The contract with Orange is another transformative deal that validates both Cyan (DE:CYR)’s cybersecurity technology and its white label model. Deployment across Orange’s 28 subsidiaries may not prove straightforward and the pace of end-user adoption is difficult to predict precisely at this point. Nevertheless, Cyan’s assumptions appear conservative and suggest the contract could generate additional annual revenues of €25m by FY21. Consensus forecasts group EBITDA to reach €37m by FY21.
Business description
Cyan supplies cybersecurity systems for mobile data networks. Following the recent acquisition of I-New, its two major products are: 1) content management software sold as a white-label product to mobile network operators; and 2) a traffic management solution for MVNOs that enables them to reduce network traffic and therefore corresponding costs
…Orange: Another transformational deal
In our previous note we highlighted how Cyan’s acquisition of I-New should accelerate its growth trajectory. The long-term (six-year minimum) contract to provide security for Orange’s 260m customers across its 28 subsidiaries is a similar step change, in our view. It validates both Cyan’s core technology and is further evidence that operators recognise the potential of cybersecurity to boost ARPU. Orange will begin domestic deployment in Q419. Assuming a 6.4% penetration across the customer base and a monthly ARPU of just €0.13, Cyan estimates the contract should generate revenues of €25m in FY21.
Financials: Revenue expected to double by FY21
Cyan delivered against FY18 guidance and confirmed it is on track to meet its FY19 guidance (revenues of €35m+ and EBITDA of €20m) in March. Factoring in the incremental revenues from Orange, it has guided to revenue of at least €60m by FY21, more than double the H218 run-rate (€26m) and implying a three-year CAGR of 38%. If we assume no margin uplift from FY19 levels (57%), this suggests FY21e EBITDA of €34m. The high margin, largely recurring nature of Cyan’s revenue base offers investors good visibility on this profit growth in our view. The main uncertainties are the speed of deployment across Orange’s subsidiaries and the pace at which its customers adopt the technology (see page 2 for details).
Valuation: Discount to peers despite growth
At €26, Cyan’s share price is essentially unchanged since the beginning of 2019. At current levels it implies 8.2x FY20e consensus EBITDA, a multiple that falls to 6.5x by FY21e. Ultimately, a DCF approach may be the best way to capture Cyan’s value, but even applying a peer group average FY20 EV/EBITDA multiple (12x) suggests a value of €38 per share, 45% potential upside.
Edison Investment Research provides qualitative research coverage on companies in the Deutsche Börse Scale segment in accordance with section 36 subsection 3 of the General Terms and Conditions of Deutsche Börse AG for the Regulated Unofficial Market (Freiverkehr) on Frankfurter Wertpapierbörse (as of 1 March 2017). Two to three research reports will be produced per year. Research reports do not contain Edison analyst financial forecasts.
The Orange deal: Details
In December 2018, Cyan announced it had secured a long-term (six-year minimum) global contract to be the exclusive provider of cybersecurity to Orange’s 260m mobile, fixed line, consumer and business customers. Its ‘OnNet’ software platform will be embedded into Orange’s networks across its 28 subsidiaries starting with France in Q419, before moving to its other European assets and African subsidiaries in H120. This network-level implementation and white-label approach (or B2B2C as Cyan describes it) makes it easier for consumers looking for cybersecurity and generates ‘value-added’ revenue for operators. Cyan will be paid a share of the incremental revenue generated as Orange customers adopt the service.
Precisely how Cyan’s cybersecurity service will be provided to Orange’s customer base is difficult to say at this point. It is expected that in some markets consumers will predominantly need to opt-in but in other markets it could also be included as a default option or even mandated. Orange is likely to market the feature differently according to the type of customer and the tariff they are on.
How the service is sold to customers will affect both the likely adoption rate and Cyan’s revenue share percentage. Cyan points to its experience in Austria as evidence of the likely take up: T-Mobile Austria currently charges €2–3 per month for cybersecurity and, with very little marketing, adoption reached 25% in just 2½ years. Cyan is currently working with Orange to develop a marketing campaign in its domestic market. It conservatively assumes adoption could reach 17m customers by FY21 (6.4% after an average of 18 months). Applying a revenue assumption of €0.13 per customer per month, Cyan estimates the contract should generate revenue of €25m in FY21. Assuming an adoption rate of 10%, this would increase to €39m. Like Cyan’s other revenue streams, any incremental revenue generated is likely to be recurring and high (80%+) margin.
Execution will also be critical to delivery. Cyan has already integrated OnNet into large mobile networks of course, including the Polish and Austrian subsidiaries of T-Mobile, but a roll-out of this scale, across 28 subsidiaries, different customer types and multiple tariff plans, is a different order of complexity. Given the size of the contract, Cyan is focusing a substantial proportion of its resources to delivering it seamlessly and has stated that its internal IT capacity will now be fully utilised until the end of FY19. The company is increasing headcount to expand capacity and believes it has sufficient resources to deliver at least one additional large contract from its pipeline given the lag between conversion of prospects and implementation. However, it has refocused its sales activities towards more profitable contracts.
Outlook for H219 and beyond
Over the next six months the pace of roll-out and the marketing strategy at Orange should become clearer. In addition, Cyan believes it has two to three large contracts close to signing and, although the timing and size of any further wins is not clear and cannot be guaranteed, they would clearly improve prospects further. Cyan has described current interest in its emerging insurance and banking product as particularly encouraging.
Even without additional deals Cyan expects to substantially outperform its nearest cybersecurity peer group. Its FY19e guidance implies organic revenue growth of 53% and EBITDA margins rising to 57% (vs forecast for cybersecurity software peers of 20% and 30%, respectively) and FY21 guidance implies a revenue CAGR of 38%.
Cyan is also improving the accessibility of its financial information as it prepares to move to the Frankfurt Stock Exchange in FY20. Our analysis here is based on the limited financial information the company publishes in English. In July 2019, Cyan will publish its first set of IFRS accounts and will move to quarterly IFRS reporting from Q319. This should substantially increase the breadth of institutions able to look at and invest in the company.
At €26, Cyan’s share price implies 8.2x FY20e consensus EBITDA, a 30% discount to its nearest cybersecurity peers despite significantly better growth prospects. Given its growth trajectory a DCF model may be the best way to capture Cyan’s value but even applying a peer group average multiple (12x) suggests a valuation of €38, 45% upside to the current price.