24 March 2026

Corero Network Security plc

("Corero" the "Company", or the "Group")

Audited results for the year-ended 31 December 2025

-      Strong sales traction and EBITDA growth delivered in H2 2025, ahead of previous market expectations

Corero (AIM: CNS) (OTCQX: DDOSF), the distributed denial of service ("DDoS") protection specialists and champions of service availability, announces its audited results for the year ended 31 December 2025 ("FY 2025").

Financial Highlights

·    Revenues of $25.5 million (FY 2024: $24.6 million)

·    EBITDA¹ of $1.5 million (FY 2024: $2.5 million)

·    Adjusted EBITDA² of $2.0 million (FY 2024: $3.0 million)

·    Annual Recurring Revenues³ ("ARR") increased by 23% to $23.9 million (FY 2024: $19.5 million)

o  Strong demand for both Corero's subscription-based and DDoS Protection as-a-Service ("DDPaaS") products

·    Order intake⁴ ("Orders") increased by 20% to $33.8 million (FY 2024: $28.2 million)

·    Continued high customer retention at 98% (FY 2024: 97%)

·    Strong new business pipeline for FY 2026

·    Loss before taxation of $0.7 million (FY 2024: $0.6 million profit)

·    Gross margins of 90% (FY: 2024: 91%)

·    Net cash at the year-end of $4.0 million (FY 2024: $5.3 million)

o  Positive cash generation in H2 2025

·    (Loss)/earnings per share and diluted (loss)/earnings per share of (0.1) cents (FY 2024: 0.1 cents)

Operational Highlights

·    Strong H2 2025 sales traction supported by new customer wins and contract expansion momentum

o  $6.8 million customer renewal and significant expansion order with a leading US cloud computing provider in October 2025

·    Channel partners, including TechEnabler and Juniper, continue to underpin new business momentum and geographic expansion

·    Corero's next generation 400GB platform and CORE platform solution continue to generate sales growth with new and existing customers

Current Trading & Outlook

·    Q1 2026 has started strongly, significantly exceeding Q1 2025 which was a challenging quarter

·    Management remains positive in the Group's ability to deliver sustained ARR growth, alongside continued migration to a subscription-based sale model which further improves revenue predictability, noting that contract structures will be customer led

·    Global cybersecurity threats continue to drive further demand for Corero's market leading products

·    The Board remains confident in the prospects of the Group to deliver ongoing progress, notwithstanding ongoing global economic uncertainty

Carl Herberger, CEO of Corero, said:

"I am pleased with the performance of the business, especially in the second half where we delivered particularly strong sales growth. Our ongoing transition to a subscription-based sales model gathered pace in the year, and further investment in R&D and new product development has underpinned our sales growth with both new and existing customers.

The DDoS market has remained buoyant, fuelled by ongoing cyber threats and increasing regulatory obligations. High-profile attacks on companies, especially across Europe, have reinforced the value of comprehensive DDoS solutions, further driving demand for our products and services from partners and customers.

Corero remains well placed for future growth, with our sales and marketing efforts generating strong sales growth in the current financial year."

¹ EBITDA is defined as earnings before interest, tax, depreciation, and amortisation.

² Adjusted EBITDA is defined as earnings before interest, tax, depreciation and amortisation and adjusted for share based payment charges and one-off restructuring costs in the period.

³ ARR is defined as the normalised annualised recurring revenues and includes recurring revenues from contract values of annual support, software subscriptions including terms greater than one year, and from DDPaaS contracts.

⁴ Order intake is defined as orders received from customers in the period.

Investor Presentation

Management will be conducting an investor presentation covering its year-end results. The online presentation will be hosted by Carl Herberger, Chief Executive Officer, and Chris Goulden, Chief Financial Officer.

This event will take place at 12.00 p.m. BST on March 24th, 2026. The webinar is free and open to all existing and potential shareholders, and questions can be submitted during the presentation to be addressed at the end.

The registration link can be found here:

https://www.investormeetcompany.com/corero-network-security-plc/register-investor

Enquiries

About Corero Network Security

Corero Network Security is a leading provider of DDoS protection solutions, delivering real-time, automated detection and mitigation with deep network visibility and analytics. Corero safeguards critical infrastructure across diverse deployment models-from inline to edge to hybrid cloud-and is currently developing CORE, an observability and resiliency ecosystem to unify defensive actions across the modern threat landscape. With operational centres in Marlborough, Massachusetts, USA, and Edinburgh, UK, Corero is headquartered in London and listed on the London Stock Exchange's AIM market (ticker: CNS) and the US OTCQX Market (OTCQX: DDOSF).

For more information, visit www.corero.com, and follow us on LinkedIn and X.

CEO Review

Introduction

The Group delivered a solid financial performance across 2025, noting the challenges in the first half of the year, with revenues of $25.5 million (FY 2024: $24.6 million) and Adjusted EBITDA of $2.0 million (FY 2024: $3.0 million). This modest revenue growth, due to lower than expected growth in H1, reflects a period of change for the business as customers accelerated their adoption of DDoS Protection-as-a-Service ("DDPaaS") and subscription solutions. This resulted in a reduction in upfront appliance and licence sales, which the business has absorbed across FY 2025, and a corresponding acceleration of ARR.

Pleasingly, our sales teams saw a marked increase in activity across H2, reversing the H1 trend, resulting in a better-than-expected performance across a number of financial KPIs. In addition, this shift towards a more subscription-based recurring revenue model generates more revenue predictability and visibility for the business going forward.

ARR, a key financial metric for Corero, continues to benefit from this trend, increasing by 23% to $23.9 million (FY 2024: $19.5 million). Order intake also strengthened, supported by strong momentum across H2 2025, increasing by 20% to $33.8 million (FY 2024: $28.2 million). Sales of new products released in 2025 was also encouraging, with over 40 units of Corero's next generation 400GB platform enhancement and five new customer wins for the CORE platform solution.

In October 2025, Corero secured a renewal and significant expansion order with a key customer: a leading US cloud computing provider with a total contract value of $6.8 million. Providing DDoS protection solutions to the customer's current and planned data centre portfolio, the contract consists of a $3.1 million renewal (of all existing contracts) and $3.7 million expansion, which will be delivered and recognised on a subscription basis over the three-year contract term.

Corero reported net cash at the year end of $4.0 million (FY 2024: $5.3 million), with the business delivering positive cash generation in H2 2025. The Group secured a £1.5 million overdraft facility in 2025 to support short-term financing needs. This facility has not been used to date and the Group has no outstanding debt.

Corero remains at the forefront of DDoS protection and innovation, delivering best-in-class solutions that strengthen the digital resilience of our global blue chip client base. Our commitment to product innovation has contributed to Corero's strong customer retention and solidified our competitive differentiation. Market-leading product development across 2025 has also allowed us to grow our market footprint. We also expanded our geographic footprint in 2025 and we have gained particular customer traction in Latin America and the Middle East, where rapid digitalisation is driving demand for Corero's product offering.

As the landscape for cybersecurity protection continues to be more acute in the face of increasingly sophisticated attacks and legislative changes, the demand for comprehensive DDoS solutions remains robust. The Group is therefore well-placed to capitalise on providing market-leading DDoS solutions through both organic and partner-driven new business activities.

Strategic Priorities

Corero is focused on increasing its DDoS defence market share globally and remains committed to four key strategic pillars:

·    Expand global footprint and partnership ecosystem - leveraging alliance and channel partnerships to grow presence across key regions, including Latin America, the Middle East and APAC

·    Investing in sales and marketing initiatives - increasing targeted marketing activity and spend, and hiring experienced personnel in new geographies

·    Securing client renewals and realising upsell opportunities - maintaining or improving on the excellent 98% customer retention rate, delivering price increases for renewals and extensions as standard, and continuing to diversify the product mix

·    Accelerating market competitiveness - actively targeting competitor displacements in key geographies, and launching new product innovations and add-on features aimed at attracting new customers and maintaining product superiority

To this end, we continue to step up our commitment to building stronger partnership channels, which management believe has the potential to unlock significant new customer opportunities. Central to this is an ongoing focus on product development to maintain product superiority. Ongoing channel investment remains closely aligned to this as the business seeks to maintain the sales momentum building in new geographic markets.

Operational Review

As part of the Group's reinvigorated go-to-market strategy and following targeted sales investment, Corero is focused on generating new business opportunities globally and leveraging alliance and channel partnerships to secure new routes to market and revenue streams. The business had notable success growing its footprint in Latin America in 2025, having secured a number of new customer wins.

New Alliance and channel partnerships secured across FY 2025 include:

·    Channel partner TechEnabler secured a new contract to implement Corero's SmartWall ONE solution for a leading telecommunications provider in Brazil, replacing the incumbent provider

·    Strategic expansion of partnership with HPE to sell Corero's full portfolio of DDoS protection solutions to HPE's customers, opening up new opportunities with tier-one telecommunication providers and enterprises

·    Secured Certified Partner status with World Wide Technology (WWT), a leading global technology integrator with deep expertise in cybersecurity

Customer deals secured during FY 2025 include:

·    Customer renewal and significant expansion order with a leading US cloud computing provider, delivering DDoS protection solutions to its current and planned data centre portfolio - contract value of $6.8 million

·    Significant $1.5 million expansion of TierPoint relationship, deploying Corero's next-generation CORE solution

·    3-year, $1.2 million partnership with Forte Telecom - one of the largest telecommunications providers in Rio de Janeiro, Brazil

·    5-year, $1.2 million expansion of its partnership with Lightedge, extending Corero's protection across its data centres and replacing an existing provider

·    $0.8 million contract renewal and extension with partner TechEnabler, a leading technology service provider in Brazil

·    $0.3 million deal with Cooper Health incorporating Corero's new CORE Zero Trust Admission Control capabilities across its almost 14,000 employees across three hospitals

·    3-year agreement with a leading European banking and insurance customer through our Alliance Partner, Akamai, to deliver a DDPaaS contract worth $0.6 million in total contract value to Corero

·    Corero's first Tier 1 Telco customer signed in APAC, through our Alliance Partner, HPE

Sales and Marketing Investment

During 2025, Corero maintained its investment in both sales and marketing, alongside supporting proactive activities to further strengthen its channel partner relationships. This blended approach supports our strategic intent to broaden the Group's sales footprint globally, alongside generating incremental cross and upsell opportunities across our existing customer base.

Marketing resources were primarily targeted for lead generation programmes including regional tradeshows, content syndication campaigns, webinars, and sponsored social media content. Increased investment played a pivotal role in growing Corero's market reach and generating new customer traction throughout the year, particularly in regions such as Latin America and the Middle East where we are already generating significant sales traction.

Successful launches of new products in 2025, including Corero's next generation 400GB platform and the CORE platform solution, will also enable Corero to capitalise on new market opportunities with an expanded product portfolio.

DDoS Addressable Market and Market Drivers

Compared to other forms of cybercrime, DDoS attacks are relatively low-risk yet high-impact, and malicious actors are increasingly aware of the significant damage they can inflict on companies through DDoS strikes, both from a financial and reputational standpoint. With organisations facing an average of 11 attacks per day (up 37% since 2018), these are no longer episodic events, but an operational reality. As attacks become more complex, aided by increased access to AI and machine-learning, organisations are continuing to seek comprehensive availability protection.

The rapid growth of the global DDoS mitigation market shows no sign of abating. Latest research indicates that the market will be valued at $15.94 billion by 2030 (2025: $7.21 billion), growing at a CAGR of 17.23% over the next five years. Corero operates within a significant segment of this overall market and estimates that the total addressable market for its principal SmartWall ONE solution exceeds $2.0 billion.

Against the evolving threat landscape, legislative changes are enforcing stricter adherence to cybersecurity obligations. In response to growing cyber threats, the EU's Digital Operational Resilience Act (DORA) has reinforced the importance of robust network and DDoS protection. Within the UK, the Cyber Security and Resilience Bill requires organisations to demonstrate that they can withstand cyber disruption, subjecting higher-risk organisations to stricter compliance measures. US regulation continues to emphasise the expectation for preventative cybersecurity controls.

Companies across industry sectors are therefore taking an increasingly proactive approach to their DDoS defence capabilities to mitigate the rapidly evolving DDoS landscape. Hacktivism associated with Russia's invasion of Ukraine has exacerbated the DDoS attack threat level in Europe. Attacks are also widespread in other key regions where Corero is actively growing its influence - including the Middle East and Latin America as a result of digital expansion and increasing connectivity across these regions.

Demand for resilient and adaptable DDoS defence solutions also remains high in North America, where Corero has its highest customer and sales footprint. Hacktivism following geopolitical events also continues to represent a significant threat, with DDoS attacks in the US surging 800% following the US military action targeting Iran's nuclear facilities*.

Corero remains well-placed to leverage current market demand and the ever-increasing need for service availability.

*https://www.techradar.com/pro/security/mr-hamza-mysterious-team-bangladesh-and-keynous-led-a-massive-surge-in-ddos-on-us-businesses-following-an-attack-on-iran?utm.

Outlook

Corero exited 2025 with strong sales momentum having generated good sales growth in the second half of the year. Our sales pipeline remains strong, supported by a combination of our sales and marketing efforts alongside our growing partner network.

Global demand for DDoS protection continues to grow, and the Group remains focused on elevating its status as an effective and affordable solutions provider capable of combatting the most hostile of DDoS attacks.

Corero remains well-placed to capitalise on the global growth in cybersecurity threats. Following a strong second half in 2025, supported by a robust pipeline, sustained growth in the DDoS threat landscape and market demand, the Board remains confident in the prospects of the Group to deliver ongoing progress, notwithstanding ongoing global economic uncertainty.

Carl Herberger

Chief Executive Officer

23 March 2026

CONSOLIDATED INCOME STATEMENT

FOR THE YEAR ENDED 31 DECEMBER 2025

CONSOLIDATED STATEMENT OF COMPREHENSIVE INCOME

FOR THE YEAR ENDED 31 DECEMBER 2025

CONSOLIDATED STATEMENT OF FINANCIAL POSITION

AS AT 31 DECEMBER 2025

CONSOLIDATED STATEMENT OF CASH FLOWS

FOR THE YEAR ENDED 31 DECEMBER 2025

CONSOLIDATED STATEMENT OF CHANGES IN EQUITY

FOR THE YEAR ENDED 31 DECEMBER 2025

The share capital comprises the nominal values of all shares issued.

The share premium account comprises the amounts subscribed for share capital in excess of the nominal value, net of issuance costs.

The capital redemption reserve comprises the amount transferred from deferred shares on redemption of the deferred shares.

The share options reserve represents the cost to the Group of share options.

The foreign exchange translation reserve arises on retranslating the net assets of UK operations into US dollars.

The retained earnings are all other net gains and losses and transactions with owners not recognised elsewhere.

1.    General Information

This results announcement is presented in US Dollars ("$") rounded to the nearest $'000 unless otherwise stated which represents the presentation currency of the Group. The average $-GBP ('GBP') exchange rates used for the conversion of the Consolidated Monthly Income Statements for the year ended 31 December 2025 was between 1.23 and 1.36 (2024: between 1.25 and 1.32). The closing $-GBP exchange rate used for the conversion of the Group's assets and liabilities at 31 December 2025 was 1.35 (2024: 1.25).

This results announcement has been prepared in accordance with UK adopted international accounting standards in conformity with the requirements of the Companies Act 2006. The "requirements of the Companies Act 2006" here means accounts being prepared in accordance with "international accounting standards" as defined in section 474(1) of that Act, as it applied immediately before Implementation Period (IP) completion day (end of transition period), including where the Company also makes use of standards which have been adopted for use within the United Kingdom in accordance with regulation 1(5) of the International Accounting Standards and European Public Limited Liability Company (Amendment etc.) (EU Exit) Regulations 2019. The consolidated financial statements have been prepared under the historical cost convention.

The financial statements have been prepared on a going concern basis.

The Directors have prepared detailed income statement, balance sheet and cash flow projections for a period of at least 12 months from the date of approval of these financial statements (the 'going concern assessment period'). In making this assessment, the Directors have reviewed the Group's financial position, liquidity and cash flow forecasts, including the most recent Board-approved budgets and forecasts. These forecasts reflect management's expectations of future trading performance and include assumptions relating to revenue growth, operating margins, operating costs and the Group's transition to a subscription-based revenue model.

The Directors have taken into account the current macroeconomic and geopolitical environment, including ongoing geopolitical tensions such as the conflict in Ukraine, instability in parts of the Middle East, and broader global trade and market volatility. The Directors note that the demand for cybersecurity solutions remains resilient, given the critical nature of network security and the increasing prevalence of cyber threats.

The Directors have also considered downside scenarios, including lower-than-forecast revenue growth and delays in customer procurement, together with mitigating actions available to management. These mitigating actions include the ability to manage discretionary expenditure and adjust the timing of investment, as demonstrated in prior periods.

In addition, the Group has access to a £1.5 million overdraft facility, which provides additional headroom to support working capital requirements during the going concern assessment period.

On this basis, the directors have therefore concluded that it is appropriate to prepare the financial statements on a going concern basis. 

The financial information set out above does not constitute the Company's Annual Report and Accounts for the year ended 31 December 2025. The Annual Report and Accounts for 2024 have been delivered to the Registrar of Companies and those for 2025 will be delivered shortly. The auditor's report for the Company's 2025 Annual Report and Accounts was unqualified and did not contain an emphasis of matter paragraph nor any statement under Section 498 of the Companies Act 2006.

Whilst the financial information included in this results announcement has been prepared in accordance with UK adopted international accounting standards in conformity with the requirements of the Companies Act 2006, this announcement does not itself contain sufficient information to comply with UK adopted international accounting standards.

The Annual Report and Accounts for the year ended 31 December 2025 are available on the Company's website https://www.corero.com/about/investor-relations.

The information in this results announcement was approved by the Board on 23 March 2025.

2.    Segment reporting and revenue

The Group is managed according to one business unit, Corero Network Security, which makes up the Group's reportable operating segment. This business unit forms the basis on which the Group reports its operating segment information to the Board, which management consider to be the Chief Operating Decision maker for the purposes of IFRS 8 Operating Segments.

The Group's revenues from external customers for the country of the Group's domiciles and each individually material country (those comprising 10% or more of Group revenues) are as follows:

Revenues from external customers are identified on the basis of invoicing systems and adjusted to take into account the difference between invoiced amounts and deferred revenue adjustments as required by IFRS.

The revenue is analysed as follows for each revenue category:

The revenue is analysed by timing of delivery of goods or services as: