Bridge Report:（4493）Cyber Security Cloud the Fiscal Year ended December 2020

President & CTO Yoji Watanabe	Cyber Security Cloud, Inc. (4493)

Company Information

Stock Information

*The share price is the closing price on March 2. Each figure is from the financial results for the Fiscal Year ended December 2020.

Change of Business Results

* The estimates were provided by the company. Units: million yen and yen. Consolidated financial results from the Fiscal Year ended December 2020.
* The company carried out a 10-for-1 stock split in March 2018, a 100-for-1 stock split in September 2019, and a 4-for-1 stock split in July 2020. (EPS was revised retroactively.)

This Bridge Report presents Cyber Security Cloud, Inc.'s earnings results for the Fiscal Year ended December 2020, Fiscal Year ending December 2021 earnings forecasts.

Table of Contents

Key Points
1. Company Overview
2. Fiscal Year December 2020 Earning Results
3. Fiscal Year December 2021 Earnings Forecasts
4. Future Growth Strategies
5. Conclusions
<Reference: Regarding Corporate Governance>

Key Points

• Cyber Security Cloud offers security services, including “Shadankun,” a cloud web application firewall (WAF) for protecting websites and servers from cyber attacks, and “WafCharm,” a service of automatic management of rules of “AWS WAF” with AI. “Shadankun” swiftly detects general attacks, discovers unknown attacks and wrong detection, and responds to the latest threats by utilizing an AI engine for detecting attacks based on deep learning. The number of companies or websites that have adopted the service is the largest in Japan, and is used regardless of corporate scale.

   

• In the term ended December 2020, the company recouped investments for mid/long-term growth and achieved significant increases in sales and profit, exceeding the forecasts. Sales were 1,194 million yen, up 46.2% year on year, and operating profit was 203 million yen, up 41.2% year on year. The sales of both Shadankun, the company's mainstay product, and WafCharm, its second pillar, have grown significantly. Cost ratio increased 3.1 points to 31.7% due to the response to the increase in sales and the increase in server costs and the number of engineers which augmented the labor expenses. However, gross profit grew 39.9% due to the increase in sales, which offset the augmentation of SG&A expenses including personnel expenses, recruitment and training expenses due to the increase of employees, mainly sales personnel, as well as R&D and advertising expenses.

   

• For the Fiscal Year ending December 2021, sales and operating profit are estimated to rise 50.0% and 32.8% year on year, respectively. The company is expected to achieve significant increases in sales and profit in this term as well. One of the factors contributing to this growth is the acquisition of SofTek Systems Inc. as a subsidiary. The entire group will work on various measures to achieve growth after 2022. Specifically, the company will focus on introducing WafCharm to the three major clouds (AWS, Azure, and GCP). Upfront investment costs are expected to increase due to aggressive promotions and awareness activities to raise awareness of WAF, and the operating margin is forecasted to decline 1.7% year on year.

   

• According to the company's "Awareness Survey on Cybersecurity Measures after the Enactment of the Amendment to the Act on the Protection of Personal Information," released on February 16, 2021, there is an awareness of the need for cybersecurity. However, one in ten major companies has suffered from cyberattacks within the past year. More than 80% of the executives of web service provider companies do not understand conditions regarding the introduction of WAF. The survey also showed that many executives do not correctly understand what kind of security measures are necessary to protect the personal information held by their companies.

   

• The company has grown at a compound annual growth rate of over 80% during the past five years. Looking at the company's conditions, we can see that the company has a huge expanding market in front of it. By examining the PER and PBR, it is evident that investors have very high expectations for the company. We want to pay attention to whether it is possible to sustainably expand profits and improve corporate value to meet these expectations under the new management system.

   

1. Company Overview

With a management ethos to create a secure cyberspace that people around the world can use safely, Cyber Security Cloud provides web security services, including “Shadankun,” a cloud-based web application firewall (WAF) that visualizes and blocks cyber attacks on websites, “WafCharm,” a service for the automatic management of rules (signatures) of platforms like AWS WAF etc., and “AWS WAF Managed Rules,” a set of rules for AWS WAF. These services utilize world-leading cyber threat intelligence and AI (Artificial Intelligence) technology, and are offered on a subscription basis.

In September 2018, the company formed a group with the subsidiary Cyber Security Cloud, Inc. in Seattle, Washington, the U.S., which was established with the aim of selling Managed Rules, which are a set of rules for AWS WAF, and is expanding its business overseas. However, the subsidiary is excluded from the scope of consolidation as it does not currently have a material impact on the corporate group’s financial position, earnings results, or cash flow.

1-1 Security measures and CSC’s business operations

Increased use of the Internet has facilitated the spread of a wide range of online services, which make daily life and running businesses much more convenient. Against this backdrop, cyber-attacks are increasing. There are two main security measures companies put in place. One is corporate security, which is designed to protect PCs and in-company networks from malware (malicious software/programs). The other is web security, which protects public servers from attacks on software vulnerabilities and the web application layer. For an e-commerce site like Amazon, where many users register their credit card information, it is web security that protects such sensitive data.

When it comes to web security, there are several layers of protection, including that for web applications (applications and services that can be used via a web browser), software/operating systems (OS), and infrastructure/networks. The level of security required differs depending on the layer. It is the job of the web application firewall (WAF) to protect the web application layer, which constitutes websites, from cyber-attacks. WAFs are predominantly appliance based, software based, or cloud based. Cyber Security Cloud offers “Shadankun,” cloud-based WAF services for corporations and other entities that provide web services.

*WAF is a firewall that prevents intrusions such as SQL Injection and XSS, which can cause information leakage and the falsification of websites. It can also handle attacks that conventional firewalls or IDS/IPS were unable to prevent (from the reference material of the company).

Cloud-based WAF “Shadankun” was launched in 2013, and boasts the No.1 position in the Japanese cloud-based WAF market in terms of the total number of companies/websites using the service. Shadankun’s success owes to the ease of installation, the reliability of it being developed and operated in-house by Cyber Security Cloud itself, and the firm’s extensive track record of providing services to major corporations. However, with many of the data leak incidents that have occurred in recent years being caused by unauthorized access to website, website security measures remain insufficient. There also appears to be a significant number of website operators that are under the false impression that security measures are already in place, according to an awareness survey on security software by Marketing & Associates.

1-2 Services

In its web security business, Cyber Security Cloud provides Shadankun, a cloud-based WAF, WafCharm, a service for the automatic management of rules for AWS WAF provided by Amazon Web Services (AWS) that is based on technologies built up from the operation of Shadankun, and Managed Rules, a set of security rules for AWS WAF.

◎Cloud-based WAF “Shadankun”
Shadankun is a cloud-based security service that detects, blocks, and visualizes cyber-attacks on web applications. From development to operation, sales, and support, Cyber Security Cloud handles all aspects of the service. This enables the company to accumulate a wealth of data on cyber-attacks on websites, as well as build up operational know-how (over one trillion rows of data from over 10,000 websites). By reflecting the accumulated data when developing/customizing Shadankun or when updating its signatures (patterns associated with malicious attacks), the service helps keep websites secure. Shadankun also visualizes cyber-attacks in real time, identifying the type of attack and the IP address (i.e., countries and attack types) the attack is coming from. Such data can be viewed on the management screen. The visualization of these invisible cyber-attacks enables companies to gain a better grasp of their security situation and share information more effectively.

Two types of Shadankun services offered
Cyber Security Cloud offers two versions of Shadankun, one being the server security (agent linked) type, which installs a security agent onto the client’s server. The agent detects and blocks attacks by receiving log entries/block commands from the cloud-based monitoring center. The other is the Web/DDoS security (DNS switching) type, which involves switching “DNS (domain name system) only” and directing traffic to Shadankun’s WAF center, which detects and blocks attacks. Having two services like this means that Shadankun can be deployed regardless of a customer’s web application environment.

For the Web/DDoS security type, the website is accessed through the WAF center, which analyzes and determines whether this access is a cyber-attack or not. Only by switching DNS, it can be installed easily and places no burden on a website’s resources. However, as traffic is redirected (i.e., goes through the monitoring center), delays may occur for e-commerce, media, video-streaming, and other high-traffic sites. In contrast, the cyber security type is able to respond to attacks with little transmission delay and is unaffected by the volume of network traffic, as the monitoring center, which is a separate system, analyzes potential attacks and sends blocking commands directly to the security agent installed on the server.

(Source: Reference material of the company)

Utilization of AI
AI is also increasingly utilized for Shadankun. In particular, using AI enables Shadankun to detect attacks that conventional signatures could not detect, and also identify false positives that negatively impact customers’ services. Through Cyber Security Cloud’s neural network (technology/network used for machine learning), the AI engine learns not only normal attacks, but also legitimate user access and requests that have falsely been labeled as malicious. It evaluates daily access data and detection data, improving signature accuracy day by day.

◎“WafCharm”, a service for the automatic management of rules of platforms like AWS WAF etc.
WafCharm, launched in December 2017, is equipped with an AI engine that learns attack patterns on web applications accumulated by Shadankun. It enables the automatic management of rules for AWS WAF, provided by Amazon Web Services (AWS), which holds the largest share of the global cloud market. WafCharm has gained high marks for its ease of installation and operation, as well as for the swift development of new features supporting new AWS WAF functionalities, backed by its partnership with AWS.

While AWS WAF increases the security of web applications, the site operator must create and enforce rules to filter web traffic themselves. Making full use of it requires considerable time and knowledge. However, WafCharm is equipped with an AI engine that automatically applies the most appropriate rule among many AWS WAF rules for the target web application, automating all necessary security options. It is automatically updated to deal with new vulnerabilities, keeping the website secure at all times. It is also equipped with a reporting function, which compiles the number of detected attacks, the type of attack, the source country, and the attacker’s IP address for each rule, as well as a notification function, which sends an e-mail containing details of detected attacks in real time.
It has also been available on Microsoft's platform, "Azure" since November 2020. A version compatible with Google's platform, "Google Cloud Platform," is scheduled to be launched as well.

◎AWS WAF Managed Rules
AWS WAF selects and provides security rules called “Managed Rules” that have been written by expert security vendors. AWS WAF Managed Rules are a comprehensive package of security rules needed to mitigate specific threats. Security is limited to specific threats, but installation and operation are simple. Managed Rules is a package service that draws on AWS WAF rule-setting expertise built up through the operation of WafCharm. AWS WAF users can easily use Managed Rules from the AWS Marketplace.
Cyber Security Cloud’s U.S. subsidiary, which has been certified as the seventh AWS WAF Managed Rules seller in the world, began selling the group’s own rule set on AWS Marketplace at the end of February 2019.

1-3 Business model

Shadankun, Cyber Security Cloud’s core service, is offered on a subscription basis (monthly billing) over a period of time, in which customers are charged fees for access under the premise of continuous service. Revenue streams consist of monthly recurring revenue (MRR), initial installation fees, and non-recurring revenue (one-off payments). Over 95% of revenue generated from Shadankun is recurring revenue. It also boasts a high service continuation rate, backed by the successful improvement of customer value through the accumulation of data on web application vulnerabilities, its swift response to these vulnerabilities, signature setting, and rule customization.
The churn rate for the term ended December 2020 remained low, ranging between 1.07% -1.24%.
The company uses its strengths to provide comprehensive services from development to operation and support and increase customer satisfaction.

(Source: Reference material of the company)

2. Fiscal Year December 2020 Earnings Results

2-1 Non-Consolidated Earnings

*Unit: million yen. SG&A are Gross Profit minus Operating Profit, based on the company data.

The company recouped investments for mid/long-term growth and achieved significant increases in sales and profit, exceeding the forecasts.
Sales were 1,194 million yen, up 46.2% year on year, and operating profit was 203 million yen, up 41.2% year on year. The sales of both Shadankun, the company's mainstay product, and WafCharm, its second pillar, have grown significantly. Cost ratio increased 3.1 points to 31.7% due to the response to the increase in sales and the increase in server costs and the number of engineers which augmented the labor expenses. However, gross profit grew 39.9% due to the increase in sales, which offset the augmentation of SG&A expenses including personnel expenses, recruitment and training expenses due to the increase of employees, mainly sales personnel, as well as R&D and advertising expenses.
Both sales and profit exceeded the forecast.

Personnel costs rose due to the recruitment of new employees, and enhancing R&D activities also led to an increase in costs.
In the fourth quarter (October-December) of the term ended December 2020, the company advertised intensively, such as video advertisements featuring the Japanese actor Kotaro Koizumi, to reach potential segments. The number of prospective customers became about 2.3 times that of the same period of the previous year, hitting a record high.
Additionally, hiring is accelerating due to factors such as improved reliability associated with the company's listing on the stock exchange. In the term ended December 2020, 18 new employees were hired at the company alone. Adding to this the 11 new employees at SofTek System Inc., which became a subsidiary, the total number of personnel of the group was 59, which is about twice the number of personnel at the end of the previous fiscal year, which was 30.

(Source: Reference material of the company)

2-2 Performances by Services

◎KPI

* ARR (Annual Recurring Revenue) is calculated by multiplying MRR as of the end of the month concerned by 12. MRR stands for monthly recurring revenue in the subscription model. It is the sum of monthly revenues earned continuously from existing customers.
*ARPU (Average Revenue Per User): Average annual sales per company.
*Churn rate of Shadankun is obtained from the latest 12-month average of MRR churn rates. MRR churn rate is actual churn rate obtained by dividing the MRR lost in the month concerned by the MRR as of the end of the previous month.
* WafCharm's net churn rate is calculated by dividing the ARR that increased or decreased by the end of the fiscal year N from paying users existing at the end of fiscal year N-1 by the ARR at the end of fiscal year N-1. A negative churn rate would mean that the increase in revenue generated through upselling and pay-per-use billing sales from existing users exceeds the revenue lost from churn and down-selling.

The sales of Shadankun, the company's mainstay product, and WafCharm, its second pillar, have grown significantly. The release of the Azure version of WafCharm has been completed, and the company plans to expand it further.
Company-wide ARR increased 43.9% year on year to 1.35 billion yen. Sales of WafCharm grew steadily, and its ARR exceeded 300 million yen.

(Source: Reference material of the company)

◎ Shadankun
The number of users grew steadily and reached 926 at the end of the term ended December 2020. ARPU, too, was going strong and expanded to 1 million yen, up 5.6% year on year, due to upselling (increasing the number of sites and servers, improving bandwidth, etc.).
The average monthly churn rate of Shadankun was 1.24% in the fourth quarter, up 0.09% from the third quarter, but remained at a low level at around 1%.
The main reasons for cancellation were site closure (including service termination and temporary use) and contract termination between partner companies and end-users (termination of server usage and MSP services). There were few complaints about the service, and many users continue to use it.

◎WafCharm
The number of users increased 149.7% year on year to 392 at the end of the term ended December 2020, and ARR increased as high as 152.6% year on year to 306 million yen.
The churn rate based on the number of users was around 1%. However, the unit price rose through upselling and increased usage due to adopting a pay-per-use billing leading to the decrease of the net churn rate, and reached a negative percentage.

2-3 Topics

(1) Acquiring SofTek Systems Inc. as a subsidiary
In December 2020, the company acquired all shares of SofTek Systems Inc. and made it a subsidiary.

(Overview of SofTek Systems Inc.)
SofTek was established in 1991. SofTek operates the vulnerability information service "SIDfm TM" business and a web security diagnosis business.
"SIDfm TM" has been used as an information base for the vulnerability management infrastructure of many clients for more than 20 years since the service was launched. SofTek's vulnerability analysts investigate vulnerabilities that appear daily, create content, and send the information to the clients by various means. By using the contents of "SIDfm ™," the clients can make more accurate decisions when conducting vulnerability impact assessments where they usually have trouble making decisions. The vulnerability information is also used to match the clients with suitable tools to manage each IT asset's vulnerabilities. Thus, SofTek provides comprehensive solutions from creating content related to vulnerabilities to providing vulnerability management tools.
In the term ended December 2019, SofTek's sales were 289 million yen, and operating profit was 86 million yen. Total assets were 428 million yen, and net assets were 347 million yen.

(Background of making it a subsidiary)
The company’s web security business has been visualizing and blocking cyber-attacks on websites and web servers by utilizing vulnerability information.
The addition of SofTek, which is strong in vulnerability management using SIDfm™, to the company's web security business will enable them to utilize big data and expand its sales channels, in addition to strengthening the technical capabilities of both companies by sharing their respective know-how.
The decision to make SofTek a subsidiary was made based on the judgment that the acquisition will contribute to the enhancement of corporate value over the medium to long term by leveraging the synergy between the two companies to further improve the service system and build a stronger corporate foundation.
The acquisition price is estimated at 430 million yen, including advisory fees.

(Source: Reference material of the company)

(2) Changing the representative director
On December 31, 2020, Hikaru Ohno, President and Representative Director, retired, and on January 1, 2021, Yoji Watanabe, a board member, CTO and General Manager of the web security business headquarters, became the president, representative director and CTO of the company.
Watanabe has been leading the technological field in Cyber Security Cloud, including working on the development and operation of Shadankun, WafCharm and AWS WAF Managed Rules and the development of AI technology.
Furthermore, on February 12, 2021, it was announced that Watanabe would be appointed as the representative director and CTO, and Toshihiro Koike, Head of the President's Office, will be appointed as president, representative director and CEO of the company.

Toshihiro Koike has experience in a wide range of operations such as business planning and product development in the Recruit Group and has managed multiple companies that provide SaaS and IT services. Aside from business strategy, he has abundant knowledge and experience indispensable for corporate growth, in areas such as technology and marketing. That is why the company decided he was suitable to become its president because he can strongly lead the new management system while steadily addressing the various management issues of Cyber Security Cloud.
By shifting to a new strong management system and implementing various measures under the leadership of two representative directors, the company aims to achieve the sustainable growth of the group and improve corporate value.
The appointment of the representative directors, as well as other officers, will be officially decided at the 11th Annual Meeting of the Shareholders scheduled to be held on March 31, 2021, and the board of directors and audit & supervisory board meetings held on the same day.

(3) An increase in the number of users and partners
The number of users is increasing across different company sizes, industries and business types.
Moreover, in 2020, the company further enhanced its sales capabilities as 9 distributors for Shadankun and 13 distributors for WafCharm joined.

(Source: Reference material of the company)

3. Fiscal Year December 2021 Earnings Forecasts

3-1 Consolidated Earnings

*Unit: million yen.

Sales and operating profit are estimated to rise 50.0% and 32.8% year on year, respectively
One of the factors contributing to this growth is the acquisition of SofTek as a subsidiary. The entire group will work on various measures to achieve growth after 2022. Specifically, the company will focus on introducing WafCharm to the three major clouds (AWS, Azure, and GCP). It has been on AWS (Amazon Web Service) since December 2017, serving 392 users with a No. 1 track record in Japan. It has been available on Microsoft's Azure since November 2020, and will continue to expand its partners and increase its recognition among Azure users. The company also plans to launch on GCP (Google Cloud Platform) in 2021. Upfront investment costs are expected to increase due to aggressive promotions and awareness activities to raise awareness of WAF, and the operating margin is forecasted to decline 1.7% year on year.

4. Future Growth Strategies

[Market environment and the company vision]

It is expected that the cybersecurity field will grow rapidly as the expansion and deployment of cloud computing, DX, 5G, and IoT accelerate due to the novel coronavirus crisis. Therefore, the business environment is forecasted to be highly advantageous for the company.
In light of these circumstances, the company aims to achieve a dominant position and become the No. 1 company in the ever-growing domestic WAF market and offer trustworthy services worldwide as a global security service provider.

[The three strategies]

The company will promote the following three strategies to achieve growth.

Market strategy
Cyber Security Cloud will enhance its awareness activities to increase the deployment rate of WAF, which remains at a low level of 6.7% due to the large gap between its needs and the deployment conditions. The company aims to raise product awareness and acquire a large number of prospective customers by expanding its market reach all over Japan through various promotions.
The company will acquire new customers through its awareness campaigns on the correct security measures. Furthermore, following the trend of adopting cloud computing, it will promote WafCharm in the global market.

Product strategy
The company seeks to increase sales by increasing product value and using cross-selling strategies through linking all products organically. The company intends to accomplish that by sharing know-how and mutual client referrals with SofTek Systems Inc., which became a subsidiary in the previous fiscal year.
Furthermore, the company will enhance the development of existing Shadankun and WafCharm products to sell them on various platforms. Cyber Security Cloud aspires to develop WAF further to be used anytime and anywhere around the world more easily.

Technology strategy
Based on a total of 1.9 trillion users' website access data and malicious attack data, the company will develop core technologies by utilizing AI and its know-how. The company aims to apply the developed core technology to various fields such as WAF operation, finance and marketing, IoT and 5G, and medical care.

5. Conclusions

The company conducts awareness activities on the need for cybersecurity, and as part of this, it continuously publishes various reports.
Most recently, on February 16, 2021, "Awareness Survey on Cybersecurity Measures after the Enactment of the Amendment to the Act on the Protection of Personal Information" was released. This survey investigated the awareness and conditions of cybersecurity measures of 600 executives of companies of different sizes, and the results were as follows.

(1) Approximately 60% of executives are aware of the Amendment to the Act on the Protection of Personal Information.
(2) More than 80% of executives aware of the Amendment to the Act on the Protection of Personal Information feels it necessary to strengthen cybersecurity measures.
(3) Approximately 50% of executives of major companies responded that they "have strengthened cybersecurity measures or plan to implement them within a year" in response to the Amendment to the Act on the Protection of Personal Information.
(4) Approximately 70% of the executives who implement cybersecurity measures answered that they were implementing both in-house security measures and web security measures. However, more than 90% of these executives do not understand the web security measures.
(5) More than 80% of web service provider companies' executives do not understand conditions regarding the introduction of WAF.
(6) One in ten major companies has suffered a cyberattack during the past year, and more than 30% of the damage was "information leakage."

Despite recognizing the need for cybersecurity, one in ten large companies has suffered cyberattacks within the past year. Moreover, more than 80% of web service provider companies do not understand conditions regarding the introduction of WAF. Also, many executives do not correctly understand what kind of security measures are necessary to protect the personal information their companies possess.

The company has grown at a compound annual growth rate of over 80% during the past five years. Looking at the company's conditions, we can see that the company has a huge expanding market in front of it. By examining the PER and PBR, it is evident that investors have very high expectations for the company. We want to pay attention to whether it is possible to sustainably expand profits and improve corporate value to meet these expectations under the new management system.

<Reference: Regarding Corporate Governance>

◎ Organization type and the composition of directors and auditors

◎ Corporate Governance Report (Update date: March 27, 2020)
Basic policy
Under the management ethos: “to create a secure cyberspace that people around the world can use safely,” our corporate group aims to achieve the sustainable growth of the group and improve mid/long-term corporate value, and establish a governance system for actualizing them effectively and efficiently. In addition, we strive to enhance corporate governance while considering that it is important to put importance on shareholders’ rights, live up to the expectations of society, and achieve sustainable growth and development as the basic policy for corporate governance emphasizing compliance.

<Reasons for Non-compliance with the Principles of the Corporate Governance Code (Excerpts)>
Our company implements all the basic principles stipulated in the Corporate Governance Code.

You can see back numbers of Bridge Reports on Cyber Security Cloud, Inc. (4493）and IR related seminars of Bridge Salon, etc. at www.bridge-salon.jp/.