ECSC : Interim Results

22 September 2021

ECSC Group plc

('ECSC' or the 'Company' or the 'Group')

Unaudited interim results for the six months ended 30 June 2021

Strong growth across MDR and Assurance divisions

ECSC Group plc (AIM: ECSC), the provider of cyber security services, announces its unaudited interim results for the six months ended 30 June 2021.

Financial Highlights

• Group revenue up 15% to £3.01m (H1 2020: £2.61m)
• Managed Detection and Response ("MDR") division revenue (managed services and incident response) up 17% to £1.45m (H1 2020: £1.24m)
• Assurance division (testing, standards and certification services) revenue up 20% to £1.49m (H1 2020: £1.24m)
• Gross Profit up 24% to £1.82m (H1 2020: £1.46m)
• Adjusted* EBITDA** profit of £19k (H1 2020: £52k)
• Cash of £0.59m at period end, including £0.14m of COVID-19 related medium-term government support (30 June 2020: £1.26m, including £0.77m of COVID-19 related medium-term government support). The Group's bank facility of £0.5m remains unutilised.

*Adjusted EBITDA excludes one-off charges and share based charges

**EBITDA is defined as Earnings before Interest, Tax, Depreciation and Amortisation

Ian Mann, Chief Executive Officer of ECSC, commented:

"We are pleased to report strong growth across both our MDR and Assurance divisions, driven in part by a rise in cyber security incidents. Contributing to this is the number of organisations opting for remote and cloud working during the COVID-19 pandemic.

"Cyber security remains a key priority for all organisations, particularly as many employees begin to shift to a hybrid of remote and office working, calling for increased focus on cyber security. Ransomware attacks also continue to pose a significant threat to organisations, with a high number of companies suffering substantial disruption.

"We look forward to keeping the market informed on our progress in due course."

Enquiries:
ECSC Group plc	[phone]
David Mathewson (Non-Executive Chairman)
Ian Mann (Chief Executive Officer)
Allenby Capital (NOMAD and Broker)	[phone]
David Hart
Piers Shimwell
Yellow Jersey (PR and IR)	[phone]
Sarah Hollins
Annabel Atkins
Matthew McHale

Notes to Editors:

Founded in 2000, ECSC Group plc (AIM: ECSC) is the UK's longest running full-service cyber security service provider. With an extensive range of in-house developed proprietary technologies, including advanced Artificial Intelligence (AI) systems, ECSC provides expert security breach prevention and advisory support to organisations across all sectors.

ECSC operates from two Security Operations Centres (SOCs): one in Yorkshire, UK, and the other in Brisbane, Australia. ECSC offers flexible 24/7/365 cyber security monitoring, detection, and response support to its clients, either as a fully managed service or to enhance an organisation's existing cyber security systems. In addition, ECSC's Assurance division provides guidance, certification to industry standards, and extensive testing services to allow organisations to assess their cyber security protection.

ECSC is led by a highly experienced senior management team with over 80 years' combined experience within the company and has delivered consecutive organic growth for the last 20 years.

The Company's broad client base ranges from e-commercestart-ups to global blue-chip organisations, including 10% of the FTSE 100.

For more information please visit the following: https://investor.ecsc.co.uk/

Chairman's Statement

The Group has managed its way through COVID-19 with excellent remote working practices, reflecting well on the capable and experienced management team who are now focussed on the many opportunities arising in the market.

Strong growth across each of the divisions has driven an improved financial performance across the business.

Cyber security remains a key priority for all Boards, with breaches continuing to attract media attention and an increasing regulatory framework, particularly with the impact of GDPR.

Clients increasingly recognise that 24/7/365 cyber security breach detection and expert incident response is vital to the protection of personal information and maintenance of critical IT systems. For all but the largest global organisations, the outsourcing of these critical functions is the logical choice, and ECSC has the technology, expertise and processes to deliver.

ECSC is well positioned in a growing market, and we look forward with confidence to continuing to deliver improved operating results.

On behalf of the Board, I would like to thank all of our clients, staff, channel partners and advisors for their continued support.

David Mathewson

Non-Executive Chairman

22 September 2021

Chief Executive Officer's Statement

Ongoing Strategy

Our strategy of delivering sustained, and profitable, organic growth remains our primary focus.

The Assurance division, comprising testing, standards, and certifications, remains key for new client acquisition and is delivering an increasing proportion of repeat revenue. This is testament to the quality of delivery ECSC provides as well as excellent client relationships.

The MDR division now accounts for 48% of revenue, compared with 29% at the Company's IPO at the end of 2016.

We have continued to invest in ECSC proprietary technologies, including continuing development of our MDR Artificial Intelligence ("AI"), which is embedded within many of our managed services. We see new opportunities to augment the vital people skills within the operation with both machine learning and neural networks.

Outlook

The UK cyber security market remains an attractive segment of the wider IT sector. Against this backdrop, we are confident that the organic growth strategy of ECSC remains appropriate.

The disruption caused by the global pandemic and the associated re-engineering of our operations has led the management team to re-examine all areas of our client acquisition strategy and operations. This widespread review is an ongoing process, and we will make any necessary changes to ensure ECSC remains ideally placed to deliver for its clients.

Key Performance Indicators

The following Key Performance Indicators were established in mid-2018, and expanded in 2019, to enable meaningful performance measurement:

		Jun	Dec	Jun
Performance	Rationale	2021	2020	2020
Indicator		(interim)	(full year)	(interim)
Revenue Growth	Measurement of the success of the organic growth	15%	(4%)	(1%)
	strategy
Managed Detection and	Visibility of the success of increasing the
Response Recurring	percentage of revenue from long-term recurring	12%	22%	25%
Revenue Growth	revenues
Managed Detection and	Visibility of the success of increasing the	44%	43%	45%
Response Recurring	percentage of revenue from long-term recurring
Revenue Proportion	revenues
Managed Detection and	Combined measurement of new client contracts	£2.7m	£2.6m	£2.9m
Response Order Book	together with renewals of existing client contracts
Managed Detection and	Delivery efficiency measurement	64%	73%	67%
Response Gross Margin
Assurance Repeat Revenue	Quasi-recurring from longer-term consulting	83%	73%	69%
	clients
Assurance Gross Margin	Delivery efficiency measurement	61%	58%	51%
Research and	Investment in future cyber technologies, service	16%	14%	14%
Development (of revenue)	enhancements and intellectual property

Ian Mann

Chief Executive Officer

22 September 2021

Financial Review

Principal Activities

The principal activity of the Group during the period continued to be the provision of professional cyber security services, including Assurance, Managed Detection and Response Services and the sale of Vendor Products.

	Unaudited	Unaudited	Audited
	6 months	6 months	Year ended
	30 June	30 June	31 December
	2021	2020	2020
	£'000	£'000	£'000
Revenue
Assurance	1,489	1,241	2,724
Managed Detection and Response	1,450	1,239	2,732
Vendor Products	49	70	125
Other	19	58	82
	3,007	2,608	5,663
Gross Profit
Assurance	905	633	1,576
Managed Detection and Response	932	834	1,994
Vendor Products	8	14	25
Other	(29)	(19)	(47)
	1,816	1,462	3,548
Adjusted EBITDA*
Other Income	117	211	297
Sales & Marketing Costs	(1,025)	(844)	(1,713)
Administration Expenses	(889)	(777)	(1,757)
	19	52	375
EBITDA**
Share Based Payments	(69)	(57)	(101)
Exceptional Items	(26)	(54)	(65)
	(76)	(59)	209
Depreciation and Amortisation	(206)	(260)	(480)
Adjusted Operating Loss*	(187)	(208)	(105)
Operating Loss	(282)	(319)	(271)

• Adjusted Operating Loss and Adjusted EBITDA excludes one-off charges and share based charges
• EBITDA is defined as Earnings before Interest, Tax, Depreciation and Amortisation

Revenue & Organic Growth

Total revenue in the period ended 30 June 2021 was £3.01m, up 15% on the comparable prior period (revenue in the six months ended 30 June 2020 was £2.61m). Within this, Assurance revenue was up by 20% to £1.49m (June 2020: £1.24m).

Managed Detection and Response division revenue increased by 17% to £1.45m (June 2020: £1.24m). Within this

division, Incident Response revenues increased to £0.14m (June 2020: £0.07m) during the period.

Vendor Products revenue in the period fell by 30% to £0.05m, (June 2020: £0.07m), and remains a small part of ECSC's business, contributing only 2% of revenues.

Margin Generation

Gross Profit in the period was £1.82m representing a 60% gross margin (prior year interim period: £1.46m representing a 56% gross margin). This was due to improved margins in the Assurance division.

Assurance margin rose to 61% in the period (prior year interim period: 51%). This was due to the 20% increase in Assurance revenue over the prior period and improvements in utilisation.

Managed Detection and Response margin fell to 64% (prior year interim period: 67%) due to an increase in investment in the MDR division during the period.

EBITDA & Operating Loss

Adjusted EBITDA for the period, which excludes one-off charges and share based charges, was £0.02m (June 2020: Adjusted EBITDA of £0.05m). EBITDA in the period was a loss of £0.08m (June 2020: EBITDA loss of £0.06m).

Adjusted Operating loss in the period was £0.19m (June 2020: Adjusted Operating loss of £0.21m). Operating loss in

the period was £0.28m (June 2020: operating loss of £0.32m).

Cash Flow

Cash and cash equivalents decreased by £0.67m to £0.59m as at 30 June 2021, primarily due to an increase in investment across the business and reducing the COVID-19 related medium-term government support to £0.14m from £0.77m as at 30 June 2020.

The Board has also renewed ECSC's £0.5m invoice discounting facility with Barclays Bank following annual review in July 2021. As at 30 June 2021 this was unutilised.

The Group will continue to prioritise cash management and closely monitor this to ensure that the Group has adequate liquidity to meet all of its financial commitments as they arise.

Capital reduction

Subsequent on 26 August 2021, the Company completed a reduction of its share capital, whereby the entire amount of £6.1 million standing to the credit of the Company's share premium account was cancelled thereby creating distributable reserves, which will allow the Company to pay dividends or make distributions to its shareholders and/or undertake a buyback of its ordinary shares in due course, should it be appropriate or desirable to do so.

The Capital Reduction will have no effect on the overall net asset position of the Company and will be reflected in the full year report.

Gemma Basharan

Chief Financial Officer

22 September 2021