Corero Network Regulatory News (CNS)

 This announcement contains inside information for the purposes of Article 7 of the Market Abuse Regulation (EU) 596/2014 as it forms part of UK domestic law by virtue of the European Union (Withdrawal) Act 2018 ("MAR"), and is disclosed in accordance with the Company's obligations under Article 17 of MAR. Upon the publication of this announcement via regulatory news service this inside information is now considered to be in the public domain.

16 July 2025

Corero Network Security plc

("Corero" or the "Group")

Half Year Trading Update

- Strong ARR growth of 25%, reflecting continued momentum towards SaaS model

- Shift in revenue mix with higher DDPaaS sales supports long-term revenue predictability and customer retention rates

Corero (AIM: CNS) (OTCQX: DDOSF), the distributed denial of service ("DDoS") protection specialists, provides the following trading update for the six months ended 30 June 2025 ("H1 2025").

The Group delivered strong Annualised Recurring Revenues1 ("ARR") growth across H1 2025 driven by an increase in DDoS Protection as-a-Service ("DDPaaS") solution sales, however H1 2025 revenue will be below the prior period as a result of the weaker macroeconomic environment and lower upfront capex license sales.

Corero's order intake2 in H1 2025 was $12.5 million (H1 2024: $14.2 million), driven by below expectations Alliance Partner performance as well as the weaker macro-economic environment and US tariff uncertainty, which has led to delays in customer decision making.

However, order intake rebounded in Q2 2025, growing 13% year-on-year to $7.8 million. Included in the Q2 2025 order intake were the first two CORE (Corero Observability and Resiliency Ecosystem) deals signed, totaling $1.8 million over the life of the contracts.

Corero has also seen a shift in customer decisions away from upfront capex license sales to DDPaaS solutions sales, which are recognised over the life of the contract. The shift in revenue mix toward DDPaaS sales contributed to 25% ARR growth, which increased to $21.6 million (H1 2024: $17.2 million), a key performance indicator for the Group.

As a result, revenue is expected to be $10.9 million in H1 2025 (H1 2024: $12.2 million), with an EBITDA3 loss of $1.4 million (H1 2024: profit of $0.7 million), reflecting the revenue timing dynamic and ongoing investment in long-term growth initiatives.

Corero believes that this shift away from upfront capex license sales to DDPaaS solutions sales will continue for the remainder of FY25. Therefore, management now expects revenue for the year ending 31 December 2025 ("FY 2025") to be between $24.0 and $25.5 million (FY 2024: $24.6 million) and EBITDA between $1.5 million loss and $0 million (FY 2024: $2.5 million profit), which is below market expectations4.

The change in revenue recognition also reflects a shift to a higher recurring revenue sales model driven in large part by DDPaaS-based sales.

Whilst this trend has had an impact on the quantum of revenue and EBITDA recognised in the current financial year, more contracted revenue will now flow through the length of the contract, typically three years. In addition, this transition improves long-term revenue visibility and supports higher retention rates across the Group's global customer base.

Corero's cash balance as at 30 June 2025 was $3.1 million (H1 2024: $7.9 million) and the Group has no outstanding debt. Like revenue, the change in mix toward DDPaaS has increased the amount of cash receipts deferred into future periods. The Group is in advanced discussions with its banking partner to put in place an overdraft facility to manage the increased working capital requirements of the business as a result of the shift in revenue mix.

The Group expects to report its unaudited interim results for the six months ended 30 June 2025 in mid-September 2025.

Carl Herberger, Chief Executive Officer at Corero, commented:

"I am pleased to report strong ARR growth in the first half of the year, underpinned by increasing demand for our DDPaaS offering whilst at the same time experiencing lower levels of upfront license sales than we had forecast. Whilst this sales trend reduces the level of revenue that can be recognised in the current financial year, I believe this shift supports our goal of building a more predictable and scalable revenue base.

Our growing pipeline, including Alliance Partner opportunities, underpins our confidence in the second half of 2025. With recent execution, including our first CORE deployments at the end of H1 2025, we remain confident in our ability to drive sustained ARR growth."

1  ARR is defined as the normalised annualised recurring revenues and includes recurring revenues from contract values of annual support, software subscriptions including terms greater than one year, and from DDoS Protection-as-a-Service ("DDPaaS") contracts.

2  Order intake is defined as orders received from customers in the period.

3  EBITDA is defined as earnings before interest, tax, depreciation, and amortisation.

4  For the purpose of this announcement, the Group believes market consensus for FY2025 to be revenue of $28.75 million, and EBITDA of $3.95 million.

Enquiries:

Jonathan Paterson

About Corero Network Security

Corero Network Security is a leading provider of DDoS protection solutions, delivering real-time, automated detection and mitigation with deep network visibility and analytics. Corero safeguards critical infrastructure across diverse deployment models-from inline to edge to hybrid cloud-and is currently developing CORE, an observability and resiliency ecosystem to unify defensive actions across the modern threat landscape. With operational centres in Marlborough, Massachusetts, USA, and Edinburgh, UK, Corero is headquartered in London and listed on the London Stock Exchange's AIM market (ticker: CNS) and the US OTCQX Market (OTCQX: DDOSF).

For more information, visit www.corero.com, and follow us on LinkedIn and X.