Description

Cyan AG is a very attractively valued European provider of white-label IT security solutions. The shares have multi-bagger potential over the next few years. Cyan will profit from strong industry tailwinds, but the main growth driver will be the ramp up of the recently won Orange tender (French telco, ca EUR 37bn market cap). Successfully executing this contract, Cyan could comfortably reach EUR60m revenues in 2021 at >55% EBITDA margins. Incl. generated cash (Cyan has very little debt) and assuming a 17x EV/EBITDA multiple (sector currently trades at 22x ‘19), this implies a money multiple of 2.7x over the next 2.5 years. Valued at a sector multiple of 22x (I expect EBITDA will continue to grow >20% pa), this is 3.5x over the next 2.5 years – and this still excludes plenty of other opportunities in the pipeline. 

This opportunity exists given the small size of this company, management’s (at first sight) lack of track record and the significant and rapid change the company went through; only 3 years ago the company employed 10FTEs, compared to ca 130FTEs today. Also, (financial) disclosure to date has not been shareholder friendly, though this is about to change. 

Some history

Cyan is a Munich based provider of white-label IT security solutions. The group is specialised in the protection and optimisation of mobile networks (MNOs and MVNOs) and focuses on B2B2C business (more on this later). In addition to network operators, Cyan services banks, insurance companies and several governments. 

Cyan has been operating for more than 15 years in the field of cyber security. Historically, the company worked closely with clients to develop products. Often, Cyan would set up a separate entity with clients/researchers. As a consequence of this strategy, over the years Cyan ended up with lots of entities throughout the world, most of which were however not 100% owned. This was one of the reasons for the Cyan IPO in March 2018; not only to raise money to pursue growth, but mainly to buy-out the minority shareholders of these entities and to consolidate (read: clean-up) what had become a bit of a messy corporate structure for such a small company. 

The company’s first major contract was with T-Mobile Austria in 2013 which included internet security solutions. Growth continued in the years thereafter with other major contract signings with Deutsche Telekom (covering various countries) and T-Mobile Poland in 2015. Though Cyan continued to expand its business in the years thereafter, growth accelerated substantially in 2018. Cyan IPOed in March and in May 2018 it announced the acquisition of I-New, a global systems provider for MVNOs (basically a one-stop-shop solution for launching and operating an MVNO platform). I will not delve much into the details of I-New’s product offering, suffice it to say that with the acquisition of I-New Cyan significantly expanded its product portfolio, customers base and number of employees. I-New was struggling to grow business though had contracts with over 40 MVNOs serving 5,5m clients. In addition, with the acquisition Cyan expanded its number of employees from 35 to ca 160 (of which 100 IT engineers), which were strongly needed to achieve critical mass to win and service much larger clients such as Orange. With the I-New acquisition, Cyan basically bought client relationships (strongly increasing cross sell opportunities), a new product offering (data-optimisations solutions, which was combined and repackaged into a new successful product) and engineers. 

As a result of the I-New acquisition, the company is now able to execute large projects for telecommunications companies, thereby increasing its attractiveness. This is very helpful in view of the company's extensive project pipeline and, according to management, has brought Cyan at least a good two years forward in operational terms. During October and December 2018, the company carried out two capital increases, aimed at financing the I-New acquisition (which was completed in two stages) and further improve its balance sheet. 

A game changer and one of the main drivers of growth is Cyan’s win of a global tender with Orange. In December 2018, Cyan and Orange agreed on a long-term contract to offer Cyan’s solution to all of Orange’s subsidiaries globally. The contract covers 28 countries with the potential to reach 260m Orange customers over time. After a two-year tender process, Cyan was able to secure this deal against a wide range of incumbent competitors. This deal will not only strongly accelerate the company’s growth but it also further underscores Cyan’s attractive product offering and potential to win other contracts.

As a result of the above, Cyan now operates along 5 business units: Carriers (which includes Orange), I-New, GVG, Banking and Insurance, Cyan Networks. All segments are expected to grow, though basically all growth will come from Carriers and I-New (incl sales from data compression) – more on this later.

Product offering and technology

Products

Cyan’s product portfolio can be summarised as follows:

• OnNet Security. This is Cyan’s network-integrated security solution which is offered as a white-label solution to MNOs and MVNOs. This product is installed / integrated in the existing infrastructure of the network. The customer (i.c. the network operator) then offers the product to consumers who can choose to opt for it (hence B2B2C). OnNet Security protects the consumer by blocking malware, phishing, viruses, etc before they reach the consumers. This can perhaps easier be understood as ‘data connection’ security. It is important to now that consumers do not have to download and install anything; they are simply offered the option to opt-in via a text message from the network operator. Furthermore, once the product is installed onto the network, tested and ready to be rolled out, it is very easy and fast to scale. Revenues for Cyan are dependent on the number of total consumers, the take-up rate of the product and the ASP of the product. Consumers are charged eg EUR 2.50 per month of which eg 40% is passed to Cyan.

• Endpoint Security. This product is basically an extension of the previous product and is often offered and sold in combination. While OnNet Security protects the consumers of threats before they reach the end-device (at the network level), Endpoint protects the device itself. This product can also be sold on a stand-alone basis. The look and feel of the product can be customised by Cyan. Revenues for Cyan are earned based on the same model as the OnNet Security offering.

• DNS data optimisation. The third main product is basically a filtering system offered mainly to MVNOs. This product filters traffic from trackers, suspicious malware/ads, etc in order to provide ‘clean’ traffic to the consumer. As a consequence, total data traffic can be strongly reduced, which improves efficiency (saves purchased data volume by the MVNO) up to 15%. Bear in mind that this does not require large investments by the operator. Revenues for Cyan are based on a cost-sharing model, where 30% to 50% of the cost savings by the operator are shared with Cyan.

Source: Company reports

• Other products such as Child Protection and Personal Protection & Authentication. These solutions target parents who wish to protect their children from malicious content as well as banks and insurance companies (just the PP&A for these of course). Note that PP&A is currently in a sweet spot as European regulation is becoming stricter and institutions such as banks and insurance companies have to adhere to new PSD2 regulation.

Technology

In discussing Cyan it is important to have a clear picture of the difference between endpoint vs network security. Endpoint security provides security of devices by installing an app or program on a device (a smartphone or computer for example). In contrast, network security software is installed directly onto the network of the operators. The objective is to protect consumers by filtering the traffic data and assuring that no malicious content reaches the endpoint device. 

Cyan is the only white-label solutions provider of network-based solutions. Providing network integrated security solutions has several benefits: it is mass-market appropriate and easy to add onto existing infrastructures of telcos. Also, as previously explained, end users are not required to make any additional downloads; the cyber protection is directly offered through the network provider. Customers merely have to opt-in/out.

Cyan’s cyber security technology processes >500m data requests per hour and is provided by hundreds of IT centres searching the internet for potential threats. The software checks traffic with cyan-patented algos (buzzterm: artificial intelligence system) and updates its filter system (the list of threats) every four hours. Updating endpoint software generally takes much longer. 

Source: Company reports

I’m not an expert in cyber security technologies, though my research and discussions with industry experts suggest the following unique selling points / key differentiators of Cyan’s technology:

• The combination of servicing endpoints with a white-label easy to scale onnet solution is unique.

• Cyan was specifically built to be mass-market focussed and hence easily scalable to millions of consumers (without adverse effects such as slowing down traffic). Once the technology is installed, practically no additional capex/opex are needed. 

• Additional product offerings can effortlessly be added on.

Source: Company reports

One other important fact to be aware about regarding Cyan’s technology is the difference between DNS-based and DPI-based. Cyan’s technology is (more) DNS-based. There is (to my knowledge) only one other company who provides security solutions on a white-label basis; Allot (ALLT), a US listed competitor of Cyan. In its Q119 conference call Allot’s CEO was asked about losing the Orange tender and the difference in technology vs Cyan’s, to which he replied:

“…the DNS-based technology is one which is inferior in its security capabilities to the in-line security capabilities that we are offering. It is however easier to install into network. So there's a trade-off there. I think that as time goes by, we will see less and less -- we will see less operators willing to go with DNS, because I think honestly, it is less future proof than the -- in line offering that we are providing. The time will tell”.

Given that this is something that according to Allot’s management might impact Cyan in the future, I dived more into this topic. I will not discuss details of the differences in technologies (or pretend to be an expert), however it was once simply summarised to me as follows: Given a webpage, DPI-based technology scans the entire content of the page, while DNS-based security technology scans the main blocks and/or (suspicious) URL addresses. Consequently, although Allot’s security offering is more thorough, it is (much) slower and more hardware intense. Network operators don’t like this as one can definitely not have traffic slow down once traffic volume increases. And as the amount of traffic is expected to continue to strongly increase (particularly as 5G kicks in), the last thing network operators want is slow(ing) traffic and continued capex investment.

I have no idea how both technologies will develop in the future. However, based on my discussions and research it appears that at the moment DNS-based technology is preferred by network operators. Furthermore, it was pointed out to me that, as customer privacy regulatory frameworks continue to be expanded, cyber security programs that scan the entire content (such as Allot’s) might face increasing regulatory headwinds or even be banned in the worst case. Whatever the case, Cyan’s win of the Orange contract (as well as previous T-Mobile wins) is a major proof of concept and one of the two major value drivers for Cyan over the coming years. Furthermore, take-up rates for Cyan’s older contracts with T-Mobile’s are very high at ca 25%, which signals strong demand from consumers.

Competitive landscape

In terms of replicating the technology, based on my research it seems that Cyan currently has at least a 2-3 year advantage over its competitors. Its main competitor in white-label solutions (Allot) clearly signalled to go about another way, while other competitors are either focussed on either device/ stand-alone solutions or network-based solutions – and thus would have to create a new offering from scratch – or do not seem willing to go for a white-label solution, something that clearly helped Cyan win large contracts. Although the cyber security space is crowded Cyan currently has no direct competition, at least for the moment. However, Cyan’s technology can be replicated. Based on the peers I would deem Avast in time the most likely to offer a similar product. 

As Cyan is the only white-label solutions provider of network-based solutions there are no direct competitors, but many do overlap in the space. I will not list them all with description, that would take up too much space and that info can easily be found, I provide a selection of players and their current pricing multiples (for the listed companies). Keep in mind, some are pure players in the cyber security space, others are software companies while others are hardware manufacturers. Also, refer to the previous picture to find others.

Avast, FireEye, F-Secure, Fortinet, Imperva, McAfee, Kaspersky, Palo Alto Networks, Clavister, Juniper Networks, Allot, Okta, OneSpan, Qualys, Zix, Sophos, Symantec, Trend Micro, VeriSign.

Source: Bloomberg

Cyan has multiple drivers of growth

Cyan has multiple opportunities to grow its revenues and cash flow. In this write-up I’ll focus primarily on the most important growth driver, the Orange contract. What is important to bear in mind is the recurring nature of the revenue (a.o. T-Mobile and Orange). 

1. Market 

A large tailwind for Cyan is the fast growing cyber security market. Dependent on the source, the global cyber security market is expected to grow with >10% CAGR over the next 5 years. The mobile cyber security market is expected to grow even faster due to higher smartphone/tablet penetration rates, an increasing use of mobile phones to access online content and a rising amount of malware. Furthermore, the total traffic of data is also poised to grow exponentially over the next years. Overall, good trends for Cyan.

2. Carriers (mainly Orange)

T-Mobile has been one of the longest contracts for the company. In Austria and Poland the take-up rate has reached 25% according to management. I assume this take-up rate to remain constant and the contracts to be renewed, though revenue from T-Mobile is not a major driver of growth. Orange however definitely is.

The Orange tender was a global tender, where “everyone was involved” according to management. The process took two years, where Orange tried and (stress-)tested many solutions. Eventually, Cyan won the tender, a strong validation of Cyan’s offering. The contract has a minimum duration of six years (network operator contracts are generally very sticky and have long durations), covers 28 countries and has a potential to reach 260m clients. Orange’s key markets are France and Africa, where Orange is one of the largest network operators. Cyan management indicated that 30 FTEs are dedicated to the Orange contract. 

Orange will be rolled out in 2 phases, Europe in 2019 and Africa in 2020. The focus will first be on France, then Spain and the rest of Europe. Orange will finance the largest part of the expenditures needed (ca EUR 25m). As previously explained, the success will be dependent on the speed of the roll-out, the take-up rate and the ARPU of the product. Another potential accelerator of growth would be the decision of Orange to sell via opt-out instead of opt-in, meaning that (new) consumers will receive the offering from the start and the possibility to unsubscribe instead of the other way around. This would lead to much higher take-up rates.

Source: Company reports

3. Other segments

After the acquisition and restructuring of I-New, the data-optimisations solutions were combined with other Cyan products and repackaged into a new successful product. Revenue from I-New is currently ca. 50% of total revenue, stable and expected to growth in the mid-to-high single digit each year according to management. As the Orange contract ramps up, the contribution of I-New will decline. 

In January 2019, Cyan signed a contract with Global Voice Group (GVG) which covers the roll-out of security solutions for governments, primarily in Africa. This contract relates to the roll-out of Child Protection and Personal Protection & Authentication products and is targeted to grow to 20 countries.

Due to its white-label focus, MNOs, MVNOs as well as banks and insurance companies across the globe can leverage Cyan’s technology alongside their own brand to drive value and lift their average ARPU. 

4. Pipeline

Cyan’s pipeline is growing strongly as can be seen from the picture below. Management is very confident in the company’s ability to win additional clients. For the investments case, I assume these pipeline opportunities to be optionality and have not assigned any value to them even though it is highly probable Cyan will close more deals.

Source: Company reports

Estimates

Cyan has not (yet) published its 2018 annual report. As such, there is no consolidated 2018 BS, P&L and CFS. Management indicated that due to all the developments in 2018 (IPO and buy-out of all minority shareholders, the acquisition of I-New, Orange) it would take some time to prepare the statements. Note that from a regulatory perspective, Cyan has time until the end of 2019 to publish its annual report (given its listing on a smaller exchange). However, Cyan intends to publish IFRS financial statements at the latest 3 July 2019 (next week) and report on a quarterly basis as of Q3. 

Cyan did however announce pro-forma results for 2018 (EUR 22.9m revenue, 4.5m COGS, 9m personnel expenses, 3m provisions, 1.6m other expenses and 4.8m EBITDA). For 2019, Cyan guides for EUR 35m revenues and EUR 20m EBITDA.

I have decided to share this write-up before the presentation of the annual report as I believe that at least a small part of the discount to fair value is due to little financial information provided. I will provide an update one the figures are released.

With respect to the estimates, as previously mentioned I only take the current contracts into account and give no value to the pipeline. Also, I present a base case (conservative) and a bull case scenario, as a sensitivity to Orange.

Carriers

Cyan revenues from the Orange contract (OnNet and Endpoint Security) are dependent on the number of total consumers, the take-up rate and the ARPU.

Orange base case:

• Overall subscriber growth of ca 3.5%, mainly due to Africa growing 5% p.a. 

• Monetisation is still unclear (dependent on country, device, take-up rate, etc) but management estimated revenues per user of EUR 1 to EUR 4 p.a. This is revenue to Cyan (after revenue sharing with Orange). I assume a constant ARPU of EUR 2.5. This compares to average ARPUs of EUR 2 per month(!) in Austria and EUR 1.5 per month(!) in Croatia. Average ARPU for Orange is lower due to a lower price point in Africa (largest part of consumers) and, in my opinion, strong management conservativism given many unknowns with respect to the timing of the ramp up. Also, keep in mind that Europe will ramp up first, which will have higher ARPUs. My blended assumption is an average over time and probably too conservative at the beginning. Another important point to keep in mind is that revenues are shared with Orange; Orange has an incentive to increase pricing as much as possible over time (as long as price elasticity allows it). 

• The 2021 average take-up rate is 4.5%, lower than historically compared to the ramp up of the T-Mobile contracts. Note that the main swing value driver is the African take-up rate; this is the main value driver of the investment case. When I posed the question to Cyan management, they claimed that the take-up rate should be the same as Europe. I remain sceptical given the higher price sensitivity of African consumers. Specifically for Africa, I assume a 3% take-up rate in 2021. Keep in mind that there is no way to know how fast the take-up rate will grow as it mainly depends on the speed of the Orange roll-out.

As for the bull case scenario I only assume a faster roll-out of Orange (a higher take-up rate), 6.8% take up rate in 2021. This scenario is actually more in line with what management estimates. Note that I keep the other levers constant (consumer growth and ARPU), even though there is upside to those as well.

There is plenty of upside to these assumptions:

• Cyan claims that the Orange contract has a potential of 260m clients over the next few years. This is because of the strong growth in Africa, not only due to mobile and fixed clients, but also enterprises (e.g. security networks, local IT networks, etc). I remain conservative with the growth in clients, though clearly African subscribers can grow >5% p.a.

• The take-up rates of the T-Mobile contract in most mature markets (e.g. Austria and Poland) have reached 25% in 5/6 years; If Europe take-up rates would grow at the same pace, even the bull case would be conservative.

• The most important KPI is the Africa take-up rate. There is much uncertainty in this driver of growth; the speed of the roll-out of the Orange contract is mostly dependent on Orange. If Orange wants to be ramp up quickly (as currently seems the case), the African take-up rate can grow much faster. Also, it is yet unknown which African countries Orange wants to expand to first (there is much difference in smartphone penetration and ARPUs between countries).

• Orange might decide to offer Cyan’s solution pre-included in its mobile contract (‘opt-out’). In that case, the take-up rate estimates should change strongly to the upside.

I-New

I-New has been restructured and comprises for 2019 still the largest part of total revenue. The ‘old’ business (at the time of acquisition) was 5.5m LatAm customers at EUR 2 ARPU. This is EUR 11m revenue. Cyan claims to be able to now cross-sell solutions (incl Data Compression) for EUR 0.90 per user; this adds EUR 4.95m. Also, I-New is expected to grow in line with user growth / MVNO growth over the next years (5% to 7%). I assume 6% in 2019 until 2024. For 2019 this means revenues of EUR 16.9m for I-New.

Others

Others are mainly Banking & Insurance and the GVG contract. I assumed these to grow in line with management indications; B&I is ramping up and will add some EUR3m revenue in 3-4 years on top of the ca EUR 5.5m I estimate for this year. GVG is EUR 450k p.a. per country and will ramp up from zero to 20 countries over the next few years. Cyan Networks is negligible (EUR1m) and I assume growth in line with inflation (2%).

As previously stated I don’t assume anything with respect to new projects.

Very strong operating leverage and cash flow generation

COGS is mainly insourced personnel costs, third party royalties, licence fees to some suppliers and rent of computers and servers; these are estimated to slightly grow over the coming years, though as Cyan ramps up revenue, I’d expect the company to start insourcing some costs. Also, Cyan indicated to have plenty of server capacity rented; I expect fairly constant COGS as of 2019 onwards.

The other additional major costs are personnel (which include R&D). These will remain one of the largest cost components, though as of 2019 (first full year of I-New consolidation) there will be strong operating leverage as Orange is rolled out. 

The company’s balance sheet is asset light. Software is fully expensed. Working capital relates to receivables (mainly from Orange) and payables (renting of server capacity). FCF conversion will be high. Over the next years, as Orange ramps up, Cyan will generate plenty of cash. In my discussion with management I was convinced that the focus will remain on capturing further growth. I expect the company to continue to reinvest its cash flow and not to pay out any dividends over the next years.

One might ask how sustainable the cash flows are. I must again stress the extreme scalability of Cyan’s model. Once the company has installed its products it is exposed to millions of consumers at an increasing take-up rate and marginal added costs; every additional consumer revenue basically drops to the bottom line. Also, contracts are generally long-term and really sticky. Unless something really bad happens in terms of execution, we can assume Cyan will be locked in for a long time. 

Based on the above, this is how the P&L would look like for the base case:

This compares to management 2021 estimates of >EUR 60m revenue and >55% EBITDA margins.

For the bull case, this is how my estimates look:

I assumed the same EBITDA margins; higher revenues would lead to higher margins, though I assume the company to reinvest for growth, hence higher costs as well. 

Note that Avast, a USD 3.8bn market cap cyber security peer, has similar margins. Although Cyan doesn’t operate the same ‘freemium’ model as Avast, their operating models are similar in that they are exposed to a base of millions of consumers which for a relatively low ASP can add-on solutions. 

Valuation

The peer group presented earlier currently trades at ca 22x 2019 EV/EBITDA, given a.o. relatively strong growth and high margins. However, note that none of the peers have the same growth and margin profile of Cyan. Even though Cyan is smaller, I would expect the company’s multiple to rerate towards sector multiples or higher once the growth and cash flow generation starts to kick in. 

I present here my base and bull case based on EV/EBITDA multiples of 17.5x and 22.5x.

Base:

Bull:

This leads to CAGRs of 50%-76% up to 2021, dependent on the case. This is very attractive for a company with fairly predictable growth, based on a conservative approach.

More catalysts / drivers of growth

• Clients moving to opt-out instead of opt-in (hence much higher take-up rates). As previously explained, this would increase estimates dramatically.

• More frequent, IFRS reporting. As stated by Cyan: “cyan AG will present its voluntarily prepared IFRS consolidated financial statements 2018 latest at the Annual General Meeting to be held on 3 July 2019. From now on, all reporting will be done in accordance with IFRS and at consolidated group level. As of Q3/2019, cyan will report quarterly”. 

• An uplisting. Also stated by Cyan: “For 2020, cyan plans an uplisting into the Prime Standard of the Frankfurt Stock Exchange”.

• As of this year, Cyan will start to generate significant and growing cash flows. I assumed no return on this cash even though the company will reinvest for growth.

• An acquisition of the company. If the company can secure growth over the next few years, it might be a nice add-on (cash flow generator) for some of the larger competitors. 

Why does this opportunity exists

• The small size of this company.

• Management’s (at first sight) lack of track record. Management specifically mentioned that  (potential) investors have indicated the lack of track record as a reason not to invest (yet).

• The significant and rapid change the company went through; only 3 years ago the company employed 10FTEs, compared to ca 130FTEs today. 

• The uncertainty in Orange; I can imagine investors holding out until Orange starts to be monetised and reflected in the financials.

• As previously explained, (financial) disclosure has not been shareholder friendly (but will change as of next week). 

Risks

• One of the main risks is execution risk. Cyan won its largest contract in history, now the company has to run. What provides some confidence though is that Cyan already has experience, albeit on a smaller scale, with the T-Mobile contract.

• Another risk is related to the speed of the Orange roll-out. If Orange would delay the roll-out, the impact on the financials would be relatively large. According to management however, at the moment Orange is actually pushing for fast(er) roll-out.

• If Orange is executed as planned, Cyan revenues are exposed to one large client. How much that exposure will be is dependent on winning new contracts / pipeline execution.

• The Orange contract is for six years (after which it will probably be renewed). One long-term risk might be that growth slows down once the Orange take-up rate has maxed out (given the size of Orange). Again, this will depend on winning new contracts. 

Shareholder base

Gerd Alexander Schütz: 1,437,213 16.2%

Apeiron Investment Group Ltd.: 1,289,901 14.5%

Tansanit Stiftung: 1,003,831 11.3%

Infinitum Ltd.:       97,491 1.1%

Peter Arnoth:     337,249 3.8%

Markus Cserna:     337,249 3.8%

Michael Sieghart:     101,174 1.1%

Free float: 4,281,836 48.2%

Alex Schutz is an Austrian entrepreneur. Apeiron is the family office of Christian Angermayer. Tansanit is an investment vehicle belonging to Rudolf Binder, an Austrian entrepreneur.

Management holds a nice stake in the company after recently exercising stock options. In addition, the pre-IPO cornerstone investors (Gerd Alexander Schütz, Apeiron Investment, the Tansanit Foundation and Infinitum) as well as management have very recently entered into a new lock-up agreement for the next 12 months. 

Catalyst

• Publish annual report and quartely figures
• Ramp up of Orange 
• Closing pipeline deals
• Uplisting