16 September 2025

Corero Network Security plc

("Corero" or the "Group")

Unaudited H1 2025 Interim Results

Directorate Change

-      25% increase in ARR led by change in sales mix to subscription products and services

-      Accelerated adoption of DDPaaS solutions delivering increased revenue visibility, and a more predictable and scalable revenue base

Corero (AIM: CNS) (OTCQX: DDOSF), the distributed denial of service ("DDoS") protection specialists, announces its unaudited results for the six months ended 30 June 2025 ("H1 2025").

Financial Highlights

·    Annualised Recurring Revenues¹ ("ARR") grew strongly by 25% to $21.6 million (H1 2024: $17.2 million)

o  Underpinned by growth in DDoS Protection-as-a-Service ("DDPaaS") solution sales

·    Group reported revenue $10.9 million down 10% on prior year (H1 2024: $12.2 million)

o  Accelerated customer adoption of DDPaaS solutions impacting in period recognised revenue

·    Order intake² $12.5 million, a decrease of 12% over the prior year (H1 2024: $14.2 million)

o  Q1 order intake impacted by weaker than expected Alliance Partner performance and short-term uncertainty as a result of the anticipated US tariffs

o  Q2 2025 order intake rebounded positively, growth of 13% over Q2 2024 to $7.8 million

·    Continued high customer retention³ at 98%

·    EBITDA⁴ loss of $1.4 million (H1 2024: profit of $0.7 million) impacted by the shift to recurring revenue

¹  ARR is defined as the normalised annualised recurring revenues and includes recurring revenues from contract values of annual support, software subscriptions including terms greater than one year, and from DDoS Protection-as-a-Service ("DDPaaS") contracts.

²  Order intake is defined as orders received from customers in the period.

³  Customer retention is defined as the percentage of annual recurring revenue retained from existing customers during the renewal cycle across the measurement period.

⁴  EBITDA is defined as earnings before interest, tax, depreciation, and amortisation.

Operational Highlights

·    New customer wins and contract expansion momentum, particularly post Q1

o  Includes major $1.2 million deal and strategic regional partnership with Forte Telecom, one of the largest telecommunications providers in the state of Rio de Janeiro, Brazil

·    Strategic expansion of partnership with Juniper Networks ("Juniper") to sell Corero's full portfolio of DDoS protection solutions, which will open up opportunities with Juniper tier-one telecommunication service provider customers

·    Secured the first two customer wins for the recently launched Corero Observability & Resiliency Ecosystem ("CORE") solution totalling $1.8 million

Directorate Change

·    Ashley Stephenson, currently Chief Technology Officer and Director to retire from Corero

o  Ashley joined Corero in 2013 and has held a number of roles including Chief Executive Officer, and has been instrumental in driving the Corero SmartWallONETM product strategy

o  Ashley's responsibilities will be transitioned to the Corero senior leadership team, and he will work closely with Carl Herberger to ensure a seamless transition in the period to the end of the year

Current Trading & Outlook

·    Trading in Q3 has continued with the positive momentum from Q2 

·    Management is confident in driving sustained ARR growth and adapting to a higher mix of DDPaaS driven revenue underpinned by an improved pipeline and Alliance Partner opportunities

·    Momentum is building and management is comfortable with the guidance for the year ending 31 December 2025 as announced on 16 July 2025 of revenue between $24.0 million and $25.5 million (FY 2024: $24.6 million) and EBITDA between $1.5 million loss and $0 million (FY 2024: $2.5 million profit)

Carl Herberger, Chief Executive Officer at Corero, commented:

"I am pleased with the rebound in Q2 order intake and demand for our recently expanded product offering. The strong growth in ARR in the first half of the year, underpinned by the accelerated customer demand for DDPaaS solutions, will deliver more predictable revenues. We continue to see the shift in customer demand away from upfront licenses to ARR.  

The Company is focused on delivering revenue growth in the second half of 2025 over the prior year by continuing to build the new business pipeline and expanding our global partner network.

Finally, and on behalf of the Board and the Corero team, I would like to express my sincere gratitude to Ashley Stephenson for his significant contribution to Corero over the past twelve years and to wish him all the very best for the future."

Ashley Stephenson, Chief Technology Officer, commented:

"It has been a privilege to work with the outstanding Corero team over the past decade. In that same period, the threat from cybersecurity attacks has escalated to unprecedented levels. With an expanding product portfolio and strategic alliances, I am confident Corero is well positioned to continue to deliver best in class protection."

Enquiries:

Jonathan Paterson

About Corero Network Security

Corero Network Security is a leading provider of DDoS protection solutions, delivering real-time, automated detection and mitigation with deep network visibility and analytics. Corero safeguards critical infrastructure across diverse deployment models-from inline to edge to hybrid cloud-through its SmartWallONE^TM solution and CORE, an observability and resiliency ecosystem to unify defensive actions across the modern threat landscape. With operational centres in Marlborough, Massachusetts, USA, and Edinburgh, UK, Corero is listed on the London Stock Exchange's AIM market (ticker: CNS) and the US OTCQX Market (OTCQX: DDOSF).

For more information, visit www.corero.com, and follow us on LinkedIn and X.

Chief Executive Officer's Review

Introduction

Group reported revenue for H1 2025 was $10.9 million, down 10% on the prior year (H1 2024: $12.2 million), as a result of accelerated customer adoption of DDoS Protection-as-a-Service ("DDPaaS") solutions and a corresponding reduction in upfront appliance and license sales. The impact of the increased DDPaaS sales was a reduction of in period recognised revenue with a corresponding strong increase in ARR, which grew 25% to $21.6 million (H1 2024: $17.2 million).  This shift in revenue also had an impact on EBITDA.  The H1 2025 EBITDA loss was $1.4 million (H1 2024: profit of $0.7 million).

Notably, management expects this shift in revenue to ARR will benefit future years, resulting in more consistent revenue recognition over the duration of these contracts, typically three years. As such, it represents an opportunity to build a more predictable and resilient business model that provides visibility of secured revenues and supports retention rates across the Group's customer base in the long term.

Order intake across H1 2025 was $12.5 million (H1 2024: $14.5 million).  Q1 order intake was impacted by a weaker than expected Alliance Partner performance and notable uncertainty as a result of the anticipated US tariffs. However, order intake rebounded strongly in Q2 2025 as tariff concerns eased, growing 13% year-on-year to $7.8 million. This included three significant customer expansion orders totalling $2.7 million and the first two customer wins for the recently launched new Corero Observability & Resiliency Ecosystem ("CORE") solution totalling $1.8 million. The Group also made progress on its strategic objective of broadening Corero's global footprint through the creation and expansion of strategic channel partnerships, with particular success in Latin America across H1 2025.

Corero reported a net cash balance at 30 June 2025 of $3.1 million (H1 2024: $7.9 million) and has no outstanding debt. The Group is in the advanced stages of finalising a bank overdraft facility from its existing banking partner to support the increased working capital requirements resulting from the growth in DDPaaS solutions where cash receipts are spread over the life of the contract.

Corero remains at the forefront of DDoS innovation, being named an Emerging Innovator in the 2025 SPARK Matrix, a leading independent third-party industry research organisation. Corero was recognised for its real-time threat intelligence and behavioural-based DDoS defences¹, evidence of Corero's best in class solutions. In the context of an increasingly complex DDoS threat landscape where businesses are more vulnerable than ever, demand for comprehensive DDoS solutions remains robust. The Group is therefore well-placed to capitalise on providing market leading DDoS solutions through both internally generated leads and its strategic partnerships.

¹ https://www.corero.com/corero-leads-in-2025-spark-matrix-with-higher-customer-impact/

Strategic Priorities

Corero continues to focus on increasing its DDoS defence market share globally and remains committed to four key established strategic pillars:

1.    Expanding global footprint and partnership channels - leveraging alliance and channel partnerships to grow presence across key regions, including Latin America, the Middle East and APAC

2.    Investing in sales and marketing initiatives - increasing targeted marketing activity and spend, and hiring experienced personnel in new geographies

3.    Securing client renewals and realising upsell opportunities - maintaining or improving on the excellent 98% customer retention rate, delivering price increases for renewals and extensions as standard, and continuing to diversify the product mix

4.    Accelerating market competitiveness - actively targeting competitor displacements in key geographies, and launching new product innovations and add-on features aimed at attracting new customers

Operational Review

As part of the Group's reinvigorated go-to-market strategy and following targeted sales investment in FY 2024, Corero is focused on generating new business opportunities globally and leveraging alliance and channel partnerships to secure new routes to market and revenue streams. The business has had notable success growing its footprint in Latin America in H1 2025, having secured a number of new customer wins. The Group has also enlarged its enterprise addressable market through an expansion of its partnership with Juniper to sell Corero's full product suite of DDoS solutions.

New Alliance and channel partnerships secured in H1 2025 include:

·    Channel partner TechEnabler secured a new contract to implement Corero's SmartWallONE^TM solution for a leading telecommunications provider in Brazil, replacing the incumbent provider

·    Strategic expansion of partnership with Juniper to sell Corero's full portfolio of DDoS protection solutions to Juniper's customers, opening up new opportunities with tier-one telecommunication providers and enterprises

·    Secured Certified Partner status with World Wide Technology (WWT), a leading global technology integrator with deep expertise in cybersecurity

Customer deals secured in H1 2025 include:

·    Significant $1.5 million expansion of TierPoint relationship, deploying Corero's next-generation CORE solution

·    3-year, $1.2 million partnership with Forte Telecom, one of the largest telecommunications providers in Rio de Janeiro, Brazil

·    5-year, $1.2 million expansion of its partnership with Lightedge, extending Corero's protection across its data centres and replacing an existing provider

·    $0.8 million contract renewal and extension with partner TechEnabler, a leading technology service provider in Brazil

·    $0.3 million deal with Cooper Health incorporating Corero's new CORE Zero Trust Admission Control capabilities across its almost 14,000 employees across three hospitals

Post the period end, Corero secured a multi-year deal with a leading European banking and insurance customer through its Alliance Partner, Akamai. The customer selected Akamai's Prolexic On-Prem solution, which is powered by Corero's SmartWallONE^TM platform, with the initial 3-year DDPaaS contract worth $0.6 million in total contract value to Corero. 

Product innovation

Corero continues to invest in R&D to deliver enhancements to its existing offerings and maintain leadership in its solutions offering across on-premises, hybrid, and cloud environments. Being named a Leader in the 2025 SPARK Matrix for DDoS Mitigation for the first time, awarded to vendors demonstrating the highest standards across both technology excellence and customer impact¹, exemplifies Corero's commitment to remaining at the forefront of the DDoS protection market.

The Group also secured its first two deals deploying its next generation CORE solution, a new SaaS cloud-based availability protection platform that has evolved the Corero offering beyond DDoS protection solutions. The platform has market leading capabilities including Traffic Analysis, Zero Trust Admission Control and Layer 7 DDoS protection, solutions in demand from Corero's target market, which complement the existing suite of Corero products. Continued investment into the CORE platform alongside Corero's existing SmartWallONE^TM solution will enable the Group to further establish its position as a technical leader and unlock new commercial opportunities.

¹ https://www.corero.com/corero-leads-in-2025-spark-matrix-with-higher-customer-impact/

Addressable Market and Market Drivers

Demand for DDoS solutions continues to grow in the face of frequent and sophisticated cyber-attacks, with the market estimated to be worth $9.6 billion by 2029 (2024: $5.2 billion), representing a CAGR of 13.2%¹. Corero operates within a significant segment of this overall market; management estimates that the total addressable market exceeds $2.0 billion for its SmartWallONE^TM solutions.

DDoS attacks are easy to execute whilst still inflicting a significant impact on the target, including reputational damage, operational downtime, and financial losses, estimated to cost $100,000 for every hour an attack persists². The largest DDoS botnet³ ever recorded was identified in the second quarter of 2025, comprising 4.6 million infected devices and almost 20 times bigger than the largest botnet seen in 2024⁴.  As evidence of the growing threat of DDoS, a newly discovered attack method, dubbed Win-DDoS, has the capability to create a powerful botnet by harnessing publicly accessible Windows domain controllers⁵.

Companies across industry sectors are therefore taking an increasingly proactive approach to their DDoS defence capabilities to mitigate the rapidly evolving DDoS landscape, leaving Corero well-placed to leverage current market sentiment.

Demand for DDoS solutions in the US, Corero's largest customer base and geographical footprint, remains high. Hactivism following geopolitical events continues to represent a significant threat, with DDoS attacks in the US surging 800% following the US military action targeting Iran's nuclear facilities⁶.

The addressable DDoS market in Latin America is also growing rapidly as a result of digital expansion and increasing connectivity in the region, driving demand for scalable DDoS solutions.

The new CORE products provide Corero with access to an incremental market with a current estimated value of $36.0 billion⁷. Management estimates that the total addressable market for CORE is 15-20% of this market, $5.4 to $7.2 billion.

Corero is well-placed to leverage these market trends and opportunities.

¹ https://www.marketsandmarkets.com/PressReleases/ddos-protection-mitigation.asp

² https://www.mordorintelligence.com/industry-reports/ddos-protection-market

³ A botnet is a network of interconnected computers or devices that are infected with malicious software, allowing a remote attacker to control them without the users' knowledge or consent.  These botnets are then used to initiate cyberattacks including DDoS attacks.

⁴ https://www.itpro.com/security/cyber-attacks/application-layer-ddos-attacks-are-skyrocketing-heres-why

⁵ https://the420.in/win-ddos-windows-domain-controller-botnet-vulnerability/

⁶ https://www.techradar.com/pro/security/mr-hamza-mysterious-team-bangladesh-and-keynous-led-a-massive-surge-in-ddos-on-us-businesses-following-an-attack-on-iran?utm_source=chatgpt.com

⁷ https://www.marketsandmarkets.com/telecom-and-IT-market-research-113.html

Directorate Changes

Ashley Stephenson, currently the Company's Chief Technology Officer and Director, has informed the Board of his intention to retire from the Company with effect from 31 December 2025, and will therefore step down as a director of the Company with effect from 30 September 2025. Ashley joined Corero in 2013 and has held a number of key roles across the Group including Chief Executive Officer, and more recently Chief Technology Officer, and has been instrumental in driving the Corero SmartWall product strategy. 

Ashley's responsibilities will be transitioned to the Corero senior leadership team, and he will work closely with Carl Herberger to ensure a seamless transition in the period to the end of the year.

In addition, Chris Goulden, Corero's Chief Financial Officer, was appointed to the Board in April 2025.

Outlook

The business remains well placed to expand our revenues with existing customers and further develop its new business pipeline across H2 2025. The shift from customers to a DDPaaS subscription solutions rather than upfront licences will deliver more predictable revenues for the business and further support ARR growth.

The guidance for FY 2025, which was revised on 16 July 2025, remains unchanged at revenue between $24.0 and $25.5 million (FY 2024: $24.6 million) and EBITDA between $1.5 million loss and $0 million (FY 2024: $2.5 million profit). 

Momentum is building and management is confident in driving sustained ARR growth and adapting to a higher mix of DDPaaS driven revenue underpinned by an improved pipeline and Alliance Partner opportunities.

Carl Herberger

Chief Executive Officer

15 September 2025

Chief Financial Officer's Review

Revenue for the six months ended 30 June 2025 was $10.9 million (H1 2025: $12.2 million). This decrease in  revenue is a result of the lower H1 2025 order intake and an increase in DDPaaS order mix, for which an increased proportion of new business revenues are recognised over the term of the contract as opposed to up front for other Corero commercial sales models. Q1 2025 order intake was impacted by a weaker than expected Alliance Partner performance and notable uncertainty as a result of the anticipated US tariffs, however Q2 2025 order intake rebounded positively, growth of 13% over Q2 2024 to $7.8 million. The increase in DDPaaS order mix resulted in Annual Recurring Revenues (ARR) increasing 25% to $21.6 million (H1 2024: $17.2 million). Management believes this trend to increased ARR will continue going forward and will benefit the Group as a greater percentage of future year's revenues are already secured given the typical DDPaaS deal term of three years.

Gross margin remained high during the period at 91% (H1 2024: 91%).

The table below illustrates the typical revenue recognition and cashflow timing of the Corero customer commercial sales models:

S&M = Support and Maintenance

Total operating expenses before depreciation and amortisation were $11.3 million (H1 2024: $10.4 million), with the increase in expenses largely attributable to an increase in sales team resources.

Depreciation and amortisation of intangible assets amounted to $1.0 million (H1 2024: $1.0 million), with capitalised R&D costs of $1.4 million (H1 2024: $1.1 million), the increase being attributable to the CORE product development.

EBITDA for H1 2025 was a loss of $1.4 million (H1 2024: profit $0.7 million), with increased selling costs of $0.9 million in the period and lower revenues of $1.3 million as a result of the sales mix change in H1 2025 with increased DDPaaS solution sales detailed above.

Loss before taxation was $2.4 million (H1 2024: $0.2 million) and loss after taxation was $2.4 million (H1 2024: $0.3 million). The reported loss per share was 0.5 cents (H1 2024: 0.1 cents).

Cash and cash equivalents as at 30 June 2025 was $3.1 million (H1 2024: $7.9 million), a decrease of $2.2 million in the six-month period (H1 2024: $2.7 million increase) due to the change in timing of invoicing and cash receipts as a result of the change in sales mix in the period.

There was no outstanding debt at 30 June 2025.  The Group is in the advanced stages of finalising a bank overdraft facility from its existing banking partner, to support any short-term funding of working capital as a result of the increase in DDPaaS sales which has an impact on short term cash flows as customers are invoiced and pay over the life of the contract rather than upfront.

Chris Goulden

Chief Financial Officer

15 September 2025

Condensed Consolidated Income Statement

for the six months ended 30 June 2025

1          See note 6 for definitions and reconciliation.

Condensed Consolidated Statement of Total Comprehensive Income

for the six months ended 30 June 2025

Condensed Consolidated Statement of Financial Position

as at 30 June 2025

Condensed Consolidated Statement of Cash Flows

for the six month period ended 30 June 2025

Condensed Consolidated Statement of Changes in Equity

for the six month period ended 30 June 2025

Notes to the Condensed Consolidated financial statements

1. General information and basis of preparation

Corero Network Security plc (the "Company") is a company domiciled in England. The condensed consolidated interim financial statements of the Company for the six months ended 30 June 2025 comprise the Company and its subsidiaries (together referred to as the "Group").

1.1 Basis of Preparation

These condensed interim consolidated financial statements have been prepared in accordance with UK-adopted IAS 34,"Interim Financial Reporting". They do not include all disclosures that would otherwise be required in a complete set of financial statements and should be read in conjunction with the Annual Report and Accounts for the year ended 31 December 2024 ("2024 Annual Report and Accounts"). Estimates and judgements that can have a significant impact on the Group's interim consolidated financial statements are the same as that of the prior year annual financial statements. The financial information for the half years ended 30 June 2025 and 30 June 2024 do not constitute statutory accounts within the meaning of Section 434(3) of the Companies Act 2006 and have neither been audited nor reviewed by the Group Auditor.

The annual financial statements of Corero Network Security plc are prepared in accordance with international accounting standards in conformity with the requirements of the Companies Act 2006. The comparative financial information for the year ended 31 December 2024 included within this report does not constitute the full statutory accounts for that period. The statutory Annual Report and Financial Statements for 2024 have been filed with the Registrar of Companies. The Independent Auditors' Report on the Annual Report and Accounts for 2024 was unqualified and did not contain a statement under 498(2) or 498(3) of the Companies Act 2006.

There have been no related party transactions or changes in related party transactions described in the latest Annual Report and Accounts that could have a material effect on the financial position or performance of the Group in the first six months of the financial year.

These consolidated interim financial statements were approved by the Board on 15 September 2025 and approved for issue on 16 September 2025.

A copy of this Interim Report can be viewed on the company's website: www.corero.com.

1.2 Going Concern

The financial statements have been prepared on a going concern basis.

The Directors have prepared detailed income statement, balance sheet and cash flow projections for the period to 30 September 2026 ('going concern assessment period'). The cash flow projections have been subjected to sensitivity analysis of the revenue, cost and combined revenue and cost levels through this period. In the half year period to 30 June 2025, the Group has seen the impact of the change in sales mix away from upfront appliance and license sales to DDPaaS solutions sales, which are recognised entirely over the life of the contract, rather than significantly up front. The shift in revenue mix toward DDPaaS sales contributed to 25% ARR growth, which increased to $21.6 million (H1 2024: $17.2 million), a key performance indicator for the Group. This increase in ARR provides strength to the going concern assessment for the coming future periods, while impacting the short term financial position of the Group.

Like revenue, the change in mix toward DDPaaS has increased the amount of cash receipts deferred into future periods which has materially impacted the cash balance at 30 June 2025, and will continue to result in lower cash flows through the remainder of 2025. The Group has secured a bank overdraft facility to manage the increased working capital requirements of the business as a result of the shift in revenue mix.

As part of the sensitivity analysis, the Directors have noted that should the forecasted revenues not be achieved, mitigating actions can be taken to address any cash flow concerns. These actions include deferral of capital expenditure, reduction in marketing and other variable expenditure alongside a hiring freeze.

The Directors are also not aware of any significant matters in the remainder of calendar 2026 that occur outside the going concern period that could reasonably possibly impact the going concern conclusion.

The Directors have also considered the geo-political environment, including rising inflation in some of our key markets, impacts of US tariff changes and the conflict in Ukraine and the Middle East, and whilst the impact on the Group is currently deemed minimal, the Directors remain vigilant and ready to implement mitigation action in the event of a downturn in demand or an impact on operations.

On this basis, the Directors have therefore concluded that it is appropriate to prepare the financial statements on a going concern basis.

2. Material accounting policies

The basis of preparation and accounting policies used in preparation of these interim financial statements have been prepared in accordance with the same accounting policies set out in the 2024 Annual Report and Accounts.

3. Segment reporting and revenue

The Group is managed according to one business unit, Corero Network Security, which makes up the Group's reportable operating segment. This business unit forms the basis on which the Group reports its primary segment information to the Board, which management consider to be the Chief Operating Decision maker for the purposes of IFRS 8 Operating Segments. Consequently, there is no separable 'other segmental information' not otherwise shown in these Condensed Consolidated Financial statements.

The Group's revenues from external customers are divided into the following geographies:

Revenues from external customers are identified by invoicing systems and adjusted to take into account the difference between invoiced amounts and deferred revenue adjustments as required by IFRS accounting standards.

The revenue is analysed for each revenue category as:

The revenue is analysed by timing of delivery of goods or services as:

4. Taxation

Due to the utilisation of past tax losses, the Group does not recognise a material taxation income tax expense or credit.

5. Earnings per share

Earnings / (loss) per share is calculated by dividing the earnings attributable to ordinary shareholders by the weighted average number of ordinary shares in issue during the period. The effects of anti-dilutive ordinary shares resulting from the exercise of share options are excluded from the calculation of loss per share.

6. Key performance measures

EBITDA and Adjusted EBITDA

Earnings before interest, tax, depreciation, and amortisation ("EBITDA") is defined as earnings from operations before all interest, tax, depreciation, and amortisation charges. The following is a reconciliation of EBITDA and further adjustment for all three periods presented:

-      END -