E 2017E 2018E E 2017E 2018E

Transcription

1 E 2017E 2018E COMPANY ANALYSIS 25 February 2016 Summary Verisec (Verisec.st) En Route for Growth? Verisec reported revenues of SEK 18.4 million and thus somewhat missed our revenue estimate of SEK 21 million in Q4. Reported EBIT was SEK -0.7 million versus our estimate of SEK 0 million, driven primarily by somewhat lower operational costs. List: Market Cap: Industry: CEO: Chairman: First North 308 MSEK Information Technology Johan Henrikson Dragoljub Nesic Continued progress is being made as BBVA is beginning to implemen its Freja ID solution in US and other countries for both retail and corporate customers. The progress will likely result in improved financial performance during 2016 which are largely discounted in our intrinsic value. The competition remains intense and the company must be able to swiftly adapt to its changing competitive environment in the future OMXS 30 Verisec Our DCF value of the company is maintained at 50 SEK per share in our base case, while our bear and bull case scenarios indicate SEK 30 and SEK 85, respectively. The BBVA progress is important, but does not change the investment case on its own Feb 24-May 22-Aug 20-Nov 18-Feb Redeye Rating (0 10 points) Management Ownership Profit outlook Profitability Financial strength 8.0 points 8.0 points 6.5 points 6.0 points 5.5 points Key Financials E 2017E 2018E Revenue, MSEK Growth -3% 20% 27% 14% 15% EBITDA EBITDA margin 5% -11% -1% 2% 0% EBIT EBIT margin 3% -14% -8% -4% -1% Pre-tax earnings Net earnings Net margin 2% -12% -6% -3% -1% Dividend/Share EPS adj P/E adj EV/S EV/EBITDA Share information Share price (SEK) 77.0 Number of shares (m) 4.0 Market Cap (MSEK) 308 Net debt (MSEK) -31 Free float (%) 23 % Daily turnover ( 000) 100 Analysts: Philip Skogby Philip.skogby@redeye.se Tomas Otterbeck Tomas.otterbeck@redeye.se Important information: All information regarding limitation of liability and potential conflicts of interest can be found at the end of the report. Redeye, Mäster Samuelsgatan 42, 10tr, Box 7141, Stockholm. Tel E-post: info@redeye.se

2 Redeye Rating: Background and definitions The aim of a Redeye Rating is to help investors identify high-quality companies with attractive valuation. Company Qualities The aim of Company Qualities is to provide a well-structured and clear profile of a company s qualities (or operating risk) its chances of surviving and its potential for achieving long-term stable profit growth. We categorize a company s qualities on a ten-point scale based on five valuation keys; 1 Management, 2 Ownership, 3 Profit Outlook, 4 Profitability and 5 Financial Strength. Each valuation key is assessed based a number of quantitative and qualitative key factors that are weighted differently according to how important they are deemed to be. Each key factor is allocated a number of points based on its rating. The assessment of each valuation key is based on the total number of points for these individual factors. The rating scale ranges from 0 to +10 points. The overall rating for each valuation key is indicated by the size of the bar shown in the chart. The relative size of the bars therefore reflects the rating distribution between the different valuation keys. Management Our Management rating represents an assessment of the ability of the board of directors and management to manage the company in the best interests of the shareholders. A good board and management can make a mediocre business concept profitable, while a poor board and management can even lead a strong company into crisis. The factors used to assess a company s management are: 1 Execution, 2 Capital allocation, 3 Communication, 4 Experience, 5 Leadership and 6 Integrity. Ownership Our Ownership rating represents an assessment of the ownership exercised for longer-term value creation. Owner commitment and expertise are key to a company s stability and the board s ability to take action. Companies with a dispersed ownership structure without a clear controlling shareholder have historically performed worse than the market index over time. The factors used to assess Ownership are: 1 Ownership structure, 2 Owner commitment, 3 Institutional ownership, 4 Abuse of power, 5 Reputation, and 6 Financial sustainability. Profit Outlook Our Profit Outlook rating represents an assessment of a company s potential to achieve long-term stable profit growth. Over the long-term, the share price roughly mirrors the company s earnings trend. A company that does not grow may be a good short-term investment, but is usually unwise in the long term. The factors used to assess Profit Outlook are: 1 Business model, 2 Sale potential, 3 Market growth, 4 Market position, and 5 Competitiveness. Profitability Our Profitability rating represents an assessment of how effective a company has historically utilised its capital to generate profit. Companies cannot survive if they are not profitable. The assessment of how profitable a company has been is based on a number of key ratios and criteria over a period of up to the past five years: 1 Return on total assets (ROA), 2 Return on equity (ROE), 3 Net profit margin, 4 Free cash flow, and 5 Operating profit margin or EBIT. Financial Strength Our Financial Strength rating represents an assessment of a company s ability to pay in the short and long term. The core of a company s financial strength is its balance sheet and cash flow. Even the greatest potential is of no benefit unless the balance sheet can cope with funding growth. The assessment of a company s financial strength is based on a number of key ratios and criteria: 1 Times-interest-coverage ratio, 2 Debt-to-equity ratio, 3 Quick ratio, 4 Current ratio, 5 Sales turnover, 6 Capital needs, 7 Cyclicality, and 8 Forthcoming binary events. 2

3 No Major Surprises Verisec reported revenues a bit lower than our expectations; SEK 18.4 million including activated revenues (estimated SEK 21 million). Continued strong development of Thales sales is likely to have been reported for the quarter, given the gross margin drop from the estimated 71 percent to the reported 69 percent. Support revenue was a decent contributor to revenues during the quarter. Reported EBIT was SEK -0.7 million for the quarter (estimated: 0 million), which was led by lower overall operating costs. We expect EBIT to improve in future quarters, when the sales organization gradually matures. Estimates SEKm Q3'15 Q4'15E Actual Diff. Revenues Gross Margin 58% 71% 69% EBIT Sales Growth Rate (QOQ) 11% 18% 3% EBIT margin % -12.4% 0.0% -3.8% Source: Redeye Research BBVA Progress during the Quarter An order was made from Banco Provincial (affiliate of BBVA) to manage two million private customers in Venzuela. Verisec recently also announced that it will soon be ready to deliver its Freja ID solution to BBVA s US customers. BBVA also ordered infrastructure from Verisec to support 5 million retail customers in Spain. Furthermore, BBVA Net cash Colombia also made orders for the Freja ID solution, initially designated for corporate clients. BBVA is showing strong intent to roll-out Verisec solutions across its branches. Essentially, these deals are largely discounted by our analysis and will help the company to gradually gain cash flow momentum. We expect the roll-out of its mobile solution to be progressively processed by BBVA during 2016 and beyond. Adoption of the Freja ID solution will be gradual, as this will largely depend upon customer interest. This development is also largely discounted in our analysis, including our estimates. Successful implementation will make BBVA a decent reference customer for future procurement processes. If viewed in the light of Verisec s maintained competitiveness, this should mean that the company could experience a domino effect to some extent. 3

4 Other interesting events As reported, Svolder recently took a smaller ownership position in the company we do not have any specific views on this, our standing on ownership remains unchanged - and fortunately it was not a sell that was significant in terms of magnitude to warrant a more worrisome approach on this ownership switch. Ramp-up in sales to support future revenue growth The current ramp-up in the sales force reflects the company s intention to widen its reach to prospective clients across many countries. We believe that the current significant staff ramp-up will suffice to maintain growth momentum over the next years but is also dependent on whether they feel that there are further opportunities that they must capitalize on for future higher growth and/or sustain its current momentum. Therefore, the company will be more profitable overall in 2016 as the ramp-up phase costs for the next growth spurt is already accounted for. However, if market opportunity arises, or product development is required, it will pursue such an objective rather than sustain its profit momentum. Once the sales force is working at full efficiency, we are likely to see increased personnel costs again, to ensure further growth, while retaining strong profitability as previously estimated. Cash flow, reporting & other items Despite the lack of results during the quarter, the cash flow was strong during the quarter due to more receivables being paid for. Cash and cash equivalents were approximately SEK 30 million, thereby allowing for an additional margin of safety in the event that the company reports for volatile quarters ahead. In reference to accounting, we request more detail into the composition of information security and the digital identity segment sales in order to properly evaluate the development. We are not concerned about aggressive accounting (amongst other factors, capitalizations are currently lower than depreciation), as this should be seen in the light of high intensity in the company s sales efforts, which can cause larger fluctuations in cash flow. 4

5 Investment case Seasoned and adaptable management permits future strong growth Verisec is a software security company providing digital identity solutions, including mobile ID, and information security solutions, such as encryption and decryption. Since it was founded, Verisec's skilled management team has been quick to adapt to the market environment, enabling the company to outgrow the security market as a whole. Verisec's management originates from the successful Protect Data business, and they retain significant ownership of Verisec, at approximately 80 percent. Verisec's compound annual growth rate has been substantial, at around 30 percent, and its EBIT margins have remained relatively stable at around 15 percent over the past 12 years. The company's target is to achieve revenues of SEK 200 million on an annual basis over the coming five-year period, with an EBIT margin of percent. The figure below shows Verisec's historical growth and profitability since Verisec Growth and Profitability Trend Source: Verisec Presentation, Redeye Our Case Rests on Double-Digit Revenue Growth Redeye's investment case rests on strong annual revenue growth of percent over the coming years, which is partly factored in by the market, along with subsequent margin expansion at the maturity phase. The maturity phase is the likely future scenario where the company s investments decreases, enjoying decent sales momentum on its existing solution portfolio through existing reputation and sales force. Ultimately, this leads to a higher and sustained margin. To meet these estimated growth expectations, the company aims to increase its market position in EMEA, and we expect this to develop further in the future. The company increased its sales in EMEA by approximately 100 percentage points in 2014, while total revenues were largely flat, indicating its ability to achieve future EMEA growth. Of the total 30,000 banking institutions and local councils across EMEA, we regard the smaller-tier banks as important primary targets for Verisec, and an essential component in meeting our 5

6 growth expectations. Furthermore, the company's broad reference customer base, along with BBVA (50 million customers), SEB and UK local councils, will provide a strong foundation for building trust, assuming that Verisec can retain the competitiveness of its solutions which will support growth. Relatively good revenue distribution between its customers Reviewing the revenue distribution among Verisec's customers, the ten largest account for approximately 50 percent of revenues. We expect Verisec's customer concentration to decrease in the longer term as its customer numbers increase. The variety of solutions purchased will also tend to minimize customer risk over time as they become a necessity in customers' daily activities. Verisec currently holds a strong position in personalization of physical log-in devices, which is a significant part of the group s revenues from the major Nordic banks. Banks in the Nordics and across Europe are expected to gradually transition to software solutions over time. However, Verisec will have trouble gaining market share in Sweden as there is a mobile authentication alliance among the banks. Verisec holds a significant position in the information security segment, as a preferred supplier to Thales within the EMEA region, in providing data encryption. This business is likely to continue to grow in absolute terms but will probably remain static as a proportion of total revenues in the longer term. Verisec's reseller network for Thales also plays an important role in gaining, widening and intensifying its sales of proprietary solutions for Freja ID. Finally, the growth in the information security as well as digital identity segments are also gaining ground due to a general uptick in avoidance of US security majors following leaks of confidential information to governmental organizations. Underlying Stability of Recurring Revenues Approximately 20 percent of the company's support revenues are recurring, with the average length of recurring revenue streams at approximately months, along with a proper time-spread of contracts. These revenues cover approximately half of personnel costs, and recurring revenues will remain an important component in covering fixed costs during non-growth periods, such as in 2013/2014, due to the alignment of its expansion stage. It is likely that the company will enjoy a higher degree of recurring revenues relative to personnel expenses in the future,, as the company reaches the maturity phase. As its segments, including Freja Mobile, require increasing support, we estimate that the company will grow its share of recurring revenues over the longer term. This will become evident in the maturity stage, when nonrecurring revenue will decline, thereby inducing a margin expansion. 6

7 Overall, the company has quite significant revenue visibility in the short term as its services are often fairly predictable on a yearly basis, as is maintenance support during the contract period. Achieving economies of scale along with hardware to software transition will help in expanding margins Expect Margin Expansion at Maturity Stage Verisec has the potential to expand its margins significantly once it achieves maturity, with its EBIT margin eventually reaching approximately 20 percent. At that point in time, investment costs related to personnel and expansion in EMEA will decline in relation to revenues, but this will be partly offset by an intensification of the competitive environment. Another important factor in Verisec's margin expansion will be the ratio of software relative to hardware, which is expected to gradually increase over time. Assuming the company can retain a high degree of direct sales, it will have further room for margin expansion as orders start to be realized from the existing sales force. Expect strong online banking growth for Verisec, a prime contributor to growth Aligned for Online Banking Growth Representing 80 percent of sales for the digital identity segment, online banking is a core focus for Verisec and is likely to remain so in the future. Online banking customer penetration is relatively low in Europe, at approximately 38 percent, and the growth rate of online banking users is expected to be 48 percent in the US and Europe over the next four years. This positions the company for attractive business growth for many years to come, assuming that it continues to provide the right solutions. Online banking penetration is one important factor for Verisec's continued growth, but more important is the rapid adaptation to user convenience required to capture the next frontier solution. With smartphones expected to be available to 2.5 billion people in 2017, a non-standalone device that covers the majority of people will be required in the future. Mobile IDs or software tokens are expected to experience CAGR of 50 percent by 2016, and TechNavio estimates that the software token market will represent approximately 20 percent of the total security token market by The hardware token market (proprietary physical log-in devices) is expected to grow by only around 8 percent. This is explained by the changing climate in the industry; hardware tokens are not cost-efficient per user, compared to software solutions, and upgrade/replacement costs for hardware tokens add another layer of cost relative to software. Additionally, many organizations are attracted to full security suites along with a dedicated security provider, which is where Verisec is positioned. The backbone of a mobile solution is a full-solution portfolio, from user registration and user management to support services, and covering the required spectra of security management services for banks. 7

8 Verisec expected to expand its local council retention in UK and EMEA Public Sector, an Interesting Opportunity for Additional Growth Furthermore, revenue growth will be enhanced by Verisec s establishment in the public and enterprise sectors. The company has already established strong market shares in some niches, with around percent of all UK local council users utilizing Verisec solutions. The confidence of UK local councils will likely help it to expand its market share to approximately 50 percent by 2018 along with significant opportunities in other EMEA local councils. Unlike banking, this sector is not as interested in the use of two-factor authentication and a complex and regularly changed password is often considered more cost-efficient by enterprises in solving security issues. However, given that 80 percent of data breaches are through hacking of traditional passwords, this security choice does not look promising relative to the cost consequence. It is important to note that the cost of hacking includes not only the consequences of the breach itself, but also the unnecessary hours spent by IT managers on solving issues outside their primary duties. Furthermore, there are many other sectors like gaming, hospitals and universities that will require strong authentication and associated solutions. Regulatory Framework Poised for Implementation of Strong Authentication The European Banking Council (EBA) guidelines for internet payments are likely to be implemented by August 2015, enforcing strong authentication solutions for financial institutions. Furthermore, the planned implementation of a new European data protection law by 2016 will impose significant fines on corporations if they do not comply with the regulations. Leaders are changing the Competitive Landscape There are a number of significant risks in the long term that relate to product obsolescence, caused by innovative solutions from existing and emerging competitors. Major security companies like Vasco, Gemalto and RSA still use digital identity solutions based on proprietary standards, and we expect that these will eventually have to start adapting to more costefficient and open standards. Essentially, this could lead to an intensified pricing war, with Verisec needing to quickly adapt to avoid becoming a price taker. In addition, the majors may well resent having to transition to open standards due to their belief in the superiority of their product, which could be a significant threat given the large amount of capital and resources available and allocated by majors, to develop their next-generation security solutions. Innovators are gaining ground but still struggling to compete with traditional security software players Furthermore, solutions such as Google Authenticator can cut software token costs in using solutions like mobile IDs, which are without a doubt attractive to millions of users. Plenty of local councils have chosen to cut their software token costs by implementing Google Authenticator, but many banks and local councils have nonetheless sought out a dedicated company 8

9 and maintenance support with a full-service suite. These organizations will likely not be satisfied with Google Authenticator alone. The solution currently lacks server-side PINs, which enables easy hacking and will not be tolerated under the EBA guidelines. However, we do not see the current differences in technology as significant barriers to entry by competitors. Overall, even though the company is expecting more intense competition, the market is growing and a small player like Verisec can quickly grasp growth through its experienced sales team. The company is subject to biometric security identification risks from other solutions, such as Apple's Touch ID, which was recently implemented by two major UK banks (RBS and NatWest). Biometric solutions could however also act as a complement to Verisec s current solutions. Other innovative solutions that could challenge the long-term standing of Verisec's solutions are cryptograms, like Vasco's purchase of Cronto, iris scanners and facial recognition. Alliances like FIDO could standardize software solutions, making them a commodity One other major and likely risk is an increase in alliances or bank consortiums, making all or parts of Verisec's solutions portfolio a standard across a sector. This could be a consequence of meeting regulatory security requirements, or of organizations moves to control their own security solutions. Business alliances, whether or not as a consequence of regulation, could result in serious competition for a market participant, such as the FIDO (Fast Identity Online) Alliance, which has seen momentum in implementing biometric and software-token authentication from Alibaba to Windows 10. Another alternative to buying Verisec's solutions would be to create a consortium of participants to share development costs, such as the Swedish consortium for mobile bank ID solutions which supplies the major banks. Organizations reproducing this strategy and type of technology within EMEA should not be disregarded. Conclusion of the company s prospects Verisec enjoys momentum due to a highly selective approach to strategy, building on a niche focus, and a seasoned management team that has been able to outgrow the security market in general. The company is subject to several significant risks such as gradually increased competition from majors, innovators and alliances with relatively small barriers to entry for strong authentication solutions. 9

10 Valuation We provide a short summary of our various scenario analysis results from the DCF valuation, peer and earnings analysis conclusions, and presentation of key catalysts along with some insight regarding the possibility of Verisec being an acquisition target. Our valuation scenarios range from 30 to 85 SEK per share. Bull case scenario: 85 SEK per share Base case scenario: 50 SEK per share Bear case scenario: 30 SEK per share Peer and Earnings Analysis We estimate that on an EV/EBIT and an EV/S basis, the company, with its characteristics and competitive position in the future, has an intrinsic value of MSEK (approximately 35 to 60 SEK per share). Key catalysts The primary catalysts are as presented below: Hardware to Software Token Transition Margin Expansion in the Maturity Phase Rapidly deteriorating Competitive Standing Verisec, a Possible Acquisition Target in the Longer Term? As growth is realized in EMEA and if Verisec's competitive standing is retained, it is not implausible to suggest that Verisec will become an attractive acquisition target. The above are the essential components required to be considered as an acquisition target, and if either of the factors fail, it is unlikely that the company will be acquired. Additionally, as the company progresses, its competitive endurance will be revealed which opens the possibility of an acquisition for a particular product or skill set. This can be observed in the acquisition of Nordic Edge by Intel for example. 10

11 Background Verisec has a track record of growth in security and hardware services since when it was founded in It has gradually transitioned itself into a software player in the digital identity and information security sectors. Verisec conducted an IPO in December 2014 on the First North exchange in order to access the capital markets and to meet funding for its expansion in EMEA (raised approximately 35 MSEK). They are planning to expand in Germany, Spain, Dubai and UK. The company has a sales goal of 200 MSEK within five years, accompanied with EBIT-margins between percent. Growth enabled by an open but stringent strategy focused on niches and adapting to user convenience needs Management Aligned for Value Creation Verisec's management team originates from the successful Protect Data a well-run, high-growth security company that was eventually acquired. An important pillar in the success of Protect Data was its efficient sales activities, and partly spearheading this growth adventure were Johan Henrikson, Anders Henrikson and Tony Buss. All of these Protect Data people were founders of Verisec, along with Jakub Missuna, which means that the transition of these individuals to Verisec, as an emerging highgrowth security company, appears to be a likely natural step for them. The management has grown Verisec in a non-volatile manner resulting in a CAGR on revenues of approximately 30 percent during the period Underlying this development is the company's adaptation to new ways of capitalizing on market trends in digital identification and information, with one recent example being the Freja Mobile application, launched in conjunction with the IPO. While there is no guarantee that this strategy will work in the longer term, it is certainly what is currently needed for success in this highly competitive and dynamic industry. In order to align and sustain its focus on research and development, more than half of Verisec's workforce is occupied with R&D. Constant Adaptation is the Key to Success Verisec has been a highly dynamic company ever since it was formed, beginning with services for physical devices and then gradually transitioning itself towards strong and innovative ID solutions for the online banking industry. In addition to banking, it is now positioned to conquer market share with its sales efforts for the non-banking vertical, including the public sector, by covering the entire spectrum of digital identity services. Ultimately, this will likely enhance Verisec's potential to outgrow the market. The company is showing several significant signs of international presence and product success, including continued strong local council retention in the UK and a presence within multinational banks like BBVA, plus the signing of several new partnerships in EMEA during Last year, the EMEA representation rose to approximately 30 percent of sales (2013: 20 percent). 11

12 Concentrated Ownership Verisec is currently aligned to maximize shareholder value, with approximately 77 percent of the company owned by the founders and former executives from Protect Data. Our research indicates that there are currently no material anti-shareholder-friendly policies among the key owners, on the contrary, we noted below-average salaries for executives, cost controls and an associated high degree of shareholding. The level of support offered by its key shareholders will become clearer in December 2015, when the founders are able to sell their holdings under the terms of the lock-up. 12

13 Market Analysis This market analysis evaluate three major topics that we expect to drive demand for Verisec's products: Primary market drivers Competitive landscape and verticals Regulatory effect on demand for security solutions Traditional passwords account for the majority of cyber attacks Primary Market Drivers According to Verizon, 80 percent of cyber-attacks are possible due to simple passwords. Along with this comes a convenience issue, namely the increasing number of passwords used. A study by the Ponemon Institute of approximately 2,000 participants indicated a general mistrust towards passwords, as shown in the table below. In essence, almost half of consumers do not trust systems or websites that rely on passwords, making this a significant issue for companies to solve in going forward if they are to avoid losing consumers. Traditional Password Evaluation Source: Ponemon Institute This means that it is natural for corporations to consider strong authentication using hardware tokens along with software tokens. Since 2013, the Breach Level Index has reported 3 billion security breaches and it is likely that the majority of records were not encrypted. According to Ponemon, 43 percent of the sample companies experienced a data breach in 2014, which is a 30 percent increase from the previous year. The increasing number of breaches and the greater use of online banking ought to lead to an increased need for software ID solutions. 13

14 Breaches by Industry and Size Source: Verizon Data Breach Investigation Report Finance, information and public sectors are targets for hackers The table above suggests that attacks occur more frequently in the finance, information and public sectors. That being said, all sectors are exposed to vulnerabilities, and if large enough, could represent a client opportunity for Verisec. The "Unknown" sector above is relatively large, and we believe that a significant number of minor finance institutions could be included in this number. Overall, considering the large increase in the frequency of cyberattacks, it is evident that companies will choose to seek out support services and solutions from specialized security firms like Verisec. Breaches by type Source: Verizon Data Breach Investigation Report 14

15 The percentage of internal attacks has diminished; external attacks still dominate overall cyber-attack numbers. Two-factor authentication market, large potential for a small dedicated security software provider Strong underlying growth for Verisec, focus within security software solutions Size and Dynamics of the Strong Authentication Market According to Gartner, the market for two-factor authentication is worth USD 2 billion, and represents around 3 percent of the total security market. Given the intensity of the competition, even a 0.1 percent stake (approx. SEK 150 million) of this market is strong performance. In general, product demand is at its greatest where high security is most critical, such as in banking and finance, e-government, defense and enterprise security. It is clear that there is general need for security as the methods for distributing and gathering data multiply. Furthermore, around 88 percent of IT technology decision-makers regard existing threats and vulnerabilities as being of high or critical priority. Software tokens such as Freja Mobile are expected to experience strong growth, with a predicted CAGR of 50 percent in the period , and a 20 percent market share, according to TechNavio. On the other hand, the hardware token market (proprietary physical log-in devices) is expected to grow by only around 8 percent, claims TechNavio. This trend is being led by strong smartphone user growth, which expected to reach approximately 2.5 billion users by Two Major Emerging Trends Software tokens that use smartphones are one major component in achieving both cost efficiency for banks, as well as maximum utility for customers. This segment is expected to grow with a CAGR of 50 percent until 2016, according to TechNavio. Biometrics represents another security layer that is growing rapidly, and their implementation is visible among the numerous market leaders. We expect that Authentication as a Service (AaaS), and its associated cloud services, will grow significantly in both the banking and the non-banking verticals, and Verisec is fully aligned for this development by its Freja Service solution. In terms of market potential, Gartner expects cloud-based authentication implementations to grow from 10 percent in 2014 to 50 percent in This should be considered alongside strong general growth in cloud services during the same period. With Freja Connect and a strong authentication solution, the company is positioned to participate in this growth. Although it is far from certain that Freja Connect will be the preferred choice for customers or the most cost-efficient solution in the future, there is clear underlying demand for these solutions. Redeye does not exclude the possibility that solutions like SaaSPASS and Google, among many current and future competitors, will dominate this sector with cheap and effective solutions in the future. For organizations seeking dedicated security providers, this will likely entail a full-suite solution including cloud services. 15

16 Competitive Landscape and Verticals We start by depicting Verisec s competitive landscape by segment, and then describe the current leaders and prospective leaders. Competitive Landscape by Segment Source: Redeye Research, Verizon Data Breach Investigation Report Major threat and opportunity from disruptive technologies The figure above indicates that the leaders specializing in security are mainly from the US. These companies typically have a high level of exposure to the banking sector and aim to diversify their portfolios. For example, Vasco's management recently intensified its focus on cloud solutions and the non-banking verticals. Pursuing hot trends however, may not be the best option for Verisec in the long term since competition will be significant. These companies regularly make acquisitions to keep up with the latest technology, which could pose a risk for a smaller player like Verisec, which may not have the expertise or the financial strength to acquire disruptive technology. The landscape is poised to change significantly in the coming years since innovators such as Google may become leaders in this sector with their solutions. We can expect cloud solutions to be heavily disrupted by Google Authenticator, especially in the public/enterprise sector, where this is a serious consideration for any head of IT. Google can be seen as mimicking what the other leaders are doing, but for free, and its solution has already gained widespread utilization across industries. Nevertheless, Verisec's edge lies in its dedicated support, adaptability and full-service solution, along with strong market momentum, which it will probably be able to continue to rely on. The information security segment is dominated by a small number of players, with Thales accounting for almost 80 percent of worldwide payment transactions. Verisec acts as a reseller for Thales. Safenet (acquired by Gemalto) is the company's strongest competitor in this segment. Potential in the Banking Vertical We regard the banking sector as Verisec's most important vertical in going forward, since we believe it generates the majority of revenues. The cost of breaches can be significant to banks due to their responsibility and accountability for fraudulent transactions. 16

17 There is a clear growth trend in online banking usage, with Gemalto forecasting 48 percent growth in the US and Europe over the next four years. Online banking represents approximately 30 percent of the market worldwide according to comscore. Asia is poised for higher growth; it represents a low market share, but is expected to grow over time in correlation with internet user numbers. Significant revenue potential in binding larger banking customers BBVA has around 50 million customers, and with an expected growth rate of around 50 percent per year in online banking users, it is clear that the intention of BBVA is to eventually implement mobile IDs or a similar costefficient solution. Assuming 10 percent penetration among total users of BBVA, this contract alone could generate significant revenues of SEK 1-5 per registration, amounting to SEK 5-25 million. For Mexico, with 11 million customers and assuming the same penetration rate, the estimated revenues are SEK 1-5 million. Even more impressive is the fact that Verisec has barely touched the approximately 30,000 institutions in the banking sector. We expect that its leverage and traction among smaller institutions will be significant, and most competitors do not extend their services into this segment. Although, the company expressed that they aim to approach the giant banks. This means there is still a large potential for ground to be gained in the online banking industry, but this will be much harder to achieve in reality. The potential for Verisec may lie in binding one or two mega-banks, but this is less likely as it faces severe competition from solutions offered by larger security providers such as Vasco, RSA and Gemalto. AaaS and biometrics could trigger further competition for Verisec within this segment. Opportunities in the Non-Banking Vertical The non-banking vertical includes enterprise security and other segments that may grow in the future. As previously mentioned, the company has established a strong hold in the UK market and currently has around percent of the total user base among local councils which are now using Verisec technology. Around 10 percent of councils have implemented a Verisec solution, which means the company currently still has around 300 local councils left to target, but only a few of these represent most of the user base. Furthermore, bringing in additional governmental councils around Europe does not seem implausible, especially with Verisec's recently announced German expansion, which has a larger user base across fewer councils (12). Many other sectors, like gambling, are starting to emerge as possible future customers Additionally, we believe that similar opportunities could exist within or outside governmental organizations in other markets. The problem within enterprises is often cost, which may hinder organizations from adapting to these solutions. Gambling verification is also an opportunity, but as log-in processes could consume considerable time this could deter customers who desire the minimum delay in order to start gaming. Another aspect of this is that the registration process can often be painfully long and rigorous for consumers, and strong authentication solutions could help to solve these 17

18 problems. This could be a profitable business given that many individual Nordic sites exceed 500,000 registrations. Hospitals and universities are other sectors that could become interesting for Verisec. The study referenced above found cyber-attacks in many sectors, and a study by HP in 2012 showed that cybercrime cost 56 organizations a total of USD 8.9 million per year. Regulatory momentum expected for security software companies Regulatory Effect on Demand for Security Solutions Before evaluating this important area further, it should be noted that the requirements in banking often do not come from regulation itself, but rather from a desire to limit the fundamental risk of hacking and fraud. One of the key regulatory drivers in Europe at the moment is the new data protection law, which is projected to be implemented by Fines up to EUR 100 million and a mandatory data protection officer for businesses with more than 250 employees are some of the aspects that will affect demand for Verisec's products, given that it targets larger companies. Security is generally more business-critical to banks since the impact of fraud can be significantly more devastating than in the public sector. Implementation by local councils is likely to be a consequence of regulation as well as a general need for improved security. Another key regulatory driver is the European Banking Authority (EBA) guidelines for internet payments, which are likely to be implemented by August These will enforce strong authentication solutions for competent councils and financial institutions. Verisec is compliant with these guidelines, including the mutual independence of multi-factors. This means that if one factor is compromised the other factor should remain uncompromised. We believe that Verisec's competitors are currently able to match these guidelines as well, or will be able to do so in future. However, although regulation will be enacted to secure customer protection and to push for increased general security, it will be some time before organizations see an obvious need to use two-factor authentication, for the fundamental reasons mentioned previously. Several countries like Germany, Switzerland and Singapore have conveyed a clear message about implementation of strong authentication for online banking security. FIDO has shown impressive movement in a short time, possibly commoditizing strong authentication solutions in the future Efforts by organizations like the FIDO (Fast Identity Online) Alliance could standardize and commoditize the strong authentication process, and thus evaporate Verisec's competitive standing. FIDO has established itself as an emerging global standard, and many influential companies like Microsoft, Google and Bank of America have joined the alliance. Although this is a driver for implementation of strong authentication in general, it is not unambiguously positive since Verisec does not currently deliver any infrastructure through FIDO. FIDO is currently working on its 2.0 edition, involving cross-platform log-in to multiple sign-ins, making it a true standard across large, medium and small companies. 18

19 PayPal and Alibaba have already implemented FIDO payments with solutions from Nok-Nok Labs. The risk in the near term is relatively low for Verisec because of its earlystage development, but in the longer term we could see something like Google Authenticator or another solution becoming the natural choice for internet security, with the analogy being Google for search, which would suffice to challenge Verisec's solution. It is worth mentioning that the Snowden affair, and the involvement of current market leaders like EMC, has shaken the reputation of US security software competitors acting in the EMEA region. As a Swedish security operator, this will likely further Verisec s favorable position and promote momentum in the European market, although (likely) only temporary. 19

20 Estimates Based on the company's success, especially in the banking vertical, and the strong need for full-service security providers, we expect Verisec to have significant traction in its growth for the foreseeable future. Redeye believes the company will meet or come close to its sales target growth of SEK 200 million by Its current cash balances of around SEK 30 million will secure the company's investment needs to enhance the momentum of its growth during the transition phase. It will also give the company room for some upgrades in existing technologies and possible endeavors in other technologies such as biometrics. EMEA expansion and banking will lead to high sales growth In the near term, we expect revenue to continue to grow by retaining more local councils and the reaping of sales from Verisec's international expansion in Spain, Germany and the Middle East. Furthermore, we expect BBVA to continue to contribute but have not accounted for mobile ID authentications in any specific quarter, as it is certainly possible and probable at some stage, we cannot foresee during which quarter this event will take place. Instead, we have taken into account the seasonal effect and the expected growth pattern. An overlap of revenues can also have an impact on specific quarters. For example, in Q the company booked a majority of the revenue that had been planned for Q1 2014, making the overall revenues somewhat weaker for full-year There have been no major changes to the growth trajectory during the quarter. Estimates /2017 SEKm Q3'15 Q4'15 Q1'16E Q2'16E Q3'16E Q4'16E 2016E 2017E Revenues* Sales Growth Rate 32% 11% 33% 21% 18% 16% 27% 12% COGS Gross margin 58% 69% 67% 64% 64% 60% 61% 62% Personnel + external costs Depreciation EBIT EBIT Margin -12% -4% -7% -11% -4% -8% -8% -4% Source: Redeye Research *After R&D Recognized Revenues In the most recent year, the company did not obtain sufficient orders in relation to its cost of sales to gain momentum in margins, as personnel and external costs increased. This is expected to gradually revert into margin expansion when the sales force comes up to speed. We expect Verisec's margins to expand as the company reaches scale of revenues and maturity in its markets for software sales. This process is likely to take time, and we therefore do not expect any significant margin expansion in the near term. The company's focus is on growth and on establishing its presence in EMEA and on further developing the competitive standing of its solutions percent revenue growth expected in the coming years In general, we expect the company to exhibit revenue growth of percent in the coming four years, with an initially negative EBIT margin reflecting expanding investments in personnel and partnership costs. The 20

21 margin should then gradually increase as Verisec's sales efforts slow down relative to revenues. We estimate that digital identity will dominate the company's total sales in the future. Thales E Security will also expand its sales, but will remain largely static in proportion to total revenues in the future. Recurring revenues are set to expand, but a large intake of mobile user registrations and initializations of projects will inhibit greater expansion of nonrecurring revenues in the relatively near term. We expect the gross margin to rise for two reasons, namely economies of scale in strong authentication solutions and the gradual transition from hardware to software. In addition, operating profit will be positively affected in the longer term by a lowering in the relative share of partnership sales to direct sales. In the short term however, expansion will mean increased partnership sales relative to direct sales. 21

22 Valuation In this section we perform DCF and peer analysis to determine the value of the company. Concentrated sales efforts within niches and EMEA to drive sales growth DCF In our DCF scenario, we assume that the company is able to enjoy momentum in its key markets, it will however have to cope with more intense competition and constantly adapt to a changing security software landscape. The company has an efficient sales organization and is established in niches across the banking and non-banking verticals, which will produce EBIT margins of around 10 percent and sales growth of around 20 percent in the foreseeable future. Verisec's digital identity segment accounts for the majority of the company's success, but if competition intensifies and makes the product portfolio obsolete, it is possible that Verisec will have to adapt and accept lower margins by acting as a service provider for other proprietary solutions. In general, sales momentum is being fueled by regulation, increased security concerns and a transition from hardware to software tokens. All of these are powerful forces that will set the company to grow at an even higher rate than the market. However, given the major developments in this arena, there are significant concerns about the company's ability to retain a competitive advantage as the industry quickly adapts and organizations seek to standardize their solutions. Its current cash balances of around SEK 30 million (estimated to improve by YE) will secure Verisec's investment needs to enhance the momentum of its growth during the transition phase. This will also give the company room for some upgrades in existing technologies and possible endeavors in other technologies such as biometrics. This will be essential in order for Verisec to remain on par with competing solutions. We anticipate that only a small requirement for working capital will be necessary during the strong sales momentum since additional products do not require more inventory. As long as there is no significant deterioration in the company's buying power and pro-active selling practices, there should be no concern about working capital. We estimate that the CAPEX requirement will rise to SEK 3-5 million a year, but the actual accounting of CAPEX is recorded by the income statement as well as the operating cash flow. The company currently capitalizes around 30 percent of its development costs, which seems fair. In terms of allocating its development costs, the allocation is apparently efficient, as indicated by its main R&D department in Serbia. DCF indicates 50 SEK per share with a discount rate of 10.7 percent The EBIT Margin is expected to be 6 percent with an average sales growth of 20 percent during the period Based on our rating and on our discount rate of 10.7 percent, we estimate the company's DCF value in our base case to be SEK