NCC Group H1 2026 Earnings Report

NCC Group EPS Results

• Actual EPS: GBX 4.50
• Consensus EPS: N/A
• Beat/Miss: N/A
• One Year Ago EPS: N/A

NCC Group Revenue Results

• Actual Revenue: $118.40 million
• Expected Revenue: N/A
• Beat/Miss: N/A
• YoY Revenue Growth: N/A

NCC Group Announcement Details

• Quarter: H1 2026
• Date: 6/11/2026
• Time: Before Market Opens
• Conference Call Date: Thursday, June 11, 2026
• Conference Call Time: 4:00AM ET

NCC Group (LON:NCC) is a people-powered, tech-enabled global cyber security and software escrow business. Driven by a collective purpose to create a more secure digital future, c. 2,000 colleagues across Europe, North America, and Asia Pacific harness their collective insight, intelligence, and innovation to deliver cyber resilience solutions for both public and private sector clients globally. With decades of experience and a rich heritage, NCC Group is committed to developing sustainable solutions that continue to meet client’s current and future cyber security challenges.

NCC Group H1 2026 Earnings Call Transcript

Key Takeaways

• Positive Sentiment: NCC said it has completed the sale of Escode, leaving the company as a more focused pure-play cybersecurity business. Management also announced plans for a GBP 170 million tender offer and a GBP 15 million share buyback to return capital to shareholders.
• Positive Sentiment: The cyber business delivered three consecutive quarters of growth, including double-digit organic growth in the U.K. in H1 2026. Revenue quality improved with record gross margin of 38.4% and stronger profitability.
• Positive Sentiment: Recurring revenue metrics improved meaningfully, with managed services revenue rising and representing 33.8% of revenue. Gross revenue retention increased to 85% and net retention to 94%, while churn fell to 15%.
• Neutral Sentiment: Management highlighted AI as both a productivity tool and a source of new demand, saying it can improve scanning, analysis, and reporting while creating new cybersecurity risks that require human-led assurance. The company also said it is actively using AI in client work, policy discussions, and internal operations.
• Neutral Sentiment: North America remains a challenge due to changing buying patterns among large technology clients, though the company is shifting toward higher-value verticals such as financial services and expanding its global delivery model. Management said it expects adjusted EBITDA to grow ahead of revenue this year, with margins guided to 5.5%-7.5%.

Presentation

[Mike Maddison, CEO at NCC Group]

Good morning, thank you for joining us online today. Let me start by outlining the structure of the presentation, which myself and Guy Ellis, the CFO, will take you through. As usual, I will start by providing some of the highlights for what has been a good first half of the year. I'll then spend some time going through a look back over our H1 performance and some of the highlights before handing over to Guy, who will talk you through the financial detail of H1 performance. Finally, I'll spend a little bit more time talking about our areas of focus for the remainder of the financial year and the forward outlook for the business. We've done an incredible amount of hard work, the team have shown outstanding commitment.

[Mike Maddison, CEO at NCC Group]

It's that commitment which has put us in the position we're now in with a simpler, more focused business, and are winning amazing projects globally. We've made significant progress in delivering our vision despite headwinds. We have simplified the business and executed divestments of several assets, I'm very pleased to confirm, as you'll have seen, that we completed the sale of Escode on the 29th of May. As a result, we are now a much more clearly focused and pure-play cybersecurity business. The strategic review of the cyber business is now complete. The board intends to commence a GBP 170 million tender offer, followed by a new GBP 15 million share buyback, subject to due process to create significant distributable reserves through a capital reduction. Improving momentum in the cyber business has seen three quarters of consecutive growth, including double-digit organic growth in the U.K. in H1 2026.

[Mike Maddison, CEO at NCC Group]

We've seen record H1 gross margin of 38.4%. Three of our four markets have grown, in fact, all capabilities grew in the first half. As we planned, the mix is changing, with combined consulting and managed services revenue now 55% of our cyber revenue overall. Managed services has continued to grow, increasing by 4.7% to GBP 40 million on a constant currency basis versus H1 2025, by 2.8% compared with H2 2025. I would like to start by just setting some context. Many will be familiar with the journey we have been on, but for those new to our business, I think it's helpful to frame some of the changes we have been making. The group has been through a significant period of change over the past few years operationally, in its market focus, whilst also navigating a period of turbulence.

[Mike Maddison, CEO at NCC Group]

Let me recap of some of the journey NCC has been on and the significant, often difficult changes that we've made. In 2023, we made a strategic pivot. We sharpened our focus on clients and their strategic problems, not transactional projects. This required building broader capabilities to deliver a more consultative approach to client interactions and importantly, greater internal connectivity to ensure we could bring the truly outstanding talent we have globally to support clients, irrespective of where they were headquartered or operated. We set some goals. To change our revenue mix with a focus of managed services. We invested in new capabilities that had market relevance, such as identity management, operational technology, both of which resonated with critical infrastructure. We aimed to build a consulting revenue stream that was a discipline and mindset that brought together our world-class technical expertise.

[Mike Maddison, CEO at NCC Group]

We implemented a globally connected operating model, giving us the ability to manage delivery across all of our markets. We executed a strategy of operational simplification, divesting businesses, improving our balance sheet with a focus on shareholder value. That has resulted in the NCC of today being a focused, pure-play cybersecurity business. The reset phase is complete, and the emphasis now is on execution, delivery, and value creation. The team have demonstrated their ability to undertake an exceptional amount of change. Why was it important to realign the group? We believe there are some fundamentals that make the cybersecurity services market attractive, and that the group is well-positioned, and indeed, actually uniquely well-positioned to capitalize on. First, the continued digitization of business, governments, and supply chains is expanding the attack surface.

[Mike Maddison, CEO at NCC Group]

AI is accelerating that trend further, which we've discussed this at length on various platforms over the past few months. Second, the threat environment is becoming more complex and more persistent. The number and sophistication of cyber attacks continues to increase, driven by factors including geopolitics, the growing ability to monetize cybercrime, and the scale of enabled global connectivity. As a result, operational resilience is now a board priority across both the public and private sectors. Finally, organizations are operating in a more complex regulatory environment and continue to face a shortage of skilled cyber professionals, increasing reliance on trusted external partners. Taking all of that together, these factors point to a market where demand for cybersecurity is structural, not cyclical, and it continues to grow. Now, AI is obviously a disruptor, also, we believe, an opportunity. Now, we're not complacent, technology is always evolving.

[Mike Maddison, CEO at NCC Group]

Our view is that AI is ultimately more of an opportunity than a threat. It works with our existing service model, not against it, indeed raises some very interesting and exciting opportunities. AI will disrupt commoditized single dimension or point solutions. Now, this comes as no surprise. It's like every other automation initiative in technological history. To say anything else wouldn't be credible. However, there are two other important aspects. Firstly, AI allows us to automate elements such as scanning, analysis, and reporting, which improves productivity and speed. The need for assurance doesn't go away. Humans have to be in the loop, and human-led assurance still matters, particularly where judgment, regulatory interpretation, and complex environments are involved. When we combine AI-driven productivity with our global delivery model, we create a structural cost-to-deliver advantage.

[Mike Maddison, CEO at NCC Group]

AI strengthens our economics, supports outcome-based models like testing-as-a-service, reinforces rather than disrupts our core proposition. Secondly, it's clear already that AI is deployed in environments at pace, often without control. It's also environments where the architecture was often not designed for it. As a result, AI creates new vulnerabilities and the opportunity for us to provide new services, which we have already launched. Currently, automation alone does not replace judgment. Regulators increasingly mandate independent human oversight. Now, that dynamic plays to our strengths as a trusted, people-powered cyber partner. Someone has to write the prompts. Now, let me just take you through some of the ways NCC is currently engaging with AI today. We are combining large language models and capabilities with deep technical expertise to simulate exploits and prompt-based attacks.

[Mike Maddison, CEO at NCC Group]

We are stress-testing resilience across a range of scenarios in global organizations, including supporting the testing of some of these frontier models. We are shaping policy, for example, giving testimony in the House of Lords and contributing to the U.K.'s national cyber strategy, and guiding that debate. Underlined by our expertise, we have completed paid reports to independently review both Google's private AI compute system, which lets mobile devices use powerful cloud-based AI while still protecting user privacy, and Meta's WhatsApp message summarization service, which adds AI-generated summaries without exposing message content to Meta. The power of the collective is our differentiator. Key things, secure coding and assurance, broader advisory, non-human identity, shadow AI, all play a massive part. We are the go-to experts for the media. We have published 50 AI cyber research papers since 2019 alone.

[Mike Maddison, CEO at NCC Group]

In the last year, we have featured over 130 times on the media, including the BBC and Forbes, on the topic of AI, which all supports our positioning as a trusted voice, and therefore sales opportunities in the market. As a provider of technical thought leadership on this topic, providing expert perspectives, helping businesses navigate their response in a highly complex and evolving environment, more broadly, we see AI being able to contribute to improving gross margin through efficiency. To reiterate, this is about reinforcing our brand as a leader, as a trusted voice, supporting our sales engine. We are not a broad IT services or a software company with cyber as one of our many offerings. Cyber is the core of what we do, that is what underpins our relevance in a structurally growing market that focuses and translates directly into differentiation.

[Mike Maddison, CEO at NCC Group]

We combine deep technical expertise with proprietary insight and a delivery model that is both people-led and technology-enabled. In turn, this allows us to support clients across the full cyber lifecycle, not just through individual engagements, but as long-term partners. This is where our model matters. We have built those capabilities, I would like to just show you how we plan to take those to market. We shared our 1-4-20 strategy at the Capital Markets event in March, which is available to watch on demand via our website. Essentially, it sets out how we create client value over time, starting with immediate problem-solving to establish trust, expanding our footprint across the portfolio, and ultimately embedding our services as a core part of our client's operations. We have an extensive vertical spread across markets with no dependency on one vertical, which may be affected by external factors.

[Mike Maddison, CEO at NCC Group]

We have in our key accounts a long tenure as a trusted partner. In H1, we have seen that increase by a further 4%. Importantly, if we look at our top 100 clients, they take on average 2.84 of our capabilities. We are therefore not reliant on them purchasing a single solution. This also means that there is a significant commercial opportunity just by uplifting the number of capabilities used with our top 100 clients, giving us a potential 34% uplift. Managed service has been a key element of our strategy from the outset to ensure a greater percentage of recurring revenue, we see that continuing to grow, as well as increasing as a proportion of overall revenue. In H1 2026, it is now 33.8%.

[Mike Maddison, CEO at NCC Group]

Gross revenue retention has increased from 78% to 85%. Meaning we are keeping significantly more of our existing revenue base with reduced leakage from churn or downsell. Importantly, this is driven by stronger customer stickiness and renewal performance even before any contribution from upsell or growth. Clearly linked, churn has reduced from 22% to 15%, reflecting better customer stability and fewer downgrades. Net retention rate has increased from 89% to 94%, reinforcing our ability to expand within the existing customer base. The point here is to illustrate momentum. Comparing our revenue decline in the prior year versus the revenue growth momentum in the first half of this current financial year. It's clear from this, by bringing together the world's leading capability and a refreshed and focused go-to-market strategy, it is beginning to have results.

[Mike Maddison, CEO at NCC Group]

In the half, we have seen all services grow, including technical assurance services, which just highlights the continuing relevance of this skill set, notwithstanding some challenges remaining in North America, which I will talk to next. As a consequence, revenue momentum has broadly improved across the board. The group has now had three quarters of consecutive growth in the cyber business, particularly impressive has been the double-digit organic growth in the U.K. in H1. One final point I'd like to highlight is that the proportion of revenue in North America is now comparable with Europe. With that, let's take a look at the specifics of North American revenue. When looking at North America, the issues are very clear and well understood. There has been a well-reported structural change in our large technology clients' buying patterns.

[Mike Maddison, CEO at NCC Group]

Our North American client base uses skills predominantly from our technical assurance capability, and what clients require and how they use suppliers has changed for reasons ranging from increased insourcing, greater automation, consolidation of suppliers, projects ending, or simply a reduction in spend due to other investments being made. However, as you can see, while there is a clear reduction in volume in the requirement for technical assurance skill sets from those large technology clients, the remaining business has seen only a modest decline. We have begun a journey to refocus our go-to-market efforts in North America in a couple of dimensions. Firstly, specific attention on bringing the credentials and expertise we have in the U.K. in areas such as operational technology and critical infrastructure to support client conversations. Secondly, we have invested in specific vertical leadership.

[Mike Maddison, CEO at NCC Group]

We have in H1 appointed a leader for financial services, which has shown some early successes. This is linked to success we're already seeing in delivering complex projects supporting AI readiness in response to the announcements around Mythos, as an example. We plan further investment in similar vertical leadership in North America in H2. What gives me confidence to be an organization that is the trusted advisor to governments and organizations is the depth and breadth of the skills and quality of our people, also the range of partnerships we've developed to build the ecosystem to deliver projects for our clients. Just to give you some of examples, we have in H1 received numerous awards and recognition, including from independent analysts such as Forrester. Our people are go-to sources of expertise in areas of policy setting.

[Mike Maddison, CEO at NCC Group]

Our award-winning government affairs team is actively involved in setting policy and direction at a national level, such as the reform of the Computer Misuse Act. Our engagement with the UK Minister for Digital Economy underscores our increasing role in shaping national cyber policy and positions us as a key partner in delivering the forthcoming National Cyber Action Plan. A key element of our strategy is always building the right technology partnerships, particularly where AI is a contributor to how we deliver those services. I've already touched on some of those early on. It's very positive to see that the team is being recognized by Horizon3 as their global partner for the second year in a row. In the area of Identity and Access Management, our partnerships have continued to grow. We are now the most accredited European technical partner with Delinea.

[Mike Maddison, CEO at NCC Group]

I'm very pleased that for the 14th year, we continue to engage with high-profile Comic Relief campaign, underlying our commitment to creating a secure digital future for all. Now, let me emphasize what really gives me that confidence as a pure-play cyber business. It's all of these factors driven by our people, and it's why we believe we are trusted to deliver such highly complex and technical services. Now, with that, I'm going to hand over to Guy for the financial review.

[Guy Ellis, CFO at NCC Group]

Thank you, Mike. Before I go into the detail, let me just pull out the headline messages at group level. First of all, we're seeing a clear improvement in the quality of performance in the continuing business. Revenue is growing on a like-for-like basis, margins are improving, that is flowing through to materially stronger profitability. Secondly, it's not just revenue growth, but the improvement in margin profitability reflects that this is becoming a more focused, more efficient, and better-aligned business to the model we set out. Finally, we've seen a meaningful step forward at the bottom line alongside a strengthening underlying cash position.

[Guy Ellis, CFO at NCC Group]

Note that the prior year operating profit and profit before tax benefited from a GBP 11.3 million profit on disposal of the Fox Crypto business, that flowed through in individually significant items, as well as trading for the Fox Crypto business of GBP 2.8 million last year. Excluding these items from the prior year, like-for-like operating profit increased by GBP 6 million, the like-for-like profit before tax increased by GBP 8.2 million. The overall takeaway is straightforward: The continuing group has momentum, it's in a stronger position operationally, financially, and strategically. Turning to the group income statement. This is where we can see that improvement coming through in more detail, importantly, we can start to see the drivers behind it. Firstly, revenue growth reflects continued momentum in the core business. Total revenue was up 4.1 percentage points year on year, with cyber leading the way up 5.7 percentage points.

[Guy Ellis, CFO at NCC Group]

Escode was down 1.2 percentage points year-on-year on a reported basis. Both businesses, though, both divisions grew on a like-for-like basis, and I'll walk through that in more detail shortly. This is a more focused group, with cyber now at the center, and that is increasingly reflected in the quality of revenues. Margin improvement was driven by better mix of work and stronger operational discipline in both cyber and Escode in the first half. It's not just growth, it's growth in the right areas. Thirdly, while the cost base has increased, this is mainly due to foreign exchange movements of GBP 0.6 million and non-repeating IFRS 16 lease benefits in H1 2025 of GBP 0.8 million. With operating efficiencies from business simplification offsetting inflation. The growth in EBITDA shows the benefit of that model overall started to come through.

[Guy Ellis, CFO at NCC Group]

Group adjusted EBITDA was GBP 2.5 million, up GBP 5.1 million year-on-year. GBP 4.7 of that came from an improvement within cyber. Overall, this shows that the strategy is now translating into the financial profile of the business with an improving quality of revenue, stronger margins, and a more scalable model. This is how we measure the delivery of the strategy we've set out. The framework will be familiar to people, but importantly, it's now aligned to a simpler pure play cyber business, as we outlined in our capital markets event in March this year. At its core, it's built around four priorities. Scaling the business to drive growth in key accounts, expanding in priority markets, and increasing the proportion of recurring revenue. Strengthening the business, improving client engagement, share of voice, and colleague engagement. All of these underpin long-term performance. Simplifying the operating model.

[Guy Ellis, CFO at NCC Group]

It's leveraging our global delivery platform and AI to improve utilization, drive margin progression, and remove inefficiencies, including stranded costs as we separate the Escode business. Finally, creating value through improved EBITDA. Strong cash conversions, disciplined capital allocation, and maintaining financial flexibility. This is not a theoretical framework. It's the set of levers that we're actively managing on an ongoing basis to translate the strategy into consistent performance and value creation. As Mike has already touched on, some of the highlights of the first half demonstrate this in action. As Mike has described, we've seen a strengthening in revenues momentum across the business. Profit conversion was very strong, with record gross margins of 38.4%, a result of the maturation of the global resourcing model, increasing use of AI. We've talked about improved pricing as well as other efficiencies.

[Guy Ellis, CFO at NCC Group]

We are on track to deliver the gross margin efficiencies required for the pure play business to deliver a mid-teens EBITDA by the end of FY 2028. The 5.7% revenue increase and gross margin gains drove EBITDA in cyber to grow at 130% or GBP 4.7 million compared to the same period in the prior year. While our clients don't buy in capability per se, this slide is useful to let you see what's happening within the cyber business at a capability level. Mike has already highlighted the consistently excellent performance across capabilities, with a year-on-year and half-to-half improvement in technical assurance particularly notable. Consulting and implementation was again star performer again, and whilst we're annualizing on a phenomenal half two in the prior year now, we do expect mid-single-digit growth in the second half of FY 2026.

[Guy Ellis, CFO at NCC Group]

This validates the sales strategy that Mike, as well as our Chief Commercial Officer, Peter Frawley, set out in the capital markets event early this spring. Before we move on, let's just have a brief comment on Escode. The business has now been successfully transferred to its new owners, with completion on the 29th of May. Our full-year accounts will reflect eight months of Escode ownership in this year. Escode has been a high quality and resilient part of the group, and I'd like to recognize and thank the teams who've supported both its performance and the transition. We wish the new owners every success as they take the business forward. For NCC, this marks the completion of the portfolio reset.

[Guy Ellis, CFO at NCC Group]

It allows us to focus fully on our pure play cyber strategy, although we'll need to continue to report the revenue for the full period of FY 2026 due to the completion point in the second half and its contribution towards this year's results. Net debt. On the left-hand side, you can see here our net debt movement in the first half. We started the half with GBP 13.1 million of net cash in the group and finished the period with a net debt of GBP 10.2 million. We've returned GBP 33 million to shareholders via the share buyback announced on the 21st of January 2026. A further seven million of buyback was executed after the half year closed on the 31st of March.

[Guy Ellis, CFO at NCC Group]

Across that total GBP 40 million share buyback, we've purchased 31 million shares at an average price of GBP 1.28 through the share buyback. It's effectively a circa 9% discount on the current share price. On the right-hand side, you can see the net debt movements to date in the second half. We have paid the final FY 2025 dividend together with the share buyback prior to the receipt of the Escode proceeds. This leaves us with a strong net cash position at the end of May of GBP 230 million. There are obviously a number of important disclosures included in the RNS release this morning, and I think it's worth drawing out and reiterating some of these. The Escode proceeds net of GBP 10 million of cost are GBP 252.8 million, and we will recognize a gain on the disposal in the second half of this year's accounts.

[Guy Ellis, CFO at NCC Group]

There will, of course, be items of individual significance in the second half as a result of the Escode transaction and execution and completion of the cyber strategy. We have announced our intention to return GBP 185 million to shareholders from Escode proceeds. 170 million of this will be via tender offer and 15 via a subsequent share buyback. This is obviously in addition to the 40 million share buyback program we've executed through the spring of this year. Per normal course of business, we would expect to conclude the capital reduction process and issue a circular for the tender offer around the end of July. At the conclusion of the tender offer, the board will announce the ongoing dividend policy.

[Guy Ellis, CFO at NCC Group]

While I cannot confirm the details today, I can state that it's the board's intention to maintain an ongoing dividend, albeit at a lower level than the existing dividend, while we execute business improvements to deliver mid-teens EBITDA business by the end of FY 2028. Mike's going to touch on that shortly. With that, back to you, Mike.

[Mike Maddison, CEO at NCC Group]

I would like to conclude with a summary of why we believe there is a stronger than ever investment case for NCC. At the highest level, the key point is that NCC is now a focused, pure play, cybersecurity and resilience business. As I've already said, with the completion of the Escode sale, that strategic reset is complete, and the group is now fully aligned behind that opportunity. We operate in a large and durable market where demand is increasingly driven by structural factors, including rising threat levels, regulatory pressure, and the growing importance of resilience spend. Our differentiation comes from a combination of these deep technical domains, our proprietary insight, and the trust we have built with clients and governments over many years. We are also building a more scalable operating model with a more joined-up go-to-market approach, increased and improved revenue mix, and increasing visibility in the business.

[Mike Maddison, CEO at NCC Group]

We are able to share insight and bring the best of NCC to support clients irrespective of where our talent is or where the client operates. Bringing that together, we see clear potential to create value through continued execution, both through operational improvement and, over time, a re-rating that reflects a simpler, more focused, and higher quality cyber business. We have delivered significant change in the business but recognize there is more to do. This is how we measure the delivery of the strategy we've set. The framework will be familiar, but importantly, it is now aligned to a simpler, pure play cyber business. As we outlined in our capital market events in March this year. At its core, it's built around four priorities, which you will have heard throughout the presentation and as Guy outlined previously.

[Mike Maddison, CEO at NCC Group]

Firstly, scaling the business to drive growth in key accounts, expanding in priority markets, and increasing the proportion of recurring revenue. Strengthening the business by improving our delivery processes, investing in the things that matter to clients. Importantly, simplifying the operating model, leveraging our global delivery platform and AI to improve utilization, drive margin progression, and remove inefficiencies, including some of the stranded costs. Finally, creating value through improved EBITDA, strong cash conversion, disciplined capital allocation, and maintaining financial flexibility. Now, the framework is not theoretical. It is the set of levers we are actively managing to translate the strategy in consistent performance and value creation. In summary, we have executed a major pivot, simplified the business, and had three quarters of growth. We've got record gross margin %. We are far more resilient business and are returning capital to shareholders.

[Mike Maddison, CEO at NCC Group]

I'm certainly proud of what the team's achieved, I would like to say thank you to all of them for all their hard work. We're not complacent. Indeed, there's a lot more that we have to do. Turning to the outlook, adjusted EBITDA is anticipated to grow ahead of revenue, with margins in the range of 5.5%-7.5% for the year. Looking ahead, the board remains confident in delivering its medium-term objectives, including mid-teens EBITDA for cyber as we continue to improve operational discipline and execute the transformation of the business. That concludes our presentation this morning, I'd like to open up now for any questions you may have.

[Operator]

Thank you. If you would like to ask a question today, please click on the Questions icon in the control bar at the bottom of your screen and type it in. Our first question: You talked about the flywheel. Are there proof points that you can share that demonstrate this is working?

[Mike Maddison, CEO at NCC Group]

Excellent question. Thank you. There are probably two points I'd highlight in terms of why the flywheel is effective. Firstly, it's that move away from purely transactional type projects. A good indicator of that I would highlight is the average order value. Larger, more complex deals, quite often using a number of capabilities from within the business rather than individual point solutions. If I look at average order value versus FY 2025, we've seen a 23% increase in value, and also a 40% increase in volume. Larger deals and more of them, which is incredibly positive. As I say, it's not always about individual products leading to other products or solutions. It is about multidisciplinary teams. However, again, there are some really good indicators how one entry point is leading to an engagement with a client which requires support in other dimensions.

[Mike Maddison, CEO at NCC Group]

To give an example of that, incident response is probably the most obvious. Responding to a breach, helping a client through a complex situation, usually a crisis. Our incident responders often who are on retainer. We've seen a 10% increase in incident response engagements leading to managed services. I think that's a fantastic indicator of an ongoing conversation with a client, multidisciplinary, multi capabilities involved, leading to a longer set of term relationships.

[Operator]

Thank you. Next question, a couple grouped together. What's the confidence like in terms of H2 in terms of market dynamics?

[Mike Maddison, CEO at NCC Group]

Well, I think clearly that's the ultimate question. There are a number of things that give us confidence actually. I'd sort of break it down. If we look at the broader market, and our client base. There's a number of metrics I'd probably pull out. Firstly, if you look at our client base, we have 92% of our bookings come from existing clients. We really do have that foundational element. We're not out hunting in the market. We do have an amazing client base, which actually leads also to our 1-4-20 strategy and why that is so pivotal. What gives us confidence, I think, as we then look forward is, of our top 10 clients, we've seen sales increase versus FY 2025 of 9%. Again, big clients, increasing sales. Again, that's highly efficient.

[Mike Maddison, CEO at NCC Group]

If we look at our top 20 clients, we've seen our sales increase versus FY 2025 of 11%. Again, being in there, being embedded, gives us visibility of the pipeline in a way we've probably historically never had. Now I think 68% of our bookings are from our top 25 accounts. Again, we're very, very focused. I think ultimately, sales in H1 of this year are up versus H1 in 2025. That, again, gives us some greater confidence about the forward trajectory of the business.

[Operator]

Thank you. Next question is from Andrew Ripper at Panmure Liberum. How much do you expect to spend in order to realize the GBP 25 million savings? Would you expect to reinvest some of these, or are they expected to all drop through to the bottom line in getting to the mid-teens margin target?

[Guy Ellis, CFO at NCC Group]

If I take that, thanks, Andrew. We expect to realize about GBP 25 million of savings come the end of FY 2028. That's about GBP 7 million in this year, and then the remainder spread over the remaining 2 years. We're expecting that to cost broadly on a pound-for-pound basis. We've got plans around all those items, and that will flow out broadly over the time period in line with when we get the savings back out. They will clearly go from those reorganization costs will hit it below the line from a ISI perspective. That's where we will report those, but obviously we'll have strong rigor around making sure that operational activities get charged into above the line and it's pure reorg that goes below the line.

[Operator]

Thank you. Next question is from Damindu at Peel Hunt. U.S. gross margins remain below 30% versus 40% in the U.K. and Europe. You talked about how you'll focus more on some under-indexed verticals like financial service. What levers are available beyond growing to increase utilization to make American margins better? Is it growing higher margin offers like managed services, or is it looking at resourcing in N.A. to make it more efficient?

[Mike Maddison, CEO at NCC Group]

So-

[Guy Ellis, CFO at NCC Group]

Can I-

[Mike Maddison, CEO at NCC Group]

Yeah, you start. Yep

[Guy Ellis, CFO at NCC Group]

I'll do just a bit of math first on that first. They're not, unfortunately, directly comparable margins because a proportion of U.S. work gets delivered out of the U.K., Spain, or particularly Manila now. The transfer pricing arrangements between the markets means that the U.S. margin, or North American margin, gets penalized for that, and actually say if it's done in Manila, the margin benefit drops into Asia Pac or if it's done in the U.K., the margin benefit from an end-to-end point of view, some of it drops into the U.K. They're not directly comparable. Notwithstanding that, there is definitely opportunity for margin expansion, which I guess Mike will now talk about a little bit.

[Mike Maddison, CEO at NCC Group]

Yeah. I was going to go exactly the same place. I think, Damindu, you've called out exactly the sorts of areas we're focusing on. I think firstly there is a focus on higher value type opportunities. I did mention, I think, some marquee wins we've had actually in the U.S., particularly in the financial services sector, supporting AI readiness post-Mythos. Those are clearly helping support an increase in margins. The second area I think is, as Guy's helpfully mentioned, the way we deliver globally to make sure that actually we use the capabilities we've got around the world to execute. Rather than it being all about just North America margins, it is about how it supports the overall group. There are then not only the verticals, but also changing the mix of services.

[Mike Maddison, CEO at NCC Group]

As you'll see from the data we flashed up on the slide, there are certainly a number of areas where we believe there is expansion. Managed service is one. We have had some early successes, but again, having to invest in the right overlay, sales capability, and also in some of our consulting offerings, which I think has had a contributing factor in terms of some of the improvements. There are a number of levers, all of which, to Guy's point, it's not a clear like for like. I think we have a path ahead.

[Operator]

Thank you. A follow-up question from Andrew. What do you expect organic growth to be in H2, and how confident are you of an acceleration of growth in FY 2027? How significant are the larger strategic client opportunities, and can you elaborate on the pipeline, et cetera?

[Mike Maddison, CEO at NCC Group]

I think I might have covered some of that in terms of the pipeline. Again, we only launched our 1-4-20 strategy in H1. We've seen the positive impact of that, which again gives us the degree of confidence going forward. We have made a significant change in terms of the way we go to market, in terms of the propositions of which we are talking to clients about, which are multidisciplinary. Again, it's not all about one skill set or one capability. It's multidisciplinary. That has also started to drive much more expansive conversations in what is an amazing client base, where we already know that we get reoccurring sales from. Putting all those factors together, it gives us a forward look, which I think there is an awful lot to play for. Nothing's guaranteed. We can't control the macro geopolitical situation.

[Mike Maddison, CEO at NCC Group]

Certainly in terms of our execution, we're very clear what we've got to do, very much focused and confident about that.

[Operator]

Thank you. Next question comes from Kai at Canaccord. It seems that pen testing is still 40% of your revenue, and you rightly highlighted it as commoditized and can be automated by AI. How do you intend to manage these structural pressures, and should we expect it to decline over time?

[Mike Maddison, CEO at NCC Group]

I differentiate between commoditized types of projects and the skill set. They are two quite different things. There is, as always in technology, ever-increasing degrees of automation. AI is the latest manifestation of that within the pen testing space. We do see some elements of pen testing being increasingly AI-driven. We've adapted to that. For example, a large amount of our infrastructure testing is already using AI. We then provide skilled oversight and humans in the loop, is the phrase I would use. That's been expanded into other areas like web app testing. We're at the forefront of some of that. The need for assurance is not going away. If anything, I'd argue it's going to increase.

[Mike Maddison, CEO at NCC Group]

AI is already demonstrating the need for guardrails, there are very few organizations in this world that we've, certainly the clients that I've talked to about our client base, who have the guardrails and the confidence that actually they are moving forward with a huge degree of confidence around AI. I think that's where we play. That's what gives us such confidence that we remain incredibly relevant. That's why I would differentiate from project and product type to actually our skill sets, where our skill set remain incredibly relevant.

[Operator]

Thank you. Next question comes from Julian at Investec. Business looking to a total GBP 25 million cost out efficiency. This signals more change to come. Can you outline how this will not disrupt but drive a positive accelerator to the top line and bottom line performance going forward?

[Guy Ellis, CFO at NCC Group]

I'll have a go at that. Mike can chip in. We have taken, I guess, a lot of cost and a lot of efficiency benefit over the last three years. It's not something that's just happened, or just about to start. I think we've got a team and a business now which has become very adept at adapting, moving forward and making itself stronger and more efficient. We have an inflection point now with the Escode business separating, as we finalize the separation, that means that we can get far more out of our existing core systems and bring a lot of efficiencies and bluntly make people's jobs much easier to do.

[Guy Ellis, CFO at NCC Group]

If I give an example around the kind of journey we're on for that, if I were to go back three years ago, we didn't have a commercial finance function at all. We now have a commercial finance function, which is embedded in the business, doing a lot of great work from a forecasting and decision support perspective, but has to do phenomenal amounts of manual work because the Workday systems that we've got have not been optimized by us in the way that they should be to be able to people spend more time in the business improving decision-making and being more efficient. There are examples of things where actually a lot of the change that we're talking about here is making people's jobs easier to do, more engaging, and will actually drive efficiency and cost out of the business at the same time.

[Guy Ellis, CFO at NCC Group]

It is also piggybacking off the fact that we now have a globalized resourcing model, which is able to, if you think about it within the delivery arena from a gross margin point of view, as we increase machine learning and AI in some of the areas of managed services as well as testing, it's now much easier. We can deploy those things globally. Whereas if you went back three years ago, those processes and those client offerings were not globalized and therefore it wouldn't have been possible to do the optimization of that in one go.

[Mike Maddison, CEO at NCC Group]

I think I'd also just emphasize to Guy's point, the inherent complexity that was in the business. We've now been able to, if we take the divestments we've made, there's a mixture to Escode, very different business to a professional services cybersecurity company. We had a fraud product business. We had a very high-end crypto products business. These are all very different. That added inherent complexity in our systems. We now have, as part of this, the opportunity to address overly complex IT systems. That, again, I think is a major point. We do have a team and a set of plans. Those plans are visible, socialized, and a much more highly resilient business than maybe we had historically.

[Operator]

Thank you. Another question from Damindu. You've disclosed that lifting average capabilities sold from 1.5 to 2 would deliver 35% incremental revenue from existing clients. Those are compelling numbers, and we know you're working hard to elevate the sales team to do this. What needs to happen on the client side? Do they need to source from fewer providers, wallet share, or do they need bigger budgets, wallet expansion?

[Mike Maddison, CEO at NCC Group]

Well, I think I touched on this again with this. We already have the client base. I think it is about a change in terms of how we have client conversations. We now have, and again, Guy sort of inferred some of this. We've got single processes. We've got a single sales operation functions, which can now share collateral centrally to the sales team globally. We can share credentials. We can roll out single training to the sales teams. There's an upskilling opportunity that naturally occurs as a result of the pivot we've made around our 1-4-20 strategy, about the propositions we take to market. That gives us, I think, the opportunity to be able to go into those clients and elevate and win market share because we've already got the clients.

[Mike Maddison, CEO at NCC Group]

It is about repositioning and winning market share, which I think we've got a pretty good track record of.

[Operator]

Thank you. Next question comes from Ross at Edison Group. Can you talk about how the strategic importance of managed services relationships might change in the delivery of future cyber solutions and the factors driving this?

[Mike Maddison, CEO at NCC Group]

I think it comes back to the skill sets element. Many organizations would look at cybersecurity of it being incredibly important, but difficult to retain the skill sets and capability to actually be able to manage it effectively. It's not the core business is the fundamental element. A big part of that, and particularly in an AI context where we are addressing threats and vulnerabilities at a machine speed, you need the right level of capability in-house. To deliver that, you can't build your own teams quite often for most organizations, unless you're particularly large. Managed services becomes fundamental.

[Mike Maddison, CEO at NCC Group]

I think when clients then look at who is a trusted provider with deep insight, long track record, stable, recognized businesses with intellectual property and visibility of this topic, I think that's one of the reasons why we believe that we're very well-positioned, maybe vis-a-vis some other organizations out there, because this is our core business. It isn't just a process. We bring insight and that intelligence to play. That's why managed services, I think is so fundamentally important and why we've seen the growth in that as a proportion of our overall revenue.

[Operator]

Thank you. Another question from Damindu. Any anecdotes you can provide about internally used AI tools? Do you have, for example, access to the best Anthropic models that might not be available to everyone? Do you plan to customize these tools to make them more bespoke to you?

[Mike Maddison, CEO at NCC Group]

That is a great question. Thank you, Damindu. I'm now going to be very careful what I say from a client confidentiality perspective. We are not part of Glasswing. I'll say that. That's obviously a matter of public record. We do work extensively with a number of clients globally in aspects relating to some of these frontier models. We do use internally AI extensively already, and I've talked about some of the public elements and the partnerships that we've got around that. AI is absolutely front and center to our future strategy and the way we're executing, and we are very close because of some of the clients that we work with in terms of how these frontier models will affect cybersecurity going forward.

[Operator]

Another one from Damindu. You've said the second half has started well. Can you put some color around that? Are you seeing acceleration in any specific segment or geography?

[Mike Maddison, CEO at NCC Group]

I think if it was to pull out some specific themes in terms of client demands, AI readiness is without doubt right at the very top of client conversations, and that covers a number of aspects. It's around whether the governance and guardrails within an organization for the deployment of AI are sufficient, and most organizations are really struggling to tackle that. There is definitely, as we've seen, the announcements around Mythos and the shortening of the identification of vulnerabilities and the actual use of exploits shortening to almost hours is now increasingly having impact on patching cycles and operational internal processes. Quarterly patching cycles are now no longer viable. What does that mean in terms of operational processes, which we're helping clients with extensively?

[Mike Maddison, CEO at NCC Group]

Interestingly, there's a really developing set of conversations happening around digital assets, and how do you provide assurance over that? The general sort of operationalization of security remediation naturally is very much a topic of client concern as they look to change how they adapt to what is, I think it's a paradigm shift, to use a very old internet term. There's quite a lot. Then, of course, there's the usual things. Third-party supply chain we see remains highly relevant. Obviously cloud adoption and how that plays out in terms of the new AI era.

[Operator]

Thank you. Final one from Damindu. Utilization improved to 76% from 70% in FY 2025. Where do you see the structural ceiling for utilization in cybersecurity services business?

[Guy Ellis, CFO at NCC Group]

Utilization is one metric. We also talk internally about how we're sort of driving revenue per fee earner. We certainly see there's Historically, the history would show that sort of knocking more than 80% out consistently across on a business average starts becoming unsustainable for people. People start suffering burnout because they've got other activities they've got to complete at the same time. Some of the real benefits, I think if Damian was sat here, our Chief Operations Officer, he'd talk about actually is as you start using, you assist colleagues with machine learning and more AI, actually they're able to carry out more activity. It's partly the utilization, but some of the ceiling on the gross margin is also then about actually the efficiency of how people can work through a daytime as well. We're conscious on working on both things.

[Guy Ellis, CFO at NCC Group]

As is always the case and always will be the case, we see hotspots. Inside that 76%, there are some functions and areas of expertise which will always run at a higher level and some which will run at a lower level. That probably won't change. Sorry, it's not a very direct answer. 76% is probably not another 15% in that, but there's some benefit in actually how people operate within the scope of their day, as much as just working more days.

[Mike Maddison, CEO at NCC Group]

I do think this does talk to the heart of the changes that I think are affecting professional services industries. Is utilization the right measure going forward? Projects are changing. It's more outcome-based. We're certainly focusing very heavily on more subscription-type activities, so not directly tied to sort of time and materials. That will obviously increasingly create a change in the way we measure some of the success of our productivity.

[Operator]

Thank you. We have no further questions on the webcast, I'll hand over to you, Mike, for any closing remarks.

[Mike Maddison, CEO at NCC Group]

Thank you very much. I would just like to conclude with maybe two things. Firstly, as Guy said, we wish our Escode colleagues every success in the future. Most particularly to all of our colleagues internally who helped on that process, thank you very much for all of the hard work. Also to all colleagues generally for the effort that has made H1 I think a very solid start to the year, and very much confident and looking forward to the second half. Thank you very much.

Participants

Executives

• Guy Ellis, CFO
• Mike Maddison, CEO