Yubico AB

STO:YUBICO

Earnings Call Analysis

Yubico Reports Strong Growth and Continued Market Demand for Cybersecurity Solutions

Yubico achieved approximately SEK 2.3 billion in sales over the past year and enjoyed a strong Q3 with 62% organic order growth year-to-date. Their flagship product, the YubiKey, is successfully meeting cybersecurity needs, evidenced by zero account takeovers among users. With increasing recognition of the importance of multi-factor authentication (MFA), Yubico anticipates ongoing demand growth, particularly as Microsoft mandates enhanced security. Looking forward, the company maintains its long-term growth targets without revision, leveraging a solid balance sheet while exploring strategic acquisitions to enhance service offerings.

Transformational Quarterly Performance

The latest earnings call from Yubico showcased impressive growth indicators that can excite potential investors. In Q3, the company's order bookings increased by 53% year-over-year, rising to SEK 89 million. Notably, when adjusted for local currencies, this growth rate is even higher at 58%. The strong performance can be attributed to a diverse customer base including public sector entities and major tech companies. This broad-based growth bodes well for future profitability as it suggests a strong demand across sectors, which serves as a favorable backdrop for Yubico's products.

Rising Revenue and Profits

Yubico reported a robust 45% year-on-year increase in net sales for Q3, reaching SEK 1.7 billion. When accounting for local currencies, the growth accelerates to 49%. The company has demonstrated an impressive performance reflected in both the gross margin, which has remained stable at 81%, and a surge in EBIT from SEK 16 million in the previous year to SEK 111 million. Such profitability levels indicate that Yubico is effectively converting growing orders into tangible earnings, setting the stage for sustained financial health as they continue to expand.

Market Trends and Long-term Growth Potential

With the increasing cyber threat landscape, Yubico is well-positioned within advanced multifactor authentication. The company maintains a promising outlook, with a stated long-term revenue growth target of at least 25%. This aligns with their strategic focus on internal enterprise use while increasingly supporting end-user implementations, especially among financial institutions. The anticipation surrounding Microsoft’s adoption of passkeys by 2025 may provide further catalysts for adoption of YubiKeys, indicating strong strategic foresight.

Strength in Subscriptions and Renewals

While the subscription sales as a share of overall revenue have slightly declined to 12% in this quarter, the total annual recurring revenue (ARR) grew nearly 15%, with a significant increase in renewal contracts. Yubico has reported that 56% of current annual bookings are tied to subscription renewals, which showcases their capability to retain customers and uplift their loyalty. The management emphasized a commitment to expand the subscription model, which could enhance predictable revenue streams and increase margins if properly executed.

Investment in R&D and Operational Improvement

Yubico has committed to investing in research and development, reflective in their sustained R&D expenditure which, although appears as a cost currently, is fundamental to their long-term product development strategy. Furthermore, the adjusted EBIT margin improved to 18.8%, indicating efficient cost management alongside revenue growth. The company has also focused on optimizing inventory—now at 28% of the last 12 months of sales—which suggests solid operational management in adjusting supply chain dynamics to meet customer demand effectively.

Strong Balance Sheet Position

As of the end of Q3, Yubico's cash position remains strong at SEK 727 million, providing them with ample flexibility for potential acquisitions or further investments. The net cash position after accounting for liabilities stands at SEK 676 million, which demonstrates robust cash flow management even amidst strategic investments. This financial resilience underscores Yubico's readiness to capitalize on market opportunities or to absorb operational hiccups.

Challenges Ahead: Managing Expectations

While Yubico has delivered strong performance, the management acknowledged the tougher comparables anticipated in Q4 due to the previous year’s record numbers. Nevertheless, ongoing market trends supporting cybersecurity solutions and the broad customer base offer a buffer against potential headwinds. Their ability to sustain growth despite challenges will be essential as they communicate transparently with investors regarding future performance expectations and operational improvements.

Earnings Call Transcript 2024-Q3

[Operator]

Welcome to Yubico Q3 Earnings Call. [Operator Instructions].

Now I will hand the conference over to CEO, Mattias Danielsson; and CFO, Camilla Oberg. Please go ahead.

[Mattias Danielsson, executive]

Good morning. Welcome to the Q3 report presentation for Yubico. As mentioned at the start of the call, on the call today are Camilla, Yubico's Chief Financial Officer; and me working as Yubico's Chief Executive Officer. And we'll start with a short recap of our company to give some background before we dive into the quarterly numbers. So Yubico, we're active in the advanced multifactor authentication sector. And we're a proud hardware company. The core product that we have is the YubiKey. For the last 12 months, we posted sales of approximately SEK 2.3 billion or about $220 million. We're about 470 employees. And in spite of us being a hardware-based company, we've been able to maintain healthy gross margins over the years, pretty consistently in excess of 80%. And the reason for that is that most of our development and most of our product offering is really the software that goes on the hardware.

And there are typically 2 things that we want to highlight as the things that we're really proud of when it comes to our company. The first one starts with the product, of course, the fact that our product addresses a very real and tangible need for our customers. There's a high level of cybersecurity threats and those customers that have been using our products have experienced 0 account takeovers. So that's, of course, the foundation of our success. Based on that success, we've to date sold and deployed more than 30 million YubiKeys, and our focus has been on selling into some of the world's largest companies and organizations. We have about 5,000 business customers today. And as an individual and a consumer, you're even able to buy our key online, but our focus is on working with large companies and organizations. And today, already some 30% of the Fortune 500 companies are a customer of ours. So to dig a little bit deeper and talk about our product, what is it that we do? And what problem does our product solve?

If we flip to the next slide, please. So fundamentally, what we're selling is a key. And a key is only helpful if there's a lock at the other end. Our key is used to ensure that there is no account takeover. It's used for safe logins to access data information and systems. And we've invested a lot in making sure that our key fits into all the relevant locks out there. So it covers today the authentication requirements that are found within a big organization of company, whether it's for remote access, whether it's for privileged access, whether it's used for different types of system access. We've spent a lot of time making integrations and building support for all the systems out there. And we have developed what we like to call a Swiss Army Knife type key, i.e., a key that fits into all the locks, meaning that a company can use this for all the authentication requirements within an organization based on the protocol or functionality that is on the key and the integrations that we have made with the different systems. And the fact that we combine this usability and that it's easy for the user to use our product with the highest level of security, that's the foundation of our success.

If we talk a little bit more about the customers on the next page, we can see a subset of our public references. And it's worth noting perhaps that you see a lot of high-tech companies there. That's where we started our growth journey, working with the largest tech companies in the U.S. But today, we have a very broad composition of customers across a wide range of industries. And to go from the visuals into the statistics, if you want to flip to the next slide, please. As I explained earlier, we sell our product to a very wide range of customers, and you can even buy it as a private individual, but our focus in terms of our sales efforts to date have been on working with the largest accounts. And if you not just only talk about the Fortune 500, but instead the Global 2000, today, already about 1/4 of them are customer of ours. And that share has increased over time. Back in 2018, it was about 12% of the Global 2000. Today, it's more than 1/4. However, our penetration among our existing customers, if we compare the number of keys deployed compared to the number of employees is still very low.

Typically, we start with a small subset of users. PAM users or a call center or people with access to all the critical areas, and then we expand from there. So even if we've landed a lot of big accounts, the big opportunity is expanding within those once we've got our foot in the door, so to speak. And we do have 2 different business models. Camilla will get back to that when we talk about the quarterly results. We sell on a perpetual basis where we outright sell the key with a perpetual license without any additional cost to use any associated software. And we also have a subscription model. But no matter the buying model for the customers, we see a lot of repeat business and very loyal customers. And one illustration of that is that if you look at our biggest customers and what their repurchase pattern look like every year, if we take a 5-year perspective on that, pretty consistently, we see that we see annual repurchase rate in excess of 10%. Part of that is, of course, because of that expansion that happens once we've landed a big customer.

But part of it is that they want to make sure that they have the latest version of the key that they find out new use cases and that they want to cover for employee attrition, et cetera. We've also diversified our customer base, as I mentioned earlier. We started out with high tech. So 5 years back, about 2/3 of our sales was high tech. In 2023, high tech was still our biggest sector, representing almost 1/4 of our sales. But this year, it's actually even been eclipsed by financial services bank and insurance companies by a small margin today being our biggest sector. So in summary, we have some very large account customers. However, the journey has often only started with those accounts, and we see a lot of opportunity to upsell within the existing customers in addition, of course, to attracting new customers all the time. So that's a little bit of a background about our company and our business.

And then going then into Q3 and some things to highlight. We feel that Q3 was a very strong quarter. We'll get into the details shortly. But high level, we feel that we've had strong growth in order bookings, which converted into strong net sales or revenue growth. And because we're able to maintain a healthy gross margin and we have cost control that turned into a good profitability, and we were able to translate that profitability into strong cash flow. So overall, we feel that this was a strong quarter, and we're very pleased with the results that we've got. We should highlight, as we did with the security advisory that we released on September 3, that there was a vulnerability that was found in our previous versions of our YubiKey. We rated this as a moderate severity vulnerability because you literally had to have physical access to the product for an extended period of time. You needed to rip off the plastics, you need to apply advanced machinery and, in most cases, even know the associated password PIN code and then you could theoretically make a copy and slip the original key once we mold it back to the original user.

And this is definitely a vulnerability, and it shouldn't have been there but in reality, I think very few customers saw this as a big security threat. We've been in contact with the major customers, and it's been a very moderate or minor, I should say, impact. So it didn't really have much of an impact this quarter. Long term, it's, of course, very important that we're able to maintain both high security, but also strong transparency when it comes to the security and the integrity of our products. So another thing that I would like to highlight other than, of course, the financial numbers is that we're seeing strong growth across a broad set of customers. So it's not just one geography or one sector or one specific customer that stands out. It's been broad-based. There are 2 sectors that were particularly strong during the quarter. It was the public sector and high tech, and it was broad-based among those sectors. One thing that we'd like to highlight is, as mentioned earlier, the majority of our sales is for enterprise use internally.

But we're seeing more and more signs that our customers want to take our product to their end users, in particular, among banks, and it was released during the quarter that we've initiated a cooperation with the largest bank in Central and Eastern Europe, the large bank in Poland, PKO Bank who has now built in support for use of FIDO and YubiKeys in their online platform and recommending their customers to use YubiKeys to ensure their accounts don't get hacked. This is, of course, a motion that we're really happy about. It's still early stage, didn't have a large impact on our revenue, but we're running now a number of pilots together with our customers to get to end users. That to us is the best route to getting to end users and consumers, working with customers and partners. And finally, on the more admin point, we have announced the Nomination Committee in preparation for the '25 Annual General Meeting, but that, of course, didn't have much of a financial impact for the quarter.

With that background, I'm going to hand over to Camilla, who will go through the details of what I feel is a solid quarter.

[Camilla Oberg, executive]

Thank you very much, Mattias. And yes, it feels quite strong when looking at the numbers. So on the order bookings, we see a continued strong growth, 53% year-over-year growth, but in local currencies, even more, so close to 58%. Notable is that subscription share is 15% of the total order bookings, which is the same level as last year. But of this SEK 89 million we have in subscription order bookings, actually SEK 62 million is related to renewals. So where we have customers that are now starting on their second contract period for subscription. On net sales, we also saw a good growth. As Mattias said, the order bookings are coming through to net sales. So we saw a growth year-over-year of 45%. And in local currencies, even 49%. Subscription share declined year-over-year, and that is due to that even stronger development within the perpetual customers. So the subscription share declined from 14% down to 12% this quarter when it comes to the net sales.

On the gross profit side, we are happy to see that we have a stable gross margin, 81% this quarter. And as you have noticed, we are around 80% to 82% during the quarters here on the gross margin. On the profit side, despite that we are continuing investing in R&D and sales and marketing to secure also the business going forward, we see a substantial improvement in the EBIT from SEK 16 million up to SEK 111 million. And of course, that is related to the volume growth that we have seen this quarter compared to last year's Q3, which was an unusually weak quarter, we should say. Looking deeper into bookings. We see that here in this chart that the Q3 bookings is substantially higher than last year. And year-to-date, we see a growth of 61%. So it's fairly even over these first 3 quarters. So we grow from SEK 1.155 billion up to SEK 1.862 billion year-to-date in bookings. And as I said, this is the first year with renewals of the subscription contracts. And looking at the TCV, 56% of it is related to renewals. And is 56% year-to-date, I would say.

And of course, we are happy to see that these renewals are coming through as a confirmation from our customers that they really have trust in our security solution and want to continue. The share of subscription bookings for this quarter is the same level as last year, as I said. But year-to-date, we have increased the share actually to 18% from 12%. So that is positive. And the order bookings this quarter came from a diverse customer base, largest orders from public sector major tech companies, but we also see continued interest from European defense sector in the market here. And looking then deeper into the net sales as well. We see that year-to-date, net sales amounted to SEK 1.7 billion and was a growth now year-to-date close to 34%. Subscription sales represented 12% versus 14% last quarter. And of course, this decline is then contrary to bookings development, as you see that we have actually increased the share year-to-date.

But it is because we have the stronger development in perpetual and where we see the net sales coming through directly and also that we have the effect of renewals and which is not new revenue then. And we also see that we have larger contracts with longer contract periods. Also, geographically, we see an increasing diversity. So we see that EMEA and also Asia Pacific is actually growing more than America and becoming a larger part of the total sales. On the ARR side, we have a growth of close to 15% compared to last year and are now running our subscription yearly value of the subscription portfolio of SEK 293 million at the end of September. So this is measuring the yearly value of our subscription portfolio at the end of the quarter. So it's kind of a, what you say, future-looking revenue stream with the current contracts. On our profit side, you see really a hockey stick here coming up on the rolling 12 months. So with the volume growth that we have now and the stable gross margin really supports the growing profit. So now leaving, as you see, the quite weak Q3 last year behind us, we get this increase in the rolling 12 months EBIT from SEK 360 million up to SEK 411 million actually.

We have investments in the R&D and sales specifically as we are a growing company and the need to continue to grow our organization with our people. Our adjusted EBIT margin was 18.8% this quarter compared to 4% last year's quarter. And you see here also looking at the EBIT, we have adjusted EBIT and we have the EBIT. And this is the only quarter we have had Q3 last year, where we actually have a one-off item that is related to the merger between ACQ Bure and Yubico a year ago in September last year, where we had some transaction-related costs, a total of SEK 93 million that is included in last year's EBIT, which was negative of SEK 77 million. We mentioned the LTIP program. We have the PSUs here because it is kind of a cost increase. This program was launched in June. We commented it also in last quarter's report. This is the first quarter where we see 3 months effect of it. And the reason why we commented is that the impact is higher due to -- we have our own financial targets as measuring the performance of this PSU program instead of having the share performance as target and thereby the cost that we're recognizing is 3x higher approximately.

And this month, we also saw an unrealized currency effect of negative SEK 9 million in this quarter. The first half of this year, we have had quite minor effects from currency changes. And finally, looking at the cash flow, which is also a nice story, as Mattias said. And as you remember, we have talked about during last quarters that we are investing in our inventory. We started to build up the inventory from a very, very low level 2022 and during 2023 and up to Q1 actually this year to both reduce the risk we have in the business when it comes to critical components and if they would just have a hiccup when it comes to deliveries. So that's the dark blue part of this chart. But also as a growing business, we also need to make sure that we can deliver quickly when we get large orders. So we have strategically built up the inventory during the last quarters.

But as you also see, we are now continuing the downturn of the ratio between the inventory levels and the rolling 12 months net sales. So we had the peak in Q1, 30%, declining Q2, 29% and now we're going down to 28% at the end of this quarter. And the net change in working capital is negative this quarter, SEK 74 million. Except from that we also increased our inventory in absolute numbers this quarter as well, we also see growing accounts receivables due to strong billing. And we also see effects of subscription contracts that we have been invoicing earlier this year that we are now recognizing the revenue and having a negative impact on the cash flow. But despite those things, we see a strong operating cash flow of SEK 67 million. We have a cash and cash equivalent position, which is strong, SEK 727 million. Net cash at the end of the period, SEK 676 million, and thereby, we have some interest-bearing liabilities of SEK 51 million, where SEK 22 million are office leases. And the rest then that's an external loan that we have, which will be amortized in full during December.

So that is pretty much the financial numbers for the quarter, and I leave back to you, Mattias.

[Mattias Danielsson, executive]

Thank you, Camilla. Just to wrap it up really quickly. So what's going on here? I think we've delivered solid growth for 4 consecutive quarters now. And that's, of course, driven by some tailwind in the market. The cyber threat level is very high. And as I think I was able to highlight earlier, we do offer a solution, which is a very tangible and cost-efficient way to mitigate one of the major threat vectors when it comes to cybercrime. Again, to repeat myself, when you look at meta studies of cyberattacks, you'll find that in 80% of the cases, compromised log credentials was a critical factor. So by ensuring that you have strong MFA, you are addressing one of the major cyber threats out there. So that's kind of the underlying market dynamics that are working in our favor. That's even faster propelled by the AI-enabled attacks that we're seeing on a broad basis now. And as I highlighted earlier, the bulk of our revenue and our focus when it comes to sale remains internal enterprise use. But we find it very encouraging that our customers are now in an increasing number of cases, taking our products to their end users, and that could be an important revenue source in the future and an important way for us to even help individuals and consumers up-level their security.

And part of that, too, is that we're active to ensure that we cannot just protect lo-gins, but even protect users. To do so, we need to cover the full life cycle of a consumer, and that's like you see the efforts that we're making when it comes to different projects for identities, especially in Europe, where we're working with the EU DI wallet initiatives. And finally, I'd like to highlight the fact that we have started our structured CSRD work, more to come there. And of course, fundamentally, we feel that our product does have a positive impact in protecting identities and making people safe online. But of course, we want to review our business and see how we can ensure that we run our business properly from an environmental, social and governance perspective, more to come there. So I feel we've built a solid base for future growth, and we're quite happy with the quarter.

And with that note, we'll open up for questions. And I believe we'll start off with some of the people standing in line wanting to ask questions. Over to --

[Operator]

[Operator Instructions] The next question comes from Joachim Gunell from DNB Markets.

[Joachim Gunell, analyst]

So our favorite topic on these types of calls tend to be how the current quarter has started. So I'll give it a shot. I mean, we're halfway into Q4 now. Q4 was a very strong quarter last year on bookings and to grow versus that higher base is, of course, here our main question here. So just take us through what gives you confidence to actually grow the bookings versus that higher base and tougher comparables and then perhaps also discuss the pacing of Q3 bookings momentum, how that progressed on a month-over-month basis throughout Q3.

[Mattias Danielsson, executive]

As you know, we don't provide guidance on a quarterly basis. And as you also noted, we did have a record Q4 last year. I think we reported in excess of 8% growth that quarter, which means that comparables look much more challenging. On a positive note, though, as we just talked about, the market trend is definitely working in our favor. And I would say that given that we have, again, a very broad-based growth in Q3 across several different geographies, industries and customers, and we see a lot of repeat business from existing customers, that should set us up for continuing on a growth trajectory. So I'm optimistic about our ability to continue to deliver growth.

[Joachim Gunell, analyst]

And call it, taking a step back and looking a bit forward here. So Microsoft Entrust enablement of FID02 Passkeys as of January 2025. In my world, that is a true hurdle remover for a potentially very large user base of organizations to go from good enough security with apps to also step up their game with YubiKeys. So can you just provide some quick thoughts whether -- I mean, how you envision that opportunity unfold for you, both in the short term but also long term.

[Mattias Danielsson, executive]

I agree with you. This does help. I mean the most common use case for YubiKeys, which is used, as I mentioned, across a wide range of service operated systems and devices. But it's no secret that the most common use case is in the Microsoft environment. The fact that they're issuing these mandates and that we're seeing a growing realization that to have strong security, you need strong MFA. This does set us up for growth. And I mean, there's nothing new when it comes to security level, but it's more the fact that now it gets easier to implement our solution, and there's a stronger realization that a solution like ours is needed. So this is definitely an enabler for continued growth. And Microsoft is a huge company, and it's difficult to always know where they're heading. But this, to me, indicates that, yes, this is definitely a positive development from our perspective.

[Joachim Gunell, analyst]

And final question for me. Coming back to a topic we've also discussed, but you have a very healthy balance sheet here and then the cash flow is also compounding nicely here. So can we discuss just the ongoing M&A appetite and the consolidation amongst U.S. cybersecurity players? I think like 2 companies was out just in conjunction with the Q3 results announcing a potential sale of the businesses here. So just talk a bit about your thoughts on the best possible uses of this capital you have in the business, whether that is to invest more in the business on an organic basis, instate some sort of dividend or buybacks or even potentially like pursue M&A to, call it, take a step up in the value chain? Or what would the dream acquisitions look like for Yubico?

[Mattias Danielsson, executive]

As you know, we have a stated policy that we won't pay any dividends for the foreseeable future. And the reason for that is, of course, that we see a lot of growth opportunities in the market. Whether we're going to execute on that based on organic growth or through strategic acquisitions is a little early to tell. But we're definitely analyzing how we can grow our solution to help our customers base from the stronghold that we have. I may have mentioned on earlier calls that the feedback we're hearing from our customers is that once they've implemented our product, they don't have a problem with compromised [incredible]. However, what they're really looking to do is to protect their users. And to do so, we need to cover the full life cycle of a YubiKey deployment. So there are a number of opportunities to expand our footprint there, either through organic development or through potential acquisitions. But we'll have to get back to you with a more firm answer on that, Joachim. But I agree with you, there's lots going on in the market. We have a very solid balance sheet, and there's more growth to be seen.

[Operator]

The next question comes from Predrag Savinovic from Carnegie.

[Predrag Savinovic, analyst]

Could we discuss the PKO Bank partnership? You mentioned it a few times in your presentation, but you also mentioned potential others as well during this call so far. Do you have others which you have not announced? Do you have other potential banks or insurance companies that are in the pipeline due to be launched soon? How should we think about this?

[Mattias Danielsson, executive]

So with PKO Bank, Poland's largest bank, what's really nice about that was that they were very public with this initiative. It's a little hands off, though. I mean they built support and they're recommending their customers, but it's really left with the individual users to decide on what authentication method they want to use. So it's not exclusively using YubiKeys in any shape or form. So the story is really that when we look across the different bank pilots and projects that we're running right now, they all look very different. Some are only targeted on specific high net worth individuals or commercial users. Others are more broad like the PKO Bank initiatives and others have identified a slightly larger set based on kind of the use case where they want to start testing this. Again, what's nice about PKO Bank is that it is a very public case and they're referenced that way. For the others, we'll have to get back to you on the deployments there. But we also, over time, want to standardize our offering there because what's important is, of course, that we see a success as this gets deployed that we have high pickup on the customer side and that they get a good user experience. So we need to be a little directed to make sure that you identify the right users that you offer a good UX to support the customers as they up-level their security.

[Predrag Savinovic, analyst]

But it does sound like you have other partnerships in place, which you have not publicly announced based on how those contracts are structured?

[Mattias Danielsson, executive]

Correct.

[Predrag Savinovic, analyst]

The EU NIS2 directive and the U.S. National Cybersecurity Strategy, do you see this supporting you already now as a tailwind? Or can this be a further catalyst for bookings going forward when these respective organizations announce a firm road map or process. So we conclude this is how cybersecurity process should look like? And will that trigger more deal for you, do you think?

[Mattias Danielsson, executive]

I think we're already seeing tailwind, and I expect to see more tailwind. So we already see tailwinds from it, and I think we'll see even more tailwind from what's going on the regulatory side. However, there's no one silver bullet there. It's more kind of a general increased awareness of the need for strong MFA and the resulting regulations and recommendations. So it's not just one piece of legislation, which makes the world of difference. It's a general motion that is driving demand within our segment.

[Predrag Savinovic, analyst]

And finally, on pricing, what is your strategy of making increases here? I always thought of YubiKey being a high-value product that offer a lot of bang for the buck. And considering the growth you have in bookings and sales, are you offering this a little too cheap maybe?

[Mattias Danielsson, executive]

Historically, what we've typically done is we haven't done with a few exceptions, any type of inflationary adjustment on the pricing. We typically like to increase prices when we offer more functionality or a new version. But even more important part is wanting to make sure that our customers buy the more advanced products. As you may be aware, we have a single product called Key, which is competitively priced because that's more open to competition. But when it comes to our more advanced versions, including the certified versions, that comes at a higher cost because of the higher functionality and the higher certification you have there. The other part of that is that we want to develop our subscription offering to make that the enterprise-grade product. And that comes with offering unique functionality and services that are only offered on a subscription basis. I'm not saying we're going to abandon our perpetual sales, but we want to make sure that we develop our subscription offerings and more enterprise customers realize that that delivers the highest value to them -- that offers an opportunity for us to adjust our pricing.

[Operator]

The next question comes from Erik Lindholm-Rojestal from SEB.

[Erik Lindholm-Rojestal, analyst]

I wanted to follow up on Joachim’s question to start with on growth rates. So this year has been strong, of course, 62% organic order growth year-to-date and the comp next year will definitely be tougher at least. But I mean, in the light of this, do you think you can sort of sustain your long-term growth target next year as well? Or will this be tough to achieve?

[Mattias Danielsson, executive]

As you say, this is arguably our fourth consecutive quarter where we're reporting really strong growth. So of course, the bar goes up. However, I feel that given that it's a very broad composition of geographies, segments and customers, I don't feel that this is a one-off. So I see no need for us to revise our long-term goals based on the fact that we've had higher growth now for a rolling 12-month period. So I think we're able to continue growing and no need really to revise the long-term growth targets.

[Erik Lindholm-Rojestal, analyst]

Then on the subscription offering, you talked a bit about maybe making some tweaks to sort of accelerate growth here. Can you perhaps -- I mean, growth has been a bit slow there. Is there anything you can mention in particular that you're doing to tweak this offering and make it grow more again?

[Mattias Danielsson, executive]

So there are 2 sides to that. One is short term, the share of subscription compared to perpetual sales is, to some extent, determined by the segments that are strong in a particular quarter. And even if it was broad-based, we highlighted that in particular, public sector and high-tech was strong this quarter. When it comes to hi-tech, unfortunately, we haven't been able to convince a lot of our more traditional high-tech customers about the value of buying it on a subscription basis. So there is some customer composition part of explaining the subscription sales pattern. However, like you say, for this to be more attractive, we need to offer new functionality. To date, the only unique functionality, which is only offered on a subscription basis is the integration we have with Okta enrollment or Pre-reg as we call it. Over time, we will develop more features and functionalities, which only lends itself to sale on a subscription basis.

And another important part of that is that we want to be a partner as we sign up a subscription customer, making sure that we assist them with a successful deployment and management of the installed base. So that goes beyond the pure physical product and the core functionality there, kind of lowering the thresholds and making sure that you have a successful and speedy deployment enrollment and maintenance of our installed base. So we want to add the software and services part of the subscription offering. More to come there, but I agree with you. We want to go down that journey, but it should be based on what the customers feel that this is the best way for them to get the highest [indiscernible].

[Erik Lindholm-Rojestal, analyst]

Just a final question for me. I think you touched on this a bit, but I mean, your EBIT margin has been around your midterm target now for 2 quarters in a row and you're growing very steadily. Is there anything that indicates that you sort of wouldn't be able to sustain this level going forward? Or do you have any major planned investments coming up?

[Mattias Danielsson, executive]

So as I think Camilla highlighted, we did not capitalize any R&D cost during the quarter, and we haven't done so in the past either. So our investments in building our products of the future are really charged as cost today. And we want to make sure that we maintain our R&D spend at a level which sets us up for success long term. And I think we're at a level which is pretty good there, but we may even increase that a little bit. When it comes to scaling, yes, G&A has pretty consistently been going down. Sales and marketing has been a little bit more stable, and it probably will be stable for a little time. But if you take midterm, so in a couple of years, I think there's opportunity for us to drive down our sales and marketing costs as we are able to explore indirect sales model more effectively. Today, most of it is direct. So I don't see any reason for why we shouldn't be able to maintain our margins. But similar to the earlier question by Joachim, there are also some adjacent markets that we may want to explore. And then it comes in 2 different ways, either it's organically that we develop this, which may require investments or that there's an M&A track for getting specific functionality or specific competence. But yes, we'll have to get back to you on that.

[Operator]

The next question comes from Thomas Nilsson from Nordea.

[Thomas Nilsson, analyst]

I have 2 questions. First, in this quarter, we saw increased sales in EMEA and Asia Pacific. Can you elaborate on your strategic priorities in these regions? And are there any particular industries or partnerships that you're targeting? And second, your inventory levels came down to 28% of last 12 months sales. What would be a long-term level you would like to see in terms of inventory as a percent of sales? And when do you expect to get there?

[Mattias Danielsson, executive]

I'll start and then I'll ask Camilla to help me out on the second question. But to start with our go-to-market approach in EMEA and APJ. In EMEA and APJ, as a reminder, we are pretty much exclusively working with a 2-tier channel model, which means that we do have salespeople who engage with the bigger customers, but all businesses run through the channel. We found that, that actually has worked out really well in certain markets where you get a reinforcing effect as you start working deeply with some value-added resellers. The most obvious example is within the German automotive industry, where we started working with our great customer, BMW, a long time ago. And our channel partner there is now very active in making sure that we expand our reach in that market, which we're super happy about. So we want to do more of that, making sure that we identify the right business, but also the right value-added resellers and become better at enabling them more quickly.

So that said, though, we also want to make sure that we have sales reps that are able to work directly with the customers because the big deployments that we have and the big customers we have typically are complex enough for us that it makes sense for us to have a direct involvement. But we want to make sure that we can enable our partners to cover most of the customers, what we call the commercial customers without any direct engagement from our end. I think that that model is working really well within the DACH market. We're seeing a lot of growth now in the U.K. and in France. So more of developing that model is how we think about approaching EMEA and APJ. So that's the first part of the question.

The second one, yes, as Camilla explained, we did proactively build up our inventory levels, both on components and ready products to ensure that we have security in terms of our ability to deliver and also to be able to deliver for large deployments on short notice. And as Camilla also mentioned, we have seen that level even though the absolute numbers are still growing, related to the last 12-month sales, it's actually come down a little bit. We don't have a specific target for that. But rule of thumb, Camilla and I feel that we probably should be in the 25% to 27% range long term. There are individual quarterly swings based on large deliveries of components, whether they happen early in the quarter or late in the quarter. So it's not a --- right now, it seems like a very smooth journey down. There could be individual swings there. But I think we're still a little high, but no real major level changes that I anticipate there, but perhaps it should come down a little bit.

Camilla, I'll hand it over to you for more details there.

[Camilla Oberg, executive]

I think you covered it very well. It's not much more to say actually. Absolutely. We will continue the journey downwards might vary depending on how -- especially the net sales in the quarter or certain shipments, timing effects, et cetera, but continue downwards, but just a couple of percentages perhaps. We will absolutely prioritize that we have the ability to ship and meet our customers' demand and also for larger orders where they need a quick deployment.

[Operator]

The next question comes from Joachim Gunell from DNB Markets.

[Joachim Gunell, analyst]

Just a quick follow-up on -- you've provided this on a quarterly basis, the number of keys sold in your presentation material, and then it was, I think, SEK 33 million year- to- date in Q3. You had the number SEK 32 million in your Q2 presentation. And I would assume that there is some rounding here. But when I look at your bookings number in relation to that, call it, incremental new keys sold, it would imply that there is a step-up on either the value that each new key bring in relation to where it has been in recent quarters. So are you seeing it -- I mean, even if you aren't raising prices the way you -- I mean, answered Predrag question, are your customers going for more advanced solutions from you? Are you seeing any such trend here? Or am I reading too much into this figure?

[Mattias Danielsson, executive]

Quite frankly, I think, unfortunately, you're reading a little bit too much to it. This is more as an illustrative number. So the fact that we've only adjusted it by one, there's some running out there and maybe it should be plus 34%. It's a plus in front of it. So it's only a level where we're definitely sure that we're not overstating it. That said, though, there is a long-term trend of our customers going for the more high functionality and therefore, more costly versions of our products. So we have seen an average sales price increase long term. But I wouldn't infer it from the overall number. That's more illustrative to show kind of the impact we have in terms of how big the deployment is. We'll have to talk about whether we should be more precise in reporting that number or whether we should be even more, let's say, rounding off and have it at the nearest SEK 10 million because we don't want people to draw too many conclusions on that number on the overview page.

[Operator]

There are no more questions at this time.

So I hand the conference back to the speakers for any written questions or closing comments.

[Mattias Danielsson, executive]

There are a number of written questions. Maybe we should read them out and take them one by one. I’ll start from the bottom. So the first one says, congratulations on a strong Q3. Two comments. Could you confirm that the negative EBIT result is only driven by the 68% dilution due to Bure acquisition.

Camilla, do you understand the question, the negative EBIT results?

[Camilla Oberg, executive]

I can say like this. I think this is a mix up of 2 parts, perhaps. The negative EBIT in Q3 last year, yes, that is driven by the transaction costs. Perhaps this is related to EBIT per share. Looking at adjusted EBIT and EBIT per share, yes, the increase in number of shares, that is totally related to the dilution in connection with the merger when quite many more shares were created or issued.

[Mattias Danielsson, executive]

Second comment, we would like to congratulate you on releasing your cryptographic library. This is a huge derisk from industry who might be affected by industry-wide issue. Kind of the Yubico product would stay immune. We believe this aspect is not well understood by investors. I agree with you. I think it's really important that we have a robust secure architecture. And this is part of that effort to make sure that we're in control. And on top of all the risk factors that are introduced by suppliers and making sure that we understand the risks that are associated with our products. So I agree with you, this is an important feat.

Then we'll move on to the next question, which is in Swedish language. Congratulations on a strong quarter. Given that this is your first year as a publicly traded company, as commented today, you have a pretty high level of volatility and fluctuation when it comes to cash flow, inventory and working capital. How would you want to work with this going forward? And would it be suitable to set explicit targets around these measurements to increase the visibility and transparency as a fast-growing company. As you know, we only have communicated 3 long-term targets. One is on the growth that it should be long term, at least 25% growth on revenue and 20% on profitability on the EBIT level and that we're not planning to pay any dividends for now.

We agree that it does make sense for us to be perhaps a little bit more explicit about certain aspects of our business because we realize that we are new as a publicly traded company. I think when it comes to setting more detailed targets is probably not the right way forward. But I want to make sure that we're transparent about how the development looks and what you should read into it. And I think you highlight cash flow, inventory and working capital are definitely areas where we need to up our game when it comes to how we provide that transparency on what to read into the numbers.

I think, however, from my perspective, Camilla did a pretty good job in explaining that just now. So please feel free to provide input with us on how we can improve in how we communicate so that you can understand our business.

[Camilla Oberg, executive]

I just would like to add one aspect there also when it comes to the working capital, the inventory we have talked about. But the other part there is, of course, related to customer receivables and also then our deferred revenue related to large subscription contracts, and as we are addressing the enterprise market especially and working with the largest customers that you have in the world. And then, of course, we see some of these large contracts. And when we do those billings at the stage that we are now in the size we have now, then that will have timing effects on our balance sheet and our cash flow. We try, as Mattias said, to be as transparent as we can when it comes to describing, but it's very difficult for us to set a model for how this should be looked at going forward. Of course, over time, increasing the portfolio of subscription contracts, a bigger portfolio of more customers, et cetera, et cetera, then this will even out over time. And there also as we grow, I expect it to be less fluctuating. But where we are now in the coming years, I expect that we will continue to see these timing effects over the quarters, which are very difficult to foresee and that we don't really see that we have any specific seasonal effect in this either. It's more timing effects.

[Mattias Danielsson, executive]

Let's make sure we're transparent, but I don't think it makes sense to provide guidance on those metrics. The next question is, why did you not make the market aware of the hacking incident when it was first made aware to you in April 2024. I understand the question as the security vulnerability because I'm not sure that anyone really got hacked, but definitely was a security vulnerability in the product. The reason for why we didn't go public as we first learned about this, just to take a step back, this is an industry-wide vulnerability that was because of a vulnerability in the Infineon chip. So the first ones that were notified about this vulnerability was, of course, Infineon. And they notified us once they -- I think we even heard directly from the hackers sometime after that. And then there was a process of establishing whether this was a real vulnerability or not.

And then we went through what's called a responsible disclosure process. Now depending on the severity of the vulnerability, the process looks different, but we followed a generally accepted industry-wide process for making sure that we could mitigate any negative effects as we could. And of course, I mean, theoretically, we could have gone live as soon as we found out and communicate this, but that would effectively have meant that we couldn't be part of any responsible disclosure in the future because people wouldn't trust us anymore. So yes, long answer to a short question, but yes, we did abide by a responsible disclosure process, which was set by the supplier that was experiencing this vulnerability in this case in Finland.

I'll move on to the next question. Given that this was your first quarter with subscription renewals, what was your retention rate as a percentage of contracts which were eligible for renewal? How much churn do you expect from subscription contracts? To be clear, this was not the first quarter where we saw subscription renewals. The first subscription actually happened back in 2023, in Q3 and Q4 2023. However, we are seeing contracts coming up for renewal. Overall, we see a very high renewal rate. But in some cases, the user population or the use case has changed. So we have seen a few cases where the user population went down because simply the number of employees had decreased quite significantly. We had one instance of that in Q4 2023.

On the other hand, in -- I think it was in Q1 2024; we had an existing customer that made an early renewal and expanded the user audience. So you saw a renewal, but an expansion at the same time. Overall, there are only very few customers that haven't renewed their contracts. And in most of those cases, it is because they have been part of some M&A activity and that they're moving to either a different authentication solution or that they want to convert to outright buying the keys because of policies within the merged entity. But those are relatively rare and few. I don't have an exact percentage, but we see a very high renewal rate of our subscription contracts.

The final one, I'll hand over to you, Camilla fully. Actually, there's one more, but the next one, I'll hand over to you. How is your bookings metric defined? You define it in your report as total value of bookings received during the period, but this doesn't actually spell out how bookings are calculated.

[Camilla Oberg, executive]

And this is the total contract value we have in the contract signed with the customer. And we are booking the total contract value the period where we actually have the signatures on, so then when we take the booking as such. If there are options or so, we are not recognizing them as bookings until we have a confirmed extension or usage of an option than that new booking. That means also, of course, that for subscriptions, we take the full booking value, the full contract value over the time or if it's 3 years or 4 years or 5 years. Therefore, could be quite high and thereby also taking quite some time before all that value is actually turned into revenue in the P&L.

[Mattias Danielsson, executive]

Final question of the written questions that we've got. European sales have now grown quicker than Americas for the last 2 quarters. Do you expect this trend to continue? Is Europe growing quicker because it is a less penetrated geography than the U.S.? Or is this a transitionary impact from the NIS 2 directive? Correct. We see European sales growing more quickly than sales in the Americas for the past 2 quarters. And if you take a look at an even longer time period, say, 5 years, that is also very much the case. I do expect this trend to continue. I think the biggest reason is because we're seeing very similar threat levels in Europe compared to the U.S. and Americas and our penetration is much lower in Europe. So as we build up our ability to sell and deliver in Europe, it's realistic over time to think that we would get similar say, penetration levels in those different markets because fundamentally, the threat level and the technology used is very similar. Of course, there are some directives and there are some initiatives when it comes to regulation that drive particular deployments and use cases. But overall, I would say it's part of a broader trend with an increased cybersecurity threat and the fact that our product addresses an important aspect of that. And we are less penetrated in Europe. So I expect this trend to continue.

I don't know if you want to add anything to that, Camilla.

[Camilla Oberg, executive]

No. I agree with you fully there, and I don't have anything to add.

[Mattias Danielsson, executive]

Just one final comment for me. A market where we have even lower penetration is Asia Pac. So that is one that should grow at an even higher growth rate going forward, at least that's our ambition. I think that wraps up the written questions, and we're 4 minutes past the hour. So unless there are any final questions, I think that's a wrap. Thanks, everybody, for listening in. Looking forward to connecting at least in 3 months' time when we'll deliver the full year report. Yes, that's a wrap for us. Thank you so much. Thanks for listening. And let us know if you have any questions, and you can reach out to us always, and we'll try to respond to it as quickly as we can. Thanks so much.

[Camilla Oberg, executive]

Thank you very much.