NCC Group PLC

LSE:NCC

Earnings Call Analysis

Earnings Call Transcript 2022-Q2

[Adam Palser, CEO & Executive Director]

Good morning, and welcome to NCC Group's half year results for the period ending 30th of November 2021. My name is Adam Palser. I'm joined today by my CFO, Tim Kowalski, and we'll be taking you through today's presentation. As usual, we're going to do that in 3 parts. I'm going to take you through the key headlines. I will pass you over to Tim for a clearer look at the numbers, and then I'll come back to talk to you a bit about where we're heading in the future. And with that, I propose we dive straight in. So let's have a look at the key highlights down the left. NCC Group is up on every important measure. Revenue is up 14.2% at constant currency. Gross margin is up. Adjusted EBIT is up. Free cash flow is up 30% or more to GBP 20 million, once again, proving that NCC Group is a rare beast in the cyber universe. We are growing. We are profitable, and we are cash generative. And if you take nothing else from this presentation, take that, the fact that NCC Group today is fitter, healthier, stronger than it was 12 months ago. And what a remarkable 12-month period to have demonstrated that growth in. If you cast your minds back 12 months to the end of the comparative period, November 2020, we were all looking forward, weren't we, toward 2021 that was free of COVID and returning to normality. And I think we can all agree, we got anything but. We were introduced to the Alpha variant. We welcomed Delta in the middle of the year. And of course, we're all embracing Omicron at the moment. But through it all, NCC Group forged ahead. We were able to execute our biggest transaction to date, the acquisition of IPM, which closed at the very start of this reporting period, 7th of June. We were able to accelerate further our key propositions for the future, Escrow as a Service, our Sentinel managed services, our remediation propositions, all of which are so important for driving growth not just this year but into the future. Now in a few minutes' time, Tim will talk to you very clearly through the comparability between years. We have, of course, got an acquisition. We have the accounting around that acquisition. We have FX and all the rest of it, but my job is to guide you towards the underlying trends that we've seen over the last 12 months. And so here we go. On the right-hand side of this slide, first and foremost, so importantly, good growth across every single one of our Assurance geographies. North America grew by almost 9% at constant currency; Europe, almost 12%; U.K. and APAC, 7.5%, results that I'll be proud of in any period but particularly proud of in the year that we've just seen. And this is a crucial point. Gross margin improved, demonstrating our ability to use utilization to pass on price increases and critically to use the global resourcing engine that we have built over the last couple of years to better match skills and demand wherever they happen to arise in the world to offset the increased costs that we anticipated. And again, with so much opportunity for people to work in the cyber and IT industries, I'm so proud to have increased the number of technical heads in NCC, it grew by 12%. That's 152 technical heads since the end of May despite a slight increase in annualized attrition, which is in line with the rest of the cyber and IT industry. Our key propositions for the future, Sentinel, managed services and remediation, up now to GBP 5.5 million of revenue in H1 from pretty much a standing start 12 months ago. And again, as we see those compound growth rates continue over the coming periods, that's going to deliver wonderful growth in the future. We've seen a bit of a slowdown in managed services, 7% growth, a little lower than we expected. But that's partly due to a very strong comparative period 12 months ago and a bit of volatility in our orders closure. We've enjoyed some great orders performance over the course of December, and we have the pipeline, which gives us confidence of returning to double-digit growth in H2. Turning now to Software Resilience. I mean, this is a division, of course, which has been transformed by the $220 million acquisition of IPM, which we completed on the 7th of June. I'm delighted to say that, that acquisition, that unit is everything we expected it to be. It is on plan for trading. It is on plan for integration, and we're looking forward to making the most of the world together. Organically, we've seen a little bit of a decline. We expected that from the disruption we had in the first half of the year. But I'm pleased to report that our sales teams are back to full strength and the investments that we've made in our marketing automation to feed that sales teams with good high-quality volume of leads, it means that we expect to be back to year-on-year growth in the second half. Escrow as a Service, again, a key proposition for regenerating software resilience and driving growth into the future, is up a further 54% year-on-year. And all of that gives us confidence in the future with an outlook for the full year in line with management expectations. So there you are at the end of the first half, an NCC Group which is in better shape than it's ever been. And that's so important because the road ahead for us is a road of opportunity. The cyber market is a wonderful market to be working in. You want to be in it, and I'm pleased to say that we really are. So you've heard us talk about these 4 enduring drivers of growth before, and you're going to hear us talk about them again and again. Number one, the connected environment is growing as more things get plugged together and more people innovate ways in passing data around. Our dependence on that connected environment is growing, whether I'm talking about us as individuals, as companies or as society as a whole. And of course, as that dependence grows, so does the threat landscape. Ransomware has proven itself to be a multibillion-dollar enterprise for criminal gangs across the world. Cyber incursion is an effective, deniable, cheap way of nation-states making interventions. So you could only expect to see this grow and grow and grow. And of course, running behind to catch up is the relentless increase in legislation and regulation. And every single one of our major geographies in the U.S., in the U.K., across the EU and indeed in Asia Pac, we're seeing a tightening of legislation and along with that, consequent costs of compliance failure. Today, not enough people spend enough money on cybersecurity because they don't want to or they're distracted. They will be dragged to spend more and more money in the future either by regulation or legislation or their own painful experience of falling prey to cybercriminals. So that's going to drive growth for us for the foreseeable future. And of course, today, it's playing out against the backdrop of the residual disruption caused by COVID. We're fortunate in the U.K. to be largely coming out now of the latest phase. Our colleagues in the Netherlands are still fairly rigorously locked down. And of course, the U.S., again, is battling with the Omicron peak at the moment. But again, all of that will normalize in due course. We're seeing also the increased labor mobility, driven in part by the so-called great resignation and in part by the rise of remote working as an acceptable way of working for the tech companies. But against all of that, NCC finds itself in a position where we have more capacity than ever. And fulfilling our promise of being a hub for cyber talent, the place that you come to get the training, to get the experience, to do important work for the most important organizations, we brought on 65 junior security consultants in our U.K. and APAC next-generation talent program. We are bringing in newcomers to the cyber industry at an ever greater rate, training them up and deploying them on important work. So whilst we did see a slight increase in attrition, a moderate 2 to 3 percentage points, I'm delighted to say that NCC Group met this challenge head-on. We grew capacity, and we improved margin. And we were able to do that by increasing our utilization a little bit, passing on some day rate increases. And of course, as further contracts come up for renewal, we will again be passing those price rises across to our customers, who unfortunately will have to bear the increased costs of operating in cyber. But an important point I want to stress again is our global resourcing engine that we have built over the last couple of years and ability to deploy talent, to deploy skills from anywhere in the world to the place where it can be most effective. And overall, our customers get a better service. Our people get more variety and more experience. And of course, it has efficiency benefits. And the punch line is that overall, we've been able to grow Assurance gross margin by over 1 percentage point in this remarkable environment. More broadly, if we look at our operational KPIs, you can see that we are delivering against our growth strategy. Our key propositions for the future, Escrow as a Service, up 54%; Remediation and Sentinel together, up GBP 5.5 million of revenue from practically nothing 12 months ago. Overall, sales orders are up. Average order value is up. Number of orders over GBP 250,000 are up. And again, the global resourcing days I've talked about, where one region delivers service for another, is up 73%. The number of days that we've spent doing research has decreased very slightly, but I'm delighted to say that the quality and the impact of our research is greater than ever. The link to our most recent annual research report is on our website. I would absolutely encourage all of you to go and have a look. And when you read it, when you enjoy it, you will see the impact that NCC Group can have on the cyber industry and, indeed, why customers come to us and why people come to work for us. And finally, as I've said before, we've managed to grow capability and capacity, a net increase of 12% in technical heads, but not just that, of course. More salespeople, more wonderful support people, a firm that is ready to deliver further growth. So with that, if I may, I will pass you over to Tim to talk us through the numbers, and I'll be back shortly to talk to you a bit more about the future. Thank you, Tim.

[Tim J. Kowalski, CFO, Company Secretary & Executive Director]

Thank you, Adam. It gives me a great pleasure to present some record financial results again for NCC Group. As you can see on the statutory financial summary, as Adam said before, revenue is up, gross profits up, adjusted EBIT's up, adjusted EBITDA's up as is free cash flow, all in the right direction. As you'd expect, with the IPM acquisition, the net debt has increased to GBP 74 million. And even on the cash conversion, which has a downward arrow, if you take out the preacquisition costs, it actually converts to 99%, it is also up. So from an overall financial point of view, we have had another set of robust financial results. As Adam mentioned before, I wanted to say something about the comparability year-on-year because it is quite complicated. So as you can see on this slide, we have the adoption of cloud customization costs in April of '21, which you saw in the prior year period. That had an impact of GBP 2.3 million costs that were classified as ISIs below the line in HY '21. And owing to the restatement, we would normally have expensed these above the line for HY '22. Also, what you have is you have the accounting standards in relation to the IPM acquisition, which relates to deferred revenue haircut as it's known of GBP 2.7 million; and last but not least, the actual acquisition of IPM itself. So looking at the table below, you can see you start with the GBP 20.2 million, which is then adjusted for the cloud amortization costs in the previous year. We then add back the cloud-based arrangement expenditure of GBP 2.3 million, which gets you to GBP 16 million in the previous year. We then adjusted this year for the IPM revenue haircut, the GBP 2.7 million, as well as the IPM acquisition of GBP 6.7 million. So what you end up with is a net EBIT comparable on a like-for-like basis of NCC, excluding everything to do with IPM and cloud, of GBP 16.2 million, pulling GBP 16 million of net adjusted EBIT. So we're slightly ahead even on an underlying basis. And I hope that clarifies the situation on the adjustments you need to look at year-on-year. So turning to the P&L statement now. You could see we've had strong growth at improved gross margins with revenue increasing both in Assurance and overall in Software Resilience. So year-on-year, the group grew by 14.2% at constant currency with Assurance growth of 8.8% and Software Resilience of 48%. If you exclude IPM, Software Resilience on a constant currency basis was slightly behind at 3.3%, which I'll talk about more in a minute. Gross profit grew by 2.3 percentage points, owing to the strong operational performance of Assurance as well as the impact of the higher gross margins within the IPM acquisition. Pleasingly, underlying overheads were in control. As you can see, they grew by about GBP 2.3 million after stripping out the noncomparable costs, which is about 5% on the cost base. On top of the GBP 2.3 million, which is related to investment in people, recruitment, training, we have marketing increased costs, and we also had a return of nonclient travel. We had GBP 3.2 million of IPM overhead cost base, and we had GBP 1.9 million of cloud-based costs that were classified as ISIs in the previous years and are now above the line. On ISIs themselves, they decreased by 61% from GBP 2.3 million down to GBP 900,000, and they were related to the residual acquisition cost of the IPM acquisition and nothing else. As a result of the IPM acquisition, we issued, as you recall, a 10% placing or 10% more shares to our share base. And that has the impact of reducing our EPS slightly by 2.2% on the P&L, as you can see. So moving on now to the Assurance financial performance. As Adam has mentioned before, we have reaped the benefits of a truly global model in this area. We've had continued revenue increase. And that has happened across all the regions, as you can see on the graph, 8% in the U.K., 9% in the U.S.A. and almost 12% in Europe coming through at constant currency rates. Profitability has been boosted with gross margin growing by 1.2 percentage points from global resourcing, from effective day rates increasing by 2%. Passing on those prices on to customers, which we did stop during the pandemic, have now recommenced. And we improved our colleague utilization rates by 6.5 percentage points. So all of those factors have come together to give us a gross margin increase. In terms of people and capability, Adam has already mentioned before, that's increased by 73% year-on-year in global resourcing days. And all of that results in adjusted EBIT moving forward within the Assurance division. Looking now at the breakdown of the Assurance service line performance. We can see there's been strong revenue growth for all Assurance service lines with Global Professional Services up by 8.2%. And within that particular feature is remediation sales, which across all regions has come up to GBP 3.6 million in this half against nothing in the previous year. Dropping down to Global Managed Services, that's up by almost 7% in constant currency. Factors there are MS Sentinel delivered GBP 1.8 million from only GBP 100,000 last year. We expect this to further accelerate in half 2. MDR growth, which was slightly disappointing at 2%, as Adam mentioned before, will accelerate in half 2. And what gives us confidence about that acceleration is that we've closed deals since November and December of 85% year-on-year, coupled with a strong order pipeline, giving us confidence we will have a return to sustained growth in half 2. Moving on now to Software Resilience. We can see this whole area has been transformed by the IPM acquisition. SR group revenue grew by 48%, including the addition of IPM. If you take out IPM, it decreased by 3.3%. Now as we said before, this was expected and anticipated in our full year results. We said that contract revenue will decline because we could see the sales disruption across our teams, and we can see the customer termination pattern coming through that has a 12-month effect rolling out. This has been partially offset by a GBP 200,000 increase in verifications in half 1. So we do expect a return to growth in software resilience from half 2 with renewal rates improving to 89% from 87%, which is still within our range. We're now back at full strength within our sales teams, and we've had improved marketing automation and channels through the first half in terms of activity and investment. So Escrow as a Service grew by 54%. And pleasingly, within the first couple of months of the half, Software Resilience has returned to growth. On the profitability side, you can see a decline in profitability in terms of the EBIT margin. This is a result of the increase in investment we've made in capability and capacity for growth in the second half and beyond. On to the cash slide. Again, we've generated a strong cash generation, which has been a permanent feature of NCC for the last few years. So we've increased our cash conversion without acquisition costs to 99%, although I do expect this to normalize around the 85% level. So net debt increase of GBP 77 million has come all from the IPM acquisition, but we're looking to pay that down. And our facility headroom as at the end of the half amounted to GBP 78 million. So we still have lots of headroom there. From a free cash flow point of view, we've improved by GBP 20 million -- to GBP 20 million, sorry, with net cash from operations of GBP 23.7 million, excluding the impact of the haircut. So we still have the balance sheet strength to fund potential organic and inorganic opportunities in the future. So on that note, I will then pass it back to Adam, who will talk about the future.

[Adam Palser, CEO & Executive Director]

Thank you, Tim, and excellent set of results that, as you can see, we're very pleased with. So let's put those now into context, shall we? As a reminder, the cyber problem, if you like, is too big for any one piece of software or any one piece of hardware to solve. And that's where cyber services firms like NCC Group come in. Cyber -- we can reach out to our customers and advise them on what they need to do, the thoughtful application of people, process and technology to reduce their cyber resilience risk. And that's why companies like NCC, with their research-led, CapEx-light business models, are able to be consistently growing, profitable and cash generative. Now our vision is to be the leading global cyber and software resilience provider. We want to be able to advise our customers throughout the whole life cycle of assessing their cyber risk, developing their cyber maturity and then managing their cyber operations. Historically, we've been world-class in certain aspects of this life cycle, for example, security testing. We've also been very strong in incident response, in managed services and some other areas. But our strategy over the last couple of years, and it will continue to be so, is to broaden our portfolio. So we have a complete set of offerings across this assess, develop, manage life cycle. We're improving the way we go to market so that we can take this complete portfolio to our customers wherever they happen to be in the world, and we continue to leverage our global talent capability to ensure we can best match skills and demand wherever they happen to crop up. So to have a look at a slide that you've seen before, let's see how we're getting on. Now our historically strong assess cyber risk portfolio, you can see that the powerhouse of our professional services has led forward again, 8% at constant currency, bolstered, supported by the 73% increase in global resourcing that I talked about a bit earlier. Across the remainder of FY '22, we're looking forward to continuing to expand our practice hubs so that we develop more and more distinctive talent that we can deploy for the benefit of our customers. Now we're very proud of the fact that a number of people who worked at NCC Group have gone off to the most remarkable positions for the most remarkable companies, and we wish them very well. Now some of those individuals choose to come back and do another stint or 2 at NCC Group to deliver more impact. To strengthen that network, we've launched at the start of H2 our alumni network, and we're looking forward to strengthening that in the future. And finally, we continue to define and refine our career paths. So those that -- who wish to stay with NCC Group and have a fulfilling career can, of course, do so. Now developing cyber maturity is something that we've done less of historically for our customers, but we want to do a lot more of it in the future. Our new remediation offering is key to that. We have GBP 3.5 million of revenues in H1 from pretty much a standing start 12 months ago. Most of that has come out of the U.K., where we focused on launching this proposition. And of course, over the rest of the financial year, we're going to be strengthening it and rolling it out sequentially in our other geographies. Moving sideways to our Software Resilience division, which plays such an important part in developing and maintaining customers' cyber maturity. Our Escrow as a Service proposition has grown a further 54%, and we're looking forward to building on the strength and stability we now have in North America and preparing to capture the revenue synergy opportunities from our IPM acquisition. Finally, looking at managing cyber operations. We've seen a 7% increase in managed services revenues at constant currency, a little bit less perhaps than what we would have hoped for. But part of that is against a very strong comparative period 12 months ago and some volatility in sales, which Tim referenced earlier on. Crucially, we have seen a 13-fold increase in Sentinel sales. So again, a proposition which is coming largely from nothing 12 months ago, now getting some real momentum and something we expect to see driving growth for many future periods. We've enjoyed some great orders over the course of November, December. We've been recognized in the latest MDR Forrester Wave, and we expect to see a return to double-digit growth in H2. And so overall, we're looking forward to continuing the positive momentum through the rest of the financial year. Second half trading has started well and is currently in line with expectations. We've enjoyed some great order momentum in December and January, and we've seen year-on-year growth in Software Resilience. The balance of H2 requires further revenue acceleration, which we expect as our global markets recover from the disruption of the COVID pandemic and for which we have recruited the global delivery capacity that we're going to need. Overall, therefore, we're expecting a strong H2, leading to a full year outturn in line with our expectations. And finally, I'm pleased to announce an unchanged interim dividend of 1.5p per ordinary share. And with that, thank you very much. I'm sure you will agree, NCC Group finishes this first half period fitter, healthier, stronger than it's ever been. And we look forward to taking your questions a little later this morning. [Break]

[Adam Palser, CEO & Executive Director]

Well, welcome, everybody. Thank you so much for spending time with me and Tim this morning. What I'm going to do, if you'll allow me, is spend 2 minutes reminding you of the highlights, hopefully. And I'm sure you have -- you all had an opportunity to read the RNS. There is an excellent presentation, if I may say so, recorded and available for you all to have a look at. So in a minute, we'll get into Q&A. Before we do, I would just like to remind you all of some of the highlights of our half year results. And again, this will take me no more than a couple of minutes. So it's a pleasure to be talking about these results this morning. And as we dive into them, I think it's really important that we don't miss the wood for the trees. The wood, as we can see, is in very good health. Down the left-hand side, compared to 12 months previously, revenue was up 14.2%. Gross profit is up. Gross margin is up. Adjusted EBIT is up. And of course, something we're particularly fond of, free cash flow is up 30% to GBP 20 million. And so overall, NCC continues to be the thing that we're very proud of, a growing, profitable, cash-generative business with loads of upside, thanks to the market in which we work. If we then zoom in to have a look at some of the trees in particular. We can see here crucially good Assurance growth and improved gross margin. So we've seen growth across all our Assurance geographies in what was a difficult year, right? We were all expecting 2021 to be easy after 2020. Of course, it was nothing but, right? The world was coming and going. But look, North America, up 9%; Europe, 12%; U.K. and APAC, 7.5%, all at constant currency, so pleasing to be able to show you that our Assurance business is back to growth after the COVID years and thriving crucially because there's been a lot of doom and gloom out there about attrition and wage inflation and all the rest of it. We've managed to do 2 things. We've increased capacity by 150 heads -- 150 technical heads, I should say, and also improved gross margin using the levers of utilization, price increases, global resourcing, and we can talk about all of those in a minute in a bit more detail. But that's so important. In Assurance, good revenue growth and improved gross margin. And we have been busy, right? Our new propositions for the future, our Sentinel managed services -- sorry, I didn't mean to click on that. Our Sentinel managed services proposition and our remediation proposition, which were pretty nascent 12 months ago, now up to GBP 5.5 million. And over the course of the next few periods, those are going to become more and more material parts of our growth and of our revenue. We did see a bit of a slowdown in managed services but still, 7% growth at constant currency. And it's against a very strong comparator 12 months ago where we posted over 20% growth rates. And when you've got slightly bigger order pipelines, there is some volatility. We've enjoyed some good orders over the course of December, and we're looking forward to a second half with stronger growth rates. Over at Software Resilience. We've had some organic weakness. We were expecting a couple of points of decline here because of the disruption to our sales teams in the first half of 2021 calendar year, as our management team was focused on the integration plans and bringing in IPM. But overall, a business that has been transformed by the acquisition of that unit, and I'm pleased to say it's exactly what we thought it was, trading on plan, integration on plan and with a great future. Crucially, our sales teams are back to full strength. Our marketing engine is running well. We've seen year-on-year growth in December. We've seen year-on-year growth where we're heading for it in January. And so we do expect that to grow year-on-year in this second half, helped by our Escrow as a Service offering, which continues to grow at rapid rates. And once again, when you look through to the future and the growth that, that's going to deliver, we're quite excited. So all online for an exciting second half and delivering a full year in line with management expectations. But as I said, there is a presentation for you on the web. Please do take an opportunity to have a look if you haven't already. So with that, we will begin to take some questions.

[Adam Palser, CEO & Executive Director]

So we got some hands up. I think to be fair, Julian, I think you were first out of the blocks. If you -- we'll go to you first.

[Julian Robert James Yates, Technology Equity Analyst]

Just a couple of questions, one on Assurance and one on escrow, if that's okay. On Assurance, yes, good to see there's some decent revenue traction in there coming through, I guess, across the board. In terms of the gross margins, they clearly went up H1-on-H1. They went down slightly versus H2, about 1 percentage point or so. I'm just trying to understand, is that a -- would you see that as a trend from H2 to H1 and then slightly moderating in H2 as well in terms of declines in gross margins? Or are you happy with where they are in the current period and you think you can withstand those for the reasons that you articulated in terms of how the model is working? So that's, I guess, the first one. And any geographical differences that you think are pertinent will be useful. The second question is -- this is on IPM and/or escrow profitability. It seems as though you had a sort of GBP 8 million to GBP 9.3 million in terms of operating profit for the business, but that assumes the contribution of IPM in there. So I'm trying to understand what happened to underlying IPM profitability. It seems that the margins there were quite low. Or was it that you had a decent IPM contribution but the core escrow IPM -- the core escrow operating margin was pretty much impacted and what that means for H2? I'm just trying to sort of get a gauge on how that full year sort of dynamics works.

[Adam Palser, CEO & Executive Director]

Yes. That's absolutely fine. Thank you. So what we'll do, Tim, in a minute, will probably tackle the IPM question because we've had -- the punch line on that second question is we've had a very strong trading contribution from IPM. But of course, we've had integration costs. We've also had the revenue haircut, which is a joyous accounting artifact that Tim will enjoy talking you through in a bit more detail. I'll tackle first, if I may, the GM point in Assurance. Now I would encourage you, to be honest with you, not to obsess too much about those slight variations half to half. We do tend to get a fairly busy finish to our H2, which can drive up gross margin a little bit under the hood. There's quite a lot of moving parts. We're hiring a lot more people. We're bringing on a lot of juniors. We're training people up, which gives us great capacity for the future. We've also been hiring a lot of salespeople, right, which also, if you'll recall, our gross margin, perhaps unusually for businesses of our type, includes both sales and delivery costs in cost of sale. So the punch line, Julian, is we are comfortable managing gross margin within the parameters, right, which is roughly where we are now, thanks to the various levers of utilization, price rises, global resourcing and all the rest of it. I think you asked me about geographic variances as well. So some of the year-on-year growth is going to be a little bit of an artifact depending on what you were comparing with 12 months ago. So the 12% growth we've seen in Europe, for example, slightly flattened by a weak comparative period. The North American growth of 9%, slightly depressed by a very strong comparative period. Overall, when we look at the market, we're seeing very strong demand growth in North America. There's a wonderful set of clients that we're privileged to enjoy over there. We expect that to continue, notwithstanding the irritating footnote which is America -- North America having a real flap about Omicron. At the moment, they're going through the peak of that. We expect that to subside and more normal service to resume over the second half. U.K. hasn't been the sort of exciting robust market that we've all seen for tech in North America driving some of our demand but steady Eddie and, as I think we can all relate to, less affected by the general COVID flap. We expect to see that market just gently continue to improve through H2. Europe, much more locked down from a restriction perspective than either U.K. or North America. So I would say business as usual operations have been more impacted over there. And again, we're just seeing that ease really in our core territories of the Nordics and the Netherlands. So I hope that helps. Tim, over to you for the IPM piece, if that's all right.

[Tim J. Kowalski, CFO, Company Secretary & Executive Director]

Yes. So on the IPM piece, what you have -- you asked about core business margins, Julian. So what you have is you have the GBP 2 million cost, your IPM, and you have the core. What's happened is, as Adam said, the development team were obviously focused on the acquisition itself and getting into the integration. So there's a slight -- that's why we have that tied to us going into last year. Coming into this year then, they're on the integration, and that's going well. Margins in IPM are higher than the core business because the nature of their model. But what has happened is, as you will recall, we increased a lot of capacity within IPM. We've been investing in salespeople, who were down in the last half and are now being put back up into full strength, and that goes into the margin. We've invested below the sales and [indiscernible] and have been professionalized. We put a lot of management team structure into the core business. So we've just developed a new thing, which is called SDRs, sales development reps. They come in. We put them in there, the people who generate the leads, before it gets to the account managers that we just invested in them to generate growth in the second half. And that is going to margins as well. So all of that has pulled it down slightly in the core. But obviously, it's an investment for the future growth. And as you know, we mentioned in December and January, we're back into positive growth on sales and revenue in Software Resilience. So that's the early seats -- early doors, and that's the early start of the turnaround.

[Julian Robert James Yates, Technology Equity Analyst]

So in terms of the actual profitability of IPM in the first half, are you able to give the EBIT number so we can sort of understand that number under core?

[Tim J. Kowalski, CFO, Company Secretary & Executive Director]

Yes. I think the EBIT number, kind of within it, if you recall, it had the -- I was thinking about [indiscernible], we had the -- yes, I think -- just wait and I'll have to check. So we have within it the revenue haircut. So I don't want you to give you the wrong number.

[Julian Robert James Yates, Technology Equity Analyst]

So the GBP 9.3 million of overall EBIT resilience...

[Tim J. Kowalski, CFO, Company Secretary & Executive Director]

Yes. The GBP 9.3 million, expect it to have the revenue haircut to get us to GBP 12 million on the sales. And then you double it to get to GBP 24 million on revenue. Yes.

[Julian Robert James Yates, Technology Equity Analyst]

And out of the GBP 9.3 million, how much came from IPM? How should we sort of think about that?

[Tim J. Kowalski, CFO, Company Secretary & Executive Director]

The IPM, in terms of the actual EBIT revenue margin?

[Julian Robert James Yates, Technology Equity Analyst]

Yes. Not just the EBIT number. And so resilience was GBP 9.3 million. I'm just wondering how much came from IPM, how much...

[Tim J. Kowalski, CFO, Company Secretary & Executive Director]

GBP 4.4 million off the top of my head, but I'll consult with you.

[Julian Robert James Yates, Technology Equity Analyst]

And then the remainder would have come from core escrow?

[Tim J. Kowalski, CFO, Company Secretary & Executive Director]

Yes.

[Julian Robert James Yates, Technology Equity Analyst]

Okay. Yes. It's just helpful to get the split.

[Adam Palser, CEO & Executive Director]

Okay. And worth bearing in mind, Julian, we're taking integration costs above the line, so not as exceptional as that revenue haircut, which is the accounting around the acquisition, is also -- and is [indiscernible] you don't intuitively expect. So we can take you through that in more detail. Thank you. Ken?

[Kenneth Charles Rumph, Equity Analyst]

Thanks to Tim also for talking us through the accounting chicane of the haircut. I got 3 questions. Firstly, on day rates, you talked about the increase in the first half. But presumably, there's a -- and it's notably a first increase for a couple of years. Presumably, there's a kind of timing effect of that gradually feeding through. Can you talk a little bit about the sort of momentum there and how much you need to increase day rates to cover a certain level of wage inflation? Second question was just regulatory. I mean, we had some statements at the back end of the year, Joe Biden calling in kind of U.S. tech chiefs' political action on the importance of best-in-class cybersecurity and so on. Is that actually making a kind of a genuine sort of step change difference? Because it really did feel like a new level of beyond the normal kind of increased threat level, increased regulation, that felt like a step-up. And finally, just -- again, you kind of mentioned it. But it is a kind of -- it would be a landmark really for Software Resilience to be growing again for the first time since FY '18. And to me, having a plus number rather than a minus number, even if it's kind of minus a couple to plus a couple, is a big symbolic difference there. Is any of that because of IPM that you're seeing in the second half? Or is that genuinely the business and the sales force kind of beginning to kind of get back into their stride?

[Adam Palser, CEO & Executive Director]

Lovely. Thank you, Ken. Well, let's take these 3 in turn, shall we? So first of all, day rates, you're absolutely right. Yes, we've increased our day rates for the first time in a little while. I mean, look, going through the pandemic, we were pretty considerate of our customers. It wasn't the time to be forcing through price rises even if we could have been able to, I suppose. The other thing to bear in mind is a lot of our contracts come up for renewal annually. And as those contracts are coming up, of course, we're pushing through more and more price rises, again, respectful of our customers. We have to respect the fact that they can choose where they place their work, but we're very confident in the value that we deliver. So as those contracts come up for renewal, we are pushing through more and more price rises. And of course, they're very powerful because an X percent rise in day rate, it will compensate for more than a 2x rise in wages, for example. So it wouldn't be appropriate for people to think that we need to match wage inflation point for point with price rises. And we also have, as I pointed out, other levers like utilization and in particular, our global resourcing, which have got a lot further to run than they have so far. The second piece, yes, the regulatory piece is -- I mean, you're absolutely right, Ken. There's been an uptick, and there have been some quite seismic points like Biden's focus on this and the obligations people now have to patch and keep themselves secure. We point out, as we always do, the 4 secular drivers of cyber growth. And the fourth and I think the most powerful is the relentless increase in legislation and regulation because it comes with costs of compliance failure. It's what makes cyber move from the CIO's budget to the CFO's budget. And then it gets ingrained into the budget. And the CFO can't cut it, which is always really very helpful. I would say, Ken, I'm not going to call out any particular spike that's come from that, but it is just one of the trends that means more and more people will be forced to spend more and more money on cybersecurity, which will benefit everybody working in the sector. And finally, in terms of the Software Resilience growth, you're absolutely right. It will be a landmark, and we're very excited. The growth that we've been seeing in December, for example, and we're on course for in January, is not to do with IPM. It is to do with the core business, which is so important, getting that sales and marketing machine working properly. And of course, we're working with the IPM unit on revenue synergies. We have a decent pipeline there to be able to increase the number of verification tests they sell and also to offer the Escrow as a Service proposition. And we've got a nice pipeline measuring in the hundreds of thousands, which we look forward to converting over the course of the rest of the year and into next year. Thank you, Ken. Caspar?

[Caspar James Pears Erskine, Research Analyst]

I just had a few very quick questions, one around the Assurance side of the business and then a couple on escrow. Within Assurance, I mean, obviously, the spike in attrition must be sort of quite a difficult metric to look at. But I mean, the hiring performance has been exceptionally impressive. And I was just wondering how much that is a function of being able to access new pools of talent away from traditional hubs. I realize your global resourcing mechanism is probably part of that. But is it sort of remote working playing into that as well? And is there a cost benefit to that, too, of being able to access a broader reach of talent? On the escrow side, the -- how much is sale of cloud escrow an opportunity to stabilize the contract base? And then just looking at the contract base, you talk about revenue stabilization or even growth going forward. And as you mentioned, that would be a landmark. Is that more a function of verification upsell? Or do you see contracts that -- the attrition rate beginning to sort of lower going forward and maybe even stabilize in the longer term?

[Adam Palser, CEO & Executive Director]

Thank you, Caspar. Look, let me come to those as we go through. So let's start over in Assurance, and let's look at that attrition. I mean, look, it's always painful to see attrition spike. And frankly, I always take it really personally when people choose to go and work somewhere else. But it's the world we live. Colleagues who have worked at NCC Group have gone off to do the most wonderful things for the most wonderful companies. We have alumni who are present in all of the great names that you would recognize. And in fact, some them will come back for a second stint. And we've launched our alumni network actually since the start of H2, which is looking to formalize that network, build upon the shared experience that a lot of people in the security industry have had at NCC Group. So there we go. But I think where I'm tempted to be a little bit cheeky and tease a lot of people in the wider world who are having a bit of an inflation flap, we've been living with inflation in cybersecurity for 10 years, frankly. So the one thing you know is that you're going to lose people. And the one thing you know is that the cost of hiring those people is just going to go up. Sometimes it will go up gently. Sometimes it will go up a little bit faster, but you've got to be able to handle it. I have a really stupid phrase for it. I call it the All Blacks strategy because you can't score points against the All Blacks, but they will score more points than you. So we know we're going to lose people. And therefore, we just have to hire more people than we lose. Isn't management a brilliant and subtle science?So coming to some of your more subtle points, we've been doing a lot of work to try and reach into pools of talent that we haven't tapped into before. We are working on flexible working. We've worked really hard on the inclusivity of our recruitment processes as well to ensure that we are not, unconsciously or otherwise, excluding people. And we do reach into people who have nothing to do with cyber and import them from other areas, which is great. The remote working certainly helps, I would say, in every single one of our territories. And I wouldn't underestimate the sheer amount of work we've put into our wellness programs and the -- yes, if you look on the social media feeds for NCC Group, you see quite a lot of fun, right, which I think is going to be part of attracting people to our company. But I will say, Caspar, at the end of the day, a lot of it is down to just good old-fashioned planning, execution and horsepower. How many people are we going to need? Let's make sure we attract them. Let's make sure we get them into the training cohorts. Let's get them through. Let's understand the impact on our cost base. Let's get them deployed and on we go. But so far, so good. And it's what we do, right? We have an amazing talent acquisition and training capability, which is at the heart of this business. Over to escrow, so a couple of things there. So cloud escrow, I mean, look, it is still a small absolute number. But the growth rates have been tremendous over the first couple of years of operation. And we've had another good growth rate in the first half, which, frankly, we think we can beat in the second half if things go well. So we're hoping that we're going to do that. With all of the key propositions for the future, whether it's Sentinel, whether it's remediation, whether it's Escrow as a Service, what I want to encourage you all to do is to look forward, right, look through the noise of the current business to what those are going to be in a few years' time because the upside potential of continuing those is absolutely fantastic. And that will play into your sort of question 2b, as it were, what impact will that have on the contract base. At the moment, if and when we finish the full year in growth for Software Resilience, it will be thanks to a good verification performance coming on top of a stabilizing contracts base. But I don't expect the contracts base to increase this year. We're tackling that, though, from 3 different angles: Number one, improved retention. Our retention rates are okay, but we're putting a lot more work down to customer success because every percentage point of retention we can improve is contracts that we don't have to sell to get back to net positive. Of course, Tim has talked about the SDRs and the marketing automation engine and the sales force, which are very focused on getting more contracts. And over time, that would get us back to a net positive. And then finally, of course, we've got the Escrow as a Service coming through on top. So all in all, we know where we're heading, right, which is net positive contracts year-on-year. And when we get there, this is going to be a phenomenal place of business. Steve, Mr. Robertson, are you out there?

[Steven John Robertson, Analyst of Technology]

Yes. Yes. Can you hear me?

[Adam Palser, CEO & Executive Director]

We can now.

[Steven John Robertson, Analyst of Technology]

Brilliant. Quick question, it's a really simple one. And it's -- I probably should know this from reading through the statement, but I can't actually find it. The integration costs of IPM included in the half 1 adjusted EBIT of GBP 20.2 million, what were the integration costs that have been included in that GBP 20.2 million?

[Adam Palser, CEO & Executive Director]

You happen to have that one, [ Tim ]?

[Tim J. Kowalski, CFO, Company Secretary & Executive Director]

Yes. So the integration cost was GBP 1.2 million. Sorry, if you include the -- just the integration costs, yes, not the acquisition costs. Yes.

[Steven John Robertson, Analyst of Technology]

Great.

[Adam Palser, CEO & Executive Director]

That's all right, Steve. We always say, no question is too easy. It's absolutely fine. Thank you, Steve. That's okay. We've got hands up still from Ken and Julian. I don't know whether those are follow-ups or whether you just left your hands up. But either way, we've got...

[Kenneth Charles Rumph, Equity Analyst]

I could follow up. Is that okay?

[Adam Palser, CEO & Executive Director]

Let's do that. Over to you, Ken, and then we'll bring Damindu in after you.

[Kenneth Charles Rumph, Equity Analyst]

Sorry, excuse me, Damindu. Right. Sorry, I was just going to ask perhaps just a few more words on the kind of slowdown -- admittedly, last year was a sort of start-up year and a big one. But the slowdown in MDR and kind of the changed client behavior and you do indicate that you feel that you've kind of adapted to that and things are back on track. But a little -- a few more words on that sort of GMS, MDR, which is really the only thing I can see that's kind of not seeming like it's improving this year.

[Adam Palser, CEO & Executive Director]

Yes. Yes, sure. Well, look, thank you. And as I say, it's -- I think there are 2 mundane things and 1 interesting thing. So we'll see if we can get to those. The mundane things are we had a very strong comparative period, the year before. That's all fine. The other mundane thing is sometimes you win bids, sometimes you lose bids. And in particular, we've seen a pretty reasonable performance over in Europe, where we've got some wonderful client opportunities in universities, for example, and other customer demographics, if you like, where we've seen some really good traction. Over in the U.K., a bit slower and a combination of things. We've got a bunch of lumpy bits. On the whole, there are slightly higher values than we've dealt with before. Customers not spending with unconstrained freedom in the U.K. yet. So we're still seeing a couple more sign-offs required, maybe at the CFO and so on and so forth. And so a bit of delay. We win some, we lose some. But the pipeline and the opportunity for us in H2, I'm just not concerned about this, Ken. It comes and goes, right, in terms of the phase.I think the interesting piece is that we can sit here and talk about MDR or managed services with -- and it's easy, right, because it's just 3 letters. Of course, under the hood, there's a whole technology shift going on. And I do find the speed with which Microsoft Sentinel is being adopted by a number of players, both big and small, to be absolutely fascinating. I think that's a technology shift that is going faster than we expected. It's going to have an impact on, I think, a number of MDR providers in the business who are working on more legacy opportunities. I think it will have some kind of impact on the SIEM solutions we've traditionally operated in. But of course, we're very pleased to be surfing the Microsoft Sentinel wave. We've been seeing a high explosion of growth. I mean, the stat that somebody gave to me, Ken, although you'll have to go and verify it somewhere else, is that Microsoft got 9,000 customers in the first year of operation with Sentinel, right, which is quite astonishing. But it just goes to show that when the hyperscalers choose to get into something, it's very wise to hang on to their coattails and get into. So we're very pleased to be working closely with Microsoft to support them. For us, plenty of opportunity. Damindu, over to you, if we may.

[Damindu Vijayapani Jayaweera, Analyst]

I -- well, actually, Ken actually asked the question I wanted to ask, but I have a couple of more to ask actually. One is, could you give some color around the largest customer relationships you have like the tech giants? Have you had a good level of repeat business from them, renewals from them? Because I think you tend to sign those contracts around this time of the year. After you answer that, I'll follow up with the others.

[Adam Palser, CEO & Executive Director]

Yes. Absolutely. And look, we were good to you at the full year results. So we did show you the level of repeat and sort of behaviorally recurring revenue that we got from our top customers. And we haven't given you that. There's no reason why not actually, and we will make a point of giving you that at the full year results. The short answer, Damindu, is I'm very pleased to say that our biggest customers are staying with us and spending more with us than ever before. And in fact, January will be a record -- it already is, right, a record month for orders for us, driven by the continued purchases that we're getting from our biggest customers over in North America. So hopefully, that's a straightforward answer to your question.

[Damindu Vijayapani Jayaweera, Analyst]

No. Perfect. That's what I wanted to hear, basically, are they spending more with you guys. The second one I wanted to ask was, obviously, a number of people already commended you on the impressive hiring you've done in this environment. I'm more actually excited by the focus on hiring juniors and training them, as you say in the statement. Can you provide a bit more color as to how you will deploy that talent? For example, are you thinking of using them in the more commodity end like pen testing, for example, which, I guess, is a way of allocating resources. I just want to get a little bit more color because you always hear of experienced hires in this industry. And I think it's the first time I've seen a cybersecurity consultancy talking about a training program.

[Adam Palser, CEO & Executive Director]

Well, yes, absolutely right. Well, look, it's so important to have experienced people in your business because they are great enablers, aren't they, of client relationships and of more complicated pieces of work. But at the end of the day, there are not enough people in cybersecurity to meet the problems that we have today, let alone the problems of the future. And therefore, the only way for we, as a firm, and if I may extemporize, as a society, to be successful is to train up loads of people who are new to this industry. So we're really excited about our junior training programs. We've had them for a long time. But of course, we've been supercharging them over the last couple of years when it became apparent just what volume we were going to handle. So we have cohorts running all over the world, in North America, in the U.K., obviously. We've got trainees over in Europe as well. I'm trying to think of my way into the second half of your question here. So we have a fairly progressive way of training people up and then putting them on sequentially more complicated jobs, which, of course, gives them the real experience they need to battle harden them and then move them through so that after 18 months, 2 years, they are really very effective indeed. We're doing a lot of work on career paths. And we've recently reorganized our global professional services -- service line into 5 practice areas so that you've got application testing, you've got cloud, you've got strategy, you've got various other things so that people are able to have a primary alignment with one practice but also dot over other practices so that they can get a blend of skills and become rounded security consultants as they go. And the final thing I wanted to add, Damindu, is that on the other side of the equation, we're working hard to break down the work that we do so that it is easier for juniors to do -- we call it the juniorization of our work. Don't get me wrong. You're always going to need some rabidly brilliant ninja to do some stuff. But like almost all work in the entire world actually, a lot of it can be process-driven, systemized and juniorized so that it is done not from scratch every time but then in a more organized way. And so those 2 things together, right, the juniorization of our work, coupled with junior training programs, means that we're very confident of the sustainability of what we're doing.

[Damindu Vijayapani Jayaweera, Analyst]

That's very, very clear. And the last one I wanted to ask you, I don't know if you want to give any color, but I'm just throwing it out there anyway. Obviously, I think not many people believe you could push through price increases, not having done them for 2 years. But are you able to do that on a broad basis? You said that in Denmark, it's easier to put the prices up. But maybe in East Coast, it's slightly more harder to put the prices up. Or is it the case that, in fact, you are catching up with pricing because you've almost not pushed prices up, and therefore, a lot more people are accepting of the new price, new rate cards, for example?

[Adam Palser, CEO & Executive Director]

Yes. Look, there's -- it's a great question. So what's the best way of answering it? I suppose, yes, the starting point for answering it is that if you think about where we come from, which is fairly geographically separate ways of operating, people had historically set different rate cards and, therefore, expectations with customers in different parts of the world. And so it's not as if we're coming off one rate card with one rate, and that's the thing that we are clicking up 1%, 2%, 3%, 4%, 5% every year. Of course, the rate card we have with a customer reflects the work that we do for that customer, the skills that we deploy, the scarcity of those skills, how good they are at negotiating, the volume that they give us and all sorts of other things. But the tools that we have at our disposal are starting to increase the minimum rates at which certain skill sets are sold. We have better visibility today into the different day rates that have been sold in different territories than ever before and which allows us to make just more informed decisions. Actually, people in that territory will now focus on working for clients in this territory because we just can't get the same day rates over here as we can get over there. And so all of that means we should continue to see, Damindu, just a relentless increase in day rates. Steve, is that hand out for a follow-up or a legacy hand up, should we say? Lovely. Okay. Anything from anybody else? We'll just give it a few more seconds. Lovely. Well, look, once again, thank you very much for joining us this morning, giving us your time. We're excited about these results. I hope you are, too. We look forward to seeing some of you over the course of the next weeks. Take care. All the best.