A warm welcome, everybody, to F-Secure's Quarter One Interim Results Session, both here in the room as well as everybody else who are attending the session online. Straight into a summary of the quarter. Our revenue grew by 2% still during Quarter One. The US dollar exchange rate was clearly favorable. Towards the end of March, that started changing, and naturally, we've seen in April that it's been quite different from what we've been experiencing in the past couple of years as dollar has been weakening. With regards to Quarter One, it was still favorable to us as we're a very heavily euro-focused company. Profitability exceeded our expectations. That was good. We forged new partnerships, one partnership in the Nordics, which is completely new, and then in Central Europe, Orange, that I'll talk a bit more about later.
We had a small number of partners who enhanced their contracts. Typically, our contracts are in the range of three to five years, and those came up for renewal, and they renewed, and not only renewed, they expanded the scope with F-Secure. In terms of Quarter One and embedded, clear developments once again on AI-powered scam detection specifically, more about that a bit later. Our new organization is now in place. At the end of 2024, we ran change negotiations to go for a more customer-centric operational model and organizational structure. That is now in place and fully operational. I would say that with regards to AI, we have gone forward in leaps and bounds in Quarter One all across the company in every single function, in practically everything we do.
Like many companies, we are still in the early phase of thorough AI-native solutions and processes across the company, but we have really made excellent strides in the first quarter. That is just a quick snapshot. I will then dig into a bit more detail. These are the main themes that we are focusing on with regards to our strategy in 2025. First of all, we want to continue to transform as a company to accelerate our growth. Secondly, we definitely want to claim a leadership position in scam protection. Thirdly, we are driving innovation and also productivity and quality gains through use of data and AI. If I start from the left, there is a whole number of big names there. Some of them we serve today. Many of them we do not yet serve.
That's, in a way, our hit list of who we are after in terms of transformative growth. These are the primary targets that we're going for, and we see that every single one of them, as we mentioned before, should have the potential of generating EUR 8 million per year or more once fully operational, which may take a few years from launch or which may come faster in case they migrate existing user bases to F-Secure protection solutions. That's crucial. Secondly, I joined F-Secure 12 years ago, and at that time, and already before that for some 10 years or so, the big thing in consumer cybersecurity was all about antivirus. Since then, we've had some pockets of the consumer security market that have been growing, like VPN solutions, password management solutions, router security, and so forth.
Now we see that with scam protection, for the first time, we're seeing a massive new development that is presenting itself as a market opportunity to all of the players. Top of mind for consumers, something that people are experiencing practically every day. The awareness of the need for something like scam protection is now much more pronounced than it was before. Also, in terms of the threat landscape out there, this technological landscape, the criminal activity and the protections needed for scam protection are also evolving at a fast pace. When you want to go after growth, a new, let's say, potentially significant space is a good one to be in. That's why we're aiming for number one position over there. Finally, AI and data-powered F-Secure, that's what we are envisioning.
I'll talk a bit more about that later, but I can only say that I've been in technology business for quite some time, and I have never seen anything develop at the same pace as I'm seeing AI develop right now. The fundamental technologies, their capabilities, their scalability, the kind of, in a way, how far you can go in terms of AI power, just in six months, it's gone forward at a breakneck speed. We intend to lead with AI, not adapt to AI. First of all, about transforming to accelerate our growth. During this quarter, as you can see on the left there, we had three partners going fully commercially live with our services. SoftBank, with a service where identity protection from F-Secure forms part of the solution.
AT&T went out with ActiveArmor 2.0, which is the next generation version of their ActiveArmor application that we developed for them. Thirdly, Anonymous Partner, who has gone out with an identity protection service now in Quarter One. These two services, AT&T ActiveArmor and the identity protection service launch, they haven't been yet as actively promoted by our service provider partners as we would want to see, but we are working actively with them to make sure that they also put their body behind these new services. On the new partnership front, we signed up as we sent out a release some five days ago. We signed up Orange Group, and they have roughly, or precisely, three different geographies that they serve: Orange Europe, France, and Middle East and Africa.
For the first, the European operating companies, seven or eight of them, are very keen to start rolling out F-Secure services. In this case, it is a strategic partner who's working with Total, not with embedded security at this point in time. Embedded security is something which may be an expansion in the future. One has to keep in mind that if you want to provide a holistic solution to consumers, Total secures laptops and mobile devices, whereas embedded serves only mobile devices. Orange has decided to go for the most holistic solution to begin with and potentially complement that with embedded in the future, remains to be seen. Massive Group, absolutely one of the top ones in Europe, and this is the first group-wide contract that we now have with a strategic partner or tier one partner. Big step for us.
Around end of quarter three is when we expect the first country or countries from Orange Group to go live with Total. The second area of our focus areas in 2025 is scam protection. Beginning of the year, we launched something we call Scam Kill Chain, which is a framework which has been used in enterprise security already for quite some time to analyze the criminal behavior and the steps they take in their attacks. We have now transposed this methodology to cover how criminals are attacking consumers. How do they go about the kill chain? What kind of steps do they go through to create trust and to get people to fall for scams? How does the scam then become a reality? How are they going after typically your money?
We have now created a methodical framework for understanding how these attacks happen so that we can then come up with the industry's best detection and protection capabilities to stop scams. Secondly, we won the coveted AV-TEST Award once again, which is naturally proof to the fact that our product does what it says on the tin. It does protect, and it does so very effectively. With regards to our SMS scam protection, in Quarter One, roughly 450,000 messaging scams were prevented, with over 10,000 in some of the peak days of messages that were blocked. This is a real threat happening out there, and this is a real protection against those threats.
With regards to the enterprise security world, the holy book of enterprise security in terms of data breaches and what is going on in terms of criminal activity in the cyberspace is the Verizon Data Breach Investigations Report. Our research for the first time contributed to this very prestigious report. Finally, in terms of embedded security, we have developed new capabilities, especially to stop crypto mining activities so we can both identify and block malicious crypto-jacking activities, which are very common now in North America comparatively with other regions, but not only there. Especially in North America, where we are actually working naturally actively to expand our footprint, this has been very much in demand. That is just one example of what we have added now in Quarter One. Here is the award for AV-TEST, Best Protection.
Here is the Data Breach Report coming from Verizon. With regards to utilizing data and AI, over 25% of our workforce are already using Claude, which is our choice over ChatGPT as the standard tool. Over 25% of our workforce are already using it daily in their work. At a staggering 20-25% growth weekly, we are seeing the usage growing from its current level. We are building in every single new protection capability that we are coming out with. There is an AI engine underneath, and that is going to be not only the case for protecting our customers, but we are also seeing in our engineering and technology that we are using AI now to enhance the entire software lifecycle, speeding up deployment, improving quality.
For example, one of our new deliverables that we created during the first quarter, the whole quality process was run end-to-end using AI tools, faster and reliably. This is definitely something that not only has to do with protection, but also our capability to run a more agile and nimble organization. Overall operational efficiency, we are busy reimagining our customer care function powered by AI. Also with regards to our people and culture, we already have tools that we have been developing for career planning and hiring, which are fully AI-powered. Many of our functions, our legal has been running AI services for a long time already. Our marketing is generating deliverables, videos, content, campaigns based on AI already today since the end of last year.
Boosting efficiency, service quality, innovation, and naturally also eliminating some mundane tasks that we all have in our work. This is taking on, I would say, like a wildfire right now. That's all from me. I will now hand over to Sari Somerkallio, our Chief Financial Officer.
Thank you. Good afternoon to everybody. Let's look into the numbers and start with the new slide. Happy to show you something that we have not had before. Starting with the partner channel revenue, we have now split the revenue into embedded and security. In our strategy, we talk about these. We refer even to the profitability of these. Earlier, we have not quantified the size of the business.
What we have here in embedded, I think from our references, you know AT&T and Docomo have embedded services and sense businesses in there, and then a number of smaller partners. Just to get a picture of what we have in there. If we start with the security suite, growth of 2.9%, this is like an okay number considering that we still have this in Germany. There is a customer who is clearly showing negative numbers and which is in hundreds of thousands the size in this one quarter only. The trend continues that we've seen already in the past. There are many positives in security suite. Total conversion continues to develop nicely, and thus the ARPU is increasing in that channel. Poland, which has been negative for years, all this time that I've worked in the company, we have talked about challenges there.
This was the first quarter that it was clearly positive after a couple of flattish quarters. Switzerland was positive in this month, and in the Nordics, especially Sweden, continues a very nice development. On the embedded side, we have mentioned in several places in the report this EUR 300,000 one-off correcting an earlier revenue recognition mistake. On the group level, annual level, EUR 300,000 is not a lot, but in the one quarter embedded numbers and in the Japan numbers, it is a significant one. That is why we have highlighted it. Even if now embedded is minus 0.3%, without this mistake, it would be positive 5.4%. Of course, it is important for us that this continues to grow.
Also in Japan, where we have said that we have historically had a good performance, that underlying good performance continues, even though due to this mistake, it is not visible. If we look at the direct channel revenue, it is slightly positive, which is good considering that we have continued this strategy of not doing any paid customer acquisition. The positive development is mainly thanks to previous better quarters. In general, we can say that ARPU is growing. Renewal rates are high, so there is good development, but with this strategy, new customer acquisition, even if we have assumed that it is not going to be great, that is the area where we hope that we can still improve. Considering the strategy and the result is okay.
Looking at the full revenue, we have the 2% growth, like Timo said, helped by FX. Underlying is plus half a percent. Considering that it would have been better without the EUR 300,000 correction. In the geographies, like mentioned, Nordic countries is already on this mid-single digit rate, which is the target for us this year. Sweden is a driver there. Rest of Europe is burdened by this development in Germany, and others are then much more positive. North America supported by dollar in this quarter. If the world continues like it is today, it will turn the other way around in the following quarters. Rest of the world, again, burdened by the correction, otherwise continuing on good track. Looking at the cost side, OpEx is slightly lower than corresponding quarter last year.
This is thanks to the change negotiations. We got savings in this area. Overall, during the change negotiations, we said that there will not be savings because we are reinvesting, but there is a slight timing difference. We have been filling the new positions during the quarter, so not like full load yet in the first quarter. The CAPEX level was a little bit lower in this quarter than last year at the same time, but overall, our guidance remains that similar levels of CapEx on full year level can be expected, even if the Q1 level was similar. In terms of profitability, gross margin, similar ballpark as last year during this time. No big changes as there has not been any major changes in the business mix of what kind of products we have been selling.
The overall profitability then in terms of adjusted EBITDA, it is higher than last year thanks to the lower OPEX level. We can say that in terms of profitability, this was a good quarter. In terms of cash flow, similar cash conversion as last year, slightly better, also a little bit better cash flow as the CAPEX was lower in this quarter. I think no drama here. Equity ratio continues to improve. Of course, it was still very low last year at the same time. Our guidance for this year remains the same. We see that this is the lowest growth quarter, and it should accelerate to get to this mid-single digit for the full year. Otherwise, no changes here. Thank you, and we are happy to answer any questions with Timo here.
Hi, Waltteri Rossi from Danske Bank.
What's your currency exchange rate assumptions behind the guidance given earlier this year? What I'm trying to get at is what the headwinds are going to look like for the rest of the year. Yeah, I think when we made the budget, USD was around $1.05. Of course, this is still a view that is valid with today's rates. All right, thank you. What caused the profits to exceed your expectations in Q1? Was it only the still ongoing recruitments? In a way, should we expect the OPEX to increase slightly from Q1 for the rest of the year?
Yeah, as I said, after the changes in the organization, a number of jobs were cut and we got the savings, but we also added new positions and we've been filling them, but it's not been full during Q1.
We expect it to grow from Q1.
All right, fair enough.
Maybe still, of course, when we gave the guidance in early February, we knew a lot already, but of course, all the recruitments were not completed. When your salary costs are a big part of our cost, there are always timings. Yeah, but yeah, we can say that it was a good quarter.
All right, one last question regarding the new Nordic partner you announced. What's the revenue potential there and when should we expect to see that start generating revenues?
The service is going live at the end of June, and it will start piling up month by month from nothing. Still a mystery how much that will generate, but it is one of our major business unit partners.
That shows that it should be, once it's fully ramped up, it should be a high six-digit number, if not a seven-digit number.
All right, thank you.
Hi, it's Atte Riikola from Inderes. Let's continue on the partner side and the new Orange partnership. Can you say anything about what kind of expectations you have for that for the coming years? Are you basically starting from scratch or are you replacing some existing cybersecurity vendor on Orange?
Both. What we know for sure is that there are countries which do not have an existing base to migrate, and there are some where such an opportunity is existing.
Orange is still taking their own time in considering if they will only provide F-Secure to new customers in the places where they already have a security service available, or if they will go and migrate all of them. Certainty on the fact that we will have several countries joining who will be starting gradual growth. It depends on Orange's own go-to-market decisions country by country where they might migrate.
Maybe I can continue a little bit. Orange is a company with many country organizations, so it is entity by entity that we need to do things. That is why there is always timing uncertainty. Of course, we try to do faster, but it is not only in our hands. Obviously, this is one of these reasons why we expect the growth to accelerate towards the year. Of course, we have expectations.
Yeah, our expectation currently is that first two countries are live this year, both sizable countries. Okay, and do you need to make any new technological investments for this Orange partnership? I think some earlier tier ones have required some investments. Yeah, as a difference to other tier one partners, this one is based on Total. With regards to the product, no significant changes from that point of view. We will get an additional threat feed from around cyber defense, which is an integration we will need to do, but that's a good one. It's going to be improving the rate of detections as there is another threat feed coming into our cloud. That's the only thing that I can think of off the cuff.
All right, and then if you look at the underlying growth in embedded security in Q1, what was like 5% if you exclude that one-off, was there already some impact from the SoftBank and AT&T service ramp-up?
Very little at this time. That was very early on still. I would say that minimum impact at this point in time.
Okay, and last question for the full year growth guidance. I think you mentioned earlier that the growth is split between health and health to embedded and total. Is that assumption still correct?
I think it is fair. Of course, it is approximately, but yeah, both need to grow and both are expected to grow.
All right, thank you.
Good afternoon, it's Matteri Hintikka, and I'm going to give a couple of questions.
Maybe first of all, the embedded top line, it did grow excluding the EUR 0.3 million, but it was still a fairly low growth rate. Were you kind of happy with it? Because I was thinking that since you were starting with some fairly new deals, they would start to accumulate revenue a bit faster. Was that kind of what you expected? Should we expect an acceleration towards the end of the year?
We expected more. No two ways about it. We expected more, not massively, but some. We need to work very actively with our tier one partners to make sure that their whole commercial engine and go-to-market machine is actually doing an effective work in taking the good product out that they have built together with us. There is always the product and service development side, and then there is the go-to-market engine.
We need to do much more work on that side now that the product is available. We fell short of our own expectations slightly, but strong focus area for us.
It is very much a question of this ramp-up time. There was this one partner with basically a soft launch in December, and where we basically start from zero. First months have been slow and marketing has kicked in only later on. Also one of those where we expect more growth later on.
With regards to the product split, we clearly, percentage-wise, are looking forward to much higher % growth in embedded as in security suite and in strategic partners or tier ones than others. Growth, we are expecting everywhere.
Right.
Then about the EUR 0.3 million, was that kind of evenly distributed, the mistake in previous quarters, or was it isolated in some particular quarter?
I'm just trying to get the comparables right. Yeah, it is actually something that happened already in year 2023 in one quarter. And we noticed a mistake, and it was corrected now in one quarter because from the overall group point of view, it's not so significant that we would do a restatement or anything like that. But it was a long time ago, one-time mistake.
It was an error over two months. That's it.
Right. So basically all quarters except Q1 in 2024 are comparable. Yes, yes. All right, that's good. Then a bit more on this Orange deal. What does exactly the strategic partnership mean other than it's big?
It means for us that we see that when we deliver to the full potential of the partnership and they are working actively together with us, we can get to EUR 8 million or more per year revenue. That's what it means for us. We see that possibility there.
Right, but it doesn't include any exclusivity from Orange's part with you, or is it just an exclusive deal?
That question should be potentially posed to Orange. Not my position to say so. What I do know is that CSPs or communication service providers typically work with one partner for one area of solution because it's hard to manage a number of different vendors or different partners. They want to minimize the number. They may have complementary partners to do different things, but in one area, typically they work with one.
You could call it exclusivity, but it's not anything on paper, naturally, from their point of view. They want to keep their options open. It's their preference. Yeah, it is their preference.
Right. Your basic expectation is that if and when they would go to embedded services, then you would have the privilege to be the service partner also in there.
If Orange starts to do embedded services, you would be the only one providing them.
I am absolutely certain that any good large enterprise actually opens up anything like that for competition. I would say that, as they say in baseball, we would have first bat. We would be first stepping up to the plate and having a whack at the ball. I think we would have a clear, clear opportunity potentially over others, but naturally, Orange would still evaluate other options. Sure.
Finally, to Sari, what do you think that we should expect of your cost accumulation in 2025? Now Q1 was clearly kind of a better than expected quarter in terms of lower cost. When you go into these deals, does it mean that you will incur more operating costs just to get the launches done and others? Do you think that when your activity with the large customers increases, does it also increase your costs? Or have you already kind of put in the cost for those that you plan to need?
Yeah, of course, in our own plans, top line and the cost required to deliver that revenue is included. Projects, of course, always delivery projects take some resources, but we also have quite a big team of those. For some big cases, if there are some timing differences, we might need to increase.
Mostly it's included. I think the main change is in how we now ramp up based on the future development that we want to do in terms of AI and new products and so on. Also, the CapEx, there is always some phasing, so it's not the same every month. CapEx also can be a function of what kind of deliveries we do to the customers, that if it's something that we can reuse or it's clearly a product for a certain purpose and lifetime, then we do those as CapEx. It's not always decided when we, for example, do the budget. Some changes.
I would add to that one, there are different kinds of cases that we're working on on the tier one side.
Some of them are banking fully on the kind of embedded security portfolio we already have. Working with that base, our incremental cost additional is absolutely minimal, like Sari says, included already. There are some where we may see that there is a massive user base that we might be able to migrate from day one. We are willing to invest more into that if there is a requirement to do so. Against certain money, we may be very happy to invest more. There are those options that we want to keep open. I think that with regards to the assets that we now have and the skills that we have built in the last one and a half years, roughly, we are already in a really good position, but we want to keep the option open to even invest more if there is guaranteed money.
Is it so that your guidance, which was basically for flat margins in 2025, is based on the idea that you would perhaps need to invest more if certain embedded deals would surface on your plate, and then you would have to meet the challenge?
We want to keep that option open. If and when such deals would happen, we would definitely tell you and the market about what kind of effect that may have on our finances.
Also, during 2024, we ramped up our cost when we were getting prepared for taking care of tier one partners. If you multiply the Q4 cost, it is higher than 2024 was. Already that was included, that we have already improved our capabilities, which comes with the cost.
Right.
Basically, we should be assuming that the fixed cost in Q1 is a good base for fixed costs in the next quarters unless you end up in a situation where it's kind of positive phase.
I think we said that we have not ramped up everything yet in Q1. It might be that it's a bit higher than Q1. Q1 was still low cost. All right.
Thank you. Finally, I think you mentioned only Germany as the European country where top line declined. Was that really the only one?
Of course, we are not separating every declining customer. You always have those who grow fast and grow a bit and who are flat or maybe small decline.
Earlier we have referred to Germany and the U.K. where we've had challenges that are beyond a normal declining customer because they have been big and declining fast. Now this Germany case is so much bigger than the U.K., we didn't include that in the commentary. Of course, it doesn't mean that it's the only one. There is always a range of development within the customer base.
All right, that's all from me. Thank you.
Hi, Valteri Rossi, Danske Bank. Follow-up question on the currencies. The euro USD rate was 1.05, as you said when you gave the guidance, but now it's 1.14, right? Should I understand that the unchanged guidance today is still based on the 1.05 and the guidance is, it's not currency adjusted, right?
No, 105 was when we made the budget, but actually when we gave the guidance, it was probably 104 or even lower because it was in the early parts of this year. The guidance is given as reported. It is not currency neutral, so it is valid even with today's effects. Valid until we tell something else, but yeah, it is not currency neutral, but it is as reported.
Clear. Thanks.
Okay, thank you, audience here in the room. Next we will take a couple of questions from the online audience. You have previously said that a couple of customers continues to see their own customer base churning. Was the impact of this on a similar level than seen in 2024, or has the customer's churn accelerated?
We already briefly discussed this topic and we have not given any specific numbers.
Earlier we talked about Germany and the U.K., and now the U.K. was not on the list because it is small, so much smaller than Germany and getting smaller. The decline is a bit less than in 2024, but it is still significant numbers. As I said, I can say Q1 was 100, and I will not tell more. Let's say it is more than 200 and less than a million.
Thank you. The next bit, similar that you mentioned, that some partners have not been selling your products to the end customers as fast or as well as you expected. What concrete actions and how well are you able to affect on that?
Okay, this is actually a relatively complex response. I will try to be brief. The main thing is that we need to engage.
When we are typically engaging with communication service providers, our engagement is mostly towards the people who are defining the offering of a service provider, the ones who develop it and who manage it. Now we need to extend our engagements in these partnerships, which are big companies, practically almost like a separate company within a company with the sales and marketing focused organizations. That's what we need to do and work alongside them the very same way as we do with our long-served partners in the major partner section. The KPNs and Swisscoms and Elisa's and so forth, we are very used to working side by side with their sales and marketing and go-to-market organizations to help them define propositions, messaging, build campaigns, drive sales incentives and so forth.
We need to activate similar kind of activity also with strategic partners or tier ones, which we have not traditionally done before.
Thank you. The final question regarding the threat feeds. Do those threat feeds that you mentioned play a big role in your competitiveness? Meaning how much of a competitive edge do you really get when you get more and more threat feeds imported when starting to work with the new big CSPs?
The changes are relatively incremental. They are not in a way massive, but they make a difference. For instance, for Orange, they have a massive unit focusing on cyber defense, and they have worked over the years to build a very strong threat feed, which they believe adds value to what we already do. From that perspective, Orange clearly sees that there is benefit from this.
Maybe it is a few percentage points, but that can make a difference between successful attack and unprotected attack.
Thank you. Any further questions here in Helsinki? That was all from the online audience.
Now when you split up the sales with embedded and the Total business, can you say anything about the gross margins of those separate businesses, or should we just make some own assumptions?
I think we still continue with the old world that you need to make your own assumptions, but like we have said, embedded has lower margins. It is because some of the work is put to the partner side and also pricing is different because of that and because it is bigger volume, so we can accept a lower price. A combination of those.
Now as we've been talking about this relationship, you at least have one more data point.
Yeah, thanks for that logical question.
Okay, thank you very much. I hope this was informative and helpful to you with regards to understanding better once again how far we've come in driving both towards our financial targets as well as our strategic targets. Thank you everybody for attending, and we hope to see you once again latest in July when we go out with our quarter two interim report.
Thank you. Thank you.