Financial Forensics Proof of Concept
Demonstration output: five-year financial pattern review and example diligence questions · 2021–2025
Proof of concept — demonstration
This document is a proof-of-concept demonstration of a financial analysis workflow. It is published to illustrate the methodology, structure, and potential usefulness of the output.
It is not a production analyst report, investment research, investment advice, a recommendation, an offer, or a solicitation to buy, sell, hold, or subscribe for any security or financial instrument.
The analysis is based solely on publicly available financial data and source materials reviewed for this demonstration. It does not rely on inside information, confidential company information, or non-public management materials.
Findings should be treated as analytical hypotheses and example management questions, not conclusions of fact. The report may contain errors, omissions, or interpretations that require further verification against primary source materials. It should not be relied upon as the sole basis for any investment, credit, or commercial decision. No representation or warranty is made as to the completeness, accuracy, or timeliness of the information. The author accepts no responsibility for any loss arising from reliance on this material.
Cross-statement patterns requiring diligence, with residualised management questions. Each tension synthesises signals from multiple financial statement sections.
The continuing Cyber Security segment reported a statutory operating loss of −£6.1m in FY2025, yet the Group simultaneously paid £19.0m in cash dividends and proposed a further final dividend of 3.15p per share. The FY2025 reported net income of £17.0m that nominally supports the distribution includes £26.2m of profit from discontinued Escode operations and an £11.4m Fox Crypto disposal gain — neither of which recurs in the continuing business.
Evidence: Statutory continuing operations operating income: −£6.1m (FY2025). Finance costs: £5.0m (FY2025). Cash dividends paid: £19.0m (FY2025). Profit from discontinued Escode operations: £26.2m (FY2025). Fox Crypto disposal gain: £11.4m (FY2025). Adjusted EBITDA, Cyber Security excluding Crypto and DetACT: £16.7m (FY2025), down from £18.5m in the prior comparable period.
Why it matters: Post-Escode disposal, the continuing Cyber Security business would need to fund distributions without the £26.2m discontinued operations contribution. Whether the continuing earnings base — currently generating negative statutory operating income and Adjusted EBITDA of £16.7m — is sufficient to sustain the dividend policy is unresolved pending disposal completion and FY26 trading. The signal is consistent with two competing explanations: (a) the dividend is sustainable because Adjusted EBITDA will recover toward the mid-teens margin target by FY28 as restructuring benefits materialise; or (b) the current distribution level is structurally unsupported by continuing operations earnings and will require revision. These cannot be ranked without a fixed-versus-variable cost decomposition of the Cyber cost base and a post-disposal cash flow projection.
Management question: What is the projected FY2026 dividend cover ratio on a continuing Cyber Security basis, using Adjusted EBITDA of £16.7m as the FY2025 baseline, and what specific cost savings from the Phase 3 reorganisation (expected completion December 2025) are assumed to bridge the gap between the −£6.1m statutory operating loss and a level sufficient to fund the proposed 3.15p final dividend?
DSO deteriorated by 17.3 days from 43.8 to 61.1 days between FY2024 and FY2025, while the FY2025 working capital movement was reported as a favourable £1.2m and cash conversion improved to 91.3%. These signals appear in tension: a material DSO deterioration would ordinarily be expected to consume working capital, not release it.
Evidence: DSO: 43.8 days (FY2024) versus 61.1 days (FY2025). Working capital movement: favourable £1.2m (FY2025) versus outflow of £2.6m (FY2024 comparable twelve months). Cash conversion: 91.3% (FY2025), up 16.9 percentage points year-on-year. Remaining performance obligation: £232.8m at 30 September 2025 (Note 3). The working capital movement is disclosed as a net aggregate; sub-movements across receivables, payables, and contract liabilities are not separately quantified in the supplied evidence.
Why it matters: The co-existence of rising DSO and a favourable net working capital movement is consistent with at least three distinct mechanisms: (a) a simultaneous increase in contract liabilities or deferred revenue that offset receivables growth; (b) a back-end-weighted FY2025 revenue recognition pattern inflating period-end receivables relative to the full-year denominator without a genuine collection deterioration; or (c) a payables extension that masked underlying receivables pressure. Each mechanism carries different implications for FY2026 cash generation. The evidence is insufficient to rank these explanations without a disaggregated working capital bridge.
Management question: What is the decomposition of the FY2025 working capital movement of £1.2m across trade receivables, contract assets, contract liabilities, and trade payables, and does the trade receivables balance at 30 September 2025 include any material unbilled or contract asset component that would explain the 17.3-day DSO increase alongside a net favourable working capital outcome?
The Group's goodwill and intangibles base declined by a combined £335m between FY2022 and FY2025, driven by a confirmed combination of impairment charges (£41.7m cumulative), IFRS 5 reclassifications (£162.1m to held-for-sale), disposal derecognitions, amortisation, and FX effects. The residual Cyber Security goodwill of £46.3m and the £76.1m net book value of Escode intangibles reclassified to held-for-sale represent the two remaining concentrations of intangible asset risk. The FY2025 impairment review confirmed no further impairment on Cyber Security CGUs, with sensitivity analysis indicating no material impairment from a 10% revenue shortfall; however, the North America Cyber Security CGU has been impaired in both FY2023 (£9.8m) and FY2024 (£31.9m), and North America revenue declined 15.4% at actual rates in FY2025.
Evidence: Residual Cyber Security goodwill: £46.3m at 30 September 2025 (UK and APAC: £44.3m; Europe: £2.0m). North America Cyber Security revenue decline: 15.4% at actual rates (FY2025). Cumulative North America goodwill impairment: £41.7m (FY2023 + FY2024). Escode intangibles held-for-sale net book value: £76.1m. FY2025 impairment review: no impairment recognised; recoverable amounts exceed carrying values for all remaining CGUs (Note 11, FY2025).
Why it matters: The FY2025 impairment review conclusion is consistent with two competing explanations: (a) the remaining Cyber Security CGUs are genuinely recoverable at carrying value, supported by the FY26 growth framework and cost savings programme; or (b) the recoverable amount assessment is sensitive to discount rate and terminal growth rate assumptions that have not been stress-tested beyond the disclosed 10% revenue shortfall scenario. The £76.1m Escode intangibles held-for-sale also carry realisation risk if the disposal proceeds are below net book value. These cannot be ranked without the key assumptions underlying the FY2025 impairment model.
Management question: What are the discount rate, terminal growth rate, and revenue growth assumptions used in the FY2025 FVLCTS impairment review for the UK and APAC Cyber Security CGU (carrying goodwill of £44.3m), and what is the headroom between recoverable amount and carrying value under those assumptions?
Individually Significant Items have been charged in every year of the five-year period, with aggregate absolute magnitude of £70.9m, and Phase 3 of the reorganisation programme remains in progress as at 30 September 2025 with further costs expected into FY2026. The Adjusted operating profit of £23.7m for FY2025 excludes these charges; the statutory operating loss from continuing operations was −£6.1m. The gap of £29.8m between adjusted and statutory operating profit in FY2025 alone (representing approximately 12.5% of continuing operations revenue of £239.0m) is consistent with a pattern in which restructuring and strategic review costs are structurally recurring in character, regardless of their per-period classification as individually significant.
Evidence: Aggregate ISI charges FY2021–FY2025: £70.9m. FY2025 ISI components: reorganisation costs £3.9m, Escode strategic review £3.8m, Cyber strategic review £1.8m, Fox Crypto disposal gain −£11.4m (net ISI credit −£1.9m). Adjusted operating profit FY2025: £23.7m. Statutory continuing operations operating loss FY2025: −£6.1m. Phase 3 reorganisation: in progress at 30 September 2025; further costs expected in FY2026 (Note 4).
Why it matters: The persistent ISI pattern is consistent with two competing explanations: (a) the Group has faced a sequence of genuinely distinct but coincidentally frequent non-recurring events — acquisition integration, North America market deterioration, portfolio rationalisation — each legitimately exceptional in isolation; or (b) the restructuring programme is structurally multi-period in character, making the adjusted profit metric a systematically optimistic representation of underlying earnings. These cannot be ranked without a disclosure of the total expected remaining cost of the Phase 3 programme and a reconciliation of cumulative reorganisation costs against the original programme budget. The Group's own disclosure acknowledges that judgement is required each period in assessing ISI classification, which is a relevant caveat for any valuation relying on Adjusted EBITDA.
Management question: What is the total expected remaining cash cost of Phase 3 of the reorganisation programme as at 30 September 2025, and how does the cumulative cost incurred to date across all three phases compare with the original programme budget disclosed at inception?
The Group's capital allocation posture has prioritised shareholder distributions and balance sheet repair over organic reinvestment throughout the five-year period: cumulative dividends paid of £76.0m exceed cumulative capex of £34.2m by approximately 2.2×, capitalised development costs have declined from £3.4m (FY2023) to £0.4m (FY2025), and the Board has announced a £170m tender offer and £15m buy-back programme funded by Escode disposal proceeds. The FY26 framework simultaneously targets mid to low single-digit Cyber Security revenue growth and mid-teens Adjusted EBITDA margins by FY28, with the cost savings target of approximately £25m by FY28 intended to be achieved through operational efficiency rather than capital deployment.
Evidence: Cumulative dividends paid FY2021–FY2025: £76.0m. Cumulative capex FY2021–FY2025: £34.2m. Capitalised development cost additions: £3.4m (FY2023), £2.6m (FY2024), £0.4m (FY2025). FY2025 capex: £5.1m (tangible £4.7m, capitalised software £0.4m). Announced capital returns (unaudited, H1 FY2026 interim): £40m buy-back completed by 31 March 2026; £170m tender offer and £15m further buy-back announced post-Escode disposal. FY28 Adjusted EBITDA margin target: mid-teens (management guidance, unaudited).
Why it matters: The sharp decline in capitalised development activity — from £3.4m to £0.4m over three years — is consistent with two competing explanations: (a) the Group has deliberately shifted from capitalised to expensed development, or reduced development activity as non-core product lines were exited, with no adverse consequence for the Cyber Security product roadmap; or (b) underinvestment in product development creates a medium-term risk to the revenue growth targets, particularly given the 4.9% core Cyber Security revenue decline in FY2025. These cannot be ranked without a disclosure of total R&D expenditure (expensed and capitalised) and its composition by segment. The adequacy of £5.1m annual capex relative to asset consumption also cannot be assessed without disaggregated depreciation data separating tangible asset depreciation from acquired intangible amortisation.
Management question: What is the total R&D expenditure for FY2025 on a Cyber Security continuing operations basis, disaggregated between amounts expensed through the income statement and amounts capitalised under IAS 38, and how does this compare with the equivalent FY2023 total given the decline in capitalised development additions from £3.4m to £0.4m over that period?
Five-year series · GBPm unless noted
| Metric | 2021 | 2022 | 2023 | 2024 | 2025 | Direction |
|---|---|---|---|---|---|---|
| Revenue (GBPm) | 271 | 315 | 335 | 342 | 239 | ↓ deterioration |
| Gross profit (GBPm) | 111 | 133 | 132 | 118 | 88 | ↓ deterioration |
| Operating income (GBPm) | 17 | 35 | 2 | -57 | -6 | ↓ deterioration |
| EBITDA (GBPm) | 27 | 44 | 12 | -43 | 4 | ↓ deterioration |
| Net income (reported) (GBPm) | 10 | 23 | -5 | -33 | 17 | ↑ improvement |
| Gross margin (%) | 41.0 | 42.2 | 39.4 | 34.5 | 36.8 | ↓ deterioration |
| Operating margin (%) | 6.3 | 11.1 | 0.6 | -16.7 | -2.5 | ↓ deterioration |
| Net margin (reported) (%) | 3.7 | 7.3 | -1.4 | -9.7 | 7.1 | ↑ improvement |
| Net margin (normalised) (%) | 10.7 | 8.2 | 3.9 | -11.7 | -4.2 | ↓ deterioration |
| Reported vs normalised (%) | -7.0 | -0.9 | -5.2 | 2.1 | 11.3 | ↓ deterioration |
| SG&A as % revenue (%) | 22.5 | 24.4 | 27.5 | 32.8 | 34.3 | ↓ deterioration |
| Capex as % revenue (%) | 1.8 | 2.6 | 2.2 | 2.6 | 2.1 | → stable |
| OCF (GBPm) | 39 | 55 | 32 | 26 | 34 | ↓ deterioration |
| FCF (GBPm) | 34 | 47 | 25 | 17 | 29 | ↓ deterioration |
| Capex (GBPm) | 5 | 8 | 7 | 9 | 5 | ↓ deterioration |
| Dividends paid (GBPm) | 13 | 14 | 15 | 15 | 19 | ↓ deterioration |
| Net cash / (debt) (GBPm) | 49 | -85 | -80 | -73 | -10 | ↓ deterioration |
| Total debt (GBPm) | 68 | 158 | 114 | 103 | 23 | ↑ improvement |
| Current ratio (×) | 1.9× | 1.1× | 0.9× | 1.2× | 2.4× | ↑ improvement |
| Interest coverage (×) | 7.4× | 10.6× | 0.4× | -7.4× | -1.4× | ↓ deterioration |
| Return on equity (%) | — | 8.2 | -1.6 | -13.7 | 8.2 | → stable |
| Goodwill as % assets (%) | 42.4 | 46.2 | 51.1 | 37.4 | 13.4 | ↑ improvement |
| Intangibles as % assets (%) | 4.9 | 20.7 | 22.2 | 21.2 | 1.1 | ↑ improvement |
| DSO (d) | 88d | 79d | 58d | 44d | 61d | ↑ improvement |
Section-by-section findings with epistemic status — confirmed: primary-source disclosure · inferred: mechanistic evidence · unresolved: competing explanations not ranked.
Revenue grew for four consecutive years from 2021 to 2024, reaching a peak of £342.0m, before falling sharply to £239.0m in 2025. The Financial Review confirms that the FY2025 figure relates to the Cyber Security segment on a continuing operations basis, following the reclassification of Escode as a discontinued operation under IFRS 5 (Note 16); total Group revenue including Escode was £305.4m for the year ended 30 September 2025. The 2025 decline in continuing operations revenue therefore partly reflects a structural perimeter change — Escode's £66.5m contribution is excluded from the continuing operations line — rather than solely an organic demand deterioration, though on a comparable year-on-year basis Cyber Security revenue also contracted by 9.2% at actual rates (8.3% at constant currency). Whether the remaining Cyber Security decline represents a one-period event or a sustained change in trajectory requires monitoring against the FY26 framework, in which the Board targets mid to low single-digit Cyber Security revenue growth (management guidance, unaudited).
Growth decelerated continuously from 2022 through 2024 before turning sharply negative in 2025, producing a negative four-year CAGR despite three years of positive growth. The Financial Review identifies that the year-on-year Cyber Security revenue decline of 9.2% in FY2025 was driven by two distinct forces: a 52.1% collapse in Crypto and DetACT revenues following the Fox Crypto disposal and DetACT exit, and a 4.9% decline in core Cyber Security (excluding those disposals), itself driven primarily by TAS market weakness — North America TAS declining 12.9% at constant currency as demand recovered more slowly than expected. The consistent deceleration from +16.24% to +2.09% across 2022–2024 may therefore partly reflect the progressive rundown of non-core revenues alongside the organic TAS demand softness, making it difficult to attribute the full 2025 contraction to either an isolated external shock or a structural deterioration without decomposing the portfolio mix in earlier periods. (The CAGR is endpoint-sensitive; the 2025 decline dominates the four-year summary statistic.)
The 2024→2025 period represents the sole material inflection point in the series, with an absolute continuing operations revenue loss of £103.0m that more than offsets all gains recorded between 2021 and 2024 (£71.0m cumulative increase to peak). The Financial Review discloses that on a like-for-like year-on-year basis excluding Crypto and DetACT, total revenue declined by only 3.7% at actual rates (2.6% at constant currency), with Escode growing 0.8% and core Cyber Security declining 4.9%; the headline £103m step-down therefore substantially overstates the organic revenue deterioration and is materially driven by the IFRS 5 reclassification of Escode and the disposal of Fox Crypto. Nonetheless, the core Cyber Security decline, particularly in North America (down 15.4% at actual rates), and the persistently negative operating income from continuing operations (−£6.1m at the sub-total level) indicate that underlying business performance has not recovered to prior peak levels. (If the reported 2025 figure is assessed on a perimeter-consistent basis, the annualised organic run-rate decline is materially smaller than the headline series implies.)
Gross margin followed an inverted-V trajectory, with the FY2022 peak followed by three years of net deterioration, leaving the FY2025 level materially below the FY2021–FY2022 range despite a partial recovery in the final year. The Financial Review discloses that for FY2025 total Group gross profit was £135.9m at a 44.5% margin, representing a 1.1 percentage point improvement versus the prior comparable twelve-month period, driven primarily by a 2.6 percentage point improvement in Escode gross margin (to 71.4%) as a result of favourable pricing and operating efficiencies, while Cyber Security gross margin excluding Crypto and DetACT remained broadly flat at approximately 37%. The sustained compression below the FY2021–FY2022 range therefore appears to reflect a combination of portfolio mix effects from the Escode/Cyber weighting, input cost pressures absorbed over the intervening years, and the dilutive impact of lower-margin TAS revenue; the partial FY2025 recovery is consistent with cost restructuring benefits rather than a broad-based pricing improvement. (Gross margin composition is not fully disaggregated across all cost-of-revenue components; no attribution to pricing, mix, or capitalised-intangible reclassification is possible from the available disclosure.)
The operating margin deterioration from FY2022 to FY2024 (−2,778 basis points) substantially exceeds the gross margin deterioration over the same interval (−772 basis points), indicating that operating expense growth — not solely cost-of-revenue pressure — drove the operating loss in FY2024. Note 4 of the FY2024 Financial Statements confirms that the £41.5m of Individually Significant Items charged in that period included a £31.9m goodwill impairment charge on the North America Cyber Security CGU and £9.4m of fundamental reorganisation costs, which are mechanistically linked to the operating loss at the segment level (Cyber Security operating loss of £33.1m in the 16-month period to 30 September 2024). The gap between gross and operating margin compression is therefore substantially explained by these non-recurring charges, though the concurrent growth in administrative expenses — from £90.6m in FY2023 to £124.8m in FY2024 — indicates underlying opex also grew faster than revenue, amplifying the gross-level deterioration at the operating line. (R&D is not separately disclosed; its contribution to operating expense growth cannot be isolated.)
SG&A as a percentage of revenue rose in every year of the period, indicating that SG&A costs grew faster than revenue throughout FY2021–FY2025. The Financial Review discloses that administrative expenses (excluding share-based payments, depreciation, amortisation, and amortisation of acquired intangibles) decreased by 2.4% from £91.4m to £89.2m in FY2025, driven primarily by lower payroll costs following the globalisation of certain back-office functions to Manila, and savings in rent and rates, partially offset by unfavourable exchange rate movements. This confirms that the restructuring programme yielded measurable opex savings in FY2025, consistent with the three-phase reorganisation described in Note 4; however, the earlier period of accelerating SG&A intensity (particularly the +529 bps step in FY2023–FY2024) reflects a phase in which reorganisation costs were being incurred before efficiency benefits materialised. (The telemetry labels this metric's direction as "improvement," which is a sign-convention artefact; economically, a rising SG&A-to-revenue ratio represents deterioration in cost leverage, and the FY2025 improvement in absolute opex remains contingent on successful completion of Phase 3 of the reorganisation, expected by December 2025 per Note 4.)
R&D expenditure cannot be quantified, located within the income statement, or assessed for capitalisation treatment from the available data. Note 12 of the FY2023 Financial Statements and Note 11 of the FY2024 and FY2025 Financial Statements confirm that development costs are capitalised in accordance with IAS 38 development criteria, and the goodwill and intangibles roll-forward shows software and development cost additions of £3.4m (FY2023), £2.6m (FY2024), and £0.4m (FY2025), indicating a material reduction in capitalised development activity over the period. Any inference about total R&D intensity, its contribution to operating expense growth, or the adequacy of the capitalisation policy would require disaggregation of expensed development costs, which is not available in the supplied evidence.
Reported net income recovered to £17.0m in FY2025 despite operating income from continuing operations remaining negative (−£6.1m), while the prior finding identifies that the divergence is driven by items below the operating line. Note 4 and the Financial Review confirm that the FY2025 reported net income benefited from an £11.4m gain on disposal of Fox Crypto (classified as an Individually Significant Item and presented as a separate line on the face of the income statement), a £26.2m profit from discontinued Escode operations, and a net ISI credit of −£1.9m, collectively sufficient to explain the swing from operating loss to net profit. The divergence between reported and normalised profitability therefore has a disclosed mechanism — disposal proceeds and discontinued-operations earnings — rather than an unidentified below-the-line item, though whether underlying Cyber Security continuing operations can sustain positive net income without these contributions remains the central diligence question. (The gain on disposal of Fox Crypto was confirmed as non-taxable per the Financial Review reconciliation.)
Special items have been recorded in every year of the five-year period, with aggregate absolute magnitude of £70.9m; Note 4 of the FY2024 and FY2025 accounts confirms this pattern and provides itemised disclosure. The disclosed items include the North America Cyber Security goodwill impairment of £9.8m (FY2023) and £31.9m (FY2024), fundamental reorganisation costs of £4.2m (FY2023), £9.4m (FY2024), and £3.9m (FY2025), and strategic review costs for Escode (£3.0m in FY2023, £0.1m in FY2024, £3.8m in FY2025) and Cyber (£1.8m in FY2025). The three-phase reorganisation programme — with Phase 3 remaining in progress as at 30 September 2025 and further costs expected into FY26 per Note 4 — is explicitly described as a multi-period programme, indicating that at least a subset of these charges is structurally recurring in character, regardless of their classification as individually significant items. (The Group's own disclosure acknowledges that judgement is required each period in assessing whether restructuring items meet the ISI classification criteria, which is a relevant caveat for adjusted profit metrics that exclude these items.)
CapEx intensity has remained in a narrow band of 1.8%–2.6% of revenue throughout the period, with no sustained directional trend. The Financial Review confirms that cash capital expenditure in FY2025 was £5.1m (tangible assets £4.7m, capitalised software and development £0.4m), down from £8.8m in FY2024, and includes £1.6m of tangible capital expenditure related to the fit-out of the new Fox-IT office in October 2025. The Financial Review's FY26 framework targets increasing Cyber utilisation from 70% to 75% and driving enhanced benefits from a globalised technical resource footprint, suggesting the low-capex model is expected to persist and that productivity gains are anticipated through operational model changes rather than material asset investment. (Whether CapEx at this level is adequate relative to asset consumption cannot be assessed without disaggregated depreciation data separating tangible depreciation from acquired-intangible amortisation.)
The simultaneous step-up in both goodwill and intangibles in FY2022 is consistent with one or more business combinations, while the subsequent multi-year decline in both balances — goodwill falling by £220m and intangibles by £115.4m from FY2022 to FY2025 — reflects a combination of confirmed mechanisms. Note 35 of the FY2023 accounts confirms the FY2022 step-up reflects the £152.0m cash acquisition of the IPM business (Iron Mountain Intellectual Property Management), which gave rise to £68.6m of goodwill and £91.4m of customer relationship intangibles. Subsequent goodwill decline was driven by impairment charges of £9.8m (FY2023, North America Cyber Security and NCC Group A/S), £31.9m (FY2024, North America Cyber Security), derecognition of £51.9m of goodwill reclassified to assets held for sale in respect of Fox Crypto (FY2024), and a further £110.2m reclassification to assets held for sale in respect of Escode (FY2025); per Note 11 of the FY2025 accounts, no further impairment was recognised in FY2025 and the Board's FVLCTS review confirmed recoverable amounts exceeded carrying values for all remaining CGUs. (FX translation through OCI also contributed to goodwill movements in each period; the residual goodwill of £46.3m at FY2025 relates entirely to Cyber Security CGUs and does not include the Escode balance of £110.2m, which is classified as held for sale.)
OCF and FCF peaked in 2022 and have not recovered to that level, with 2024 representing the trough and 2025 showing a partial rebound that still leaves both metrics materially below the 2021–2022 range. The Financial Review discloses that net cash generated from operating activities was £33.5m for the year ended 30 September 2025, with operating cash inflow before working capital movements of £38.7m and a favourable working capital movement of £1.2m; cash conversion (operating cash flow before interest and taxation as a percentage of Adjusted EBITDA) improved by 16.9 percentage points to 91.3%, primarily driven by stronger second-half performance and favourable working capital movements reflecting improved collectability. The post-2022 compression in cash generation is therefore consistent with the earnings deterioration and elevated ISI cash outflows over FY2023–FY2024, while the FY2025 partial rebound is corroborated by the disclosed cash conversion improvement, though whether this level is sustainable depends on whether working capital improvements persist and whether the ISI cash outflow of £3.8m in FY2025 continues to decline. (Capex composition — maintenance versus growth — is not separately disclosed, limiting FCF quality assessment.)
The OCF/NI ratio has declined from 3.90 to 2.00 over the observable period, and the divergence between endpoint OCF contraction and NI expansion is the basis for the weakening classification. The FY2025 net income of £17.0m includes £26.2m of profit from discontinued Escode operations and an £11.4m Fox Crypto disposal gain, neither of which is reflected in operating cash flow from continuing operations (Escode's operating cash flows are separately presented as £39.6m in Note 16); the OCF/NI ratio computed on a continuing-versus-reported basis therefore conflates different perimeters, making the trend potentially misleading. The ratio's apparent weakening may partly reflect this perimeter mismatch rather than a deterioration in accrual quality, though the evidence does not rank between these explanations. (OCF/NI ratios above 1.0 across all observable years indicate OCF exceeds NI in absolute terms throughout; the "weakening" classification reflects trend direction.)
Working capital was a cash drag in four of five years, with 2024 representing a step-change outflow before reverting to a more modest drag in 2025. The Financial Review confirms that the FY2025 working capital movement was a favourable £1.2m, attributed to improved collectability, compared with an outflow of £2.6m (FY2024 comparable twelve months) and £10.1m (FY2024 sixteen-month period); this is consistent with the cash conversion improvement to 91.3% disclosed for FY2025. The 2024 spike in working capital consumption remains the single largest identifiable contributor to that year's OCF trough, and the evidence does not rank whether the outflow originated from receivables expansion, payables reduction, or a prior-year timing benefit unwinding. (The working capital movement figure is a net aggregate; the reconciliation of net debt provided in the Financial Review does not decompose the £1.2m into receivables, payables, and inventory sub-movements.)
Receivables and DSO declined materially from 2021 to 2024, indicating faster collection or a shift in revenue mix or billing terms, before DSO rebounded to 61.1 days in 2025 despite receivables remaining flat. The Financial Review's disclosure of a £232.8m continuing-operations remaining performance obligation (RPO) as at 30 September 2025 (Note 3), expected to be recognised between FY26 and FY30, confirms substantial multi-year contracted revenue, which is consistent with the Managed Services revenue growth of 2.6% and C&I growth of 14.9% disclosed for FY2025; however, RPO scale confirms only the existence of committed contracts and does not confirm receivables collection timing or DSO composition, which remain unresolved by this disclosure. (DSO is computed against revenue and may be distorted if revenue is recognised unevenly across quarters or if the receivables balance includes contract assets.)
Payables contracted by £4.1m between 2022 and 2024, indicating that the business paid suppliers faster or lost extended credit terms over this period, which would have contributed a cash outflow to working capital independent of receivables or inventory movements. The Financial Review does not provide a disaggregated payables movement, but the £89.2m administrative expenses base for FY2025 (down from £91.4m) and the noted payroll and rent savings are consistent with a reduced payables run-rate in FY2025, which may contribute to the payables compression observed. The £4.1m cumulative payables decline is insufficient to fully explain the £23.0m FY2024 working capital outflow, leaving the residual mechanism unresolved. (Payables balances are point-in-time and may reflect seasonal or period-end timing rather than a sustained change in supplier payment terms.)
The company moved from a net cash position of £49m in 2021 to a net debt position that peaked at £85m in 2022, with partial deleveraging to £10m net debt by 2025. The Financial Review confirms that net cash excluding lease liabilities reached £13.1m at 30 September 2025 (net debt including leases: £6.4m), with the reduction in net debt predominantly driven by the completion of the Fox Crypto disposal in March 2025, from which the Group received net sale proceeds of £61.4m that were used to repay external borrowings; prior to the disposal, the Group carried borrowings of £61.5m (net of deferred issue costs) as at 30 September 2024. The trajectory confirms that deleveraging was driven by an asset disposal rather than by organic cash generation, which is a relevant distinction for assessing the sustainability of the improved balance sheet position under the pure-play Cyber continuing operations. (Without maturity schedules, covenant terms, and available undrawn facilities for the residual RCF, the adequacy of the £13.1m net cash position cannot be fully assessed; the Board's FY26 framework targets strong cash conversion and appropriate liquidity.)
Leverage deterioration from 2022 to 2024 was driven primarily by EBITDA compression rather than debt growth — gross debt actually declined from £158m to £103m over that period while EBITDA collapsed — and this characterisation is corroborated by the disclosed Adjusted EBITDA series. The Financial Review reconciliation confirms Adjusted EBITDA declined from £51.6m (16-month period to 30 September 2024) to £43.7m (year ended 30 September 2025) on a total Group basis, and that the Cyber Security segment's Adjusted EBITDA (excluding Crypto and DetACT) fell from £18.5m to £16.7m year-on-year, suggesting continuing operations earnings quality has not materially recovered. The leverage stress in 2023–2024 therefore reflects an earnings problem confirmed by the disclosed EBITDA compression, with different implications for recovery trajectory than a pure borrowing problem. (EBITDA figures are APMs and exclude ISIs; the statutory operating loss from continuing operations was £6.1m in FY2025.)
Interest coverage collapsed from a comfortable double-digit level in 2022 to sub-zero in 2023 and remained negative through 2025 on a statutory operating income basis. The Financial Review confirms that finance costs for FY2025 were £5.0m (down from £8.3m in the prior period), with the reduction directly attributable to the repayment of external borrowings following the £65.6m Fox Crypto disposal proceeds received in March 2025; FY26 finance costs are expected to amount to approximately £1.8m, reflecting the Group's expected net cash position (management guidance, unaudited). The sharp debt reduction from £103m (2024) to approximately £3.3m (2025, borrowings net of deferred issue costs) has therefore materially addressed the interest burden, but statutory coverage from continuing operations operating income remains negative at −£6.1m versus £5.0m interest, making debt serviceability from continuing operations earnings still a concern absent the Escode contribution. (The Adjusted operating profit of £23.7m for FY2025 exceeds finance costs of £5.0m, but this is an APM that excludes ISI charges and amortisation of acquired intangibles.)
The current ratio fell below 1.0× in 2023 before recovering to 2.35× by 2025. The Financial Review confirms the FY2025 balance sheet benefited from the reclassification of £198.0m of Escode assets as held for sale (current assets) as at 30 September 2025 per Note 16, which would mechanistically inflate the current ratio; the 2025 recovery to 2.35× therefore may partly reflect this reclassification rather than an improvement in operating liquidity, and the current ratio post-Escode disposal would need to be assessed on a continuing-only basis. The 2023 sub-1× current ratio, coinciding with near-zero interest coverage, represents the period of greatest near-term liquidity stress, which the subsequent Fox Crypto disposal and debt repayment have partially resolved. (Current ratio interpretation requires knowledge of the composition of current assets, including the £198.0m held-for-sale balance and £3.9m of Escode cash, neither of which represents core operating liquidity for the continuing Cyber business.)
Equity declined by £88m between 2022 and 2024, consistent with accumulated losses in those years, before stabilising in 2025. The Financial Review and Note 4 confirm that the FY2024 losses were materially driven by the £31.9m North America Cyber Security goodwill impairment and £9.4m of reorganisation costs charged as ISIs, as well as the statutory loss from continuing operations of £32.5m for the sixteen-month period; the FY2025 equity stabilisation is consistent with the statutory profit of £17.1m for the year. ROE returned to positive in FY2025 but the recovery is partly attributable to the Fox Crypto disposal gain (£11.4m) and Escode discontinued operations profit (£26.2m) rather than continuing operations performance, and the equity base itself remains materially lower than at peak, reducing the book value buffer against further impairment or operational losses. (Equity movements may also include FX translation differences; £(0.1)m of exchange differences on translation of discontinued operations is disclosed in Note 16.)
Goodwill stepped up sharply in FY2022 by £83m, consistent with the confirmed IPM acquisition (Note 35 of FY2023 accounts: £68.6m goodwill arising on £152.0m cash consideration), and the subsequent decline from £266m to £46m by FY2025 (a reduction of £220m) reflects a combination of confirmed mechanisms: goodwill impairment charges of £9.8m (FY2023) and £31.9m (FY2024) on North American CGUs per Notes 12 and 11 respectively; derecognition of £51.9m of Fox Crypto CGU goodwill reclassified to assets held for sale (FY2024); reclassification of £110.2m of Escode goodwill to assets held for sale (FY2025 per Note 16); and FX translation effects in each period. Note 11 of the FY2025 accounts confirms that no further impairment was recognised in FY2025 and that the Board's FVLCTS review found recoverable amounts exceeded carrying values for all remaining Cyber Security CGUs, with sensitivity analysis indicating no material impairment would arise from a 10% revenue shortfall. (The residual £46.3m goodwill relates entirely to UK and APAC Cyber Security (£44.3m) and Europe Cyber Security (£2.0m) CGUs; the Escode goodwill of £110.2m is classified as held for sale and is not included in this figure.)
The combined reduction in goodwill and intangibles of £335m between FY2022 and FY2025 substantially exceeds the equity erosion of £86m over the same period, suggesting that write-downs were partially offset by other equity movements or that the charges were spread across multiple periods. Note 11 of the FY2025 accounts confirms that the intangibles reduction includes £98.9m of customer contracts and relationships reclassified to assets held for sale (Escode), amortisation of acquired intangibles of £8.1m in FY2025 and £12.5m in FY2024, and FX effects; the scale of intangible asset reduction relative to the original £91.4m customer relationship intangible recognised on the IPM acquisition implies that a significant portion of the value assigned in that transaction has been amortised or written off within the subsequent three-year period. (Asset reductions include disposal derecognition, amortisation of finite-life intangibles, and FX effects in addition to any impairment; the FY2025 Note 11 confirms no impairment of remaining Cyber Security intangibles, but the Escode intangibles reclassified to held for sale carry a net book value of £76.1m whose ultimate realisation depends on the Escode sale transaction.)
Cash dividends paid have been stable to rising across the five-year period, with a step-up to £19.0m in 2025. The Financial Review confirms that during FY2025 total dividends of £9.2m were recognised and paid, and additionally the £9.8m interim dividend for the prior period (3.15p per share) was recognised in the prior period and paid during FY2025 on 1 October 2024, together explaining the £19.0m cash outflow; the Board is proposing a final dividend of 3.15p per ordinary share for FY2025, marking 20 consecutive years of dividend payments. The 2021 gap between the income statement charge and cash paid, which may reflect a timing difference or scrip component, is a separate historical question; the FY2025 dividend mechanics are fully explained by the interim/final payment calendar disclosed in the Financial Review. (The gross dividend income-statement charge for FY2025 is not separately identified in the supplied canonical metrics, so the income-statement-to-cash comparison for that year cannot be completed independently of the Financial Review disclosure.)
Equity activity shifted from a large net issuance of £73.0m in FY2021 to negligible movement in FY2022–FY2023 and then to modest net buybacks of £5.5m in both FY2024 and FY2025. The Financial Review confirms that in FY2025 the Company acquired 4,000,000 treasury shares for £5.8m (consistent with FY2024), with shares held in the Employee Benefit Trust for future vesting requirements; additionally, as announced on 21 October 2025, the Board intended to commence an initial share buy-back programme in December 2025/January 2026, and per the H1 FY2026 interim announcement (unaudited), approximately £40m had been returned to shareholders under that programme by 31 March 2026, with a further £170m tender offer and £15m buy-back announced following the Escode disposal. The 2021 issuance is consistent with the Note 35 disclosure that the IPM acquisition was partly funded by a £70.2m equity placing in May 2021; the subsequent buyback trajectory signals a shift toward returning capital to shareholders following balance sheet repair. (The H1 FY2026 capital return figures are from the interim announcement, unaudited; the £170m tender offer and £15m buy-back remain subject to due process per the Board's own disclosure.)
Debt activity shows a net repayment of £66.0m in FY2021, a gross issuance of £76.0m in FY2022 to partly fund the £152.0m IPM acquisition, followed by three consecutive years of repayment totalling £144.0m (FY2023–FY2025). The Financial Review reconciliation of net debt confirms that the largest single FY2025 debt reduction event was the application of £61.4m net Fox Crypto disposal proceeds to repay external borrowings, reducing borrowings (net of deferred issue costs) from £61.5m at 30 September 2024 to £3.3m at 30 September 2025; FY2025 finance costs of £5.0m reflect the partially year-weighted benefit of this repayment, with annualised FY26 finance costs expected at approximately £1.8m (management guidance, unaudited). The deleveraging from FY2023 onward is therefore driven by both operational cash generation and asset disposal proceeds, and the sustainability of the improved net cash position depends on whether continuing Cyber operations can generate sufficient OCF absent Escode's contribution. (The H1 FY2026 interim announcement (unaudited) discloses net debt excluding lease liabilities of £10.2m at 31 March 2026, including £21.1m of Escode discontinued operations cash balances, improving significantly post period-end to approximately £230m net cash at 1 June 2026 following Escode disposal completion.)
The £153.0m outflow in other investing cash flow in FY2022 is discrete and isolated, approximately 19× the concurrent capex spend of £8.2m, consistent with the confirmed IPM acquisition cash consideration of £152.0m disclosed in Note 35 of the FY2023 accounts. The partial reversal visible in FY2024 (+£11.0m) and FY2025 (+£61.0m) investing inflows is consistent with the disclosed disposal proceeds: £10.4m net from the DetACT sale (April 2024) and £61.4m net from the Fox Crypto disposal (March 2025) per the Financial Review net debt reconciliation. The confirmed acquisition and disposal mechanics resolve the classification of these flows; the remaining diligence question is whether the value created by the IPM acquisition — which generated £68.6m of goodwill and £91.4m of customer relationship intangibles at inception — has been adequately preserved, given the subsequent impairment of North America Cyber Security goodwill and the ongoing Escode disposal process. (The £51.9m of Fox Crypto goodwill reclassified to assets held for sale and subsequently derecognised on disposal, and the £110.2m Escode goodwill reclassified to held for sale, are separately tracked in the goodwill roll-forward per Notes 11 and 16; disposal proceeds do not directly explain these goodwill movements, which reflect derecognition of the allocated goodwill of each disposed CGU.)
Across the five-year period, cumulative dividends paid (£76.0m) exceed cumulative capex (£34.2m) by a factor of approximately 2.2×, while the company simultaneously pursued net debt reduction of £134.0m, indicating that shareholder distributions and balance sheet repair have both been prioritised over organic capital investment. The Financial Review's FY26 framework confirms this capital allocation posture is expected to persist: the Board targets strong cash conversion, sustains appropriate liquidity, commits to the dividend policy, and initiates a share buy-back programme, while capex guidance of £5.1m in FY2025 implies continued low investment intensity; per the H1 FY2026 interim announcement (unaudited), the Board intends a £170m tender offer and £15m buy-back programme funded by Escode disposal proceeds, reinforcing the distribution-oriented allocation priority. Whether constrained reinvestment is adequate relative to the FY26 targets of mid to low single-digit Cyber revenue growth and mid-teens Adjusted EBITDA margins by FY28 (management guidance, unaudited) is a testable question that the disclosed cost savings target of approximately £25m by FY28 is intended to address through efficiency rather than capital deployment. (Operating cash flow adequacy to simultaneously fund all three capital allocation uses under the pure-play Cyber structure cannot be confirmed from the FY2025 data alone.)
Cross-tension synthesis identifying structural mechanisms and the specific disclosures required to confirm or refute each hypothesis.
Three capital allocation commitments — the 3.15p final dividend, the announced £170m tender offer, and the £15m buy-back programme — are being funded from a combination of Escode disposal proceeds and a continuing Cyber Security earnings base that generated a statutory operating loss of −£6.1m and Adjusted EBITDA of £16.7m in FY2025. Integrating across Sections 2, 4, and 5, the structural tension is not simply that dividends were paid during a loss year (Section 6 tension 1), but that the three capital allocation streams are simultaneously drawing on the same finite disposal proceeds pool while the continuing operations earnings base has not yet demonstrated the capacity to independently service any one of them. Finance costs are expected to fall to approximately £1.8m in FY26, which partially improves the statutory coverage position, but even applying the full £1.8m reduction, continuing operations operating income would need to improve by approximately £4.3m from the FY2025 level before statutory interest coverage reaches breakeven — a threshold that the FY28 mid-teens Adjusted EBITDA margin target implies is achievable but that cannot be confirmed from the FY2025 data. The capital return programme is consistent with at least two mechanisms: (a) the Board has assessed that disposal proceeds are sufficient to fund distributions while the Cyber earnings base recovers toward the FY28 target, treating the tender offer as a one-period event funded by asset monetisation rather than recurring earnings; or (b) the distribution scale has been set at a level that presupposes a pace of Cyber earnings recovery that the FY2025 Adjusted EBITDA trajectory — declining from £18.5m to £16.7m year-on-year — does not yet corroborate. These mechanisms cannot be ranked without a post-disposal cash flow projection and a fixed-versus-variable cost decomposition of the Cyber cost base. The specific disclosure that would confirm or refute mechanism (a) is a Board-approved capital allocation framework showing projected Cyber OCF against committed distributions over FY26–FY28; the disclosure that would confirm or refute mechanism (b) is the Phase 3 reorganisation cost savings schedule with phased EBITDA impact.
Caveat: The H1 FY2026 interim figures are unaudited; the £170m tender offer and £15m buy-back remain subject to due process. Adjusted EBITDA is an APM excluding ISI charges; the statutory operating loss is the applicable GAAP measure for coverage assessment.
Section 6 identifies the surface tension between rising DSO (43.8 to 61.1 days) and a net favourable working capital movement of £1.2m. The integrative dimension absent from that tension statement is that this unresolved co-existence has a compounding effect on the FY2026 cash generation outlook when considered alongside the revenue mix shift and the RPO profile. Specifically: if the DSO increase reflects a back-end-weighted FY2025 revenue recognition pattern (mechanism b in Section 6), then the £1.2m favourable working capital movement may include a timing benefit that partially reverses in H1 FY2026, reducing OCF in the period immediately following the Escode disposal when the Group is most dependent on Cyber OCF. If instead the DSO increase reflects a shift toward longer-term enterprise contracts (mechanism a), the £232.8m RPO balance — expected to be recognised between FY26 and FY30 — would be consistent with a structurally higher receivables balance that persists, and the favourable working capital outcome would require a simultaneous increase in contract liabilities or deferred revenue to offset it. If the DSO increase reflects payables extension (mechanism c), the favourable working capital outcome is transient and the payables position would normalise in FY2026. Each of these three mechanisms requires independent confirmation: mechanism (a) would be confirmed by a receivables ageing schedule showing a shift in customer payment term profile; mechanism (b) would be confirmed by a quarterly revenue phasing disclosure showing Q4 FY2025 revenue concentration; mechanism (c) would be confirmed by a disaggregated payables movement in the working capital bridge. The cash conversion improvement to 91.3% is consistent with all three mechanisms and does not rank between them. Until the working capital bridge is disaggregated, the FY2025 cash conversion improvement cannot be confirmed as a durable trend rather than a one-period outcome.
Caveat: DSO is computed against full-year revenue and may be distorted by intra-year revenue phasing; the working capital movement is disclosed as a net aggregate without sub-movement decomposition in the available evidence.
Sections 6 tension 4 and tension 5 address the ISI recurrence and the capitalised development decline as separate questions. The integrative dimension is that both signals affect the same metric — Adjusted EBITDA — in the same direction, and the FY28 mid-teens margin target is expressed in Adjusted EBITDA terms. The £29.8m gap between Adjusted operating profit (£23.7m) and statutory continuing operations operating loss (−£6.1m) in FY2025 represents approximately 12.5% of continuing operations revenue; if any portion of the ISI charges is structurally recurring (Phase 3 reorganisation costs expected into FY2026 per Note 4), the Adjusted EBITDA margin in FY2026 will continue to overstate the statutory margin by a material amount. Simultaneously, capitalised development additions declined from £3.4m to £0.4m between FY2023 and FY2025 — a reduction of £3.0m — which is consistent with at least two mechanisms: (a) deliberate exit of non-core product lines (Fox Crypto, DetACT) reducing the capitalised development base without adverse consequence for the Cyber roadmap; or (b) a reduction in total development activity that creates a medium-term risk to the 4.9% core Cyber revenue decline reversing toward the mid to low single-digit growth target. These mechanisms cannot be ranked because total R&D expenditure (expensed and capitalised) is not disclosed; R&D is not separately identified in the income statement, and no primary-source disclosure states whether development costs are embedded in cost of revenue or administrative expenses. The specific disclosures required are: (i) total remaining cash cost of Phase 3 reorganisation as at 30 September 2025; (ii) total R&D expenditure for FY2025 on a Cyber continuing operations basis, disaggregated between expensed and capitalised amounts; and (iii) the Adjusted EBITDA bridge from FY2025 to the FY28 target showing the assumed ISI run-rate and development investment assumption.
Caveat: R&D is not separately disclosed in the evidence pack; no inference about its location within the income statement or its capitalisation treatment beyond the confirmed IAS 38 capitalised additions of £0.4m is possible from the available data.
Section 6 tension 3 addresses the impairment review conclusion for residual Cyber goodwill and the Escode intangibles realisation risk as a single tension. The integrative dimension is that these two concentrations are subject to entirely different resolution mechanisms and timelines, and their interaction with the balance sheet creates a compounding risk that is absent from the individual tension statement. For the £46.3m Cyber Security goodwill (UK and APAC £44.3m, Europe £2.0m): the FY2025 impairment review confirmed no impairment with sensitivity analysis limited to a 10% revenue shortfall scenario, but North America Cyber Security revenue declined 15.4% at actual rates in FY2025 — a decline that exceeds the disclosed sensitivity threshold — and while North America goodwill has already been fully impaired (cumulative £41.7m), the UK and APAC CGU carrying the £44.3m balance has not been separately stress-tested against a scenario consistent with the observed North America trajectory. The discount rate, terminal growth rate, and revenue growth assumptions underlying the FVLCTS review are not disclosed in the available evidence, making the headroom between recoverable amount and carrying value unverifiable. For the £76.1m Escode intangibles held-for-sale: realisation depends on the Escode disposal transaction completing at a price that supports the net book value; the H1 FY2026 interim announcement (unaudited) discloses approximately £230m net cash at 1 June 2026 following Escode disposal completion, which is consistent with disposal proceeds exceeding the £76.1m intangibles carrying value, but the allocation of proceeds between goodwill (£110.2m held-for-sale) and intangibles (£76.1m) and the resulting gain or loss on disposal cannot be confirmed from the available data. The two risk concentrations are therefore consistent with two competing aggregate outcomes: (a) both are resolved without further income statement charge — Cyber goodwill remains recoverable as the FY28 framework materialises, and Escode disposal proceeds exceed net book value; or (b) one or both require further write-down, with the Cyber goodwill impairment risk concentrated in the UK and APAC CGU if the core Cyber revenue decline of 4.9% in FY2025 persists or accelerates. These cannot be ranked without the impairment model assumptions and the final Escode disposal completion accounts.
Caveat: The H1 FY2026 net cash figure of approximately £230m is unaudited and post-period; the Escode disposal gain or loss cannot be confirmed until completion accounts are finalised. The FY2025 impairment review sensitivity analysis is limited to the 10% revenue shortfall scenario as disclosed in Note 11; no additional stress scenarios are available in the evidence pack.
This document is a proof-of-concept demonstration of a financial analysis workflow. It is published to illustrate the methodology, structure, and potential usefulness of the output.
It is not a production analyst report, investment research, investment advice, a recommendation, an offer, or a solicitation to buy, sell, hold, or subscribe for any security or financial instrument.
The analysis is based solely on publicly available financial data and source materials reviewed for this demonstration. It does not rely on inside information, confidential company information, or non-public management materials. It may not include all public filings, accounting notes, management commentary, market data, or subsequent events.
Findings should be treated as analytical hypotheses and example management questions, not conclusions of fact. The report may contain errors, omissions, or interpretations that require further verification against primary source materials. It should not be relied upon as the sole basis for any investment, credit, or commercial decision.
No representation or warranty is made as to the completeness, accuracy, or timeliness of the information contained in this report. The author accepts no responsibility for any loss arising from reliance on this material.