Cyber Security Cloud,Inc. Q4 FY2025 earnings call

Previous Medium-Term Management Plan Achievement

• All annual revenue and operating profit targets over the plan period were met, including the final year targets. The company has achieved 25%+ year-over-year growth for both revenue and operating profit for 6 consecutive periods since listing.
• Qualitative achievements: Two non-Japanese customers are now among the company's top 5 largest customers by revenue, and the number of large customers with ARR over 10 million yen has tripled over 4 years. The company now serves approximately 7,000 total customers, creating strong cross-selling potential. The company has completed 3 M&As over 5 years, expanding its system development capabilities and entering adjacent privacy and data protection security fields, and successfully launched CloudFastener to expand its business scope. It has built a growing business within the AWS ecosystem after prioritizing this market starting from 2021.

Industry Environment and Strategic Positioning

• The cybersecurity industry is undergoing structural change driven by AI adoption: Traditional 1-to-1 communication between users and single SaaS products is shifting to a new structure where multiple systems communicate autonomously to exchange data and generate outputs. This massive increase in the volume of data communication is a tailwind for the company, which focuses on protecting Web application communications, and demand for cybersecurity will continue to grow as data protection remains a core need regardless of AI adoption.
• New AI-era security challenges: Rapid growth in the number of cloud-hosted Web applications (built via no-code tools) expands the total addressable protection market. AI-driven attacks are becoming automated and faster, and multi-step autonomous AI operations create new unregulated risks with unclear accountability. There is a severe global shortage of AI security talent even as enterprises rush to adopt AI, creating new unmet security needs.
• The company's competitive advantages: It has accumulated decades of historical attack data that provides a time-based competitive advantage for AI model development. It already has product and operational implementation capabilities deployed across over 100 countries, and is already integrating AI into its product roadmap. It has sufficient remaining capital after last year's fundraising to pursue new investment and M&A, and has a unique positioning via deep collaboration with cloud platform providers such as AWS. The company will also leverage growing government cybersecurity policy momentum, including the enacted Cyber Response Capability Enhancement Act and increasing cyber-related budget allocations.
• Core strategic focus for 2030: LTV (Lifetime Value) maximization. After achieving the No.1 position in the WAF market, the company is moving beyond its historical WAF-focused business model to expand its scope and drive growth via increasing customer lifetime value.

Four Core Growth Strategies

• 1. Product Line Expansion: The company will add new offerings to the left (customer touchpoint creation) and right (value-added services) of its core product portfolio to create a full cycle that addresses any customer security need. New services/options will be launched in the near term to expand coverage and improve product quality. Customer touchpoint creation refers to proactively engaging potential customers who have unaddressed latent security needs (not just waiting for security incidents to drive purchases), similar to providing health checkups and consulting to identify needs, which creates new business opportunities while delivering customer value. Value-added non-subscription services will be formalized into formal offerings to drive additional revenue from existing core customers.
• 2. Deepening Value via Product × Operation Bundling: The company targets growing the number of customers with ARR over 10 million yen from 48 currently to over 500 by 2030, with focused effort on this high-growth volume segment. Initiatives include unified branding to improve customer awareness of the company's full product portfolio, bundled sales of multiple products plus ongoing operation (a proven winning model validated in the last medium-term plan, centered on CloudFastener), and pricing model reviews to ensure returns match the delivered value.
• 3. Concentrated Investment in AI Security: The company will actively launch new services that protect enterprises from AI-related security risks, beyond just using AI for internal operational efficiency.
• 4. Accelerate Growth via Disciplined M&A: M&A will be used strategically to speed up growth, and the company already has a track record of positive post-merger results from 3 completed acquisitions. The company will only pursue M&A that delivers clear synergies and tangible benefits, and will avoid low-synergy acquisitions that only increase scale.

Global Expansion and Governance

• The company expects sales via AWS Marketplace to accelerate, and prioritizes deep, early engagement with the global cloud platform ecosystem. It already has regional hubs in the US, Europe, and Asia, and global talent hiring is progressing well. Going forward, it will allocate global talent to priority markets to address localization needs that were identified as a key growth opportunity after 4-5 years of global expansion testing.
• Shareholder returns: The company started dividend payments last year, and will target continuous dividend increases, with share buybacks considered based on market conditions.
• Prime Market listing: The company expects to meet the listing requirements in 2026 and 2027, and will work toward a future application to list on the Prime Market after confirming it meets all standards.

1. 攻撃遮断くん (Kōgeki Shadan-kun): Holds the No.1 revenue share in Japan's cloud WAF market. This was the company's core product, accounting for approximately 80% of total revenue at the time of listing. 2. WafCharm: Holds the No.1 revenue share in Japan's WAF automated operation monitoring service segment, and cross-selling adoption with CloudFastener is growing. 3. CloudFastener: Launched in the second half of FY2023, adoption is expanding steadily, with increasing orders from large listed enterprises including House Foods, and combined use with WafCharm is growing rapidly. The sequential Q3 to Q4 growth rate was 105%; the slower sequential growth was attributed to temporary order fulfillment delays and isolated cancellations, not a shift to a stable growth phase, and management expects it to eventually become a core product larger than the company's existing offerings. Total company aggregate results for FY2025: Total revenue reached 5.08 billion yen, operating profit reached 1.1 billion yen, ARR (Annual Recurring Revenue) reached 4.997 billion yen, with overall ARR growing 22% year-over-year. The share of recurring revenue from overseas customers reached 10.6% for the first time, exceeding 10%.

• FY2026 (current period) full-year guidance: 6.0 billion yen in revenue, 1.2 billion yen in operating profit. This guidance only includes organic growth, and excludes any potential contribution from future M&A. The lower implied growth rate relative to historical periods reflects the M&A contribution to FY2025's result, and management expects to outperform this conservative baseline guidance.
• New 2030 medium-term target: 20.0 billion yen in revenue, 4.0 billion yen in operating profit, maintaining a 20% operating profit margin. This target is based on detailed analysis that the company's addressable market is 100 billion yen to 300 billion yen after aggregating relevant segments, and 20 billion yen is a fully achievable target based on expected market share gains. The company targets at least tripling EPS by 2030 to drive share price growth.
• The company has confirmed that the 20 billion yen 2030 revenue target is not an approximate goal, but a detailed plan that accounts for multiple scenarios of organic growth and M&A, with probability-weighted simulations confirming it is achievable.

• AI security talent is extremely scarce globally, creating potential hiring challenges and cost pressure as the company scales its AI security initiatives. However, management notes that hiring has been progressing well recently and the company is steadily building out its team and internal training programs.
• The company still lacks sufficient market recognition for its role in supporting national cybersecurity policy, even as government demand for cyber solutions grows. The company plans to improve PR and IR to address this gap.
• Sequential growth for CloudFastener weakened quarter-over-quarter due to order fulfillment issues and isolated cancellations, though management frames this as temporary.

Q: The new medium-term plan's 2030 revenue target of 20 billion yen looks ambitious. Is this a rough aspirational goal, or a carefully calculated achievable target? Can you share a rough breakdown between organic growth from new products and growth from M&A?

A: This target is based on detailed calculations of achievable market share in each target segment, and we judge it is fully achievable. We do not provide a fixed breakdown between organic and M&A contribution because the plan accounts for multiple possible scenarios, including parallel development of new business lines in different segments, and simulates the probability of success for each path (including organic development, hiring, partnerships, and M&A). We will use M&A strategically as a tool to accelerate growth and speed up delivery of results, rather than pursuing it for its own sake.

Q: CloudFastener's Q3 to Q4 sequential growth rate was 105%, which looks slow. Is this because the product has moved from a high-growth phase to a stable growth phase? What caused the slowdown?

A: The slowdown is due to temporary factors: weaker-than-expected order fulfillment and isolated cancellations from specific customers. We strongly reject the idea that the product has entered a stable growth phase; demand remains robust, and the product is still in the very early stages of growth. We expect it will eventually become our largest core product.

Q: There is growing concern that AI will disrupt the SaaS model. How do you see the market opportunity for SaaS, and do you plan to transform from a WAF-focused company to an AI security company?

A: We do not see the "SaaS is dead" narrative as a threat. While we have SaaS characteristics that have drawn some criticism, the massive increase in data communication driven by AI creates far more market opportunity than any potential risk. It is true that we will no longer be primarily WAF-focused going forward. If being an AI security company means being a company that protects data in the AI era (which aligns with our core focus on growing demand for data protection and increased communication), then yes, that is our direction. But regardless of AI adoption, our core identity will remain a cybersecurity company focused on protecting data, which is a permanent need that will not change.

Q: How is progress going with government-related projects? Are there off-market discussions ongoing?

A: We maintain regular communication with government ministries and agencies about our products and how we can contribute to national cybersecurity. We already have a past track record of delivering projects for the Digital Agency that have supported CloudFastener's growth. We cannot comment specifically on non-public negotiations at this stage, but we are working to build recognition and grow our presence in the government segment.

Q: The FY2026 revenue growth guidance looks lower than historical growth rates. Why is that?

A: The FY2025 result includes contributions from recent M&A deals (DataSign and Generative Technology), so comparing the FY2026 guidance (which excludes new M&A) to the FY2025 result naturally makes the growth rate look lower. We are aware the guidance is conservative, and we will work to outperform this baseline.

Q: Do you have enough resources to deliver on your integrated AI security product and operation model? Won't you need to hire very expensive specialized talent that will drive up costs significantly?

A: We have been researching AI-era security challenges internally for a long time already. We recognize that we need to increase investment, but hiring is progressing well, and we do not expect an extreme unexpected jump in costs.

Q: What is the basis for the 300 billion yen addressable market and 6.6% target share that leads to the 20 billion yen 2030 revenue target?

A: The total is the sum of the relevant segments where we operate: application security, vulnerability management, security diagnostics, managed security, security consulting, and security training.

Q: What is your biggest competitive advantage and entry barrier for your cloud WAF business?

A: Our biggest advantages are our multi-decade accumulation of attack and defense data, our top-tier expertise in cloud security built from years of focus on this market, and the customer trust we have built up over time. It is possible to build a superficially similar product, but the trust and data we have accumulated cannot be easily replicated.

Q: How confident are you that you will achieve the new medium-term plan targets?

A: We have very strong confidence; this target is fully achievable if we execute on our planned initiatives.

Q: What is your strategy for driving share price growth via EPS and PER? What market capitalization do you target by 2030?

A: We have committed to tripling EPS by 2030, which is our core business commitment. If PER remains at current levels, that implies a proportional increase in market capitalization. We are not satisfied with the current share price, and we will work to improve market perception and expand PER via stronger IR, while continuing to grow EPS. We are strongly committed to reaching a higher valuation over the next 5 years.

Q: Do you expect to meet the criteria for inclusion in the next TOPIX rebalancing?

A: We are aware the next rebalancing is scheduled for autumn this year. We know that sustained profit growth is the key to meeting the criteria, and we are working to reach the required level.

Q: Can you share more details on your shareholder return policy? The current projection implies gradually increasing payout ratio to 11% and a dividend of 26.7 yen per share by 2030. Is that the plan?

A: We have committed to continuous dividend increases, and we have planned a 6 yen per share dividend for FY2026. We do not have a fixed mechanical increase schedule for payout ratio. Our core priority is growing EPS to drive capital gains, which also builds the base for future shareholder returns. We will consider dividends and share buybacks based on our performance, and we aim to deliver positive returns to long-term shareholders.

Q: What does "customer touchpoint creation" mean in practice, and how will you implement it?

A: Historically, most of our new customers came to us after an external trigger, such as a security incident or a mandatory requirement to adopt WAF, and our marketing focused on generating leads for WAF. Going forward, we want to also reach customers who have latent security needs but do not yet know they need our products, by offering new services that help them identify their security issues. That is what we mean by customer touchpoint creation — expanding our product lineup to reach these potential customers and deliver value to them early.

Q: Do you still have the long-term goal of reaching the scale of the large global cybersecurity companies that exceed 1 trillion yen in market capitalization?

A: I remember that comment, and I think about it every day. There are already many global cybersecurity companies that exceed 1 trillion yen, even 10 trillion yen, in market capitalization, and this is a very large global market. We study the business models of these companies every day and we aim to build a company that can compete with them. But first, we need to focus on executing this medium-term plan, building a solid, sustainably growing base, and then pursue larger non-linear growth opportunities when they arise. We do aim to reach those high long-term targets, but we prioritize building a sustainable foundation first.

Q: What additional security demand will AI-driven MCP technology create for WAF and CloudFastener? Can your team handle this demand, given that AI security talent is very scarce?

A: For WAF, API communication between applications and database access (the core new demand driven by AI) has always been WAF's core market. While the nature of bot traffic has evolved from all-bad to requiring good/bad classification, the core communication structure that WAF protects has not changed, so our existing technology is fully applicable to this new demand. New types of backchannel communication will require new product features, but we already have the technical capability to deliver these. For CloudFastener, the challenges enterprises face with governing AI tool usage (managing what data AI can access, and controlling AI activity) are very similar to the challenges enterprises faced when moving from on-premise to cloud: unclear ownership, poor configuration governance, and lack of visibility into third-party work on cloud systems. We can extend CloudFastener's existing approach to governance to this new use case directly. AI security talent is indeed scarce, but our hiring has been very strong recently, and we are steadily building our team and capabilities internally, so we are confident we can secure the talent we need.

Q: What strength of the company did you reaffirm when planning the new medium-term plan, that you did not fully appreciate before?

A: We were so focused on executing day-to-day sales that we did not step back to see how valuable our accumulated customer base and data have become. Most CloudFastener users are existing WafCharm customers; historically we did not have many opportunities for cross-selling and upselling when we only offered WAF, but our low customer churn and high customer trust from our WAF business gave us the base to launch new products and grow via cross-selling. Customers have welcomed our expansion into new product areas, so this existing customer base and accumulated data is an extremely valuable, irreplaceable strength that we have built over time, and it gives me high confidence that we will deliver on this new plan.

Q: Can you update us on your fundraising status and financial strategy for the medium term?

A: We raised approximately 2 billion yen in equity from investors including JIC last February, and we also secured a debt financing facility. Part of the equity raise was structured as share warrants with an exercise price of 2,161 yen per share, which will be exercised sequentially once the share price exceeds this level, which is expected to bring in approximately 300 million yen additional capital when that occurs. M&A is included in our 5-year plan, and we will use equity and debt financing flexibly, but we will prioritize maintaining financial health and pursuing growth investment that delivers value, rather than just expanding our capital base. We will communicate clearly if we need additional fundraising during the medium-term plan period.