H126 trading update – growth accelerates

The strong order intake in the final quarter of last year (+74% y-o-y) has driven strong revenue growth of 42% y-o-y over H126. Importantly, a H126 adjusted EBITDA of $2.7m demonstrates excellent operational gearing with a very modest (5%) increase in opex. Order intake over H126 was a little soft at just $14.3m (+14% y-o-y) but we note a large order with a Tier 1 operator has been signed very early in H226. Annual recurring revenue (ARR) of $24.1m (before impact from the recent large order) is up 12% y-o-y and a little ahead of the year-end level of $23.9m.

Seizing an expanded addressable market opportunity

Over the last two years management has invested in new products, including the Corero Observability & Resiliency Ecosystem (CORE), the next-generation 400G platform and Zero Trust Admission Control solutions. As a result, Corero’s total addressable market (TAM) has risen considerably, and we now estimate Corero’s solutions serve a market opportunity valued at $77bn growing at a CAGR of over 14%. Accessing this expanded market opportunity will be helped thanks to the next major investment: an overhaul of the sales channel strategy, creating new indirect and direct selling opportunities to a varied customer profile. This is being led by the recent addition to the management team of Michelle Ragusa-McBain, who brings more than 20 years’ experience of sales channel management across cybersecurity and SaaS markets.

Forecasts and valuation

Post the trading update we have left forecasts unchanged as we await the detailed H126 results due mid-September. However, our estimates are beginning to look conservative and not fully reflecting conversion of some larger transactions in the pipeline. As the sales channel strategy initiatives are put in place and these opportunities are indeed secured, forecast momentum is expected to remain positive over the medium term. We forecast an adjusted EBITDA margin of 20% in FY28e from 8% in FY25. This is reflected in the fall in the FY28e valuation multiples (EV/EBITDA of 7.0x and P/E of 16.6x). Our valuation analysis suggests share price upside of 50–105% or 12.5–17.0p/share.

As a leading provider of solutions that help customers combat the growing threat of distributed denial-of-service (DDoS) attacks, attractive growth opportunities are assured for Corero given the rise in frequency and complexity of such attacks. Aside from the customary drivers of cybercrime (eg financial gain), the geopolitical landscape over the past few years has fuelled a marked increase in DDoS attacks, which rose by 100% in 2025. Perpetrators of attacks have become more sophisticated, creating the need for more complex solutions. Industry forecasts predict that the addressable market value for DDoS mitigation solutions ($5.8bn in 2025) will increase at a CAGR of 12.3% in 2025–30.

Having secured its position as a leading DDoS mitigation solutions provider, Corero has wisely invested into new products in adjacent areas, materially expanding the company’s addressable market opportunity, in terms of both size and growth. With these investments, we now estimate the company serves a market opportunity in excess of $70bn, growing at a rate of 14% per year.

Stepping up a gear

The last two years have seen a fundamental repositioning of the business, during which time new management has pivoted to serve a growing customer appetite for subscription-based services and has launched new solutions. Early indications of the commercial opportunity for the new products are very positive and early traction has been achieved. A significant next step for the business is the optimisation of the sales channel strategy. In January this year, the company announced the recruitment of Ragusa-McBain to lead the sales channel transformation. Ragusa-McBain has more than 20 years’ experience in sales strategy optimisation for cybersecurity, SaaS and SMB-to-enterprise IT, including leadership roles at leading industry players such as Cisco, SonicWall and Compucom. Ragusa-McBain was recently named in the prestigious 2026 Computer Reseller News (CRN) Women of the Channel Power 100 list.

Since joining Corero, Ragusa-McBain has made a number of changes that have increased the number of active partners, materially increased the partner pipeline and reduced the customer acquisition cost. We expect these initiatives should both consolidate the excellent growth dynamics seen at the end of 2025 and further drive the strong underlying growth momentum. The recent trading update seems to confirm this with impressive H126 revenue growth of 42% y-o-y. We believe estimates momentum will remain positive.

Sensitivities

• Execution risk: while we believe the current management team has a solid and well-engineered strategy to take the business forwards, achieving share gains in an expanding market, our investment thesis relies heavily on the new management team executing well. Early indications are positive, but execution risk exists.
• Industry partnerships are a key component of the strategy and with changes being made to the sales channel strategy, risks do exist. For example, preserving existing agreements with HPE Juniper, Akamai Technologies and GTT Communications remains important and management needs to safeguard these relationships as new partnerships are developed.
• Disruptive pricing: if one or more of Corero’s key competitors decides to participate in aggressive price disruption for a prolonged period, it could adversely affect the overall industry segment’s TAM.
• Technology disruption: Corero’s current technology gives it a leading position, something we believe is sustainable. If a new technology emerges, this could affect our forecasts.
• Consolidation: Corero’s balance sheet is healthy, and is expected to build a stronger net cash position over time. Management may be tempted to participate in consolidation, which could have a positive or negative impact.

Valuation

Comparison of multiples (specifically EV/sales) against a peer group of businesses implies share price upside of c 60%. Application of the Rule of 40 regression analysis to Corero’s valuation when compared to industry peers implies upside of 105%. Given the long-term structural growth, operational leverage and rising cash generation, assessing Corero’s value using a discounted cash flow (DCF) model has merit. Based on our assumptions, our DCF implies 50% upside to the current share price.

The bigger market opportunity

With the current varied and challenging geopolitical landscape, it is no surprise that the size, frequency and sophistication of DDoS attacks have continued to rise. According to Corero’s 2026 Threat Intelligence Report, over the last year there has been a 260% increase in the peak attack size. One attack comprised 50 unique vectors, while another (KIMWOLF) was created by a botnet of 1.4m compromised devices.

To address the evolving threat, government agencies around the world have either introduced or are in the process of introducing updated regulations that govern cybersecurity. While awareness of phishing, hacking, ransomware, data protection issues and related threats is generally well understood, other threats that can significantly affect the resilience and service provision of online systems appear less well understood. For example, the UK government is in the process of updating the existing Network and Information Systems Regulations 2018 with the Cyber Security and Resilience (Network and Information Systems) Bill, which was introduced to parliament in November 2025 (updated March 2026).

While the original legislation covered critical systems such as the NHS, transport and energy networks, the revised legislation will ensure that providers of critical parts of the economy’s digital ecosystem (such as data centre providers, managed service providers and other relevant digital service providers) have suitable protections in place to ensure better protection of the services that the public rely on to go about their lives. The UK financial sector is largely covered by the EU Digital Operational Resilience Act introduced in early 2025. This latest UK legislation extends similar resilience requirements to a much broader set of businesses, irrespective of whether they have operations in the EU.

The DDoS market: An update

In its 2026 Threat Intelligence Report (published on 2 April), Corero revealed the rise in DDoS attack frequency and sophistication detected by its own systems over the past year. Some headline data points included:

• A 262% increase in the peak attack size year-on-year (Exhibit 1).
• An average of 12 DDoS attacks per day per customer during 2025.
• Up to 50 unique vector combinations in a single attack campaign.
• A peak volume of 2.7 terabits per second used in an attack in 2025.
• 31% of attacks followed by a repeat attack within seven days of the initial attack.

Exhibit 1: Peak attack size (gigabits per second)

Source: Corero 2026 Threat Intelligence Report

As we entered the current year, the escalation in activity continued, with one attack in February that included 1.3bn packets of data per second. Together with the obvious increasing risk of commercial harm, evolving and ever more stringent legislation continues to drive the market opportunity for DDoS detection and mitigation solutions. The chart below shows the size and overall growth of the market by region. The CAGR of 14% over the forecast period 2025–31 is a small increase (~100bp) compared to the longer-term market growth expectations predicted last year. Asia-Pacific is expected to have the fastest growth, but all regions are expected to show double-digit increases over the forecast period.

Exhibit 2: DDoS detection and mitigation market, $bn

Source: aggregated industry forecasts, Edison Investment Research

Corero’s augmented product portfolio

Thanks to the company’s heritage of being solely focused on DDoS, it has developed differentiated solutions compared to those available from peers, most of which provide DDoS detection products alongside other security solutions. Corero’s core technology, which utilises deep packet inspection, means that the solutions are software based and agnostic to the hardware used. It is for this reason that we believe that Corero’s solutions are regarded as very cost-efficient and can be deployed easily over a service provider’s existing infrastructure.

The focus on software-based solutions has also allowed highly efficient new development and the addition of many new features and standalone products over the last two years. While AI is used as part of the solution offerings to improve threat detection, AI has also been heavily used to accelerate the software coding process and thus markedly affect the speed with which new features and products can be brought to market.

New products released over the past two years as part of the DDoS solutions offering include:

• 400G solutions: the company unveiled a massive 400G capacity upgrade, available across both high-performance hardware appliances and bare-metal software deployments.
• Layer 7 DDoS protection: co-developed with partners, this Layer 7 (application-layer) solution blocks complex, targeted attacks without the complexity, latency or bloat of traditional web application firewalls.
• Bare metal and ‘COTS’ deployments: the company has launched a commercial solution that allows customers to deploy DDoS protection on standard commercial off-the-shelf (COTS) servers and virtualised environments, bypassing restrictive hardware procurement. Given the growth in data centres as corporates outsource increasing amounts of their IT infrastructure, service resiliency and an ability to detect and mitigate DDoS is becoming a core component of the data centre infrastructure offering.

The launch of the CORE platform in late 2024 introduced a number of new features and products that address logical adjacencies to DDoS detection and mitigation. The expansion of the product range in these adjacencies creates new opportunities for both Corero and its channel partners that logically build on the back of the franchise and reputation established in DDoS. Important new products and services include:

• Traffic observability and analysis: optimising inbound traffic to maintain capacity, improve cost efficiency and manage traffic by type.
• Web application security and API protection: combines on-premises enforcement with cloud-native visibility to protect web APIs and applications from bot-driven and modelled threats.
• Application performance monitoring: visibility and reporting on application/service latency and uptime.
• Zero trust admission control: uses behavioural analytics to detect and block anomalies at login portals, which specifically mitigates bot-driven threats and credential abuse.

For these new adjacent product categories, in addition to the external drivers of attack frequency and sophistication, there are a number of common demand drivers arising from the way in which the IT infrastructure landscape itself has evolved in recent years. These drivers include:

• Implementation of hybrid and multi-cloud IT infrastructure means that organisations are running their businesses with very decentralised networks and network traffic. Being able to detect congestion points and ensure end-to-end observability of data traffic is increasingly important.
• A move to cloud-first and remote access working has meant that businesses can no longer rely on a traditional ‘castle and moat’ strategy for cybersecurity. Instead, a much more holistic approach is required, resulting in better ways to govern access through identity management and context-based system access. Privilege creep as well as other insider threats are also more relevant and require guarding against.
• A rapid expansion of machine-to-machine and AI-related traffic is forcing organisations to manage and secure a rapid increase in automated interactions. Adoption of generative AI systems and their integration with enterprise data pipelines requires strict, continuous authorisation in order to prevent unauthorised system access.
• The dramatic rise in web-based applications, the use of APIs and microservices have hugely increased the number of potential ‘break-points’ through which an attack may occur. As such, organisations have come to rely on application and API security solutions to create greater overall system integrity and protection from malicious bot traffic.

An expansive TAM

The importance and opportunity now afforded by these new products is illustrated in the chart below. The new products and services, particularly Zero Trust Admission Control, address a much expanded market opportunity. Rather than being a focused provider of DDoS solutions, Corero now provides a range of solutions and services that address the typical areas of vulnerability faced by communication service providers (CSPs) and enterprises in keeping networks up and running. The current global TAM of $77bn is expected to increase at a CAGR of +14.5%, rising to a value of $133bn in 2030e.

Exhibit 3: Corero’s enlarged addressable market opportunity

Source: aggregated industry data sources, Edison Investment Research

Sales channel strategy update

Since taking up the CEO position in early 2024, Carl Herberger has implemented a new product strategy, repositioning Corero from a provider of DDoS solutions to now having a broader portfolio of products designed to ensure service providers can operate without service disruption, or ‘always on’. While there have been several changes in personnel in the sales and marketing function since early 2024, in January this year the appointment of Michelle Ragusa-McBain (as vice president of channel sales) marks a significant commitment to advancing the sales strategy.

At present c 25% of Corero’s revenues come via the key strategic partnerships with HPE Juniper, GTT Communications and Akamai Technologies. The remaining c 75% of revenues are from a variety of resellers in a manner that has tended to be very ‘transactional’ in nature, which is to say with varying commercial agreements and no globally (or regionally) consistent channel framework. This has led to a broad ecosystem of resellers globally with activity levels varying materially. This is a common challenge for smaller technology providers where development and launch of new products often takes priority over go-to-market strategies. For Corero, a more structured or sophisticated channel strategy now has the potential to materially increase the efficiency of the selling process.

Improved regional and end user focus

Currently, the reselling partners are heavily weighted to the US, reflecting the company’s customer base. We understand that initiatives are already in place to increase reseller coverage across Europe, the Middle East and Africa, Asia-Pacific and selected Latin America markets. In the first instance, this will add to the overall number of resellers, though over time the intention is to identify across the group, and focus support on, those resellers with potential to remain ‘active’ rather than those proving to be ‘inactive’. The first half of 2026 has seen formal agreements put in place with both existing and new partners, together with a programme of pipeline planning and reviews on a more consistent basis. At Corero’s recent capital markets day (20 April) management noted that this was already resulting in an increase in pipeline activity, though we have assumed that there will be a time lag before these incremental pipeline opportunities are converted to revenues.

Aside from the existing partners, with a more structured reseller programme we expect Corero to formally partner with managed security providers, cloud marketplaces, leading systems integrators as well as regional specialists. In addition, following on from last year’s new business with a leading European financial institution, we expect Corero to add systems integrators and resellers with specialist industry domain expertise to enhance sales to the enterprise market. Aside from telecommunications (CSP) and financial services, other industry verticals into which we expect to see dedicated systems integrators appointed include government, healthcare and physical infrastructure/utilities.

Channel partner selection and benefits

Aside from the regional and customer focus, the choice of resellers for the partnership programme will depend on a number of important factors such as technical capability, broader security expertise, executive commitment and ability to invest with Corero, as well as cultural alignment. The new sales strategy team is expected to be more efficient in its selection of higher-quality partners, avoiding the inherent inefficiencies of the parter selection process.

However, success in establishing good reselling of technical products such as Corero’s requires that partners also benefit from the relationship. Above and beyond a simple ‘margin’ for their sales, resellers will be supported by Corero in a manner that allows them to grow a profitable revenue stream based around the Corero solutions. As such, Corero is committing to partner education initiatives including:

• technical certification programmes;
• sales training;
• playbooks and competitive positioning data;
• joint customer briefing; and
• executive briefings.

Additionally, in order to establish improved rules of engagement, prevent any possible channel conflict and ensure that the resellers are themselves operating efficiently, Corero is providing some governance as to how the resellers operate within their markets. These initiatives are to include:

• deal registration;
• defined account ownership;
• regional planning/coverage; and
• opportunity protection rules.

The initiatives are designed to ensure that while a healthy level of competition exists between the resellers, this is achieved without channel conflicts arising. With the additions and changes made to the internal sales and marketing functions, over time as partner revenues scale, Corero’s customer acquisition cost should fall as significantly more customers are added without proportionally increasing internal sales resources.

Key strategic partnership update

The three core strategic partnership relationships with HPE Juniper, GTT Communications and Akamai Technologies, accounting for c 25% of revenues, have clearly been successful in recent years: we calculate that since the key partner programme started in 2018, these three industry original equipment manufacturers cumulatively have accounted for close to $20m of Corero’s sales. There has been speculation about potential new key partnerships. While this should be expected in the longer term, we believe that in the near term there will be a focus on strengthening relationships with these three major original equipment manufacturers, where there is limited overlap in their customer base.

Current collaborative initiatives with the key partners include:

• joint business planning;
• joint field engagement;
• improved forecasting and planning;
• increased product alignment; and
• improved operational processes.

Each of these initiatives represents a long-term commitment by Corero and the respective partner, and the impact will increase as the strategic relationships mature. Already these key partnerships have shown an ability to sell Corero’s solutions to their own customers as a broader ‘business continuity’ platform rather than a discrete DDoS detection and mitigation solution.

Sensitivities

Corero’s sensitivities include:

• Execution risk: while we believe that the management team has a solid and well-engineered strategy to take the business forwards, achieving market share gains in an expanding industry segment, our investment thesis relies heavily on the management team executing well. We take comfort from early positive indications, but execution risk exists.
• Industry partnerships: related to the above, a specific component of the strategy concerns the industry partnership agreements with leading players such as Juniper, Akamai and GTT. Sensitivities apply in both directions and, while management needs to maintain existing partnerships, our forecasts do not include potential material upside if additional industry partnerships are forged.
• Disruptive pricing: so far, pricing trends around DDoS detection and mitigation solutions have followed the technology industry norm, in which prices per unit data show annual deflation, but this is more than compensated for by growth in data volumes and the increased value-add of the solutions. This established trend in many technology market segments allows an opportunity for the providers to up-sell, a key component of the overall expansion in the TAM. If one or more of Corero’s key competitors decides to participate in aggressive price disruption for a prolonged period, it could adversely affect the overall industry segment’s TAM, as well as Corero’s financial performance.
• Technology disruption: we believe Corero’s leading technology is a sustainable competitive advantage and will help drive market share gains. As with all leading-edge technology solutions, there are risks that peers will catch up with or overtake Corero with new technology.
• Consolidation: the industry for cybersecurity solutions has shown much consolidation already, but the trend continues. Corero’s balance sheet is healthy, and we expect it should build a stronger net cash position over time. While we believe the business can achieve its longer-term objectives on a standalone basis, management may be tempted to participate in consolidation, which could have a positive or negative effect on our forecasts and valuation assumptions.

Financials

Strong momentum into H126 with revenue growth accelerating

Corero’s performance over FY25 was characterised by changes in customer purchasing with demand for subscription-based services in deference to traditional up-front or capex-based procurement. Notably, the business responded well, achieving H225 growth of 18% y-o-y, to leave revenues for the full year ahead 4%. Moreover, the order intake for the year was excellent at $33.8m, an increase of 20%. This included exceptional order intake in Q425 that was +74% y-o-y (Exhibit 4). Given these strong order dynamics, it is perhaps not a great surprise that revenue growth has improved over the first half of the current year. This has been confirmed in the H126 trading update that has revealed revenue growth of 42% y-o-y.

Impressively, this revenue growth has been achieved with a very modest (5%) increase in opex costs, resulting in a H126 adjusted EBITDA of $2.7m, from a loss of $1.3m. We have previously noted evidence of Corero’s tight cost control and potential to show impressive operational gearing, and the results for H126 confirm this.

Order intake over H126 was $14.3m, up 14% y-o-y, though we note the relatively easy comparative due to the softer orders in H125. However, we would also note that the order intake H126 excludes a large contract with a Tier 1 US operator that slipped into the first few weeks of H226.

Exhibit 4: Half yearly order intake

Source: Corero Network Security, Edison Investment Research

Similarly, while the H126 period end ARR of $24.1m represents only a small increase on the $23.9m at year-end, this also does not include the ARR contribution from the large deal signed in recent weeks. The chart below demonstrates how ARR has risen in recent years and also shows ARR risen as a percentage of revenues. This is an important evolution of the business model given that ARR effectively secures a material portion of the forecast revenues for the following year.

Exhibit 5: Corero ARR evolution and improving revenue visibility

Source: Corero Network Security, Edison Investment Research

We note that in FY25 recurrent revenues (subscriptions, maintenance and support services) represented 67% of group
revenues, a marked increase from below 60% in FY24.

Cash balances at the end of H126 were $2.1m, from net cash of $4.0m in December 2025. The $2.0m, loan facility put in place last year remains and has not been used. Our forecasts imply that the business will be net cash generative for the year overall.

Forecasts

Our forecasts are summarised below (Exhibit 6). Following the H126 trading update we have not changed our estimates, waiting instead for the full detail and commentary, which is due in mid-September. However, it is clear that our current estimates are conservative. In particular, having seen the operational gearing over H126, we remain confident that the expansion of EBITDA margins (from 7.2% in 2025 to 19.5% in 2028e) is achievable.

Exhibit 6: Key forecast metrics, 2025–28e

Source: Edison Investment Research

Valuation

We continue to believe that assessing Corero’s value should be done using several differing methods. First, Corero’s valuation should be compared to its industry peers using our near-term projections, giving an indication as to what the fair value is of Corero’s current revenue and profit franchise. However, we also believe that significant weight should be given to a valuation based on longer-term projections, which better capture the value creation as the company scales and is expected to win share in the expanded addressable market opportunity. Given the operational leverage and future marked increase in profitability and cash flow generation, we believe a DCF method of valuation is very relevant.

Industry peer multiples

We show in the table below Corero’s current valuation metrics, together with those of its peer group of leading cybersecurity businesses. These metrics are based on nearer-term forecasts and, as such, the profit forecasts indicated for Corero do not reflect the full margin potential as the business scales and the operational leverage is seen. For this reason, Corero appears to be valued at a premium to its peers. However, when we compare the companies on their revenue franchise values or EV/sales multiples, we see that Corero appears significantly undervalued (by c 60%) against the peer group average. If Palo Alto Networks were to be excluded from the comparison (given its exceptional valuation) Corero’s discount to its peers is 45%.

Exhibit 7: Peer group valuation comparisons

Source: LSEG Data & Analytics, Edison Investment Research. Note: Prices as at 27 July 2026.

Applying the Rule of 40

When comparing the value of faster-growing (SaaS-based) business, we believe that benchmarking using the Rule of 40 is useful. This rule is based on the principle that as a SaaS-based business matures, and its revenue expansion slows, its ability to drive up profitability increases. The assumption is that well-run SaaS-based businesses can operate with a combined growth rate and EBITDA profit margin of c 40%. For example, a business operating with 25% growth should be able to command margins of 15% and a business with slower growth of 10% should be able to achieve margins of 30%. The value in applying the Rule of 40 to a group of businesses is that we can assess how, relative to its peers, Corero is valued when normalising for its different level of maturity (growth rate).

In order to benchmark Corero against its peers, we plot their valuations (EV/sales) against their revenue growth + EBITDA margins (Exhibit 8 below) and plot the corresponding regression line. The regression line has the equation: EV/sales = 50 x (revenue growth + EBITDA margin) - 14. We then calculate Corero’s implied market capitalisation and share price for it to satisfy or fit the regression equation. The calculation implies a market capitalisation of $132m (£98m) and a share price of $0.24 (17p), respectively, suggesting share price upside of 105%.

Exhibit 8: Rule of 40 regression analysis

Source: Edison Investment Research

Longer-term DCF valuation

Given the longer-term growth and, as discussed, the expected improvement in profitability and cash generation, it is appropriate to assess Corero’s longer-term value by looking at the implied fair value of the equity using DCF modelling. The key inputs to the model of revenue growth and margin expansion over the 10-year period are indicated below (Exhibit 9). We note our assumptions that a) revenue growth tapers beyond the current forecast period such that in year 10 (2036) growth is at the assumed terminal growth rate and b) EBITDA margins peak at just 22.5% (in 2032), where they remain.

Exhibit 9: Input assumptions for DCF modelling

Source: Edison Investment Research

Clearly, such modelling has challenges, not least choosing an appropriate weighted average cost of capital (WACC) to apply in discounting forecast cash flows. Using the current 10-year UK gilt (5.0%) as the risk-free rate, the UK market risk premium of 4.7% (source: Damodaran, Stern School of Business, New York University) and Corero’s beta of 0.2 implies a WACC of 5.9%. However, the beta of 0.2 is arguably ‘understated’ due to the lower equity liquidity.

A beta of 1.0 (volatility in line with the UK market) would suggest a WACC of 9.7%. Mature, unlevered SaaS businesses typically have a beta in the range 1.00–1.25x. A beta of 1.25 would imply a WACC for Corero of 10.8%. The table below shows a sensitivity analysis of the implied fair value of the equity as a function of the WACC and the assumed terminal growth rate. We have shaded the area that correlates to the input data suggested above, with the average implied fair value of $0.17 (12.5p) per share, which is 50% upside to the current share price.

Exhibit 10: DCF implied fair equity value sensitivity analysis ($/share)

Source: Edison Investment Research

Exhibit 11: Financial summary

Source: Company accounts, Edison Investment Research