Acuity RM Group (LSE:ACRM) — Interim Results

0:01 Good morning, and welcome to the ACUITY RM GROUP PLC Interim Results Investor Presentation. Throughout this recorded presentation, investors will be in listen only mode. Questions are encouraged, and they can be submitted at any time using the Q and A tab situated on the right hand corner of your screen. Simply type in your questions and press it. Company may not be in a position to answer every question received during the meeting itself. However, the company can review all questions submitted today and publish responses, which is appropriate to do so. Before we begin, I would like to submit the following poll. And I would now like to hand you over to chairman Angus Forrest. Good morning to you. Good morning, everybody. Thank you for watching this broadcast. We believe this is a very interesting time for ACUITY risk management, and for the business cybersecurity risk management. It's been very high profile cybersecurity breaches in the first half of two thousand and twenty five, and the business is catching up and growing and improving.

1:10 Since the start of 2025, ACUITY has been going through transformational change. Change itself is disruptive. It's hard, and it takes time to achieve the results which are expected. Change requires planning, and in the implementation phase, it needs leadership and determination to succeed. David has shown all of these qualities in abundance. These results are the first which show the benefits, but they are coming through. And I'd like to highlight losses are down by more than 50%.

1:59 A new product was launched in the period, vendor management hub. Now I'm gonna allow David to talk to you because as chief executive, he is responsible for driving the business. So hand over to David. Thank you, Angus, and thank you everyone for attending. Just like to, as a welcome, talk about exactly what ACUITY Risk Management does just as a brief reminder. So ACUITY Risk Management is cyber GRC software. And what does that mean? We help comp companies monitor their cyber risk. We help them achieve certifications such as ISO 27,001 and comply with regulations such as the EU AI Act, which is recently coming into force.

2:53 The other item that we we do is third party risk management. And in fact, we are close to signing a deal that that is based on on that who also is a potential partner. In terms of the interim results, which is the the main purpose of this investor meets company presentation, so revenues are up a bit. Our operating losses have been reduced significantly. So we've made many changes to the organization to not only reduce cost, but also make the organization more lean so we can work very closely as a team to deliver even better results, in the coming six months and beyond.

3:44 We've just as a reminder and those who who have listened to me before have have understood that I've refocused the business around cyber GRC, which is where our strength lies and where historically we've been we've been strong. The one very exciting development is that we've released the vendor management hub, which is an entry level product, very easy to use, very easy to launch and get started for clients, and we feel this will be a great entry point for clients who don't quite know what to do with third party risk management that will ultimately become Stream clients to do a broader and more comprehensive risk management program.

4:31 So that's been launched. That is on the AWS Marketplace live as we speak, as of as of only a few days ago. So that is that is another development that we feel, will impact the results going forward. Our next gen stream redevelopment is close to being finalized. We've got many functions and features, a whole new user experience, a whole new user interface that parts of which are ready to go now, and the rest will be will be ready to go in short order. This is a very exciting moment for us. Not only are we gonna have an improved user experience and and user interface, but we're also gonna have the ability to connect with other with client systems such that we can pull in information in real time and provide an even richer picture of a a client's risk profile.

5:33 The I mentioned the restructuring of the business. So now we have a very solid, strong, dedicated team with a higher level of talent than what we've had in the past, And we feel like that will push us on to even greater heights as we're working very closely together on a daily basis to come up with the the the recipe for growth. We've launched new marketing efforts. In fact, they've had an impact already in terms of our engagement on LinkedIn. We've had a big push on the EU AI Act, which is something that companies worldwide will have to contend with, whether they're headquartered in the EU or not. That's been well received. We've had a number of downloads and inquiries about our services from those from that new marketing effort.

6:26 In terms of the financial review, I'll leave this on the screens for you to review. I won't go through all the numbers. As I mentioned, our revenue is up somewhat. Our costs are significantly down, which means that we are we are working toward becoming profitable, which is what we said that we would do by the end of the year, and we're still on track to be able to get there. We we do need to win some more new sales orders. We've got an exciting pipeline in the months ahead, so I think that is something to look forward to. And and I think, you know, we're on track to to achieve what we set out to do. In terms of here's here's the balance sheet highlights. So you can see you can see a bit about our cash position.

7:18 We're we've we've done a lot to to make changes to make the organization more lean. There'll be even greater savings that will come in at the end of this month and especially by the end of October. So that cash position and that and also our our p and l will improve significantly from October onwards. In terms of ACUITY Solutions, I touched on it earlier, but I'll go into a bit more detail now. So the vision for what ACUITY will do is it will provide a real time picture of a client's risk profile. So they'll see they'll see what risks they face, the level of implementation that their controls have had, how how how well they've been implemented, and what is the residual risk after those controls have been applied.

8:17 Importantly, we prioritize the controls that a client should invest in. So we can tell you by investing in control x, you will you will the return on your investment will be y. And that's something that's that's very powerful. There's a number of competitors out there. Many of them focus solely on compliance. So if you wanna get ISO 27,001 certified, there's others that can help you. But increasingly, regulators are moving toward not just complying in based on a one off audit, but on continuous monitoring of of the the risk profile. One advantage that I've alluded to is this idea of cyber risk quantification.

9:07 So one of the biggest trends in software now is demonstrating your value to clients. And we can demonstrate that in the most powerful way possible, which is by showing you the financial impact of of implementing Stream and from working with us. In addition to allowing you to comply with with one framework or one regulation, let's say it's ISO 27,001, we can very easily map your control frameworks or map your controls across multiple frameworks. This provides clients a a great deal of time saving and also reduces their complexity because they can assess a control one time and it cascades throughout all the regulations and all the frameworks that they need to comply with.

10:00 In terms of the vendor management hub, there this is, again, an entry level product, and this allows what what clients do now, in many cases is they send out spreadsheets that ask the security questions. They're called security questionnaires. What the vendor management hub allows you to do very easily and very simply is see all of your suppliers and vendors altogether in one view and understand where your biggest risks lie. That way, you can focus your efforts on improving the the the critical suppliers that have high that have a high priority risk. So if you have vulnerabilities with with certain suppliers, then you and and it's a critical supplier, you can see that straight away.

10:55 This is important because as we've seen in the news recently, so there's been Marks and Spencer, Google's even had a breach, if you can imagine that, and that is all through third party risks that have come to fruition. We've even dealing with Amazon's marketplace, we've seen they still do security questionnaires on a spreadsheet. Now we there's there's that means there's huge opportunity for us to step in and provide a much more efficient, more organized way to understand third party, risks. Some of the progress we've made re recently. So we've as as I mentioned in the beginning, we've refocused on cyber GRC rather than trying to compete with many larger organizations on the enterprise risk management level.

11:48 We've reorganized sales and marketing. We've added to the team in cert in in certain areas, and we've we've stripped away what wasn't working in the past. One of the key areas here that we've we've streamlined is the partner network. So we've got we've got someone heading up our our alliance partner program, and we've already seen progress both in The US and in Europe in terms of, a, reigniting partnerships that had that had sort of been left to wither on the vine and also finding new partnerships. For instance, one potential partner in The US who has many different financial institutions as clients, which is perfect for us because we our our best clients are the ones that are heavily regulated and have to deal with multiple frameworks and multiple sets sets of regulations.

12:50 We've restructured the organization. I've talked a great deal about about that. We're leaner. We're meaner. And we're we've not only reduced cost, but we've acquired the ability to move faster based on a core strong team working together to deliver results. Some of the benefits. So, yeah, we've got a couple sales, significant sales that are imminent, and it's just about dotting the i's and crossing the t's. We've got a number of other exciting sales in the pipeline, and we expect with the launch of NextGen Stream with more partners and newer partners coming on board, this this positions us well to acquire new customers both in the remaining, weeks in this quarter and also in the quarter four and beyond.

13:46 What we can expect to see is increased, efficiency. So you'll see better results in the p and l. You'll also begin to see the fruits of our AI native marketing campaigns and also our our work with partners. Even going beyond that, we are we will be constantly evolving the product. So we'll be introducing, some some new product management initiatives where we we truly understand what the market needs and our ability to to rapidly build new products and evolve existing products will will show up in in the results, especially into into next year as we continually evolve the product. And this, you know, AI has revolutionized the the software space, and we're in good position to take advantage of that.

14:44 I will just provide a a real brief summary of what we talked about and some of the things that I find the most important. So I think it's important to remember that what we've done over the first six months of this year is greatly enhanced the profit profitability at ACUITY. So we are on track to become profitable by the end of the year on a month over month basis. We have we have significant opportunities in the pipeline, and our efforts to date, both in terms of the the AI marketing campaigns and our work with partners, will come to fruition in the in certainly in the quarters ahead. We are looking to further invest, and that will consist not only in terms of sales and marketing, but also developing the product to make it an AI native product.

15:40 And what we're looking to do ultimately is to develop a product that changes the way companies do cyber GRC. So there's a number of competitors out out there with with the cyber GRC space. Many of them are doing similar things. Our goals are we already have some differentiators, but our goal is to completely revolutionize the way cyber GRC is done. And the key element there being we wanna reduce the workload that our clients need to go through in order to comply with regulations, achieve certifications. And importantly, what these lead to is their ability to make sales and and and garner trust with their clients to say, we know that you are on top of your game, in terms of your risk management.

16:37 And therefore, we can provide our clients a competitive advantage against those that aren't using Stream, by way of providing assurance that they have it they're they have a handle on risk management. And we're looking not only to make incremental smaller improvements, but also change the way that it's done, which is now much more possible in this era of of AI. At this point, I will I will stop here, and I will open up the floor for for questions. That's Shall I Feel free, Angus. Go straight into the questions. Okay. So we have a number of interesting questions received.

17:25 If I read out the questions and then David can answer them, you've highlighted encouraging traction in the defense segment. Could this become a major growth vertical for ACUITY? And how quickly might we see that reflected in revenues? Yeah. I think the defense segment will has and will continue to form a strong base for our revenue so that there there is a base that is that is established and solid, and that base is continually growing. So we have a number of we we have, you know, in the defense and public sector, our clients are very sticky. They're sticking with us. They're very happy with us.

18:12 And we're also expanding our reach, especially within the UK government. So I think that will that will drive our results. I think to take the next step as an organization, we need to, we we need to attract some private clients, which we are which we are starting to do, but the the defense sector is really strong for us. Okay. I think we can't give you, exact proportions and, other data about h two because that would be giving a forecast, and and we can't give forecasts on on this format. Hi.

18:58 Do you expect to land material contracts in the near term? It's been a very tough year with no signs of anything significant to date. I think I'll handle this one, which is that we can't give that that information. But I can tell you, we are very busy, and we expect there to be news in the near term. So so are you still pressing sorry. Are you still pushing The US market? I've not seen any contracts landed to date in The US, which seems a huge market opportunity. Yeah. Absolutely. We are so our go to market strategy is based on harvesting fire intense signals across the web worldwide.

19:57 So we don't we don't necessarily constrain ourselves to The UK or Mainland Europe, and we certainly are looking to expand in The US. There's there are a couple exciting partnerships that are in the works that will provide us access to The US, particularly financial institutions in The US, where where, generally, the cyber GRC market is the strongest. So we've got some inroads already, and that's that is a a big focus for us. And I think you can we can start to deliver results, especially in in quarter four and certainly certainly beyond. K. Who would you say are your two main competitors?

20:45 Yeah. I mean, there's a number of competitors. I would say, Archer is a competitor. ServiceNow is a competitor. If if on a on a smaller scale, it's probably SureCloud. And in many cases, these competitors such as ServiceNow and Archer, they are they're not particularly suited to the cyber GRC market. They they they go after they they have larger, clunkier implementations, and they they can't provide that that focus and that knowledge of the client and those relationships that we can deliver. So I would say that would be the difference there. But those, yeah, those those three are probably somewhere are are probably our biggest competitors.

21:37 Okay. How much of your recurring revenues are from legacy clients, and what does client churn look like? Of the 3,800,000 in the pipeline, how much is at the final stage of contract negotiation versus the first stages? Yeah. I mean, I don't wanna go into an exact breakdown of the pipeline. It it would look too much like a prediction. I can say, you know, there are there are hundreds of thousands that is in the the near term pipeline is is what I'll say there. Terms of recurring revenue, yeah, with the change of focus and restructuring, there is there there is some churn.

22:24 It's it's not a huge amount. I think as we evolve as an organization, we are now much more clear on which clients would benefit from from our services and our and our tool. So there will be naturally be some be some changeover, but we we are very confident in our go to market engine that will deliver results, for clients that that are are right for us and that we're right for them and that we will establish long term relationships with them. Question. We are seeing cyber attacks pretty much weekly. Why are we not seeing a huge uptick in contracts at ACUITY?

23:13 Yeah. There certainly are cyber attacks weekly. I think it's a number of things we need to get our message out there, and we've only you know, we we we spent the early part of this year refining the message. Now we need to to promote ourselves even a bit further. And we we need so a, we need our our partners to to come on board and recognize all the changes that that we've made. And in fact, we we have with one particular partner. So we've got CGI and and was on a call with them yesterday, and they they they noticed how much more engaged we are and how much more willing we are to work with them to enable them. So, those things take time, but we are we are very well positioned, especially in terms of also, in terms of the launch of the vendor management hub, which which really was only, a couple months ago.

24:14 And and and, yes, now we're seeing a lot of incidents with third party risk management breaches, and vendor management hub is a good way to get started. So I think I would expect to see an uptick in demand, for our services in in, you know, the quarter and, in the months ahead. Yeah. It's it's natural, but we need to promote ourselves a a bit better and get the word out a bit more. K. Please explain about the new product, the vendor management hub. I think, really, what what's it do? Why is it it it it's special? Yeah. So the the vendor management hub, the I guess, the the the best thing about it is its simplicity and its ease of use.

25:04 So this is something that we created, you know, in in from idea to launch in a matter of months. And this this it really goes back to when we acquired Rizicon. We saw what they were doing. We saw that there is a market for it. They were a bit scattered in terms of their their strategy. They didn't know quite where they should expand. For us, we wanted to make a simple tool that allows clients to manage all their third party vendors in one place so they can they can see exactly which suppliers represent the greatest risk because they can see this this particular supplier is critical. They have access to critical data and they, based on the security questionnaires that we send out to them, they have a high risk. So there's a high potential for for breach.

26:02 So they know out of all their hundreds of suppliers or even thousands of suppliers, we need to work with this group of, let's say, 10 to ensure that their their security protocols are strengthened. And I think given the amount of spreadsheets that are that are being sent out for security questionnaires, there's there's there's no way those clients have an organized view of their suppliers, which ones represent the greatest risk, and what they need to focus on next. And that's what that's what we that's what we help them accomplish. With all these new regulations coming into in into effect and all these new ways of cyber breaches, we can help them develop new questionnaires, add to their questionnaires quickly, and therefore, understand where where where suppliers which suppliers represent the greatest risk and and where.

27:06 Okay. Artificial intelligence, how does that impact ACUITY, and are we taking artificial intelligence and using it at ACUITY? Yes. We are. So we are developing ways to ingest real time threat data into the system, match it up with the controls that should be in place, and and basically giving clients a real time view of their risk situation. So are they do they have weaknesses? Do they not have weaknesses?

27:53 Which initiatives do they need to invest in to most greatly reduce their risk? So I think that's where we are, in the very near term. In the more medium term, we are looking at creating an AI native product that completely reimagines CyberGRC. So, you know, just to give you an example, we are looking to develop the ability to so supply customers generally ask their suppliers to fill out, security related questionnaires. We're looking at the ability for just ingesting all of their policies and understanding, all of their architecture and being able to just automatically answer these security questionnaires, which is a massive time saving.

28:46 And, it it makes sure that we are answering the the these security questions in a way that that is that is optimal, helping you to actually win business. So there's there's a number of areas that we're that we will be looking at, but, certainly, AI is is in the top, you know, at the top of our mind in terms of how we build the product in addition to how we we do marketing and and understand where buyer intent is. K. Short question. Are you satisfied with progress to date? I'll answer that by saying it's very hard for me to be satisfied. And so I'm satisfied when I zoom out at progress and but I will never be satisfied until, you know, we are the go to CyberGRC software company that completely revolutionizes where where CyberGRC is going. So, yeah, bit of a mixed answer there.

29:57 Yes from an outside in view. No from because I'm just never satisfied. Okay. Here's a question probably for me, which is, are you planning to do any other PR for investors using other outlets? The answer is yes. We need now to tell more people the story and the opportunity relating to ACUITY. Until David joined, it was the future was rather uncertain. I don't mean that we hadn't got a future, but but what we were doing and where we were going was uncertain. We're not much more certain now, and that confidence can come and be shown to potential investors as well as existing investors. So, yes, there will be more, and that that should be coming in in the relatively near future.

31:04 Question. Another one for me. Angus, are you looking at further acquisitions much like the £15,000 one RizziCon that was? Dave just talked a little bit about RizziCon. We are looking at further acquisitions, but we haven't found one which matches our opportunity well enough recently. And we are focused currently on building the business organically. If we can find acquisitions, yes, we will do them because that would accelerate our growth. Can you give us an idea on ACV for the legacy products and for the new, David?

31:53 Yeah. Give us an idea on So, yeah, ACV for the legacy product, the new. Yeah. I would say that, you know, we are in its infancy in terms of the the vendor management hub. You know, we've won three clients already. They are they are small smaller clients. We haven't been able to announce them, but they they do show that there is, there is a need out there and that we, that we've we we fit that need. I think Stream will continue to be the main driver of our of our ACV. But I think the vendor management hub has has potential to, to deliver a a significant amount of results faster.

32:46 So I think yeah. That I see sort of providing us some funding in the in the near term and and STREAM as it develops And as we make it AI native, more, you know, product led growth ready, then I can see that, you know, driving, the majority of our of our ACV. What is happening with the STORM product with government legislation covering this, it seemed like, a good second revenue stream to add alongside stream? Shall I answer that? We're we're now very much focused on cybersecurity, and focus is important to achieve maximum returns. So storm, whilst it's interesting, is not a major focus for us at the moment. Would you agree with that, David?

33:42 Yes. Yeah. Yeah. I think the key with with software is to not spread yourself too thin, you know, especially in an organization of our size. We we need to concentrate our funding and our energy and resources, and that's that's why there is this focus. You know, it's tempting to say, oh, we'll just launch, you know, a bunch of new products, and they'll all bring in a little bit. But the reality is that's that's not how you you win in the software world these days. Okay. I think this is appears to be the last question. Are you still receiving approaches to acquire ACUITY? I think it goes on to say that I had mentioned previously that we've had 40 approaches.

34:32 The answer is we do continue to receive approaches, both new ones and from existing inquirers. It is our belief that we can grow the business and add significant value for shareholders in the shorts to medium term before we sell it. But we have something which is very, very interesting to our competitors and to others who are interested in this sector. So we will continue to field potential acquirers. And one of the possible end results for this business is to be acquired.

35:20 There's just one question I I think we might have missed that is probably worth addressing, which says you already serve government, defense, utilities, and health care. Which sectors do you see offering the strongest growth opportunities in the next few years? And what I would say is the ones you mentioned are quite prominent in our plans. I would say the the other one that I would put in there are financial institutions and particularly banks. So this is where to to get into to get into the banks, it's very helpful to have a partner who's already in there. So for consultancies that are that are delivering cybersecurity services to banks, we're talking to a couple of them to to have Stream serve as the base of their offering.

36:15 And I think that's that's a particularly strong sector, especially in The US. Okay. That's great. Angus, David, if I may just jump back in there, I believe you have covered a lot of ground there. And, of course, all the questions that we received today, the company can review, and we'll publish those responses on the investor meet company platform. David, before I redirect investors to provide you with their feedback, which in this particular important to the company, could I please just ask you for a few closing comments? Sure. Thank you very much for attending. It's been my pleasure to speak to you. I welcome you to to reach out on LinkedIn or, yeah, in in whatever format, and, you know, I'm more than happy to to discuss ACUITY.

37:02 So thank you all for attending. I think the future is is quite bright for us, and and we're certainly moving in the right direction. But thank you for attending. That's great, David. Angus, thank you once again for updating investors today. Could I please ask investors not to close this session as you will now be automatically redirected to provide your feedback in order that the Board can better understand your views and expectations? This will only take a few moments to complete, and I'm sure will be greatly valued by the company. On behalf of the management team of ACUITY RM GROUP PLC, we would like to thank you for attending today's presentation, and good morning to you all.