Welcome to Yubico's Q3 2025 report presentation. For the first part of the presentation, participants will be in listen-only mode. During the Q&A session, participants are able to ask questions by dialing pound key five on their telephone keypad. Now, I will hand the conference over to CEO Mattias Danielsson and CFO Snejana Koleva. Please go ahead.
Good morning, everybody, and welcome to Yubico's Q3 report call. I'm Mattias, CEO of Yubico, and with me today is Snejana Koleva, our new Chief Financial Officer, and we'll take you through the material. Several of you have probably been attending these calls before, but as always, we'll start with a quick overview of the company before we get into news and details of the financial report. In terms of the agenda, we'll start with a company overview. Yubico is a proud hardware company, and our core product is the YubiKey. What we typically like to stress when we talk about our growth today is the fact that we are the world leader in modern multi-factor authentication. Our customers who have deployed our keys and the modern protocols on the keys have experienced zero account takeovers. Of course, we want to keep that way.
That's the basis of our success. We're a hardware company, but in spite of that, we've been able to maintain healthy gross margins pretty consistently in the 80% range over the past number of years. The second thing we'd like to brag about is the customers that we're working with. We've been selling to about 5,000 different business customers, but our focus has been on selling into the largest companies in the world. As we'll get back to, we cover almost 30% of the Global 2000, so almost 30% of the Global 2000 companies are existing customers of ours. In most cases, they've only deployed YubiKeys to a subset of their employees. Of course, our journey is to make sure that they protect all of their users using YubiKeys. We've been growing at a pretty consistent rate.
Our average growth rate over the past five years has been 40% per year, but it's been variable year by year. We've experienced a healthy long-term growth. Since the start of the company, we've sold and deployed about 40 million YubiKeys. Today, in the last 12 months, sales amount to SEK 2.3 billion. Today, there are approximately 520 people working for Yubico, about two-thirds of them in the U.S., about a quarter in Stockholm or in Sweden, and the remainder in different sales positions across the world. That's Yubico in a snapshot. Okay, I mentioned very briefly the market we're in, which is multi-factor authentication. What does that mean? The most common way to access any online service or system or device is still username and password.
With a password is the identity, sorry, where the username is the identity and the password is how you authenticate that you're the legit user. Everyone knows that username and password is not a safe way to authenticate. What you want to have is MFA, multi-factor authentication, not just something you know, a password, but something that you are, biometrics, something that you have like an app or a device. We're in the most advanced form of MFA, the highest level of authentication. That market for multi-factor authentication is estimated to amount to about $5 billion per year. How can we claim that we're the leader in that market? We're the leader when it comes to modern advanced authentication. There is a lot of legacy technology out there, but gradually modern forms of MFA are taking over and we're the market leader in that segment.
This market of advanced authentication is estimated to grow at about 14% per year over the next couple of years. It's a big market where we have only so far a very limited market share, and it's growing quite rapidly. What the YubiKey has as its unique features is a unique combination of achieving the highest level of security together with it being very easy for a user to use, which sets it apart from other ways which are much more cumbersome when it comes to advanced authentication. Another key feature, pun intended, of the YubiKey is that it's a key that fits into all the relevant locks. Fundamentally, what we're selling is a key, the YubiKey, and it's only as usable as the number of locks where it fits.
We've invested a lot in making sure that we have this Swiss Army knife type of key that fits into all the relevant locks. It used to be us doing all the heavy lifting in terms of building support for different systems, but now increasingly it's that systems realizing that their customers want to authenticate in the most safe way and therefore provide support for YubiKeys. Part of it is the software that goes on the key, and part of it is how it's getting integrated into different environments, which is something we'll have a reason to get back to later in the presentation. Now, talking then a little bit about our customers, as I mentioned, we're actually in excess of 30% of G2000 companies in terms of coverage today. If you look six years back, we worked with 14% of the Global 2000. Now we're at the full 32%.
That's growing. We're adding new customers continuously. What's also very encouraging is that we see a very high loyalty and repurchase rate from our customers. We have two different business models, one which is an outright sale of YubiKey and the other one is a subscription model where you instead sign up for the use of YubiKey to ensure that your users are protected with the best technology, and then you instead pay on a recurring annual basis. No matter the business model, we see a very high repurchase rate. We've been measuring this over different periods of time, but you typically would see an annual repurchase rate among our biggest customers in excess of 100%. How can it be that high? A lot of it is about the fact that we typically land and expand with customers.
We win a new customer, and it's typically a limited set of users within that enterprise or government organization that use our keys. Then, as people realize that it offers the best protection, it's also very convenient for the user. That's when we start a conversation about expanding into more groups so that the entire organization gets protected. We started out within tech, and it's still a very important sector for us, but now we have a pretty diverse customer base working across a lot of different geographies and a lot of different industries. On a very high level, our sales strategy is to land accounts and then to expand within those accounts. That was it for kind of the overview. Some highlights for the quarter. As we reported, as we released early, what's called an early press release or profit warning, we saw softness in terms of order bookings.
year-over-year, we saw a decline in order bookings by 17%. 8% of that was attributed to FX, but an underlying order booking decline of about 9%. A little comment on that, what we see and what we highlighted in the quarter was that we saw a decline when it came to the larger orders. We saw continued good momentum and winning new customers and doing smaller sales. Small and mid-sized orders grew quite nicely, but the large orders, which are important for making sure that we meet our numbers, we saw softness there. High level, it should be noted that we saw some currency headwinds.
We had year-over-year about a 10% appreciation of Swedish krona, which is our reporting currency, compared to the U.S. dollar, which is the currency where we conclude the vast majority of our deals, about 80%, and the remainder is in euro, where we also see an increase in the Swedish krona. Another thing that we highlight is the fact that we are making steady progress when it comes to our product roadmap. That was made even more specific as we released new functionalities, which are planned to be released at Authenticate in California in mid-October. One is targeting digital signatures, making sure that you can sign transactions using the YubiKey, not just use it for authentication.
The other one, which is a little bit more long-term, so it won't be released next quarter or anything, is the ability to run post-quantum cryptography on the YubiKey, which is important as we want to make sure that we have the most resilient authentication solution even when quantum computers are a reality. High level, we continue to expand our market reach, expanding new geographies, setting up a new office in Singapore, and continuing focusing on recurring revenue through our subscription model. We feel that this and the underlying growth in small and mid-sized deals puts us in a good position to continue growing this market and delivering long-term sustainable growth.
One thing that we could highlight in particular is the fact that we've been available on Best Buy online stores in the past, but in Q3, sorry, at the start of Q4, I think we announced that we're now actually even in the physical stores of Best Buy, which means that we can get access to a new set of consumer users with a different set of packaging and simplified instructions so that they can protect their digital selves using YubiKeys. However, the vast majority of our sales goes into large companies and government organizations, and that remains unchanged. That forms the basis of our revenue base still. With that, I'll hand it over to Snejana, who will talk more about the numbers for the quarter. Over to you.
Thank you, Mattias. Let's start first with the key figures for the quarter. Net sales nominally declined with 7%, but the entire change was actually driven by negative currency impact, as Mattias mentioned. 80% of our sales are in dollars, the rest is in Euro, and the SEK, our reporting currency, has depreciated year-over-year. In excluding currency effect, our sales are flat versus last year, and our subscription sales are actually growing very nicely. Gross profit nominally has decreased with 10%, but gross profit margin is relatively stable. It has some effect from currency as well. Looking at the EBIT, it has decreased with 4 percentage points versus last year, Q3. Primarily, as our gross margin is relatively stable, then the rest of the decline in the EBIT margin comes from increased expenses.
As our growth ambition, we are increasing somewhat our headcount to meet and deliver on our growth ambitions. ARR is increasing very nicely, 32% versus last quarter or last year's quarter, very much driven by adding new customers in our subscription model and renewing our existing installed base. Also, it shows that there is an increasing demand and adoption of our subscription model. The pages are moving a little bit. Now, let's take a little bit closer look at the bookings. The bookings declined 17% year-over-year, whereof 9% was actually the underlying change, and the rest was a negative currency impact. The order bookings came a bit short of expectations, which we have as well announced in our earlier communications. We've seen fewer high-value perpetual bookings.
We had a very strong Q3 2024 where we had multiple large public sector contracts, which we did not see coming to fruition in Q3 2025. Subscription bookings, however, develop well. We see a nominal decline of 3.2% versus Q3 2024, very much driven by currency. Now it corresponds to a larger share of the booking, 17% versus 15% in Q3 2024. We see that the overall subscription activity and demand and adoption continues to increase. We see that reflected in both the bookings and then further on in the net sales. From a net sales perspective, as I mentioned, 7% nominal, but actually flat if we disregard the currency impact. Increasing share of subscription sales, now it is 16% of the total net sales for the quarter versus 12% in Q3 2024. Total SEK 87 million of subscription sales in the quarter.
From a geographical perspective, Americas is now 64%, while EMEA and Asia are increasing somewhat in the mix with 25% and 10% respectively. From an ARR perspective, as I mentioned, 32% increase versus 2024 Q3, driven by good renewal rates and adding new customers to the portfolio of subscriptions. When we look at EBIT, as I mentioned, gross profit has decreased 10% nominally. Margin-wise, somewhat decreased versus quarter three 2024. Overall margin decrease is 4 percentage points versus last year. We see that the costs in the quarter are driven by higher personnel costs, reflecting our continued expansion ambition. Of course, we are very mindful how we grow, but we see that impact versus last year. The LTIP program costs this quarter were about SEK 30 million. Last year, they were SEK 23 million. We have very small currency effects in EBIT this quarter, only SEK 0.3 million.
Last quarter, it was about SEK 9 million. From a cash flow perspective, the cash flow for the quarter from operating activities was SEK 32 million. Overall, good cash flow before the changes in working capital of SEK 105 million. The changes in working capital were about SEK 17 million. The majority of that came from changes in inventory where we have received the last order for our security component now in Q3. The cash and cash equivalents at the end of the quarter are SEK 875 million, which is an increase versus last year. Excluding the interest-bearing liabilities, the net cash at the end of the period is SEK 835 million. Our interest-bearing liabilities are primarily leases. Inventory has increased as a percentage of the last 12 months' sales to 33%, again, primarily driven by the last shipment, as I mentioned, for our security chip in the quarter.
With that, Mattias, back to you.
Thank you, Snejana. To sum it up then, we fell short of expectations when it comes to order bookings this quarter, and what fell short was really the larger orders, i.e., orders in excess of $1 million. About half of the shortfall is attributable to the U.S. public sector, where the government shutdown definitely had an impact. We saw renewals of subscriptions, but we did not see any new orders really towards the end of the quarter. The reason why we then had a number of private sector orders. There is some background noise. I am not sure where it comes from. Can you hear me? Yeah. Good. Outside of the U.S. public sector, we also saw a shortfall in larger orders from the private sector.
There's not a common theme there, but what's promising is that with one exception, they remain in the pipeline, and it's continuous conversations about taking that expansion from a small segment of the company into a broader use case. Also, combining that with the good activity that we see for small and mid-sized orders, that means that we remain optimistic about the position we have in the market. We continue to see growth in subscription, and I think that's good because that will provide more predictability and more stable development of net sales over time.
We're excited about the collaboration we have initiated with Best Buy, and I think this is a good test for us to see not just how many customers are interested in buying YubiKeys online, but going and buying it in traditional shops where they can also get support from the local representatives in how they actually deploy the key. We continue to invest in innovation and future growth. I think the biggest highlight there was really when it comes to our core product during the quarter, highlighting new functionality, which is in the immediate product roadmap.
Finally, if you're interested in learning more about the company and get to learn more about our upcoming product releases, but also a run-through of our go-to-market and also understanding the difference between the two business model perpetual subscription, I recommend and you're cordially invited to attend our investor day, which will be held in Stockholm next week on Wednesday, starting at 3:00 P.M. local time. It will be recorded, so it will be accessible online afterwards, but if you want to be there and ask questions, you are cordially welcomed to join our investor day. Hope to see you there, and with that, we'll hand it over for any questions. We'll start with live questions.
If you wish to ask a question, please dial pound key five on your telephone keypad to enter the queue. If you wish to withdraw your question, please dial pound key six on your telephone keypad. The next question comes from Erik Lindholm-Röjestå l from SEB. Please go ahead.
Yes. Good morning and good afternoon for you in California. Just a couple of questions from me. I want to start on the quarter here. You mentioned seeing a high share of smaller and mid-sized orders in the quarter. Is it fair to say that more customers are active and ordering compared to a year ago? Is it possible to disclose sort of what growth you are seeing in the number of orders and the number of customers. I will start there. Thank you.
Thank you, Erik. To respond to that, yeah, we did see an increased number of both new customers placing orders and existing customers doing follow-up orders. We debated some before we released this report whether we should report order value by order size, and we concluded that if we start that, then of course we'd need to continue doing so, and it may add confusion rather than adding clarity. I think the compromise that we'll go for is that we'll try to share at the investor day what the composition of orders by deal size look like, because then if you look at orders below $1 million, you can see that's much more predictable, and there's a long-term positive trend there, whereas you see that big volatility when it comes to the bigger orders quarter by quarter and even year by year.
Hopefully, that will add some context to understand what the order composition looks like.
Okay. That's great. I'm looking forward to that at the CMV then. I mean, you speak about sort of evolving your platform to protect digital identities and not just secure logins. I wanted to ask if there's more of an organic effort that you're developing and aiming to reach with partners, perhaps, or do you think you have to make acquisitions here to sort of fully reach your goals in this area? Thanks.
It's more a matter of speed, honestly. It's a very good question, but I'll have to get back to you on that. If you look at two of the critical areas where we need to supplement our current product offering, it's within identity verification and credentials management. When it comes to IDV, it's a pretty complex business in itself. It's more about providing a framework so that customers either could fall back on a solution that we offer or that there's a good integration with the IDV identity verifier that they're using. That can be developed internally, or we could seek a partnership or a merger and acquisition, but we'll have to get back to you on that. The other one, credential management, we do have some of those pieces in place already, but when it comes to expanding those, it's a matter either of partnerships or acquisitions.
I don't think you should expect if we go down the acquisition route, I don't think you should expect a large acquisition which is targeting, say, market access. It's more about then critical technology that would be relevant for us.
Okay. Perfect. Just a final question. You mentioned most of these sort of large enterprise orders still being active opportunities, the public sector as well, perhaps. Do you feel like there has been any changes to the competitive landscape at all, or are you losing any deals to competition? Thanks.
I would say if there's one general change in the competitive landscape is that when we looked at the biggest competition outside of username and password, say, a couple of years back, then it was different software apps, authentication apps on your cell phone. Today, we increasingly see Cloud Sync passkeys being deployed, and that is both a threat and an opportunity because we are one of the founders behind the passkeys technology, and we know that technology better than arguably anyone. Analysts like Gartner agree that Cloud Sync passkeys is a giant leap from passwords, but if you want the highest level of security, highest level of security, and also the biggest flexibility, then you need to go with hardware-based passkeys, which is the YubiKey.
The competitive landscape is changing a little bit in terms of technology and use, but we don't see a major shift there. That's a long-term trend that we need to explore.
Okay. Thank you.
Thanks, Erik.
The next question comes from Predrag Savinovic from Carnegie. Please go ahead.
Hi. Good morning, Mattias, Snejana, and Alexandra. Thanks for taking my questions. Let me start by the U.S. government. You did unpack a bit on the size of it, but in terms of a catch-up effect, can this be, for example, a delay where you see accelerated order momentum Q4, Q1, Q2 due to these budget shutdowns in the U.S.?
I mentioned that with one exception, for all the larger opportunities, they continue into Q4. Honestly, we have very little visibility into the federal conversations as there is essentially no one responding to phone calls there. We will have to see as the government opens up again what the spend mandate is and what the plans are going forward within the federal sector, and that actually has repercussions also for state and local since they also depend on a lot of federal funding in this space. I think it is too early to tell whether there will be catch-up from them. I think that the need is definitely there. It is more a question of will the budgets be there within the U.S. public sector.
All right. Another question on the competitive landscape. Do you have any visibility or any expectations for how it might change in the future considering how the capacity and new threats are increasing, becoming more complex, and software is becoming potentially slightly too fragile? Do you see or hear discussions on some of your partners in Silicon Valley and so on in terms of either partnering further with you or developing something themselves?
One trend that we see, I mean, everyone's talking about how AI will impact the threat landscape with more sophisticated attacks and more scalable and industrialized attacks based on harvesting information to make very targeted attacks attacking digital identities. Another aspect of that when it comes to AI is with Agentic AI, then you really want to make sure that if you authorize an AI to represent you in different transactions, you definitely need strong authentication. I think this will be something that will work in our favor in the sense that there is an even greater need for strong authentication in securing the digital identities that are being out there, whether they're Agentic AI or you doing it yourself, so to speak.
What's interesting there is that if you look at the people that probably have the most insight into what this will mean, it's arguably some of the leading AI companies that we see a very strong market share. Almost all AI companies, at least in the U.S., use YubiKeys internally today. That, to me, is a good indication that we're offering something which is very robust when it comes to AI-enabled attacks. Of course, AI companies today are relatively small when it comes to internal use, but as that insight and as that threat becomes more pervasive, I'm optimistic that there's an ever-growing realization that you need a hardware root of trust.
Sounds very interesting. Finally, in terms of inventory levels, if you can comment on what you think in absolute numbers, but also percentage of sales for 2026.
Yeah. I think I've learned to be a little careful when it comes to short-term forecasts, but as Snejana mentioned, the driver for the buildup in inventory in Q3 was that we took final delivery of all second-half deliveries, committed deliveries of secure elements already in Q3. That meant that there was a short-term peak, and since we do not buy any more of those in Q4, that should by nature mean that the inventory levels drop when it comes to components. We are a little high now in inventory levels, and it is mostly about components where we have secured enough secure elements to maintain production, and that should come down. Another thing which could be commented on is that the deliveries of secure elements that we took now in Q3 were actually the last ones of the ones that we committed already three years back.
Now we're in a position where we can set new purchase levels, meaning that we can reduce inventory level. How fast that will happen, I'm afraid I can't commit to that right now, but that's definitely something that we'll, because we are a little too high in inventory levels, particularly when it comes to raw components right now.
Super. Thank you very much, guys.
Thanks for your time.
The next question comes from Simon Granath from ABG. Please go ahead.
Hi, Mattias, Snejana, and Alexandra. Thanks for having my questions. I'd like to continue on the inventory topic because, as you point out, cash flow was weighted by that, and there have been lots of questions on this on previous calls as well. Can you help us unpack why it's necessary to have this, at least in my view, big inventory levels? Is this a competitive edge that you see that your customers really appreciate, i.e., that you have short deliveries, or could this change markedly over time? Thanks.
There are two reasons for why you want to have a certain level of inventory, really. Fundamentally, it's about our ability. One part is fundamentally about our ability to deliver on short notice in the different form factors to customers because even if typically a deployment is planned and takes at least a large deployment, some quarters to do, in some cases, the customer urgently needs to have a need satisfied, and then we need to have inventory levels that are sufficient of the different versions in the different geographies that we're serving. The other part is more about business continuity, and that's on the component side, making sure that the critical components where we essentially have a single point of failure that we're not put in a position where we run out of stock on those.
There was a scare, I think, broadly in the market when it comes to a shortage of—it's getting later in California, I'm losing the words—of secure elements and more broadly in silicon circuits for some time. That made us realize that we can't go for just in time delivery there. We've made sure that we secured at least a year of inventory of critical components, which would, if needed, even permit us to transition over to a different technical platform. That's more kind of a business continuity. On that part of the inventory, we're a little too high right now because of the volumes that we secured already three years back, and that's something that should come down. We think that to satisfy those two requirements, the target inventory level should be in the 23%-25% range measured against the last 12 months.
It's not an official target we have, but that's kind of a rule of thumb we have. That's the level we should be targeting going forward.
Thank you so much. Appreciate the color here. I also had a question on net recruitment because, as you highlight, the momentum from medium-sized customers is good while there has been slower progress with the larger customers. Does this change in dynamics, assuming that this continues as well, incrementally require more sales resources, or do you see scale effects kicking in here? In connection to that, how should we think about net recruitment in 2026? Should it be in line with 2025 or a slightly slower pace given the current market dynamics and outlook?
We're still in a situation where most of the demand is generated in a one-to-one direct sales relationship. Even though a lot of delivery happens through channel, i.e., resellers and distributors, most of the larger deals are settled in a one-to-one direct relationship where we are account executives engaged directly with the customer. One of the ambitions and one of the big investments that we're making on the go-to-market side is making sure that we have more channel and partner-generated sales. We're making some good progress there, but that takes time. That's an area where we'll continue to invest in, which means, again, kind of rule of thumb, we're seeing some scalability when it comes to winning orders which aren't generated by our demand generation, but by partners and channel. On the other hand, we need to invest in building that capacity.
I don't see a big change in the sales and marketing spend compared to revenue in the short term, but longer term, we want to build more leverage in that model. I'm not going to be able to provide good guidance for 2026, but we don't anticipate any major changes there.
That's all there. Thank you so much. A final question from me. Can you refresh us on your view around buybacks, especially now when the share has continued to drop while the balance sheet remains very robust in value?
Yeah. As a reminder, we got a mandate to repurchase up to 2% of the outstanding shares. Sorry, we got a mandate to, I think the board got a mandate from the AGM to repurchase up to 5% of the outstanding shares, and then we had a board decision to buy up to 2% of the outstanding shares in mid-Q3, if I remember correctly. As is reported in the interim report, we've used about half of that mandate, but there hasn't been a, and of course, since late September, we haven't used any more of that mandate since we then could be argued that we're leveraging inside information while purchasing shares. It's really subject to a separate board decision whether we should resume that, but we'll have to get back to you on that question.
There's still room for both the mandate granted by the AGM and the board decision on how much to repurchase.
Very good. Thanks for having my questions.
Thank you.
The next question comes from Georg Attling from Pareto Securities. Please go ahead.
Good morning and thanks for taking my question. Can we just sort on the subscription bookings? Most of the decline was obviously less renewals on subscription bookings this quarter. I'm just thinking in Q4, what's the size of the upcoming renewals? Is it in line with last year, or will this be a drag on subscription booking growth in Q4?
I'm not quite sure I got the question there. Could you repeat the first half? I may have missed it. Snejana, maybe you got it. I'm not sure I got the question.
I can clarify. Yeah. This quarter, we had SEK 43 million of subscription renewals compared to SEK 62 million in Q3 last year. Just wondering in Q4 if this continues to be a drag or if the size of the upcoming renewals in Q4 are roughly the similar size of Q4 2024.
I can take more sort of a general sort of comment on that. The duration of our subscriptions is, on average, three years. Every quarter, the subscriptions that come for renewal will be basically the ones that we take three years back in the same quarter. I would not be able to comment on the exact amount, but as we have grown now, the subscription bookings lately, if we look three years back, probably the size of the renewals will start increasing as we go forward.
Yeah. Okay. On my second question, I'm just wondering about the personnel cost per employee here. I understand that FX is moving this a little bit, but even excluding that, we see the cost per head coming down here in Q3. Just wondering if you could add some more color to why that is.
Yeah. We have two effects in the personnel cost this quarter. One, correctly, as you say, is the FX movement as we have quite a large share of our personnel cost in the US. On that note, we'll have a sort of a positive impact in SEK translation. That's one. The other one is that we have two development projects that are quite advanced, and we have started this quarter actually capitalizing part of the time that we are putting into advancing these projects. The total sort of capitalized development cost is about SEK 6 million. These are the two effects.
Yeah. Okay. That capitalized expenses in personnel cost R&D, I guess.
Yes.
That's why that's down. Okay. Just final question on Q4 here. Wondering first, what's your visibility on the larger order bookings? Then generally speaking, is Q4 more tilted towards large orders than Q3 or roughly similar?
I can talk some. Of course, we have visibility in the sense that any large deal which is expected to close in Q4 is already in our pipeline for some time, and we have visibility into how the conversations are going. We definitely see that there's progress and activity on them, but as I mentioned before, the volatility when it comes to whether an order actually closes before or after quarter end is very hard to predict. That is just generally speaking. There is much more visibility, as mentioned, on smaller and mid-sized orders where the velocity is typically much higher and where they are just kind of by the law of numbers, you have more predictability on the aggregate since it is thousands of orders instead of a handful of orders.
When it comes to deal composition, I can see that there's a clear trend across quarters when it comes to the deal composition. However, Q4 is typically a very, let's say, broad-based quarter where you see orders across all geographies and all types of industries. For instance, normally Q3 is a quarter where you see low activity in Europe because of vacation, and you see high activity in US public sector because of the end of the fiscal year. This year, we didn't see that. We saw pretty good traction in Europe, and we saw very limited activity for U.S. federal orders. It was a bit of an anomaly, but that's how Q3 typically looks.
We don't see any pattern like that in Q4 other than it being typically a strong quarter, probably because people wanted to spend their budgets or close business before the end of the year, but nothing really in terms of deal size that can be discerned there.
Okay. That's all my questions. Thank you very much.
Thank you.
There are no more questions at this time, so I hand the conference back to the speakers for any written questions and closing comments.
We'll start with a question from David. The first one is, how does YubiKey as a Service enable faster deployment within organizations and accelerate the learn and expand strategy? Now, that's one of our key selling points really to this date. There's to date relatively limited specific product functionality in the YubiKey as a Service offering. It's just, quote-unquote, just about making sure that we're that partner when it comes to deployment. I'll give two examples of that. One is that we actually help train the customer based on our experience working with other customers on how you execute a good rollout. Of course, based on our experience there, that would typically quicken up the deployment.
The other one is more when it comes to the sales process because with YubiKey as a Service, the customer does not need to know exactly how many keys they will deploy in what location and what time and what type of YubiKey they want to have: USB-A, USB-C, Lightning, and whatnot because it is commitment more on protecting the users, and then they have flexibility on the form factors. That particular feature typically speeds up the sales process. Those would be two examples of how YubiKey as a Service is an enabler for faster deployment. Second question from David is, as Passkey adoption grows and syncing becomes seamless through Apple, Google, and Microsoft ecosystems, how do you anticipate this will impact YubiKey demand among SMB and enterprise customers? Really insightful question because, as we talked about before, there are two types of Passkeys.
One which is cloud synced and is typically tied, well, it is tied to a platform like Apple's or Google's or Microsoft's. Then there are Passkeys that are hardware-bound like the ones that are on the YubiKeys. Now, the market for Passkeys is growing quite rapidly. A lot of that and a lot of the effort from the platform provider is on promoting the cloud sync Passkeys. However, they're tied to that platform, and it's actually often very complicated to move it across platforms. Not only is a hardware-bound Passkey more secure, but it's also more flexible, and you're not tied down to that platform. There are two different motions impacting that. One is, okay, for convenience, it could be good if you're only using one platform to use cloud-based cloud sync Passkeys.
However, if you want to maintain flexibility and more robust recovery, you probably want to go for a hardware-bound one. We have a very strong, of course, opinion about what's the best solution, and ours is always hardware root of trust, even if you can use it for convenience for applications where cloud sync passkeys are deemed safe enough. I think this is long-term something that will actually foster a type of user behavior, realizing that it's really good to have that separate hardware root of trust. Third question, and I'll have to ask you, Snejana, but I'll read out the question. Which LTIP program incurred the costs in the quarter?
We have three active LTIP programs: 2023, the 2024, and the 2025. All three of them have running costs because they are three years long. The 2023 program has the lowest cost because it's a different program, but 2024 and the 2025 program incur the higher share of the cost because they are performance-based. According to IFRS, there are sort of different rules how we account for that, but it includes the cost of the program plus the social cost that we will need to pay as an employer based on this benefit.
It's really all three programs that impacted the cost in the quarter then?
Yes.
Great. Good. Another question from you. It would be very helpful if you could, in a bit more detail, explain the journey towards the subscription model and how long this journey will take. Are we talking about a number of quarters or a large number of years or something in between? I think Q3 net sales subscription percentage was 15.8% and nine-month stage. Okay. The full nine months.
The year-to-date, I think.
14.7. Yeah, year-to-date. The optical impression is that this precision is pretty slow. Could you please develop this topic, please? Yeah, it is. We have an ambition to where we think that the natural mix between perpetual and subscription is probably 50/50, but it is going to be a journey to get there. Part of that will be in terms of how we can impact that is really about functionality. We had a breakthrough we felt in Q2 when we, for the first time, saw that high-tech companies were interested in buying on a subscription basis. Then it was not so much about what we talked earlier, deployment support or implementation support because they are long-time customers and they are pretty qualified.
There was more about commitments on our roadmap and our functionality, in particular when it comes to PQC because they're pretty advanced when it comes to thinking about that and knowing what's in the plans there. For other industries, it's perhaps not either about deployment but more about business continuity. I think we need to work pretty much sector by sector to figure out how we have the right offering so that we support our customers not just with a one-off delivery but with a commitment from our end. It is, as you say, a transition that will take a number of years. Next question is from Alex. How locked are your bookings? Typically, how long does it take for booking to flow into revenue?
I'm not sure I get the first part of the question, but how long does it typically take for booking to flow into revenue for a perpetual sale? Actually, I'll hand this over to you, Snejana, since you have such excellent preparation.
Of course. Actually, I mean, how locked are your bookings? I would say pretty locked. I mean, it's a contract and a sales order. Yeah, it is pretty locked. Typically, how long it takes? For smaller orders, the shipment takes quite fast. The larger orders, it could take some time in terms of shipment, actually primarily from a customer's side as they are planning the deployment. It can take some time, typically a few months. There are some very large perpetual orders that could take up to a year, but now we're talking about the large orders that Mattias is talking about, about like $ 1 million or $3 million. For the subscription bookings, in the order bookings, we report the total contract value. On the subscription orders, we will see, again, typically a three-year contract value. Then we recognize the revenue on a linear basis.
The next quarter, it will be like one-twelfth of the contract value on average. That's how it flows. I hope this gives a bit more clarity. The next question, inventory increased 19% between September 25 versus last year, September 24. How do you see this trending? I think we commented, Mattias already as well commented, we had some final shipments of the secure element, both in Q2 and Q3 this year. Now, these were the final shipments on this contract, and we are a bit high. We would be working on kind of having a bit more optimal inventory. Anything else you would like to comment, Mattias?
I think you covered it. The final question there, how do you improve cash conversion? Again, I'll ask you to comment first on that, Snejana.
Exactly. I mean, from an operating point of view, we have quite good cash conversion before the changes in the working capital. I think, again, the biggest driver to improve that would be the inventory. From an AI perspective, we have quite a stable percentage of revenue. Again, it's about working on the inventory.
Great. We have an anonymous question. Who are your biggest competitors within hardware-based keys? If you talk about all types of hardware-based keys, the biggest competitors are the smart card vendors, and that's the traditional solution. That includes companies like HID owned by Assa Abloy, Gemalto owned by Thales, RSAC, OneSpan, used to be called something different, but now they're OneSpan. Those would be the biggest traditional competitors we have within hardware-based keys. When you talk about Passkeys that are hardware-based, security keys, it's actually the same companies that I just mentioned because they've now come to realize that this is where the market is moving in terms of strong MFA. They've all introduced security keys that look surprisingly much like YubiKeys. They are, of course, they're good about security, so they're definitely competitors that we respect. Good. Next question is from Anders at the [Nubica Navy].
You mentioned AI effects earlier. Is there any other changes in the market that could change increased demand? I think the biggest thing is how the development continues when it comes to Passkeys. It is a much better way than username and password. We really encourage everyone to consider implementing Passkeys to up their game when it comes to MFA. I think when we enter into customer conversations, they're all aware of this development, and then it's more about, okay, do I want to get the highest level of security and perhaps even more importantly, do I want to have that robustness in my solution and not trust the big platform providers to depend on them on my digital identities? It turns into a conversation. Okay, then everyone needs a YubiKey. Do you need to use it for every type of authentication? Probably not.
Do you want to use it for very sensitive transactions? Yes. Do you want to have it as the way that you switch between platforms and as effectively the hardware of trust? Yes. I think that the development of Passkeys is one of those bigger trends that will impact our demand. It is about getting that knowledge out there and, in some cases, also regulation driving a need for deployment of strong MFA. I think we have one more question here.
Sorry to circle back. Maybe you want to take this, Snejana.
Yes. It's a follow-up on the LTIP cost. Let me try to explain again. The LTIP for 2023 program is based on total return for shareholders. We have thresholds for the share price that determine whether the RCUs will vest. However, we take the cost basically at the time of granting. It is an option-based approach or valuation, and the cost for LTIP 2023 is quite low because of this valuation method. We take the full cost and we spread it out throughout the duration of the program. Since we have a catch-up effect at the end of the program for all the programs, we take the full cost. For 2024 and 2025, we take the cost again at the time of granting, the full cost for the full program, so three years ahead, but we spread it out again throughout the months and the quarters.
Again, because we have a catch-up effect in both programs when they end, basically at this point, we calculate or we take the cost with the assumption that 100% of the shares will vest at the end of the program period. That is really kind of what lies behind. I hope it became more clear. Basically, we take the full cost for all the three years and we spread it out throughout the years.
Great. We have a question from Magnus. After several consecutive profit warnings, do you think management now has a credibility issue around this communications? I'm not sure we have several consecutive profit warnings, but to reel back the tape there, what happened when we released the Q1 report was that we said that we saw a drop in demand towards the end of Q1 spilling into Q2. We provided some negative guidance there, and we followed up when we released the Q2 report. Yes, that materialized into lower sales in Q2 as in net revenue. However, we did see a recovery towards the end of Q2. The order bookings were unusually weighted towards the end of the quarter, and we saw strong momentum going into Q3. That's the profit warning now.
That positive forecast that we made or the positive comment that I made in my CEO statement about the good velocity going into Q3 did not actually materialize into the larger orders materializing in Q3, and hence the profit warning. Looking in the rearview mirror, even without the rearview mirror perspective, I should know. I have taken enough econometrics to know that it is very difficult to make strong predictions based on only a handful of deals that could be correlated. I definitely realized that I should have been even more sure before putting a positive statement like that out. I understand if that introduces a credibility issue. It was all in earnesty, but I can understand if that means that there is some doubt on our predictability.
That's one of the reasons why we, during the investor day, will want to show what does a typical deal composition look like over a quarter to give some more confidence in what's predictable and what's not predictable when it comes to order bookings. Next, an anonymous question. What does Yubico do better than other hardware-based competitors? I would put it into two things. One is usability, where we, as explained earlier, have invested in making sure that our key actually fits in all the relevant logs, that it's integrated into systems. The other one is about security. Of course, we're using, when it comes to Passkeys, an open protocol, an open standard. It's no difference there, but security isn't only about cryptography. It's about the integrity of the product. It's about the integrity even of the organization.
I think we've had a very holistic perspective and a thought-through perspective when it comes to security, ranging from everything that we source our components from trusted suppliers, that we only manufacture in controlled environments in Western Europe and in Europe and in the U.S., to the fact that we have very rigorous peer control on how new software gets deployed. I think we have earned recognition as having the highest level of security. I'm not going to talk bad about anything competitors do, at least the competitors that I just mentioned, but I think that that combination of usability and security puts us at the top. We'll have to wrap it up shortly, but we'll take two or three more questions. Do you see a threat of the other hardware-based competitors taking market share from Yubico by launching Passkeys similar to YubiKeys?
All of them already have, and there's definitely competition out there. If there's no competition, there's no market, but because of the combination of usability and security, I feel that we have an edge. We just need to maintain that edge by launching and pursuing new product features and functionality over time. Given that Yubico's business is largely based on USB support, how do you see the company's future prospect if device manufacturers follow Apple's example of removing physical parts as they did with the headphone jack? What is Yubico's plan B in such a scenario? I should mention that most YubiKeys, excluding those really small ones, the nanos, also support NFC. I think we will make sure that we cover the different protocols for transmitting data that are out there.
I don't see the change in USB support or the migration from USB-A to USB-C as a big impact. Final question. Which two to three parameters do you consider most insightful to evaluate when thinking about Yubico's intrinsic value? That's a really good question. I'll have to take a minute to think about it, but let me put it like this. I think we need to get comfortable with the total addressable market and what you think about how that will evolve over time. That kind of sets the potential. Then it comes down to our product-market fit, which is a little more difficult to put a number on, but I think you'll find implications in terms of how well-positioned a company is by looking at what kind of users they have, what position they have within those.
Finally, of course, parameters, of course, the financial numbers are how do we deliver on that opportunity? That's down to execution. Great. I think that actually sums up both the live and written questions. With that, we'll end the Q&A. Again, repeat that you're all welcome to attend our investor day in Stockholm next week, Wednesday, November 19, starting at 3:00 P.M. Hoping to see as many of you as possible there. Thanks so much. Have a great day.