Corero Network Security — Strong H126 leads to forecast upgrades

Corero Network Security (AIM: CNS)

Last close As at 09/09/2026

GBP0.10

1.75 (20.59%)

Market capitalisation

GBP53m

More on this equity

Research: TMT

Corero Network Security — Strong H126 leads to forecast upgrades

Corero’s H126 results provide clear evidence of its growth potential and operational leverage and have led us to increase our forecasts, with our current year EBITDA revised up 62%. It is still relatively early days in the selling of a broader product offering and realigned sales strategy. We expect a further beneficial impact from these strategic initiatives and believe there is potential for further upside to FY27e and FY28e forecasts.

Written by

Dan Ridsdale

Head of Technology

Software and comp services

H1 results

10 September 2026

Price 10.25p
Market cap £52m

Net cash at H126

$2.1m

Shares in issue

512.2m
Free float 32.0%
Code CNS
Primary exchange AIM
Secondary exchange OTCQX
Price Performance
% 1m 3m 12m
Abs 17.1 (8.9) 5.1
52-week high/low 13.3p 6.6p

Business description

Corero Network Security is a leading provider of DDoS attack detection and mitigation solutions, protecting organisations against external and internal threats and ensuring the ability to continually operate web-based services.

Analysts

Dan Ridsdale
+44 (0)20 3077 5700
Neil Steer
+44 (0)20 3077 5700

Corero Network Security is a research client of Edison Investment Research Limited

Note: EBITDA, PBT and EPS are normalised, excluding amortisation of acquired intangibles, exceptional items and stock-based payments.

Year end Revenue ($m) EBITDA ($m) PBT ($m) EPS (¢) P/E (x) EV/sales (x) EV/EBITDA (x)
12/25 25.5 1.8 (0.3) (0.05) N/A 2.7 37.7
12/26e 31.8 5.5 3.0 0.46 30.1 2.2 12.5
12/27e 36.7 7.9 5.1 0.76 18.3 1.9 8.7
12/28e 42.1 10.9 7.9 1.15 12.0 1.6 6.3

Revenue acceleration and operational leverage

H126 revenue was up 42% y-o-y with the business benefiting from the exceptional order intake at the end of last year (Q425 order intake was up 74% y-o-y). All key metrics showed progress including a further order increase of 14% y-o-y in H126. The revenue increase was achieved with a slightly improved gross margin (93%, +29bp) and a modest 5% y-o-y increase in operating expenses, resulting in a marked rise in adjusted EBITDA to $2.7m from a loss of $1.3m in H125.

A broader product portfolio

Recent product introductions mean that Corero is now positioned as a provider of cyber resiliency solutions to secure customers’ ability to operate in an ‘always on’ manner. We note, for example, the H126 $1.1m contract with one of the world’s largest data centre providers for Corero’s Web Application Security (WAAP). Momentum has continued post H126, with the signing of two further large contracts with Tier 1 telco providers totalling $4.8m, business also won thanks to new solutions in the CORE platform.

Sales channel optimisation

We believe the sales channel initiative implemented by Michelle Ragusa-McBain, who joined the business in January this year, will have had a modest benefit in H126. A fuller effect is likely to be seen over H226 and beyond, further adding to our confidence that order intake and revenue momentum will be sustained.

Forecasts and valuation

Management has noted it now expects to exceed the prior FY26 consensus market expectations for revenue and significantly exceed in terms of EBITDA. We have made significant upward revisions to our forecasts for 2026, 2027 and 2028. The magnitude of the revisions, which see adjusted EBITDA increases of 62%, 59% and 46% for 2026, 2027 and 2028, respectively, reflect a key aspect of our investment thesis; Corero is a business with increasingly predictable revenues, high operational leverage and capacity for further margin expansion. We therefore view the 12x 2028 P/E as an attractive valuation.

H126 performance reflects key strategic initiatives

Corero’s H126 results provide clear evidence that the growth and operational leverage we highlighted in our recent research are now coming through. These initiatives include a much broader product portfolio, which dramatically increases the addressable market opportunity, as well as the more recent sales channel optimisation.

The H126 revenue increase of 42% y-o-y to $15.5m represents the fastest rate of growth the business has seen in recent years and reflects Corero’s much expanded addressable market, thanks to new product introductions. The investments over the last two years include the Corero Observability & Resiliency Ecosystem (CORE), the next-generation 400G platform, Zero Trust Admission Control solutions and the WAAP product.

We have noted in previous research that these products serve a materially expanded total addressable market (TAM) of $77bn, of which Corero has a current tiny market share. As management highlighted on the H126 conference call, 50% of all new business leads include some element of demand for the newer solutions, which changes both the likely conversion rate on proposal requests and also raises the potential size of new contracts. Moreover, the newer solutions are marketed on their individual merit to new and existing customers and gaining traction. Corero continues to receive industry accolades and in March was named 'Most Innovative DDoS Protection Solution' by Cyber Defence Magazine at the RSA Conference. More recently, Corero has retained its position as a leader and as the 'Emerging Innovator' in the 2026 SPARK Matrix for DDoS mitigation.

Gross margins were a little stronger than expected in H126 at 93.4%, due to the better-than-expected revenues from one-off licence sales. In contrast to other providers, Corero has always noted that it would offer customers the choice between licence and subscription purchasing options, and in H1 several of the larger telecom customers chose the licence purchase or capex option. This sustained high gross margin together with a very modest operating cost increase of just 5% delivered adjusted EBITDA of $2.7m, compared to a loss of $1.3m in H125.

Order intake increased 14% to $14.3m (H125: $12.5m) and annualised recurring revenue (ARR) increased by 12% to $24.1m (H125: $21.6m). We note that the sequential increase in ARR was modest compared with the December 2025 figure of $23.9m, which was due to several factors. We have noted already the higher than anticipated demand for licence transactions in the period. We also note the timing of several substantial orders that fell early in H226 such as a $1.4m, 3-year contract and a $3.4m, 5-year contract, both with Tier 1 Telecoms companies. Management noted on the call that the historical strong ARR progression is expected to be restored by the end of the year.

The initiatives implemented by the new president of channel sales (Michelle Ragusa-McBain) include a refreshed channel partner programme and go-to-market strategy. While these initiatives will have certainly contributed to the H126 performance, we believe the positive impact and improvements will be ongoing.

The net cash balance at the end of the H126 was $2.1m, down from $4.0m in December 2025. This was mainly the result of a working capital cash outflow of $2.6m, including a $2.4m impact from the trade receivables increase as the business continues to adjust to the broader trend for subscription services and the slightly less favourable cash flow profile. Management has noted that it expects a partial reversal of the working capital outflow over H226 and expects the business to be free cash positive for 2026 and beyond. We expect year-end net cash to show a small increase on last year at $4.3m.

Forecast revisions

We have made significant revisions to our forecasts, which are summarised below. Our forecasts allow for a normalisation of the gross margin over H226 and also for generous operating expenditure to support the growth initiatives, such as investment in the channel strategy changes. Nevertheless, we are raising our FY26 adjusted EBITDA forecast by 62% with a comparable increase made in 2027. These revisions reflect our core thesis for the company, expressed in our recent Outlook report, that 2026 is a year in which Corero will step up a gear and begin to demonstrate the revenue growth and operational leverage that will result from the last two years of strategic investments.



General disclaimer and copyright

This report has been commissioned by Corero Network Security and prepared and issued by Edison, in consideration of a fee payable by Corero Network Security. Edison Investment Research standard fees are £60,000 pa for the production and broad dissemination of a detailed note (Outlook) following by regular (typically quarterly) update notes. Fees are paid upfront in cash without recourse. Edison may seek additional fees for the provision of roadshows and related IR services for the client but does not get remunerated for any investment banking services. We never take payment in stock, options or warrants for any of our services.

Accuracy of content: All information used in the publication of this report has been compiled from publicly available sources that are believed to be reliable, however we do not guarantee the accuracy or completeness of this report and have not sought for this information to be independently verified. Opinions contained in this report represent those of the research department of Edison at the time of publication. Forward-looking information or statements in this report contain information that is based on assumptions, forecasts of future results, estimates of amounts not yet determinable, and therefore involve known and unknown risks, uncertainties and other factors which may cause the actual results, performance or achievements of their subject matter to be materially different from current expectations.

Exclusion of Liability: To the fullest extent allowed by law, Edison shall not be liable for any direct, indirect or consequential losses, loss of profits, damages, costs or expenses incurred or suffered by you arising out or in connection with the access to, use of or reliance on any information contained on this note.

No personalised advice: The information that we provide should not be construed in any manner whatsoever as, personalised advice. Also, the information provided by us should not be construed by any subscriber or prospective subscriber as Edison’s solicitation to effect, or attempt to effect, any transaction in a security. The securities described in the report may not be eligible for sale in all jurisdictions or to certain categories of investors.

Investment in securities mentioned: Edison has a restrictive policy relating to personal dealing and conflicts of interest. Edison Group does not conduct any investment business and, accordingly, does not itself hold any positions in the securities mentioned in this report. However, the respective directors, officers, employees and contractors of Edison may have a position in any or related securities mentioned in this report, subject to Edison's policies on personal dealing and conflicts of interest.

Copyright 2026 Edison Investment Research Limited (Edison).

Australia

Edison Investment Research Pty Ltd (Edison AU) is the Australian subsidiary of Edison. Edison AU is a Corporate Authorised Representative (1252501) of Crown Wealth Group Pty Ltd who holds an Australian Financial Services Licence (Number: 494274). This research is issued in Australia by Edison AU and any access to it, is intended only for "wholesale clients" within the meaning of the Corporations Act 2001 of Australia. Any advice given by Edison AU is general advice only and does not take into account your personal circumstances, needs or objectives. You should, before acting on this advice, consider the appropriateness of the advice, having regard to your objectives, financial situation and needs. If our advice relates to the acquisition, or possible acquisition, of a particular financial product you should read any relevant Product Disclosure Statement or like instrument.

New Zealand

The research in this document is intended for New Zealand resident professional financial advisers or brokers (for use in their roles as financial advisers or brokers) and habitual investors who are “wholesale clients” for the purpose of the Financial Advisers Act 2008 (FAA) (as described in sections 5(c) (1)(a), (b) and (c) of the FAA). This is not a solicitation or inducement to buy, sell, subscribe, or underwrite any securities mentioned or in the topic of this document. For the purpose of the FAA, the content of this report is of a general nature, is intended as a source of general information only and is not intended to constitute a recommendation or opinion in relation to acquiring or disposing (including refraining from acquiring or disposing) of securities. The distribution of this document is not a “personalised service” and, to the extent that it contains any financial advice, is intended only as a “class service” provided by Edison within the meaning of the FAA (i.e. without taking into account the particular financial situation or goals of any person). As such, it should not be relied upon in making an investment decision.

United Kingdom

This document is prepared and provided by Edison for information purposes only and should not be construed as an offer or sol icitation for investment in any securities mentioned or in the topic of this document. A marketing communication under FCA Rules, this document has not been prepared in accordance with the legal requirements designed to promote the independence of investment research and is not subject to any prohibition on dealing ahead of the dissemination of investment research.

This Communication is being distributed in the United Kingdom and is directed only at (i) persons having professional experience in matters relating to investments, i.e. investment professionals within the meaning of Article 19(5) of the Financial Services and Markets Act 2000 (Financial Promotion) Order 2005, as amended (the "FPO") (ii) high net-worth companies, unincorporated associations or other bodies within the meaning of Article 49 of the FPO and (iii) persons to whom it is otherwise lawful to distribute it. The investment or investment activity to which this document relates is available only to such persons. It is not intended that this document be distributed or passed on, directly or indirectly, to any other class of persons and in any event and under no circumstances should persons of any other description rely on or act upon the contents of this document.

This Communication is being supplied to you solely for your information and may not be reproduced by, further distributed to or published in whole or in part by, any other person.

United States

Edison relies upon the "publishers' exclusion" from the definition of investment adviser under Section 202(a)(11) of the Investment Advisers Act of 1940 and corresponding state securities laws. This report is a bona fide publication of general and regular circulation offering impersonal investment-related advice, not tailored to a specific investment portfolio or the needs of current and/or prospective subscribers. As such, Edison does not offer or provide personal advice and the research provided is for informational purposes only. No mention of a particular security in this report constitutes a recommendation to buy, sell or hold that or any security, or that any particular security, portfolio of securities, transaction or investment strategy is suitable for any specific person.

London │ New York │ Frankfurt

20 Red Lion Street

London, WC1R 4PS

United Kingdom

More on Corero Network Security

View All

Latest from the TMT sector

View All TMT content

Research: Industrials

Amoeba — Binding Syngenta agreement advances AXP20 commercialisation

Amoéba and Syngenta Crop Protection have converted their November 2025 memorandum of understanding (MoU) into a binding, long-term supply and distribution agreement for AXP20, Amoéba’s next-generation biocontrol fungicide. Syngenta will have exclusive distribution rights for all cereals except corn across the EU-27, the UK, Ukraine and Switzerland. First registrations in core EU markets are targeted for Q328, with first sales expected by the end of 2028 for use in spring 2029. The agreement advances AXP20 towards commercialisation by establishing a route to the European cereals market through Syngenta. However, the launch remains subject to product registrations and no financial terms were disclosed. Syngenta will hold exclusive distribution rights, while the two companies will jointly advance field trials and regulatory programmes, with Amoéba supplying the product. In our view, this should reduce the commercial infrastructure that Amoéba would otherwise need to build itself.

Continue Reading
Cookie Policy Overview
Edison Group

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping us understand which section of the website you find more interesting and useful. See our Cookie Policy for more information.

Strictly necessary and functional

These cookies are used to deliver our website and content. Strictly necessary cookies relate to our hosting environment, and functional cookies are used to facilitate social logins, social sharing and rich-media content embeds.

Advertising

Advertising Cookies collect information about your browsing habits such as the pages you visit and links you follow. These audience insights are used to make our website more relevant.

Performance

Performance Cookies collect anonymous information designed to help us improve the site and respond to the needs of our audiences. We use this information to make our site faster, more relevant and improve the navigation for all users.