Welcome to Yubico Q3 2026 report presentation. For the first part of the presentation, participants will be in listen-only mode. During the questions and answers session, participants are able to ask questions by dialing pound key five on their telephone keypad. Now, I will hand the conference over to CEO Jerrod Chong and CFO Snejana Koleva. Please go ahead.
Hi, everyone. Welcome to our Q3 report 2026. We are in San Francisco. Quick recap of Yubico's strong in our customer business. We are growing obviously very strong also in our overall e-comm business. We see this in our business customers and our end customers as well. We have a strong gross margin position that we continue to build upon the business this way, and we continue to invest in our subscription business as evident in our growth. I want to focus the next part of it to describe a little bit of the market landscape and also give some context for how companies are looking at these attacks that we're seeing. We do see a general heightened awareness of cyberattacks. I think many of you see this on the news every day, independent of cyber news.
We make a lot of observations around the world where the news cycle in mainstream do talk about cybersecurity at a very accelerated pace. In addition to that, we also see different countries and regions implementing various policies and regulations to ensure that everyone is up-leveling their cybersecurity practices. Clearly, this is the age of AI, so there are three things that happen when you put the combination of known attacks with AI. First, you get speed. Things can happen really, really fast. You get scale, which means it can happen to many, many people, many companies at the same time. The third thing you actually get when you have AI in the picture, you get sophistication, which means that the accuracy of an attack goes up a lot.
Traditionally, most organizations have depended on being able to manage one of two or the three, but when all three happens at the same time, that is why you see a lot of headline news. We conducted our own state of authentication and just trying to understand where companies are, individuals are, organizations are. As I've stated, awareness is really high, but unfortunately, adoption is still not where I think we all want to be, and so you see the gaps between knowing what to do or knowing there's a problem versus fixing the problem. I think that's something that we are looking closely more towards helping companies with the adoption side of the conversation.
What we also see is that AI has brought a lot and will bring a lot of productivity gains in general, but without the proper guardrails, what is going to happen is that the attacks will continue to happen, and you will also have insider threats being activated because you did not properly monitor or govern the AI workflows. We find a lot of organizations wanting to make sure that there are some checks and balances when you implement technology into the stack or AI technology in the stack, there is some way to either limit the scope or make sure that the right authorized user or teams organization does that before it carry on autonomous behavior. We want to move over to the recent highlights from Yubico. We are here in San Francisco.
We just completed our YubiNation, our first inaugural Yubico conference where we bring together our customers, our partners, and industry, our ecosystem, to work together to build and protect all the latest threats. We have introduced two product lines at this conference. We talked about YubiID, which is our new offering to help customers manage their digital lifecycle in terms of how they would onboard users, how would recover users, making sure that they stay secure while things happen to their workforce and their end users. And we have also introduced a new capability in the YubiKey where we can address some of the future post-quantum threats, which means when we have quantum computing, where it is super powerful computer that can break existing systems. You need a new set of capabilities to resist those attacks.
Other news in terms of commercial, we have expanded our retail business by expanding not just with the U.S., we are also expanding into Europe, where an end user can go up to a retail store, a brick-and-mortar store in several cases, and buy it while they are buying other electronic products, for example. This continues to grow for us, meeting customers where they are in terms of how they want to buy our technology. We have also expanded into markets where we have been there before, but we see the need to invest further, particularly in Japan, where there is currently a state of emergency for cybersecurity because of the number of attacks and fraud to the everyday citizens. In terms of our execution, it was a strong quarter for us, growing our order bookings very strongly.
We also had a good mix of sector demand, particularly in the finance, public sector, and technology. Those sectors were not performing well earlier this year, and we see a comeback for a number of these organizations. One thing that it is important to call out before is that the growth in the business is broad-based, which means that we also see growth in our business below $1 million, which what we call the run rate, and that is very important because that is the trajectory that we think is more how we would anticipate the tip of the spear, which is how the market feels about the products. Long term, we are very confident with our long-term targets, which we have had pegged now at 15%-20%, the average annual net growth, and excuse me, sustaining our EBIT margin at 20%, growing towards 20%.
We will definitely cover a lot of these further in our Capital Markets Day, so we won't go into every single detail, but we'll cover some highlights during this call. This is a quick recap in terms of our various industry performance. You can see that strong growth in our technology, public sector, and financial services. If you look at it collectively, the reason for that is these organizations in these sectors and these industries do want to get the best technology, and we see that they're also regulated or regulating, so they are really aware of the type of technology that we provide that helps them solve a business problem.
Key figures, as we've described in our report and in the numbers that we've shown, bookings are growing very well for this quarter. The reason for that is several large opportunities that we've been working over, some of them over several years, did land all at the same time in the quarter, which means that we understand that these larger opportunities do take time, and it's not always going to hit every quarter at the same estimates that we anticipate. We described earlier this year as well, which is we don't typically lose these large opportunities. It is a little bit more unpredictable when they will land, so when these land in this quarter, the results are evident. We continue to invest in our subscription business.
YubiID is a product that you buy in subscription, so we continue to invest in our subscription business, particularly expanding into our portfolio of platforms and services and software. This is one of the key growth drivers we will be talking about much more at Capital Markets Day and for the near future. EBIT is high as well, and we've described before, we have a strong leverage position when we have fixed costs, so when we go above that, then every sales really translate into profit in a very direct way. With that, I will hand it over to Snejana to go through a little bit of the numbers.
Thank you, Jerrod. Good morning, everybody, and good afternoon. Let's start with comparing to last year, Q3. We have, as Jerrod mentioned, had a very healthy growth in order booking, 85% organic, excluding the currency impact. Just as a reminder, the year-to-date order booking growth is 21%. In net sales, we grew with 28% organically, and year-to-date, we are growing with 9%, excluding the currency impact. From an EBIT standpoint, we have improved substantially the EBIT margin. We have a positive currency impact this quarter, which contributed approximately SEK 20 million, and the rest is operational improvement. Again, we have a very substantial operating leverage with high gross profit, so when we grow sales, the impact on EBIT is very visible. Year-to-date EBIT is 15.7%. Let's zoom in into the bookings.
Very strong quarter indeed with SEK 949 million in bookings. We see a very large part of that is the large orders, the large customer orders. As Jerrod mentioned, these are orders that we have been working a long time on, and now in Q3, they all materialized. Excluding these large orders, the foundation, so to say, is also growing 40% year-on-year, with particularly strong growth in e-commerce. As Jerrod mentioned, we have activated a few new countries, especially in the Asia-Pacific region with Japan. We are expanding our retail presence, and in general, the awareness in the consumer market is also increasing with all the threats. So we see a very healthy growth in this segment. From a regional perspective, Americas is growing very healthily, but also EMEA recorded its strongest third quarter to date.
YubiKey as a Service was 22% out of the total booking. Zooming in into the perpetual bookings in particular, very strong order booking for the quarter at SEK 738 million, and the sales grew with 28% to 595. Jerrod mentioned technology was the largest contributor to these perpetual bookings. We have also public sector bookings that contribute and financial services. We haven't delivered all the bookings. As you see, it's a very positive book-to-bill, so we have further deliveries to come in the future, in the next periods. In the subscription bookings, the order intake more than doubled versus last year. Bookings were 211 million.
Renewals out of that represented 106 million, so approximately half of the bookings are renewals, which is great news because that means that our customers are staying with us and they continue seeing the value in the YubiKey as a Service subscription. That, of course, drives also the annual recurring revenue growth and the subscription net sales growth with 30% this quarter. Decomposing or going deeper into the subscriptions and the annual recurring revenue, we see a like-for-like growth versus the end of 2025 of 13%. This is very much driven by adding new customers, but also expansions. That means that when we're renewing existing customers, we expand within their workforce or with higher tier of subscription, which is great testimony of the trust that they have in YubiKey as a Service.
We have also very reasonable or slow churn rate and low contractions, which drives very healthy gross retention rate of 94% almost and net retention rate of 107%. From a profitability viewpoint, our gross profit is continued to be very healthy for this quarter, 81.3%. It's supported by strong volumes and favorable product and channel mix. As I mentioned, the retail and e-commerce sector is growing, and it has one of the highest gross profits within our channel mix. So that contributes positively. The EBIT, of course, is impacted by the high sales volume and the high operating leverage. With this strong profitability, we have also a very healthy cash flow for the quarter. Before the working capital changes, the cash flow is SEK 173 million. The working capital change is positive, contributing with SEK 54 million.
We see reduction of inventory based on the high sales. It is partially offset by increased receivables, again, driven by the strong sales quarter. Investing activities, the majority of this is from R&D, capitalized R&D costs, which are related to the new products that we launched. Now in YubiNation, the YubiID and the PQC-ready YubiKey. Minus 4 million from financing activities. All in all, very strong cash flow, working well on the working capital, and very strong cash position with SEK 1.2 billion. With that, I will hand back to Jerrod.
Yes, we also published our new financial targets, and this is for the next five years, with the average annual net sales growth over the five-year period. It is important to understand the previous financial targets were actually ended from when we published it at 2029. When we look at these new targets, we are actually very bullish from a long-term growth perspective because we are providing this for the next five-year period. From a profitability perspective, we put the word towards 20% because we want to be able to invest, to scale, and sometimes it is not a linear way to look at the way that we build a business. We know that in order to continue to deliver new products, we have to invest.
We want to take a measured step-by-step approach towards building strength in our product capabilities and also providing the necessary indications of when we need to invest further. That is the reason we are using the word towards, which means that some years we may not be as profitable as we want, but we are investing more, and then when we fully realize the investments of the new products, then we will obviously be more profitable. We will definitely dive into all the details on the products and the go-to-market conversations on our strategy and our plan at Capital Markets Day. I will be speaking. Albert Biketi, Chief Product and Technology Officer, will be speaking. Poupak, our go-to-market leader, will be speaking, and Snejana will also be speaking.
We will also be joined by our customer, Lovable, and we will also be joined by one of our key partners that we have activated this year, IBM, to also share their thoughts and their insights of how they work with Yubico. We are ready to open up for questions from the floor.
If you wish to ask a question, please dial pound key five on your telephone keypad to enter the queue. If you wish to withdraw your question, please dial pound key six on your telephone keypad. The next question comes from Simon Granath from ABG. Please go ahead.
Thank you. Hi, Jerrod and Snejana. Congrats on the very strong results. I would like to start on the sales target, and maybe I will have to wait for the Capital Markets Day here, but can you shed more light on this one? Does it entail several new product launches over the coming years? Is pricing a significant lever? Do larger orders sustainably have to come back, or is it reachable based on the smaller and midterm deals that you also see growing? Thanks.
Yes. That question comes up in many different ways. I will answer it in a broad base first. Our goal, and I have described this much earlier in Q1 about directionally where I believe Yubico can go and will go, which is we are moving to a multi-product organization, right? We see we had YubiKey as a Service before, and that had a foundational piece of requiring the YubiKey and then expanding capabilities to expand the adoption. We have introduced new products. We are also introducing new segments. YubiID really allows us to sell to customers that may or may not want to use with the YubiKey. That is directionally how we think about growth, which is investing in product lines that customers value, customers want us to build, and then we deliver. At the same time, it takes a while for the engine to kind of get going, right?
A new product line means that we have to invest further. We have to enable the team to sell these products. Customers are trying to understand how it integrates and work with the environment. These things take a bit of time to really get the full value realization. Having said that, I think we are always going to be working with the most impactful and largest companies of the world. We have a strong presence in the Global 2000 that will continue to be where we will spend time on. At the same time, a lot of other small organizations face similar threats.
We are going to continue to also expand, as you can see from our retail push, to meet some of these customers where they are, because not every customer has the capability, like a Global 2000, to help them get adoption of the technology. I think we continue to invest in meeting the needs of the most, I would say, sophisticated organizations in the world, because they're being attacked by the most sophisticated attackers. We also want to help the other organizations who are smaller, that don't have resources to be successfully defending against the attacks. Our business, we will see growth in both areas. I've described, when do we see these large organizations invest in a large amount? Sometimes it can be quite unpredictable.
Thank you, Jerrod. Appreciate that colorful answer, and looking forward to discussing this further in two weeks' time. On the sales driver in this quarter, the push you have done into e-comm is certainly bearing fruit here. Do you see any reason why it should not be sustainable over the coming quarters? I mean, it's much smaller deals, of course, so I'm just trying to figure out the sustainability of that strength. Thanks.
Yeah, I think the e-comm business, there's a few layers to the e-comm business. We look at the e-comm business as not just about consumer trends or, I would consider, the more educated consumers with tech. In this part of the business, we also see small organizations, small companies, or even you can think of a company with five employees, right? That is in this bucket as well. When we talk about growth, we can do more to sub-categorize some of our organizations in this bucket. Sometimes you also find very large organizations buying through e-comm as well. It does happen. The reason is sometimes very clear, because they need to do something really quickly, and e-comm sometimes can be the fastest route. You can get it the same day. For example, you can think of Amazon. They can get it the same day.
Sometimes there's a need to get it the same day. It's very layered. It's not just about the consumer business here. We're talking about a variety of subcategories that go into e-comm. Is it sustainable? Again, it depends on the macro trend sometimes, right? If I just describe, if the small organizations feel the awareness, feel the need, and they are protected or need to be protected, then they will obviously spend a bit more. We do want to explain that the e-comm business is quite dependent on where we set up the warehousing. The reason why we see some of the growth happen was that we invested, as we described, in our Singapore hub, and that made the e-comm business pick up because we could now meet customers' expectation where they didn't have to wait weeks and weeks and weeks to get a product.
It is dependent on how much and how quickly we can expand capabilities in country, in region, where the expectation from an e-comm business is that they can get it almost instantly. For our business to be able to do that, there sometimes are quite significant investments to think about warehousing, to think about returns, and all these other things. At the moment, I think the investment we've made in certain hubs work, but sometimes you have to then reinvest more if you want to sustain that type of growth.
Thank you. A final question from me. We have waited for these larger orders to come in for quite some time, and now you show that you are able to capture those opportunities. As you look into your pipeline and into the future, would you say that the pent-up demand have sort of been materialized now, or do you see an equally large pipeline on the larger deals over the coming quarters? Thank you.
We continue to work on large opportunities. I think pipeline is relative to what we see in the overall cyber landscape. We continue to work with large organizations around the world, and that's why we're expanding around the world.
Okay, fair enough. Thanks for having my question, and congrats again on the strong results.
The next question comes from Thomas Nilsson from Nordea. Please go ahead.
Thanks for taking my question. I have two questions, actually. First, with the new 15%-20% annual growth target for the coming five years, can you talk a bit about the assumptions behind this target and how much of this growth should come from new clients versus existing companies? Second, do you see Yubico eventually moving towards being a more predictable recurring revenue model, where you combine hardware, software, and lifecycle management, and what we need to change commercially to accelerate such a transition towards a more predictable recurring revenue model? Thank you.
Thanks so much for the question. The growth target, of course, includes both expanding the impact of our new product offering and also reaching new customers with scaling our go-to-market. But let us go into the details for that in the CMD. There will be much more detailed presentation. Sorry, what was your second question?
Yes. If you envision Yubico moving towards more of a predictable recurring revenue model where you have hardware, software, and lifecycle management combined into more multi-year enterprise contracts, then what would be needed to change commercially to see such a transition in the coming years?
I think there will be always a demand in our customer base for both models. We have use cases for both license or subscription recurring revenue model, and also perpetual. It very much depends on the customer use case. Secondly, for the perpetual, the e-commerce is, of course, only perpetual. With the high growth that we see in e-commerce, I believe we will still see demand for perpetual. But with the new YubiKey, we definitely open up possibilities for increasing the recurring revenue model. Yes, but we will definitely have use cases for both going forward.
Okay. Thank you very much.
As a reminder, if you wish to ask a question, please dial pound key five on your telephone keypad. The next question comes from Georg Attling from Pareto Securities. Please go ahead.
Good afternoon, or maybe good morning to you. I have a few questions. Maybe just rephrasing a previous question regarding these large orders. Is it that we shouldn't expect large orders here in Q4, maybe also in Q1, considering you sort of cleared that pipeline here in Q3?
Hi, Georg. Let's put it that way. We are focused on developing our foundation with the small and medium-sized orders that we believe are more predictable, bigger number of orders. The large orders, as we have seen and we have said, it takes sometimes a few quarters. They're a little bit less predictable exactly when they will close. We're very focused on developing and continuing growing our foundation, and the large orders, we continue working on them. We have them in the pipeline, but the nature of these orders are that they're a bit more lumpy and volatile.
Yeah, and I think, just to clarify, I think you're all asking whether there'll be more large deals. There will always be large deal, yeah, for sure. But we're not going to commit a timeframe on this thing because we just described it, that it's unpredictable. But Yubico's overall history has always been working with the largest companies in the world. You can see, we talked about all our companies, and we're so proud of. If you just one way to look at it, go look at our YubiNation page. It's live now. And then you look at the customer, and then you can make your own conclusions. We always work with them. A number of them have been our longtime customer. As we continue to deliver value, they will continue to work with us, and in many cases, they would invest a lot with our technology.
So I encourage you to look at YubiNation and understand our customers, and then I think it would answer your question.
Thank you. Second question, a bit curious on the initial financial impact from the OpenAI partnership. Is that an important driver for the growth in smaller orders, or is it not really that material?
For OpenAI, I think the lens of that should be not about just the partnership. I think the lens of that particular announcement is really that we are a critical infrastructure as part of the AI world. I think that's how you should interpret that announcement, because the most advanced defenders are using our capabilities. From that perspective, it sends a signal to every other organization, big or small. Think a critical piece of infrastructure needed to support the scale of AI growth is where Yubico stands. Again, if you take a look at the YubiNation, you will have a glimpse of the other types of companies in that realm that are working with us or using our product.
Yep. Just a final question on the long-term margin guidance. I mean, on that sort of growth trajectory that you lay out and the gross margin that you have, from the outside, it looks very possible to go beyond that 20%. Could you explain why you put it at that level? Is it any major investments in organizations that you're planning, or, yeah, any color here would be helpful.
Yes, we do have a very high operating leverage. We have reduced costs in Q1 and beginning of Q2, and now we are experiencing this really positive development. There is definitely a need that we need to invest in our organization, in our capabilities, in order to fulfill and to successfully launch our new products and reach new customers. We will see potentially during next year, we have to invest in our organization, in our capabilities. That's one of the drivers that we need to scale in order to capture the potential that we believe we have with the new product lines.
Okay. That's very clear and helpful. Thank you very much.
There are no more phone questions at this time, so I hand the conference back to the speakers for any written questions or closing comments.
There's a couple of written questions online. Let's start with the first one. Congratulations, Snejana, on becoming Deputy CEO. What share of Q3 bookings and of the orders above $1 million required FIPS 140-3 keys? Were those orders held back until certification in May, and how much of that pent-up demand is left?
Yes. Thank you for the congratulations. We have definitely seen increase in the public sector bookings. Some of them are requiring FIPS 140-3 keys. In terms of whether they were orders that were waiting for the certification, I would say it was more the budget stops during the end of last year, beginning of this year, that was more impacting rather than the certification.
Yeah, and I think the certification perspective, it's the ability to continue to sell to these customers. This would continue to be needed to expand our footprint in several sectors. It's not just in the public sector. There are many organizations that support the public sector, and they use this product line. We see this as Snejana mentioned, some of these organizations, they do buy perpetual, and these are the type of certifications that is needed to ensure that they can continue to buy the products for future years.
Yes. As for the second question, we are managing very tightly the finished goods and the firmware on our keys. From that perspective, there is not substantial risk for obsolescence on the firmware.
Another question. How has demand among the top 10 to 20 tech customers changed in the quarter?
For the tech companies, I would consider tech companies are companies that have been working with us for a long time, and they are also the individuals or the teams that are in these tech companies, they move around, and then many of them are longtime Yubico and YubiKey users. We continue to work with them. I think that part of the ecosystem play, which is they are our customers, but they also offer a lot of the capabilities on the standards that we created with them. We continue to collaborate with them on multiple fronts. It is not just that they are a customer. Sometimes we go to market with them, sometimes they offer capabilities that help us, and sometimes they compete with us.
I think these tech companies, we have a multi-layered relationship with them, and that is also why we can have scale in conversations with large organizations.
Another question. On your 20% EBIT margin target, given that your gross margins are so high, can you help us understand whether your target is more or less in line with what you achieved in 2024, at a far lower revenue base, and why not higher?
I think I already addressed this question. Indeed, we do have, again repeating, very high gross profit, but we have the need also to invest now in order to be successful with the new product launches.
Next question. Can you please elaborate on your capital allocation strategy and what the purpose of the current and substantial cash position is? If not at the current level, what is a target level relative to sales or any other metric? Thank you.
Yes, we are now in a very good cash position. Of course, we will use part of this cash, again, to invest in our organization and capabilities. Inorganic growth is also on the table, so that is part of it. From a long-term targets point of view, the board, of course, will consider dividends. So, that is kind of how we are looking at our cash position. We do not have sort of a hard metric to aim for.
How does a typical buying process look like today compared with two or three years ago in terms of who makes the decision and how long it takes? Has it become more senior and/or faster recently given impact from AI?
We do see an engagement level higher up with higher-up executives overall in our business, and that is partly because the awareness of cybersecurity in general is brought to the center. We definitely hear from our customers, and our customers want us to engage with higher-ups in the organization, which we are doing. We have introduced new programs where we engage with C-level executives for our top customers, and that generally helps us to get mindshare and long-term growth opportunities with these customers. Yes, we do see that engagement change and will change. Also, if you look at what we have been doing, we have been working with much different set of partners, like global system integrators, who do have this relationship with executives as well. We are also working with partners to elevate the conversations.
There are no more questions online. Thank you so much for calling in today. If you have any other questions, feel free to reach out to our investor relations. Thank you.