and feel we can expand that moat. We can really defend it well. Our attrition is extremely low. Our attrition is below 2.5% in terms of revenue. We hardly lose any clients. We talk about that pyramid, not just the front face of the pyramid, but also the multi-dimensions of that pyramid, which allows us to grow that target account market, not just from a product perspective, from a geography, but also go to market. We will continue to invest in that distribution model, in that reseller model. We have a relatively small sales team, but we can actually work with our partners. We have one of our channel managers currently in Oman. He is based out here in the U.K. Madge is probably spending two weeks a month nearly in the Middle East out there. I was in Dubai a couple of weeks ago, at GISEC, one of the largest cybersecurity shows. We get very good interest. Of course, in the market, we love regulation. Regulation is good for us. Regulation in the U.S. has established our business. We now see regulation taking whole foothold in continental Europe, and we are chasing that business with partners like Cryptas, but also the whole Riverbird conversation with TwinVerify, that is again, driving companies particularly in continental Europe who have to do something, they have to start using MFA. So, we are on that bandwagon. Finally, financials. We have had a couple of very good years. Our KPIs are growing quite nicely. Really good cash flow generation. We have more cash in the bank than we have ever had. I go back to 2018 when we were nearly out of cash, and it was a very different story with nearly a GBP 5 million convertible hanging out there, which we retired early, and since then, we have been growing the cash pile. Debt-free, clean balance sheets, good profitability. Talked about the attrition. We see very little attrition. This is pretty sticky stuff. Once a customer is on platform, they will stay on platform. We are trading, pretty solidly, and we have seen some good share price momentum over definitely the last 12 months. We think there is significant growth for us in the market. We are working hard. I cannot control the share price. I always say to the team, the only thing we can control is how we respond as a company. Nose to the grindstone. We will do what we do well, and we will hang on to the coattails of our partners, whether that is in the U.S. or anywhere else, and we continue to drive that out. I think that concludes the day, and I think I am six minutes over. No problem at all, Klaas. Thank you very much indeed to Allen, Jamie, and Cara. Ladies and gentlemen, we are about to take some questions, so if you could just raise your hand, I will pass you the microphone, and then perhaps you can hand it out to Klaas where it is appropriate to do so. Hi. Thanks for that. It is Bob Liao at Zeus. I just wanted to ask a question on competition and just one finance question. On the competition, just if you could provide a bit more insight into who you mostly see in the market and when you talk about how competitive you are and confidence in your moat, what are the key sort of strengths you have against those particular competitors? Secondly, on the financials, talk a lot about scalability in the software model. Maybe just a little bit more insight into how scalable it is from an operational gearing perspective and what sort of drop through you might get in terms of revenues over the next couple of years, and where margins might get to in that situation. Okay. Let us start with question number one. Okay. On the competitive side, it depends on the product set. On the credential management system, I genuinely believe we have got the best product on the market. We do see others. We see some people have been combined into a PKI. Nexus, for example. ActivIdentity used to do some. XTec used to be a competitor, but seems to be losing everything at the moment. On the CMS one, I think we are in a very strong position. As we move down the pyramid, MFA is much more competitive. There are some very large players in that space. Okta, Ping Identity, Microsoft themselves, RSA, Thales, et cetera. The key there is not to fight them. The key is to try and differentiate from them and have that mid-market product in that MFA size. Also, bringing FIDO into the product allows us to bring that higher assurance into that space. On the password security management, really the area there is, and probably sums up what we got told by an opportunity recently, which is, "I love the security that you guys bring. What can you do for the rest of the passwords in the organization?" That is where we are looking at coming into competition with more people like Specops, Dashlane, people like that, who have enterprise password style management solutions. Combining the security management with the enterprise password management, but also bringing that in with the MFA so we have got more of that larger set of capabilities for the mid-market and for the large opportunities with the It is working with the likes of Microsoft, Okta, Ping. How do we add value to those on the CMS side? More than happy to have a longer conversation. There is a lot I could go into there, but I think we are very familiar with our competition. Nitil, you want to take? Thanks. Thanks, Bob. Operating gearing is that we are roughly, Klaas mentioned we did 17 employees last year. We have five or six forecasted for FY 2025. We do not see that growing too much. The variable in that operating is now sales commission. As our sales increase, we will see that, as we have said, is that the licensing for us is highly accretive and it feeds very nicely down to the bottom line. I think one of the graphs we showed you was that two or three years ago, we were forecasting GBP 1 million about now, and then growth was going at 10%, and that was feeding through at about GBP 1.3, GBP 1.4. We now shifted that to GBP 3 million, GBP 3.2, GBP 3.5 going forward. The reason for that is because, again, as we sell the licenses, our recurring income from our support and maintenance is continuing to grow because that is a 20% feed from that license sale. Also because our new product is brought out, every version is every quarter. As our clients upgrade, they are using more of our repeatable professional services, and that is growing, and that is now covering 90%-95% of our operating expenses going forward. Thank you. Thank you. It is Kai from Canaccord. Just had a quick question on the U.S. market, I guess at the federal level. Have you had a guess at your market share in the software, obviously ID space? Is it 10%? Is it 50%? Just wondering, and where do you think that can get to? Then I guess linked into that is, how about the state level? Is that interesting to you? It is obviously a lot less seats and licenses, but presumably it is also a pretty sizable market. Just wondering how you are thinking about those two. Okay. On the first question, particularly on the CMS side, which is the U.S. business, there is no active market data available, so I can't go to a Gartner or an Ovum to get market data. There is plenty of scope in that market for licenses for us, as we've shown over the last couple of years. I don't know, Allen, you want to have a guess? 2025 will be my gut feel that we have at the moment with some of the recent wins. I- I'm guessing. The data's just not there. I think there is a lot of space for us to grow into. Your second question, state local, absolutely. As I explained, they, and as you well know, they tend to be smaller. They may not want to buy a PKI solution on its own, but we have partners who offer fully managed services. A company like WidePoint in the U.S., NASDAQ-listed, they offer a fully wrapped service, so that's actually quite good for the smaller opportunities. We're also talking to a very large distributor in the U.S. who's got a very strong foothold in state and local, SLED, or state local education. I've taken up the lingo. We definitely can see a lot of opportunity for growth and that's the CMS side, but also because we've uplifted the MFA product into the cryptographic side with passkeys, FIDO, we can see real good opportunity now going forward. We've lifted the functionality in the product. We've got a much wider market to sell into. Thank you. Hi, it's Andy from Cavendish. When you, I'm not sure if this is for Allen or Klaas, but when you are talking about your tech roadmap, certainly at the high level for PKI, it's in the CMS environment, and you're dealing with such large clients, how do you make sure that you stay pure to your tech roadmap for the greater good of all clients, as opposed to being bullied by the enormous individuals who you're trying to serve perfectly? We have a very good answer to that, is every year we now running client advisory boards. All our clients in the U.S. are invited. The partners are invited as well. There is generally a trend of areas they want to explore, and I'm sure Allen can jump in here. We're not being bullied by a single client. As Nicole has explained, if a client wants to bring forward functionality that's on our roadmap, we're perfectly fine with it, but then you pay. Yeah. But we retain the IP. So maybe that's the only way they can accelerate something. But other than that, our roadmaps are now published. We release software every quarter, which is very different from five years ago, six years ago. We had one release maybe every 12, 18 months. Now, we're on a quarterly cadence. But you want to add anything to? Yeah. What we find is our customers have common problems. Not just within U.S. federal government, but even from outside that space. The customer advisory board, you see the customers talking to each other, and that's really, really valuable for them, but it's also valuable for us because we get feedback on what's important to them. We then tend to put that on the roadmap and we put it back into the product. We put FIDO in the product. You could say that was before customers actually needed it, but some of the very large customers, they're looking 5 or 10 years ahead, and they want to know that you're looking at post-quantum, you're looking at AI, you're looking at FIDO, you're looking at mobile driving license, because they're going to be there in 5, 6 years' time, and they aren't getting that from their current vendor. I have to say, it's not been a problem, and we've generally found the more we speak to customers, the more common problems we find and the more common solutions we can bring. Thanks. A further question is how much can you rely on other people's tech, like face scanning on iPhones? I can actually open my dad's iPhone. Apparently, 1 in 400 faces can open a different iPhone. Is that something that you have to insure yourselves against, or is this something where you know you're just never going to rely on that kind of third-party tech? It comes down to how secure do you want to be. Not all customers need to be at the highest levels of assurance. If we're talking federal government, they will be using PIV-compliant biometrics. There are rules about what level of assurance do you need to get to. They wouldn't necessarily be allowed to use the Face ID on their iPhone at the high level of assurance. If they're protecting lower assurance assets, they may be able to. We've always been in the realms of trying to explain to our customers, these are the various options you've got, how secure do you want to be, as opposed to dictating to them, you should be at this level. Because our customers are generally quite educated, and they'll make their own choices. But that technology independence is very important to us. Again, we don't just rely on one particular technology. So, the national ID of Kuwait, for example, we issued about 4 million smart cards. They then went mobile. We've issued about 2.5 million mobiles. Initially, they were exactly as you were saying there. Do I trust Face ID? I don't know. They were comfortable with fingerprint. So the way we configured it is, well, you can, as a customer, you can enforce a PIN, or you can allow it to use a fingerprint, or you can allow it to use Face ID, but it's your choice, customer. How secure do you want to be? So that's very much the strategy we've been following. Bruce, did you have a question? No question. Oh, okay. Good. Eric. Thank you. Just a couple of MFA questions. I was wondering if you could just expand, you talked about trying to not go directly against some larger competition. I was wondering if you could just expand on that. Also from a sort of go-to-market perspective, are those competitions or are those competitors or can you still go direct to those, whereas you can quite clearly access the sort of federal government, U.S., indirectly. Does that sort of indirect model lend itself to the sort of MFA market as well and the different customers that you're trying to access within that? If you take the first one, I'll take the second one. Sure. Most of our very large customers have invested very heavily in an identity and access management solution, and that's typically around Microsoft or Okta or something of that. It does more than the authentication. It does not just is it really Sam, but what can Sam do and what are the rules around it, et cetera. So when we issue PKI credentials with Guidehouse, for example, often those customers are using them to access Microsoft-protected environments. So working with those big players is very important to us. So we wouldn't try and take those head on. But as you move down to the mid-market, particularly in Europe around the NIS2 legislation, those systems are very expensive and they're very complex to deploy and manage. We think there's a gap in the market for something like an Okta Lite for the midsize market, which doesn't really exist at the moment. So that's very much we're playing things change over time. But as it stands today, we're very much working with I was in Redmond with Microsoft 2 weeks ago, looking at how we can work with them on deploying MFA solutions in their environment and work with them. So we're very much looking at how do we work with them. On the more down the mid-market size, it's a different play. We think, yes, we can compete directly there. So distribution, your second question, we very much see distribution for that mid-market. We cannot build a sales team that will cover that entire mid-market. Siobhan and her team, as I said, Madge, one of our Channel Managers, is in Oman at the moment. They are working that channel and distribution very hard. And what we acquired with Authlogics is real good, strong distribution. So we have two very strong distributors, AmiViz and Shifra, and they are both pushing our solution set out in that market. And in the same way as we are now using in the German market, again, the MSPs to get to the market, because don't forget, again, if you look at that pyramid, the way it works is the MSPs have access to the resellers, and the resellers have access to the clients. It would be impossible for us to work with all small individual resellers. We focus on those who have got access to the market, and that model works. It works on the high end because we need the credibility. We need the credibility from the system integrator to help that client migrate from legacy platform onto state, modern state platform like MyID CMS. And that works really well, but it works in that middle market as well. In that middle market distribution, as Siobhan has walked those corridors for years. If you look at the Boscos, you look at the HIDs, their route to market is through distribution and channel, and we are following exactly the same. And clearly, what we have now is we started with that journey five, six years ago, so we have been building our credibility up with reseller channel distribution, bringing Authlogics on board. We can utilize the existing relationships. I know Cara has got conversations within her client base about password security management. If we think that state doesn't use any passwords, believe me, I can show you. I can show you in our PSM, there are an awful lot of passwords being used. But a lot of this is about timing. We need to find the right timing. We need to find the right vehicle. We need to find the right partner to work with. So hopefully that answers your question. So Mike from Equity Development, do you see RFC 8784 as a guideline or a proto-regulation towards symmetric key authentication? And secondly, when that cat in the screen looking at the mouse, when do you wake up one day and find out it has become a quantum cat, you have got to think about what it might do. Absolutely something our customers are looking at. The quantum piece, particularly, a lot of our U.S. federal government customers are at the absolute cutting edge of security. Nation-sponsored states will be trying to break into their systems. Quantum is what they're looking at. We very much never tried to write our own cryptography. We always use NIST-approved cryptography. We're working with hardware security manufacturers. We're working with the smart card device manufacturers ahead of that to look at post-quantum and where that's going and incorporating that into our own product. My personal view, I think authentication is less of a risk for quantum resistance because as we've done beforehand, we're quite crypto agile. You can just roll out new crypto technologies into the product and move forward. We move from RSA to ECC, move from triple DES to AES. We've done that before. I think it's likely to be more of a problem for stored encryption, so archived emails that are there for a long time, and you can't really easily go back and change the encryption on that without a huge key management overhead. I think that's more of a challenge. The other interesting attack I've seen is potentially trying to attack signing certificates for installing software. If you could fake Microsoft certificate and you can install some malware and everybody thinks it's Microsoft, that's the bigger attack. Yes, we're absolutely watching it. Yes, our customers are asking about it. From an authentication perspective, I think it's less of an issue. I think we've probably got a bit more time. Great. Thank you. Any more? There are questions on the platform, but I thought we'll deal with the questions in the room first before we go to IMC. I don't know if there's any more questions here. Any more questions from the room? Is it? Perfect. I timed it, the good role of reading the questions, and then I can try and dish them out as we see fit. What is your appetite for further acquisitions? This is a question from Samuel. I think what we have tried to explain through the presentation, we started our acquisition journey three years ago. We got a full-time Head of Corporate Development in-house, somebody who is really experienced. We are definitely on the acquisition trail. We will only do acquisitions as and when we think it is the right fit. Before Authlogics, we had one that we walked away from. Yes, it is expensive because you are paying lawyers' fees, but it is far cheaper to walk away at that point than end up with the wrong acquisition. In total, we have walked away from three, where we have started DD, and then suddenly what you find when you are on the inside, it does not look as pretty as when you were originally looking or even indeed, what was sold to you. We recently had our company kickoff in April, and I said I compared it to looking at the kitchen. I look at my kitchen, and at least I know what is in my kitchen. I love looking at somebody else's kitchen. But we kiss a lot of frogs when we engage with potential acquisition parties. I tend to come back to my own kitchen sink. Yeah, at least I know what is in it and I know what it looks like. We are very cautious, as Nitil said as well, but we are not afraid to invest. Definitely acquisition is on the roadmap. There is a bit of glare on the screen here. This is one for you, Alan. How is AI impacting your business? The major thing we are seeing is phishing attacks using AI. I will give you an example. I personally got one. I am a member of a rowing club, and I got an email. Well, actually, no, the secretary of our rowing club got an email saying, "Hey, Natalie. Stewart's contacted me and they have said we need to pay this invoice by tomorrow or we are going to get fined." She sent it to me and said, "Is this legitimate?" I looked at it and went, "No, but it is really impressive." This AI engine had gone there. It had gathered information from the websites, populated a really credible-looking email in a really nice PDF form, and sent it on. I looked at it and thought, I would not have looked at that and thought, this is fake. We are absolutely seeing AI being used to generate more realistic phishing campaigns, more realistic websites, bringing in real-world content about the person it is sending to. It is spear phishing. It is a direct attack on somebody. There is no human being doing that. They are just putting the rules in, and the AI is doing it for you. More and more people fall for it. It is really hard to spot them these days. That is on the attack side. Which is good for us because that drives people towards more phishing-resistant authentication, such as PKI and FIDO. We are also starting it soon to be used in terms of cyber defense as well. Starting to look at behavior, starting to look at risk analysis, starting to look at things like Sam authenticated ten minutes ago, but now he is authenticating again, and that is an impossible travel situation. If you look into what Gartner call shared signals, one of the big trends in the industry is lots of systems sharing security information between them to make better security decisions, and that is going to need AI in there to do that. Again, we are starting to look at how do we start incorporating that into our technology. It is both a threat and an opportunity. What Alan didn't say with regards to the rowing club, Alan is from Yorkshire, so that bill would never have been paid anyway. That's not true, actually. I'm seven-eighths Yorkshire, one-eighth Scottish. Well. You can figure that one for yourselves. Then we're definitely confirmed. What size of opportunity do you see in the U.K. and E.U. digital ID space driven by regulatory changes? Question from David B. I think go back to Stefan's presentation, who clearly indicated there's a step change within the E.U. and regulation with regards to NIS2 and DORA. It's not just a 1x or a 2x change. It is a multiplier change in the market. We're jointly pursuing that. Stefan within Cryptas, he's got huge credibility, again, in that very high end, and that's exactly what we're saying. Because we're credible on the top end of the pyramid, nobody's asking us for referenceability. We're credible as a company because of the client base we have. So if it's credible on the top end, it's definitely credible on that middle end. I think Stefan gave the answer. It's a force multiplier that we see in the market changing. Regulation in the U.S. has been phenomenal for us. If we see the same regulatory impact in continental Europe, that could actually be really good for the business, not just for Intercede, but also the partners we work with, because they typically bring their own IP to the market. I think that's the last question that's out there. That is correct. Thank you very much indeed. I do not know, Klaas, whether you have got any closing comments, and if not, I will redirect investors to give you some feedback online. Yeah, it has been great to see you all here. It has been great to prepare for this. As I said in the beginning, this is our first CMD. We want to learn. We would love your feedback. I know that Tim and team will be on you for your feedback. That is not just about Intercede itself, but we also love your feedback on the content of the material that we are presenting. Appreciate it. It is two and a half, three hours of your time. You have all traveled in, so very much appreciated. We know there are existing investors in the room, there are potential investors. So we are always available. Again, through Tim and the team, we are always happy to jump on a call, or respond accordingly. So on that note, we have some drinks next door if you want to hang around. Really appreciate your time. So thank you for coming. Thank you. Thank you. Klaas, Nitil, Alan, James, Jamie, Cara, thank you very much indeed. If I may just ask investors to close the session, we will now redirect you to provide your feedback. Good afternoon to you all.

Data Source: Quartr Last updated: Oct 12, 2026

Earnings call transcripts are provided by Quartr and are published within hours after each earnings call.

Update frequency:

Quarterly

Data Sources Report a data error