New strategic focus on telco cybersecurity

Cyan 15 October 2021 Update
Download PDF


New strategic focus on cybersecurity


Scale research report - Update

15 October 2021



Market cap


Share price graph

Share details




Deutsche Börse Scale

Shares in issue


Net debt at 30 June 2021
(excludes Q321 €8m capital raise, includes IFRS 16 leases)


Business description

Cyan is a Germany-based cybersecurity provider for MNOs, ISPs, insurers and financial providers. Its core business is delivering cybersecurity for blue-chip telco customers. It also acts as a mobile virtual network enabler (MVNE) developing and operating BSS/OSS platforms for mobile virtual network operators (MVNOs) and B brands of MNOs globally, and enables them to reduce network traffic and corresponding costs.


New focus on high-margin recurring revenue.

Cost reduction program that should help margins.

Rapidly growing cybersecurity market.


Execution and timing risk in shift to cybersecurity.

Multiples leave little room for delay or error in restructuring plan.

Moving away from historically higher revenue capex deals in BSS/OSS business.


Ken Mestemacher

+44 (0)20 3077 5700

Cyan’s H121 results reflected ongoing challenges, with revenues dropping 80% y-o-y and EBITDA turning negative as large prior year contracts did not repeat. Subsequently, in August management announced a strategic realignment focused on generating recurring revenues in the higher-margin cybersecurity business and reducing costs. With shares trading in line with peers, there is little room for delay in execution. However, Cyan’s business has long-term potential, operates in an expanding market, an €8m September capital raise boosted its balance sheet and management launched a plan to return to profitability and growth.

H121: Ongoing challenges continued

In our note Reset and regroup, we reviewed several challenges Cyan faced in FY20, which unfortunately continued into H121. Revenues fell nearly 80% y-o-y to €3.5m with EBITDA turning negative to a €7.4m loss, as several large one-off sales did not recur and Cyan’s cost base continued increasing. However, there were rays of sunshine where several new contracts and extensions were reached, and the April Orange launch marked a key milestone and reference point for future customers, as Cyan continued building up its recurring revenue base,

Strategic realignment to cybersecurity

In response to the H121 results, Cyan in August announced a significant restructuring programme and reset FY21 guidance from c €21m to €10–14m. Its focus is now on cybersecurity for telco customers, and as a result, management is exploring various strategic options for the lower-margin business support services (BSS)/operations support services (OSS) business, including a potential sale. The restructuring will be implemented by standardising products to accelerate project implementation, targeting higher-margin recurring revenues, and implementing a cost reduction initiative, targeting a 30% decrease in costs. To fund the restructuring, Cyan held a fully subscribed capital raise in September, raising €8m.

Execution is key to retaining valuation

At €3.91, Cyan’s shares are down 61% year to date, with consensus not expecting positive EBITDA until 2023, although management is targeting 2022. Even with that fall, Cyan’s price implies a 12.7x FY23e EV/EBITDA ratio, in line with cybersecurity peers. As we highlighted in our report Growth potential remains, Cyan’s business model retains long-term potential and operates in the rapidly growing cybersecurity market. Nevertheless, with a valuation based on a consensus FY23 sales growth rate of 60% or ~ 4x higher than peers, management has little room for delay in executing its restructuring plan and returning to profitability.

Consensus estimates



Adjusted EBITDA* (€m)

Adjusted EBIT* (€m)

Adjusted EPS* (€m)































Source: Refinitiv. Note: *Adjusted for exceptionals. **Includes €8m capital raise.

Edison Investment Research provides qualitative research coverage on companies in the Deutsche Börse Scale segment in accordance with section 36 subsection 3 of the General Terms and Conditions of Deutsche Börse AG for the Regulated Unofficial Market (Freiverkehr) on Frankfurter Wertpapierbörse (as of 1 March 2017). Two to three research reports will be produced per year. Research reports do not contain Edison analyst financial forecasts.

Strategic shift to cybersecurity

Challenges continued in H121

In our report Reset and regroup, we reviewed several challenges Cyan faced that continued blighting its financial performance throughout 2020. Those challenges continued in H121, and despite many new deals coming in cybersecurity, revenue came in slower than expected and fell to €3.5m, down from H120’s €16.9m, which benefited from non-recurring revenues from the old Virgin Mobile business and a capex contract for 83m end user licences. Revenue from several of these large contracts (Flash Mobile/CAN and Virgin Mobile) was recognised upfront in 2019 and 2020, but as such, did not recur in 2021. However, revenues were in line with H120 when adjusted for those one-offs. Segment revenue came in at 63% BSS/OSS (€2.2m, down from €15.4m in H120) and 39% Cybersecurity (€1.4m, slightly lower than H120’s €1.6m). Most revenues came from the Europe, Middle East and Africa region (~ 65%), up from 11% in H120 due to upgrade or expansion projects in the BSS/OSS segment. The remainder of revenues were split between Asia-Pacific (20%) and the Americas (15%). Unfortunately, EBITDA turned negative, moving to a €7.4m loss from €2.2m profit in H120, primarily due to the falling revenue and increased personnel expenses. Lastly, diluted EPS fell to a loss of €0.75/share from a €0.06/share profit in H120.

There were, however, rays of sunshine in the first half of 2021. Contract extensions were reached for Bangladesh customer Skitto as well as expansions into Magenta’s fixed-network customers and into METL’s Switzerland and German businesses. Two cybersecurity solutions for large telco firm Orange in France were launched in April with growth rates of 20% seen across the first six weeks. The Orange launch marked a milestone and provides a key reference point for future customers, with product rollouts planned for other Orange national companies, though revenues were not expected until late H221 and into 2022. Business with Claro Chile and two other mobile network operators also were added. These contracts should contribute financially in the near future as Cyan builds up its recurring revenue base.

New focus on cybersecurity for the masses

As a result of these ongoing challenges and disappointing H121 financials, Cyan announced a significant restructuring plan with a focus on cybersecurity for telecom customers, or ‘Cybersecurity for the Masses’. The new strategy involves three components:

Standardisation: this involves standardising its products to accelerate implementation, as the same technology can be used for existing telco and future clients. Moreover, Cyan will deepen its go-to-market support, especially as many telco clients may not be experienced in selling cybersecurity. Here, Cyan will be more active with these customers throughout the implementation process, walking them through the steps and providing expanded sales and marketing support. These efforts should hasten customer onboarding and ultimate product monetisation. Importantly, Cyan’s final clients are not the actual telco companies, but the end user who opts in for the cybersecurity product, purchases it from the telco and Cyan then receives licence fees/revenue share for the users from the partner. Management describes this new business model as a B2P2C (business to partner to customer), as it is partnering with the telco firms to sell to the end users themselves. To this end, Cyan’s white-label products are installed in the telco networks themselves, rather than only at the endpoint with competitors such as Norton, Kaspersky, etc. Rather than going through a tedious installation, registration and setup, as seen with some competitors, Cyan’s customers need only to click on a message (for example, ‘Do you want to surf safely?’) to add the product to their mobile plan. Consequently, management believes Cyan’s take rate is ~ 10x that of the traditional endpoint competitors, which average ~3–5%.

Recurring revenue: Cyan will begin shifting away from a dependence on one-off projects towards a focus on recurring revenue, which includes subscriptions, recurring services and maintenance fees. This shift to recurring revenues should help even out financial results in the future, lessening the volatility experienced with many non-recurring one-off projects in the past. To measure progress, Cyan introduced two new H121 KPIs: recurring revenues (73%), above its 70% of revenues goal, and €9.6m in annual recurring revenue (ARR) (including pro rata revenues from licence agreements, which is why it is larger than the H121 reported revenue and in line with the strategy to drive growth through recurring revenue).

Cost reduction: Past acquisitions and business expansion into non-telco markets (ie insurance, automotive) also accumulated costs and weighed down Cyan’s financial results, especially when H121 revenues came in so low. As a result, Cyan announced a cost reduction initiative affecting all the firm, including personnel, operations, marketing, etc, with the goal of reducing the cost base by 30% over the next 18 months and reaching profitability by 2022.

The new strategy also has an impact on both business segments. Cybersecurity has been a core business for Cyan, and now the primary focus is on the telco industry where Cyan an better leverage its core strengths of its research network, security filter database and cyberthreat intelligence. Telco tends to be a higher margin, scalable business and Cyan’s emphasis will be on implementing, scaling and monetising about 10 existing telco customers, with a narrower pipeline of promising opportunities. In future, Cyan will readdress other markets, such as insurance and automotive, but for now the emphasis is on scaling the business and closing telco deals.

Specifically, Cyan will continue to target two sets of telco customers: mobile network operators (MNOs) and internet service providers (ISPs). Here, management believes longer-term customer retention and increased recurring revenue would occur as customers would have little reason to switch as Cyan’s solutions contribute to revenue and provide a healthy margin once installed. These two customer bases can reach a large mass market, as the end-customer bases of internet/connectivity services are already billions of users. Note that telcos are at the forefront of the cybersecurity challenge as they act as the link between users and the internet. They are looking for opportunities to further engage the user and gain margin in a very competitive market, and Cyan’s products would naturally fulfil these needs. Rather than needing a large salesforce to reach many small businesses, telco sales channels could potentially reach nearly a billion people. Under this model, the initial negotiation is done with the one MNO or ISP, while the cybersecurity contract and customer retention is at the single end-user level with the MNO/ISP, such as a student who owns a mobile phone or parent using their iPad for business. Therefore, any cancellations of the single user would have minimal impact compared to the previous model, where contracts were with large customers whose cancellations could have a material effect on financials. The MNO segment alone offers a total addressable market (TAM) of 2.6 billion customers and management estimates a 10% market share would be potentially worth up to €2.6–7.8bn, although there is substantial progress that needs to be made in building the telco pipeline and improving operational execution to reach this potential.

The competition in the telco space is growing and many competitors are pursuing the same market potential. A key advantage for Cyan is that it provides seamless, multidimensional solutions to cybersecurity. These include covering multiple use cases (smartphones, PCs, fixed-lines, etc.), being both endpoint based and integrated in the network, providing convenient sign-up for the end-customer (where the user signs up directly through the telco, so providing a seamless customer journey rather than going through a 3rd party) , being a white-labelled product so it benefits from clients’ marketing and operating its own integrated proprietary security database instead of relying on third parties or outdated lists. In contrast, its competitors’ offerings are not always integrated or seamless across these key dimensions and do not necessarily offer the same breadth of products and service. Nevertheless, to capture even 1% of the TAM, Cyan must leverage its advantages to truly differentiate itself from competitors such as Norton, Akamai and Allot.

With the move towards cybersecurity, BSS/OSS is no longer part of Cyan’s core strategy, as it does not provide the recurring revenue model management is looking for, has lower scalability and narrow margins. While management has successfully integrated the business and put it on what management believes is a solid foundation, it is no longer the focus of Cyan’s cybersecurity strategy. Therefore, Cyan is reviewing options for that segment’s future, including a potential sale. While Cyan was able to successfully integrate the i-new acquisition and its BSS/OSS segment, synergies did not occur as expected. Management believes the separation should occur within the next six months, freeing up operational and financial resources to concentrate on Cybersecurity.

It should be noted the BSS/OSS segment has historically provided greater revenues than Cybersecurity (see our previous note Reset and Regroup), albeit with lower margins, and the disposal of this business would likely have an unfavourable short-term impact on revenues while the telco cybersecurity segment ramps up. One risk in the shift is that delays in realising Cybersecurity revenue could have a further negative effect with the move away from a segment that since 2018 provided most of Cyan’s revenues and impacted on the bottom line, although management now can devote its attention to the higher-margin, faster-growing cybersecurity business and reinvest the funds from a BSS/OSS sale.

Exhibit 1: Segment breakdown showing BSS/OSS providing majority of revenues

Source: Cyan

As a result of the strategic shift and disappointing H121 results, management retracted its earlier guidance (c €21m revenues) and now expects FY21 revenue to be lower at c €10–14m with EBITDA remaining negative. Management also expects the impact of the restructuring measures will become evident as soon as late 2021 and in 2022.

To finance the transformation and cost-cutting efforts and address a liquidity gap, Cyan held a capital raise in September. The raise was fully subscribed with about 2.48m shares placed, raising €8.0m and boosting Cyan’s balance sheet liquidity, as net debt (including IFRS 16 leases but excluding the capital raise) was c €10.8m at 30 June 2021. Management aims to be self-sustaining with no further capital or significant debt increases needed, although this depends on meeting its revenue targets and becoming cash flow positive. Otherwise, further debt or equity funding could be required.

On a personnel note, long-time executive and CFO Michael Sieghart has announced his departure and will be replaced by Martin Wachter in December, after a transition period. Mr. Wachter has a long career in banking, with over 35 years of financial experience.

Market driven by increasing mobile use and cyberthreats

With the rise of digitisation and mobility, the cybersecurity market is experiencing rapid growth as more people use and own mobile phones. The COVID-19 epidemic only accelerated the shift towards online shopping and banking, working from home and mobile payments. In fact, GSMA Intelligence estimates that 5.2bn people globally use mobile phones.

Regrettably, the shift to increased mobile usage has also brought in many bad actors, as potential cyberthreats rose at a c 36% CAGR since 2016, including threats such as malware, ransomware, phishing, adware, etc. These hazards affect a wide range of activity, such as emails, financial payments, social media, etc., further driving the demand for cybersecurity products across all mobile devices, not just phones. As a result, these market drivers should support their business going forward, as Cyan focuses their efforts on cybersecurity for telco, rather than being distracted by the BSS/OSS business and expansion into other industries such as insurance and automotive.

Execution is key to maintaining valuation

Trading at a recent €3.91, Cyan’s shares are down 61% year to date. Although Cyan is targeting to turn profitable by 2022, consensus does not expect EBITDA to turn positive until 2023. The share price implies an EV of 12.7x consensus FY23e EBITDA, in line with its nearest cybersecurity peers and near the high end of its historical range. Consensus also expects Cyan to grow 2023 revenues at 60%, significantly more than its cybersecurity peers at an average 13% y-o-y in 2023.

Delivering recurring revenue growth and associated higher margins in the expanding cybersecurity segment over the next 12–18 months could restore investor confidence in Cyan’s long-term potential. However, with a valuation that is in line based on a much higher projected growth rate, management needs to execute its restructuring plan and achieve profitability in a timely manner to unlock the potential in the growing cybersecurity market.

Exhibit 2: FY23 EV/EBITDA multiples for selected cybersecurity peers

Exhibit 3: FY23 consensus revenue growth forecasts for selected cybersecurity peers

Source: Refinitiv, Cyan

Source: Refinitiv, Cyan

Exhibit 2: FY23 EV/EBITDA multiples for selected cybersecurity peers

Source: Refinitiv, Cyan

Exhibit 3: FY23 consensus revenue growth forecasts for selected cybersecurity peers

Source: Refinitiv, Cyan


General disclaimer and copyright

Any Information, data, analysis and opinions contained in this report do not constitute investment advice by Deutsche Börse AG or the Frankfurter Wertpapierbörse. Any investment decision should be solely based on a securities offering document or another document containing all information required to make such an investment decision, including risk factors. This report has been commissioned by Deutsche Börse AG and prepared and issued by Edison for publication globally.

Edison Investment Research standard fees are £49,500 pa for the production and broad dissemination of a detailed note (Outlook) following by regular (typically quarterly) update notes. Fees are paid upfront in cash without recourse. Edison may seek additional fees for the provision of roadshows and related IR services for the client but does not get remunerated for any investment banking services. We never take payment in stock, options or warrants for any of our services.

Accuracy of content: All information used in the publication of this report has been compiled from publicly available sources that are believed to be reliable, however we do not guarantee the accuracy or completeness of this report and have not sought for this information to be independently verified. Opinions contained in this report represent those of the research department of Edison at the time of publication. Forward-looking information or statements in this report contain information that is based on assumptions, forecasts of future results, estimates of amounts not yet determinable, and therefore involve known and unknown risks, uncertainties and other factors which may cause the actual results, performance or achievements of their subject matter to be materially different from current expectations.

Exclusion of Liability: To the fullest extent allowed by law, Edison shall not be liable for any direct, indirect or consequential losses, loss of profits, damages, costs or expenses incurred or suffered by you arising out or in connection with the access to, use of or reliance on any information contained on this note.

No personalised advice: The information that we provide should not be construed in any manner whatsoever as, personalised advice. Also, the information provided by us should not be construed by any subscriber or prospective subscriber as Edison’s solicitation to effect, or attempt to effect, any transaction in a security. The securities described in the report may not be eligible for sale in all jurisdictions or to certain categories of investors.

Investment in securities mentioned: Edison has a restrictive policy relating to personal dealing and conflicts of interest. Edison Group does not conduct any investment business and, accordingly, does not itself hold any positions in the securities mentioned in this report. However, the respective directors, officers, employees and contractors of Edison may have a position in any or related securities mentioned in this report, subject to Edison's policies on personal dealing and conflicts of interest.

Copyright: Copyright 2021 Edison Investment Research Limited (Edison).


Edison Investment Research Pty Ltd (Edison AU) is the Australian subsidiary of Edison. Edison AU is a Corporate Authorised Representative (1252501) of Crown Wealth Group Pty Ltd who holds an Australian Financial Services Licence (Number: 494274). This research is issued in Australia by Edison AU and any access to it, is intended only for "wholesale clients" within the meaning of the Corporations Act 2001 of Australia. Any advice given by Edison AU is general advice only and does not take into account your personal circumstances, needs or objectives. You should, before acting on this advice, consider the appropriateness of the advice, having regard to your objectives, financial situation and needs. If our advice relates to the acquisition, or possible acquisition, of a particular financial product you should read any relevant Product Disclosure Statement or like instrument.

New Zealand

The research in this document is intended for New Zealand resident professional financial advisers or brokers (for use in their roles as financial advisers or brokers) and habitual investors who are “wholesale clients” for the purpose of the Financial Advisers Act 2008 (FAA) (as described in sections 5(c) (1)(a), (b) and (c) of the FAA). This is not a solicitation or inducement to buy, sell, subscribe, or underwrite any securities mentioned or in the topic of this document. For the purpose of the FAA, the content of this report is of a general nature, is intended as a source of general information only and is not intended to constitute a recommendation or opinion in relation to acquiring or disposing (including refraining from acquiring or disposing) of securities. The distribution of this document is not a “personalised service” and, to the extent that it contains any financial advice, is intended only as a “class service” provided by Edison within the meaning of the FAA (i.e. without taking into account the particular financial situation or goals of any person). As such, it should not be relied upon in making an investment decision.

United Kingdom

This document is prepared and provided by Edison for information purposes only and should not be construed as an offer or solicitation for investment in any securities mentioned or in the topic of this document. A marketing communication under FCA Rules, this document has not been prepared in accordance with the legal requirements designed to promote the independence of investment research and is not subject to any prohibition on dealing ahead of the dissemination of investment research.

This Communication is being distributed in the United Kingdom and is directed only at (i) persons having professional experience in matters relating to investments, i.e. investment professionals within the meaning of Article 19(5) of the Financial Services and Markets Act 2000 (Financial Promotion) Order 2005, as amended (the "FPO") (ii) high net-worth companies, unincorporated associations or other bodies within the meaning of Article 49 of the FPO and (iii) persons to whom it is otherwise lawful to distribute it. The investment or investment activity to which this document relates is available only to such persons. It is not intended that this document be distributed or passed on, directly or indirectly, to any other class of persons and in any event and under no circumstances should persons of any other description rely on or act upon the contents of this document.

This Communication is being supplied to you solely for your information and may not be reproduced by, further distributed to or published in whole or in part by, any other person.

United States

Edison relies upon the "publishers' exclusion" from the definition of investment adviser under Section 202(a)(11) of the Investment Advisers Act of 1940 and corresponding state securities laws. This report is a bona fide publication of general and regular circulation offering impersonal investment-related advice, not tailored to a specific investment portfolio or the needs of current and/or prospective subscribers. As such, Edison does not offer or provide personal advice and the research provided is for informational purposes only. No mention of a particular security in this report constitutes a recommendation to buy, sell or hold that or any security, or that any particular security, portfolio of securities, transaction or investment strategy is suitable for any specific person.

Frankfurt +49 (0)69 78 8076 960

Schumannstrasse 34b

60325 Frankfurt


London +44 (0)20 3077 5700

280 High Holborn

London, WC1V 7EE

United Kingdom

New York +1 646 653 7026

1185 Avenue of the Americas

3rd Floor, New York, NY 10036

United States of America

Sydney +61 (0)2 8249 8342

Level 4, Office 1205

95 Pitt Street, Sydney

NSW 2000, Australia

Share this with friends and colleagues

You may be interested in