Narf Industries (LSE:NARF) — Strategy & Operations Update

0:01 Good afternoon, and welcome to the NARF INDUSTRIES PLC Investor Presentation. Throughout today's recorded presentation, attendees will be in listen only mode. Questions are encouraged and can be submitted via the Q and A tab situated on the right hand side of your screen. Before we begin, I'd like to submit the following poll, which I kindly ask you to submit your responses to. I'd now like to hand over to executive chairman, John Herring. John, good afternoon. Yeah. Thank you very much. Good afternoon, everybody.

0:27 I'm John Herring, executive chair, and we've got today also Steve Bassi, our c our president, CEO, and founder of the company. And so we're pleased to provide you this update. We've been doing them about every quarter through IMC, and it seems to be an effective way to keep everybody up to speed. We see a number of questions that have been submitted. And as I've reviewed them, I think the majority of them will be covered in the presentation here. So, we'll go ahead and get started with that and, leave some time. I'm gonna try to wrap up this in about forty five minutes and so, get people back fifteen minutes in their day. Steve has a pretty important call. He wants to, hop on at that time, so I'm trying to facilitate that and appreciate you guys, everybody's, patience with that.

1:18 Okay. Getting to the meat of the matter. We did get out a press release this morning, an r and f. So many of the disclosures in there is what we're going to be talking about and providing some additional detail. A financial update, which I'll give. Turn it over to Steve to do the g r and d sector and the g s and s sector. As a reminder, these are our two main business operating groups that we have. G r and d specializing in the DARPA, IRPA, the advanced work activities, which are usually multimillion dollar contracts over one to three years type activities, and that we've had continued great wins in those areas. And, again, that is work that we undertake, which is very advanced, but our objective is to be about two or three years ahead of the market working on those capabilities, and they all fit into what we're doing with UPXI, which we'll talk about under the GS and S sector.

2:19 So, and Steve will highlight a couple of those programs also. And then, Steve will get into great detail on UPXI and exactly where we are, some of the contracts that we have won, with UPXI so far, and then also, the, ones that are in the, hopper. So with that, very quickly, financial. Our fiscal year ends, March 31. And so these are unaudited numbers, but our revenue did grow to about, by 40% up to 4,200,000. So we're pleased to see that. Again, we continue to operate within our available financial resources. That's our cash flow primarily out of g r and d programs at this stage. And the CEO loan facility, Steve has been very good to continue to extend every year when it comes up for renewal, and we haven't busted those boundaries. I will say, and my thanks to Steve, we have been in the position to pay Steve back, but, Steve is then wanting to hire people, to drive more of the UPXI capability.

3:26 So, we're, very grateful for him, and, we do need those dollars to continue to stay on the leading edge of that. So, that's kinda how we're balancing that. When we get to this year '27, which started one April, a month ago, as we enter that, we do have about 5,300,000 of fully contracted revenue at the start of the year. So again, you know, we did 4,200,000 this year and already out of the gate without any additional awards. We're going to deliver about 5,300,000 in revenue, and we got great confidence in the guys being able to staff that and to do that. We've continued to have great GRD awards over the course of the year, we continue to look forward to that. We had a record year last year with about 10,000,000 in awards that we had announced.

4:18 We did have an award that was made post the year, 2,500,000, greater than 2,500,000. You'll get more details on that over the next couple of weeks. In these situations, and you've seen it in the past with us, we might get an award from a government agency, and we need to get cleared, the disclosures we wanna make in a press release. And that can take anywhere to fifteen to twenty days after the award. Typically, we would probably wait until, we had all the information and release at that time. But because we are coming to this meeting, we're going ahead and disclosing just the general, award of that. I think it's about a eighteen month two year program, but that is built into our backlog and all.

5:07 Then finally, so that was GR and D and overall, and then GS and S pipeline, that is primarily being built by the UPXI business. So you'll be seeing us reporting under GS and S, and you can begin to track the UPXI growth through that sector reporting that we do in our financials. Okay. Well, at this stage, I'm gonna hand it over to Steve. And these next two slides again are about GR and D. And I think the message that Steve will be trying to get to you is that, basically, our UPXI platform, we'll give you what that stands for in a minute, is, is going to be receptive of all these new capabilities that GR and D is beginning to push out. We currently have our base value proposition, but the message is here, we've staked out a very good segment of the market that we can actually continue to grow our moat around our competitive positioning and expand our values there. So, Steve, with that, I'm gonna turn it over to you, and you can drive the slide deck as you wish. Sure. Thanks, John. Appreciate that.

6:19 Good morning. I'll talk to you about our our recent g r and d wins and how those are progressing slightly, and then we'll move into the meat of this, which is UPXI, formerly Ranger, if you're tracking it by another name. So let's kick that off. We recently got a another phase greenlit with DARPA work for something called ingots. I can't get too far into the to the meat of the program there. But one of the things I wanna point out is we are bringing this, you know, out and up into the UPXI platform as well as heavily leveraging AI for both security research and active defense of of things we're doing on this project.

7:07 So if you've seen the some of the mythos news, that was an interesting PR coup by Anthropic. But the reality is most security researchers have been leveraging, these models in this way, for quite some time now. And I think the, you know, the the hype of late, is is a bit late in coming, but we're all we've already been tracking this and doing a lot with it. So moving on to, you know, another another DARPA win of ours, you know, which we announced in December last year, and we're able to get the press release releases approved. We're doing a fair amount with AI and AgenTeq technologies on this program. And one of the big novel things is dealing with threats in all these GPUs and models that are coming off the line, the models that they run, and looking at the actual hardware level for for active exploitation and vulnerability.

8:08 So that's what the Red Sea program is focused on. It's very much targeted at what's called the bus, which is the interconnections between these large deep GPU farms and servers where a lot of the compute traffic and a lot of the AI interactions are moving today. So we're pretty excited about this as it progresses through research and the ability to, you know, to be very viable outside of the research domain for defending some of these new, you know, AI, agentic, and model driven environments. So this is a multiyear DARPA award. We're we're in year one. We're having reasonable success so far in the first quarter with our research results, and we hope to be able to share more soon as we progress.

8:58 So that brings us to our rebranding of Ranger to what we call UPXI. It stands for upstream extended intelligence, and we'll explain why that matters and, why we say upstream. So one of the things we hear from early design partners, and customers around, Ranger and UPXI now is that they really want to get what's called left of boom. So at the point an exploit and a vulnerability is announced and everybody rushes to fix it, it's very, very late. And the existing industry focuses on doing all of this downstream. So after this vulnerable code is built into people's environments and containers and basically is already running inside their environments.

9:49 We think this threat is actually further upstream, and we've seen this with several things we've reported to this group over the over the last year or so with, you know, everybody from the North Koreans to the Iranians basically going after the software supply chain. We saw two very recent examples of this, and the the irony in a couple of these is they're they've actually, one of them actually targeted a well known container scanning and and downstream, vulnerability scanner. And they did this by stealing the credentials of this, this this team and basically propagating their their malware quite quite broadly. So these are examples of both, downstream tools and where they break down. A lot of the downstream tools didn't catch these compromises, and some of them were actually part of the compromise. That's why we're aiming upstream.

10:39 So here's a good, a good sort of, graphic of the various domains and how, software is produced and run. And a lot of software, as we discussed previously, is produced in this sort of upstream open source ecosystem where people sort of pull it down, remix it. But, really, when they pull it down into the developer domain, they don't know what they're they're getting, in some of these packages. And there's no aspect of knowing the developer created it. There's no, there's no reading of the developer that's using it, of the source code of the thing they're pulling in. And there's really no, you know, no sort of knowledge until all these the and and scanning for for threats until these things get all the way downstream into the runtime domain. And so that's why with UPXI, we're targeting the upstream ecosystem and doing this on source code and providing risk assessments on developers before it gets all the way downstream.

11:37 So to do this, we built both the platform and the data source. And we're going to market first with the data source as we add capabilities from GR and D into the platform. So one of the things I wanna highlight here is that there's been a lot of discussion about Anthropix miss mythos, and how it's very good at finding security vulnerabilities. Spoiler alert. A lot of the open and closed source models are extremely good at finding vulnerabilities already. The problem is in having the agentic technologies and the workforce to apply these models, find the issues, and more importantly, fix and deal with the issues. Right? So that's why we've basically focused upstream and focused on finding flaws before they're built into software downstream.

12:27 And so that's what we built UPXI to do and some of the data we're talking about.

12:35 So our one point o for this, which is shipping today, consists of three main things, that provide what we call contributor risk intelligence. All three of these data sources are sent downstream to our customers, and they already use them in things like deciding if they should distribute a software package to their DOD customer, all the way to, DOD itself using this in software factories to make sure that the containers they package and build that end up in, you know, on tents and Humvees out in the field don't contain vulnerabilities, and they're very certain of the the provenance of the source code in those containers. So we're delivering this, but more specifically, there's three sort of broad classes of data that we deliver through this platform that's really of use to our customers.

13:32 One is this idea of contributor dossiers. So especially for our national security market segment, they very much care about the identity and and affiliations of those building their software. This is doubly certain with the employment history. So there's a lot of, as you know, defense industrial and state sponsored, tie ins with large corporations and technology corporations all over the world. And our customers are very, very concerned about the the ability for those corporations to influence the backdoring and or vulnerability insertion in open source software. So we go ahead and flag those ties, and we we basically send our our downstream customers a list of developers that are systemically important to them and, you know, very well reasoned and very good data about why they should be concerned about said developers.

14:34 The next thing we do is security reports. So we are analyzing hundreds upon hundreds of thousands of what are called commits to open source code every day. And we are applying models similar to mythos, but we're not just applying them once. We're applying them both to look for vulnerabilities, to fix them, to validate vulnerabilities, and produce these security reports. And these all go downstream to our customers, but we're really doing it before the software gets built into their environment so they can be aware of the last thing, their risk both at the contributor level. So what what is their risk associated with these foreign influencers or developers as well as the, as the source code and actual vulnerability level itself.

15:24 So I put in a couple gratuitous screenshots of the product as it exists today. I think the important thing here is this is a view for for one specific vertical, specifically the government and national sec vertical. And the the really interesting thing here is this is, I think, over about a month, and we were able to generate about 26,000 reports, but really narrow that down to about a 150 critical areas of risk across this software that this this customer is consuming. So the thing that customers love about this is we have very, very high signal to noise ratio. So when we flag a risk, it's been validated and verified by all these advanced models, and we have a lot of information about the the developer and the provenance of that of that vulnerability of that issue.

16:20 And this kinda gives you an idea of of of another view that customers very much find interesting. And that's that of, you know, where am I finding the most risk of foreign influence? And risk is defined not just by the flag in the country for these customers, but it's also defined by how many security errors or how many risky code commits these developers are introducing. And you can see kind of a a top, you know, page one map here of a specific view. So that brings us to traction. You know, here's our go to market. We've made quite a bit of progress. We are still waiting for a contract from our our DOD software factory.

17:09 We previously hoped to have that in q one. We believe it'll be in q two now. The reason for the wait is the marketplace approach that was previously championed by them has a very short term one year funding source attached to it. So we've got a two year proposal in with a longer term option in the low 7 figures to be able to capitalize on that. But the key value here is that it's a longer term contract because it seems to take some of these government customers a longer term to where we didn't wanna do just one year. So the the second the second one is we're we're dealing with a large government systems integrator. We've got a an initial contract in with them where we're pushing some data through. We expect that to expand in phase and scope, specifically around some large procurements that they're handling on behalf of of government and DOD that we expect to go live in the summer. So stay tuned for follow on phases there, which we think will expand scope and value.

18:16 And last, how we're approaching the commercial market. So with the data sources I previously discussed, we actually were at RSA, which is big security conference in San Francisco last month. And we found out that a lot of a lot of companies in the container and app sec platform business don't have great contributor and upstream intelligence. They do okay on code analysis, but the big thing that their government existing government and their some of their big multinationals, especially with tariffs and sanctions are asking, is who's contributing my source code, and where are they based, and what is the what is the potential for foreign influence?

19:01 So we have a very, very unique data stream that's US based and US sourced, which, you know, has been pretty key. So we've got a a a fair fair amount of ongoing partner discussions with those guys where we hope to see sort of our first our first wins in the commercial space this year.

19:26 Obviously, we're helped by and we've discussed some of this before, but there's been a huge amount of, policy on The US side driving some of these things. You know, there's blanket statements that are, frankly, no one knows how they're gonna deliver technology, without sort getting a handle on where the foreign influence is coming from in the first place on some of these. I'd point you to the executive as well as the the cotton letter up top. But, really, what this means is that, even in software supply chain, people are going to have to prove a provenance for what they're building. Right? I'd say that 60 to 70% of solutions today that are very expensive and custom delivered to the government are built on open source basis with contributors that span the globe. And no one out there in the market has been able to quantify and qualify both the the criticality and the scope of contributions with foreign influence.

20:28 And that's basically what we're looking to do with with our data as we push it out. We've seen this sort of be tiered into pricing on containers, and we've seen we've seen, you know, numbers for other container scanning and and data sources coming in around those price ranges. So that's why we we have some confidence in the, in in the numbers we're, you know, saying in the ranges for these contracts. So looking forward, we think UPXI will become the upstream intelligence layer that every AppSec platform, either government or commercial needs. The the, you know, prime prime examples of this are gonna be near term in the DOD software factory.

21:20 So that are already pushing out lots and lots of softwares or lots and lots of software containers, and the and the data feed product will be first to go to the commercial side of that. Medium term, we expect the UPXI and and platform customers, to, you know, to basically be expanded in the commercial areas. And I hear I see the British spelling of artifact here. But we will we will we will basically be able to expand into software packages from just runtime containers as well, which is an important area of coverage and as you'll see where a lot of supply chain compromises have been delivered in the past hundred and twenty days or so.

22:14 Alright. So, John, I think I'm passing back over to you you here. Sure. Thanks, Steve, for that. Steve, I've been looking at some of the questions that we've received during the call here, and I think we should probably step through a few of those a little bit to clarify some of the information. So first off, in regards to our numbers, there are some questions around do we expect to get 10,000,000 a year in contracts from g r and d going forward? And so in respect to that question, that $10,000,000 is spread over a couple of years that we were awarded this past year.

23:00 We do look to get contracts that contribute at least maybe 5,000,000 in revenue a year to keep that backlog moving along so that we have a steady state there. The importance of what we're doing is that it's just not going after any contracts that are out there. They're going to ones that are very specific to supporting this upstream capability. So we do not go after GR and D contracts that don't have at least a little bit of a line of sight to contributing to the UPXI platform. So we'll con continue to receive good awards out of the GR and D. They'll continue to support cash flow. There was a question saying that with that 5,200,000, do we expect to be or the 5,300,000 we have in contracted backlog that will burn this year, do we expect to be profitable?

23:58 I I think I've commented on this before. Profitability is not the drive that the board has set for the company. We it's embarrassing how little we are investing in UPXI, and it's amazing the competitive position we've achieved with such small investment going into that. So it's being funded internally. And, like I said, a lot of it is from Steve continuing to keep that loan out there for us. And because we do feel that we're undervalued, we don't want it to go to market at this stage until we can show people this traction in UPXI and going forward. So another question that we've had is why do you feel you're undervalued?

24:47 Well, certainly, here in The US market, there is a great understanding of, the values of cybersecurity and what's going on. And it's frothy over here as far as the, you know, investments that are going into it over here. So I can tell you that comparable to, you know, any number of people over here that, you can have any analyst do a head to head comparison of where we are. And if we were able to execute on continuing to get g r and d programs and UPXI more particularly, which is that broad based platform that we will, consume future g r and d work into that will continue to, grow our value there, that, there's no question that it's gonna be a huge win. So, what do I think needs to be done to confirm that? We need to get validation from the marketplace, which I feel we're on track with. As Steve mentioned, we did get the award with a systems integrator through a partner.

25:48 No. We are not going to be able to be talking about, those relationships publicly. They're very competitive sensitive at this stage. So I just wanted to, make sure that, you know, we we I've been on phone calls recently, and people come we're working with or saying, oh, yeah. We listened to your investor meet. That's interesting strategy. And it's like, wow. We should probably be a little bit, do the best for our shareholders, but have a good balance between, those type of communications. One of the other questions was along strategic investments and partners. And, yes, as we begin to tie in to some of these larger companies and relationships, we are finding ways of which we can jointly develop capabilities that fit into them.

26:41 And, certainly, at some point, I hope that these partners, they see the traction that we're having here, come in and say, well, we want these things developed, can you do this? And that we can raise some money, whether it be investment money from them in a joint venture or whether it just be some advanced payments against some future possibility, then we'll be able to to do that. Steve mentioned a couple of names of companies in here like Sonatype and others. I would say they're representative. We were out at the RSA conference. I would from that, I know of eight active activities of which we're dealing with partnerships in and discussing that and bringing things together. So, we'll continue to see that.

27:29 And, yes, as those mature, we will announce partner relationships. In regards to revenues from UPXI, the ones that we're talking about now with low 6 figures and low 7 figures are all around doing integration activities in into this and then providing some of the initial services. So those are integration programs and activities. Steve pointed to this container model of what we would be getting per container activity. And that's really going to be the go forward model. Once we're integrated into them, we'll be charging per container. So, yeah, there are thousands of containers out there. There are a huge app sec market of vendors that are out there that we're just beginning to engage with and to, confirm the value proposition. So we hope to, to continue to drive that forward. And as Steve laid out, you know, very well, sort of our expectations, for the next couple of months, which,

28:36 you know, we'll, look forward to reporting on again, in this format in IMC. I think we complete our audit in late June, July, by the way. Things are you know, the corporate governance has been great in this company since we got it turned around. And so that's all in time, and we'll give an update after that, and we'll get some progress. In regards to announcements and those things, yeah, we're we we try to get out as much information as we can. We'll continue to to do that. I think now with the announcement of EPXI, you'll see more of activity on our part. We are setting up a a new website for that. We'll begin to populate that with information, and it gives them something, I think, Steve, talk about with some of the investment community there in The UK and some of the other blogs and interviews that go on, and Steve's committed to, now that we have UPXI out there and something really specific to talk about to continue to educate people.

29:46 Steve, is there anything else you saw on the, there was a lot about mythos and, you know, was that putting us out of a game and, activity? And I think you kind of addressed that. But after reading these while I was blabbing away, did you come up with any other? Yeah. So I think that, there's a lot of we call it FUD or fear, uncertainty, doubt about about mythos, neotropic stuff in the community. Generally,

30:20 I think that it actually presents quite an opportunity for us because people are talking about it more. But the thing that people miss is that, you know, a model on its own doesn't do much. There's a lot of day in and day out work of orchestrating that model and telling it what to focus on because it needs to be monitored and fixed re software re software vulnerabilities. And that's exactly what UPXI is doing today, and it's doing that both in, you know, understanding the contributors, but also understanding and fixing source code before it gets built into, you know, serious software with serious consequences if it goes wrong. So I think it really presents an opportunity for us because we're getting a lot of people asking us about it. What do you think of Memphis? What do you think of Memphis? It's like, it's great as long as you have a platform and a system to apply it and deal with the fallout continuously from all your software that's getting developed.

31:15 The other trend that I would that I'd point out, you've all heard of vibe coding, and I'm I'm here to confirm that a lot of people are entering the software development arena with vibe coding but not really understanding what they're producing. That that also gives a huge opportunity, to be able to apply these models, apply these security practices that our our experts have codified in how these models are sort of applied to different things and actually help people, you know, defend themselves against vibe coded apps for lack of a better term. So that's that's a big opportunity for us as well. I just wanted to comment on those two things because I I hear a lot about mythos, but I'm you know, it it's it's gonna be helpful as a model, but we're already doing this and lots of, you know, there there's lots of opportunity for it out there for AppApply in these things.

32:06 Yeah. I think, Steve, we we debate this quite a bit. Right? And, you were the one probably about, two years ago at this time was saying that this AI wave is really here, and it's gonna make an impact. And and I remember early on you being concerned about it. Gosh. Can we can we afford to hire a, you know, a $950,000 a year AI engineer into the company so that we can really compete in here and compete continue to to compete, with what was going on out there. So I think one of the things Steve and I talk about is really the democratization of AI. Right? That, it's really, leveled the playing field. It's brought all the capabilities up and up and up a layer, and, it's allowing us things like that. We we're taking advantage of this. Steve and the team have been taking advantage of it long before, you you know, Anthropic packaged it, right, and and put that fear, uncertainty, and doubt into the community about, it's gonna replace every, you know, security engineer that's out there. So Steve been well ahead of that curve and has and is taking advantage. So we welcome these advancements.

33:28 It's areas that we it's like, we we don't need to be under the hood as much anymore. We can take advantage of it and customize it for our customer base, which is in this upstream area, which, folks aren't, you know, which is a great area to go stake out. So, yeah, Steve, I I think that completes the debate on that. You feel you've answered the questions that people have asked here? You're on mute. Go ahead. You're back on. I think so. I think the, you know, the USG's, you know, near term ban of anthropic has been interesting, but it it doesn't matter for us because Ranger's act or UPXI is actually leveraging multiple models to do to do its work every day.

34:17 And and swapping models these days has become not quite commodity, but very, very well understood. And even within the platform, we use multiple different models because some

34:29 are better at others than certain certain tasks and analyses. So, yeah, it's it's been a pretty interesting year and will continue to be so, but that that's kind of my final comment on that. Yeah. No. So I'll just go back to the one slide. I'm slipping through here. Where UPXI fits in this upstream and, you know, people are asking about partners and, things like that. So these systems integrators that we're dealing with, they're, you know, 5 to $7,000,000,000 a year in their revenue activity. They have these platforms that are in place. You kinda see on this slide that, know, things like, these acronyms, the SCA, SBOM, SAS, secrets, software composition analysis, build the materials for your software. SAS is capability for a security scanner that's out there. Secrets are things that are kinda built into software that let developers know what to do and, you know, their credentials and things like that.

35:35 And so you've had these small type of, point best of breed capabilities coming up. These platform app segmenters, so Steve mentioned a few of them, that are there. They were all RSA. I mean, these are, you know, major corporations that have been in this since 2015, and they've collapsed all those capabilities at the top into a platform now and are bringing those together. And then there's third generation platform vendors or AI native, and they have popped up. And they're going like, they're really changing the market dynamics. But all of these are billion dollar valuation plus companies that are out there.

36:21 And, Steve and his team did a great job of making contacts with this RSA and getting to the, real leadership in those companies and getting your attention, and they're following up on them. So, we had a question. Know, do we think UPXI is gonna be a huge contributor? Yeah. UPXI, we've done in our our one point o launch, which has that contributor risk intelligence, and we're looking forward to, continuing to build that out with these other things that are gonna flow in from g r and d. Alright, Steve. I'm sensitive to your timing and everything, so I think we answered most of those questions, that or there. If any others come in, we'll get to those and get them out. So mister IMC, I think we're about ready to wrap up here.

37:12 Perfect. Thank you both for answering those questions and for your presentation this afternoon. Before we ask investors to share their feedback, which I know is important to you, John, if I could just ask you for a few closing comments to wrap up with, that'd be great. Yeah. I think we've we've steadied the ship here. I think we're delivering on numbers. We're, delivering on the commercialization, and we've got the right connections now to go really dive to a next level and figure out these go to market strategies, and, the team's excited to have something to go kill. Thank you. Great. Thank you both once again. Ladies and gentlemen, can I ask that you don't close the session just yet as you'll now be automatically redirected to a page to give your feedback, helps the company better understand your views and expectations?

38:04 On behalf of the management team, we'd like to thank you for attending today's presentation. I wish you a good afternoon.