Defense organizations. You know, and being number three in the world is you know, most companies dream about that. We already there. Our products, we have really invested heavily in our products, and they are today, you know, world-class products. They are really, you know, high class. It's the best products in the market. It goes a little bit up and down depending on, you know, how the patches from the mobile vendors apply. We are, we are on the top now. We will hear more about that later on when Tomas comes in. We have really good products, and this is a product business. Our customers, they buy the things that can get the data.
If you can't get the data, if you are, you know, you cover only 75% of the phones or the mobile devices, they will not use your solution. You need to be there at the top, and that's one of the things we changed. We come to the organization. Now, we have done a total makeover of the organization. The management team, I think Tony now, he's the most senior guy in the management team, and he's been in the company for three years, and he's done a fantastic job. You know, many are younger than me. All are younger than me in age, but have been with the company less time than me. We really have a totally different management team.
I think we had the management teams been there a long time. They got stuck. You know, no matter how good you are, after a while, if you've been there for 10 years, you get stuck in your different patterns, you need, you know, change. We've done a lot of change now, it seems to be working really well. We haven't only changed the management team. We have also changed a lot of other people in the organization, we have also changed, you know, how we work, how we do processes, I think we have a really, really good organization working now. It's the best product and R&D organization I ever seen. Ever seen in the companies I've been to. That's an important part, it's also starting to be a better and better sales organization, you know.
Mårten will talk a little bit more about that. He's new, he's already, you know, doing changes that's needed to the organization. That is five reasons, you know, to invest more in MSAB or invest in MSAB. If you look on the market, it's really also, you know, it's growing, at least in needs, you know. We have a lot of more data. The complexity of the device is increasing all the time. It means that the barriers of entry for new players to coming in is, you know, higher and higher and higher. It also means that we, as existing players, you know, have more challenges. There's a lot of regulatory changes that our customers needs to adapt to. You know, the geopolitical things that is happening is also affecting this industry, we have AI.
I think we will see both the positive and the negative impact of AI for us in this industry. I think in essence, we are more protected than, you know, a normal software company because we have a lot of hardware, you know, solutions here or close to hardware solutions. We can have the fruits of, you know, developing faster with AI and so forth. It's gonna have an impact, that's for sure. Mostly, I believe positive impact. Looking at the market, it's a market that doesn't change a lot, you know. We have the biggest player here, an Israeli company, Cellebrite, fairly aggressive. They are the biggest player in the market. They are American, everybody's are from Israel in the company, so we say they are Israeli.
We have Magnet, a North American Canadian company, which we partnering with, but we are also competitors in some cases. They are more specialized on the OS. We have MSAB. Being smaller, having a smaller market share, but are growing. We have the rest. We are, as I said before, the only European player in this aspect, so I think that's a good thing to keep in mind. Who are our customers? What is the industries that we serve? We serve law enforcement, as I said, the police organizations, various law enforcement. It's about 50% of our business. It's a big part. Custom and border, you know, utilize our solutions, utilize our frontline solutions, sits at the airport, checks people that comes, you know.
Without the passport you have a mobile phone, okay, let's check if you really are the one you say that you are and if you're a terrorist and so forth. Military and defense. It's super interesting. We serve the military police. We serve, you know, special ops and so forth with our solutions. Government related is our second biggest. You know, that's where we have all the three letter agencies that use our stuff. We also have a lot of other government cities that use our products then. We have the private sector, very small for us. We are being careful in the private sector because we are under, you know, the we need to act in according to, you know, the European or the American act, you know, how and who we can sell to, the regulations.
If you sell to a private company, you never know where they will use the product or end up. We are very careful with the private sector today. The users, they are investigators and analysts. They are using our software. It can be forensic examiners, you know, doing deep into the technology. It can be frontline personnel in the police station, you know. You can take a witness statement out from the phone. You can be at the airport in the border control. You know, we're being in the front line. It's a kind of unique offering we have also there. Then it says managers, but it's more, you know, the IT tech people that are, you know, setting up the solution, how it should work, and so forth. It's more the IT manager side that use it.
Let's see how it looks for real customer, what they are doing for us. Should come a movie here. While they are fixing this is really about the case in Nevada. It's about child exploitation. We work with CRC, which is the, you know, Child Rescue Coalition, which is a organization that really focus on exploiting children. We work with them, you know, as a part of our sustainability and social response. We, you know, we give them our solutions to really help the police in various cases around, you know. It can be things in the Philippines or in other areas. This is more, you know, a normal case, this is a typical case where police use our solutions. One more time. Here it comes.
In this case, they caught the perpetrator. Another example is the long-term customer for us, the U.K. Counter Terrorism Policing, been using our products for a long time and have prevented a lot of bad things happening with them. There are two examples, but you will hear from a real customer here today, Arnaud that will tell you more. Our ecosystem is really, it looks like this. We have our products, our software. To that, we have a number of services, and then we have, you know, the hardware aligned to that if you have a frontline solution, depending on how you use it. Then we work with a number of selected technology partners. ’Cause in some cases, you want to have information from a vehicle, then we work with Berla. You wanna have it from a PC, we work with Detego.
If you wanna have it from a drone, we work with VTO. It's very similar technology to us, and we can analyze all the stuff, but we need to use the partner technology. Okay. Last but not least, you know, how are we going to grow? What do we see the way we're going to grow going forward? First of all, we see now that we are winning share in existing markets, in the mature markets. This is really the game, you know. All the customers in the Western world, you would say, they have bought the solutions normally from all the major three vendors. You know, we are the smallest one, and we are now growing on each of these customers, you know, by providing the best product in the market. We see that that's happening.
That is one growth avenue we see if you look on a geographical space. We also think emerging markets, for instance, in APAC, in Asia, is super interesting for us. They have more Android devices, which is really, you know, our core, and it hasn't established itself that market yet. It's much bigger opportunity for doing, you know, national wide deals, doing bigger deals, and establish yourself. They are more open, you know, to look at different solutions right now. We think that will be a growth market for us going forward. And it's something we're really focusing on right now. We have military and defense.
What we have sold historically to the military side has been normally, you know, we sell to the military police, or we sell to special unit forces, which go into a country and grab phone and check it. What we see in Ukraine is that they are using our tools, you know, really as an offensive weapon in the field. They grab a soldier's phone, they check, you know, in the front line, okay, where did he sleep last night? How has he moved? What messages has he sent? Then they can shoot in that direction. It becomes a much more offensive weapon. To utilize that even better, we need to do some more investment and development. We think that this would be, you know, a really interesting segment going forward.
It's a lot more licenses to sell if you sell to the whole army rather than to the military police and the special forces. Private. We think that private can be interesting, but only in the way that we want to help identify malware on the phones. You know, if it's been infected, you've been traveling, you wanna check your phone. We think that can be an interesting market. That's something we're looking on. From product side, these two solutions, an easy-to-deploy trial solution for the front line that also goes into the military and the malware detection side that goes into the private. That's, that's really where we see, you know, that growth will come from, growth avenues in the future. We are already growing, but this is, you know, for the future.
With that, I will give you what you really want to see, you know, the numbers from Tony, our CFO. Thank you.
Thank you, Peter. Before starting off this morning's news, the financial goals for the company. I'm Tony Forsgren. I'm the CFO of the company since a little bit over three years. This morning, we released some financial goals. Our long-term targets, they are to serve as guiding targets for the company and our strategic direction through 2030. By year 2030, we are aiming to reach SEK 1 billion, an EBITDA of at least SEK 200 million, at last and not least, a dividend target of between 25%-50% of the net result. The long-term financial goals are forward-looking statements and should not be taken as forecasts. I know you are sitting and calculating already. That said, let's have a look at our financial situation.
Before that, also a little bit of a history. I'm going to present more a forward-looking slideshow here, also talk about a little bit of the history which Peter touched upon. This is our first CMD. We are proud to have it. We feel that we have a stable platform to have it. We didn't have that platform three years ago. We have it today. We are confident in the numbers we are showing internally and externally to the market. We know that MSAB has been hard to follow as a company. We have made huge changes, both in personnel, management, strategic direction, also our systems, ERP systems, product portfolio, price segments, terms and conditions with customers, everything, I can tell you. It's been hard work. We have a stable platform for growth now.
The aim is also to improve our communication with the market. Let's start off with the revenue. This is a tricky one for some. I want to spend some time on explaining how we take the revenue. We sell perpetual licenses. Previously, there wasn't an end to the license. It was really perpetual. We have changed that in our terms and conditions. XRY Pro, our most advanced product, is ending day one if they don't pay the new license. That is not really perpetual. Our biggest product, XRY Logical/Physical, it ends after 12 months of the expiry. It's not really perpetual anymore. That's also gaining the revenues to us.
You can see to the left here, the pie chart, the perpetual and the model we have today, we take 84% of the revenue day 1, and the rest of the 16% is distributed evenly over the contract length. That stands for support, service, and updates of the software. The 100% cash up front is really good for our cash flow. It gets, if you look to the right, really volatile between quarter to quarter in what numbers we present to the market. As you can see in the dark blue colors, it's the half year one. The light blue is half year two. We really do better in half year two, and that follows our customers' budget processes. Also, if you look at the staples between quarter one and quarter one, it gets bumpy.
With that said, we have reliable customers, we have strong cash flow, and I also want to tell you we have a really low churn. I will come back to that. What we have done then, and for the first time presented in this Q1 report for 2026, we have an internal KPI called annual contract value. We have been following that internally for a while to see it, to see the growth, to see stabilization of it, etcetera, and talked and internally, are we going to release this to the market? We feel confident that we did this Q1 report then. What is this annual contract value, and how do we measure it, and how do we calculate it? You can see up to the right again then how we're taking revenue today, SEK 8,416.
If, like in this example, having a one-year contract and extracting the numbers to the annual contract value base that we count, we split it evenly over the 12 months. For each and every contract, this is not real numbers, I can tell you that. This is an example. It's the illustration. For each and every contract that we have, we pull it line by line, year by year, and distribute the revenue in even parts over the contract length. It's a lot of contract, I can tell you that. What did we do then now in March? In the example I'm showing January. What we did, we take a snapshot in March. What is the revenue for every contract that are active this month? We multiply it by 12.
We get the annual value of the active contract base that we have today. We look back one year and see what was the value one year ago. That was what we are presenting in the Q1 report now. This is really following, in some case, the revenue recognition growth, but not, it's not one-to-one, and I will tell you why. As you can see, we grew 38% March this year versus March last year. You can also see we have been flat, and that has also been reflected in our reported revenues for if you exclude 2025 last year, which was a real successful year, look back, it's Forex and FX and stuff like that. We have been flat for like five, six, seven years due to no investments in the company.
This finally, this is not to be compared with what we are reporting in our external report as recognized revenues, and it cannot be bridged. I know we were going to calculate when you come back and try to bridge it to our reports. I can tell you, we have all the facts and the data about contract lengths, the volumes, the price mixes, the FX, the discounts, etcetera. We have all the data and have ourselves tried to bridge it. We cannot do it. We have to see it as a snapshot of the annual contract value today. Since we are selling perpetual licenses, new sales are very important for us. I'll be giving an example now again.
If we have a contract of 100 for a new sale year one, the second year is approximately 55% to 65% of the total value for year one. We really have to fill the bucket with new sales. We do that. We measure and monitor this KPI very closely because we have to bring in more new sales to our business. We do that, and that is showing in the growth. Our goal is to be at least 50% new sales of the total sales. Now we are there. We haven't been there. You see, 2024 wasn't that good, and that showed off in the reported numbers as well. 2025 is really good. Rolling 12 2026, we are still there, 51% in new sales.
As I said, we are following this really close. What is it driven by? It's mainly driven by our product investments and mainly with our outstanding product XRY Pro. I'm following the P&L going down from revenues, now we are at gross margin. We have stabilized our gross margin, that is key driver for scaling our business. Hardware represents a really small cost in our P&L, it's based and attached to our new sale. In the past, we have low margins, unstable gross margins, that was due to pure hardware business with customers. We don't do that anymore. We have stopped that. The seller, to be real honest, they got bonus for selling those hardware. They don't. We don't incentivize it at all.
We are just scaling and cleaning and want to be a pure software company with a high gross margin for scalability. Okay. Costs. OpEx. 77% of our OpEx is personnel costs. As Peter said, it's approximately just above 200 personnel. This really sets a good foundation for not scaling the cost in the same pattern that we scale the growth or the sales. We can do more sales. It doesn't drive. It has no connection, no direct connection to the costs. Maybe if we sell more, we have to have some more support personnel and stuff like that, but it's not driving in the same pattern as we grow with the revenue. We invested in our products. You saw that for the first time last year in the balance sheet. We invested SEK 30 million.
We bought exploits, capabilities to the software externally, which we balanced. We still have an agreement with that vendor, but nowadays we are buying support and updates on the software that we bought last year, and that is taken in OpEx. We explained that in the quarterly report. It cost us SEK 4.7 million quarterly, so close to SEK 20 million in support. As well as we sell support, the 16% we distribute in updates, they sell support to us to maintain the capabilities with our iOS features in XRY Pro, which is really important and really XRY drive the growth. That said, 35% of the total OpEx consists of R&D. Even though we cover all internal R&D costs up front, we can keep OpEx stable. I've been through revenues, gross margin, OpEx.
We come into the scalability. Revenue, gross margin, OpEx summarizes the scalable business model. The platform is established now. We haven't had it before. Now it's established, it's highly scalable. According to our strategies, we want to expand in emerging markets, new verticals, and gaining market share. Also new sales, as I mentioned before, and upgrades in current licenses. The base for that is XRY Pro, which has a price point of 4x versus the XRY Logical/Physical. That said, 2026, it's somewhat an investment year. We will grow in sales, we will also continue to invest in products and know-how personnel. However, this is an investment year. Our EBIT is planned to be at least on par with last year. Maybe a little bit of growth in EBIT as well, even though it's an investment year. Yeah, cash conversion.
We have a really strong cash conversion case here. This results in average 86% in cash conversions ratio between year 2021 to 2025. Nowadays we have a good and stabilized DSO, day sales outstanding, which is important for us and the cash. We have a light and debt-free balance sheet. We receive payments upfront, resulting in strong cash flow generation. Investments, as you can see, started off in 2025 and are going to continue. Finally, my last slide, capital allocation. The diagram to the left is just for illustration, so no calculation here. What we did before 2024 was the capital allocation. We have been handing out dividend. We have been handing out dividend to the shareholders in average with a 109% between year 2022 and 2024 in payout ratio.
The proposed for the annual general meeting next week is 60% of net result then. Annual dividend is brought from 2024 and in history. We shifted in 2025 to a growth journey. We started to invest. We will keep on investing. Looking this year, 2026 and going forward, we will keep on investing. We will keep on giving dividend to our shareholders. We will also look into M&A. This is where we're going to spend our money going forward. With that said, thank you very much.
Thank you, Tony. Please stay. Peter, will you please join us for a few questions?
Hi, Peter.
Okay, maybe let's begin with growth in APAC. Asia Pacific is a big focus, but still a smaller part. What gives you confidence you can really scale there?
As I said, it's not really, you know, it is an emerging market in every way, it's an open game, I would say. It's more about, you know, the best supplier can be in a lot of big business. That's one reason. The other reason is that they are more Android-focused, and I think we have, you know, we are on par with iOS, but when it comes to Android we are really, you know, outstanding. That's the other thing that makes us win those deals. I think that is the main reasons.
All right. What's the, I mean, what's the main risk in the execution?
The main risk, I think it's, those markets are You never know how the sales processes will end. You know. It's, it's kind of a, it's a market far away with different politics and different ways of doing. I think that is the risk. We have some really good sales people and organization down there, so far we've been able to manage that risk.
Okay. Just to make sure we don't miss anything, how do you see the U.S. market, and what's your biggest challenge over there?
I think we have a challenge in the U.S. market as well as others have with, you know, the current political situation that's been in the U.S., which has really, you know, made it difficult to allocate budgets. I think now that starts to happen. Also it's been a lot of changes in staff and, so, you know, you don't even know who to contact. People don't know what they can do. I think it's been a turmoil in the U.S. the last year. That is difficult to handle for everybody. I hear this from also the competition. Of course, you can get renewals, but, you know, getting new business has been difficult. We see that that starts to change now. The U.S. market is super important for us.
It is a big market for us, the geopolitical situation needs to kind of stabilize. I mean, when President Trump came, we thought he would invest, you know, heavily everywhere where we are important. Police, ICE is one of our biggest customers, for instance, on the software side. He didn't do that. He tripled the ICE budget, he cut the IT budget in half, you know. It's been difficult, you know, to predict what would happen. It starts to stabilize. I think we will see some good development this year.
Yeah. Okay.
We still grow last year in local.
Good to hear. Let's move on to competition. Let's say your competitors have more scale.
That's true.
How do you catch up?
We don't. I mean,
How?
It's. Yeah, we can't scale as they do because they are bigger than we are. What we need to do is to focus on what we do better. We are more adaptable, so we can be much more adaptable as, for instance, with AI you need to adapt. It's much more difficult to, you know, turn around with a big ship than a smaller ship. So far also when we look on it, where they. If you look on the product side, we are really keeping up. We don't see that they produce better stuff than we do with the organization we have. On that side, and that is really key, we are keeping up. Of course they have more salespeople, but they also need to pull in a lot more revenues to keep the position.
We see we are growing, faster than they are right now. To keep on doing that, we need to be smarter, better, and more adaptable.
Okay. Now let's talk a little bit about this year. It's an investment year. How should investors think about the near-term impact exactly? Maybe Tony?
Peter, I follow you.
Yeah. It's an investment year. We keep on investing, so there will be some investments during this year. Maybe you should not exaggerate the investments that we will do. We still think, you know, that we will have a healthy profit. We think if we grow the business as planned, we will grow also the profits. It's not like we, you know, will invest, you know, so we will take the costs, you know, to a higher level. It's not the scalability that I want in the company this year. That will come next year.
The revenues, When will it come?
The revenues will come this year, will also come next year. This year we will also grow the cost, you know, a little bit more than we will the year after in proportion to the revenues.
All right.
We will scale, but we will not scale as much as we should.
A little one adding to that, investments is new for us, this company. We started invested. Looking at the numbers of investments we do, it's a small portion to the business to drive, and it gives a really good return. That's what we're talking about when we're talking about investment, smart investments.
All right. This question maybe is for you, Tony. You're introducing ACV. Just to be clear, what does it tell us that metrics didn't, and why is that so important? Could you explain that?
I think it's important for us to describe to the market how the underlying business is going. That is not told by the revenue recognition report in the, in the annual, in the, in the QR reports and the annual report. The underlying growth is really on the active contract base. That is really growing. We saw good efforts in revenues in Q3, Q4 last year. We did almost 50% organically in Q1 2026, even though it's in lower numbers than the half year two. We're really growing the base. That is not reflected at the same, in the same way in the revenue recognition since we're taking 84% day one. If we sign a three-year contract, we take 84% day one. We don't see so much revenue for three years.
If we distribute it evenly over the contract length, you can see the underlying contract base.
How-
Not churned.
Yeah.
I'll be back to the churn then. I will tell you, we have a churn between 0.5% to 2.5% in value each and every month, so always below 3%.
How can I, as an investor, use ACV?
Yeah, you can have it as a metric, a snapshot on what is the actual, like, contract base today, this month.
Okay. Not the future revenues?
No.
Okay. Maybe we start with some questions, if we have any questions from the audience. We have a mic. Kim, could you?
Yep. Here we go.
Please go ahead.
Yeah. Thank you for a good presentation. Okay, I have two questions. First one, how long is the average length of the contracts? The second one, in, when you're talking about investments, what exactly is it that you're meaning? Is it in staff or is it software development seen as CapEx?
Yeah.
Is it something else?
The average contract lengths we have been working on, we have been working on shortening the average contract lengths. It sounds strange, but since we don't have a churn, we want to have shorter contracts to gain the price increase we do on a yearly basis. Because if we sell a three-year contract, we lock down the price for three years. If we do it annually for thre years, we have a price increase an average of 10%, so we're gaining more revenue. The annual contract length is 17.6 months today. It's been closer to two years before, 17.6 months today. Investments, we are investing in capabilities in our products, which you saw last year in the balance sheet, and now we're told it's approximately SEK 20 million in the OpEx for running that service.
We're also investing in personnel this year. We are increasing personnel with approximately 15 FTEs this year. When we're done that in 2026, as looking of today, Peter, correct me if I'm wrong, we see we will not do it in the same pace. We will also monitor in AI and see what brings to the organization, and we will scale.
Yeah. That's right. A lot of investments this year goes into the sales and marketing side.
Yes
as well.
Okay. Well, I think we had some more question.
Magnet is number two, isn't it?
Yes.
Didn't you say that you partner sometimes with Magnet?
We do.
In what respect?
There are customers that, you know, can buy a solution where they use Magnet, for instance, for iOS. They use us for Android, and so they use that. We have a package like that.
Okay.
That some customers-
S- s- so-
Which I can't give the name of.
No. They are not strong on Android?
They are capable on a Android, but customers thinks we are stronger.
Okay. Another question. The information you find within the phone, but if the information transform to the cloud, what do you say about that?
Yeah, what do I say about that? First of all, it's not we who find the information, it's our customers. We don't, you know.
No
check any information.
No.
Today, what you have is normally a mix between mobile data and cloud data.
Okay.
What we help our customers with is, for instance, to find the password to the cloud service.
Okay.
We, and that's normally in the phone, you know. If we can use our tool, the RAMalyzer for instance, which checks the ROM memory of the phone, we can find the password to, for instance, yeah, WhatsApp in the cloud.
Then we can give that to our customer, or the customer can use that then to access the data in the cloud.
If everything is in the cloud and nothing is on the mobile phone, that is not the case. I think it's going in, you know. It will be a mix.
Um-
Today it's a mix?
Yeah, today it's a.
Okay
I think it will continue to be a mix.
Thank you.
All right. Thank you. I think we have to leave it there. Thank you, gentlemen. Let's take a short break and we will be back in 20 minutes.
Yeah. Also, you know, if you have more questions, talk to Tony and me in the breaks or in the lunch or wherever. Whenever. Thank you.
Thank you.
[Break]
[Presentation]
Welcome back, everyone. Hope you had a good break. We'll now continue the program with a session on market and customer presented by Mårten Blixt. With that, Mårten, the floor is yours.
Hi, everyone. Really, really happy to meet all of you here today. My name is Mårten Blixt, and I'm the Chief Commercial Officer here at MSAB. I'm actually quite new to the business. I started three months ago in beginning of February, but I'm super excited and happy to what I've been seeing and be part of this transformation and growth journey that we have ahead of us. What I've seen during my brief tenure here is that we have a growing market, a proven product, and a commercial organization that is really ready to scale. Let's start looking at the market, how it looks today, and what are the main growth drivers. First of all, it is a market with strong structural tailwinds that really plays to our advantage for MSAB.
Some of the growth drivers that we're seeing is, of course, the data explosion. I'm not just talking about number of volume of devices, I'm talking about the pure volume within each devices. We're not talking about gigabytes and megabytes any longer. We're talking about terabytes within each of the phones. Secondly, it's the encryption and complexity. It's getting harder and harder to actually extract the information from each of the devices. Thirdly, the geopolitical realignment. We're seeing increased need from customers that are looking for trustworthy European and with long-term experience in the field. Last, the AI-enabled workflow that we're seeing entering our space as well. As Peter and Tony are saying, the size of our company, our adaptability, and flexibility makes it easier for us to incorporate and implement AI in many parts of our product and organizational workflow.
If we look at the competitive landscape, you saw this pie chart from Peter's presentation before, but I'd like to digest a little bit what it means to us and how it plays to our favor that we are the runner-up in this game. First of all, it's a stable three-vendor race, and as Tony talked about, the churn in the market is super low, and it's hard for competitors outside of the top three to enter this space. Secondly, it's clear that no vendor rules them all, so you actually need all of the top three to solve these cases, and that's highly placed to our advantage, where we have now an extremely potent product and are able to grow and take market share. What I've been seeing is also our fantastic complete offering from frontline to the digital lab.
We have a really compelling competitive advantage, where we cover the entire customer’s workflow in multiple different customer use cases. Last but not least, being in sales the larger part of my life, what I’ve seen with our existing accounts, the number of accounts that we have to grow and penetrate within, sell more number of licenses, sell more products, and also sell the complete end-to-end offering. That is one major growth lever we have that plays to our advantage. Secondly, the emerging markets. When I’ve been out meeting customers all over the world during this brief tenure, I’ve seen the need, and they’re building up their forensics labs, their frontline offices, for the first time, and they really need someone like MSAB to lean upon doing so. Why are customers choosing us then?
There are multiple reasons, but I tried to dissect some of them. First of all, we're European and trusted. We're Swedish-listed and European-headquartered, and it plays to our advantage when it comes to being compliant with all European data regulations out there. Secondly, our frontline advantage. There is a clear trend and a theme where a police officer and law enforcement wants to solve the crime closer to where the crime has been committed. The use case and how you use our product is a little bit different there. We, thanks to the product and development team, have a really potent product to address that specific need. It's a clear differentiation compared to some of our competitors that we have this complete end-to-end workflow. Thirdly, our global footprint.
As Peter is saying, we have customers in over 100 different countries, and we have local representation in all of the major geos, Americas, Europe, and Asia Pacific. I'll talk a little bit more about the products, but our complete product portfolio is extremely interesting and rewarding and add value to the customers. We are having the right product at the right time. I'll talk more about XRY Pro, XAMN, and Unify in a slide or two. Who do we serve today? Peter talked about the various customer types, law enforcement, government, military, and defense, and here you have an understanding of the coverage. Looking at public safety, that is definitely our heritage, our DNA, and a core in our offering. Civil government is expanding.
Governmental agencies, central intelligence, it's an area of interest for us which we believe is going to grow significantly in the years to come. Private sector is a sensitive topic, as Peter mentioned. We want to make sure that our product is being used for the right reasons, definitely. There's also a clear wide space for us. Our competitors are there, we want a piece of that lunch. There's a clear wide space opportunities, it doesn't really do any major changes from the product point of view. That's an area we want to tap into, definitely. The beauty of this, if I was an investor, is that we don't depend on one single customer. We are bred quite broadly. We are not depending on one single product.
The product evolution, as Tomas will show you later on, is really, really compelling, and the feedback we're getting from customers are super positive. What are then the products we're selling? I just want to take you through some of it on the high level. We have our XRY product. To make it easier, it's the product we're using when we have a mobile phone that is unlocked. Secondly, the upgrade and the growth journey we've had over the last couple of quarters is our XRY Pro. We're talking about more advanced capabilities. We're talking about not only Android, we're talking about iOS. We're not just Samsung, but also Apple. It's when you need to enter locked phones, and we're talking about password lengths that are severely long.
We do brute forcing to make sure that we really can extract the full file system from these mobile phones. We have XAMN. It's where you do the analytics part. When you extract the data from a mobile phone, and there are thousands of chat messages or pictures, and you want to find this image with a gun or with a certain individual. Our tool and analytics to find this information is best of the best. Last, but definitely not least, Unify. The product is to be used to collaborate. When I've been talking to some law enforcement today, they're using USB sticks. They're having hard drive, SD drives to send and share, and it's highly vulnerable.
Unify helps agencies across the world and across and within the agency to collaborate, share, and reduce significant time and money as they solve these type of crimes. I'd like to take you through how a typical deals comes together. I thought that it could be an interesting way for you to understand and to see. Starting with the law enforcement here, and to make it easier or simpler to understand, it's pretty much two-fold. One, we have the law enforcement and the lab community, and second, you have the frontline police. Of course, their use cases is vastly different. Here, we're doing complex case extractions in the lab to a very fast triage need in the frontline police officers.
We're leading with XRY Pro and XAMN and Unify within the lab, they're using our tools as XRY Pro Express or kiosks in the frontline. Looking at our customs and border agencies, as Peter mentioned, they have a very short period of time when they have and detain an individual in the border. They are talking about minutes that they need to extract information and take a quick decision, should we keep this individual or not? Using our XRY Express and kiosk solutions with built-in workflow to support the agent at hand to make a fast and right decision. Secondly, the military and defense units. We're talking about defense-grade triage solutions that are military adjusted and adapted.
We're talking about rugged, also hardware, but also again, when you're being shot at, you need to make sure to take quick and easy and correct decisions. We have a similar use case as the law enforcement, so some on the analytic side on the military, but definitely on the frontline police and the more offense part, as Peter's also mentioning. Last but not least, the enterprise space. Here we talk about, you know, corporate security, insurance companies, banks, et cetera. They're mostly often are working with mobile phones that are unlocked, so we lead with XRY Pro, and some other part of our offerings as well. The beauty in this is that we have both the breadth as well as the depth in each of our customer segments that we're focusing on.
From sales, what we have been working on and will be working on is to make sure that we have a really structured way of going to market in each of these verticals, and that we support sales as well as our partners ensuring that we push and lead the sales journey. We adapted our sales journey to the customer buying cycle. Who is our audience? What are they looking for? How are we selling to it? We're following it to identify, qualify, evaluate, procure, and then deploy solutions. We're a structured way of adapting into each of these customer segments. Where does the growth sits? I have taken the 2025 revenue results from MSAB's last year and tried to dissect what is driving growth in each of the geos, and what is our focus within.
Starting with our foundation market, EMEA, representing 4% of the total revenue. We see a clear growth driver where they're favoring European-first vendors. It's perfect match to us. We're seeing increased budget coming from defense and border controls, and we're seeing a modernization going on, when again, more into the frontline use cases, as I talked about. Our focus will replicate the growth pattern we're seeing in Europe, and we play that to fit our strength in the business. Government and defense border use cases, so we're building up a repository on that to make sure that we attract and we're easy to understand what we're doing and how we're solving each of these use cases. More importantly, EMEA is our foundation market.
Here's where we have the largest number of existing accounts, and we have a massive opportunity to grow within each of the existing accounts. Upgrade to XRY Pro, move over to XAMN, and then the full suite with Unify. They need it, and they need it badly. Secondly, Americas, our scaling market. What's driving growth there? Well, it's the largest digital forensics market in the world. We need to be there. We need to actively proceed with new customer wins there. There is a trend of growing federal investments in the market, as well as within the Americas regions, we have LATAM as a geography that is untapped and super exciting to be part of. Our focus, we need to be there when we're being evaluated in each of these cases.
We have done account mapping with every single of our competitors, so we know when the renewal is up, what is installed, what are the price mechanisms, and we want to be part of that evaluation process for sure. Secondly, the federal enterprise deployments. Here is a classic land and expand, but we know who is being funded. We want to be part of those conversations, and the team is really aligned and set up to be part of this growth trajectory onwards. Last, LATAM, of course, been part of the growth channel. I can just say that we had two weeks ago, we had a partner event in Athens where we had 70 partners from over 40 countries.
The feedback from those partners on a grade 0 to 5, and 5 was the best, the average score was 4.9. That is a beauty for me to see that what we are showing, what we are talking about to the customers, how the product development that the investments has been doing over time is being perceived from the customers as, more importantly in this case, from the partners' projective. Last but definitely not least, APAC, the emerging market. You investors, you have seen the growth trajectory we are on to in that market, and we feel extremely excited based on the conversations we are having in the region. It is the fastest growing region in the world as in regards for the forensics market. Many of these customers, they are building their forensics labs for the very first time, and they need someone trustworthy.
They're looking for, really love a European supplier. As Peter was saying as well, Android play to our strength in that area. Coming in as new, I like to challenge the Android piece at least. That's a definite strength for us, but that won't be enough if we're gonna reach the 1 billion in 2030. We need to be as potent and as skilled in Android as iOS as well. The conversation I've seen so far, it seems very promising. Focusing on APAC, we have a direct sales force focusing on the more direct markets like Japan and Australia, and in the other markets, we're working with our extended arm in our partner ecosystem. When I've been looking through the entire global market, I've identified three engines of growth, and those are focusing on where we're strong.
We have 1,000 customers in 100 countries. Three priorities. Number one, upgrade, get every single one of our XRY customers up to XRY Pro, and we know the value they will seen from this upgrade. Secondly, more seats. Once they're in, once they're hooked, once they see the beauty of our technology and the results from these extractions we're supporting them on, we're gonna spread within the agencies. Thirdly, the development that we have done in XAMN and Unify move from just one product to more products to the full platform suite. It's exciting times to speak to our existing customer and see their feedback to us. Second growth engine, new markets. I have to say that I'm super impressed that in every single geo we're in, we're having emerging markets. We're having new markets, even in Europe. APAC, you know, again, fastest-growing region.
The response we're seeing extremely positive. Americas, Latin America, some of the largest deal we closed in Q1, as well as we're working on for Q2, will come from LATAM market. Super interesting and nice to see. EMEA, yes, we have some mature markets, the Nordics, U.K., the DACH region, France, to mention a few, the Netherlands as well. There are other countries outside of Europe that are really, really interested in of working with us, and we're definitely targeting those markets as well. Last, but definitely not least, we have been talking about verticals as a highly important part of the puzzle, and I'd like to mention three verticals. First, the trend we're seeing with the frontline police, that's definitely something that we are different compared to our competitors.
It's a huge political use case because the labs currently, they're being overflown and drowning with lots of devices. We can solve and reduce that workload by solve the crime, closer to the crime is committed, we're making a huge impact. We're reducing efforts on the forensics digital labs. Secondly, the military and defense, it's a great market for us. Our focus here will be to make sure that we are structured in the way we go to that market. There's a different vocabulary and how we're penetrating those market. We have the product, we have the technology, and we have the resources of translating those messages. The same really is for enterprise. Definitely wide space for us. We're definitely going after that market as well.
Three engines of growth leads up to some sort of a conclusion. Where do we go from here? Well, as a summary from my point of view, the market and the market drivers that I spoke to you about before really plays to our advantage: local supplier, trustworthy, and our capabilities around frontline. Secondly, our customer base. Thousands customers spread over 100 countries. That's a massive opportunity for us to go deeper and wider within, plus the opportunities we have in the emerging markets. Last, and absolutely not least, three months in, the commercial transformation is prioritized, it is resourced. We know what to do. The market is moving, and we for sure are doing so as well. Don't take my word for it.
The best thing we learn and evolve as an organization is by working close in relationship to our customers, and it's with great pleasure that I'm introducing Arnaud from the France law enforcement, who will take us through his views from a daily forensics operations in one of the largest police forces in the world. Please put your hands together and make Mr. Arnaud Bristielle welcome. Coming all the way from France, we're so happy to have you here. Arnaud, welcome.
Thank you very much. Thank you very much for inviting me. I will today try to share with you the use that I made of the MSAB solution with a small presentation. I will start by introducing myself and the main mission that I handle, make a quick overview of the digital forensics, okay? Then show you how MSAB enable our mission with a case study. I'm Sergeant Major in the French Gendarmerie. I work as digital forensics investigator. I have 23 years of experience in law enforcement, and I've spent 16 years in digital forensics. My main mission in order of involvement, forensic analysis of digital devices such as computer, mobile phone, IoTs, USB stick storage, anything with digital data on it. Support to search operation.
We go every week on field to help to our colleague to perform a search operation to detect the device and identify them. We provide technical assistance to the investigation when my colleague have difficulties to find evidences, or when they don't know how they can find evidence in the cloud or in internet before we are going to the arrest phase. We'll help them to gather information. I will also perform technical monitoring and process adaptation. You know, we are in a moving field. Every day there is a new solution, new application, new hardware, so you need to stay sharp and to always be looking for the new things. I'll also train and transfer knowledge to the front investigator to help them to get the data on field.
I work. The main type of offenses that I handle are on the upper end of the spectrum. Most of them are rape and sexual assault against minor, offenses related to Child Sexual Abuse Material, so downloading video and photos with children on it, serious crime like homicide, very violent crime, things like that, and also organized crime, drug trafficking and theft and things like that. Rape and offenses related to child sexual abuse are 80%-85% the case we handle. We are involved during all the investigation. During the initial investigation, we support field investigator, as I said, to the digital investigation, looking for I don't know, IP address, things like that.
Help them to interpret data provided by site like Facebook or things like that, as they collect sometimes quite a lot of data. We help them to sort them and find what is important. During the arrest and search operation, we will go on field. That's real photo from case we are handling. We are there to identify devices, okay? Sometimes for a field investigator that seems not important or sometimes too old, we go there and say, "No, we can find evidence on that. We need to take it to the lab." We also put the devices in the right condition. If you need to, especially with mobile devices, you need to perform some things on field to be able to extract the data later.
We are there to do that. After the arrest of the guy. During the police custody phase, we will deploy labs in the unit we are assisting to quickly uncover the initial evidences so the judge can in the first hour take decision against the perpetrator. During the follow-up investigation, when the case is a bit complex or we have some issues with the devices, we will go to the lab and we will sometimes disassembly a computer to get the hard drive, or sometime change part on mobile phone because on this case, the USB port was not working. Without USB port, we cannot extract data. We ask for spare devices. We switch the component.
In this case, I was able to recover the bullet shot by a guy, so we can try to extract the data from the phone later by replacing some part on it. A quick digital forensic overview. When is digital evidence important? Almost every crime leaves a digital trace. In violent crime, we are looking for location, pictures and video. We have often people who are filming or taking picture of aggression or violent crime on the street. Child exploitation. For child exploitation, we are looking for, of course, media, but also internet navigation, messaging, and things like that. Cybercrime, we're looking for hacking tools, ransomware, tools for phishing, and other stuff. For drug trafficking, communication, location.
Financial crime, you are looking for spreadsheet, mail, and things, and so on. Why is digital evidence crucial in front of court? Those are facts, not opinion. It's based on data, not on human memory, okay? You can, it's very difficult to remember something precisely, one or two years before. In phone, it's not a problem. The data will stay as the same. It's persistent because the data can remain for years, sometimes over decades. If, for example, you have rape videos stored on a whole hard drive, the hard drive stays in a shelf or something like that. 10 years later, the data is always on. We just need to plug the hard drive in, and we can get the information.
There is a massive data collection, especially since the introduction of smartphones. Your smartphone is, for a user, don't remember the things. Excuse me, I'm French. No. To help you to get more from your phone, your data will store a lot of information like location, the way you type on your keyboard, some thumbnails, and things like that. These, there is a very large number of data collection, so it's very interesting for us. It's often, invisible to user because in the mobile devices, you are not, you don't have access to all the data of your phone. If you are using, for example, a Windows, you can go to the Windows folder and see what's inside.
You cannot do that on an Android phone or in an iOS phone. A lot of the data is invisible. Even if you delete things, for example, you can delete picture you made from a crime scene or things like that. You go on the bin, okay, it's completely deleted. You think that, we are able to recover some thumbnails or things like that in the system side. What challenge we faced in the mobile forensics? During the acquisition phase, we have more and more device locking and encryption, it's so very difficult to get the data. We need tools for that. We have no administrative access. Even if I have the password of the phone, I'm like user. I cannot go in the system files.
I cannot go in the system folder, so I cannot find directly the hidden traces, the hidden evidences. I need a tool. As I just said, most of this data are hidden or inaccessible. During the analysis phase, as we have a massive data volume, it is usual to get 2 million pictures on a phone extraction. That is pretty common. That is the same for location, message, and things like that. Many, many data are stored in a way that is not human readable. Before you can interpret the data, you need to process them to decode them, so you can work on it. The structure of the data is continuously evolving.
You can see on your phone, you have regularly new version of your application, you need to stay sharp and to be up to date. It's difficult when you are in front end. That's the reason why we need tools. I will share with you a case study. It should have some difficult thing to hear. I prefer to say that before I start. This case study is very recent. I've handled it in the late March 2006. For at first solicitation of a minor, during the investigation, we discover sexual assault involving a minor. The initial findings. The suspect is a school bus driver. He's 30 years old.
Nothing, no particular background. He's accused of sending inappropriate message to a girl aged to 12 to 14 that he transported. At first, he asked the number of the young girl to say, "Okay, I can tell you when I'm late or when I am in advance, so you don't need to wait in the rain." Then he say, "Oh, you were cute today. I want to hug you. Do you like me? Maybe we can see each other outside," and things like that. The message were deleted by the victims, and we were not able to recover those messages because the lack of space of disk space available on the device.
As the victim's phones was, have a very few storage, the data were erased and replaced by other one. We decide to put, to go on early morning arrest at the suspect's residence, 6:00 A.M. We cannot go earlier. To use the surprise to prevent the evidence deletion. We always said, at 6:00 A.M., when the police knock on your door, your brain juice is not fresh yet, so you don't have, you know, you don't have all the things aligned. The goal was to place the guy in the police custody for interview, seize all these devices, and during the custodies, proceed to the examination to find some evidence.
We do that even though it we think it's he's innocent because if you think he's, you don't have a lot of element against this guy, and you don't put everything on it, you don't take this seriously, you cannot say that he's innocent. Maybe there is, there will be people who said, "No, you are not innocent." The police didn't put all the effort to catch you. They lost you. Okay. During the arrest phase, the suspect took 10 minutes to open the door. As we don't have a lot of element, we didn't break the door. Okay. When we tell him why we are there, he show no sign of surprise at all.
In fact, he tells me, "Okay, I understand, but she got no evidence." That's really not the way an innocent people tells you. No. Okay. Even he said that way, "Okay. Well, we'll see that." We found one device on him. Okay. He give us immediately the passcode, and we can continue our investigation. We didn't know that he was a single father of a five-year-old son, so we handed this young boy to the family, so they can take care of him during the custody of the father. It's important for later. Okay. After the arresting, we during the search phase, we found a second phone on the bedroom, power on, locked, and charging on the bedside.
The suspect appeared suddenly very uncomfortable and said, "I don't have the code of the I don't use this phone anymore. I don't have the PIN code." Say, "That's quite strange. I don't have a cell phone plugged, powered on my bedside, and I don't remember the code," especially if it's my old phone. Most of the people keep the same passcode on the two phone, but that was not the case. It was not the same passcode. Say, "That's not a problem." We will handle that later. We will end the search operation. The first phone analysis, we perform a full data extraction, using MSAB XRY Pro, including system data that's not accessible to the user.
And I was able to say that the, he deleted a folder at 6:05 A.M . We knocked on the, uh, 6:00 A.M. , and he opened at 6:10 A.M. , just before, uh, he was arrested. Over two hundred CSAM file, uh, in this, um, in this deleted folder. Uh, videos, uh, es- m- uh, most of this, of this file were videos with children between eighteen months to eight years old, okay, having sex with an adult that he get from Internet. And Snapchat conversation with the victims for the reason, uh, the reason why we are at first there. So we recover on his phone the deleted conversation. The most important, uh, the most interesting thing were on the second phone. On the second phone, we were able to unlock the devices using, uh, using MSAB XRY Pro.
Full data extraction performed as well, including data, system data and user data. We found evidence of the father sexually abusing his son. More than 20 videos recorded on the devices. As I said before, his brain juice was a little bit fresh, but not fresh enough to think about the second phone. Maybe he thought that we will not search this one. In conclusion, effective tactics and tools enabled to recover data, deleted evidences related to the initial case, okay. We got the messages and messages with other little girl. Uncover intrafamilial sex sexual abuse. After that, we can safeguard the five-year-old boy to his family. The father was directly in jail waiting for his trial, all within 48 hour, so in something very quick.
Imagine, when you arrive and, you know that the children were abused, to be so effective in the term of a timeline is very, very important. Thank you for attention. I have nothing else to say.
Thank you, Mr. Bristielle, and thank you Mårten also. We will now move on to the products and the underlying technology. For that, I hand over to Tomas Taesler.
Thank you very much. Good afternoon, all. I'm Chief Product Officer at MSAB. I joined the company about one and a half year ago. I'm gonna give you a bit of a more introduction to the different products of our portfolio, and I'm gonna start doing that by illustrating the use of products through a video that sort of is showing what could be a real case from extraction to sort of analysis and addressing a criminal. I take you back to the city of Greyport, let's imagine that's in South of England, in December last year. The police station gets pretty routine call about a car accident happening.
They send officers to the scene to investigate, and when they get there, they discover that the driver is missing and the passenger is unconscious and not cooperating. They soon realize that this car is actually stolen, so they collect evidence from the car, two mobile devices, one from the passenger, which is turned on but locked, and one from the supposed to be driver who's missing, but left his device into the car, which is then also locked and turned off. They bring these devices to the police office and do an examination. They connect the passenger device to XRY to try to figure out who this guy is, where they have been, potentially connecting to where this car has been stolen, still thinking this is only a car theft.
They can do selective extractions for the last seven days to examine that content on his device. When they have that content, they move that into XAMN, the analytics tool, to look into who is the owner of the device, looking into all the content available, choosing to look for geolocations where this device has been moving around. They see some interesting connections with sites where there have been other crimes committed. They look into the message history to find out there's some interesting message correspondence between the owner of this device and another person called Anota. In the message log, they can see the actual messages exchanged between the two people, and something indicating that this guy has come over quite a lot of cash. Now this opens up to something else.
It reveals a connection to an armed robbery actually that happened a couple of weeks ago. That of course initiates an interest in the other device found also that was turned off. They bring the evidence back to the [Greyport ] forensic lab, where they have the XRY Pro, and the forensic experts can try to break into the other device. For that purpose, they use something, an application called BruteStorm Surge. This is a GPU powered hashcat -based brute forcing application. After a while, they're able to crack the passcode of this device to get in to analyze all the data available on that one.
With the correct password, the locked device can be accessed. They can now start to connect the information from the two devices, see how they have been communicating, with whom they've been communicating, and what they have been communicating about. As they do so, they actually find in one of the messages an address that looks interesting. It happened to be an interaction between this Justin and Anota, and a message confirming a delivery address for food delivery. They take that as an indication of a site of interest. They get the search warrant, and they go to this address and find evidence from the robbery. Together with Arnaud's presentation and this illustration, I think that gives you a good picture of how our products are used and the purpose of the business we're in.
The portfolio we provide is addressing all the steps in the workflow of a police department, law enforcement organization from seizing information on the field to bringing devices to the lab for more advanced analysis, to the investigator office for trying to connect the dots and find what is of relevance, to creating a report that holds up in court. Important through this chain, especially for law enforcement, is that what is presented in court can be proven was unchanged from when it was seized on the device, of course. There are ways in this process to guarantee that nothing is manipulated along the way. In addition to that, we then also have, of course, management tools for network management to help the IT department to operate the software on the endpoints that are installed with any law enforcement organization.
Basically, the use cases applied here is the same also for defense and special ops type of customers, just that the requirements on the sort of evidence is not as hard as it is in law enforcement, of course. Looking at the different step of this value chain, as mentioned, at the core of it is getting the data. With the data, we mean everything you have on the phone. We can do this by different means. We can politely ask the operating system on the phone to give us the data they wanna share. As Arnaud said, that's pretty limited on mobile devices. It's not like a PC where you have full access to everything on the workstation.
Instead, we use both physical extractions, and we use full file system extractions by getting underneath the hood of the operating system. The media we capture is everything from geographical information, as you saw in this example. Where had this device been located? How has this person been moving around? We can track messaging through a wide range of messaging apps, of course, call data records, media of all types, pictures, movies, whatever you have on the phone, passwords used for logging into networks. You will be surprised when you see the extraction that we can present on XAMN, the vast amount of information available on the phone. It's all your life is on that phone, and everything is accessible for us, basically.
When we do this extraction, we put the information into a secure container that we call the .XRY file. That is the entity that goes on in the investigation going forward. That is the format, proprietary format that is then locked down and secure and audited for any type of reading that is done on it. We can prove that nothing was changed from extraction to the courtroom. This is what XRY does, and we package that for different purposes. For use in the field, we package XRY into what we call XRY Tablet or XRY Express, which is sort of a then laptop-based solution for the purpose of being able to capture data already at the crime scene or for that matter also to get data easily from victims and witnesses.
Imagine you have been a witness of a crime. You maybe have a picture you wanna share, but you don't want to hand off your phone for a couple of weeks to be sent to a lab. You don't want the police to have access to all information on your phone. You just want them to have that picture. We can support that by selective extractions on site at the victim's or the witness location. The other option is the Kiosk that I think was mentioned. The XRY Kiosk is sort of more stationary frontline equipment, which offers you a little bit more capable interfaces for data extraction that typically then is deployed at the police station, which was used in this case in the movie where the device was brought into the police station and they could do the examination there.
All of this gives you that folder, the same folder then as being extracted in the lab where we can do more advanced extractions. Typically the device is locked. You want to get into a specific type of device and operating system that is not as easily done as with some other devices. This is where the forensic experts are working. They have more competence and then more powerful tools also to work with. We also use, here we use XRY Pro, and we also use that when we help customers through our access services, where our own consultants can help them to get in data from phones that maybe they have tried and failed with themselves.
Quite often we can do tweaks to the solutions that is released for customers to get into even more devices than what is otherwise available. The simple sort of positioning of XRY and XRY Pro is that XRY gives you access to unlocked Android. It's a little bit simplified. We do actually get into locked Androids as well, but it depends on what type of device it is, and so on. Unlocked iOS with sort of a limited extraction. That's kind of the polite asking the system to provide this information. Feature phones, burner phones, more often used in crimes than maybe anyone in this room would think. Quite an important sort of range of devices to have support for and different accessories.
We talked about drones, we talked memory cards, other type of associated accessories that hold information that we can get into also. XRY Pro does everything XRY does, plus gets you into locked Androids, complete extraction, full file system extraction of unlocked iPhones, and also ROM and memory extraction. That's the simple sort of differentiation between XRY and XRY Pro. Once we have that container of extracted data, we move it to the investigator's office and start looking for the evidence, connecting the dots, finding that picture that holds the evidence, the needle in the haystack. For that, we use XAMN Pro. It's a very capable analytics tool that gives you tailored filtering and search possibilities for mobile forensic purposes.
It helps you to follow conversations between different parties, as you could see in the movie here also, independent of what different messaging apps they have been communicating across. You can see the complete chain of communication for two or more parties and follow sort of the conversation that they may have had. You can see how people connect to each other. You can see everyone that I have been communicating with and everyone that those I have communicated with have communicated with, so you can follow the chains of people relationships. Geolocations, as I mentioned, and everything available on the device is then possible to search and filter and analyze through XAMN Pro. If you wanna do that investigation at a larger scale, you may have 50GB, 100 GB of data on a device, even more.
There's thousands of pictures, as Arnaud mentioned. It's just too much data for one person to dig into. You have a team of investigators working on different focus areas in parallel. We're offering the Unify Suite as a way of collaboration to make it possible for more investigators to address the same data at the same time and create one consolidated report that can go to the court for presentation of evidence. Of course, this is an area where AI becomes very powerful. It's a lot of data to be analyzed. Already today, and on our roadmap, we have a lot of initiatives where we are utilizing AI to make this XAMN Pro more powerful in terms of being able to find what is relevant for the investigation.
We of course have media content recognition to find specific type of media automatically by content recognition. Pictures including CSAM material, guns, drugs, face recognition, those kind of things. Of course also language models for transcription and translation, language detection. More and more now looking with the more powerful large language models to have natural language queries, to have even more powerful searching and filtering of information, and also fake media detection tools. Also in research, I mean, what makes it possible for us to get the data depends on our research. This is dependent on knowing how the hardware and the operating system on any device is working together for us to find the vulnerabilities on that can help us get into device even if it's locked.
If we get into device, actually being able to access the full file system extraction. We use AI more and more now in our research to sort of elevate the performance of our very skilled researchers. Of course, as in any software business, agentic development for application development, we see that with AI. We can scale the number of flavors of applications, use cases we can support for specific customer segments and use cases. In the court dimension, XAMN produces a report that holds as evidence for a court case. On top of that, we have the network management tools to help the IT department to operate an installed base at the customer site. This is still very much an on-prem business. We're starting now to have more requests coming for the cloud deployments.
We do support cloud, but our customers, for legal reasons very often, are very conservative in terms of storing this kind of data in a cloud environment. Typically, they have the need to operate this installed network themselves. This can range from just a few nodes with XRY and XAMN licenses installed to several hundreds at the big customer. Of course, you need efficient ways to update the software when we do releases, to manage user access, to update watch lists and hash list on those clients that are doing extractions, and everything can then be done centrally in an efficient way. Looking forward, some of the key investment themes we are seeing is, of course, always continued research and development of our access capabilities in XRY. Tools for quick triage, as mentioned, as one of our growth avenues also.
Field triage solutions for specific use cases, military special operations not the least, where you quickly can seize a device, see if there's something of interest on that device, maybe looking for some specific contact names, phone numbers, pictures. Having the tools that gives you quick way of on the field getting like a green light or red light that this is of interest or not. Cloud deployment, going into to more of an optimization of the platform and the whole solution for that. Client network scalability to be able to handle even bigger states of installed applications. And also then, of course, in XAMN, AI-augmented analysis tools. That's in a nutshell what's in our product portfolio. Thank you very much.
Thank you, Tomas. Please stay on stage. We'll now move into a panel discussion. Maybe we can have some help to get the chairs. Okay. For that, I'd like to invite CTO Anders Jonson. Please join us. We are also joined by Jim Dowling, CEO of Hopsworks, an AI expert and lecturer at KTH Royal Institute of Technology. Jim is working with companies like Saab and Ericsson on developing large language models or more specific LLM solutions. Welcome, everyone. Let's spend a few minutes on AI and what it means for MSAB and the broader space. Let me start broadly. How is AI changing the industry? Jim?
Digital forensics industry. I mean, what we saw earlier in some of the demos were analytics. I think, first and foremost, I had a quick look at a demo out there, and it's great you can search around and find things, but I think natural language has become an interface that people can use to dive deep quickly, find correlations, find patterns with natural language. I think it's gonna improve the productivity of the people using these tools, such as MSAB. I think that's the main kind of thing we're gonna see here in the near future. In the long term, you know, agents and LLMs are gonna change many industries.
Do you agree, Anders?
I do. From the customer side, absolutely. I mean, I think with a growing volume of data in the, in the, in the software or in the, in the phones, there will be a different way of accessing the data and there need to be a new workflows, which is aided by AI, definitely. Since I'm the CTO, I think the way of working is also changing inside when we produce the software. And in R&D, we have basically two departments. It's research, and research is using AI even more than they did just a couple of months ago, actually.
Development, as Tomas mentioned, we are using agentic engineering to sort of leverage the play field compared to the competitors, so we can produce more with the amount of staff we actually have today, which is pretty cool.
Do you want to add something, Tomas?
The product perspective in that case, it's obvious with the kind of data volumes we're handling and the vast different types of data that AI can simply be a superpower for investigators.
Is it like everything happens faster than you expected?
I mean, I can tell you this. I mean, I've been around a long time. I mean, I've seen the internet bubble, I've seen the mobile phone revolution, I've seen deep learning come, and I've been working AI for 30 years. This is beyond anything. The change even in the last six months. At my company, Hopsworks, we've gone from some people playing around with coding agents six months ago to 99% of our code is written with coding agents now. I guess we're at 5x the productivity of before. Software is gonna be built incredibly quickly and with high quality, it's not gonna be just slop. I mean, a lot of people think it's slop, but you can actually engineer this thing.
We're gonna see a lot of changes in how software is built and deployed. That's gonna be the main thing, and it's gonna affect a lot of workflows that may not have been digital before. They'll be digitalized. I'm sure that's gonna affect digital forensics. I mean, if we take the example of digital forensics, we have large data volumes, and typically how we process large data volumes is we need to search through that data, and we might have something like an index, and there's many different types of indexes from database technologies. LLMs won't change that, but they'll change the way you interface and you access that data primarily through natural language.
If you have data analysts that need to learn how to use SQL and build dashboards, that will be revolutionized as well, as will the interfaces to all digital forensics products.
How do you-
in the near future.
How do the rest of you see it? Anders?
Can you repeat the question?
Yeah, if it's happened faster than you expected.
Yeah, most definitely. A while back we had 4 releases per year. Now we're down to basically biweekly. This is in response to the increased release cadence from the different vendors we are sort of competing against. We are releasing more often, and also, it's become a bit more problematic. Peter mentioned in his open speech that you heard about Mythos, I guess, Anthropic's new model. It has increased the difficulty of sort of answering the more frequent releases from the vendors. We in turn have started to use AI internally more to, in response to that. We are releasing more frequently.
Is it, like, hard to, for the companies to adapt to the path?
It could be, I guess. It has to do with the amount of investment you can do, but also of course, if you need to be very, very, very skilled. We got 20 researchers in our department, a total of 19 in my department in total. Those 20 persons are very, very skilled. We're actually recruiting globally, so they're not living in Stockholm, all of them, in order to, you know, find the best ones, in order to have, in order to respond to the increased difficulty-
Basically.
Tomas, will you be able to adapt technology?
I mean, it's a trick question because the speed of development in terms of increased capacity for large language models the last one or two or whatever timeframe you look at is basically logarithmic. It's hard for the human brain to adapt to logarithmic development, right? It's just, it's a matter of catching up rather than foresee what will happen. Clearly what we, the capabilities that AI offers today compared to just one year ago is mind-blowing when it comes to how that can be applied in a mobile forensic solution for analysis and research and so on.
Yeah, exactly. In five years, where will we be?
You tell me.
All right. I just also have to ask you, maybe start with Jim, about Mythos.
Yeah.
I mean, is it a threat or an opportunity or?
I think it's the near-term threat to a lot of system software companies, including my own and MSAB. I think, you know, there's two parts to it. One is that Large Language Models now work with any task that is what we call verifiable. If I have a program and I can write it, run it, and verify that it works as expected, or it could be mathematics, any tasks that we have out there that are verifiable, it could be based on natural language, will be nailed by LLMs. That's kind of the first part. Programming has been the first main one that we've been talking about. Mythos has taken it to incredible extent.
For us internally, we're like scrambling to kind of, you know, do threat analysis of our software because when some of these are released, the bad actors will of course. The bad actors can be your competitors, you know?
Yeah
You can down a competitor with this. It's not not necessarily gonna be just. You know, I think if we take back to mobile forensics, you know, when models become so much better, it's also the users it will affect. They're gonna spin out messaging apps with crypto that you haven't seen before.
They're gonna be even harder to crack. Then we have the quantum issue as well, quantum computing. There's a lot of I think it's an industry where a lot of kind of change will happen in the next few years.
What do you think about Mythos?
I mean, it smells, it's definitely a kind of threat. It is, absolutely. I mean, MSAB has been doing this for 20 years, so playing this sort of attack-defense game, we are quite skilled at it. We are not so nervous. Yes, it's a new landscape, absolutely. Again, we are prepared for it.
Will it make your moat stronger or weaker?
We have had a lot of discussions internally regarding this. The reply from research is actually mostly positive. They say, "Yes, it's more difficult, but we are using the same tools as our competitors or and the vendors." In some instances, we can increase our effectiveness tenfold or even more depending on what area we are doing it. It's also produced a lot of new possibilities.
Do you have any thoughts about Mythos, Tomas?
Yeah, who doesn't?
Should we be afraid?
No. It's a great opportunity, to be honest. It's, it gives us as a small company, as Anders says, the same powerful tools to do research as anyone else in the industry, so we are levering the odds a little bit with that, to my opinion. Also, when you look at what we do, and for the purpose we're doing it, what any large language model can do today technically may for different parties in this ecosystem not be interesting or profitable. The business case looks different for us versus the vendors versus our competitors. Where we have a good business case to use the full power of large language models for research and product development are the vendors of mobile devices may not always have that. It remains to be seen sort of how that-
power game will sort of end up. As Anders said, that is not really a dramatic change. The sort of the power balance has been there for years.
Where do you actually see AI creating the most value in your products?
If I may answer that, clearly in analysis, for all the reasons I described, it just gives us the investigators a superpower in terms of finding a needle in a haystack that otherwise you would have to have many investigators in the police offices to try and do. I mean, the biggest iPhones holds 1 terabyte of data, I think. It's just too much for 1 person to go through. With AI analytics tools, you can all of a sudden change that completely. So in law enforcement, you'll need less people to do the same analysis. In research, it just gives us a superpower to do more.
In product application development with agentic development and, sorry, vibe coding or agentic engineering or whatever it's called now, which name changes monthly, I see an opportunity we can do more flavors of the applications. We have the moat is to extract the data. That's very hard for anyone to copy, and it's both hardware and software architecture combined, so I don't really see that being threatened by AI. The capability of getting the data is our moat, and on top of that, we can now all of a sudden build much more flavors of applications for specific user segments that basically just helps expanding our offering.
Anders, what's your take on that? Or do you agree?
I totally agree with Tomas, and I think, I mean, looking at the competitors, Cellebrite and Magnet foremost, I mean, yes, they are bigger, but with help of agentic engineering, I mean, and the amount of token we are willing to use, we can basically produce the same output as they do now. That's only a positive thing.
Just to clarify, what's the biggest risks with AI, actually? Jim?
Risks? I mean, there's risks in, if you're in the area of digital forensics, there's risks that there's gonna be new attack vectors are gonna appear that'll overwhelm the ability of law enforcement to actually deal with them.
Right? Everyone's using WhatsApp, Facebook, Signal, and so on, and I guess you've cracked all of them. Maybe not Signal, I don't know. You know, the new software will be just put out there that will have very good quality encryption, and there won't be existing tools there to crack it. I guess the biggest risk for the industry as a whole is that new tools will appear at a rate that you can't keep up with. I do think because of the agentic engineering, you will be able to move a lot faster and keep up, but the arms race will get faster.
I think that's the biggest, probably most likely outcome.
All right. Your industry, MSAB's industry then, law enforcement and the military, tends to be quite skeptical in some markets like U.K. How do you break through? Tomas, maybe?
In what way are they skeptical?
No, I mean, there have been several cases where evidence has been dismissed.
Yeah
because-
I know.
It wasn't evaluated by a human.
Typically, I would say it's an often in the hands of how you have used sort of public AI tools in a sort of, in a not so clever way sometimes. Which has led to, in the U.K., there's been some situations where they have went to court with evidence that were produced by AI. We just don't do that in our products. We use AI to help find what could be of interest. We never manipulate, we never draw conclusions. We just expose it for the investigator to do their judgment. Rightly used, it is not an issue from a sort of any point of view. There'll be some cases which has influenced the
The public debate in U.K., for instance, that has been a bit unfortunate.
Okay. I mean, we've touched on this, but there is a lot of talk about AI replacing software and SaaS companies and could AI replace parts of what MSAB does today? Anders?
I would say no. The reason is that we are in a very specific market, requires knowledge and skill, especially to extract the data, that requires humans to create the exploits. I know with us, Anthropic says they created exploits themselves, the ones we are sort of finding are very, very difficult to find. That won't be replaced by AI anytime soon. Also, to create the softwares we are creating, we need to be very, very careful about automating the code generation. We need to review every line of code in order to have a software which is guaranteed to produce court-admissible, well, stuff, basically, which holds up in court.
If we automate the entire production line by AI, that would be pretty unfortunate, I think. That makes this sort of business area, it creates a big moat, and we are not that replaceable.
which is a good thing for MSAB.
Is it like that, Jim?
I mean, I can't comment specifically. I only know the tool briefly, but I can comment about SaaS in general because, I mean, at our company, we do marketing with a tool called HubSpot and pay them EUR 3,000 a month. Our marketing person, who's not a programmer, built an equivalent tool and sort of integrated a couple of open source tools. Wasn't too much work, a few weeks work, pretty profitable. We've replaced a few other SaaS applications like a managed webpage, Webflow, built something ourselves. Now our marketing people are writing the website with vibe code. Because it's easier. If you're making changes that spread across the whole website and so on, it's very easy to do those globally, and it would have been much harder on the SaaS platform.
I think a lot of SaaS software is under threat, but I don't know how fast it's going to happen. It'll happen, but it's, it'll be industry kind of related, right?
I think in different industries, like it'll go faster. In others, it'll go slower.
Where is the real boundary, if there is any?
I don't know if there is a boundary, to be honest. I mean, we're a database company. We build a database, right? This is the lowest of low engine. Our code is open source. RonDB is a database. Our head of database, Mikael Ronström, he's written 150,000 lines of code in the last two months. He's written a query optimizer that he hadn't touched. He'd been working at different layers, and it's really good. This is the hardest code you would expect to write with agentic coding, but it's actually quite good.
I don't know where the layer is. I really don't know where the moat is.
Do you wanna add something, Tomas?
Yeah. No, I, every software that is exposed on the internet, user interface-heavy will be copied. Can be copied, will be copied. The question is what you have beneath the hood that is not exposed and, copyable. That is what the value you can protect, and that's what you can build on.
Yeah.
I mean, I get contacted regularly by analytics companies who want access to our data. We're not giving them our data. Simple as that.
What applications will be able to expose. Yeah, I agree. I don't see why they can not be copied, but the question, it'll just be empty shells if you don't have the data.
Are you agreeing?
I do.
Okay. You don't want to add anything?
No.
Okay. As, talking about competition, as a smaller player, how do you stay competitive in an AI-driven market? I mean, there will be many competitors.
Should I answer? I don't think there will be, actually. We have three on this market, and the barrier of entry is increasing, getting more difficult quickly, which is to our advantage. Smaller companies using or creating exploits single-handedly, et cetera, they are, is my guess, going to disappear. I think MSAB is in a very good position to scale and to compete or, well, using AI also, of course.
Jim, do you agree that this favors specialists?
I mean, I think definitely. If you have a niche that has a high barrier to entry and you have a good moat, that's not going to be the first software company to be upended. I mean, there's tons of workflows that are not digitalized today that will be digitalized in the very near future. There's tons of incumbents that basically charge huge, huge margins for something that you can vibe engineer. Those will be upended first. It's going to be a journey. You know, and I mean, I saw, for example, Legora, who are a Stockholm company, who are massive, and I saw someone the other day say, "Well, I've open sourced a vibe coded version of Legora." Now, how true is that? I don't know.
I think there will be a deflationary aspect to AI and software. We have a competitor called Databricks. They're valued at $150 billion. They charge huge margins, and we can do the same thing. We could be the Lidl version of data AI analytics. You know, when times are good, maybe it's fine for Databricks, but when times don't turn a bit and you need to save cash, there will be a deflation aspect to this, I think.
Right. Good to know for the investors. In other words, you're saying AI can replace others, but not you. All right. What is one thing investors might underestimate about AI in this space? Anders, do you want to start?
Oh, underestimate? That's a difficult Not prepared for that one. I'm drawing a blank here, to be honest.
Okay. Tomas, do you want to?
Well, I'm underestimating AI every day, so I guess investors are too.
Jim, do you want to help out?
I just think that there will be more attack vectors and maybe you're gonna need more forensic on digital forensics in future.
You know, it's gonna be a higher cost if there's gonna be, it's gonna be easier for people to hide their digital trails.
I'm with Jim here also. I mean, there's a saying, there is no such thing as a perfect code, and I do think that applies to AI too. We will see more apps popping up in both Android and iOS, and more apps is more attack surface, so that may be to our advantage, actually.
What is, like, the weirdest thing you think we will use AI for that we, like, can't imagine right now?
Wow. Well, I have been sort of theorizing about maybe the police will be using agents themselves. Maybe humans aren't clicking through our software, who knows, in the future because the amount of data. Maybe they just point an agent to our software and say, "Find evidence for, you know, this case," whatever, "and present this when you're done." Voila, it sort of presents this. Hopefully holding in court as well. Maybe that's the future, not now. That would be interesting.
Jim, what do you think?
I work in the area of data, right? Scalable data. In data, we typically say data is either structured, so it's stored in tables, and it's organized and you can search through it. We have this big bucket we call unstructured data, and that's everything from files to text to images to videos and so on. I think AI is gonna organize that unstructured data in the next few years. I think the idea that we're gonna have these, like, big dumps of unstructured data that no one has a handle on and there's a lot of tooling around it, I think we're gonna just organize all that.
Mm-hmm. That's the weirdest thing you think we're gonna use AI for?
It could be weird. For me, it's weird. If you work in data, it's like, it's a revolution, but yeah.
What do you think, Tomas?
The most weird thing about AI?
No, no, but I mean the most weird thing that we are going to use AI for.
Yeah.
can't really imagine right now.
Personally, I see people using AI as a psychologist and so on. That's to me crazy. Within forensics, I don't know. I don't see any crazy use cases. Again, I don't know if we've seen it all yet.
I wrote a book on AI for O'Reilly, just came out in December, and I kind of described LLMs as it's an amnesiac brain in a jar. I'll try and break that down. It's a brain in a jar in the sense that Large Language Models are our brain. They understand language, they have language going in and language going out, they're not connected to the physical world. They don't have vision. They don't have senses that we have. They're also amnesiac because I can tell something and it's forgotten it immediately. It's like that movie Memento, right, where you write it down. He had better memory than an LLM because he wrote stuff on his body. He tattooed them, they don't.
They're, at the moment, they're amnesiac brains in a jar. I think when they get connected to the physical world and they're interfaced into things, we're gonna see big changes. Yeah.
Interesting. Maybe we have some AI questions in the audience.
When will the dystopia, the saga of the great computer, become reality?
What kind of dystopia? I mean, is it the end of the world?
Do you know the saga of the great computer?
No, I don't. Do you know it?
No.
Maybe a microphone.
The professor at KTH, Hannes Alfvén, he wrote this book about, actually it was the computer writing the book about the development of the computer, the big computer. At that time, of course, the humans, they were so dangerous that they were kept in, like zoos or very carefully taken care of. Actually, the humans were only the way to produce the great computer. This book was written in about the '60s by the Nobel Prize winner, KTH professor, Hannes Alfvén. You didn't know about it.
The question was?
When will it come true?
When will it come true?
Well, I mean, there are many people who think that that's the next step in evolution, is that we're just a stepping stone. A lot of people in the tech field aren't particularly unhappy about it. They just think it's a natural evolution. That's not my opinion, but that's what I hear.
Okay. Do we have any more question? No. Okay. Guys, is it anything else you wanna add on AI that you think it good to take with us from today?
I can ask. If you're not programming, I expect you will be programming in the next 12-24 months. I think most people in most jobs will be producing software of some kind, powered by Large Language Models. You know, rather than wait for the future to come to you, maybe you wanna move to that future earlier. That would be my take.
Tomas, do you have any closing remarks?
No.
No. Anders?
Just say that internal at MSAB, we are quite energized with dawn of agentic engineering, and I know some of our product owners in the audience here, they're also using agentic engineering and sort of have started using and producing proof of concepts, real software, just to show us that something actually is working, which they then can hand over to R&D for, well, proper development. It creates a quick cycle of new things actually, which it's very energizing, and everyone can be active, sort of, in the development, which is very fun.
Great new things.
It actually makes me really tired 'cause I'm not sleeping 'cause I'm doing so much programming. That's another side effect.
Okay. Thank you, everyone. That brings us to the end of today's session. Before I hand over to Peter for some closing remarks, I just wanted to tell you that the panel will be here for a quick chat, and there will be light lunch served and some products you're welcome to have a look at. With that, I hand over to Peter to wrap things up. Thank you very much.
Thank you. Yeah. AI, both a threat and an opportunity. We are keeping our eyes on both, I can promise you that. Talk to these guys during lunch. When we had dinner with Noah yesterday, he told us, you know, first he told us about he lives in this beautiful little village where they locally provide very good things that you can eat and drink, you know. Seems to be a fantastic place. He also told us that he brings a sleeping bag to work. Sleeping bag to work? Yeah, because he has only 48 hours, you know, to find the evidence for the criminal. It's not, you know, the time that you go home and sleep. That's the kind of commitment our customers have. The crimes that he solves, pretty important.
That is, you know, what the customers we serve with our products. I think that is a reason to invest in MSAB. Maybe you want more reasons. I mean, I put up five reasons, you know. We have a good strategy that we are executing on, and it seems to be working. We have a good organization in place, you know, with a lot of new people, new energy, but not only a new organization. We also have, you know, changed the way the company operates. You know, today, we have the data we need to take important decisions. We have more efficient processes and so forth. We have great products. We have really top-of-the-line products today. We don't have a lot of products, but the ones we have, they are really great products.
We have the growth avenues that we see in front of us that we talked to you about, you know, both in geographically in the products and new verticals. We haven't stepped into those yet, we are still growing with, you know, really good speed. I think there's a lot of reasons to invest in MSAB. You have invested this half day in MSAB, and I wanna thank you for that, and I hope you got some value for it. Thank you for coming. Now go to the lunch, spend it talking to the people, you know, the management people you have here. They are all really easy to talk to. Thank you