Bridge Report:（4494）Vario Secure Fiscal Year Ended February 2022

Yoshihiko Inami, CEO	Vario Secure Inc. (4494)

Company Information 

Stock Information 

*The share price is the closing price on April 25. Each number are taken from the brief financial report for the FY Ended February 2022.

Earnings Trends 

* Unit: million-yen, yen. Estimates calculated by the company. IFRS applied. 

This Bridge Report presents Vario Secure Inc.’s earnings results for the Fiscal Year Ended February 2022 and Growth Strategy etc. 

Table of Contents

Key Points
1. Company Overview
2. Fiscal Year Ended February 2022 Earnings Results
3. Fiscal Year Ending February 2023 Earnings Forecasts
4. Growth Strategy
5. Conclusions
<Reference: Regarding Corporate Governance>

Key Points 

• The company offers comprehensive network security services through which their customers can safely use the Internet, under the mission: “To ensure that all enterprises using the Internet can easily and securely carry out their business, we will offer the very best services to Japan and to the world.” 

   

• Their specialties and strengths include (1) an original business model, which offers a one-step solution with the procurement of devices used for security services, the development of key software installed into those devices, installation and setting up of those devices, and monitoring and operation of the devices after installation, (2) a stable earnings model, which is based on a recurring revenue business, whose revenues increase year by year through an increase in the number of companies installing their products with a monthly charging system, and on a low cancellation rate, (3) a strong marketing channel covering the entire country with partnered companies in OEM and partnered companies in resale, and (4) a high share among small and medium sized enterprises, which appraises the ease of installation of their products. 

   

• The revenue for the term ended February 2022 increased 0.8% year on year to 2,566 million yen. While Managed Security Service performed as planned, Integration Service did not progress as planned, as some projects took time to be set up on-site due to the impact of prolonged emergency restrictions, despite the increase in sales. Operating profit declined 1.6% year on year to 751 million yen. Gross profit increased due to sales growth, but was unable to absorb the increase in SG&A expenses due to the rise in material costs, as well as the strengthening of marketing and sales as planned, hiring of personnel to strengthen legal aspects, and the establishment of a security operation center.

   

• For the term ending February 2023, the company forecasts a 3.2% year on year increase in revenue to 2,650 million yen and a 4.4% year on year rise in operating profit to 785 million yen. A new series of Managed Security Service was launched in March, with the aim to further grow the mainstay business. In addition, with the increase of remote work due to the novel coronavirus pandemic, the company will strengthen security measures on the terminal side and expand its adjacent business of Data Backup Service in case of an emergency. The company aims to increase sales and profit by absorbing investments for strengthening the structure of the security operation center (SOC) and adjacent areas (EDR, etc.), increasing the number of remote marketing staff, and advertising and promotional expenses. The company targets a dividend payout ratio of 30% on an IFRS basis. The dividend forecast for the term ending February 2023 is ¥40.50/share, up ¥0.06/share from the previous term. The expected dividend payout ratio is 29.3% on an IFRS basis.

   

• The current market growth rate for the company's core services, such as UTM provision and monitoring services, is around 1-2%, and the company's top-line growth is likely to be unchanged for the time being. However, in line with the increasing number of news stories about ransomware and other cyber security issues, the business environment surrounding the company remains favorable, with the number of inquiries and licenses for the company's services (VDaP and EDR), which include not only data backup, but also preparation for viruses and malware that cannot be detected by conventional anti-virus software, is increasing rapidly.

   

• The company's collaboration with HEROZ has also been successful in terms of both development and sales, and we look forward to the evaluation and results of the AI traffic forecasting function (beta version), which will be launched in May. In addition, the release of the VSR-n Series, a new series of Integrated Internet Security Services, will also be an important point in advancing the strengthening/coordination of foundational software. We will be keeping a close eye on the progress of these efforts as well as the company's performance in the current term.

   

1. Company Overview 

[1-1 Corporate History]

To realise a sustainable growth and corporate value enhancement, the company was convinced of the importance of securing the flexible and diverse financing methods and also that by relisting, the company could further improve social credibility, secure excellent human resources, improve employees’ motivation to work, and aim for appropriate stock price formation and liquidity, the company got listed on the Second Section of the Tokyo Stock Exchange in November 2020. The company got listed on the TSE Standard Market in April 2022.

[1-2 Corporate Philosophy, etc.] 

Under this mission, as a company that provides Internet-related security services, it provides comprehensive network security services to assist with the safer use of the Internet by protecting the customers’ networks from attacks from the Internet, intrusions into internal networks, and various threats such as virus infections and data thefts.

[1-3 Market Environment] 

(1) Growing demand for cybersecurity 
◎ New types of cyber attacks receive increased attention
In August 2021, IPA (Information-technology Promotion Agency, Japan) released the Ten Major Threats to Information Security 2021. The Ten Major Threats to Information Security 2021 were selected by IPA from information security incidents that occurred in 2020 and are considered to have had a significant impact on society. The Ten Major Threats Selection Committee, consisting of approximately 160 members, including researchers in the information security field and practitioners from companies, deliberated and voted on the threat candidates.
The top threat was "damage by ransomware" as in the previous year, followed by "theft of confidential information by targeted attacks," the same as the previous year. On the other hand, "Zero-day attacks," which target users before the release of a modified program, ranked seventh, indicating that cyber attacks are becoming more diverse.

◎ Ministry of Economy, Trade and Industry of Japan calls employers to strengthen cyber security efforts

This report identified the following current issues:
• In recent years, the attack entry points in the supply chain used by attackers have been constantly increasing. These include overseas bases of business partners including SMEs and companies expanding overseas, as well as gaps created by the increase in telework due to the spread of the novel coronavirus.
• In addition to demanding ransoms to recover encrypted data, ransomware that uses the so-called “double threats” — threatens to release the data that was stolen in advance before encrypting unless ransom is paid — are rapidly increasing in Japan. This is due to the establishment of an ecosystem which enables attackers to systematically provide ransomware as well as collecting ransoms systematically, allowing them to operate easily without having to be highly skilled.
• With the globalization of businesses, more and more systems that are closely linked with overseas bases are being built; however, as a result of linking the Japanese domestic systems to those of overseas without sufficient measures, the risk of intrusion is increased as this enabled the attackers to construct intrusion routes at overseas bases where security measures are insufficient.

As shown in the graph below, since March 2020 when the novel coronavirus began spreading, the number of consultations concerning those unexpected events that would quickly spiral out of control without immediate counteractions has been increasing.

(From the Ministry of Economy, Trade and Industry’s “Warning to Managers Concerning the Recent Cyberattacks (Summary Edition)” 

• The severity of damage caused by cyberattacks is increasingly more serious and the damages are also more complex: management needs to be involved even more than previously.
• Responding to the damages caused by ransomware attacks is an important issue directly related to corporate trust, and sweeping management leadership is required from proactive prevention to postvention.

Under these conditions, the security service market is seeing an increase in demand.
The security service market requires advanced security measures, but companies that find it difficult to operate and manage in-house security measures tend to outsource operations and monitoring to security vendors, leading to an increase in the service usage.
The market size is expected to expand from 223.7 billion yen in the fiscal 2019 to about 322.2 billion yen in the fiscal 2025, with an average annual growth rate of 6.3% (from the company’s securities report. Source: Fuji Chimera Research Institute, Inc. “2020 Network Security Business Survey Overview (Market Edition)” published on November 17, 2020).

(2) IT personnel shortage
The METI ran a trial calculation of the output gap in IT human resources due primarily to the expansion of IT investment by companies using AI.
According to the report, if the productivity growth rate is 0.7%, the shortage in the number of IT workers in 2030 is estimated at 787,000 in the high-level scenario (3-9% growth in IT demand), 449,000 in the medium level scenario (2-5% of the same), and 164,000 in the low-level scenario (1%). Even if productivity were to rise to 2.4%, the high-level scenario still predicts a shortfall of 438,000 people.
Under these circumstances, it is difficult for companies to secure sufficient IT human resources within their companies, therefore a steady increase is expected for the demand for “managed service” that provide not only the functions but also combine the operation management as one when using IT systems.

* Gap in demand for IT personnel in 2030 (number of workers) 

*Created by Investment Bridge based on the Ministry of Economy, Trade and Industry’s “Survey on Supply and Demand of IT Human Resource (Summary)” (April 2019). 

[1-4 Business Contents] 

(1)Service category

These services cover every step in the security framework: construction, identification, defense, detection, response, and recovery.

① Managed Security Services 
In addition to the integrated Internet security service using VSR and the data backup service (VDaP), since the term ended February 2021, the company has been offering Vario EDR service that helps detect and respond to cyberattacks at lower operational costs, and Vario-NSS, which detects abnormal terminals and provides vulnerability management.

<Integrated Internet Security Service Using VSR>
Overview
This service provides comprehensive network security that protects corporate networks from the attacks from the Internet, intrusions into internal networks, and threats such as virus infections and data thefts, and enables customers to use the Internet safely.
The company’s integrated Internet security service uses VSR (Vario Secure Router) — a network security device developed by the company which integrates various security functions such as firewalls, IDS (intrusion detection system), and ADS (automatic defense system) into one unit — which is installed between the Internet and customers’ internal networks, and acts as a filter to remove threats such as attacks, intrusions, and viruses.

VSR is automatically managed and monitored by a proprietary operational monitoring system run by the company’s data center, and operational information statistics and various alerts are processed in real time without human interventions. 
Statistics and alerts are provided in real time to user company administrators over the Internet via a reporting function called, the Control Panel. In addition, the company has established a 24/7 support center, and a maintenance network covering all 47 prefectures in Japan and an operation support system such as changing the equipment settings.

Since they are manufactured at several factories in Taiwan while the core software is developed in-house, it is more cost-effective than purchasing hardware and adding services, and this is one of the reasons contributing to VSR’s high operating income margin. 

(Source: the company’s website) 

Merits
Previously, to introduce the security system such as above, it was necessary to install various security devices in-house and maintain them, making it more difficult for many companies to introduce sufficient network security measures because they required highly skilled engineers and high investments.
In addition, even after the introduction of the security system, monitoring, quick response to alerts, software updates, inquiries in the event of trouble, etc. required a great deal of effort and time, and the operational burden was extremely large. 

In contrast, the company’s Managed Security Services, which provides the one-stop solution from initial introduction to operation and maintenance of VSR, a unique in-house product, provides significant benefits to customers in the following respects: 

The ease of introduction and the clarity of the menu are highly evaluated by mid-tier enterprises and MSEs.

(Source: materials provided by the company) 

Customers
Most of their customers are mid-sized and small businesses who would struggle to employ IT managers with expertise on their own. As of the end of February 2022, 2,871 companies use the services and are operating at 7,307 locations nationwide (number of VSR-installed locations).
It has a high market share amongst the mid-tier enterprises and SMEs.

<Data Backup Service (VDaP)>
The company provides a backup service that combines VDaP, where backup data are stored on a device, and the storage in a data center.
After temporarily backing up corporate digital data to VDaP, data are automatically transferred to the data center to further increase the fault resistance.
In addition, since the latest and past data are kept as version-managed backup data, it is easy to select and recover the necessary digital data by providing an interface for the customers that are easy to use when recovering data.
Utilizing its experiences in monitoring and operating services for integrated Internet security service using VSR, the company also provides the service that efficiently covers the whole country by utilizing the system for installing equipment and responding to failures. 

<Vario EDR Service>
Vario EDR Service visualizes cyberattacks that try to penetrate through antivirus measures and avoid security incidents before they happen. It adopts highly accurate detection methods using AI and machine learning, and against the high-risk incidents, it would conduct automatic isolation of terminals and initiate investigations by security specialists. 

<Vario-NSS>
As the shortage of IT personnel in companies becomes more serious, the company will support the efficient operation of internal systems and promote the concept of “Information System as a Service.” Vario-NSS automatically scans terminals connected to the corporate network by simply installing a dedicated terminal in the network for asset management, visualizes terminal information, and understands vulnerability response. This enables it to respond to terminals with security risks early and monitor unauthorized terminals, reducing the burden and risk on the IT asset management which tends to rely on personal operations.
Through continuous updates, it can not only manage Windows terminals, but also centrally manage Red Hat Linux terminals which are widely used for internal servers, etc. reducing the burden on personnel in the information systems departments at customer companies. 

② Integration Services
This consists of sales of Vario Communicate Router (VCR), an integrated security device (UTM) for small and medium-sized enterprises, and Network Integration Services (IS) for procurement and construction of network equipment.

<Sales of integrated security equipment VCR for small and medium-sized enterprises>

<Network Integration Services (IS)>
Their engineers cover the whole areas of designing, procuring, and building the network according to the needs of end-users, and are working to expand the business into the wider corporate network areas.
As with the VCR sales, the manufacturers provide support on sold equipment and hardware failures, through the company’s and/or distributors’ support desk.

(2) Revenue model

(3) Sales channels

(4) Numbers of VSR and VCR installations

[1-5 Characteristics and Strengths] 

(1) Unique business model
The company provides one-stop service for (1) procurement of equipment used in security services, (2) development of core software to be installed on equipment, (3) installation/setting of equipment, and (4) monitoring and operation after installation of equipment.
There is no need for end-users to individually consider equipment selection and operation services, and they can quickly start using the service.
In addition, since the service is provided as one-stop, the company can easily investigate the cause of a problem and respond.
Support is available 24/7, allowing end-users to quickly receive support for inquiries and troubles. The company aims to reach customers within four hours if it deems that equipment needs replacing, and in the term ended February 2021, it almost achieved the target at 99%.

(2) Stable revenue model
As mentioned above, Managed Security Services are recurring business in which profits accumulate year by year due to the increase in the number of companies introduced by monthly billing, and as of the end of February 2022, Managed Security Services were provided at approximately 7,300 locations (number of VSR-installed locations) in all 47 prefectures nationwide.
In the term ended February 2022, Managed Security Services accounted for 84.4% of the company’s total sales revenue. With a low churn rate of 0.82% (in the term ended February 2022), a stable earnings model has been built, and it is possible to forecast revenues at a relatively early stage in the fiscal year. 

(Source: material provided by the company) 

(3) Strong sales channels
As mentioned above, it has built strong sales channels with 31 OEM partners and 60 reselling partners, covering the whole country.
It is an important asset for efficient sales for the company, which mainly targets small and medium-sized enterprises.
In addition, since there are many OEM partners in the telecommunication industry and the company’s services are incorporated as an option in the menu of the operating company, it is easy for users to select and introduce when the Internet connections are newly installed or altered, leading to a high order rate. 

(4) High market share

* Firewall/UTM operational monitoring service market: Sales Amount and Market Share by Employee Size (FY2020) 

* Created by Investment Bridge based on the company’s financial results briefing materials (source: ITR “ITR Market Vie Gateway Security-Based SOC Service Market 2021”)
* UTM: Unified Threat Management. A network security measure operated by combining multiple security functions into one.

2. Fiscal Year Ended February 2022 Earnings Results

(1) Overview of business results 

*Unit: million yen 

Increase in revenue and decrease in profit. Sales and Profit both fell short of forecasts. 
Sales revenue increased 0.8% YoY to 2,566 million yen. While managed service performed as planned, integration service failed to reach the forecast as some projects took longer to set up on-site due to the prolonged restrictions under the state of emergency, despite the increase in revenue. Operating profit decreased 1.6% YoY to 751 million yen. Gross profit increased due to higher sales, but material costs rose. While enhancing marketing and sales as planned, the company hired personnel to strengthen legal aspects and built a security operation center, and could not absorb the increase in SG&A.

(2) Service trends 

*Unit: million yen 

① Managed Security Service
The initially anticipated OEM of EDRs experienced procedural delays due to circumstances on the partner side. However, the number of licenses provided has increased rapidly, tripling from the term ended February 2021.
Meanwhile, backup services for countermeasures against ransomware significantly exceeded the forecast performance.

◎ Churn rate
The churn rate remained low.

◎ New services, etc.

② Integration Service
The shortage of semiconductors and parts due to the novel coronavirus pandemic caused delays in the procurement of parts and materials, and delivery dates could not be fixed, resulting in many project cancellations and delays in deliveries. As a result, the business did not perform as planned, but revenue recovered to the level before the novel coronavirus pandemic.
In February 2022, the company launched the VCR 116w, a fully remodeled version of the VCR-Vario Communicate Router, which is a UTM suitable for companies with up to 50 employees. The product is off to a strong start, with significantly faster processing speeds and enhanced security through the standardization of the sandbox function.

(3) Major Initiatives

The following three issues were recognized and addressed. 

①Developing new business channels
*Development of system integrators and network integrators
*Introduction of projects to agencies
*High-touch sales (a sales style in which a company directly attends to customers without using an agent)
*Approach to specific industries (medical care, education, and public services)

Situation
The company generated 49 deals (passed on to the sales division) through remote marketing.
The new EDR service has made progress in generating deals (a high probability of closing a deal). 
Progress was made in approaching specific industries (medical care) by finding OEM partners in Kyushu.
The company attracted hospital-related customers through a VDaP webinar on anti-ransomware measures for the medical industry.

② Improvement of service recognition
*Improvement in service recognition among end users
*Popularization of the name of the service

Situation
Amid the need for companies to adopt telework, a total of 12 webinars focused on security risks and cyber-attack countermeasures were held and attracted 353 participants.. 
In addition, the company participated in two external webinars and one external event.

③ Enrichment of contents
*Proactive provision of video content
*Overhaul of the website

Situation
Post-event webinars and video guidance on service use cases were launched to deepen the understanding of the service for a wide range of customers. As a result, the average time spent on the site increased 2.6 times and direct return rate improved 16.4%.

(4) Financial position and cash flows 

*Unit: million yen. Borrowings include lease liabilities.

Balance of interest-bearing liabilities decreased by 443 million yen from the end of the previous term. Net D/E ratio decreased 7.3% from the end of the previous term to 32.3%. Equity ratio increased by 6 points to 60.7% due to decrease in liabilities and increase in retained earnings. 
Repayment of interest-bearing liabilities and financial soundness improvement are progressing as planned.

◎ Cash Flows

*Unit: million yen

The surpluses of operating CF and free CF decreased.
The cash position fell below from the end of the previous term.

3. Fiscal Year Ending February 2023 Earnings Forecasts

(1) Earnings forecasts

*Unit: million yen

Increase in revenue and profit estimated.
Revenue is estimated to be 2,650 million yen, up 3.2% from the previous term and operating profit is projected to be 785 million yen, up 4.4% from the previous term. 
A new series of Managed Security Service was launched in March, with the aim to further grow the mainstay business. In addition, with the increase of remote work due to the novel coronavirus pandemic, the company will strengthen security measures on the terminal side and expand its adjacent business of Data Backup Service in case of an emergency. The company aims to increase sales and profit by absorbing investments for strengthening the structure of the security operation center (SOC) and adjacent areas (EDR, etc.), increasing the number of remote marketing staff, and advertising and promotional expenses.
The company targets a dividend payout ratio of 30% on an IFRS basis. The dividend forecast for the term ending February 2023 is ¥40.50/share, up ¥0.06/share from the previous term. The expected dividend payout ratio is 29.3% on an IFRS basis.

(2) Main initiatives

To strengthen core businesses and expand operations in adjacent businesses.

① To grow the mainstay business
The company will grow its Managed Security Service by strengthening its support (quality, efficiency, and speed) and service capabilities.
Specifically, the newly released n Series will provide additional functions that are in high demand by customers, and the UI will be substantially revamped.
In addition, the company will promote automation through VSR-Config and is considering offering bundled services jointly with HEROZ, with which it has formed an alliance.
Through these efforts, the company aims to add value and differentiate itself from its competitors.

② Business expansion into adjacent businesses
The company will expand business not only in VSR (Internet Gateway), but also in adjacent areas where needs are growing, such as VDaP, EDR (EPP), and V-NSS.
It will accelerate the speed of its business expansion by further focusing on initiatives that have proven successful in the previous term, such as the use of webinars, strengthening approaches to specific industries, including the medical industry, and remote marketing.

4. Growth Strategy

The company, which has created a business foundation by offering reliable and safe Internet connection and additional services that can be used easily by medium-sized enterprises, will now move beyond Internet services and herald a concept of “Information System as a Service,” offering services by expanding their reach to in-company network infrastructure as a whole, and work towards its implementation. 
Specifically, the company will improve the overall strength of its services by focusing on the following three points to increase its earnings and securing profit.

These measures, which began in the term ended February 2020, are progressing well, and the company will take steps to further strengthen them.

In the area of user interface integration, collaboration with HEROZ, Inc. (TSE Prime, 4382), with which they formed an alliance in September 2021, is a major key.
The VSR n series, the latest series of Managed Security Service, will be equipped with an AI traffic prediction function (beta version) utilizing HEROZ Kishin, and is expected to be launched in May 2022.
AI predicts the detection of abnormal communication volume and the status of lines and other congestions, and takes next actions to avoid the risk of failure and prevent unknown threats.
The two companies have a high affinity in complementing each other's areas of expertise, and the joint service development, POC (Proof of Concept), to validate the introduction of AI is progressing smoothly. This is expected to be a strong competitive advantage in Managed Security Service.

In strengthening/coordination of infrastructure software, cloud systems and on-premise systems will be centrally managed to ensure the security of cloud systems.
In optimization/automation of SOC (Security Operation Center), the company aims to ensure quality and improve productivity based on thorough automation.

In about five years, the company aims to become an AI Security Company that provides services ranging from the safety and security of corporate Internet connections to overall corporate network infrastructure to make "Information System as a Service" attainable.

(Taken from the reference material of the company)

5. Conclusions

The current market growth rate for the company's core services, such as UTM provision and monitoring services, is around 1-2%, and the company's top-line growth is likely to be unchanged for the time being. However, in line with the increasing number of news stories about ransomware and other cyber security issues, the business environment surrounding the company remains favorable, with the number of inquiries and licenses for the company's services (VDaP and EDR), which include not only data backup, but also preparation for viruses and malware that cannot be detected by conventional anti-virus software, is increasing rapidly.

The company's collaboration with HEROZ has also been successful in terms of both development and sales, and we look forward to the evaluation and results of the AI traffic forecasting function (beta version), which will be launched in May. In addition, the release of the VSR-n Series, a new series of Integrated Internet Security Services, will also be an important point in advancing the strengthening/coordination of foundational software. We will be keeping a close eye on the progress of these efforts as well as the company's performance in the current term.

<Reference: Regarding Corporate Governance>

◎ Organization type and the composition of directors and auditors 

◎ Corporate Governance Report

<Basic Policy>
Our company’s mission is “to ensure that all enterprises using the Internet can easily and securely carry out their business, we will offer the very best services to Japan and to the world,” and have conducted our business to meet the expectations of our various stakeholders. Business management based on corporate governance, which forms the core of our business, is the most important administrative category and through a highly transparent, optimized management with a strengthened monitoring system, we are aggressively taking initiatives to improve our corporate value.

<Reasons for Non-compliance with the Principles of the Corporate Governance Code (Excerpts)> 

<Disclosure Based on the Principles of the Corporate Governance Code (Excerpts)>