Hello, I'm Mike Maddison, CEO of NCC Group, and along with my colleague, Guy Ellis, the CFO, we are pleased to bring you our full year results for 30 September 2025 in this presentation. I want to start with some important points. First of all, as predicted, this was a year of two halves. We had a challenging first half, as we talked about at our interims on the 19th of June, but as highlighted in our trading update in October, we saw improved performance in the second half. Overall, the results are in line with the board's expectations, and good strategic progress is being made across both the Cyber and the Escode businesses. As a reminder, we have two reviews in progress: the Escode review and the strategic review of the cybersecurity business, which is independent from both the process and the outcome of the Escode review.
Regardless of the outcome of the Escode review, and as announced in our October trading update, we will launch the initial share buyback program once the Escode review concludes. Now, I know you'll have lots of questions, but as a reminder, NCC Group remains in an offer period under the Takeover Code rules. This does restrict what we can say about current trading and the financial outlook for the group. So, with that context, let me give you an overview of our two businesses in FY 2025. For those unfamiliar with the business, let me first provide you with an overview of who NCC Group is. Our strategy recognizes and reflects that we have two distinct businesses. Both operate with the goal of providing increased operational resilience, and while there are some overlapping clients, the buyers and buying cycles are fundamentally different.
Both our businesses provide services to clients where we are a trusted partner, and by that, I mean we support a significant client base at both the enterprise and SME level, and it's in every sector and with a global footprint. We bring deep skills that address compliance issues and/or provide solutions to build cyber resilience. Both of our businesses have multiple growth drivers. In cybersecurity, this relates to the ever-increasing threat landscape, digital adoption, and the shortage of necessary skills to meet these evolving client needs. In Escode, the drivers are linked to regulatory requirements, particularly in the critical infrastructure arena. Our group retains strong financials with an increased mix of recurring revenues and, importantly, an improved balance sheet, which gives us increased optionality, and I'm delighted that our Escode business has now delivered 12 consecutive quarters of growth.
Let me give you some color on each of the businesses in FY 2025. Firstly, let me talk about Escode. The Escode business continues to perform consistently, and I think I've already mentioned this. Delighted to say that we've delivered 12 consecutive quarters of growth. We've continued to execute on our plan for this business consistently. Highlights include we've reorganized the sales structure by industry verticals to deliver deeper sector expertise, create greater value for customers in finance, critical infrastructure, and commercial markets. We've been establishing a new customer acquisition team focused on ideal customer profiles within our growth sectors in the U.K. and also the U.S. market. We've seen an expansion of our software verification offering to include fully independent builds of cloud-hosted solutions, ensuring greater reliability and trust. We've been broadening our regional presence with an extended focus into the Middle East, which we've highlighted previously.
Let me give you the highlights for the cybersecurity business in FY 2025. While the economic conditions are doing us no favors, as I said, this year was one of two halves. It's worth noting that our Technical Assurance services are intrinsically linked to economic conditions, and as a result, customer buying reflects the economic cycle. Despite this, and as Guy will talk to in more detail in his section, we've made good progress against our strategy in FY 2025, and it continued very much in line with the areas we highlighted in June at our trading update. So, those key highlights. We've had investment in strategic sales capability to build deeper relationships in each of our markets. For example, we've put in place market leadership with experience of strategic consultative selling. We've launched client propositions with embedded technology at their heart.
For example, our Continuous Offensive Security service was launched, highlighting our emphasis on moving to increased subscription services as part of our strategy to increase ARR and to build longer-term, more strategic engagements with our clients. The investments we made in Consulting and Implementation services, in particular Operational Technology and information technology convergence, and Identity and Digital Access Management, are generating value, which Guy, again, will highlight in the financials. We've put the foundations in place for an enhanced global account management approach, which will deepen relationships and unlock revenue opportunities, and I really want to emphasize this point. We've put in place a global sales operation capability, and we've improved our management information. This enabled us to highlight the positive deal quote creation trajectory in December 2024, which turned into sales and then into revenue in the second half.
This allowed us to make informed decisions on balancing supply and demand in January as we were confident in the forward look. We've now also fully implemented global scheduling, timesheets, and pricing tools, which is a significant cultural shift within NCC Group. We've also completed the DTACT and Fox Crypto sales, fully separating those businesses and the operational efficiencies that come with it. Now, I'm going to hand over to Guy to bring to life some of these points through the financials, and I'll then talk a little bit more about our strategy and our future focus. Guy, over to you.
Thank you, Mike. Hello, everyone. I want to spend a few minutes to walk through the highlights of the group and both businesses in a bit more detail, linking the outcomes in Mike's strategy and commercial activities through into our financial performance. So, this slide here shows our financial key highlights of the business, excluding Fox Crypto, which we divested of on the 31st of March. So, you can see the underlying performance of the focus cyber and Escode group. Revenue declined by 2.6%, and that's GBP 11.3 million on a YoY basis. Escode continued in growth, and cyber delivered a better performance as we expected in the second half of the year. Gross margin for the group expanded by 0.6 percentage points up year- on- year. That was as a result of Escode stepping forward and cyber remaining broadly consistent.
This was overall a GBP 3.1 million decline in the absolute gross margin cash as a result of the revenue reduction. Actions taken to transform our processes in the back office in year helped reduce the overheads and thus mitigate the GBP 3.1 million reduction in gross margin to a GBP 1.5 million decline at Adjusted EBITDA level. It has been a year of great change in our finance, IT, and HR functions, where we've refocused our resources around the U.K. and Manila operations, and it resulted in a saving of GBP 1.6 million in year and ongoing annualized savings of GBP 4 million. Our operating profits on the bottom left step changed by GBP 41.8 million year- on- year. That brought us to a profit of GBP 22.8 million.
This was in large part due to a GBP 40.9 million reduction in ISI, or Individually ignificant Items charges, but also an underlying improvement in group performance as well of GBP 0.9 million. At the start of the strategy we launched three years ago, the group carried a net debt of GBP 52.4 million. The transformation of the balance sheet has been achieved with excellent cash conversion and the successful refocusing of the cyber business around our four key capabilities and the resultant disposal of our Fox DetACT and Fox Crypto businesses at excellent multiples. This means the group finished FY 2025 with a net cash balance of GBP 13.1 million. This financial robustness and consistency underpin the board's decisions and stated intention to execute a share buyback on the conclusion of the Escode strategic review. Let's go into the numbers in a bit more detail.
This slide shows our group income statement, including Fox Crypto on a statutory basis. Before looking at the two divisions in detail, I'd like to reflect on our delivery against the FY 2025 financial framework objectives that we set out this time last year. The financial framework is anchored around four key pillars: sustaining revenue growth, improving gross margin, delivering efficient cost savings to fund the growth, and maintaining strong capital resources. There are 13 measures which you can see on here, and we've delivered on 11 of them. Mike's already referenced a number of these, so I'll not talk through them in detail, but I'd like to thank all of our colleagues on their efforts to deliver on these. I'm confident we fundamentally are a more operationally and financially robust group, which will help us drive sequential profit growth as we return to revenue growth.
Looking at the businesses in turn, so first of all, in Escode, so this is a consistent slide format you will have seen before. On the top left-hand side, you can see the half-on-half cash revenue performance in each of our three market areas. We had superb years in both the U.K. and Europe, which grew at 5% on a like-for-like basis year on year. North America was slightly down by 0.6%, but has recently returned back into growth following the realignment of the sales teams. Looking at performance at the top right by sales line, so in terms of our contracts performance and verifications, our two main services, we grew in both areas. So Escode contracts grew by 1.2% and verifications by 4%.
Gross margin rose from 68.8% to 71.4% as a consequence of really good operational management and positive returns on investment, and our overhead was reduced by GBP 0.4 million, resulting in an overall Adjusted EBITDA of GBP 30.9 million, up from GBP 28.4 the year before. Let's look at cyber now. So, we saw a better second half revenue performance as we forecasted. This resulted in a full year like-for-like decline of 4%, but we've seen a return to growth in the first quarter of FY 2026. The U.K. delivered a really strong second half. So, the first half of the year inside the U.K. on its own declined by 6%, but the second half grew by 7% up year- on- year, driven by consistent Managed Services growth and performance and outstanding consulting growth. The EU was broadly flat year on year.
And with Fox Crypto and DTACT now fully detangled, we're confident in the refocused EU cyber business is positioned well to continue the returns growth we've seen in the first quarter of FY 2026. After a material half-on-half decline in the first half of last year, the North American business saw stabilization in the second half and has started FY 2026 in growth, albeit, of course, this is far more weighted towards our testing business in North America than Managed Services, consulting, or incident response. Gross margin percentage held broadly flat. We made a conscious decision from a resourcing point of view at the turn of the calendar year when clients' buying cycles in the autumn of 2024 caused a dip in utilization at that time.
We could see strong opportunities and qualified sales opportunities coming through for the remainder of the year in our data, and this gave us the confidence to hold our resourcing levels to support the improvement, which did then come through in the second half. As with Escode, we saw a reduction in overheads in cyber as a result of efficiencies. So, this slide shows our performance across our four capabilities. At the bottom of the page, you can see the revenue by each of them over the last four halves. So, if I start second from the right, Managed Services delivered another year of growth, but the most eye-catching capability was consulting and implementation, which is second from the left, and that grew 16.6% in year and 39% in the second half.
This followed the investments we've made in the prior 12 months, bearing fruit, especially in Identity Access Management and the Operational Technology spaces. Testing, to the left-hand side here, declined sequentially from half one to half two to GBP 42.8 million, but this has seen a return to growth in the first quarter in FY 2026 in all markets, and sales data that we have indicates that the first half should remain in growth. Testing demand is closely tied to the macroeconomic investment environment for our clients, but between 85% and 95% of our testing clients repurchased the following year. Loyalty and retention is strong. It's too early to call this a permanent turning point for testing growth, but it's certainly very encouraging. Now, if I can talk through our net debt bridge. We concluded FY 2022, which was the beginning of Mike's strategy, with a net debt of GBP 54.2 million.
This had reduced to GBP 45.3 million, the far left of this chart at the start of FY 2025. During the last year, we've returned GBP 19 million of cash to shareholders in dividends. This has consisted of GBP 14.6 million for the 12-month period to the end of May 2024, plus GBP 4.6 million for the four-month stub period we had to the end of September 2024. In addition, we purchased GBP 5.8 million of the shares of the employees' trust, demonstrating our conviction in the group's strength and resilience. Overall, the group's net debt of GBP 45.3 million improved by GBP 58.4 million, 56.3% of which was a result of the Fox Crypto disposal, the remaining improvement as a result of really good cash conversion, 96.6%. So then, what does this mean for our financial framework for next year?
So, this slide shows the evolution of our financial framework for FY 2026 and the key levers to drive enhanced shareholder returns. The execution of our strategy over the last three years and the efforts of our colleagues provides a fantastic platform for growth. It's an evolution which, with revenue growth, will convert more efficiently into profit and shareholder growth. And with that, I'm going to hand back to Mike.
Thanks, Guy. I think that really helps to bring to life some of the points I made in the introduction. Now, I just want to spend a few moments building on this and focusing specifically on the cyber business. The team believes that the year 2025 was a pivotal year for the cyber business, and we believe we've demonstrated we will do what we say, and that we have demonstrated the strategy can unlock our potential, positioning us to drive growth going forward. I'll just take a few moments to maybe reflect on where we started. At the beginning of the strategy, we operated a business that was isolated boutiques in siloed regions. We had significant revenue concentration in U.S. major clients, a high reliance on transactional single capability projects globally, duplicate processes, and inefficiency across all of our entities.
We set out a strategy to transform this business, and in the full year 2025, we have unified that global business, simplified the business through disposal of non-core cyber assets, and built a model that includes a global delivery hub in Manila. We've developed entirely new capabilities led by client need, creating market-relevant propositions with technology at the heart, powered by strategic alliances. This is why we are the go-to choice for many of the world's leading companies. To give you a few examples, in the U.S., when F5, a technology company that provides multi-cloud application security and delivery solutions, faced a major breach, they turned to us. We had more than 75 consultants responding as a global team to conduct a security code review of over 100 million lines of code, supporting the client in a very challenging time.
Another example, we were chosen to secure the NATO summit in The Hague recently, not only because of our cooperation with Dutch and international intelligence services, but also because of our client-led approach and our incredibly talented security experts, and most recently, again, a public example, where we were called upon by three London Borough Councils to help them respond and recover from high-profile cyber attacks, collaborating with a broad group of agencies, including the National Cyber Security Centre, the Metropolitan Police Service, and the National Crime Agency. We are seeing momentum from Q4 FY 2025 flow through into the first quarter of this financial year, which gives us great confidence for FY 2026 and beyond to unlock our potential and drive growth, so if I think about FY 2026 and our focus, it remains very much consistent with the execution of our strategy, creating value from the investments we've made.
We now have outstanding capabilities, so we are absolutely focused on driving sales. It's simply about selling more through investing in our go-to-market, which we saw benefits of in FY 2025, with the re-engagements of nearly 200 legacy accounts resuming spending for the first time with us since before the full year 2022, and we had 285 new accounts, which were wins with the average customer spend growing by 5% between 2024 and 2025. We have taken an end-to-end approach on our lead- to- cash redesign and integration of key systems. This is aimed at reducing the admin burden on our sales teams and to increase productivity. We are streamlining processes to simplify our business using technology better. We're continuing to grow our Manila office to support clients both with delivery capacity, but also by expanding our enabling function capability. I've mentioned our focused alliance and technology partners.
We've already seen an increase in partner and portal deal referrals, which increased by 63% between quarter two and quarter three in FY 2025. We're driving efficiency by embedding technology in our delivery approach for our clients. We've deployed technology to automate delivery and reflecting our market-leading thinking with automation and improvements in data flows to bring additional value. To ensure we continue to drive improvements to our focus areas, we've appointed a transformation lead with a view to reducing underlying operating costs, which will be informed by the strategic reviews currently underway. We laid out our strategy and have executed against it despite a difficult external environment that has not been in our favor, but we can control what we can control.
By continuing on our current trajectory, working together, we are already well on our way to create a very different NCC Group that will have the following features: recurring revenue growing through a focus on Managed Services and increasingly as a service cyber solutions. We've already started to see the shift with Technical Assurance services revenue as a proportion of overall revenue, reducing from 60% to 40% in the period FY 2022 to FY 2025, with Managed Services and our consulting and implementation capability rising from 35% to over 55% in that same period. Consulting and implementation services and capability is the mindset that connects our services and capabilities to solve clients' complex problems. Growth in this area is being driven predominantly by operational technology and IT convergence and the investment in identity and access management capability.
Over the last three years, 43% of our overall customers bought more than one service line. However, when consulting colleagues are engaged, that increases to 72% of clients using one or more service line. We will remain renowned as a global leader in regulatory and complex testing and continue to provide, for example, services to the likes of Google and AWS, the capability to undertake public research in emerging technologies. Today, we are recognized by industry analysts, IDC, Forrester, for example, and endorsed by major software players such as Microsoft and Splunk, affirming our standing as one of the leading cybersecurity service providers. Going forward, we will ensure our costs are proportionate to our business, and we've made some great strides in this area and already rationalized our property estate, and we've grown our support functions in Manila, delivering GBP 1.6 million in-year savings with an annualized benefit of GBP 4 million.
We're focused on relationships that drive higher value opportunities. More than half of our FY 2025 cyber revenue comes from our top 100 large accounts, who are typically consistent spenders and purchase across multiple service lines, and of course, we'll be recognized for quality and insights across our whole business. We are playing a leading role in shaping the cyber industry and ecosystem and recognized by the U.K. government in their U.K. industrial policy as exporting world-leading cyber solutions and services around the globe, driven by cutting-edge innovation and trusted expertise. That is quite an endorsement. I was delighted to see recognition of my colleagues when we were named Enterprise Consultancy of the Year at the National Cyber Awards, as well as being named as Splunk's U.K. and Ireland Security Partner of the Year for the second year running.
When I pause and look back, it's clear we've achieved a great deal together. I want to recognize the outstanding contribution of the NCC team in making this happen. Now, there's still a lot more to do, but we should take pride in how far we've come and the momentum we've built. So, in terms of outlook, we are confident in our strategy and the medium-term growth prospects for both businesses. We expect cybersecurity to return to revenue growth in FY 2026, while Escode is projected to deliver single-digit growth. Adjusted EBITDA, excluding non-core disposals, will be in line with board expectations. The Escode review continues and will provide an update in due course. We are in the early stages of a review of all strategic options for the cyber business should the Escode business be sold and no decision has yet been made.
Dividend maintained for FY 2025 and initial share buyback announced. In closing, I would like to thank our colleagues, clients, and partners for their continued trust and support. Together, we are building a stronger, more resilient NCC Group, well-positioned for sustainable growth and long-term success.
Thank you very much. We will now begin the Q&A session. If you would like to ask a question, please click on the control panel at the bottom of your screen and click on the question icon to type them in. Our first question comes from Julian Yates from Investec. Can you outline work being done to reduce churn in Managed Services and also what trends are like in new business wins?
Thanks, Julian. So, let me address, and I think we talked about churn in our previous results where we had seen an uptick. I think, as we said at that time, a bit of our churn was to do with legacy contracts and obviously changing dynamics within technology. What we've done in the recent months is focused very explicitly on ensuring that we have the right hypercare teams to support clients. We have had an ongoing program of engagement with our clients to ensure that we can demonstrate value throughout the contracts. I think there's also an element of, and I think we did again mention this, there has been a degree of consolidation in the market.
We did notice quite an aggressive attempts and some competition in the market where there was, I think we've categorized it as buying contracts, and that resulted in some challenges for some of our competitors, which we were also able to capitalize on. So, overall, I think we've seen a significant improvement in that churn. And also, from a new business perspective, I don't have the numbers to hand, but we are seeing a strong pipeline, which again, our improved MI, which we highlighted in the presentation, is something which gives us far more confidence in the forward look than we perhaps historically have been able to get. So, it gives us some confidence that Managed Services remains a very strong proposition in the market and that we have good forward sight to growth.
Thank you. Next question comes from Craig McDougall from Aurel Capital. Please clarify the quantum and timing of your share buyback program. Will you be buying 10% of issued equity starting immediately? How will the anticipated Escode sale impact future buyback plans?
Good morning, Craig. So, we will start the buyback that we've announced when we're able to, per market regulations, which will be on the conclusion one way or another of the Escode program. We can't start it at the project. We can't start it before that. Our intention is to buy up to 10% of the share capital. And in terms of the impact that an Escode disposal, were that to happen, has on this, it's something the board will consider at that point in time, and we'll look at whether we consider a larger return of capital back to shareholders via one mechanism or another.
Great. Thank you. Next question is from Andrew Ripper at Panmure Liberum. What was cyber organic growth in Q4 2025, and what is it expected to be in Q1 2026? And how much visibility do you have in cyber for the full year?
So, it returned to growth in the final quarter, as it said. In terms of the first quarter, what we've seen is mid-single-digit growth. Obviously, we're not closed yet, but that's where we are fairly confident about finishing up. And we've got line of sight now in our sales data, both in terms of opportunity creation and sales forecast, to be confident that we should be finished the growth in the first half, the first half in growth. So, to put a couple of numbers around that, sales orders growth in the first quarter are in the range of, again, we're not closed, but we're going to be in the range of somewhere between sort of 8%-12% up year- on- year, kind of out of the back of that.
Great. Thank you. Another question from Julian Yates. Can you talk about workforce new hiring or reductions in the differing areas and regions of the cyber business in response to the demand signals and the Manila staff expansion?
That's quite a big question and quite complex. I'd rather not go into specific numbers of changes in workforce by region. I don't have them to hand for one of the primary reasons. But I will talk about how we have used the improved management information and supply-demand matching that we've been able to do to actually drive Manila. One of the fundamental parts of the growth of Manila has been to ensure that we have appropriate development plans for resources in that region to be able to use them in increasing numbers of domains within the cyber business. We also have, from a strategic workforce planning perspective, our propositions have effective models, optimal models for how we deliver those propositions, whether that's digital identity or Managed Services or particular elements of our testing component.
And we build our resources in Manila and the training plans based around that strategic workforce planning. It is very much driven by market demand in the particular regions and the type of work that we're doing. Obviously, there's also particular requirements based upon whether it's national security requirements or whether it be by client preference and requirements for on-site working, which drives the extent to which we have resources in region. And that does vary very much by region, by vertical, and by specific client.
Thank you very much. We currently have no further questions coming in from the webcast, so I'll hand over to you for any closing remarks.
I would just like to say thank you to colleagues for an incredibly challenging year, but I think, demonstrated by our results, a really positive momentum. And what has been a pivotal year, FY 2025, we've delivered some amazing progress against our strategic goals. And again, just highlighting, I think, the consistency that we've been able to demonstrate our execution against our plan, including, for example, the consecutive growth within Escode. So, thank you to colleagues, and thank you very much for joining.