Cyber Security Cloud,Inc. Q3 FY2025 earnings call

• Financial Results
  • Q3 operating profit hit 360 million yen, an all-time high for any single accounting period. Cumulative operating profit through the first nine months of the fiscal year reached 840 million yen, representing 84.4% progress against full-year guidance, with both revenue and profit tracking on schedule to meet full-year targets.
  • Operating expenses decreased quarter-over-quarter because a portion of CloudFastener new feature development costs were capitalized.
  • Churn for the two core subscription products 攻撃遮断くん and WafCharm remains stable at ~1%.
• Workforce Expansion
  • Mid-career hiring has been very strong, with total headcount growing to 176 employees as of quarter-end. The quality of new hires has strengthened the team significantly in the second half of 2025.
• 攻撃遮断くん Growth Initiatives
  • Signed a sales agency agreement with Sakura Internet, to offer 攻撃遮断くん through the Sakura no Cloud platform. This partnership targets the large remaining market of on-premise and data center-based customers in Japan, to expand user base.
  • Launched a strategic collaboration with Fastly, a high-performance CDN provider. Combining Fastly's CDN with 攻撃遮断くん will deliver higher security accuracy, and create new opportunities to pitch the product to large enterprise customers that use CDN services.
• New Product Launch
  • Released WafCharm Lite, a mid-tier priced offering for AWS users that fills the gap between the low-cost, no-support AWS WAF Managed Rules and the high-cost, full-support WafCharm. The product is designed to enable a smooth upsell path to full WafCharm, expand the customer base, and increase average revenue per user (ARPU).
• New Research Contract Award
  • Won a contracted research project from Japan's Information-technology Promotion Agency (IPA) focused on user-centric educational credential digital identity. This project explores the technical and institutional challenges of enabling cross-border student mobility under differing personal data sovereignty frameworks between Japan and the EU, and forms part of the company's long-term R&D into future cybersecurity needs for user-controlled personal information.

All product segments delivered growth in the quarter:

1. 攻撃遮断くん (Kougeki Shadan-kun): Flagship cloud WAF product, holds the number one market share in Japan's cloud WAF segment, with stable churn holding at ~1% and ongoing user growth from new partner partnerships. No specific absolute revenue or contribution percentage was disclosed in the transcript.
2. WafCharm: Premium managed WAF service for AWS, with stable churn around 1%, growing alongside broader AWS customer adoption in Japan. No specific absolute revenue or contribution percentage was disclosed.
3. CloudFastener: Growth-stage cloud security operations product, launched two years prior, with steadily growing customers and revenue. New feature development costs were partially capitalized in the quarter, supporting profitability. No specific absolute revenue or contribution percentage was disclosed.
4. Generative Technology subsidiary: The newly established subsidiary contributed to revenue growth via contracted development projects in the quarter. No specific absolute revenue or contribution percentage was disclosed.

Overall aggregate annualized recurring revenue (ARR) grew 26.4% year-over-year, and total quarterly revenue grew 36.7% year-over-year.

• Full-year 2025 December fiscal year revenue and profit remain on track to meet original guidance, with 84.4% of full-year operating profit already achieved through the first three quarters.
• Q4 2025 operating expenses are expected to increase compared to Q3, driven by exhibition costs for a large cybersecurity conference in Las Vegas that the company plans to attend.
• CloudFastener is positioned as the primary growth driver for fiscal 2026 and beyond. Management plans to prioritize increasing market awareness of the product, simplifying its messaging for broader adoption, and driving cross-sales to existing customers of the company's other products.
• Capitalization of qualifying CloudFastener development costs will continue in Q4 2025, with amortization scheduled to start from fiscal 2026.

• Long-term uncertainty around future business models: There is global policy uncertainty regarding personal data sovereignty, with the EU already advancing regulations that recognize personal data as an individual asset rather than a corporate asset. This shift could change the company's core business model of serving corporate customers that hold large volumes of user personal data over the long term.
• CloudFastener market adoption risk: While the product solves a clear unmet need for Japanese enterprises facing cloud security talent shortages, it is currently under-recognized by the market, and increasing adoption depends on successful clearer marketing and outreach that communicates its unique value proposition.
• Commercialization uncertainty for digital identity R&D: The IPA educational credential research project is early-stage, and there is no guarantee it will result in a profitable commercial product in the short or medium term. Commercial viability depends on future evolution of global regulatory frameworks for personal data and digital identity, which remain uncertain.
• Cloud security complexity creates customer challenges: Many enterprises lack in-house staff with the expertise to manage cloud security, and this risk grows as cloud technology evolves, though this dynamic also creates market demand for the company's managed solutions.

Q: What products and initiatives will drive growth for the 2026 December fiscal year? / A: Management identifies CloudFastener as the primary growth driver for 2026 and the company's next phase of expansion. The product addresses two major pain points in the Japanese market: widespread lack of in-house cloud security expertise and difficulty keeping up with cloud platform evolution, and it fits these needs very well. It already has a proven value proposition, so the key priorities now are clearer marketing to boost awareness and cross-selling to existing customers of WafCharm and other core products, who already have a high cross-usage rate for CloudFastener.

Q: What is the path to commercialization for the IPA educational credential digital identity project, and what is your timeline? / A: This project is still early-stage research, and management does not expect short-term commercialization that would impact profits. EU already has mature regulation around digital identity and personal data sovereignty, and the project explores how to enable cross-border mobility between the EU's existing framework and Japan's current system. No specific commercial plans or timelines are set yet, but winning this government contract validates the company's long-term R&D direction, and the research findings will serve as a foundation for future opportunities if the regulatory environment evolves.

Q: Does the company benchmark against or target any specific overseas cybersecurity firms? What is the company's global strategy? / A: Management does not benchmark against or target specific overseas firms. The Japanese market has a unique culture of preferring end-to-end outsourced "full-package" services, which is very different from the segmented, function-focused model common in overseas markets. This Japanese preference for full outsourcing is actually a key strength that lets the company continuously refine its products, and the company has already won new customers in North America and South America by leaning into this unique value proposition. Management believes copying the U.S. model would only produce an inferior offering, so the strategy is to refine Japan-specific strengths and adapt them for global markets to build unique, unmatched value.

Q: What is the amount of capitalized CloudFastener development costs, what is the amortization schedule, and will you continue capitalizing development costs going forward? / A: Management declines to share specific figures, but the capitalized amount matches the increase in software assets between Q2 and Q3, excluding amortization impacts. Similar levels of capitalization are expected in Q4, with amortization set to begin in fiscal 2026. The company will follow accounting standards: qualifying development costs that will generate future revenue will be capitalized, while routine operating costs and non-qualifying development will be expensed, with ongoing alignment and discussion with the company's audit firm.