SSH Communications Security Oyj

OMXH:SSH1V

Earnings Call Transcript 2023-Q1

[Lauri Koponen, executive]

Well, valued shareholders, investors, customers, and media, welcome to our Investor Call on SSH Communications Security Corporation's Business Review January-March 2023, so Q1. This meeting will be recorded, and recording, along with the presentation, will be available on our webpage after this call.My name is Lauri Koponen. I am the communication lead here at SSH and will be your host in this call. Results will be presented by our CFO, Michael Kommonen; and CEO, Teemu Tunkelo. You can ask questions at the end of the event by asking to speak, raising your hands, [indiscernible], or writing in the chat your question, I will read it out loud. Please keep your mics muted whenever you don't have the floor.And actually, we could straight ahead move forward. So let's start with the financial results. Please, Michael, the floor is yours.

[Michael Kommonen, executive]

Thank you. Good morning from my side as well. Quickly on the agenda, so -- okay, we'll jump straight into the financials. So in the first quarter of 2023, our net sales grew by 9%, while our EBITDA remained positive, and we recorded operating cash flow of EUR2 million. So looking more closely at the net sales number, it was EUR4.8 million for the first quarter. Our subscription annual recurring revenue grew by 27%, reaching EUR10.3 million at the end of the quarter. The total annual recurring revenue grew 12% and reached EUR18.3 million.The EBITDA for the first quarter was EUR0.2 million, and this was the 8th consecutive quarter with positive EBITDA. On the portfolio and market side, we continued major R&D investments into our Deltagon suite. We continued marketing and market positioning based on Zero Trust, Operational Technology, and Quantum-Safe products. And also we increased the awareness of SSH passwordless solutions in all regions during the first quarter.So next slide please. Looking at the trend of our net sales and EBITDA, you can see that subscriptions growth was strong in all our products and our strategy of moving towards the subscription-based sales yielded revenues in the first quarter based on the multiyear contracts we have in place. And as already mentioned, this was the 8th consecutive quarter of positive EBITDA.So next slide please, Lauri. Teemu, I'm afraid you're muted still.

[Teemu Tunkelo, executive]

Thank you. Yes. Hello from my side as well. And I apologize for background. I'm in San Francisco with the RSA Conference with 40,000 visitors. So it's not only in Texas where things are big. So like to go through what we've done in the starting months of the year. We worked on the topics that Michael mentioned, and we've been clarifying our marketing story, which is targeted now to more challenge the traditional way of perimeter-based security. So we are communications security company. We secure communications between humans, systems, applications, and networks, and sites to cloud.So we have 5 products that manage this whole thing, and it really focuses on session control, on RDP or SSH protocols between the user or the application and the counterparty of the communication. And that basically means that the future of the communication is borderless, meaning that there is not anymore reason to have firewalls, DMZs because it's moving more to the cloud access and partially also because of COVID, it's not anymore that people come over to work and work in the internal network. So in the end, the whole dynamics has changed that there is no difference on the security posture between intranet, internet, and extranet. And that's why our PrivX is the core element of the platform that enables us to monitor, audit, control, and record how cloud accesses with real-time session control.And on top of that we have now half of our products are already supporting PQC as a option for the product where I believe we are pretty much -- at least at the high end of early adopters in the European market, a lot of people talk about PQC here also in RSA, an important topic, but very few companies have yet implemented the protocols.So let's move forward. So how does the Zero Trust Suite, which consist of our total portfolio of 5 product families? The idea is to secure the access and the communication that there will be no man in the middle. The applications are secured, [ Zero Trust ] is done, especially first thing coming out is the biometric recognition and hiding the SSH keys and passwords from the users.So where are the use cases now for these environments? So 1 is certainly the OT edition where we connect the factory to the cloud in a secure way, connect the control systems to the cloud. We have increased a lot the support of the third-party contractors, DevOps environments, that it's easy to control who comes and does what in the system. And just today, we had a meeting with 1 of the major credit card companies. And they said that they have to tighten screws on access control, especially for the production environment, which also has a high availability requirement. They said that their -- the operations guy said that he is allowed to have planned and unplanned downtime for PrivX 12 hours per year. And we have high availability. We have improved upgrade without downtime -- minimizing downtime when you need to upgrade PrivX, so this all is helping our customers.Then if we go to the cloud instances, I would still say that major, part of our customers are using on-premise solutions, but the move to the cloud is accelerating, faster in the government business, slower in the banking business because it is so critical. The OT environment is going to cloud faster because they are coming into this area. They start often from a clean slate or start by taking down parts of their SCADA infrastructure, and then they see better to go to cloud immediately. And that, of course, creates the customer the problem that where is my critical data? Do I know it? Who can access it? Where are the keys? And that's where we can help our customers to manage their data and tighten the screws that they know who was when just enough access, just in time access.And last, you click once more, so cloud and SaaS are coming. I think more and more our competitors are going to cloud. We are also supporting cloud environments in some of the products. But, for example, for PrivX, the demand for pure SaaS solution is not there because part of our customers are banking customers and they want to keep the keys to the kingdom still in their data centers.And last point that I want to make why we did this thing is that the endpoint security solutions that have been a big part of security defense is becoming less and less relevant because the security and biometric recognition is going more towards your mobile phone, and biometric recognition comes from there. The Microsoft, Apple, and Android will do the endpoint security. So it's more and more going to the cloud access. So traditional endpoint security will reduce in importance. Of course, the transition will take time.I was talking with 1 of our government customers the other week and we were talking about the Zero Trust Suite approach, and they said, yes, we've heard the same from other technology companies, but we will still buy firewalls. And it will be a long way, but since we are a communications security company, I think we are in good position to position us as early adapter enabling secure cloud access to a multi-cloud and hybrid environments.So if we go then to our portfolio focus, so we do 3 things: Zero Trust, which is basically passwordless, keyless, borderless solutions based on the PrivX's platform in our -- did I only lose the slide, Lauri? So Zero Trust solutions are available for all our product lines. And it enables hiding passwords, hiding SSH keys, managing them that you get to a world of no passwords, no SSH keys that you can steal, and you can run safely in a borderless world where there is no difference between internal network and external network.OT side I must say that we have been over the last 18 months been well received in the European market with different machine builders and other operational technology solutions, partially still impacted by the geopolitical situation in Ukraine, because people have understood that life is not so nice if we don't have electricity, water, and heating. And that's why a lot of basic infrastructure is now ramping up their cybersecurity protection, so that the enemy cannot remotely shut down the facilities.So these [ 2 ones ] are really carrying us forward. The Quantum-Safe is where we do a lot of work on educating customers, showing the products because we have Quantum-Safe products which are using the protocols that so far has been standardized, and we are well equipped to ride that wave. On the other hand, at this point of time, the market, our customers are making their Quantum-Safe strategies, so the work is more on the early cycle business like consultants. And we estimate that Quantum-Safe will be medium- to long-term a big differentiator for our total Zero Trust Suite.And for the outlook, it's early in the year, and we keep the guidance that we have said. And I think we are on a stable base to continue our profitable growth. So with these words, I hand it over back to Lauri. Maybe, Lauri, you could go through the questions.

[Lauri Koponen, executive]

Definitely. Thank you. Sorry for little slide dance. There was some automation forgotten, but now we have questions coming. And let's start, as a tradition, from Fredrik. So please, Fredrik, you can ask your question.

[Fredrik Reuterhall, analyst]

First, I have a couple of questions regarding the products. Can you give an indication how much the PrivX grew in the quarter?

[Teemu Tunkelo, executive]

Not from my top of my head, but it's actually a little bit difficult to say because if you compare quarter to quarter or year to year, it's different because our Q4 was so good for PrivX. Of course, the revenue continues to grow basically on the deals we did last year because they now convert to revenue. And year on year, we are doing very well. We were looking for that number -- sorry, Michael, do you remember what was the growth for PrivX?

[Michael Kommonen, executive]

Yes. So PrivX sales grew 9% in the first quarter.

[Fredrik Reuterhall, analyst]

Quarter on quarter?

[Michael Kommonen, executive]

Yes. Compared to the first quarter last year.

[Fredrik Reuterhall, analyst]

Okay. Great. And NQX, have the number of customers increased during the quarter or is still -- I believe it was like 6 last time, right?

[Teemu Tunkelo, executive]

Yes, I would say that we are now around 10 customers, most still early implementations and lab use things. So there's a lot of growth potential, but there's lot to learn for the customer on implementing and operating it, and that's why the ramp up is still slower than I would like to have it.

[Fredrik Reuterhall, analyst]

Okay. And yes, even though the strong tailwind for cybersecurity demand, it looks like the customer are still hesitant to place orders, we talked about this before. But what do you think will change the sentiment and maybe, most important, when?

[Teemu Tunkelo, executive]

Well, future is well known to be difficult to predict. We have the highest pipeline ever. We haven't gotten -- which is normal for first quarter, we haven't gotten any mega deals, but we've gotten still new PrivX deals at the sweet spot levels of around $200,000, so below our limit to publish those deals. So I think it's coming. People have a new budget. We have a lot of PoCs going on, and we have done a lot of marketing efforts now in the first quarter, exactly because of our subscription business. We need to get new business win in the first half of the year that it has an impact for the full year numbers of '23. So I am very confident that we will do our best to really in some big [ signings ] still before midsummer. But of course, the customers buy when the customers buy.

[Fredrik Reuterhall, analyst]

Yes. And then the last question for me. EMEA showed a growth of almost 14%. Which 1 of your products pushed demand there?

[Teemu Tunkelo, executive]

PrivX is the biggest growth in EMEA?

[Lauri Koponen, executive]

Please more questions, you can raise your hand or write in chat. In chat, actually, came 1 question, which I assume was addressed just now, but it continued about the PrivX growth. How you see overall the future growth of PrivX? And continued question, is the PrivX year-on-year growth only 9%? What has been the main driver in this dramatic slowing of the growth?

[Teemu Tunkelo, executive]

First of all, we are still looking at a very granular business because the deals -- single deals can be big. And then in which quarter they come, they distort the picture. So our average deals has increased and our spend of the deals has tenfolded. So how PrivX will catch up in the second quarter depends on single deals that we are now working on to get the customer order in the second quarter. And if we get 2 of our main deals, which I think is a good possibility for that, then the growth will return to double-digit numbers. Of course, now that we are ramping up PrivX to absolute growth, if needed more to maintain the growth rate that we have had. But we have strategically, as mentioned before, we have been wanting to work on average deal size growth, which creates then granularity when then the quarters are difficult to compare for a single product on the dynamics of the business.

[Lauri Koponen, executive]

Okay, let's continue with questions which came in advance. Let's start from the question where all the Deltagon installments now pay.

[Teemu Tunkelo, executive]

Deltagon installments paid what does it mean?

[Lauri Koponen, executive]

Where they owe.

[Michael Kommonen, executive]

Yes, I think I can take that 1. Yes, so the second installment of the Deltagon payments will be made in the second quarter of this year and the 3rd and final installment will happen in the first half of next year.

[Lauri Koponen, executive]

And next question was the advances reserved were already quite high in the previous report. They are recognized as revenue on a accrual basis, understood. Why are they not recognized as a lumpsum like license fees in general?

[Teemu Tunkelo, executive]

Well, maybe I'll start and then Michael can continue. Because we've gone to subscription business, the accounting rules tell that as long as we have a delivery responsibility, we will have to spread the income -- the invoiced deal, we have to spread it over the extension of the contract, which typically is 1 year, sometimes 3 years, sometimes 5 years. And that's why our invoicing has bigger number, so we kind of create backlog. And then if we have a 3-year contract, then the contract value is spread over the 36 months.And on the cash flow side, typically customers pay year by year, so we get 1-year subscription cash according to payment terms after the invoice. But it converts only to revenue during flat run rate during the contract period. And 1 of the reasons for that is why we wanted to go there because we are very people-heavy business. This way our revenue is more stable. And we anyhow have to pay people salaries every month, so license deals are difficult because that would create more volatility to the business.And depending on how you count it, if we would have [ wrote ] still everything on the license deals, the company revenue would be tens of millions for sure. But then we would be really dependent on the quarterly variations. So the whole software industry is going to subscription in this sense. And the subscription has the benefit for the customer because some level of R&D, we keep the product alive and that is important, especially in cybersecurity, because the hackers become more clever all the time. And the reason is that since we have the responsibility to keep the product fresh, we cannot recognize all the revenue. Of the invoice before -- we can only recognize it during the invoicing -- during the contract period.

[Lauri Koponen, executive]

Then related to this question, previous question, there is money in the cash box from the prepayments and the cash flow from operations. Why not pay off the expensive hybrid loan from the balance sheet?

[Teemu Tunkelo, executive]

Michael, do you want to take this?

[Michael Kommonen, executive]

Yes. Well, I think what we can say is that we are looking actively at all the options related to the hybrid loan and solutions in relation to that, but we don't have anything we can communicate at the moment with regards to changes in the hybrid loan.

[Lauri Koponen, executive]

The predictability of SSH revenue streams has improved as recurring sales have increased. At the same time, profitable growth at the rule of 40 levels has been seen. Can we expect a rearrangement in the near future, for example, for a high-interest hybrid loan?

[Teemu Tunkelo, executive]

Well, I think, Michael answered the question already. We are actively looking at alternatives. But before the fat lady sings, there is nothing to tell.

[Lauri Koponen, executive]

And then [ Arnold ] also ask them question -- and Michael, to comment on how the company thinks Finland's NATO membership will affect SSH business development growth in the short and medium term.

[Teemu Tunkelo, executive]

I would say, it will have, hopefully, significant impact on medium- to long-term. At the moment, it actually slows down the development because there are new interfaces to be done, there are new protocols that have to be supported, so the customers have gone back to drawing board and are adjusting their architecture to be NATO compatible. So, again, the work is more on engineering and consulting, not yet on the product sales. So it's a good thing, but certainly, the good impact is rather medium term, certainly not short term.

[Lauri Koponen, executive]

And last question was related to this, and why are no order accumulating in form of press releases? Is the market situation competitive situation or what? And I will think the NATO country that trade is getting bigger. This kind of comment.

[Teemu Tunkelo, executive]

Yes. Michael answered already. I think the first quarter of the year is always low. People get their new budgets and start to plan procurement and that's why for us, first quarter is always slow. We have relatively high limit on doing press releases on new deals. So our deal size is -- of the new deals in the first quarter were below that limit. But we are very confident that we have built a very solid base to continue the growth during the year.

[Lauri Koponen, executive]

And in the chat is 1 comment. Sorry to follow up on this, but it is essential since PrivX has in the past been highlighted as 1 of the key growth drivers for the company and now the year-on-year growth is 9% compared to previous growth of 100. Have you lost any PrivX customers during the last year? How is the land and expand strategy progressing in PrivX?

[Teemu Tunkelo, executive]

We have not lost any customers. PrivX is very stable. It is more dependent on, as I said, for single deal's timing, how do you compare the year-on-year thing. We have very many discussions ongoing related to the land and expand things, and we just are in negotiations in the U.S. with big customers who have started the rollout with SSH protocol, and now they are adding LDP protocol to their portfolio. So PrivX is very well positioned to the land and expand strategy. It will deliver growth with existing customers. And also we are getting more and more UKM customers to want to have PrivX as well as the combination of the Zero Trust Suite.

[Lauri Koponen, executive]

So is there anymore questions or comments? There is no more questions in advance. Meaning, I think that at this point, there will be none. So thank you, dear guests, for participating in our call for questions and comments. Materials for this call will be available on our webpage later this day. My name is Lauri Koponen, and I am the communication lead here. I thank you for this call, and next we will be reporting on July 20 with Q2 results. Thank you and have a good rest of the day.

[Teemu Tunkelo, executive]

Thank you.

[Michael Kommonen, executive]

Thank you.