Good morning, everyone. Welcome to this investor call on SSH Communications Security's Q3 results. My name is [Christian Fredrikson . This call is being recorded, and the recording, along with the presentation slides, will be uploaded to SSH website later today. To avoid any unnecessary disturbance, please keep your mics muted during the p resentations. The results will be presented by our CEO, Teemu Tunkelo, and Niklas Nordström, the company CFO. There will be a Q&A session after the presentations. Without further ado, Teemu, the floor is yours.
Thank you, Christian. I'm Teemu Tunkelo, I'm the CEO, and I'm happy to present you the Q3 results, which are good, and we are going to good direction. I want to thank our team, I want to thank our customers for the commitment and trust on our products and solutions so w e are on a good road. Let's go to the presentation. This everybody knows. Let's move forward. We were able to achieve growth 54% compared to last year. Our annual recurring revenue reached 87% of the revenues at EUR 14.5 million. 36% of our revenues, we reinvested back to business by developing further our products.
We also moved closer to customers and expanded our addressable market with PrivX, just-in-time access and just-enough-access technologies. We did it for new customer segments for operational technology, for factories, harbors, and airports and marine vessels and MSPs, so outsourcers, task providers. We also are taking care of our installed base by embedding PrivX to UKM and Tectia solutions.
We were the first ones, I think, or one of the first ones at least, to make a post-quantum secure product with NQX PQC Edition, where we are already working with the first customers and w e integrate the Deltagon to the company and launch the SSH Secure e-communication Suite that will be sold through the whole SSH network, also to markets outside the Nordic region. These are the key points that we have done during the third quarter, and now I would like to hand over to Niklas to give us some more detailed numbers.
Thank you, Teemu. Good morning and welcome also on my behalf. My name is Niklas Nordström. I'm the CFO of SSH. Let's jump into the numbers. During the third quarter, we started seeing pickup in the cybersecurity market, as well as demand for SSH services and solutions. As Teemu mentioned, our revenue grew 54% compared to the comparison period, and we recorded a positive EBITDA, as well as operative cash flow for the quarter. Our new license sales also increased, and at the same time, we were able to increase our share of recurring revenue to 87% of the total, driven by solid performance of the SSH Secure e-communication Suite as well as PrivX. This gives us a solid foundation for moving into the fourth and final quarter.
It's worth mentioning here that due to the Deltagon acquisition and the related purchase price allocation, meaning the allocation of goodwill in our balance sheet, our depreciations have increased from Q2 by approximately EUR 300,000. This is not a cost that would affect cash flow, but it is rather an IFRS type of cost in accounting, therefore, i n the future, I would say that EBITDA is an even more important measure of our operative performance. On a regional side, EMEA grew, driven mostly by the SSH Secure e-communication Suite performance, but also as a result of good pull from PrivX.
U.S. returned to a growth path while APAC was down. We have intentionally put focus on our biggest markets, U.S. and EMEA, where we have also been successful. As a result, we have been able to grow despite the decline of APAC. We will put focus on reorganizing APAC operations during Q4. One more interesting point to mention here is that while we are now in the go-to-market deployment phase of the e-Communications Suite outside of the Nordics and into other SSH regions, we have already been able to improve the suite's performance under SSH management, reaching over 20% growth for the portfolio in Q3 compared to the comparison period when Deltagon was not yet a part of SSH.
On the balance sheet side, I will keep it short but to the point. Our liquidity situation is improving, and we ended the quarter with a cash balance of EUR 4.2 million. Furthermore, invoicing in Q3 was higher than during the two previous quarter combined, giving us good visibility into a further improving trend. Okay, moving on to NQX. For NQX, we received the first more significant customer subscription orders during the quarter amounting to EUR 300,000. These orders consist of mainly test lab environments, which will then be the path to production environment rollouts, which will start during Q4.
Overall, it seem that deployment base has been slower and anticipated and that has had a negative reflection on our revenue generation this year. We see that the development is positive for next year. We see that PQC or post-quantum cryptography is something that resonates especially well with the security-critical customers, not only in Finland but also internationally and t he race is on here, as Teemu briefly mentioned. The next slide. You can see what NQX basically does. It effectively creates an encrypted and highly secured tunnel within a tunnel between endpoints and i t does it in a way that is resistant to quantum computing or threats created by it.
NQX doesn't care what goes through it, so it can be used for encrypting any kind of traffic. I've previously described it as a stargate between two networks. This kind of solution is very useful, for example, large multinational organizations and security-critical customers. NQX is also a very important test lab for SSH, as it's the first platform that we have architected post-quantum readiness into, and this work will pave the way for doing the same to other SSH solutions as well. Tectia being the first product to receive this feature, this treatment. Next, I'll give the floor back to Teemu, to tell you more about our other recent developments. Teemu, please.
Thank you. One of our key pillars on moving forward for sustainable, profitable growth has been the move towards annual recurring revenue, and the present number is maybe, at least for me, so big that it's difficult to understand. It's driven by three different things, where largest one is the products we received with the Deltagon acquisition, also PrivX with stellar development. NQX also with huge percent number on growth, but of course, the base number for NQX is so low that all in all our future-proof products that are still on the significant growth rate are driven by the subscription revenue, which I believe is the right way for a software company to move forward.
The other pillar in our strategy has been to become a trusted advisor to our key customers, of which we have about 120 customers that pay us more than EUR 50,000 per year. With them, we have started actively to promote professional services as part of our service, which we used to do in the past, maybe in the last two years, less, but it's important for a software to work with the customers and help them to use the products. We will not ever become a professional services business, but our professional services helps our customers to use our products in the best possible way and t hat has happened with NQX and PrivX. It already has been happening with the Secure e-communication Suite before.
All our products are supported by a meaningful service portfolio that helps customers to learn to use and optimize the use of our products. PrivX is a zero trust privileged access management solution for administrators, power users, third-party developers, and maintainers, so t hey will come through a general identity and access management, and when they need system-level access, they will go through PrivX, which enables them, us, or the customer actually, to audit who does what when. The great thing with PrivX is that it takes the cyber safety to the next level. There are no static passwords that people can use. It is like in a hotel, you don't have a physical key.
You have a digital card, which can be nullified when the customer is not anymore allowed to access the room. We have the same logic. No static passwords. No static password for users or applications. We also have implemented, based on the customer need, the way to manage who gets to do what, not by person individually, but based on the role they have at the moment in the company. This is really critical for our key customers. One of the top customers has 8,000 people, admins, power users, and third-party people who come to the system. It would be very difficult to manage them one by one and t hat's why the role-based automation for managing the system-level access is absolutely a key differentiator for PrivX.
The third point is that since you have it digitally, you can do the access verification, monitoring who does what in real time to prevent misuse and also to make a log who did what when, so that you can do postmortem analysis what happened. If you go to the right side of the picture, you can see that PrivX doesn't only do traditional servers. We help from servers to cloud. We help also the access to applications and especially with the OT environment devices, being automation systems, being routers.
All these you can control the access without the privileged user having to know the password or even doesn't know the password to get access to the device, and that can be in real-time controlled and cut it if needed. PrivX is really the gatekeeper for all these different kind of IT systems in your landscape. What we have done with PrivX, if you go a level deeper, is the just-in-time and just-enough-access technologies done with hyper-scalable architecture, native in cloud, easy to use and t he pricing model we have implemented is that we enable our customers to start small and expand. We call it the land and expand sales approach, which maybe makes our growth slower, but it makes our customers happy, and I think that's a good combination looking at the growth we have been able to achieve.
The OT and MSP additions have been accepted very well by our customers and w e are really expanding the PrivX's addressable market with these additions. We also have extended our way to deploy PrivX so you can use it in your data room or in a outsourcer's data room. You can use it in a cloud. You can run it in a container, like Kubernetes environment. You can do it SaaS deployment, which means that you can let your customers to use applications like you buy electricity from a wall plug. You just use what you need. We have been able to break out to Finland because PrivX used to be earlier very much Finland-centric. We have proven our case here. We have gotten right names and bnow we have gotten several significant new customers in all of our regions.
PrivX is getting global, and I'm really proud of that. It's a great achievement from the team. We are also bringing in the zero trust technologies to other PrivX products, UKM and Tectia being the first ones. If we look at the quarter past, it went fast and I'm really grateful for the team. I think we've done a lot of changes in the team, and the team is on board and committed. Customers are revitalized with their dialogue with us. I'm really, really happy with the third quarter, and I can see the trend even improving for the end of the year. For the full year, I see very good outlook, which is in line with the guidance we have earlier given.
Our net sales will be increasing this year significantly, and our EBITDA and cash flow from operations will be positive despite the investments we do to the R&D and to the go-to-market. I feel really, really excited about what we have been able to do and what we will be able to do in the future, which follow the same positive trend, most likely even better than what you have seen this year. With these words, I would like to open the floor for questions and comments. Any questions out there? You can also put the questions on the chat.
Hi, it's Atte from Inderes. Could you open up that how much of your growth in Q3 was organic and how much was from the Deltagon acquisition?
Atte, you can take it in different ways. The Deltagon acquisition was that we used the cash at hand we had at the company. Like ex-Prime Minister Sipilä said, "Let's put the capital in better use." Most of the growth, of course, comes from the acquisition because Deltagon is now our second-biggest product line, second-most profitable product line. It is a huge change for the company, but also old SSH made good progress, as you could see. Our focus regions, U.S. and Europe, did very well. We can discuss where we failed, maybe not being able to have the focus on APAC, which, like Niklas said, we are going to go back with it. If you look at by product line and region, I think we did very well with the old SSH despite the decline in APAC. Niklas, would you like to begin?
I can summarize that by saying that we grew both organically as well as inorganically.
Okay. Can you open up a little bit more about that big NQX deal that was deliveries were a little bit slow in Q3. You sounded really optimistic in Q2 about the deliveries.
Well-
What is taking so long?
Well, I guess big projects take a lot of time. The good thing with NQX is that we have gotten several customers. The large frame contract has been slower for reasons behind our control, and we are in a good dialogue with the customer. I think we have better visibility, but I think Niklas should answer this question.
Yeah. The prospect of that particular agreement has not changed. It's a huge IT project, and these kind of projects tend to be difficult to estimate, and that has happened. Now we have the further pain of the global semiconductor situation, and we are fighting for our piece of the puzzle. We have been quite successful so far in getting those equipment that we need. You have to remember that we, in this particular product and case, we're no longer a software provider. Software you can send over the Internet, but here we have also a hardware component, so we are a total system or solution provider, and this makes it that much more complex but we are confident that we will be able to get the supply that we need.
Also if you look at the outlook for it, I think even that this project has been delayed, the traditional SSH has been growing and the growth percent for NQX for next year will most likely exceed the current growth percent of PrivX. Both of our traditional growth engines and investments in the future, NQX and PrivX, are going to contribute to the growth in 2022.
Okay. One last question from me. You said that you have signed many new significant PrivX clients. Can you say anything about those deal sizes on an annual basis?
Yeah. We have signed a large deal, which I can't say a lot about, but we have signed several deals which represent ARR of EUR 200,000, EUR 250,000. I like to talk about whale, salmons, and sardines as the size of the fish we want to catch because I'm a fisherman. We don't want to go for whales because the whale we have is a lot of work. Our sweet spot are PrivX deals that are EUR 200,000, EUR 250,000 per year, plus professional services, which initially is about the same size as the original deal and o ur average PrivX deal size has been growing constantly over the last 18 months. I would say that minimum PrivX deal we want to take is EUR 15,000 per year, and the optimal deal size is EUR 200,000-EUR 250,000 per year.
Okay. Thank you.
There's a question in the chat. Q1 to Q3 operating cash flow was a EUR -1.5 million, and we still expect whole year operating cash flow to be positive. Could you elaborate what the main drivers for very positive operating cash flow in Q4 are?
When we do subscription deals, the typical deal model is that the customer pays the full year at the signing of the order, and then we will recognize that as revenue by month. That means that assuming we would get significant deals during the end of the year, being either new subscription or being renewables, the cash will come and the revenue will be recognized later. That's based on our business model, but maybe Niklas can explain that better.
Yes. I mentioned already in my part that our Q3 invoicing was better than the two previous quarters combined. That invoicing is heavily weighted towards the end of the quarter, there is that. That gives us a good visibility into Q4 strong cash flow. Also, all of our bigger renewals tend to be phased towards the end of the year, that's another driver for that. We of course have the pipeline that makes us confident that we will have a strong Q4.
I actually like to talk now internally that we are on a super quarter now.
These are the main drivers.
Any other questions? While you think about those questions, there is another one here in the chat. Can you elaborate a bit on SSH competitive landscape and what challenges we expect when expanding internationally?
Well, I think the good thing for us is that the competition is consolidating. Thycotic and Centrify are in the middle of integration with competing products, so customers are worried about which product will win, how are they going to do it. CyberArk is strong with their installed base, but they have old products which are difficult to implement so w e are easy to implement. We are land and expand. We are easy to use. Compared to what we can offer, especially with PrivX and NQX, both being a little bit of products that nobody has ever done before, for an existing use case but done with the new technology, in an innovative way. I think we are a typical Nordic engineering company.
Our products are the best. Our challenge is how to get them to the market, and that's big part of the investment we have done on top of the R&D investment that we want to take the product to the market. Creating a product costs one, and taking it to market costs 5x-10x more. PrivX, we have been breaking out of Finland successfully over the last year. NQX, we have been focusing on Finland, and we will be breaking out to market as well. Why we win is because we are nice guys and the product is good. It's a new technology, it's future proof, and it's coming from a stable company who knows what we are doing. Maybe Niklas, you could say some words about NQX expanding internationally.
Well, right now the focus is 100% domestic market. We need to establish our ground here, and after that, we will be able to then use those learnings. We will then have the infrastructure set up, support all kinds of this logistics, everything like this. Only after that, when we're successfully running the solution and the service in Finland, then we can look abroad. As I mentioned, the PQC, the technology is very interesting. It's resonating not only in Finland, but in a number of other discussions that we have ongoing also internationally.
The PQC will come to SSH other products as well. That's kind of a way we leverage the investment in the NQX environment, the post-quantum proven products will be also starting with Tectia and then others following. Maybe the other question on breaking out to Finland is Deltagon.
Deltagon. One more thing that I would like to mention regarding NQX. Right now, the customer base is security critical customers. They need high security certified products. Certification means that you certify the software together with the hardware. In the end, NQX is hardware agnostic. It doesn't care what hardware it runs on. If we're talking about internationalization going abroad, in the end, it's a software that can be installed on a number of different devices. As I said, the focus is now on the domestic market.
On Deltagon in Sweden and Finland, we have a good base and Nordic is growing. How do you see Deltagon breaking out of Nordic?
Right now we have been very much focused on building the infrastructure that is necessary for that product to be able to expand to other SSH regions. It sounds like, "Well, why don't you just sell it to U.S.?" To be able to sell it to U.S., you need to have the support infrastructure. You need to have on-site sort of support capabilities 24/7. You need to have information customized to that country. This all takes time. Now we are in a good phase. We have done the groundwork, the legwork that is necessary. We have combined our support teams. We have 24/7 capabilities, and now we are actually, during Q4, we are in a position where we are finally able to start contacting SSH existing customers, so large banks, insurance companies, all of these kind of operators, and we are able to sell the product.
I think there are two elements that are key. One is are the resources that are there, people are trained. We need also new people. The other one is systems. We are merging. We acquired Deltagon half a year ago, roughly, and now we are merging the support customer-facing systems, support systems, CRM systems. In order to really drive the expansion, we first have to have the people ready. We have to have the systems ready. Those are the elements that will help us to grow in 2022 and t he things we've already done, they will help us to make the super quarter Q4.
Any other questions from the audience?
Hi. This is Forbes from Redeye. Do you hear me fine?
Yes. Go ahead
Great. Thank you. Yes, I noticed you launched the availability of the commercial NQX edition. How does that product compare to the large NQX Lighthouse agreement you have? Would you say it is a lot more standardized than that product? How do you expect to go to market with it?
Well, what Niklas already said, the large contract we have is hardware and software certified as combined. The PQC edition is software only so t he go-to-market is more traditional NQX. It's also important from a point of view that the PQC algorithms are developing, and we will sell the PQC version first to customers who want to test it. It also will go first to lab environments. It also is a key component for the large frame contract, as an upgrade opportunity when they might later want to go and upgrade their solution with the PQC version. It has two dimensions to grow. Maybe Niklas.
Yeah. The ability to merge or transition towards PQC-capable software during the term of the agreement has been a very important topic in this particular contract negotiation as well, s o it by no means is just a conceptual thing in relation to this contract as well.
It's an upsell opportunity for us.
Yeah.
Yeah. On the being an upsell opportunity, do you see that your existing customers, some of your larger financial institutions, for instance, would benefit from having this security product in their portfolio?
Absolutely. Not only NQX as a product, but the post-quantum migration that you can take your existing Tectia product and upgrade it to be future-proof is a thing that really excites our customers. It sounds good. Actually, Niklas was talking to one of our key customers not long ago, when he was asking from them that, "Are these quantum computers, are they a risk for you?" Niklas, can you expand what they said?
Every customer that would speak, they say the same thing. They don't know when it's coming, if it's coming, if the technology will ever be a relevant threat to current cryptography. Every customer, especially the big ones, are already preparing, and they need to do that well in advance.
Because the challenge is that the threat actors can already today record your encrypted messages, and if that data still has a value years from now, they can crack it later.
We know that, for example, NSA, American, what is it?
Security Authority.
Yeah, Security Authority is constantly recording Internet traffic and key exchange events and storing it into their data centers. One day they will have a computer that is strong enough, powerful enough, and they will be able to read every secret that's transmitted over the Internet. As to the relevance of the PQC and customers preparing, we have actually sold the first options to update the PQC. This was in Asia, wasn't it?
Yeah.
Yeah.
It was in Asia. It is really something, the PQC program that we are working with Business Finland and other actors, VTT and other actors, it is getting a lot of positive attention and people are coming to us and talking about it. We see that that's one of the reasons why also Tectia can defend its position against OpenSSH because it's going to be passwordless with zero trust, and it's going to be quantum-proof. All in all, Tectia is a future-proof for another 20 years.
Great. A final question then. Yeah. You might have said this already, but I noticed that license sales are still on historically low levels similar to that in the pandemic. You had quite a positive outlook after the Q2 report and commentary. Do you expect to improve on this in the nearest term, do you think?
Well, I think the license sales will remain to be important part of the portfolio. It is still overall growing. It's a lot based on UKM and Tectia and Asia. In Asia, people still buy perpetual licenses rather than subscription. I believe that license sales will be a significant part of our portfolio in the future as well. The main growth will come from the subscription business.
All right. Well, thank you and well done on a solid quarter.
Thanks, folks.
There's one question that I kind of missed, sorry, in the chat. The first question, actually. I'm very sorry about that. This is for Niklas, I would say. How much corrected ARR was in the Q2 situation?
Right. Going back to that, when we made the acquisition, we entered into a transitional service agreement where accounting was done outside of SSH, and we just received these transfer files. During the integration process, when we were starting to take over this function, we discovered that there was revenue recognized for P6, June, which belonged to earlier periods. As you know, the ARR KPIs are a result of a multiplication of the last month's revenue of the period multiplied by 12. Even a small increase in the monthly revenue distorts the annualized figure to an extent.
We don't have the detailed information. We know that the revenue for year to date is correct, so we're not missing any revenue or anything like that. The monthly revenue that was recognized was somewhat overstated, causing the subscription ARR figure to be too high. The fact of the matter is that our subscription revenue has grown from June, and therefore the number that we reported in P9 is correct. Therefore, the number that we reported in P6 should be lower than that.
Any other questions? Chat is now empty.
Great. If there are no further questions or comments, I would like to reiterate that we are really proud of the third quarter. We're proud of the team. I think the team is in place. We are in very good terms with existing projects that we are running moving forward. We really see that we've done, in our opinion, well, like Inderes said in its deep dive, turnaround is coming. It took some time. I think this is now the first concrete evidence that the turnaround is turning, and we expect the positive development to accelerate, and we are working hard with it, with our customers and partners to make it happen. We hope for your trust and support as well, because we are going to make it happen. Kristo, would you like to close the session?
Sure. Thank you. Thank you presenters Niklas, Teemu, and thank you to the audience. The recording and the presentation will be uploaded to our website later today. If you want to revisit that, it will be down there later. Thank you very much for your participation and looking forward to our next call. Have a very good day. Thank you. Bye-bye.