Intercede Group (LSE:IGP) — Interim Results

0:01 Good afternoon, ladies and gentlemen, and welcome to the INTERCEDE GROUP PLC Interim Results Investor Presentation. Throughout this presentation, investors will be in listen only mode. Questions are encouraged and could be submitted at any time via the Q and A tab situated on the right hand corner of your screen. Simply type in your question and press send. The company may not be in a position to answer every question it receives during the meeting itself. However, the company will review all questions submitted today and publish responses where it's appropriate to do so. These will be available via your investment company dashboard, and we'll notify you by email when these are ready for your review.

0:33 I'd also like to remind you that today's presentation is being recorded. But before we begin, I'd like to submit the following poll. I'd now like to hand you over to Claus de Liszt, CEO. Good afternoon to you. Thank you, Alessandro, and good afternoon, everyone. My name is Clas Van de Liszt. I'm the CEO for INTERCEDE. I'd like to welcome both existing investors as well as potentially new private investors to this session, and we'll cover our interim results presentation for the period April 1 till the end of September. During this session, I'm joined by Andy Walker, who's our CFO, and Ellen Story, who's our chief product officer. Whilst the presentation is clearly us presenting to you, we do look forward to your questions, but also your feedback after the session. So without further ado, let's start with the presentation, which will provide an update on the last six months as well as an insight into the market we operate and how we're expanding our target account market through additional features and functionality in the MyID platform.

1:30 Very high level, there's four sections. We'll start with the interim results, which we follow-up by the INTERCEDE markets and solutions. So I'll provide a bit more color on the markets we operate in and more importantly, how we position our online deep platform. Wrap up with summary and outlook, and then we will deal with any q and a that you wish to wish to see answered. So very high level summary highlights. I think pretty pretty respectable financial performance. Revenue was up 9% on constant currency. We have increased profit for the period, and we strengthened the balance balance sheet predominantly on the back of the retirement of the loan note earlier this year.

2:21 We continue with good operational progress. We've had really good strong progress in the product development side. You know, we've added net new functionality, particularly in our v 12 platform, which was launched in April this year, and we now see clients moving onto this new platform using Fido and mobile authentication functionality. Alan, our chief product officer, will provide a lot more color around Fido and mobile authentication, and we also aim to show you one or two use cases for clients who've started to use this. From an outlook perspective, we remain confident in the outturn for the full year. I'll skip through this. And then at very high level, you know, we're based in in The U headquartered out of The UK in Letterworth.

3:12 We've been listed on AIM since 2001. We have around 85 employees, 85 colleagues, 75 are based in Letterworth, and we have a sales and delivery office just outside of Washington in Reston with 10 staff. We are a leading software provider in strong authentication. Our platform is labeled as MyID and what it does if, in effect, it prevents data breach. We have a a very strong client base, spread across a number of, of continents. We're very heavily geared towards The US market. There's some very good reasons for that, and, again, we'll explain that. I joined just over three years ago as part of a a turnaround. And in those three years, we've shown progressive revenue growth, profitability, and cash.

4:02 What we've also done at the same time is really grow our annual recurring revenue, and that currently covers just over 60% of our existing revenues, and that's accompanied by very low attrition. So clients are very, very sticky. We're now realistically in phase two of the business, and what we want to do is far more aggressive expansion through both organic and inorganic growth. So let's look at what's happened over the last six months. The goal from the board going back just over three years ago was very, very clear. Plus, get us back to sustained revenue growth and profitability, and we've delivered that over the last three and a half years. It's coupled with a strong recurring revenue growth, but also a good solid range of repeatable revenue. Repeatable revenue we describe as any professional services we do for existing clients and potential new clients.

4:54 Cash is good. Cash has really developed over the last couple of years. We reported 8,500,000 at the end of the reporting period, and we're currently debt free. Yes. We've seen some currency headwinds, but if we normalize for that, we're showing 9% growth, which we think is is good in the current climate. That's very much underpinned by good set of new client wins, for eight new clients in the half, spread from The UK, US, Latin America, and they're all driving revenue in in the year. So that's very much the organic side. Since the June 1, we've report appointed a very experienced head of corporate development. He's very quickly whipped us into shape. He set the ground running. We've got a clear set of defined strategic priorities.

5:42 For those who've listened to our updates before, you will recall that we very much talk about the authentication pyramid where you have weak authentication at the bottom, very strong authentication, at the top. We very much play in that top end. From an m and a

5:57 perspective, we're really looking to strengthen in that middle part of the, the pyramid. And, this will become clearer in Alan's update. We're very much dealing with this in exactly the same way as we do with any sales opportunity. We put the potential targets in the long list, in the funnel. We qualify them. We create a shortlist, and we start engagement. From a road map perspective, it's very much client and partner driven. So we're listening to the market. We're listening to the partners. We're listening to the clients and then decide what we're gonna release. We've moved our whole release schedule from what was traditionally very much a waterfall approach into more an agile delivery. We make quarterly updates at the moment, which means that the clients can see constant incremental releases going forward.

6:47 Internally, but also externally, we we talk about our five c's, colleagues, code, customers, channel, and and cash. We clearly couldn't do any of of of the results we're publishing without our colleagues, and we stay pretty, pretty close to them. We're a close knit community. As I said, we have 85 people in in two physical locations. We poll them every year through an employee survey, and we measure employee net promoter score, which remains very, very positive. Ninety six percent of staff actually completed the survey, so we have very high overall engagement. COVID wise, we were very early on last year in getting the staff to work remotely. We jumped the gun. We wanted to make sure that we could make all the key deliverables in March last year. And to be honest, we've been predominantly remote all throughout that period. We're currently back in the office one one day a week.

7:37 We really want to start, some increased levels of collaboration. Already talked about the appointment of a head of corporate development. So from a code perspective, I I strongly believe we write the best code in our part of the industry. We have one platform. It's called MyID, and it's got three different versions based on the same code depending on which market segment we're addressing. We've added new functionality.

8:02 And in the past, we were very much into heavy customization. Now we tend to move far more towards low code or no code configuration, which is typically API driven. So it's relatively straightforward to integrate with other applications nowadays, and we actively make use of that. Customers are very much at the heart of what we do. Alan drives the client advisory board every year. We've just run them both here in rest of world as well as North America in October and November. Very high attendance. Yes. It's all virtual nowadays, which on the one hand is unfortunate. On the other hand, it drives incremental attendance, and that's really, really good because people simply don't have to travel. We use that input in developing the pipeline.

8:52 So I think we help to develop that that input to drive the road map, and our customers are actively deciding on the development of the road map going forward. We see a lot of customers currently upgrading to our latest release. Main release was was April this year, and we actively see customers upgrading, which is good. Our pipeline remains strong, so we have confidence in that. And I already talked about very low levels of revenue attrition. It's significantly below 2%. Channel is very much center to the story as well. We decided three years ago, we would go down the indirect route, build up the channel. We've got a dedicated connect partner program. We have dedicated staff on that, and it's got two main pillars. One pillar is the technology partnerships.

9:44 So it's those technologies either in hardware or software we need to integrate with and to in order to build an end to end relationship. And then on the other hand, we have the channel relationships. They take the end to end solution to market. So they're typically the primes that the large system integrators. What we've seen in the last six to twelve months is more and more of our partners, they now want to offer a managed service around our solution, which is good for us because it addresses typically a new market segment. And we see now many service offerings both in The US as well as here in Europe. Cash has been king. Three years ago, we were rapidly running out of cash. Today, we're reporting 8,500,000, and we'll continue to make good progress. Andy, our CFO, will provide more color around that. And in order to support our m and a activity, we've got a revolving facility agreed in principle. So at this stage, I hand over to Andy.

10:40 Thank you, Klaus. So I'll start by providing a high level summary of the key numbers. You'll see that year on year revenue is up 2% in absolute terms, but as Klaus has already said, the underlying performance is more encouraging. It was 9% higher on a constant currency basis, which reflects primarily the impact of the US dollar with circa 90% of our revenues being dollar denominated, not just North America, not just The US, also parts of the world like Singapore and The Middle East, we invoice in dollars. As regards profit for the half year, we are profitable again at all levels. Operating profit and EBITDA are slightly down on the prior year, which reflects increased operating expenses.

11:29 Most of our ex operating expenses, 80% plus, relate to staff costs and with the annual pay review, the April 1, being primarily responsible for the increase there. The profit for the period, on the other hand, has continued to increase, which reflects the benefit from us having successfully retired the convertible loan notes in February of this year. And that saves us £400,000 a year, which has also helped with the cash balances and the increase to 8,500,000 that Klaus referred to. Worth mentioning that we have made another successful r and d claim, similar value to last year. The difference being that the 400,000 plus this year was collected or received from the revenue in October, whereas last year, it had already been received and was reflected in the end of September number.

12:23 So another good result there in terms of the r and d claim that was available. Moving on to the next slide. Wanted to provide a summary of the performance over the last four years since CLAS joined in April 18. This also effectively reflects the impact of the phase one turnaround and the strong platform that that has created for INTERCEDE for phase two of our strategic development. So of the the different areas on revenue, already talked about the impact of currency, but I think by showing the split of the revenues over the last first four, first half years between The Americas and the rest of world, you can see what the impact of COVID has been.

13:17 We've continued to drive revenues in The US where as an economy, they've probably been most successful in keeping things operating as usual, less so in other parts of the world, most notably Europe and Middle East. And you can see the impact over the last two first halves on our revenues, circa 500,000, indicatively down as a result of that even before we get on to consider what the revenues might have been as a result of other initiatives such as the connect partner program. On profitability, then you can see the benefit year on year on year of the turnaround from phase one.

14:04 And the comment I'd make there is our target for accelerated revenue growth from phase two and the potential benefit to bottom line due to the very high operational gearing that we have as a company with development of our own software and very high margins in 98% plus level. On the balance sheet, we're much strengthened primarily focusing on cash. Over the four years, you can see that class having inherited a 5,000,000 convertible substantial turnaround over the last twelve months, having removed debt and continue to increase cash balances. That convertible loan note retirement also worth noting that 12 out of 13 loan note holders chose to convert to equity, and therefore, the balance sheet is much stronger in that respect as well.

15:01 So I will hand you back now to Claus and to Alan who will provide more detail about phase two and our plans to both in terms of the market and in terms of our technology.

15:16 Thank you, Andy. So Alan and I will split this this part where I will talk about the market we operate in. Alan will then take over about the solutions we're providing into the market, how we're positioning both where we've been in the past, but also how we position going forward. So if we look at the market we're operating in, ultimately, INTERCEDE is a player in the wider identity and access management space, that outside ring there. And, you know, that market ultimately is is crowd crowded by players like ForgeDrop and SalesPoint and Oracle and Microsoft and Okta. It's a it's a huge multibillion dollar market. But if we focus in a little bit and go to the center, the the second circle, we come closer to the market that we operate in, which is the the wider authentication market, also referred to as multifactor authentication market.

16:09 Within that market, INTERCEDE has focused on the center of this this diagram, the CMS market, the credential management solution market, or typically referred to as the PKI market. That in that market, we've built up our credibility. A market we know incredibly well. We've operated in that market for the last twenty years. We build up a phenomenal client base, very recognizable. I always talk about INTERCEDE as a small company based out of Luttwelveworth that's got this phenomenal client base that that really is impressive for the the shape and size and and and business that we are. But what we can also see is that that whole CMS market is significantly smaller than the the MFA market that ultimately it it's it's a constituent

16:56 part of. So for the last two years, Alan has worked really, really hard with the product side to say, hey. What can we do to break out of our core space and take bigger slice of that wider MFA

17:07 market? So since April, we've added net new functionality, which allows us to come out of the the core PKI market and then scale out. So we've added FIDO. We've added mobile ID or mobile authentication, and that basically enables us to take advantage of a much increased target account market. What I'm not saying is that we can cover the entire middle circle, but we can definitely cover much more than the traditional market we've been operating in. So this is really a market overview. If we then see what the drivers are in these markets, we can pretty much categorize them in in two specific sections. The top half is the regulatory drivers. The bottom half is the business drivers. Regulation is really good for INTERCEDE. If we look at specific regulations that we see a lot in The US, there are regulations like FIPS two zero one.

17:59 FIPS two zero one is very much dedicated to the federal market and the markets that are associated with the federal space. So, typically, there are defense and aerospace players, but also the contractors supplying into that industry. FIPS two zero one first was launched in 2006, and INTERCEDE was the first

18:17 software platform compliant with that standard. So that's very much an explanation as you as to why you see the client base we've got in North America in in the federal space and the defense and aerospace market. So specific regulations, really good for us. We then have more generic regulations like Critus for critical infrastructure, HIPAA, for instance, for for health care. Health care is an interesting market. Clearly, there's lots of PII, personal identifiable information going around, but also health records. And, clearly, the companies

18:48 who deal with these records want to protect them to the highest possible standard, and there are some very clear guidelines on how to achieve that. There have been examples in The US market of some large data breaches in the health care space, which in turn has been good for INTERCEDE. You'll see if you dive into our client base, and Alan, again, will show you

19:07 a sample of that, that there are some really good examples of health care companies that we cover. Then we have, you know, even more generic regulations like GDPR and. Obviously, they are significantly less prescriptive in our space, but typically talk about best practice, and it's something our software platform can help to achieve. The third part here is this move towards zero trust. If we go back five, ten years ago, most companies would protect themselves on the edge of their network and say as long as we can keep the bad guys on the outside of the edge, then we're perfectly fine. Well, the world has changed, and and the zero trust model that everybody is trying to talk about is very much focusing on the fact that even if people are on the network, we wanna make sure that we authenticate them from time to time to make sure we keep control about what these individuals are doing. So that's regulation.

19:58 The bottom half is all about business drivers. Now corporate embarrassments about any hacks taking place at the moment, they're common news. We see them on a week by week basis, and SolarWinds is just one example.

20:10 The second driver which really helps in our space is this move towards remote working, predominantly driven on the back of the pandemic. It means that a lot of people, and there's probably quite a few on the call here that are persistently working remotely or away from an office environment, which means you're not on the corporate network anymore. A lot of these connections typically don't go through VPN, so these connections are more susceptible to being hacked or at least breached. The final point here is this move away

20:42 from passwords. Passwords are simply not secure, and more and more companies are getting to realize this and starting to move away from passwords. But then, you know, how do we do that? And, again, that will become clear in the follow-up after this this immediate section. How do we position in the market? As I described before, we have one code base and one code base with three different versions of the product. MyD enterprise is exactly what it is. It's an enterprise version. It's feature rich and very much focused on the the white part in the diagram. When we look at the the FIPS regulations, we need to bolt on some functionality to MyID enterprise, and we created the MyID PIF version. And, you know, in the diagram, it's clear that's positioned towards the federal government market and the defense and aerospace players as well as the contractors who supply into that industry.

21:35 And then the third version is MyD professional. It's actually the same as MyD enterprise, but then we've reduced functionality a little bit, and that's very much our play into mid market enterprise. So we talked about the markets. We talked about the market we operate in. We talked about the drivers in the market. So what does that actually mean? Because there is some structural change happening in the market, and it's probably happening faster now than it's ever done before. So the world is moving towards password less and passwords are dead. Now, clearly, it's gonna take a little while before all the passwords are gone, but the move towards passwordless for us is important. It means that companies, federal departments need to move to much stronger forms of

22:18 authentication. We believe we're well placed to exploit this because on the one hand, we continue to develop the product by adding that new functionality, and we bring that functionality into our channel who in turn take that to market. From an inorganic perspective, you know, we talked about that pyramid. We're looking for strategic acquisitions that we can bolt on particularly in that middle space of the pyramid in order for in order for us to take a wider product portfolio and, in effect, serve more clients. Clearly, this is all interesting, but what does that mean for your existing product? Can you continue to defend what you've got? Our core market is very much a niche market that we've already described. It's got scarce PKI resources that are difficult to replicate.

23:04 We've invested over a thousand man years into the platform, so anybody who wants to have a go with this needs to invest quite heavily. It's coupled with a very strong client base. Our clients stay with us five, ten, fifteen years. We have now client a single client who's actually renewed for the twenty first time.

23:22 Our investment cycles can be long. Yes. They can be six to twelve months because it's complicated stuff we do. What we do know, once these clients are in production, this is very, very sticky. Again, presented in a different in a different kind of context in our attrition. Our attrition is incredibly low. Anybody who wants to have a go at this this market will very quickly realize that there are a large number of third party hardware and software integration, which are difficult to achieve. And, you know, we build up that credibility. So the market, the drivers, how we position,

23:58 and then, you know, we're very capable of defending our our current position. But, clearly, we wanna break out that core PKI space into that much wider multifactor authentication market. At this stage, I hand over to Alan. Over to you. K. Thank you, Flas. So I'm gonna take a look at what the product does, who buys it today, and what we've been doing to that product to enable us to sell more of it to a wider range of customers. So MyID today helps you protect against data breach. That could be reputational damage, so people like Yahoo who were breached in the process of being sold to Verizon, people like British Airways who were fined 22,000,000 by the ICO under GDPR, and more recently, Colonial Pipeline

24:44 who had to pay $5,000,000 to the ransomware vendor to get their systems back. But while the systems were down, had a significant impact on business continuity, they couldn't actually deliver their products to market. The number one cause of data breach is weak credentials. So credential being how a user authenticates into that system. So the place people start is to look at putting stronger authentication into their systems. This is the authentication pyramid that Klaus referred to. We have weak authentication down the bottom, passwords, stronger authentication towards the top. So with a weaker authentication, it's easily stolen, it's easily compromised, it's easily reused. The closer you get to the top, the harder it is to break in and compromise that credential.

25:32 Therefore, the more secure, the more protected you are against data breach. Historically, our product has played right at the top of this pyramid. So the people at that end, as you see from our customer base,

25:43 are the people who have a lot to protect. They have to comply with specific regulations. So they're driven to use that gold standard of security, which is PKI. The reason PKI is secure is it has a private key. It's based on cryptography. That private key is typically generated and stored on a secure device such as a smart card or a USB token, and it never leaves that device. So it can't be compromised. It can't be stolen. Associated with that is a public key which is bound in a certificate to the person. All I can do with that public key is verify that that signature by the private key happened by that person. So if somebody sends me a digitally signed email, for example, I can verify that with the public key, but I can't recreate that.

26:30 And that's how strong authentication works. You authenticate to a system, you are sure that the person with that particular device and with the ability to unlock that device, for example, with a PIN, was the person actually logging on. So that's why it's seen as the the gold standard security for the the highest security organizations. To deploy those digital identities, those PKI based digital identities is quite complex. You need to be able to integrate with sources of user data, directories, solutions like SailPoint. You may need to deal with biometrics, facial biometrics, etcetera. You need to communicate with the devices themselves. There's a lot of security, a lot of key management, secure channels to devices. There's no point having a secure credential if it was issued by an insecure system. So people have to trust the systems that issued these.

27:21 People with mobile device management systems, for example, Microsoft Intune, VMware AirWatch, you need to integrate with those. There's a lot of security processes and policies. So when a new person is onboarded in the organization, do they get issued a credential face to face? Are they a remote worker? Does it need authorizing by their line manager? Do contractors get a different credential to an employee? Do people working in finance get a digital signing credential for authorizing transactions, for example? We need to manage that life cycle of them. So this this is very complex to do. To actually achieve that, MyID integrates lots of different technologies together. So on the left hand side here, we have an example of some of our technology partners. So these are people who produce those secure devices, PKI tokens, smart cards, Baidu security keys, people who provide the certificate authorities for the PKI and trust Verizon Digicert, PrimeKey, for example, people who make the mobile platforms and the operating systems, So Google, Apple, VMware, Airwatch.

28:24 And then a number of applications that we need to integrate with, be they identity governance solutions such as SailPoint or digital sign in such as Sineas. So this technology we integrate together. On the right hand side, we have people who take our product to market, and there is an overlap here. Some people do both. So some of those integration and reseller partners, the large players like Accenture and Guidehouse, they will take our product and they will provide program management, additional software, additional services, deliver a deliver a large scale government deployment. Others such as WidePoint and CertiPath provide managed services around our product. So they will use an instance of MyID to manage multiple typically smaller customers from a single solution. Others actually add our product into their own security offerings to add value around it. For example, some of the digital signing services use our product to authenticate in to that central signing solution.

29:24 And that's really what MyID is designed to do. It helps you deploy those highly secure PKI digital identities at scale across your organization. The sorts of people who use that today, class talked about specific regulation, FIPS two zero one in The US. That states you have to use a PKI based identity. So a number of people on the top there are US government agencies who are mandated to use a technology like ours. So people who look after US citizen data, port workers traveling into The US where we've issued over four and a half million identities, people about planes land, people who track nuclear material, people look after the centers. So very high security requirements there. Some of the government examples there in The UK, the Kuwait National ID, where we've also issued one and a half million mobile IDs to citizens, the driving license agency.

30:18 So governments are looking at the highest level of security. The next level down are suppliers into those governments who also need to follow the regulations. So they typically, have to comply with certain technology standards and levels of authentication. Below that, we have people in the more generic regulation space. So for example, UnitedHealthcare, very large health provider in The US, they have to comply with things like HIPAA, which says you must protect your patient's data, private patient data, but they don't specify the particular technology you need to use to do that. So the pattern here is traditionally very large customers and very sticky customers stay within SEED for a long time. But we see things changing. And I just wanted to touch on why we see things changing and why we think this is the right time to change the product.

31:10 FIPS two zero one in The US was that directive that stated that everybody in the US government has to have a digital identity and it has to be PKI. That was out back in 2006, and that's driven a lot of our business. That's now changing. There were three things that are pushing that to change. First one was the office of management and budget, OMP, issued a memorandum saying, now the pandemic's kicked in and lots of workers are working from home. We know it's difficult to do PKI at home. You might not have a smart card reader in your laptop. You might not be using a work device. You could be using your own device, and that's difficult for people to deploy software to when it's not on the network. So you can use other forms of authentication, but try to keep them as secure as you can.

31:58 Next one down, CMMC. This is cybersecurity maturity model. So this is pushing the regulations from government down the supply chain. Federal government agencies can now write into the contracts that any supplier to government must have a certain level of cybersecurity maturity, and that does specify the strong authentication that you can use. SP under one seven one or one seven two, the entire FIPS two zero one regulation is broken up into different parts. Those parts are called SPs, special publications. This particular one dictates control of information outside of a federal government system, I e, in the end, supplier system. And, again, this states you have to use strong authentication, and it dictates which ones are seen as secure.

32:45 Interestingly, their one time passwords of their SMS are no longer seen as secure. The president Biden administration pushed out an executive order, which really is a precursor to where the regulation goes, stating all agencies must use multifactor authentication or strong authentication. Those terms are interchangeable to the maximum extent possible within federal law. Now that all those three together are not regulation. FIPS two zero one dash three, the third variant of this, is regulation. That's been in draft review for the last twelve months, and we didn't put into that. The person who authored that actually spoke at our customer advisory board, which which was excellent. That is likely to get ratified within the next two to three months. It's difficult to predict how fast the government will move under the current circumstances, but that's historically been the time it's taken once it's been submitted.

33:42 Ratified means it becomes regulation, so people have to then comply with it. Organizations typically have twelve months to become compliant with it. But as soon as it becomes ratified, they all start looking at what they need to do. What we found today is that those government agencies and aerospace and defense contractors and suppliers into government have all rolled out PKI because they had to, but only for part of their estate, for the highest security part of their estate. Outside of that, it's difficult to roll out PKI. So they've started to look at other solutions such as one time passwords, but those are no longer necessarily secure enough. FIDO, a new standard I'll talk about in a minute, is secure enough and is stated as being secure in those, rules and regulations.

34:28 So a number of those organ organizations are starting to look at how do I move up that pyramid in terms of the security for the areas that currently weren't covered by that. The other thing we're starting to see is a concept you'll probably see on the in the security market called an unphishable credential. So how can I use a credential that can't be stolen? The password can be stolen and reused. If you get sent a one time code to your phone, that can also get stolen and reused. As you start to move up the pyramid towards credentials based on cryptography, they're far, far harder to steal and be reused, so they're treated as credentials that cannot be phished. So we're starting to see demand for people wanting to move down that pyramid and also move up. Just wanted to touch briefly on what FIDO is before using a couple of case studies to explain what we've been doing with the product here.

35:21 So FIDO stands for faster identity online. It's very consumer focused initially. So it was started by PayPal, and their business model was don't put payment processing into your application, hand it over to us. We'll take care of the security. But importantly, we'll give the end user a frictionless experience because their message was very much transactions have been dropped partway through because people didn't have the bank card or the reader they needed to authorize that transaction. The way they're making it frictionless is by making this an industry standard. So Fido is now an international standard, meaning it's baked into browsers, it's baked into devices. So your Android phone or your iPhone just understands Fido out the box without having to have any software deployed to it.

36:08 FIDO is based on a private public keypad like PKI, which is good. It uses that cryptography level of security, so it puts it up towards the top of the pyramid. But it's fundamentally different to PKI. PKI has a certificate that binds the keys to a person. Fido doesn't. When I log on to my bank, my bank will say, Alan, next time you log on, do you want to use a Fido key? So it will generate a private key on my device. If I do the same for my ecommerce provider, I get another key. My network provider, I get another key. And that works well in the consumer space. I don't want my ecommerce provider knowing anything about my banking credentials. But that's not how enterprises work. Enterprises want one person to have a digital identity, and that digital identity can access multiple applications.

36:56 They want don't want 20 credentials to manage for 20 different applications in the business. So what we've been doing is making MyID make FIDO work in the enterprise space. We're not being another me too player in the FIDO consumer space. We're very much focused on our background and our strengths. The last twenty years, we've been putting credential management capabilities into the product for PKI. We're bringing those to the world of FIDO. So we can issue a credential to a person. We know who that person is. The organization is in control of that issuance policy. Remote workers may get FIDO keys. They've got the life cycle management. They've lost it. They've stolen it. They've forgotten it. When Sarbanes Oxley come in for an audit and see how are you, who can access your systems, you can run all that information from my ID. You know who's got what credentials.

37:48 So that's really where we've been taking the product in this space to capitalize on the the changes in the regulation, but also importantly to make FIDO relevant to the enterprise. So I'm just gonna touch on a couple of case studies here for early adopter customers who are starting to use this technology. So I think it's the best way of explaining the problems we solve. So the first one here is an existing customer using MyID, large multinational and resource extraction organization. They buy very expensive pieces of equipment and distribute them around the world, like the device you can see on the right there in the picture. They wanna make sure the right pieces of equipment get to the right place. So they did that by using PKI smart cards at the desktop. So their SAP system that control these purchases, people will put a smart card in. They digitally authorize that transaction. It will get approved and it will get processed.

38:43 Then the pandemic kicked in. I mean, Europe, everybody started to work from home, and it was therefore difficult to use PKI. People didn't have smart card readers in their home desktops. They couldn't deploy the software over the Internet to those devices. They needed to make the work with PKI. They also wanted to use mobile devices here. So is there a way I could actually get somebody to do this from their phone or their iPad? Then they have much more flexibility of how they sign these transactions. So what we deployed here is our mobile app. We'd added mobile ID into the capability. This is PKR based, so it's secure. But because the phone has that Internet connection baked in, we could deploy those credentials directly to it. We also used our APIs to allow the SAP system to pass information into MyID that needs authorizing.

39:34 We used our toolkit to do that. So that was a zero code, low code approach. We didn't have to get developers to do that. You could configure what data's passed in. So that data gets passed into the app. It's then displayed to the person holding that phone. To authorize that transaction, they have to access the private key on the phone. To do that, we can support a PIN, we can support face ID, we can support fingerprint. So that gives the user that very simple experience of simply touching the finger to the phone to authorize that transaction. Under the hub though, it's doing a PKI transaction. So we're using the private key to digitally sign that transaction, pass it back to MyID. MyID will authorize that transaction, validate it using the public key, and then pass the result back to the SAP system that will perform the operation.

40:22 So just to give you an idea of what that looks like, SAP sent an instruction to MyID that requires something authorizing. MyID knows who has which particular device and what credentials so this can push this out to their phone. That's an encrypted message. So unlike OTP over SMS, that can't be compromised. Person taps that message. That then displays within our mobile app the data of the transaction that needs authorizing. The end user can then reject that or approve it. If they approve it, configurable by policy, we will ask for a PIN, a face ID, or a fingerprint that unlocks the private key, digitally signs that transaction, sends it back to MyID. MyID validates that transaction and then passes it back to SAP that processes and approves the transaction.

41:12 So very simple experience for the end users, nice and easy to use, and very flexible for the end organization. All they need to do is download a simple app, and they, in effect, have the security level of a smart card and a desktop but in the end user's hand. Next use case I wanted to touch on is in the world of FIDO. So this hopefully explains why we think PK and FIDO actually solve different problems in the organization. So this is a North American mobile network operator. They have two types of environment. They have the back office, and then they have the front office, which is the stores that are customer facing. In the back office, they'd already used MyID to deploy PKI to their employees to access networks and applications.

41:59 They did this on a USB token, which happens to be YubiKey. When those people go into the stores, they don't have desktop PCs with them. They happen to use whatever devices in the store. Those devices in the stores are not on the corporate network, so you can't push software out to them. It also might be a shared device, so you could literally get an iPad out of the box and need to use it to access a back end application. But they really needed to know who the people were accessing these applications. And this is where FIDO comes in. So because FIDO is built into the devices, devices like iPads and browsers like Chrome and Edge and Firefox understand and work with FIDO. So if I take my, in this case, my USB token, my YubiKey, and tap it to an iPad over NFC, it will already understand FIDO without me having to deploy software to it.

42:51 So MyID and the devices that we're using, YubiKey supported PKI and FIDO. MyID supports PKI and FIDO. So to the devices we'd already deployed PKI credentials, we also deployed FIDO credentials. Just gonna pause there because that's unique. We are the only system on the market today that can deal with PKI and FIDO. We also integrated with our existing applications using standard protocols. OpenID Connect is a very simple way to connect applications into authentication servers. So we use that to connect the Salesforce system into MyID so we can provide identity services to it. MyID acts as a FIDO two authentication server. We're a certified FIDO two server. We're on the FIDO aligned certified product list.

43:38 And importantly, we can deploy, manage, and use credentials in this environment without having to put any software onto the end client. It's all server side, which makes it very easy to manage. So walking through the example here, here we have an iPad that's just been taken off the shelf. No software deployed to it in advance. We have the the worker come into the store with their YubiKey, which has a PKI and FIDO credential on it. So they log on to Salesforce. Salesforce over at OpenID Connect talks to my ID and says, I have somebody called Sam trying to authenticate. How do you want them to authenticate? Now if they have multiple mechanisms, can choose at this point. This example, we're gonna use FIDO. Now Sam taps his FIDO token to the device.

44:27 It's detected with NFC. He enters his PIN or optionally enters a fingerprint at this point, depends how it's configured. We're then authenticating to MyID. Because MyID issued that FIDO token, it's able to provide those identity services to multiple back end applications. So you don't need one key per application. You just have a one FIDO key within MyID, and that's used to authenticate to multiple applications. So it uses that high security crypto based authentication to MyID. MyID then authenticates that person into that back end application. So the end user gets a really simple experience. They can literally pick any device off the shelf and just authenticate with it. So this also plays into that zero trust world where you you can't trust the devices. You need to know who the person is coming into the system.

45:17 And the organization maintains that high level of security. So they've not dropped down the pyramid to one time passwords over SMS. They're maintaining the use of crypto based security. So just to summarize really, what we've been doing with the product is adding in support for a wider range of authentication technologies. So not just PKI at the very top of the pyramid, PKI, FIDO, mobile ID that moves us down really to that mid ground of the pyramid. We're not moving down into the insecure space, but we are moving down. That allows us to address the needs of a wider range of customers. Some of those customers are our existing customers that we can sell more licenses to to manage FIDO devices and existing types of customers who are being driven by regulations to support a wider range of authentication in their environments.

46:11 And they don't want to have one system to do PKI, another one to do FIDO, another one to do mobile ID. We can satisfy all those needs. But we're also starting to see customers down the other end of the pyramid looking at the changes in the rules to say one time password over SMS is no longer secure enough. They probably wouldn't move all the way up the pyramid to the top of it to PKI. It's too complex. It's too expensive. But they might move all the way to find it because of its simplicity of deployment and its high level of security. So hopefully, that gave you a flavor of where we've been taking the product and why we believe that means we can address an increased market with that product and why due to the regulation changes, the time is right to do that. So I'm now gonna hand back to Claus to summarize.

46:59 Thank you, Alan. Let's quickly wrap up. So from a summary perspective, overall, good solid financial performance, good continual operational progress, and our focus is not just gonna be organic, but we'll also take the inorganic element into consideration. So if we move back to the top, we have really good revenue growth, 9% constant currency. It's not a one off. We've now done this for the fifth successive year where we show compound annual growth rate at 11%. I came in as part of a turnaround. We've completed, as Andy said, phase one of that turnaround. The next focus is now on incremental revenue growth.

47:46 Very much KPI driven throughout the business, you know, whether they are financial KPI, sales KPIs, marketing KPIs, product management, customer support. We measure those, you know, on a on a month by month basis, and they continue to show good progression. We're delivering that sustainable revenue growth both in terms of profit as well as cash, and that's underpinned by a good, very sticky annual recurring revenue, which now covers over 60% of our existing existing revenues. From an operational perspective, clearly, we're impacted, and have been impacted by COVID as as each one of us has. But we've been practicing remote working pretty much the last twenty odd months, and it's had no impact on our ability to deliver to time and to budget. And, you know, what are we delivering? We're either delivering road map items like Alan talked about, or we're delivering client specific work. All of that has been delivered to time and to budget.

48:43 With Alan's background and and the positioning in the markets, we believe we can address a significantly larger target account market simply because of the new functionality that we've added on the back of FIDO and mobile authentication. And we're serving that target account market through our connect partner program. Three years ago, we made a very deliberate choice to move away from direct sales into indirect sales. We build out a partner program, which we call the connect partner program. And on the back of that, we've scaled both the technology partnerships as well as the resellers and and large clients who take the deals to to to market. Strategic focus over the last two to three years has been very much organic because we were simply not in a good enough financial position to even consider acquisitions.

49:33 We are now in very different kind of space. We believe there are interesting acquisitions we can look at. We are looking at. And as soon as we have something to announce, we will come back to the market. So outlook wise, where are we? I think the objectives and the strategy are clear. They were clear when I started three years ago. They are clear now. They just have a different focus. Our pipeline is strong and continues to develop. EMEA is still slow. It's simply more impacted, through COVID. We can see what's happening today on the continent. Austria is going back in lockdown. I was due to go to The Netherlands of next week. I'm simply not going because I fully expect that The Netherlands will go back into lockdown. And whilst I'm out there, I don't know how I'm gonna back come back home. I e, home for me is nowadays The UK.

50:24 That's very much offset by the very strong momentum we have in The US market, which clearly has dealt very, very differently with with COVID, and we have taken advantage of that in in in a positive way. Ongoing cost control, as Andy has indicated, has been a strong feature. Again, three years ago, it was absolutely paramount. We control the cost, but we continue to to be quite tight on on the things we do and make sure that we just don't deliver the top line, but also the the bottom line. So what does that leave us for the end of the year? At this stage, you know, we remain confident in the outturn for the full year, and we look forward to updating you again in June 2022.

51:16 So that concludes the presentation, and we have space for Q and A. I'm not quite sure if Alessandro is just gonna Yeah. Klas, Klas, thank you very much. Klas, Andy, Alan, thank you very much for your presentation. Ladies and gentlemen, please do continue to submit your questions using the Q and A tab situated in the top right hand corner of your screen. Just while the company take a few moments to review those investor questions that have already been submitted, I'd like to remind you that a recording of this presentation along with a copy of the slides and the published Q and A can be accessed via your investor dashboard on the investment company platform. I'd also like to remind you that your feedback is important to the company. And immediately after the presentation has ended, you'll be redirected for the opportunity to provide your feedback in order that the company can better understand your views and expectations. Expectations. Investors have submitted a number of questions during the presentation today. And I wondered if I could hand back to you just to open up that q and a tab and then read out the questions and who it's from. Thank you, guys. Absolutely.

52:13 Let let me try and share the, the q and a. And as I'm sharing, I think I'm in a good position to hand out a few as well. So, Deepak, has, has put the first question in. There's actually two parts to the question, and, I propose we actually split them up. Can you talk a little bit about the competition in the industry? Alan, can I hand that one to you? Yeah. Sure. So it depends which part of the market we're looking at. QOPKI credential management space, there's limited competition because it's very niche space. The competition in the FIDO space is mainly in the consumer market. That's quite busy, but that's not where we're playing. So we we're deliberately not going after that market. We're going in the enterprise space. There's one or two players who are starting to look at FIDO in the enterprise, but the main differentiator there is that they only do FIDO or people only do PKI.

53:07 Again, we're we're the only company that can do both in a single product for an end organization. So I'd also say for the people trying to come up that pyramid to the more secure solutions, it's complex to get the credibility there. We have that credibility from working with some of the most security conscious organizations in the world that they know our product's gonna be secure, and they know it's gonna be trusted. Thank you. Second part of the question from Vivek again. For nontechnical people, could you please explain differentiates INTERCEDE from other providers of similar services? Alan, can I pass this one back to you? Yeah. Possibly, hopefully, answered that a little bit already. So it's our focus right at the top end of the pyramid means that we come from that security background. Therefore, Therefore, we have the highest levels of security and trust in our product. Others who come up from lower down find that very difficult to build in.

54:02 So it's that very high levels of trust and proven capabilities to the highest levels of security. And the second one is the flexibility. We are technology independent. You could pick a smart card from one vendor, a USB token from another vendor, a FIDO token from another vendor. You could use a iPhone. You could use your Android device, and we will support all of them. A lot of the other competitors in that space support their own particular technology, but we don't. We support technology independence so our customers don't get locked in. Thank you. Another question from feedback. Andy, I think this is one for you. With FIDO services, given the lower technical requirements, will that impact dilute the gross margins and require INTERCEDE to operate in a more competitive marketplace?

54:50 So the the pricing model for Fido is the same model as we have long standing for the PKI. We primarily charge based upon devices. Used to be number of users. It's evolved and now become number of devices. So we see FIDO as a way for us to sell more licenses, and we'd anticipate being able to sell them at a similar price. The benefit for customers is they they they they don't have to have to pay as much to set up a Fido solution as the cost involved in setting up a PKI platform. So that's why we believe it will still be attractive.

55:36 Thank you. Just just to add to that, I'd say if we were playing in the consumer space, absolutely, because that will be driving the price down. But in in the space we're still playing in the enterprise, that FIDO ID has just as much value as a PKI based ID because it's letting people into those secure applications. Thanks for the addition. We got a question from Seth. How would biometric authentication impact your business? Alan, you're back on. It would expand it, which is great because biometrics are supported in FIDO. A number of the PKI devices support it. PKI smart cards very typically have a PIN, and that's the way you use them. You have a card and you have a PIN. But Fido has biometrics as a standard baked in. So you can use a fingerprint. You can use face ID. We support that as part of the Fido standard.

56:25 So it just makes the technology easier to use. Therefore, it should drive acceleration of the use of technology. Thank you. Roger's got a question. Clearly, from the presentation, selling these product services requires a lot of market education. What are you doing to increase awareness and knowledge in the market? Alan? So part of my role as as product is also to look after marketing the organization. And you're absolutely right. This this is an education piece, and we can't do that by ourselves. Therefore, we're not trying to. So the answer is to go through partners. So So we we spent the last three years building out that connect partner program. Not only did they have a route to market, but they also have far bigger advertising budgets.

57:12 So just as an example, next week, we're taking part in a SailPoint conference. And for government in The US, they're demonstrating our products integrated with their product. They are putting a lot of marketing effort into that, and we're broadcasting that out to their customers. We will piggyback on top of that marketing. So we're doing that. Yes. We have our own marketing team, but we're very much trying to drive that and augment that through partner based marketing. Thank you. The questions are still coming in thick and fast. We will try to do as many as we can. If we do run out of time, we will commit to answering all the questions, after the session has closed. Here's a question from Simon. Here's one for Andy. Is mister Walker sure he wants to retire just as the sunny uplands are at a very long last approaching?

58:02 Thank you, Simon. I guess it is a big decision to make to approach the third phase of your life, but, I, long term, had always planned to be retired by 60. I'm 62 next. I was persuaded to stay on when PLOS joined, and I'm glad I did. It's been a rewarding three years of delivering phase one, and now I feel the time is right certainly for me and my family. And I believe it's probably as good as it could be in terms of the company and having completed phase one. And I look forward to the sunny up plans as well, particularly given my shareholding. Thank you. I've got a question from Andrew c.

58:47 Do you see much switching of smart cards to YubiKeys? Alan, one for you? Yes. We do. And there's two reasons for this. The the first one is customers who buy laptops don't tend to have them with smart card readers built in anymore. Used to be able to buy corporate laptops with smart card readers, but a lot of people don't do that anymore. Whereas the YubiKey device about like that comes with the USB slot, and you can just plug it in the USB. So that's one reason you get that PKI level of security, get the hardware, and you can use it on device without smart card reader. But it also supports NFC, which is useful. And the second reason is that customers are starting to look to protect themselves to future proof themselves. So even if they're not deploying FIDO today, they've seen the regulations changing. They know where that's going. So they wanna buy a device that does PKI today, but they know he's capable of FIDO for tomorrow.

59:43 So, yes, I would say in the US federal government space, it tends to be a smart card and also a FIDO key. In the aerospace and defense where they don't have to physically use a smart card, then they're starting to swap them out for devices like YubiKeys. So, yes, we're absolutely seeing that. Thank you. Got a question from Kimberly. Is there anywhere I can see a demo of the MyID platform? Depending on how much functionality you want to see, Kimberly, actually, on our website, there are a number of relatively short videos. Call them virtual espressos. They last about three, four, five minutes, and they typically dive into part of the functionality of what MyID does. So, hopefully, that will give you a flavor of what we do and what's actually involved. If you want to see more, you're always very welcome to contact us, and Alan will be more than happy to to show you more.

1:00:40 Question from Simon. Is the cost or the complications that are the main barrier to new customers buying into what seems a no brainer with regards to the high security level? Alan, right up your street. For PKI, absolutely. PKI is complex. It's difficult. You need lots of policies. There's a real skill shortage in cybersecurity as well, which is why it's typically reserved for those larger organizations who have their own internal IT teams and can run this themself. FIDO, we believe, changes that because it's built into the operating systems. It's built into your devices. It just understands it. It's less complex to deploy. To deploy PKI, you need devices, you need a PKI system, and you need a credential management system. To deploy FIDO, you need the device and you just need MyID because it acts as the credential management system and the authentication server. So it's both cheaper for the end customer to purchase, but it's also less complex because it's far more standards based.

1:01:42 Thank you. We got a question from Paul. So how are the channel relationships working regarding sales? And then there's a second part, so I'll pick up on that. So, basically, as I explained, the channel program has got two main pillars. One's the technology partnerships. The other one's the the the resellers. We continue to sign new integration partners, reseller partners, well as as technology partners, and we actually see the overwhelming majority of our new business now being contracted through the channel. So the channel is actually starting to work really, really well. Second part of the question from Paul is do upgrades provide more revenue? It depends, Paul. Some customers choose to upgrade themselves, in which case, we do not need to be involved.

1:02:28 Other customers want us to be involved in the upgrade, in which case, you see that part of our revenue stream is actually a professional services or development effort stream. So it really depends on the client. Where clients are heavily customized to basically make MyID do the the task that they want them to do that are not out of the box, then we may need to be involved. But we have customers doing their own upgrades at the moment, and and that's one of the big benefits of a standard off the shelf piece of software. Clients can, if they want to, do their own upgrades. So that's Paul. Martin, what are the top three risks to your plans in phase two? Well, that's a really good question. So let let me have a think about that.

1:03:14 I I think one one risk would be, you know, and it it's commonly talked about across the industry is is m and a distracting to what you do? You know? Is is the executive team gonna be too much involved on the m and a side, and therefore, the run rate business is is disappearing? We've actually contracted that very, very early on. When I joined just over three years ago, it was obvious that this company was very much top top driven, and there wasn't enough middle management that could basically run the business on on on a day by day perspective. We already introduced what we call the OMT, the operational management team. It's a team of middle middle managers who, in effect, report to us who are capable of running the day to day business. So I don't think we're particularly distracted. We haven't been distracted in in the first half, and I don't think we will be distracted in the second half. What's the second risk? The second risk, you know, not not yeah. The phrase we use, particularly around m and a, is no no deal is better than a bad deal. So the risk is, you know, are you buying something that turns out to be, you know, a bad deal?

1:04:26 And we put a lot of time and effort upfront to understand, you know, whether this is the right party for us to free even to be to be talking to. So the work we do upfront, desk based research in the initial engagement, and any due diligence that will follow, we'll have to mitigate that risk. So that's two risks. Let's think about the third risk. So I'll throw one in from a product perspective class, which would be if we build something that our customers don't want. And how we're trying to mitigate against that is really engaging with them. So with the customer advisory boards, with the regulations, engaging with the standards bodies, working with the early adopters to really try and make sure that we don't go for a build it and they will come approach. We really listen to what the customer base wants and build what they want.

1:05:18 Thank you. Hopefully, that's given that's given three quantifiable kind of risks. Simon's got a question. What's the potential size of the market within customers you already service part of? What's the potential size of the market? It's It's a different I'm not sure I can answer the question without without really getting a clarification on this. Clearly, we have an installed base. We have roughly a 100 clients, and we are constantly upselling and cross selling within that client base. If we look at the wider markets, we try to give some market definition. You know, the the the CMS market is around a billion dollar market, so it's it's by no means small.

1:06:04 But if you look at that wider MFA market, you know, that's pretty much a factor 10 times bigger. So, hopefully, that that's giving you some indication on on market size. And then finally, Simon has got a question. Is Boris backing you as part of the global Britain campaign? May maybe we should put a tweet out and see if we can get support for for your suggestion, Simon, but it's very much appreciated. I think that concludes all the questions. Alessandro, back to you. Can I just can I just add, plus, one of the questions about the demo? Then just to let folks know as well, there is access to a demo on ThinkApp's website, which is is also a good another good source.

1:06:50 And in that regard, FinCap is very good for retail investors because they pretty much give you full access once you register. So it's a really good point. Thank you, Andy. Alessandro, back to you. Thanks, guys. Just want to say thank you for being very generous for your time. You've actually addressed all the questions from investors today. And of course, the company will review any further questions submitted and publish responses where it's appropriate to do so. Klas, just before redirecting investors, I wondered if I could ask you for a few closing comments. Yeah. So a couple of final words in closing. We're looking forward to the second half, on the back of this strong start to the year. Our offering remains very relevant, I think, witnessed by not only our current sales, but also the ongoing pipeline development. Alan has explained how we're positioning MyID and how we aim to take advantage of a much enlarged target account market. You know?

1:07:40 And and, again, you know, we have a highly committed and loyal team of colleagues, you know, who day after day, I think, deliver the best code in our industry. Aim We to deliver continued revenue growth profitability, and we believe we are on track to do so to do so for the current fiscal year. Thank you again for attending, and we look forward to updating you all again in June 2022. Thank you. Thank you. Thanks. Andy, Alan, thanks again for updating investors today. Can I please ask investors not to close the session as you'll now be automatically redirected for the opportunity to provide your feedback in order that the management team can better understand your views and expectations? This will only take a few moments to complete. However, it's greatly valued by the company. On behalf of the management team of INTERCEDE GROUP PLC, we'd like to thank you for attending today's presentation. That now concludes today's session, and good afternoon to you all.