Welcome to SSH Communications Security's investor call for Q3 of 2026. My name is Aino Virolainen, and I will be hosting the call. The results will be presented by our CEO, Lars Bell, and our CFO, Cristian Arias. As always, after their presentations, we will have a Q&A session, and you can ask questions throughout the call by writing in the chat. This call is being recorded, and we will share the recording as well as the presentation material on our investor pages. But now we are good to start, so I will give the floor to Lars for a quick introduction before we dig into the results. Lars, please go ahead.
Thank you very much, Aino, and good morning to you all. I will start with a short introduction of myself and SSH. Then I will invite Cristian, our new CFO, to take the stage to walk us through the financial results of Q3. After that, I will come back with the business highlights. I will talk a little about our leadership priorities and the outlook. Then, at the end, actually, I have asked Cristian to talk a little about how we look at our numbers and how we are going to track it and how that is going to be presented. That is the agenda for today. Let us get started. My name is Lars Bell. I am the CEO since the 1st of October here.
I have spent more than 25 years in international enterprise software, most recently at Omada, another Nordic identity security SaaS company, where I was Chief Customer Officer for a long time and also interim CEO. Before that, I have been at several international companies, including Pedab, Microsoft, HP, and IBM. My focus will be on growing our market penetration and profitability. Let me give you a very quick introduction to SSH also. We secure access to critical systems for people, machines, and increasingly AI agents. We deliver solutions for the zero trust access security via PrivX, we deliver quantum safe encryption via NQX, and we deliver secure collaboration via SalaX. Our customers are, amongst others, banks, governments, defense, and critical infrastructure around the world. We are a Nordic security pioneer.
We are built for zero trust and the AI era, and that is what we are going to focus on going forward. My job is quite simple, is to turn that base into consistent, profitable growth. With that, I will hand it over to Cristian, our new CFO, to give us an update on the Q3 finance results. Cristian, the stage is yours.
Thank you, Lars. Good morning, everyone. I'm Cristian Arias, and I joined SSH as CFO on October 1. Since this is my first call with you, let me say how I intend to work with the market. First of all, you will get consistent numbers in the same format every quarter with the good news and the bad news presented in the same way. I'll start with the numbers in the format you are used to from our reports, and later in the call, after the business update, I'll come back to explain in more details how we look at these figures and why our recurring indicators move ahead of the reported revenue. This is a format in which our numbers have been always presented, and we will discuss later in the call in more details how to look at them.
Let's start with the net sales. Net sales were EUR 5.7 million against EUR 5.5 million a year ago, up about 5.3%. Our EBITDA was EUR 0.3 million, against EUR 0.8 million at the previous year's quarter, and the operating result, EUR -0.5 million. The difference between the operating result and the EBITDA is mostly the amortization. Invoicing grew by almost 40% to EUR 6.1 million, and the deferred revenue was EUR 14.4 million against EUR 9.7 million from last year. We will touch into these two concepts later in the call. The operating cash flow was EUR -0.7 million in the quarter, and this is in line with our seasonal pattern. Typically, the third quarter is usually weak for cash and the fourth and first quarters are strong when the renewals are collected. The year-to-date net sales are EUR 16.8 million, up about 3.5%.
As we announced on September 22 , mainly the larger orders were expected in the quarter were delayed, which bring us to our outlook for the rest of the year. Our outlook is unchanged from the update we gave on September 22 . We expect net sales to grow compared with 2025 and our cash flow from operating activities to be positive. We expect EBITDA to be negative for the full year, but better in the second half than in the first half. What changed in September was basically the EBITDA outlook. This is mainly due to orders from some of our customers which actually slip out of our Q3 into further quarters. At the same time, we have been keeping our investment for growth, which is impacting our EBITDA.
Over the last six quarters, the net sales of EUR 5.7 million were our highest quarter since the fourth quarter of 2024, up, as I mentioned in the previous slide, 5.3% on the same quarter last year. EBITDA was EUR 0.3 million against EUR 0.8 million a year ago, and a positive after a negative first quarter. It's below last year, mainly because, as I mentioned before, some of the orders from our customers were delayed. But we have been keeping investing in our sales and marketing as well as in our R&D. In this slide, we present the regions. EMEA, which is typically our stronger region, grew by 11.2% to EUR 3.4 million and is up 9.1% year- to- date. Americas was EUR 1.8 million and is down 0.5%, and there's an impact also there from the weaker dollar, which reduced the group reported growth by about 1.5%.
APAC was EUR 0.9 million, down 7.4%, and there we have experienced delay in customer orders. Maybe this is the most important slide in order to understand where we are. The subscription sales grew by 17.8% to EUR 3.9 million during the quarter. Our subscription ARR grew 23.6%, while our invoicing grew by 39.2%, almost 40%, during this quarter. We are also given a visibility on the deferred revenue, which grew by almost 50%, and I will touch on that later, after the business outlook from Lars, what are the drivers for those. All of this grow faster than the net sales, which is growing at 5.3%. It is because subscription are invoiced in advance and recognized over time. The growth shows here first in the annual recurring revenue and the subscription revenue than in our sales, which has been growing 5.3% year-on-year.
I will explain the mechanics of the ARR and the MRR later in the call. To summarize it, this is where we stand today with our Q3. Our recurring base kept growing. The subscription ARR was up 23.6% to EUR 15.7 million, and deferred revenue almost 50% growth to EUR 14.4 million, of which EUR 11.5 million will be recognized within the next 12 months, and the other part is the non-recurring part.
Net sales were EUR 5.7 million, as I mentioned in the previous slide, up 5.3%, while the EBITDA was EUR 0.3 million during the quarter, and the operating result EUR 0.5 million during the quarter. We ended the quarter with EUR 8.5 million in liquid assets. Our equity ratio was about 70% compared with the 54.5% a year ago, and that is mainly due to the EUR 20 million directed shares issued to Leonardo, completed by the end of October 2025.
Since year-end, it has come down from 78.7%, mainly because we have repurchased the hybrid loan from last year. Okay. Maybe a word on reporting. What we report today will stay the same way with the same definitions. We will be adding more details, such as year-on-year growth for the ARR and the deferred revenue and the split of deferred revenue from current to non-current. We are also reviewing additional KPIs with Lars to report with the full year result in February, and any new KPIs will come with a clear definition. Lars Bell.
Thank you, Cristian. Thank you very much, Cristian. I will share a little on the highlights of the quarter here. If we take a look at the business and the numbers Cristian just have presented, Cristian talked about our growth in annual subscription revenue. That is driven to a large degree by the PrivX PAM solution, which is showing a very strong growth of 33.9% year-on-year. We are, in that, also seeing that the product is picking up, largely because we are moving towards that whole momentum in the market where agentic AI is picking up, and we actually have some of the capabilities that is requested in that.
I want to call out also that our Key Manager solution, which is a tool that allows companies that use Tectia and OpenSSH to control their existing keys, as well as preparing them for moving into the zero trust principles with fully audited creations of short-lived access, is a big driver behind this. The whole shift of the market going towards the modern way of doing access management is reflected also in the growth rates we have on these products. Another important thing to take a note of is that in the beginning of September, we announced that one of the largest banks in the world has decided to implement both the Key Manager and the PrivX PAM solution, the products I just talked about, and exactly for the reasons I just talked about.
To get control of the existing SSH keys and to build a modern zero trust-based access system. The deal is a three-year deal with an option for two additional years in the contract, and this agreement we have landed together with our partner, WWT. We are working on identifying and landing more deals of this character. Moving on. The final one to mention out here in the highlights is that the strategic initiative with our partner, Leonardo. You probably know that Leonardo is now the majority shareholder in SSH. We have a steady growing pipeline with Leonardo, and for several quarters in both defense and high security areas, we are seeing that progressing. Such deals by nature take time, but will have a big impact when they land.
This partnership is strong and we are constantly, and on an ongoing basis, focusing on the collaboration together with Leonardo, and you will hear more about this going forward. Moving into a little more about the outlook and what is to come yet. First, let me just quickly take a little notice here also that both Cristian and I joined here on the 1st of October. Let me just also thank the previous leadership, Rami and Cristian. Rami has been very instrumental in bringing SSH to where they are today. There is a strong foundation on products. There is a strong foundation of opportunities and things that we can work on. Big thanks to the previous leadership, and then Cristian and I will do our best to try to take that into the next level. A short word.
Cristian and I have, as I said, begun here this month, and we are seeing this at a time where market is shifting and where cybersecurity and access management is becoming even more important. We could not ask for more exciting roles. I think this is a time of change. It is a time where SSH is strongly positioned for that, and it is a time where we need to make sure we take that into the market. Our priority is to make sure that SSH grows its business to help companies, and mostly help them move into the modern, secure way of managing all the things that will make them productive. SSH is here to make sure that companies can adopt new technologies in a safe and secure way.
We have the products to do that. I think we are beginning to see the growth of that in a very structured way. We cover human identities, we cover machine identities, and we cover agentic identities, and that is what the market is looking for. Finally, let me just also remind you that we have a strong balance sheet. We have the foundation for the growth. We have more than 30 years of expertise, and we have a strong balance sheet that allows us to make investments and to lead us into a fast-growing market. With that, I also in the beginning said that I would ask Cristian to come back and talk a little about how we see the numbers and to present a little of how we will manage that going forward. Cristian, I am going to hand it back to you.
Thank you, Lars.
Thanks.
Okay. Basically, I wanted to have a few minutes to go through how we look at the numbers under the hood. Let me start with the annual recurring revenue, which is our growth engine. When we talk about the annual recurring revenue, we have there two items, which is the subscription and the maintenance revenue, which we have been disclosing in our release. The way we look at that is the monthly recurring revenue times 12. Basically, it is the revenue that the business is generating in one particular month that will continue to take place in the next 12 months. Later on, I will have an example with a specific contract. We have two type of ARR. We have the subscription ARR, which is our main growth engine. As an example, our PrivX product is run through the subscription ARR.
That is actually very positive when the subscription ARR is increasing. The second item there is the maintenance ARR, which is basically used for the recurring revenue for our legacy business. Our intention is to move customer from the maintenance ARR into a subscription ARR in order to increase the second one. The reason why we bring all of these KPIs together is because not all of them have the same level of stability. While subscription and maintenance ARR are, and should be, stable, invoicing and deferred revenue are probably the more volatile of the items. The main reason is that invoicing is impacted by renewal and long-term deals, the same as the deferred revenue.
Net sales is the metric that you have been used to follow in our P&L, but the foundation for the net sales are the two main items, the subscription ARR and the maintenance ARR. Here there is an example with one contract. This is a generic example. If we take a contract of about EUR 1.2 million a year. The contract start to generate revenue during the month that is invoiced. You can see in the graph that actually part of that contract is being cumulated into the deferred revenue. When we get the contract, the contract get booked originally to deferred revenue, and every single month will generate the recurring revenue. The way that is done is simple math. It is actually taking the contract and dividing the contract by the number of months that the contract will extend. In this case, it is basically one year.
In the graph you can see basically how the monthly recurring revenue, which is our engine, stays stable while the cumulative revenue start to increase, which is actually the blue bar. Then the deferred revenue, which is the item that we typically inform in our balance sheet, start to get smaller and smaller. By the end of the contract, there is the renewal of the contract. There might be potential upsells, downsells, and the cycle start again. The main takeaway from this slide is that you understand how we are actually monitoring the business, and that our main focus will be to increase the monthly recurring revenue from our customer, which will turn into a higher annual recurring revenue. To finish with the metrics, here basically you can see where our performance is.
Here there is a split of the subscription revenue and the maintenance revenue, where you can see that subscription revenue is actually taking a higher part of the bars, which is actually very positive for the business. While the maintenance revenue, which is related to our legacy business, is going down. I just want to touch on this so you can have a bit more overview on how we are monitoring the business and how the figures that we present in our P&L get translated into our recurring revenue engine. With that, I think that we go back to Lars.
Aino.
Aino?
I will join you here on stage.
All right. Thank you. I will check the chat for questions very shortly. But first, as always, we will start with questions from our analysts. So Jacob, please go ahead.
Hi. Good day. Can you hear me?
Yep.
I can hear you.
Hi.
Hi, Jacob.
Lars, Cristian, and Aino, thanks for taking my questions and thanks for the presentation. I firstly just wanted to check this deal with one of the world's largest banks for PrivX Key Manager and PAM that you announced early in September. You state that this is valued at EUR 3 million over three years. So two questions on this. Firstly, should we interpret this as that it is about EUR 1 million in subscription ARR from that deal? Secondly, just to clarify, since you announced it in September, I suppose that figure is already included in your Q3 ARR figure. Is that correct?
The answer to that is yes. But Cristian, I do not know if you want to add a few words to it, but yes.
Yeah. So basically, if you follow what I was saying, so part of that contract is a small portion is already in our ARR. It is a three-year deal. Actually, we have invoiced one year for that particular deal. So a small portion is in the Q3, but actually Q4 will have a bigger impact from that particular contract.
Okay. I see. Thank you. Just to follow up on that, is that because, I assume that the last month in the quarter, you take the subscription revenue and you multiply it by 12 to get to the ARR figure. Did you not get the full amount?
Actually, it is the other way around. I can explain to you, Jacob. You take the contract to simplify the figures. You have EUR 1 million that you have invoiced. What you do with that is you divide that by 12, and that one twelfth is what gets booked the first month.
Okay. That is why we have a small portion of that book in Q3, and then in Q4, we will have the full effect of the monthly recurring revenue multiplied by three months.
Okay. Then I perfectly see it now. Thank you. In the report or in the CEO letter, Lars Bell, you state that you aim to turn SSH, the strong position you have, into faster growth and larger market share. I just wanted to see, when you say faster growth, from what levels are we talking? Is it a 5% revenue growth through your report? Do you also think you can accelerate subscription growth and even PrivX growth from these high double-digit levels that you are currently at?
If we think a little about what Cristian just described here. The growth really comes from us going out and creating new contracts. Those new contracts will then go in, as you say, 12 for one year. Out of that will go into the ARR. If we look at the ARR, that to me is the leading indicator for the growth of the company. In that, we are growing. That will then later turn into revenues. When we talk about recognized revenues, it is trailing a little behind, and that's where you see the 5%, why you see the ARR growing faster than that. We will focus on, of course, going out and making sure that we upsell to existing customers, that we land new contracts. That will then first show up in the ARR increasing and showing good double-digit growth year-on-year.
As a result of that, we will also see the recognized revenue grow over time. Of course, it all sits together, but we just important also then when we talk about it is that the first indicator we see is that we land the contracts, and we'll be talking about that. Then we see it come into the ARR. That shows us how big a base of recurring revenue we have. Then later we will see it in the recurring revenue that we actually go in and book. That's how we see the growth, but it all flows together, and it all starts with us going out, making sure that the customers understand what we do, how we can solve the issues that they're dealing with, and that we make sure that we scale that up via our partner channel.
Okay. Thank you for that. Final one from me then is that in APAC, revenue declined slightly, and I interpret it as it's mainly due to these delayed customer orders that should have arrived in Q3. What's your expectations on these orders? What magnitude are we talking about? Since APAC is your smallest region, I can imagine it's not too big. Can you say anything about it, and should we expect these orders to be received in Q4, or is it more tilted towards 2027?
It's a good question, Jacob. We don't really go in and disclose what we have in pipeline because it's, first of all, a thing that is a little volatile and where we are working on things, especially when you work with partners like that. We will announce as soon as we know that there's a deal on the way or that we have booked something, we will go out and talk about that. In Asia, what we are seeing is also that a lot of the business is done by our partners in the various countries. We have those relationships. We do have the pipeline. Yes, there is pipeline behind it, but we also need to make sure that we are getting even better at predicting when that comes and takes that into the business.
I can't share with you exactly what we're working on now, but there are deals around the growth areas as well in the APAC.
Okay. Fully respect that you can't disclose it. Thank you very much for providing some color. I'll get back in the queue.
Thank you, Jacob.
All right. Thank you very much. I will quickly check the chat now. Looks like we don't have any questions in the chat, so we will close the call. Thank you very much for participating, and thank you very much to Lars and Cristian for the presentation. Our next investor call will be in February when we release our Q4 and full year 2026 results. See you then.