Financial Forensics Proof of Concept
Demonstration output: five-year financial pattern review and example diligence questions · 2021–2025
Proof of concept — internal review only
This document is a proof-of-concept demonstration of a financial analysis workflow. It is provided for internal review and feedback on the methodology, structure, and usefulness of the output.
It is not a production analyst report, investment research, investment advice, a recommendation, an offer, or a solicitation to buy, sell, hold, or subscribe for any security or financial instrument.
The analysis is based solely on publicly available financial data and source materials reviewed for this demonstration. It does not rely on inside information, confidential company information, or non-public management materials.
Findings should be treated as diligence hypotheses and example management questions, not conclusions of fact. This document is not for public distribution, publication, forwarding, quotation, or onward circulation without prior permission.
The most significant patterns identified across five years of financial data and three years of CEO disclosures.
The dominant pattern in this five-year series is the near-complete erosion of value from the 2022 capital deployment, with acquired assets written down to residual levels within three years of the transaction.
The company simultaneously raised £90.0m of debt, consumed £44.0m of cash, and deployed £153.0m in investing outflows in 2022. Goodwill and intangibles then declined 83% and 97% from their respective peaks to £46m and £3.6m by 2025. Per the FY23 CEO letter, the first material impairment recognition included a £9.8m write-down of North American Assurance goodwill and a £3.0m write-down of Danish goodwill, with buying decision delays and cancellations in the North American tech sector cited as the proximate cause. Per the FY25 CEO letter, the Fox-IT Crypto business was sold in March 2025, and the Fox DetACT and Fox Crypto entities were fully separated during the year — confirming that the 30.1% revenue decline in 2025 is at least partially attributable to disposal rather than purely trading deterioration.
Revenue decelerated monotonically from +16.2% in 2022 through +6.3%, +2.1%, and then -30.1% in 2025, a pattern consistent with progressive underperformance of the acquired entity from an early stage. The central concern for any investment or credit analysis is whether impairment indicators were observable before the FY23 recognition event, and what residual value — if any — from the 2022 deployment remains on the balance sheet.
The reported 2025 net margin recovery to 7.1% is inconsistent with a normalised net margin of -4.2%, and the gap implies a dependence on below-the-line items that raises a material question over whether the operating recovery is genuine.
The reported-vs-normalised gap of 11.3% of revenue on a £239m base implies approximately £27m of non-recurring or below-the-line benefit in 2025. Per the FY23 CEO letter, ISIs in that year alone totalled £14.7m and included impairment charges, reorganisation costs, a strategic review charge, and a £4.7m disposal gain on the DDI business — all within a single exceptional line. Per the FY25 CEO letter, the Fox-IT Crypto disposal in March 2025 "strengthened the Balance Sheet," and management voluntarily excludes non-core disposals from its preferred EBITDA metric, confirming that disposal proceeds contributed to the reported figures. Exceptional items have been classified as material in every year of the series, making the recurring/non-recurring distinction analytically untenable without line-item decomposition. The £27m gap exceeds seven times the 2025 EBITDA of £3.7m.
Accepting the 2025 reported net income as evidence of a restored operating model carries material risk of working from a misleading baseline; the sustainable cost structure cannot be assessed without stripping five years of uninterrupted exceptional charges.
Interest coverage turned negative in 2024 (-7.4×) and remained negative in 2025 (-1.4×), and the company increased its annual dividend to a series-high of £19.0m in the same year — a capital allocation pattern that is not consistent with balance sheet repair.
Dividends totalled £76m across the five-year period: £13m, £14m, £15m, £15m, and £19m respectively. In the three years of sub-1.0× coverage, aggregate dividends paid were £49m. FCF declined to £17.2m in 2024, providing only £2.2m of headroom above the £15m dividend in that year. Per the FY25 CEO letter, the Board indicated that a sale of Escode would enable "a significant return of capital to shareholders over and above the recently announced initial share buy-back programme," implying the current distribution level is not purely discretionary and that asset monetisation is the anticipated mechanism for shareholder returns. Per the FY24 CEO letter, net debt reduction was achieved in part through divestiture of non-core Dutch cyber assets rather than organic cash generation, which is relevant to interpreting the apparent balance sheet improvement.
Any credit or equity analysis must assess whether the dividend is contractually constrained and whether the stated path to capital return is contingent on asset sales that may not complete.
Three earnings quality metrics deteriorated simultaneously in 2025, and the pattern is inconsistent with the reported net income recovery reflecting restored trading performance.
DSO deteriorated 17 days in a year of falling revenue, moving from 43.8 to 61.1 days. OCF recovered only modestly to £34.0m against reported net income of approximately £17.0m, producing an OCF-to-net income ratio of 2.0× that implies a meaningful non-cash component in reported earnings. The DSO inflection in a revenue-declining year — where contract run-off and collections pressure are the more plausible interpretations — is more adverse than the same movement in a growth year would be. Per the FY23 CEO letter, cash conversion reached 102.9% in a year of reported net loss and £1.9m operating profit, indicating that the OCF-to-earnings relationship has been volatile throughout the period and not directionally consistent with trading performance.
An analyst relying on OCF as a quality check on the 2025 reported income recovery faces a distorted signal: the non-cash earnings component and the DSO deterioration both suggest the headline figures overstate the quality of the underlying cash generation.
Five-year series · GBP millions unless noted
| Metric | 2021 | 2022 | 2023 | 2024 | 2025 | Direction |
|---|---|---|---|---|---|---|
| Revenue (GBPm) | 271 | 315 | 335 | 342 | 239 | ↓ deterioration |
| Gross margin (%) | 41 | 42.2 | 39.4 | 34.5 | 36.8 | ↓ deterioration |
| Operating margin (%) | 6.3 | 11.1 | 0.6 | -16.7 | -2.5 | ↓ deterioration |
| Net margin (reported) (%) | 3.7 | 7.3 | -1.4 | -9.7 | 7.1 | ↑ improvement |
| Net margin (normalised) (%) | 10.7 | 8.2 | 3.9 | -11.7 | -4.2 | ↓ deterioration |
| Reported-vs-normalised gap (%) | -7 | -0.9 | -5.2 | 2.1 | 11.3 | context-dependent |
| SG&A as % of revenue (%) | 22.5 | 24.4 | 27.5 | 32.8 | 34.3 | ↓ deterioration |
| CapEx as % of revenue (%) | 1.8 | 2.6 | 2.2 | 2.6 | 2.1 | context-dependent |
| Operating cash flow (GBPm) | 39 | 55 | 32 | 26 | 34 | ↓ deterioration |
| Free cash flow (GBPm) | 34.2 | 46.8 | 24.7 | 17.2 | 28.9 | ↓ deterioration |
| OCF/NI conversion (×) | 3.9 | 2.4 | — | — | 2 | context-dependent |
| Net cash / (debt) (GBPm) | 49 | -85 | -80 | -73 | -10 | ↓ deterioration |
| Return on equity (%) | 3.8 | 7.8 | -1.7 | -16.1 | 8.2 | ↑ improvement |
| Current ratio (×) | 1.9 | 1.1 | 0.9 | 1.2 | 2.4 | context-dependent |
| Goodwill as % of assets (%) | 42.4 | 46.2 | 51.1 | 37.4 | 13.4 | context-dependent |
| Intangibles as % of assets (%) | 4.9 | 20.7 | 22.2 | 21.2 | 1.1 | context-dependent |
| Interest coverage (×) | 7.4 | 10.6 | 0.4 | -7.4 | -1.4 | ↓ deterioration |
| Reported tax rate (%) | 19.3 | 29.3 | — | — | — | ↓ deterioration |
| Dividends paid (GBPm) | 13 | 14 | 15 | 15 | 19 | context-dependent |
| EBITDA (GBPm) | 27 | 44.3 | 11.9 | -43 | 3.7 | ↓ deterioration |
| DSO (days) | 87.5 | 78.8 | 57.7 | 43.8 | 61.1 | ↓ deterioration |
— Not interpretable for one or more years.
Areas where the financial data and CEO disclosures together leave material questions unanswered.
A 2022 acquisition-scale capital event — funded by simultaneous debt and equity — has resulted in near-total impairment of acquired assets within three years, with residual leverage and coverage deterioration persisting into 2025; and the progressive revenue deceleration from 2022 onward is consistent with the acquired entity underperforming before the disposal events confirmed in 2025.
Evidence: In 2022, goodwill rose £83m (to £266m), intangibles rose £98m (to £119m), other investing outflows reached -£153m, debt increased £90m (to £158m), and the net cash position swung from +£49m to -£85m — all in a single year. By 2025, goodwill had fallen 83% from peak to £46m and intangibles 97% to £3.6m, while interest coverage collapsed from 10.6× in 2022 to 0.4×, -7.4×, and -1.4× in 2023–2025 respectively, and interest expense grew 48%, 68%, and 32% across the same three years. Revenue growth decelerated monotonically from +16.2% in 2022 to +6.3%, +2.1%, and then -30.1% in 2025. Per the FY23 CEO letter, the first impairment recognition — £9.8m against North American Assurance and £3.0m against the Danish business — was made at the FY23 year-end assessment, with North American tech sector demand cited as the trigger. Per the FY25 CEO letter, the Fox-IT Crypto disposal completed in March 2025 and Fox DetACT and Fox Crypto were fully separated during the year, confirming disposal as a partial driver of the 2025 revenue fall.
Why it matters: The near-complete write-down of £181m in acquired goodwill and intangible value — against a 2021 revenue base of £271m — is consistent with value destruction at a magnitude comparable to the company's entire annual revenue. The FY23 impairment was recognised at year-end against a backdrop of revenue deceleration that had been visible for multiple periods, raising a testable question about whether the recognition timing was appropriate or whether indicators were present earlier. The residual goodwill of £46m and the separation of Fox DetACT from Fox Crypto suggest further impairment or disposal risk remains.
Reported earnings are uninterpretable on a tax-normalised basis in three of five years, and the 2025 reported net income recovery appears to be driven by below-the-line items rather than restored trading performance — with approximately £27m of non-recurring benefit implied by the reported-vs-normalised gap.
Evidence: Reported tax rate is not interpretable in 2023, 2024, or 2025 because net income before tax was zero or negative in all three years (D7 caveat); normalised net margin deteriorated continuously from 10.7% in 2021 to -4.2% in 2025, while reported net margin recovered to 7.1% in 2025 — producing the widest reported-vs-normalised gap in the series at 11.3% of revenue in 2025. Exceptional items were classified as material and recurring across all five years. Per the FY23 CEO letter, ISIs in FY23 included a £4.7m DDI disposal gain sitting within the same exceptional line as impairment charges and reorganisation costs. Per the FY25 CEO letter, the Fox-IT Crypto disposal "strengthened the Balance Sheet" and management's preferred EBITDA metric explicitly excludes non-core disposals. OCF recovered only modestly to £34m in 2025 against reported net income of approximately £17m, with OCF/NI of 2.0× suggesting the income recovery is partially non-cash.
Why it matters: An 11.3% reported-vs-normalised margin gap on a £239m revenue base implies approximately £27m of below-the-line benefit in 2025. This figure exceeds seven times the 2025 EBITDA of £3.7m, meaning the apparent return to profitability is almost entirely dependent on non-trading items. The Fox-IT Crypto disposal gain is a confirmed one-time credit that will not recur; whether additional disposal gains, debt restructuring credits, or deferred tax releases are embedded in the same line is unresolved.
Persistent dividend payments through net debt, operating losses, and sub-floor interest coverage represent a capital allocation posture that is not consistent with the company's financial position across 2022–2025, and the 2025 dividend increase compounds the concern.
Evidence: Dividends were paid in every year: £13m (2021), £14m (2022), £15m (2023), £15m (2024), £19m (2025) — totalling £76m over the period. In 2022–2024 the company held net debt of -£85m, -£80m, and -£73m respectively while interest coverage was 0.4×, -7.4×, and -1.4× in 2023–2025. FCF declined to £17.2m in 2024, providing only £2.2m of cover above the £15m dividend. Per the FY24 CEO letter, net debt reduction was achieved in part through divestiture of non-core Dutch assets rather than organic cash generation. Per the FY25 CEO letter, the Board indicated that a completed Escode sale would enable a significant additional capital return, framing future distributions as contingent on asset monetisation rather than trading cash flow.
Why it matters: The decision to increase dividends in 2025 to a series-high of £19m in a year where operating earnings did not cover interest charges is not consistent with organic balance sheet repair. The FY25 CEO letter's framing of future capital returns as conditional on the Escode sale implies the board does not consider operating cash flow sufficient to sustain a materially higher distribution — raising the question of what disciplines, if any, constrained the FY25 increase to £19m.
Structural cost inflation — evidenced by SG&A expanding from 22.5% to 34.3% of revenue and gross margin compressing 4.2 percentage points — has not been reversed despite the 2025 revenue contraction, leaving the operating cost base disproportionate to the current revenue level.
Evidence: SG&A as a percentage of revenue deteriorated continuously from 22.5% in 2021 to 34.3% in 2025 (T002 context); gross margin deteriorated from 41.0% to 36.8% endpoint to endpoint with a trough of 34.5% in 2024. Operating margin deteriorated to -16.7% in 2024 and remained negative at -2.5% in 2025. EBITDA collapsed from £44.3m in 2022 to -£43.0m in 2024 and recovered only to £3.7m in 2025. Per the FY23 CEO letter, total administrative expenses increased 32.9% (£32.2m) in FY23 alone, driven by inflationary people costs, XDR investment, travel, marketing, and depreciation — each individually modest but collectively structural. Per the FY25 CEO letter, management actions in FY25 included sales reorganisation by vertical, new customer acquisition team buildout, expanded Middle East presence, and global account management infrastructure — all of which represent overhead additions in a year of revenue decline. The working capital outflow was £23m in 2024, and DSO deteriorated 17 days in 2025 from 43.8 to 61.1 days.
Why it matters: On a 2025 revenue base of £239m, an SG&A ratio of 34.3% implies approximately £82m of overhead — 11.8 percentage points above what the 2021 ratio would have implied on the same revenue. The FY25 cost additions, while individually described as capability investments, are not consistent with a business operating at revenue trough and raise a question about whether the cost structure can reach breakeven at current scale without a revenue recovery that is not yet visible in the order book.
CapEx has been below depreciation in every year of the series while goodwill and intangibles have been nearly fully written down, raising a question about whether the organic asset base is being maintained at a level sufficient to sustain service delivery and competitive positioning.
Evidence: CapEx ranged from £4.8m–£8.8m annually against D&A of £9.3m–£14.0m across all five years (T027–T031), with CapEx ending at 2.1% of revenue in 2025 against a D&A charge of 4.1% of revenue. Goodwill fell from a peak of £266m to £46m and intangibles from £119m to £3.6m by 2025. Per the FY23 CEO letter, FY23 D&A included £10.0m of amortisation of acquired intangibles within the £26.9m total adjusting items charge, indicating that a material portion of the reported D&A has reflected acquired-asset run-off rather than organic replacement cost. Whether the residual D&A charge after full intangibles write-down now more accurately reflects organic reinvestment needs — or whether CapEx remains structurally insufficient — is not determinable from the series alone.
Why it matters: For a cybersecurity services business, sustained CapEx at 2.1% of revenue in a period of near-full intangibles write-down raises a testable concern about tooling currency, platform infrastructure, and the ability to bid competitively for higher-value managed services contracts — the segment management has identified as the primary growth vector. The concern does not yet show in the income statement but is a forward-looking vulnerability if the organic reinvestment rate is genuinely below replacement.
Suggested questions an investor could put to management to resolve each of the tensions above. Each question corresponds to the tension of the same number.
When were impairment indicators first identified relative to the multi-year revenue deceleration, and does the residual £46m goodwill balance reflect an independently supportable valuation or a carrying amount that has not yet been tested against current trading?
What specific line items account for the approximately £27m gap between reported and normalised net margin in 2025, and which of those items will not recur in FY26?
Are there debt covenants or shareholder agreements that constrain dividend policy, and what is the board's rationale for increasing the dividend to £19m in a year of negative interest coverage?
What is management's target SG&A ratio and the revenue level at which the business reaches normalised operating breakeven, and have the FY24 and FY25 cost additions been modelled against a scenario in which Escode is sold?
What proportion of the FY25 D&A charge relates to acquired intangible amortisation versus organic assets, and what is the forward CapEx plan relative to the organic replacement rate?
Accepted changes incorporated; material disputed items retained in audit log.
This report is a proof-of-concept demonstration output prepared for internal review and feedback. It is provided for informational and analytical purposes only.
It is not investment advice, investment research, a recommendation, an offer, or a solicitation to buy, sell, hold, or subscribe for any security or financial instrument.
The analysis is based solely on publicly available financial data and source materials reviewed for this demonstration. It does not rely on inside information, confidential company information, or non-public management materials. It may not include all public filings, accounting notes, management commentary, market data, or subsequent events.
Findings, tensions, and questions should be treated as diligence hypotheses and examples of analytical output, not final conclusions of fact.
This document is confidential to the intended review group and is not approved for public distribution, publication, forwarding, quotation, uploading, or onward circulation without prior permission.
No representation or warranty is made as to the completeness, accuracy, or timeliness of the information contained in this report. The author accepts no responsibility for any loss arising from reliance on this report.