Welcome, welcome online. Guests arriving. I'm letting people in. We'll start in just 10 seconds. Please mute your mics if you are not speaking. Well, valued shareholders, investors, customers, and media, welcome to our investor call on SSH Communications Security Corporation's business review January-March 2023, so Q1. This meeting will be recorded, and recording along with the presentation will be available on our webpage after this call. My name is Lauri Koponen. I am the Communications Lead here at SSH and will be your host in this call. Results will be presented by our CFO, Mikael Kommonen, and CEO Teemu Tunkelo. You can ask questions at the end of the event by asking to speak, raising your hand, typical Teams, or writing in the chat your question. I will read it out loud. Please keep your mics muted whenever you don't have the floor.
Actually, we could straight ahead move forward, let's start with the financial results. Please, Mikael, the floor is yours.
Thank you, Lauri, and good morning from my side as well. Quickly on the agenda. Okay, we'll jump straight into the financials. In the first quarter of 2023, our net sales grew by 9% while our EBITDA remained positive, and we recorded operating cash flow of EUR 2 million. Looking more closely at the net sales number, it was EUR 4.8 million for the first quarter. Our subscription annual recurring revenue grew by 27%, reaching EUR 10.3 million at the end of the quarter. The total annual recurring revenue grew 12% and reached EUR 18.3 million. The EBITDA for the first quarter was EUR 0.2 million, and this was the eighth consecutive quarter with positive EBITDA.
On the portfolio and market side, we continued major R&D investments into our Deltagon Suite. We continued marketing and market positioning activities on Zero Trust operational technology and Quantum-Safe products. Also we increased the awareness of SSH passwordless solutions in all regions during the first quarter. Next slide, please. Looking at the trend of our net sales and EBITDA, we can see that subscriptions growth was strong in all our products and our strategy of moving towards a subscription-based sales yielded revenues in the first quarter based on the multi-year contracts we have in place. As already mentioned, this was the eighth consecutive quarter of positive EBITDA. Next slide, please, Lauri. Teemu, I'm afraid you're muted still.
Thank you. Yeah. Hello from my side as well. I apologize the background. I'm in San Francisco with the RSA Conference, with 40,000 visitors. It's not only in Texas where things are big. I would like to go through what we've done in the starting months of the year. We've worked on the topics that Mikael mentioned. We have been clarifying our marketing story, which is targeted now to more challenge the traditional way of perimeter-based security. We are communication security company. We secure communications between humans, systems, applications, and networks, and sites to cloud. We have five products that manage this whole thing, and it really focuses on session control on RDP or SSH protocols Between the user or the application and the counterparty of the communication.
That basically means that the future of the communication is borderless, meaning that there is not any more reason to have firewalls, DMZs, because it's moving more to the cloud access, and partially also because of COVID, it's not anymore that people come to work and work in the internal network. In the end, the whole dynamics has changed, that there is no difference on the security posture between intranet, internet, and extranet. That's why our PrivX is the core element of the platform that enables us to monitor, audit, control, and record cloud accesses with real-time session control. On top of that, we have now half of our products already supporting PQC as a option for the product, where I believe we are pretty much at least at the high end of early adapters in the European market.
A lot of people talk about PQC. It has been here also in RSA an important topic, very few companies have yet implemented the protocols. Let's move forward. How does the Zero Trust Suite, which consists of our total portfolio, five product families, the idea is it secure the access and the communication that there will be no man in the middle. The application for secured device trust is done especially first thing coming out is the biometric recognition and hiding the SSH keys and passwords from the users. Where are the use cases now for these environments? One is certainly the OT edition, where we connect the factory to cloud in a secure way, connect the control systems to the cloud.
We have increased a lot the support of the third-party contractors, DevOps environments, that it's easy to control who comes and does what in the system. Just today, we had a meeting with one of the major credit card companies, and they said that they have to tighten the screws on access control, especially for the production environment, which also has a high availability requirement. They said that The operations guy said that he's allowed to have planned and unplanned downtime for PrivX 12 hours per year. We have high availability, we have improved upgrade, without downtown, minimizing downtime when you need to upgrade PrivX, so this all is helping our customers.
If we go to the cloud instances, I would still say that major part of our customers are using on-premise solutions, but the move to the cloud is accelerating faster in the government business, slower in the banking business because it is so critical. The OT environment is going to cloud faster because they are kind of coming into this area, and they start often from a clean slate or start by taking down parts or part of their SCADA infrastructure, and then they see it better to go to cloud immediately. That of course creates the customer the problem that, "Where is my critical data? Do I know it? Who can access it?
Where are the keys?" That's where we can help our customers to manage their data and tighten the screws that they know who, what, when, just enough access, just in time access. Last, you click once more. Cloud and SaaS are coming. I think more and more our competitors are going to cloud. We are also supporting cloud environments in some of the products, but for example, for PrivX, the demand for pure SaaS solution is not there because biggest part of our customers are banking customers, and they want to keep the keys to the kingdom still in their data centers.
Last point that I want to make why we did this thing is that. The endpoint security solutions that have been a big part of security defense is becoming less and less relevant because the security and biometric recognition is going more towards your mobile phone. Biometric recognition comes from there. The Microsoft, Apple, and Android will do the endpoint security. It's more and more going to the cloud access. Traditional PAM, traditional endpoint security will reduce in importance. Of course, the transition will take time. I was talking with one of our government customer the other week, and we were talking about the Zero Trust Suite approach.
They said, "Yeah, we've heard the same from other technology companies, we will still buy firewall." It will be a long way, since we are a communications security company, I think we are in good position to position as a early adapter enabling secure cloud access to a multi-cloud and hybrid environments. If we go then to our portfolio focus, we do three things. Zero Trust, which is basically passwordless, keyless, borderless solutions based on the PrivX platform in our... Did I only lose the slide, Lauri? Yep.
Zero Trust solutions are available for all our product lines, and it enables hiding passwords, hiding SSH keys, managing them, that you get to a world of no passwords, no SSH keys that you can steal, and you can run safely in a borderless world where there is no difference between internal network and external network. OT side, I must say that we have been, over the last 18 months, been well received in the European market with different machine builders and other operational technology solutions, partially still impacted by the geopolitical situation in Ukraine because people have understood that life is not so nice if we don't have electricity, water, and heating. That's why a lot of basic infrastructure is now ramping up their cybersecurity protection so that the enemy cannot remotely shut down the facilities.
These two ones are really carrying us forward. The Quantum-Safe is where we do a lot of work on educating customers, showing the products, because we have Quantum-Safe products which are using the protocols that so far has been standardized, and we are well equipped to ride that wave. At this point of time, the market, our customers are making their Quantum-Safe strategies. The work is more on the early cycle business like consultants. We estimate that Quantum-Safe will be medium to long-term a big differentiator for our total Zero Trust Suite. For the outlook, it's early in the year, and we keep the co-guidance that we have said, and I think we are on a stable base to continue our profitable growth. With these words, I hand it over back to Lauri.
Maybe Lauri, you could go through the questions.
Definitely. Thank you. Sorry for little slide dance. There was some automation forgotten. Now we have questions coming, and let's start as a tradition from Fredrik. Please, Fredrik, you can ask your question.
Good morning. Hi, Teemu and Mikael, and thank you for the presentation. First, I have a couple of questions regarding the products. Can you give an indication how much PrivX grew in the quarter?
Not from my top of my head. It's actually a little bit difficult to say because if you compare quarter- to- quarter or year- to- year, it's different because our Q4 was so good for PrivX.
Mm.
Of course, the revenue continues to grow basically on the deals we did last year because they now convert to revenue. Year-over-year, we are doing very well. We were looking for that number, Niklas. Sorry, Mikael, do you remember what was the growth-For PrivX?
Yeah, PrivX sales grew 9% in the first quarter.
Complete-
Quarter- on- quarter or?
Yeah, compared to the first quarter last year.
Okay. Great. Thank you. NQX, have the number of customers increased during the quarter, or are you still... I believe it was, like, six last time, right?
Yeah. I would say that we are now around 10 customers.
Okay.
Most still kind of early implementations and lab use things, so there's a lot of growth potential, but there's a lot to learn for the customer on implementing and operating it, and that's why the ramp up is still slower than I would like to have it.
Okay. Yeah, even though the strong tailwind for cybersecurity demand, it looks like the customers still are hesitant to place orders. We talked about this before, but what do you think will change the sentiment, and maybe most important, when?
Well, future is well-known to be difficult to predict. We have the highest pipeline ever. We haven't gotten, which is normal for first quarter, we haven't gotten any mega deals, but we've gotten still new PrivX deals at the sweet spot levels of around EUR 200,000, so below our limit to publish those deals. I think it's coming. People have a new budget. We have a lot of POCs going on. We have done a lot of marketing efforts now in the first quarter exactly because of our subscription business. We need to get new business in the first half of the year that it has an impact for the full year numbers of 2023.
I am very confident that we will do our best to reel in some big salmons still before midsummer. Of course, the customers buy when the customers buy.
Yes. Then the last question for me. EMEA showed a growth of almost 14%. Which one of your products pushed demand there?
PrivX is the biggest growth in EMEA.
Great. Thank you. That was all for me.
Thank you, Fredrik. Please, more questions, you can raise your hand or write in chat. In chat actually came one question which I assume was addressed just now, but it continued about the PrivX growth. What, how you see overall the future growth of PrivX? Continue question, is the PrivX year-on-year growth only 9%? What has been the main driver in this dramatic slowing of the growth?
First of all, we are still looking at a very granular business because the deals, single deals can be big and then in which quarter they come, they kind of distort the picture. Our average deal size has increased and our span of the deals is has tenfolded. How PrivX will catch up in the second quarter depends on single deals that we are now working on to get the customer order in the second quarter. If we get two of our main deals in, which I think is a good possibility for that, then the growth will return to double-digit numbers. Of course, now that we are ramping up PrivX, the absolute growth is needed more to keep maintaining the growth rate that we have had.
We have strategically, as mentioned before, we have been wanting to work on average deal size growth, which creates then granularity when then the quarters are difficult to compare for a single product, on the, on the dynamics of the business.
Okay. Let's continue with questions which came in advance. Let's start from the question: Where are the Deltagon installments now paid?
Deltagon installments paid, what does it mean?
Where they all?
Yeah, I think I can take that one.
Yeah.
Yeah. The second installment of the Deltagon payments will be made in the second quarter of this year, and the third and final installment will happen in the first half of next year.
Thank you. Next question was, the advances reserved were already quite high in the previous report. They are recognized as revenue on a accrual basis, understood. Why are they not recognized as a lump sum like license fees in general?
Well, maybe I start and then Mikael can continue. Because we've gone to subscription business, the accounting rules tell that as long as we have a delivery responsibility, we will have to spread the income, the invoiced deal, we have to spread it over the extension of the contract, which typically is 1 year, sometimes 3 years, sometimes 5 years. That's why our invoicing has bigger numbers. We kind of create backlog, if we have a 3-year contract, the contract value is spread over the 36 months. On the cash flow side, typically customers pay year- by- year. We get the 1-year subscription cash according to payment terms after the invoice, but it converts only to revenue during flat run rate during the contract period.
One of the reasons for that is why we wanted to go there, because we are very people-heavy business. This way our revenue is more stable, you know, we anyhow have to pay people salaries every month. License deals are difficult because that would create more volatility to the business. You know, depending on how you count it, if we would have sold still everything on the license deals, the company revenue would be EUR tens of millions for sure. We would be really dependent on the quarterly variations. The whole software industry is going to subscription in this sense, and the subscription has the benefit for the customer because some level of R&D, we keep the product alive, and that is important especially in cybersecurity because the hackers become more clever all the time.
That the reason is that since we have the responsibility to keep the product fresh, we cannot recognize all the revenue of the invoice before. We can only recognize it during the invoice, during the contract period.
Thank you. Related to this question, previous question, there is money in the cash box from the prepayments and the cash flow from operations. Why not pay off the expensive hybrid loan from the balance sheet?
Mikael, do you want to take this?
Yeah. Well, I think what we can say is that we are looking actively at all the options, related to the hybrid loan and solutions, in relation to that. We don't have anything we can communicate at the moment with regards to changes in the hybrid loan.
Thank you. The predictability of SSH revenue streams has improved as recurring sales have increased. At the same time, profitable growth at the Rule of 40 levels has been seen. Can we expect a rearrangement in the near future, for example, for a high- intenrest hybrid loan?
Well, I think, Mikael answered the question already. We are actively looking at alternatives. Before the fat lady sings, there is nothing to tell.
Yes. Thank you. I would also ask Teemu question and Mikael to comment on how the company thinks Finland's NATO membership will affect SSH business development growth in the short and medium term.
I would say it will have hopefully significant impact on medium to long term. At the moment, it actually slows down the development because there are new interfaces to be done. There are new protocols that have to be supported. The customers have gone back to drawing board and are adjusting their architecture to be NATO compatible. Again, the work is more on engineering and consulting, not yet on the product sales. It's a good thing, but certainly the good impact is rather medium term, certainly not short term.
Last question was related to this and why are no order accumulating in form of press releases? Is the market situation competitive situation or what? I would think the NATO country, that trade is getting busier. This kind of comment.
Yeah. I kind of answered it already. I think the first quarter of the year is always slow. People get their new budgets and start to plan procurement and, that's why for us first quarter is always slow. We have relatively high limit on doing press releases on new deals, so our deal sizes of the new deals in the first quarter were below that limit. We are very confident that we have built a very solid base to continue the growth during the year.
In the chat is one comment. Sorry to follow up on this, but it is essential since PrivX has in the past been highlighted as one of the key growth drivers for the company, and now the year-over-year growth is 9% compared to previous growth of 100. Have you lost any PrivX customers during the last year? How is the land and expand strategy progressing in PrivX?
We have not lost any customers. PrivX is very stable. It is more dependent on, as I said, for single deals timing, how do you compare the year-over-year thing? We have very many discussions ongoing related to the land and expand things, and we are in negotiations in the U.S., with big customers who have started the rollout with SSH protocol, and now they are adding RDP protocol to their portfolio. PrivX is very well positioned to the land and expand strategy. It will deliver growth with existing customers, and also we are getting more and more UKM customers to want to have PrivX as well as the combination of the Zero Trust Suite.
Thank you. Is there any more questions or comments? There is no more questions in advance. Meaning I think that at this point there will be none. Thank you, dear guests, for participating in our call, for questions and comments. Materials for this call will be available on our webpage later this day. My name is Lauri Koponen, and I am the communication lead here. I thank you for this call, and next we will be reporting on July 20th with Q2 results. Thank you, and have a good rest of the day.
Thank you.
Thank you.