Narf Industries (LSE:NARF) — Ranger Launch & Annual Results Overview

0:00 Good afternoon and welcome to the NARF INDUSTRIES PLC Ranger Launch and Annual Results Overview. Throughout this recorded meeting investors will be in listen only mode. Questions are encouraged and they can be submitted at any time via the Q and A tab situated at the right corner of your screen. Just simply type in your questions and press send. The company may not be in a position to answer every question received during the meeting itself, however the company can view all the questions submitted today and publish responses where it's appropriate to do so. Before we begin, I'd like to submit the following poll.

0:27 I'd now like to hand you over to the Executive Chairman, John Herring. Good afternoon to you, sir. Thank you, Alessandro, for setting that up, and good afternoon to everybody who's joining us today. We have, looking at the, list of participants, a number of long term shareholders have been following the company. So it's great to have that following and also if you knew. I don't wanna belabor a lot of history of the company here. I the purpose of this call really is to get to Ranger AI, our product capability we announced in June, July time as being ready. And those who have followed us have known that that's been a big focus of ours during the previous, reporting period.

1:15 I do, at the start, wanna take a minute to, to acknowledge that we did get out our annual report and we completed our audit. And to tell you that I was disappointed in our revenue performance for the year. I think we guided quite a bit, even starting in May '24 about the expecting a decline in revenue as we began to pay attention to the Ranger AI capability and invest in that. And Steve will be providing a lot of good justification that they provided to the board of doing that. So we as a board was good to go along with that shift. We saw the importance of it and knew there would be some revenue impact, but we were surprised as the year had gone on.

2:08 About in May or so, we began to see the historic US budget had not been approved, and so that had delayed, so we were experiencing some delays. We expected to catch up some from that. We moved into the summertime, picked up some good contracts, got a follow on for Social Cyber, and that began to fit well. And a lot of the GSNS work that had been impacted by the earlier budget delay, we had gone to other prime contractors who had relationships with those customers, and they were picking up those contracts and taking them in, and so felt very good about that. So in the November time frame, after we had gotten our six months results, which were down quite a bit to 1,800,000 in revenue, as we looked at the opportunities that were being presented, and this was, I think, November 7, we put out our latest guidance.

2:57 It was looking like we would recover, to some extent in the upcoming months. We knew we had a very large contract coming, which we did announce $6,800,000. So that was our, largest contract to date. We saw some good momentum going in to some other areas. But right after about November,

3:19 end of November, you know, the new administration came in and unexpectedly, we had Doge come in, and that just kinda brought everything to a halt. So, we were impacted, by those budget delays. And, so, that ended up with things with some big prime contracts we'd expected not coming through by the end of the year because these prime contractors had no idea where money was coming from, so they failed to move forward. And it did delay a couple of the other projects. I would say, going forward, we've kind of recovered from that. We're seeing good activity coming in. So you saw our revenue was about $3,000,000 That was about 50% annualized decline from where we were.

4:08 To the credit of the company, cash flow was managed very well. Just like investors, had impact, to their value, a lot of us had impact to the value that we were getting from the company in regards to salaries and all, and we were sensitive to that. So I think everybody gave their fair share in, trying to, get through this period. One of the key things we've stressed to management is that we cannot access capital at, these low share values, And so we gotta kill what we, we gotta eat what we kill, and, they've done very good with that. And we're now in a a good position as we've entered this current year. I'm not gonna give any revenue forecast at this time, but I will tell you that just based on our current GR and D backlog that we have and some things that we're aware of that are closing here in the near term.

5:01 There's probably 4 to $4,500,000 of revenue for this coming fiscal year in that. So just to give you a feeling that we do have a good base entering this year. And again, as we've said, we've kind of managed our capital and all. And with our core plan, we're presenting here and where we're going, where you don't need access to capital. Access to capital is great. We could go a lot faster, but the trade off until we show value is just not there. So anyway, I appreciate everybody working with us. We'll be giving more clarification. Again, that number that I just presented did not have any contributions coming from Ranger AI. We do expect some very good ones and Steve will be addressing that.

5:47 So I just wanted to get that on the table of where we're at at the beginning and kind of acknowledge that and let you know that again, I'm disappointed but certainly there were some factors that even management couldn't see doze coming along and what we ended up with at the end of the year. So anyway, I think we've planned for that. Alright, given that, so I'm going turn it over to Steve Bassi, our CEO. You'll see a couple of additional faces on here as we're beginning to expand. This is our product team. Steve will go through introductions with him here in a minute when he gets to the appropriate point in the slides. Steve, you want to comment on your poor performance on revenue? No. I think I'm gonna I'm gonna look towards the future rather than the labor, the the past as you personally pointed out, but I'll I'll I'll get into a bit of that.

6:42 Let's go ahead and start off and set the agenda. Some of you may have heard me speak about this before, but we're really gonna talk about what Ranger AI focuses on and it's that open source software is really critical infrastructure. We'll talk about the 9,000,000,000,000 in investment that's already been made in open source and why companies are building on it. We'll talk a little bit about how they consume it, why it's critical. We'll talk and then we'll start talking about the product team and what we're doing with Ranger AI as well as where we've gotten to with one point o and where we plan on going with initial customers and as we add more agentic features to it. Last, we'll talk a little bit more about go to market, and other items that we plan on launching, in the next six months in terms of commercial availability and expansion beyond government with Ranger.

7:37 And then finally, we'll interview or we'll sort of review any questions that came in as stragglers and get through those at the at the end of the deck. So draw your attention first to there was a Harvard Business School, report that came out a while back that was quite interesting. And the gist of it was that open source software basically is a has has received a lot of investment over the years, and companies are deciding to, to build on it. And it ends up, pretty much everywhere in modern day software. So the real headline here is it cost about $9,000,000,000,000 if it were to be created from scratch today. So it's a it it has become both critical infrastructure, and, infrastructure that people have decided to build on for better or worse. And we'll talk a little bit about the worst part of it and and how we help in that.

8:27 So as this has become pervasive, you see there's a couple a couple metrics around this. Right? You know, 96% of code bases that people use or the code within it, has some open source component to it or some open source DNA, if you wanna think of it that way. By open source, we mean that software that's built by effectively random people on the Internet, you know, either sponsored by a company, or as a as a hobbyist or in their free time. But it turns out that people building this code, as software is in the world, a lot of people are building on top of existing open source, using it as a dependency or using it, you know, as sort of the framework that runs their higher level applications that they're building for their company, their enterprise. So that means it's become pervasive in the software world today.

9:19 And this bears out in the numbers, the consumption numbers. Right? If you look at various stats from various providers, you know, I wanna wanna focus your attention on the fact that, 2024 saw about 6,600,000,000,000, downloads of various open source components. Now we ultimately don't know and have great breakdown in that in those downloads on on how they were consumed ultimately, but you can be sure that a lot of them have been have ended up in products and services that you've used that you've used in the in their day to day. If you sent an email today or or browse the website, I would be willing to wager there's a 100%. You've touched some open source software along the way, and it has been processing critical data related to everything from your identity to financial transactions.

10:10 So at a high level, and if we wanna use analogies here, it's it's basically the wiring of the modern world. Right? It's built into every product and service, but few really ask, you know, who installed that wiring? Is it maintained? And is it safe to continue using? Right? Are we using electrical codes from the nineteen thirties still, or are we using modern 2025 electrical standards and practices? So as this is the invisible infrastructure that powers pretty much everything people have come to rely on, you know, it's often unknown and unvetted who's contributing to this code base, and that's a massive overlooked risk. One that the industry is is very much starting to wake up to. So the challenge then becomes reducing risk at the relentless pace of of open source software.

10:59 So as as people have continued to build on top of open source software, they've, the developers and other contributors to open source software continue to add new features, functionality, and fixes to it. Keeping up with all the contributors or the human layers of of these open source projects, you depend on tens of them is difficult enough. If you depend on hundreds of these open source projects, then it's way more difficult. And these projects not only are the contributors the building blocks, but the source code they contribute,

11:31 is also very specialized. It's very dense reading if you ever wanna fall asleep at night. Reading an open source code base is pretty good way to, to start down that road. And, keeping pace with the updates, the velocity behind which these projects move across tens or hundreds of projects is is difficult, costly, and requires expertise. And we talked about this, all the way from the spring of last year. Right? We were involved in, some tooling and some, some work for our air force customer, understanding how the impact of this almost backdoor that ended up in open source software may have affected them and how to prevent it in the future.

12:16 And this is kind of a sign that we see attacks on this infrastructure accelerating. Right? And threats against this infrastructure because everything is built on it. Everything from the Linux kernel to all web servers that you use today have some open source component in it. This is a really juicy target for, malicious actors to be able to take advantage of. And they take advantage of it in two ways. Right? One is basically deliberate backdoors in the in the project itself or looking for security vulnerabilities that developers either wittingly or unwittingly introduce into these projects that people deeply depend on. On top of all this tracking, contributions to the open source projects, understanding the risk if your company has largely built things on the software, We have quite an acceleration in the regulatory, requirements and frameworks.

13:13 And I wanna point your you know, if you guys are you guys are closer to the EU than we are, but, there's been a lot of talk about product liability extending into software lately, specifically in The EU. And this is a really big deal and an interesting, caveat around the regulatory stuff because now even if you take advantage of the $9,000,000,000,000 investment that's already been made in open source software and sort of stand on the shoulders of of those giants to build your own products, you're still not only liable for your own source code, but you're also liable for the open source code that you choose to include in your products and services. Right? So, you know, if you're building a self driving car and it, you know, runs off the road and hurts somebody, because of software, or if you're, you know, using some vulnerable open source code to manage your customer database and that leaks.

14:04 You know, under under most of these regulatory frameworks, there's there's some regulatory effect or liability that arises from that. So the real question becomes, how do you derisk your leveraging of that, $9,000,000,000,000 open source investment? And for us, this leads to a significant market opportunity. Right? We sort of exist at this crossroads between traditional open source security and, you know, leveraging this code safely as well as the larger software security market. And we think for us that represents kind of a rough intersection of about $45,000,000,000, you know, TAM.

14:43 So at this point, I'll talk to you how we're addressing this TAM, and, we'll talk a little bit about our product team. We have a we have some, select members from from the product team today here at NARF. We've got, doctor Michael Locasto. He's our CTO and has been responsible for a lot of the R and D and recent DARPA wins as well as past DARPA wins that have gotten us to this point with Ranger one point o. Doctor Sean Carrick is not on this call today. This is very early for him, and he works very late. But he's responsible for applying, these technologies to the more arcane and, black magic side of things on the binary security vulnerabilities. We have Greg Russos, who is our, lead developer on this side, and he's been working tirelessly in the last few months adding, our AgenTik AI capabilities to the the platform and getting us towards a second release, beyond one point o, that really scales out to meet some of these, challenges we've just discussed and some of the address some of the, challenges that we've seen from our initial customers of this platform.

15:51 And we have Stuart, Nagi Kato on the call as well. He is sort of leading the, the product development and, management of of our day to day dev tasks, so he's here as well with us. And I'll be handing off, different components of the slides, which I can explain a little bit a little bit better, than I can and then talk to those as we go along. So we talked about the pervasiveness of OSS. We talked about how, companies are using it to build stuff on, but we didn't really talk about the the nitty gritty and how they're deploying this and where this thing ends up as critical infrastructure. So a lot of what we're focused on with Ranger is the fact that people take open source components and cobble those together into a scaffolding for their larger project.

16:44 These open source components are known as dependencies, and they, you know, are often sort of critical components of a custom application that somebody is writing for their enterprise. What's important here is that custom application ends up handling very, very sensitive and valuable data, or is relied upon in life or death, you know, situations anywhere from hospital record keeping all the way to, you know, there's there's there's ton of open source technology on things like the f 35 and larger multibillion dollar, military expenditures.

17:22 Critically and to our customers, open source software actually handles a fair bit of class classified information, which you may be surprised to learn. Now granted, when it does this, it's in something called an air gap, meaning it exists, in a software enclave, in a in a cluster or software enclave that's not connected to an Internet the Internet. But it's still pretty important that people understand, security issues and vulnerabilities that exist in these classified and sensitive,

17:51 enclaves that are due to open source software. And oftentimes, the problem with, using open source and building your applications and how it's become critical infrastructure is there's a deep under appreciation of the resources required to understand and manage the risks that taking code that some random guy on the Internet developed and running it on your sensitive system presents. Right? So we've seen a lot of, really, really good engagement, and initial usage of our results around certain areas that we'll talk about in a minute. But, really, our customers have have been eye opened by the diversity and geographic origin of who's developing their source code that exists on their critical systems.

18:39 We've talked a bit about, you know, the potential for, backdoors or what we call bug doors. So these are unintentional backdoors in the systems that do or they're due to software vulnerabilities. And, you know, there's also this aspect of security vulnerabilities are introduced all the time because every software developer is also not a security engineer or a security expert. And so the resources needed to monitor for all those things in this thing that you got off the shelf for free and started building your application on are really not well understood, and there's really no, great solutions for tracking the risks that those things present.

19:17 So that leads a bit to our ethos and our adoption of AI, that we've tried to take at a high level when developing Ranger, from one point o into Ranger AI. Right?

19:27 And this is leveraging, some of the impressive abilities of Agentic AI to recognize, automate, and scale the human security expertise we already have here at NARF, into helping out with understanding and mitigating that risk that our customers see by leveraging this $9,000,000,000,000 investment in open source software. So how do we get there? Right? Today, we've we've successfully released and are working on follow on contracts for two initial customers for Ranger one point o. We did that with leveraging about $4,000,000 in DARPA funding over the years to build out this capability. We also, have worked closely, with some, air force personnel, as an initial customer for this that have validated this is real and valuable and, have have a continuing need for all the features and functionality that's that's been been implemented in the one point o.

20:28 But we can do better. We can take it farther. We are really expanding on this agentic AI idea and its ability to scale, to actually extend the value that we've seen with our government customers beyond Ranger one point o into something that really appeals to a commercial market that also depends and builds heavily on on open source software. So we've taken this from a scanner, you know, and and some, some very, well understood statistical machine learning techniques. We're trying to take it into a suite of AI agents that really adapts and scales to meet the risk profile here. We've also, produced a lot of really interesting, really highly technical data that our our friends over at the air force, and other initial customers appreciate, but that ultimately is not actionable by somebody who's not trained and not deeply steeped in the the the idea of, you know, picking up these open source dependencies and keeping them secure.

21:27 And and we wanna comprehensively or more comprehensively address this problem of being able to take advantage of this $9,000,000,000,000 investment in open source software and make it safer to build on for companies of all shapes and sizes, not only government. And here's what we hear from our initial customers. Right?

21:46 We, from those at the air force, you know, they're responsible for a repository and record of, of safe open source software or what they consider safe and trying to manage some of the security risks that are presented. However, they're trying to do this, across approximately 6,000 open source software projects, and they're trying to do this with a staff of 30 people who are very skilled, but I don't know if there's enough hour in the day hours in the day without great tooling and without AgenTek AI assistance to scale their efforts to over 6,000 open source projects that they need to monitor for security flaws. The other challenge we've heard from these customers is that security patches from what's called upstream.

22:32 So, you know, if you're dependent on these open source projects, you are downstream from them, and they are upstream from you. And waiting for security patches from a volunteer effort or something that may not be prioritizing, your risk profile and the security vulnerabilities in their in their product that are affecting you, it ends up being slow, manual, and likely incomplete, especially when you've got attackers taking advantage of it quickly. This isn't a direct open source project, but if you all heard about the, recent, attacks on Microsoft SharePoint,

23:08 It's interesting to note there that, attackers were able to understand and weaponize the flaw found in SharePoint in a matter of hours. And we had within the first twenty four hours, victims actually being victims with SharePoint servers actually being ransomed out there, and having their their data encrypted, their SharePoint services offline, and and being extorted for for Bitcoin within twenty four hours of that flaw landing. So it is quite a tight timeline

23:38 for fixing some of these issues. And one of the things we talk about on the product team is we wanna end up what's called left of CVE. Right? We'd like to use, the scale and the speed of AgenTek AI to understand these flaws and be able to present patches for them before the

23:56 before the the attackers can can make it. The other the other things we hear from our our initial a different type of customer, but we're working with a large government IT services and system integrator. They manage billions in, government contracts for secure compute cluster operations, and they deliver most of that, most of those technologies and most of that compute cluster with open source software. So they've really had their eyes opened as to the backgrounds of the contributors behind that software, and how our agentic platform can scale to meet those challenges that they have to maintain the security of that infrastructure.

24:38 So we're working on partnership right there, with them, to deliver, you know, millions more in joint revenue, you know, surrounding the safe deployment and safe building upon these these open source technologies. We'll get to that in a bit.

24:54 So, sorry, Michael. I'll jump in. Is there anything I've I've missed in sort of your last year working with our with our Air Force customer that, that you kinda wanna highlight? No. There's a there's a pretty, good description. Will, add, right, as you've kinda communicated and intimated here, like, we are intensely focused on identifying actionable threat intelligence about this supply chain. And if you think of the supply chain as conveyor belt, right, someone like the Air Force customer with their, you know, couple of teams of 14 people is way, way downstream from where software is manufactured. And the important thing to realize is that every step of that conveyor belt, there's a

25:33 black curtain that's between you and whoever produced it, packaged it, touched it, slipped something into the box, slapped a new label on it. And so parts of that supply chain are very, very opaque. And, unfortunately, the folks all the way at the end of that conveyor belt are pushing on a rope. Right? If they wanna make changes, as you said, upstream or or push a patch, they don't have a lot of control. Right? There's a volunteer effort upstream. And, you know, they can't even sometimes do things for themselves because they don't have enough information about what the impact of a change might be, or if there is a a flaw or threat there that's worth addressing. So that's the kind of tooling we're building. But the the worm in the apple is the scale. Right? You you mentioned 6,000 projects.

26:24 If if each of those projects is run run by a single other person, that's 6,000 other contributors. Understand, Our dataset has, like, 9,300,000. Right? So understanding all that is just impossible for, you know, a team of 30 people, and that's why we need to leverage the the AI as something that can consume work and really rapidly triage a lot of that info. Yeah. Exactly right.

26:51 So, you know, let's get into a bit about what this platform entails and what it is. Right? And it is three things at at its surface. Right? One is this is the agentic AI platform for open source security operations. So if you wanna consume and build upon open source software and you wanna do it safely, this is the platform for you. And the reason for that is we get to scale past this bespoke human security expertise, with something that's sort of always awake and can review contributions at any time of day, anywhere made to this open source software. And the reason for that is because there's a lot of automation in how open source software is built upon and new software from enterprises and all these teams gets released. Right? And that automation automatically incorporates the latest changes from some random guy on the Internet into your shipping product. Right? If you're if you're doing it right and in a modern way. So it's really helpful to be able to identify the vulnerable pieces of these dependencies wherever they may be and to do it rapidly.

27:57 And we simply can't scale that out with human expertise. And I missed talking about this a little bit early, but earlier. But this software is often shipped in something called containers. So if you've heard of something called Docker or this idea of shipping shipping software for running in a cloud or a cluster, it's often done in these containers. And these containers are automatically built with all this downstream software and deployed often without a human in the loop. So we need to have, you know, agentic capabilities to actually remediate vulnerabilities in these containers before they make it into production. Right? We call this internally something called left of CVE. And CVE is this public notification that there's a vulnerability somewhere in a piece of proprietary open source code. Right? Ideally, we would like to produce software containers that never have that vulnerability present because agents out there have read the code contribution, understood why it's bad, presented a patch, and fixed it automatically for our customers before it makes it into production.

29:05 So all this leads to we're also running a platform that's able to key to collect data on what our customers care about and what software containers are really, really critical to them. Right? So not only do we need to know that a customer consumes and builds upon a specific software container. Right? But how critical is that to their operations and their infrastructure? Right? Is it a software container that's running the drink fridge in their office so they get, you know, free beer on Fridays after work? Or is it a software container that's running on thousands of CPUs across various data centers? And if there's a vulnerability or an issue with that container, it brings down their entire financial and revenue operations for days at a time, which loses, you know, on order of millions per day in their large scale operation.

29:53 So we have this really great data capture platform for not only do we understand, you know, the issues and the landscape of how open source software is developed and used by our customers, but we wanna understand the scale with which it's used and the criticality it has within our customer environment. And this is really a great platform for capturing that data and understanding where, we should be suggesting that that customer make their investments in securing their open source consumption. And the last thing is a sales conduit. Right? So we we talked earlier about this large system integrator that we're already, working with, on these topics. And, obviously, we're trying to reduce the the, the issues that can be used in their service delivery because they're using open source software to do it. Right?

30:39 But they also have very sensitive downstream, government clients, right, who are interested in hardening and really making these systems that they already buy from the system integrator more robust while still leveraging that open source investment. Right? So we're looking at this as a sales conduit for the system integrators where they can take the really critical pieces of this stack that have been written in, you know, in the open source world and and actually generate a lot of revenue taking over stewardship for some of these open source projects and making sure they're really, really safe to to consume for their downstream consumers and making sure they built they're they answer some regulatory questions about being built in the EU or the Western, you know, sort of the Western, allies, structure or being built in The US or The UK or anywhere else where it's critical that some of these critical components be onshore. Right? You've seen onshore in this kind of a a continuing trend in our current, hectic economic environment.

31:41 So we'll talk a bit about the the road map for this, and a little bit more, detail about these two initial customers. So we we plan to launch customers for this. We've already been working with the air force. We are starting work with this major system integrator, and we expect to, you know, be able to announce larger ongoing engagements with both of these entities in q four. Now if you ask why q four, why hasn't it been q two? Well, if you can predict the the the government budget cycles and what's been going on with the new administration better than I can, my email inbox is always open, and I would love to hear your your sources of information. But for now, we we expect that now that the big beautiful bill has been passed, we expect to see the contracting officers be able to deploy some of those funds, both very, very quickly to meet year end, you know, September 30 deadlines for spending f y '25 money that has been unspent in the government up until now, as well as, this newer, fiscal year money, that's often committed in the September to October frame time frame.

32:52 Now we've already pushed out budgets for the next year of Ranger one point o and Ranger AI capabilities for these two launch customers and received head nods and definite, yes, we need this. We are just waiting on government funds to be released from their various contracting officers. As an interesting aside, we learned the other day that that the folks at health and human services are actually using the, Department of the Interior, which is responsible for our national parks in The US, to commit money to cybersecurity efforts. So, Smokey the Bear is now our contracting officer in a couple cases. Not in these cases, but this just kinda gives you an interesting aside as to what's going on in government.

33:41 So we expect those launch customers to you know, these budgets we submitted, they are for three things. They're largely for platform access and design partner status around, you know, contributing to the road map and understanding, what we need to build for them quickly. And they're also getting access to our security team. That's about 30% of the budget. Budget. So our human security team is, paired with these AgenTik AI workflows and is available to basically respond to any vulnerabilities that are found by our AgenTik AI flows as well as help remediate them in the customer's environment. Because remember earlier, we talked about, one of our key customers has about 30 people to respond to these incidents. Oftentimes, those 30 people do not have the breadth of experience that NARF security engineers have with patching various, open source projects and various programming languages against a myriad of threats.

34:39 So I'll talk three areas in which we're building and deploying agents in the product. I'll talk about the first one. I'll hand it over to Greg halfway through the second one to talk about them. And Michael, if you wanna follow-up and talk about the bigger trends and the excitement on the team and understanding, you know, really how we get to scale out our expertise without, you know, submitting Greg, Stuart, and others for for cloning duties. So the first place we use our agentic workflow or and and and, workforce rather that we're building is, in understanding the the infrastructure, and the project dynamics behind this open source software. This was the original use case for Ranger one point o. So this idea that we needed to perform very, very high level and very, very broad based, health checks on projects on open source projects that our customers have come to depend on. So a great example here, you know, if you've if you've come to depend on a road or bridge, right, it's useful to understand if the company behind maintaining that road or bridge is still solvent and and doing it well. Right?

35:59 So really what we built and a lot of what, our our launch customers are relying on Arranger one point o is this ability to to understand the health of these critical projects and to be able to intervene, by what's called forking the project or taking it over in the event that, you know, the maintainer gets hit by a bus, or it becomes critical to national security. Or generally, they just really need more help, you know, securing that open source dependency because it's become such a critical part of what we're doing. This has really allowed us to identify and sort of map out what a national strategic reserve of good software developers that can work on this critical infrastructure looks like. And it's one of the data assets we've built up as part of this Ranger one point o work.

36:49 So the customer impact to date on this has been huge. And mainly, it's been, hey. We're able to notify them that this critical thing you depend on that's in all your software, it's having some maintenance troubles, and it's having some, for lack of better term, solvency issues that we need to address right now. And giving them a support plan or giving them a road map to addressing what we call abandonware. Right? This is software that you depend on that's been abandoned and and no one's maintained it anymore, which obviously is not good in any type of infrastructure. So that leads us to our our the really something we we stumbled on with working with, the air force and some of key customers. They're very interested in knowing about the, backgrounds and who's contributing this contribute this critical infrastructure.

37:37 And we found some surprising things for them here. And I'll turn it over to Greg in a second. But I think generally using these agentic processes, we've been able to, as Michael said earlier, if if every if one every one of the 6,000 projects only had one developer, we we really wanna understand the background, you know, where that developer was educated, who he works for, you know, is he in an adversarial country that that has influence over him or can, you know, knock on his door and say, shall insert this code or else. We really wanna understand that that background behind the developer, because they can pass on potential security vulnerabilities to people that really depend on their code is critical. And I'll I'll pass it over Greg and kinda let you speak to, you know, how we think of developer backgrounds and and how we're using the agentic framework to to rapidly understand and spot problems.

38:33 Yeah. So this is, this is really we're, you know, trying to understanding these software systems, we're really trying to answer the who, what, where, when, why questions here. And in answering the who, I think we're trying to put some shape around, you know, who is this developer other than having some email address on GitHub, for example. So we want to know a little bit about where was this person educated? Where has this person worked? Where do they currently work? All of these things indicate not only what their piece might be in this specific software project, but also what is the potential quality of the code that they're committing to this project.

39:21 Do they have the necessary skills to be working on, for example, the cryptography a specific piece of software? And if so, quantifying all of this by looking at all of these inputs is the effort we're trying to capture here in describing the who. Of course, you do a full background check on each person, but if you are able to leverage, LLMs and and the agentic workflow, you're able to do this at scale intelligently.

40:10 So you can look at the, you know, a 150,000 developers that are contributing to your 6,000 software packages that are running in your cluster. This is this is this is a novel, and a a very new sort of ability here. This is not something we've had even even a year ago. So, I think the the ability to understand, a large scale problem here with the use of these tools is is putting us is giving us a leg up, in understanding the who here. You know? And I think to add to that, some of our initial customers, we know that that these findings that we've produced on developer backgrounds and the, you know, the degree to which certain certain projects and certain components of critical infrastructure and OSS that they rely on have a degree of, you know, of of of adversarial participation that's uncomfortable.

41:15 Right? And being able to quantify that and present a genitically generated plan for, for minimizing that has been really critical and valuable to them. And we're looking forward, especially in q four, to really extending that work and, you know, and rapidly, you know, showing that return on investment for them, which we think will unlock, frankly, larger efforts and larger budgets from those customers. So next, we'll move to the another another, you know, agentic workflow that we we have in place, and we're we're looking at really expanding, on behalf of our customers is this idea of of of real time security reviews. So, you know, a developer in open source land, contributes a new piece of code. Remember that if you're depending on that that piece of code, it's oftentimes automatically included in your next production release.

42:16 So it'd be really great to know if there's any security impact, either positive or negative for that. And, Greg, do you kinda wanna give a couple couple bullets on on, you know, how we're doing this today and and scaling it? Yeah. Yeah. This so this is this is this goes to understanding the what here. Right? The ingredients of of your software package, which at the end of the day, the ingredients here are source code. And like Steve already said, the volume and velocity of this source code that is pouring in as these packages and these software products are being built is immense. So, being able to leverage LLMs and agentic workflows here really allows us to scale.

43:09 And not only scale, but scale in an intelligent fashion. Or simulated intelligence, depending on where you sit on that spectrum. But I'm able to take a source code review that I might do on, let's say, a 100 lines of code that would take me an hour. And I'm able to scale that out across all of the software packages that I'm interested in looking at automatically by assigning an agent who encapsulates the review that I would do across all of those packages. So this allows us to really cover a lot of ground here. We have a couple numbers in here. We can look at 100,000 commits in a day, where a human might be able to look at 10.

43:58 And in sort of working through this with some of the data sets that we've used so far, taking a small sample of contributions, in this case looking at 20,000 contributions using AI and an NGENTIC sort of approach here, we were able to find seven fifty of those. Which sounds like a small number, but it's not trivial the big picture. Seven fifty of those contributions introduced a potential security issue that would then feed into the customer's upstream system, potentially causing a problem. And another thing this sort of AI approach allows us to do is we can produce concise, focused, and very audience specific outputs for the client. So the client isn't one person. The client consists of a whole stack here. Everything from the executive to the management to operations down developers. To And we're able, by assigning different agents to different tasks, we're able to create different outputs for those different audiences.

45:21 And we have this idea of a software nutrition facts. It's basically just playing out this idea that your software has ingredients and here's a quick label that we're all conditioned to look at proteins, carbohydrates and fats. Here's what makes up your software and here's some things that are standard across all software, and here's something that's really specifically interesting about this piece of software that you might care about. Hey, Steve. I just wanted to pop in real quick. We've got probably about fifteen minutes left here. The presentation's been great. I think people have gotten a dive.

46:06 Let's spend some time on this next slide of yours, which is giving an understanding of kind of the go to market and expectations. I've been looking at a lot of the questions that have been coming in. So let's spend some time on this next slide. Sure. So we spent a while talking about some of the agentic processes that we're already running. I really think the thing that we didn't highlight so much is not only is this providing alerting and information to our downstream customers. Right? But our a lot of our planning and our road map here is and they is to turn these, these findings or these alerts into actual remediations. Right? So actual fixes, actual defenses for the downstream clients themselves.

46:55 Right? So I'll walk you through the roadmap a bit in the sort of near to midterm here. Obviously, we talked about having those initial two customers onboarded to the Grainger AI features as well as, you know, being able to announce contracts within q four on those two initial starts. Now this is really useful because this gets us in a, you know, keeps us in a daily cadence of, providing basically these AgenTeq outputs and NARF security staff as well as our agents, delivering delivering results to these guys. I don't know. Whoever's controlling the deck right now, please, please leave it here. So the, you know, onboarding those initial two customers as well as, you know, pushing that that AI road map forward is sort of on our very near term.

47:52 Now next year, early, we would like to release some tooling that sort of brings in a freemium model. Right? So this is the idea of all this great work that the Gentix, solutions are doing monitoring this open source, field of play and all this critical infrastructure. We'd like to be able to understand you know, help, commercial clients understand all the risk that's cropping up in their infrastructure because of that. Right? Now the free part of that will be helping them sort of understand at a high level that sort of nutrition facts. Right? Here's what's going on in your in your infrastructure because you're using open source today. Right? You know, if you'd like the fixes and continued vigilance past this point security scan, you need to get in touch and become a paying customer.

48:38 But that's a good way of sort of, you know, accelerating the lead generation in the commercial space while making sure that everything we've developed for sort of government or government flavored customers here to include civilian agencies, to include federal is also applicable in the commercial world. That sort of gives way in the second quarter to really offering agentic remediation services. Right? So having AI actually write and deploy the patches surrounding the issues it's finding. I can't understate how huge of a capability that would be. Right? As Greg said earlier, that 750 number out twenty twenty thousand reviews seems like a small amount. But when you actually talk about, you know, the work required to, to make sure those security vulnerabilities are closed and customer infrastructure, it's significant. And when we're really leveraging AI to make that less of a lift and less of a a hairy problem.

49:38 You know, we've talked previously about, you know, partnerships with with larger entities and really scaling our offerings out for those entities. Our initial target for this, you know, is is in line to be initial customer in in q four this year. But they've really bought into this vision of us being able to drive joint revenue, through partnerships with them. So every time they have to fix a open source infrastructure security bug in a classified environment in a critical cluster. Right? Obviously, they'll have the infrastructure, the boots on the ground, the bodies to be able to affect that in that air capped environment. But we will definitely have the software and the AI processes that makes that repeatable and scalable with their existing workforce, to the to the tune of good revenue numbers.

50:27 And that sort of, you know, goes into, '27, which is really taking advantage of this platform we built, this data we've collected. Right? And really trying to move towards this bigger idea of doing AGI like things in cybersecurity with this fleet of agents who are able to identify security vulnerabilities or mediate them in third time and and and priority there. So I'll pause there with sort of the overview of our road map. And and, John, if you wanna direct me to any specific questions that you think we should be queuing up. Yeah. Sure. Appreciate that, Steve, and, great job team on, getting through this. I think it really gave people a good update on kind of the journey. Steve, a lot of the questions are coming from, you know, and maybe you addressed it before, but let's hit on it, size of contracts.

51:17 When I talk with you and the team, you kinda have this feeling that it's you know, each of the contracts is gonna be about, you know, low 7 figures. There's gonna be a combination maybe of thirty five percent one time work, let's say, for some of these initial government customers and when we talk about these initial government customers, we're talking about really heavy DOD intelligence community customers that we're connected with. So, right now, Steve's identified a couple that are out there. You know, the expectation is there five to 10 of these low hanging fruit. That doesn't mean they happen tomorrow but that we kinda get, our credibility allows us to be swept up into that.

52:04 And so I think, the the the idea is staying within the the the people that we can reference right now and to, others that are very close to them, pick up, you know, over the next year, these next, five to 10 customers with that, you know, low 7 figures activity and that once that momentum gets going, that as we enter calendar year '27, we're really positioned to expand along with these strategic relationships. We've got one strategic relationship going. I'll tell you it's a $7,000,000,000 company today, so it's not a small integrator. There are probably three or four more integrators like that that as the team gets going here, they'll be able to reach out to.

52:54 And so I think that's kind of the the the scalability of what we're seeing right now. You want to expand on that, Steve? Or does that capture it enough for you? Yeah. I think so. And through those integrators as well as some of the bigger direct ones with ones like Air Force, right, I think we trend towards the higher six to seven figures, in these initial stages and who knows where it goes after that, especially as we start turning over these issues. You know, just to give a number on it with like, those 750 issues. Right? I could see the integrators generating, you know, tens of millions of dollars on fixing pervasive issues in that seven fifty, for these customers. Right? So, obviously, we will be right there in that journey in providing both the leads to fix those issues, as well as some of the deep technical expertise. So I'm pretty excited about that. Yeah.

53:49 Great. One of the other questions that we got is have we totally abandoned r and d projects out there? And I know Michael is wincing when he probably hears that because, Michael is, very involved with getting bids in and, like I said, you will see that, you know, out of our current backlog, which I was talking about, that, does not, you know, include any of the Ranger AI activities at this stage. Michael's team is in that area is delivering about 4 and 4,500,000 in this coming fiscal year. So I think that's, pretty key. Michael, I think, maybe you can just quickly talk about being more focused, right? R and D not for R and D stake, right? That it really is a building block and that's a key part of your strategy and and helping us move to this product.

54:38 Yeah, I think that's exactly correct. And I think that myself and the rest of the team actually appreciate the opportunity to focus on building a thing that's exciting and take advantage of a lot of the advancements in AI and stuff. So as we all know, research dollars are very tough to come by, extremely competitive, and they're sort of a one for one. You put $1 in, maybe get some value out the other end. But they're really tough to get, really tough to keep, and very uncertain. So I think we look forward to focusing on this particular capability, particularly because there are some very obvious places where this can be a receptor for some of our past research work and techniques. Yeah. Stuart, I want to give you a chance to hop in here. Stuart is one of our newer hires, IE two years. So, that's new for NARF. We have a very dedicated team.

55:30 They've been together over a number of years. Stewart was one of her first hires that was brought in to help with project and product management and he comes from a background of having done that and he's the one that's hopped on. He's been very active with our customer in the Air Force activities. And Stuart, can you just real quickly, know, we talk about platform one and Iron Bank, right? I don't think people understand that it's just not one customer that's potentially there. The breadth of platform one. Can you just address that real quick and the activities you've got going on to now get this product out to all these other relationships? Yeah, absolutely. Yeah. Hello, everyone. Platform One serves as a both point for upstream vendors and providers of intelligence and containers.

56:22 But they're really the the holder of containers for the DOD and for other agencies that want to rapidly set up a new software environments, take on these pieces of software and understand that they're coming from a trusted embedded source. So when they go to platform one, and they're using platform one, or they're using their containers and tools, they have a sense of trust that they're coming from a secure place. And that's been the key component of our relationship with platform one is enhancing that posture of their security. Thanks. So, yeah, I think as I kind of looked through the questions, tried to test the team here to to summarizing them.

57:08 So, we'll final close out just getting back to kind of the health of the company and and where it is. You know, I've been very impressed with Steve and the team and the, commitment that they have. It is a solid committed team. They've been through a tough period of managing resources. They're coming out of it. They've done a great job. They they they complied with the board's direction of, you know, get out there and stay within your bounds. So we're very pleased with that. Right now, with the execution that we have and with AgenTeq AI, we kinda are within our bounds, within our current financial profile to be able to deliver on those things as we've talked about, here.

57:53 In respect to expanding, we are looking at strategic partnerships, and we'll continue to look at those and to leverage the, resources and funds if we need it from those people. We don't wanna give up equity at this stage. We'd probably rather give up some percentage points on, you know, pricing to a partner rather than giving up equity. So that's kind of the strategy you're going to see us continuing to pursue. No question, we could go faster with additional equity but until we're able to show you all the traction here and gain your confidence on on where we're going. We're going to we've got, our hands full plugging away with, what we've got here. Alright. I think we're coming up to the hour here. Steve, let me, turn it over to you to to wrap up.

58:47 Yeah. Thanks, John. No. I I I just wanna echo. I think we're pretty excited about, you know, where the AgenTek, technologies and frameworks have gotten to in the last year, we're really seeing an acceleration of being able to leverage them on our problem and our customers' problem set. I'm also excited about some of these strategic relationships that we're forming now because we're definitely first in the door, and we're definitely very far ahead on the on the solution and the problem, that we're addressing for these guys, which is which is sorely needed for them. So I want to thank the team for getting on early and explaining their components of things. I'm looking forward to getting back work on this. And we'll have some follow-up announcements as they come on these initial customers and what else is going on here at NARF.

59:38 And one last item. I kind of see in this forum that a number of questions we didn't get to, but that we can answer them here maybe after we're done online and to wrap them up here. But in any event, we'll try to get to them all. Alessandro, I think we're all set here. Is there anything you need to do on your side to wrap up? No. Well, that's great. Just thank you very much for updating investors today. Could I please ask investors not to close the session as you now be automatically redirected to provide your feedback in order the management team can better understand your views and expectations? On behalf of the management team of NARF INDUSTRIES PLC, we'd like to thank you for attending today's presentation, and good afternoon to you all.