F-Secure Initiation of coverage 3/2018

Page created by Troy Miller
 
CONTINUE READING
F-Secure
Initiation of coverage
              3/2018
New strategy in acceleration phase                                                                            F-Secure Company report               9 March 2018

The shift in the focus of the information security market from blocking threats to detecting them has
required considerable regeneration from F-Secure. The company launched a strategy intended for                Analysts
the growing corporate security markets in 2015 to respond to the change, and that strategy has
now reached a stage where growth can be accelerated thanks to an expanded product and service                 Mikael Rautanen
portfolio. However, the company still has to unify its solution portfolio and develop a sales channel         358 50 346 3460321
for the larger enterprise segment before the alluring growth potential of the market is fully realized.       mikael.rautanen@inderes.fi
Information security company turning into a cyber security solution provider
Through its history, F-Secure has developed a strong expertise, reputation and brand in preventing            Atte Riikola
malware and cyber security threats. The company’s business model focusing on endpoint protection
products is very stable, as well as recurring and scalable by nature, which provides the company with a       +358 44 5934500
good base to invest in the growth areas of the cyber security market. The shift in the market from            atte.riikola@inderes.fi
blocking threats to detecting and reacting to them also creates challenges and change pressure for an
established supplier like F-Secure that has historically focused on the consumer business. Customer           Rating and target price
demand is shifting from point technology solutions towards acquiring cyber security as a
comprehensive process. In order to respond to the change, F-Secure must continue developing and
unifying its product and service portfolio, shift its focus towards medium sized and large enterprises and
                                                                                                              Accumulate
develop its organization.                                                                                     Previous: -

Value is created through growth in corporate security                                                         EUR 3.90
In the current market situation, F-Secure sees the best value creation potential in strong net sales          Previous: -
growth on the corporate security markets. F-Secure’s current corporate security products and services
(43% of net sales) are, in our view, very competitive, and the recently expanded portfolio creates cross-
selling possibilities but the company must continue investing in strengthening the product portfolio and      Share price: EUR 3.65
in the sales channel. In consumer security (57% of net sales), the company aims at stable growth and          Potential: 6.8%
strong profitability. In line with its strategy, F-Secure invests considerably on the corporate side aiming
for an annual growth of over 15%, while maintaining group level profitability positive with the help of the
consumer business.                                                                                            Key indicators
                                                                                                                                    2016    2017       2018e       2019e
Excellent growth outlook for the industry but also signs of overheating
                                                                                                              Net sales             158.3   169.7      182.0       196.6
Cyber security companies are solving one of the biggest problems of digitizing society, which is why the       Growth %             7.2%    7.2%        7.2%        8.0%
demand fundamentals of the market are excellent in a big picture. The size of the global cyber security       EBIT                   19.2    11.1       10.0        15.2
market is around USD 89 billion and is growing by some eight per cent annually. F-Secure’s business is         EBIT %               12.1%   6.5 %      5.5 %       7.7 %
focused on more established product segments that grow more slowly than the overall market, and the
                                                                                                              Profit before taxes   20.8    11.9       10.7        15.9
company’s investments in growth areas are still in their early stage. The cyber security sector is turning
                                                                                                              EPS (EUR)             0.10    0.07       0.05        0.08
challenging as an investment object despite the growth outlook. We see a risk that the current, partially
                                                                                                              Dividend (EUR)        0.12    0.04       0.04        0.05
extremely high valuation levels of the sector are not sustainable when competitive pressure increases
after the investment wave seen in the industry in recent years.                                               P/E (adjusted)        34.6    57.0       71.5        48.1
F-Secure optimizes shareholder value between growth and profitability                                         P/B                    7.2     8.8       8.0          7.4
                                                                                                              EV/S                   2.8     3.1       2.6          2.4
The growing corporate cyber security markets are now being allocated and shareholder value is                 EV/EBITDA             18.4    29.9       28.9        21.5
created through the right balance between growth and profitability. We initiate our coverage of F-            EV/EBIT               23.5    46.8       47.5        30.8
Secure with a cautiously positive view as the valuation of the share already reflects moderate growth         Dividend yield %      3.4%    1.0%       1.1%        1.4%
expectations (EV/net sales 2018e 2.6x). We require the company to showcase strengthening growth in            Source: Inderes
corporate security generated by new products before we can take a bolder stand on the share.
Share price development                                                        Net sales and operating profit                                            Valuation and dividend yield
                                                                                                                                                                                             3,4 %

                                                                                                                                                       Valuation multiple Dividend yield-%
                                                                                                   19                                     21
5,0
                                                                                                                               15
4,5                                                                                                                                                                                                                                  1,8 %

                                                                                     EBIT
                                                                                                            11      10                                                                                                     1,5 %
4,0                                                                                                                                                                                                  1,0 %       1,2 %
3,5
3,0                                                                                                                                       213                                                                    72x                 P/E
                                                                                                                     182       197
2,5                                                                                                158      170                                                                                      57x                             EV/EBIT

                                                                                     Net Sales
2,0                                                                                                                                                                                                     47x          47x    48x
1,5                                                                                                                                                                                          35x                               31x    35x
                                                                                                                                                                                               23x                                      22x
1,0
      3/13

              9/13

                     3/14

                            9/14

                                   3/15

                                          9/15

                                                 3/16

                                                         9/16

                                                                3/17

                                                                       9/17

                                                                              3/18
            F-Secure                                    OMXHCAP                                    2016     2017    2018e     2019e      2020e
Source: Reuters
                                                                                                                                                                                              2016   2017         2018e     2019e     2020e

                                                                                                          Value
             MCAP                                        EV                                                                                      Risk factors                                                              Valuation
                                                                                                          drivers
         572                                      475
      EUR million                                       MEUR                                    Strong growth in                     Transformation process                                                    Valuation levels in sector
                                                                                                 corporate security                    from consumer security to                                                  high, not much room for
                                                                                                Demand outlook for the                a cyber security company                                                   valuation multiple
                                                                                                 corporate security                    not finished                                                               expansion
                                                                                                 market strong                        Tight competition and rapid                                               F-Secure’s conscious
             EV/S                                  EV/EBIT                                                                             market change in
                                                                                                F-Secure has good                                                                                                growth investments
        2.6x                                      48x                                            preconditions to invest in            consumer security
                                                                                                                                      Success of investments in
                                                                                                                                                                                                                  burden the profit
             2018e                                      2018e                                    growth                                                                                                          Growth speed most
                                                                                                                                       corporate security
                                                                                                Consumer security                                                                                                important value driver for
                                                                                                                                      Cyber security market
                                                                                                 creates stable cash flow                                                                                         the share
                                                                                                                                       potentially over-invested at
                                                                                                Scalable and sustained                                                                                          We see a slight upward
                                                                                                                                       the moment
      Source: Inderes                                                                            business model by                                                                                                potential if the strategy
                                                                                                                                                                                                                                               3
                                                                                                 nature                                                                                                           progresses as planned
Contents

Company description and business model   pp. 5-13
Investment profile                       pp. 14-17
Industry                                 pp. 18-23
Competition                              pp. 24-27
Strategy                                 pp. 28-31
Historical development                   pp. 32-35
Estimates and valuation                  pp. 36-40
Tables                                   pp. 41-45
Disclaimer and rating history            p. 46

                                                     4
F-Secure in brief
F-Secure is a company that offers cyber security products and services, whose solutions help
thousands of companies and millions of consumers to protect themselves from security
threats.
                                                                                                                                  Cloud storage business sold in

1988                         1999                                 Endpoint protection focused antivirus company
                                                                                                                                  2015

Year of                      IPO                                                                                                  Transformation into a more
                                                                  Focus on consumer customers
                                                                                                                                  versatile provider of cyber
establishment
                                                                                                                                  security products and services

EUR 169.7                million (+7.2% vs.                                    Expansion into cloud storage markets
                                                                                                                                  Focus on growing corporate
                                                                                                                                  security markets
                                                          200
2016)
NET SALES 2017                                            180

+16.4% 2015 to 2017                                       160
                                                                                                    16           19      16        2
                                                          140                               13
Average growth of net sales from corporate                                          4                                                                         97
                                                                          2
security                                                  120                                                                                         97
                                                                                                                                            96
                                                          100                                                                      96
                                                                                           86       94           92      92
                                                                                    78
EUR 11.1 million (6.5% of net                              80    66
                                                                          74

sales)                                                     60

OPERATING PROFIT 2017                                      40                                                                                                 85
                                                                                                                                                      73
                                                                                                                                            63
                                                                 47      50         49     47       47           45      46        52
                                                           20

1,104                        57% / 43%
                             Share of
                                                           0
                                                                2008    2009       2010    2011    2012      2013       2014     2015      2016      2017    2018e
Personnel at the end         consumer/corporate
of 2017                      security in net sales 2017                 Corporate
                                                                       Yritystietoturva     Consumer
                                                                                           Kuluttajatietoturva        Pilvitallennus
                                                                                                                       Cloud storage (lopetetut
                                                                                                                                        businesstoiminnot)
                                                                        Security            Security

Source: F-Secure / Inderes
                                                                                                                                                                     5
Company description and business model 1/6
Company description                                   passed security and reacting to them. The
                                                      corporate security market is, therefore, growing
Software company focusing on cyber security           strongly. In consumer security, the market is
                                                      extremely mature and growth is slow.
F-Secure is a cyber security software company                                                                        Market change
established in 1988. The company’s roots are          F-Secure has reacted to the market change. In
deep in antivirus software, where the company         2015, the company started transforming from an
has operated since it was founded and, in             antivirus company towards a company that offers
practice, for as long as computer viruses have        more versatile cyber security services and           Previously
existed. Through its history, the company has         products and focused its growth investments on
developed a strong reputation and brand in            the growing corporate security markets. This         ✓   Mass viruses
preventing malware and information security           transition has required a change in the company’s    ✓   Prevention
threats and in how malware develop and how            organization, mindset, product offering and          ✓   Data security is technology
their industrial logic works. F-Secure’s antivirus    strategy.
                                                                                                           ✓   Point solutions
software for endpoints have won numerous
awards in international information security tests    The change process required by the market
and the company’s endpoint protection products        disruption is still ongoing at F-Secure. Thanks to   Now
have been sold to millions of consumer and            its history, the company’s clear strength is its
                                                      stable and profitable consumer business, as well
hundreds of thousands of companies worldwide.                                                              ✓   Intelligent, targeted attacks
                                                      as established position and well-known brand on
Historically, F-Secure’s business has focused on      the security markets. In corporate security, many    ✓   Attack detection
strong antivirus know-how, where the basis is the     competitors are clearly unprofitable and             ✓   Cyber security is a process
prevention of attacks and threats. However, a         dependent on external financing when investing       ✓   Complex wholes
paradigm shift is ongoing on the information          aggressively in growth, while F-Secure can make
security markets, where the assumption that all       similar investments in this area with cash flow.
attacks could be prevented has become
impossible. With the development of technology,       In light of current market trends, the shift in F-
malware and hacking have also become clearly          Secure’s strategic focus to the growing corporate
smarter and constantly evolving, which is why it is   business could have started earlier as the                   F-Secure's transition
practically impossible to prevent all modern          company was still in the early 2010s investing
attacks in advance with security software. Thus       heavily in the consumer business, for example, in
                                                      cloud storage. Expansion into the cloud storage       Focus from consumer security to
the market is shifting from attack prevention
increasingly towards detection and a mindset          business and selling of this business in 2015 did,     enterprises
where cyber security is seen more as processes        however, create clear shareholder value and           New product areas (detection)
than products. This has been an important             provided the company with capital to invest in
                                                      growth in corporate security.
                                                                                                            Uniform products and services
change for the market and F-Secure.                                                                         Services next to products
Especially on the corporate security markets
focus has shifted from preventive blocking of
threats to quick detection of threats that have
                                                                                                                                               6
Company description and business model 2/6
                                                                                                                                   Distribution of revenue
Business model                                        Sales, marketing and distribution channels
                                                                                                             200

Two business areas                                    F-Secure is currently investing heavily in
                                                      increasing the net sales from corporate security       150
                                                      and the company has clearly increased its                                                                          97
F-Secure’s business currently comprises                                                                      100                                  96
                                                                                                                                                            96
developing, offering and selling of corporate         resources in terms of sales and marketing in                        92          92
security products and services, as well as            recent years. At the end 2017, altogether 636           50
consumer security products. The company’s basis       persons worked in sales and marketing (including                    45          46          52        63           73
is the stable and healthy antivirus products          consultants), which corresponds with 58% of the         0
business on top of which it is building its current   company’s employees. Sales and marketing                           2013        2014       2015       2016          2017
growth strategy.                                      expenses amounted to EUR 105 million in 2017 or
                                                                                                                             Yritystietoturva
                                                                                                                               Corporate           Kuluttajatietoturva
                                                                                                                                                    Consumer
                                                      some 62% of net sales.
In 2017, the company’s net sales were EUR 170
million and operating profit was EUR 11 million.      F-Secure sells its corporate security products                                Number of employees
The share of corporate security in the company’s      through an extensive retailer network, which           1200
net sales was 43% and that of consumer security       globally consists of over 6,000 IT service
                                                                                                                                                                         108
was 57%. On the corporate side, company growth        partners. The task of the company’s own sales          1000                                            131
has been strong and on the consumer side              organization is to support and provide services         800
                                                                                                                            136       127         147                    360
stable. Net sales is by nature very continuous and    for the retailers, as well as develop and grow this                                                   325
                                                                                                              600          366        325         279
is based on annual licenses of various durations      network in order to accelerate the growth in
and, increasingly, on monthly SaaS fees.              corporate security products. Critical in terms of       400
Geographically the company focuses on Europe.         success is that selling of F-Secure’s products and                                          500       570          636
                                                                                                              200          437        469
The share of the Nordic countries in the              related services is good business for the retailers.
company’s net sales was 37% and that of the rest      The current clientele of F-Secure’s data security            0
of Europe was 41% in 2017. The remainder of net       products consists mainly of small companies but                      2013       2014        2015      2016         2017
sales came from North America (10%) and               the company is shifting its focus towards medium
elsewhere in the world (12%). At the end of 2017,     sized and large companies with its new security                  Myynti
                                                                                                                        Sales ja markkinointi
                                                                                                                               and marketing      Tuotekehitys
                                                                                                                                                   R&D                Administration
                                                                                                                                                                     Hallinto
the company had 1,104 employees of whom 636           products, which requires development of the
worked in sales and marketing, 360 in product         existing retailer channel. The company primarily                     Geographic distribution of revenue
development, and 108 in administrative tasks.         offers cyber security consultation as direct sales       200
                                                      through its own sales organization.
The company's strategic focus in terms of growth                                                               150
lies in corporate security, where the market is       In consumer security, a majority of net sales is
growing rapidly. Consumer security is, however,       created globally through a network that covers           100
an important pillar for F-Secure, where the           over 200 operators, which is one of the
                                                      company’s key strengths and competitive                      50
company is aiming for moderate growth in line
with the market and good profitability and cash       advantages. F-Secure started building a sales
                                                                                                                   0
flow, which in part can be used to finance the        channel through operators already at the                              2013       2014       2015      2016         2017
growth investments in corporate security. The         beginning of the 2000s and its operator network
synergy between the consumer and corporate            is clearly the largest compared to other cyber                           Pohjoismaat
                                                                                                                                Nordic             Muu Eurooppa
                                                                                                                                                    Other Europe
business derive primarily from shared                 security companies. Consumer products are also
technologies.                                         sold through many partners operating online and                          Pohjois-Amerikka
                                                                                                                                USA                Muu Maailma
                                                                                                                                                    Other countries               7
Partners                            Operations                          Business idea                     Customer                                 Products
                                                                                                                        segments
                                                                                                                                                               Protection Service for
                                                                       F-Secure offers a comprehensive                                                         Business, Business Suite
                                            R&D                           selection of cyber security
                                                                                                                        Large companies and           Endpoint protection products
                                                                        solutions and services to both                  governments
                                                                         enterprises and consumers.
                                                                                                                                                               Rapid detection service
      IT service partners                Sales and
                                         Marketing                                                                                                     Detection of and responding to cyber-
                                                                                                                          Small and medium             attacks as a managed service
                                                                    Solid expertise in virus     New products for         sized companies                     Endpoint detection &
                                    F-Secure Labs                         prevention              detection and                                               response (2018)
                                    research center                                                 response
                                                                                                                                                       Automated alarm system for
                                                                                                                                                       endpoints
                                                                                                                           Consumers
                                                                                                                                                                F-Secure Radar
         Telecom operators                   Resources
                                                                                                                                                       Vulnerability management
                                                                                                                         Go-to-market
                                    Long-term cyber
                                    security expertise                                                                 Corporate security                    Cyber security consultation
                                                                         Ability to deliver      High value added                                            Focus on more challenging
                                                                      comprehensive product    services complement      Retailers                            cyber security customers
                                         Cyber security
                                                                       and service packages        the products         +6,000 IT service partners
                                         technology and
                                                                                                                                                               F-Secure Cloud Protection
                                         software
                                                                                                                                                               for Salesforce
          Retailers                                                                                                  Consumer security
                                          Extensive retailer                                                                                               Securing cloud platforms
                                          network                                                                         Retailers
                                                                                                                          +200 operators
                                                                                                                                                            F-Secure Safe, Key,
                                           Strong brand,                                                                  Retailers
                                                                                                                                                            Freedome and Sense
                                           especially in Europe                                                          Own online store              Cyber security solutions for
                                                                                                                                                       consumers
                                                        Cost                                                          Income flow
         1,104 employees (2017)                      structure      MEUR -160.6 (2017)                                                                       Net sales 170 MEUR
                                                                                                  43% (2017)               57% (2017)                        EBIT 11.1 MEUR (2017)
                                                                                                                                                                         Pohjoismaat
                                                                                                                                                                          Nordic
                                                                                                                                                   12%
                                                                                                                                                10%           37%        Muu Eurooppa
                                                                                                                                                                          Other Europe

                                                                                                                                                                          North-
                                                                                                                                                                         Pohjois-
Materials and services       Sales and               Research and      Administration            Corporate              Consumer security                                 America
                                                                                                                                                                         Amerikka
                                                                                                                                                     41%                  Other
                                                                                                                                                                         Muu Maailma
          (3.9%)*            Marketing               development                                 security
                                                        (20.4%)*       (8.4%)*                                                                                            countries
                              (61.9%)*
  Source: Inderes                                                        *% of net sales
Company description and business model 3/6
retailer partners, and also increasingly in the       products and develop new products. The more            Products
company’s own online store.                           data the products that are in use produce, the
                                                      more efficiently it can find vulnerabilities and the   F-Secure offers its corporate security products
Product development                                   better existing products become. This is an            through an extensive retailer network, which
                                                      important distinguishing factor in the business        globally consists of over 6,000 IT service
In 2017, in all, 360 F-Secure employees worked                                                               partners. F-Secure’s corporate security product
                                                      model when comparing F-Secure with software
with product development and product                                                                         selection includes:
                                                      companies that sell their software products with
development costs (EUR 35 million)
                                                      the conventional linear business model. This is
corresponded with some 20% of net sales. In its                                                              • Cloud-based and locally managed endpoint
                                                      particularly true for endpoint protection products
product development, the company focuses in                                                                    protection products (Protection Service for
                                                      where the economies of scale are considerable.
particular on developing the features of existing                                                              Business and Business Suite)
                                                      In detection products, the company’s products
corporate security products and launching new
                                                      are tailored to the customer’s network                 • Managed detection and response solutions
products on the markets. The main focus lies on
                                                      environment over time with the help of machine           (Rapid Detection Service, RDS)
developing products that detect and respond to
                                                      learning, which also creates strong ties to the
security threats. Another key development target
                                                      customer. These factors generate an important          • Automated tool for detecting and responding
is better harmonization of the product portfolio in
                                                      competitive edge in the company’s business               to malicious hacking to be released this year
order to be able to offer more comprehensive
                                                      model.                                                   (Endpoint Detection and Response, EDR).
cyber security solutions to customers. In
consumer security, there is low pressure to
increase product development investments in           Corporate security                                     • Vulnerability management solution (F-Secure
                                                                                                               Radar)
protection products for endpoints but the             F-Secure’s corporate security business consists
company also invests in certain product areas on      of product business, managed services, where           • Solution for securing cloud platforms (F-
the consumer side (like the Sense security router).   the product and service are combined, and pure           Secure Cloud Protection for Salesforce)
F-Secure’s core technologies, especially in           service business. The product business is              Protection Service for Business and Business
detecting malware, are basically very similar both    excellently scalable due to replicability. Managed     Suite
in consumer and corporate security products,          services are also easily scalable and F-Secure’s
which creates a lot of synergy in product             products have in this category been designed so        A majority of F-Secure’s corporate security net
development. F-Secure’s consulting business also      that the company’s retailer or integration partner     sales currently comes from selling of protection
enriches product development as F-Secure’s            (IT service provider) is primarily responsible for     products for endpoints, the demand of which is
consultants can investigate security breaches that    delivering the service components and F-Secure         stable and the market is growing moderately.
have never been seen before at large companies        only offers certain service components that            These products represent F-Secure's core
and transfer the knowledge they gained to             require specialized expertise. In its consulting       competence, virus prevention, and are an integral
product development.                                  business, the company focuses mainly on                part of the company’s product portfolio. Products
                                                      delivering services requiring the highest level of     are sold with annual licenses of various lengths
F-Secure’s business model includes considerable       expertise, where the price levels for the              and as continuous subscriptions valid until further
economies of scale and network effects on             consultants can be really high compared to             notice (SaaS). Traditionally, a majority of the total
product development. The company’s products           conventional IT service operations. The transition     volume is fixed-term licenses whose renewal
daily collect vast amounts of data from               from “cyber security as a technology” towards          rates are a key indicator for the company. Our
customers’ online traffic that are processed with     “cyber security as a process” will in future also      view is that the renewal rates have constantly
the help of AI and machine learning in order to       blur the line between products and services in F-      been on a good level. The market is, however,
detect malware and security threats. With the         Secure.                                                strongly shifting towards deliveries based on
help of processed information from this constant                                                             continuous monthly licenses.                            9
data stream, F-Secure can refine its existing
Company description and business model 4/6
The customer target segment for these products         by nature, where technology plays a big role.          energy and IT. The biggest challenge in our view
are small and medium sized companies and F-            Sensors are installed in the customer’s IT             is that the target group for RDS is in the size
Secure’s endpoint protection products are used         networks and endpoints, which collect and              category of large companies where F-Secure
by over 100,000 companies globally. The size           stream data to F-Secure’s data center, where AI        does not yet have a strong partner and
category of annual contracts vary from hundreds        and machine learning are used to find anomalies        distribution network.
of euros to some tens of thousands of euros.           in the company’s data communications that could
                                                       indicate security threats that have passed into        F-Secure’s competitors in this product category
Competition is tight in endpoint protection            the system. In addition, honey pots can be             come mainly from USA and the main competitors
products and the field is quite established. F-        installed in the customer’s network, which help        include Darktrace, Crowdstrike, Carbon Black
Secure’s competitors are numerous companies            detect if some external party tries to hack into the   and FireEye. According to F-Secure, it
that offer antivirus software, like Symantec,          customer’s systems. F-Secure’s data center             distinguishes itself from its competitors with its
Kaspersky, McAfee, Sophos and Trend Micro. F-          monitors customers’ data environments 24/7 and         strong technological expertise in antivirus, which
Secure’s customer base in this product group           when it detects a possible threat it notifies its      means that RDS’ detection ability of cyber-attacks
focuses heavily on small companies, where the          service partners whose job it is to react to the       is very good. In addition, in Europe the company
role of the retailer is emphasized in the              customer’s security alert. RDS’ sensors collect a      has competitive advantage against its
customer’s purchase decision. Customers’ know-         huge amount of data daily and the overall picture      competitors in that geopolitical factors may affect
how in cyber security issues is typically low and      of the customer’s data communications becomes          the decision making of some customers.
the purchase decision is often made based on           clearer over time. Through machine learning, the
the price or the retailer partner’s                                                                           Endpoint Detection and Response (EDR)
                                                       product increasingly becomes better tailored to
recommendation, which means that management            the customer's environment and thus the                This year, F-Secure will launch an automated tool
and development of the retailer channel is an          customer’s threshold to switch to another              for detecting and responding to malicious
important factor in the competition. Comparisons       product grows over time.                               hacking (Endpoint Detection and Response,
made by research institutes that test security
                                                                                                              EDR). The product is largely based on the same
software also affect customers’ purchase               RDS is suitable for companies whose security
                                                                                                              technology as RDS but it does not include the
decision in this product group. F-Secure’s             requirements are high and the target group are
                                                                                                              service component and is scalable to smaller
endpoint protection products have performed            companies with more than 1,000 employees. The
                                                                                                              companies as well through automation. EDR acts
very well in security tests within the industry (AV-   size category of the contracts is around EUR one
                                                                                                              as an additional ability on top of endpoint
Test, AV-LAB PL, V3) over the years and their          hundred thousand and for the largest customers
                                                                                                              protection products and on the markets this
ability to detect malware are of world class           clearly higher. RDS still has a small weight in the
                                                                                                              product area is integrating with endpoint
compared with the competition.                         company’s business as it is a relatively new
                                                                                                              protection products. F-Secure has designed its
                                                       product but thanks to the large size of the
Rapid detection service (RDS)                                                                                 EDR product so that it is also compatible with the
                                                       contracts its importance in the growth of
                                                                                                              endpoint protection products of its competitors.
                                                       corporate security was already considerable in
RDS is F-Secure’s first product launched in 2016                                                              This distinguishes F-Secure in the competition
                                                       2017. F-Secure’s expectations concerning the
to respond to the paradigm shift on the security                                                              and makes it easier to sell the product to parties
                                                       product are high, and the company invests
markets, where mere prevention of malware and                                                                 that are not using F-Secure’s endpoint protection
                                                       heavily in its continuous development and sales.
malicious hacking is evolving into quick detection                                                            software.
                                                       F-Secure has already managed to attract
of threats that have passed the security and
                                                       customers to RDS, e.g. from banking, media,
responding to them. RDS is a managed service

                                                                                                                                                                    10
Company description and business model 5/6
The operating principle of EDR is highly similar    information security. The product scans the           who own critical IT systems cyber security
to RDS but when the product detects an              company’s network and endpoint data against a         consulting. In consulting, F-Secure focuses
anomaly in the company network the                  vulnerability database and notifies when it finds     primarily on the most demanding customers and
information is automatically delivered to the       vulnerabilities (e.g. software versions that have     security issues and the company tries to hire the
company’s IT head, while in RDS F-Secure’s own      not been updated and that have vulnerabilities).      most respected cyber security consultants in the
experts help with detection. The product also       Radar was transferred to F-Secure in 2015 in          world, whose expertise companies are ready to
gives the IT head instructions on how to            connection with the nSense acquisition and the        pay high fees for. The focus of F-Secure’s
respond to the security threat. The product is      sales of the product has grown well. In a big         consulting lies in the most demanding security
suitable for companies of all sizes but the main    picture, F-Secure faces large competitors in          problems and the strategic goal is not to expand
target group will be small and medium sized         vulnerability management that focus only on this      its service business to compete with regular IT
companies whose cyber security budget is too        segment (Rapid7, Tenable), and the company's          service companies, even if the company’s
small for acquiring RDS.                            main focus is not to start competing directly with    service offering is sometimes overlapping with
                                                    these large players. F-Secure sees integration of     these. More extensive cyber security service
Next to RDS, F-Secure’s EDR holds center stage      Radar’s functionalities into the company’s            packages are offered by consultancy companies
in the company’s growth strategy for corporate      endpoint protection products, as well as RDS          (like KPMG), IT generalists (like CGI) and
security. If successful, the product has            and EDR as the potential of Radar. This could         specialized players (like Nixu).
considerable growth potential as the product        generate a considerable competitive edge
market is still in an early development stage       against other antivirus-based competitors that        The demand for consulting services is strong
and, for example, the market research company       do not have capabilities in vulnerability             and growth is constantly restricted by the
Gartner has estimated that the number of            management. This product integration requires         availability of experts. F-Secure already has
endpoints with detection ability will grow          more product development investments from             hundreds of large corporate customers in its
manifold in coming years and that the EDR           the company and, thus far, Radar’s importance         consulting services. The company has not
markets will grow at an annual rate of 45% in the   for the company’s business is still relatively low.   revealed the size class of the business but the
next few years. F-Secure is now investing                                                                 net sales of nSense that was acquired in 2015
heavily in completing the product in order to get   F-Secure Cloud Protection for Salesforce              was around EUR 7 million and the number of
a piece of this rapidly growing market segment.                                                           employees was some 70 (in 2014). The business
Also in this product category, F-Secure faces       F-Secure has developed cyber security                 has been growing heavily since the acquisition
competition on a wide front, as nearly all          capabilities into the Salesforce platform for         and it has been complemented with two small
competitors that offer endpoint protection          checking links and appendices for malware. The        acquisitions (Inverse Path, 2017 and Digital
products have EDR capability, in addition to        development is still at relatively early stages and   Assurance, 2017), so we can assume it currently
which, the developing and rapidly growing           the importance of the product as a whole is           employs over 100 persons and its net sales is
market constantly attracts new players. The         rather small at this stage. F-Secure also has         clearly above EUR 10 million.
weakness we see is that the company is only         other ongoing research projects to secure cloud
entering the EDR competition this year with a       platforms but the main focus in product               The services offered by the company include
slight handicap to its competitors.                 development lies in developing detection              cyber security audits, cyber security stress tests
                                                    capabilities and products related to them.            (Red Teaming), strategic risk and cyber security
F-Secure Radar                                                                                            management, cyber security in software
                                                    Consulting services                                   development and responding to hacking and
The vulnerability management solution Radar                                                               data leaks.
enables analyses of weak spots in companies’        F-Secure offers large companies and others

                                                                                                                                                               11
Company description and business model 6/6
F-Secure’s cyber security consulting also offers        operators. Consumer products are also sold            Operator channel
synergies with the product business. F-Secure’s         through many partners operating online and
consultants get to help companies in preventing         retailer partners, and also in the company’s own      F-Secure started building a sales channel through
the most challenging and completely new cyber           online store. The company’s products are used by      operators already at the beginning of the 2000s
security attacks and threats and this know-how          millions of consumer customers across the world.      and its operator network is clearly the largest
can be utilized in product development when             The main products in the company’s current            compared to other security companies. In
developing new cyber security products. F-              product portfolio are:                                consumer security, operators sell F-Secure’s
Secure’s ability to offer consulting services offers                                                          products as part of their own continuous cyber
the company a competitive advantage against             • Endpoint protection product, F-Secure Safe          security packages. Through the operator channel,
players who only offer cyber security products. In                                                            F-Secure receives extensive distribution and
                                                        • Privacy protection product (VPN), F-Secure          volume for its products, and, thus, the replicability
addition, consulting offers cross-selling
                                                          Freedome                                            and scalability of the products enable good
possibilities with the products. Consulting also
polishes F-Secure’s brand towards a more                                                                      profitability even though the operators take a
                                                        • Password management product, F-Secure Key
comprehensive cyber security company.                                                                         rather large share of the gross sales of the
                                                        • Data security router that protects all smart        products as they are responsible for the lion’s
F-Secure’s cyber security consulting is still             equipment in the home, F-Secure Sense               share of product marketing. For operators, co-
primarily a project driven business but the                                                                   operation with F-Secure is also fruitful as by
company is constantly trying to make continuous         A majority of net sales in consumer security          offering cyber security packages in connection
consulting agreements with its customers.               comes from selling endpoint protection products       with broadband subscriptions operators have, in
                                                        (Safe). The sales of Freedome and Key was             addition to profitable additional sales, been able
Total solutions for corporate security                  growing last year but we estimate that their effect   to improve the customer loyalty and satisfaction of
                                                        on the net sales of consumer security is still low    their subscriptions. In our opinion, the success of
F-Secure’s product portfolio is currently more
                                                        compared to Safe. An increasing number of             F-Secure’s product among operators is based on
extensive than ever. As the company moves from
                                                        customer are, however, switching to the               the fact that it solves two of the core problems of
smaller companies to larger ones, new demands
                                                        combination solution Total that includes both Safe    the operator business (average price and
are also created for the product portfolio as IT
                                                        and Freedome when renewing their order. This          customer churn).
decision makers are more willing to buy easily
                                                        product bundling is a key growth driver for
understandable and clear comprehensive                                                                        Direct sales channel
                                                        consumer security sales.
solutions than separate individual products. F-
Secure still has things to do in order to integrate     Sense, that was introduced to the market in 2017,     Consumer products are also sold through many
its product and service portfolio into a more           did not affect the net sales of the company’s         retailers operating physically and online. In
uniform whole in order for the company to better        consumer security last year but the company sees      addition, the company is increasingly selling its
sell comprehensive solutions (e.g.                      growing interest in the product as smart              products through its own online store, which
RDS+Radar+consulting). The current renewed              equipment increases in households. Expectations       means there are no middlemen between F-Secure
product portfolio already offers considerable           concerning the product are still cautious because     and the end customer. The competition on the
additional sales possibilities to existing customers.   the market for the product is in its infancy. One     market is extremely tough and customer
                                                        potential route for more extensive commercial         acquisition requires considerable marketing
Consumer security                                       distribution of Sense would be to offer Sense as a    investments, and various free products and
                                                        software that can be installed on the routers of      freemium models make the consumer market
Products                                                third parties.                                        challenging to reach through direct sales.
F-Secure offers cyber security products for
consumers through a network of more than 200                                                                                                                      12
F-Secure's business model
                                            Shared technology and product development

                                                          Management
                         Threat Research                                                 Analytics and
                                                          services
                         Lab                                                             monitoring platform
                                                          (companies)

                  Consumer security                            Corporate security products and services
                    57% of net sales 2017                                          43% of net sales 2017

         Privacy protection (F-Secure Freedome)                     Endpoint protection (EPP)

         Endpoint protection (F-Secure Safe)                                Endpoint detection and response (EDR)
         Password management (F-Secure Key)
                                                                                       Vulnerability management (Radar)
         Data security router (F-Secure Sense)
                                                                                                       Managed detection (RDS)

                                                                                                                                      Threat detection
                                                                                                                        IT            and sensor data
                                    Retailers and                                       IT service
       Operators                                              Retailers                                         integrators/direct     from millions of
                                    online store                                         partners                                     products in use
                                                                                                                 sales (services)

   Consumers                           Consumers              Small                  Medium sized                     Large
                                                            businesses                   (200-5,000)                businesses
                                                              (25-200)                                                 (>5,000)
     Product sales                    Product sales                                 Product and service         Product and service
                                                            Product sales
 (retail sales/revenue                                                                    sales                       sales
sharing with operators)

                                                                                                                                                     13
Source: Inderes
Investment profile 1/2
Challenging development stage to perceive            create more of a risk factor for the share.             responding to them has forced F-Secure to
                                                                                                             start a transition from a company focusing on
F-Secure is difficult to perceive for investors in   Strengths                                               antivirus products to a more comprehensive
the current development stage, as the share                                                                  cyber security company.
combines a stable cash flow business                 ▪ Strong expertise and products in virus
(consumers) with a business that is in a heavy         prevention technologies. F-Secure has              ▪ Transformation into a cyber security
investment stage with negative cash flow               award winning cyber security products, a             company still ongoing. The change requires
(corporate) and the company does not report the        strong brand in certain market areas, and            further development and integration of the
profitability of the businesses by segment. The        long experience in detecting malware.                company’s product portfolio, as well as sales
former of these is basically priced with earnings-                                                          investments, which depress profitability in the
                                                     ▪ A stable and established position in
based valuation ratios and operating margin on                                                              short-term. Also, as a brand, F-Secure is not
                                                       endpoint security gives the company good
the stock markets. The latter is priced with                                                                yet seen as a provider of corporate security
                                                       resources to expand F-Secure’s core
EV/Sales ratio and the growth percentage. So                                                                solutions.
                                                       competence and technology to new
the company is not a pure growth company but
                                                       segments and sell new solutions to the             ▪ The change process could have started
not a “matured” tech company either.
                                                       existing customer base.                              sooner. In light of the current market
F-Secure’s own objective is to continuously                                                                 situation, one could argue that the company
                                                     ▪ The business model based on scalability and
balance between growth investments and                                                                      should have started focusing the strategy
                                                       strong customer loyalty enables excellent
profitability, which ever is optimal for                                                                    heavily on the corporate side already earlier
                                                       profitability after the current investment stage
shareholder value at the time. We consider this                                                             in the 2010s in order for it to have a clearer
                                                       is successful.
approach to be sensible but difficult for                                                                   lead in the competition. F-Secure is now
shareholders to interpret. The share cannot          ▪ Hot and growing market. The rapidly                  entering certain product areas (like EDR) later
simply be priced with one method or multiple,          growing corporate security market and                than its competitors. On the other hand, the
value creation must be viewed as part of a             certain product areas within it offer strong         sales of the cloud storage business in 2015
bigger whole. In our opinion, the main drivers for     growth potential.                                    gave the company resources to start
the company’s value creation are the growth                                                                 investing in the corporate side.
rate (of corporate security) and the operating       ▪ Strong balance sheet and good cash flow
profit margin of the whole company, so a strong        offer leeway in growth investments and             ▪ The sales channel in corporate security for
growth rate compensates the weakness in                enable acquisitions when the opportunity             medium sized and large companies is still
profitability and vice versa. Currently, the stock     presents itself, while many smaller players in       being built.
market values growth rate very highly and it is        the sector depend on external financing. F-
                                                                                                          Opportunities
seen as a key value driver as the cyber security       Secure’s cash in hand and financial assets
market is seen to be on the threshold of strong        available for sale amounted to EUR 90 million      ▪ Successful growth in corporate security
growth and it is important for players to stake        at the end of 2017 and the company has no            creates shareholder value as the market for
out the market now.                                    interest-bearing debt.                               detection and response products is only
                                                                                                            emerging and market shares are handed out
We point out that the valuation multiples of F-      Weaknesses
                                                                                                            now. RDS and the coming EDR product are
Secure’s industry are already stretched high. A
                                                     ▪ Paradigm shift in the industry from prevention       the growth drivers in coming years. Radar
rise in the valuation levels in the sector should
                                                       of cyber security threats to rapid detection of      offers a potentially considerable competitive
no longer be seen as a value driver, they actually
                                                       threats that have passed security and                edge if integrated into the portfolio.
                                                                                                                                                              14
Investment profile 2/2
▪ Success in renewing and integrating the              for F-Secure's share. We caution that the
  product portfolio would also enable the              valuation multiples in the industry are in some
  company moving in the value chain more               cases stretched very high.
  towards larger customers and would
  accelerate the growth of corporate security. A     ▪ Competitive threat in consumer security and
  more integrated product portfolio would also         weak net sales growth: Free antivirus
  bring a competitive edge.                            software are one reason for slow growth on
                                                       the market for consumer security. Microsoft is
▪ New product areas, like the Sense security           constantly developing the features of the free
  router on the consumer side, can offer the           Windows Defender and this can in the
  company considerable scalable growth                 medium term affect consumers’ purchase
  potential.                                           decisions in consumer security. Despite this
                                                       and threat scenarios that have been discussed
▪ Inorganic growth through acquisitions could          for years, consumer security seems to remain
  generate shareholder value if successful. F-         a very vital business.
  Secure has a track record of successful
  corporate reorganization transactions that
  have generated value in the past and the
  company constantly scans for potential
  acquisition targets. The valuation levels of the
  industry are high at the moment and it is not
  easy to find suitable acquisition targets at the
  right price.
Risks
▪ The industry is potentially over invested,
  which can lead to a clear increase in
  competition in the next few years. In recent
  years, capital investors have invested several
  billions in hundreds of new cyber security
  companies and corporate transaction activity
  is high in the sector. The gold rush of new
  players can lead to tightened competition and,
  despite the growing market, there is not
  enough to go around.
▪ Dissolving of high valuation traps in the
  sector would probably have a negative effect
  also on the valuation accepted on the market

                                                                                                         15
Investment profile

                                                            Potential                  Risks
         Strong growth focus in corporate
1.       security                                           ▪ In corporate security,   ▪ The industry is potentially
                                                              strong growth now          over invested, which can
                                                              generates shareholder      lead to a clear increase in
      2.          Hot and growing market                      value                      competition in the next
                                                            ▪ Strengthening growth       few years
                                                              and competitive edge     ▪ Dissolving of the high
                   Scalable and sustained business            through renewal and
        3.         model                                      integration of product
                                                                                         valuation levels in the
                                                                                         sector could have a
                                                              portfolio                  negative effect on the
                                                            ▪ Strong demand outlook      share
                  Transformation from virus prevention to
      4.          a cyber security company still ongoing      on the market            ▪ Competitive threat in
                                                            ▪ Strong and stable          consumer security and
                                                              business in consumer       weak growth
           Strong cash flow provides capacity to              security
5.         invest in corporate security growth

Source: Inderes
                                                                                                                       16
Risk profile
                                          Risk profile of the business model
                                      Low risk level                            High risk level

                     Market                                                                       Strong demand drivers on
                     cyclicality
                                                                   1                              the market but tight
                                                                                                  competition

                     Net sales                                                                    Net sales is by nature continuous
    1 Net sales      continuity                          1
                                                                                                  and is based on annual licenses
                                                                                                  of various durations and monthly
                                                                                                  SaaS fees.

                     Net sales                                                                    Net sales comes from millions of
                     distribution
                                              1                                                   consumers and hundreds of
                                                                                                  thousands of companies

                     Scalability of                                                               Cost structure primarily
   2 Profitability   costs
                                                                       2                          fixed, marketing costs are
                                                                                                  flexible if necessary.

                     Cost structure                                                               Strategy aims at strong growth
                                                                           2                      at the expense of short-term
                                                                                                  result.

                     Capital                                                                      Operations tie a little capital and
                                              3                                                   working capital is negative.
   3 Capital         commitment
         structure
                                                                                                  Net debt-free balance sheet. At
                     Financing need
                                          3                                                       the end of 2017, the company’s
                                                                                                  net financial assets stood at EUR
                                                                                                  90 million.
                                                  Assessment of F-Secure’s overall
                                                  business risk                                                                  17
Source: Inderes
Industry 1/4
Market                                               Market segments                                       In the big picture, market growth is the result of 1)
                                                                                                           data security issues playing an important role for
Market definition, size and growth                   The target groups of the cyber security market        an increasing number of industries when
                                                     can be roughly divided into three parts in a          planning new digital businesses and 2) the rising
Cyber security companies are solving one of the      pyramid model based on the intelligence of            trends on the IT markets (industrial Internet of
biggest problems of the digitizing society. Big      attacks and technologies. The intelligence of         things, social media, digital commerce) force
problems always also means big business              attacks and technologies also broadly correlates      organizations to pay more attention to data
opportunities, which makes the market extremely      with the size of the customer organizations as        security. In the segment of targeted attacks
interesting, dynamic and rapidly growing.            the biggest organizations and state                   (large and medium sized organizations), cyber
                                                     administration are typically the main targets of      security cannot be solved only with mass
Cyber security refers to processes, technologies,    cyber criminals. For organizations at the top of      solutions. The information security budgets of
solutions and services that protect companies’       the hierarchy, solutions that have been created       companies in this segment are annually roughly
and other organizations’ or individual users’ data   for the masses at the bottom of the hierarchy do      around EUR 1 to 5 million, which makes this
against criminality that occurs in electronic        not offer sufficient protection levels.               segment attractive to companies that offer cyber
networks. Cyber threats can be divided into three    Correspondingly, the solutions focusing on the        security products and services. F-Secure has
categories: 1) criminality that aims at financial    top levels of the hierarchy are too expensive for     expanded into this segment in recent years
profit, 2) hacking that aims at disrupting           organizations whose activities do not require a       through acquisitions (consulting service) and a
companies’ or governments’ activities, and 3)        high protection level. The development of new         wider product portfolio (e.g. RDS).
spying that aims at gaining a competitive            technology focuses on the more demanding top
business advantage or discovering government         level segments after which the technology is          The most important segment for F-Secure at the
security secrets. The number of cyber threats        duplicated to the lower levels for broader            moment is the lowest level of the triangle that
and their intelligence is constantly growing and     segments.                                             includes small and medium sized companies and
the market is, in practice, driven by an endless                                                           consumers. For small companies and consumers,
race between criminals and cyber security            The top of the cyber security market is               the main thing is to be protected against mass
technologies and processes.                          represented by state espionage and the defense        attacks, which can be done with regular “off the
                                                     industry. This is a niche market from the             shelf” cyber security products like endpoint
The cyber security market develops quickly and       viewpoint of cyber security companies but it          protection products and firewalls. A majority of F-
the estimates on the total market size and growth    represents the highest technology and level of        Secure’s net sales still comes from endpoint
vary dramatically. The market research company       expertise and is thus important. The largest          protection products.
Gartner estimates that the global size of the        volume of the market is found in the center part
cyber security market was USD 89.1 billion in        of the pyramid that covers targeted attacks. In       Among medium sized companies the need for
2017 and it is expected to grow at an average        this case, the primary target group is in practice    higher cyber security than mere endpoint
annual rate of 7.9% in 2016 to 2021. The share of    all large organizations and public administration,    protection is growing, but the data security
consumer security is USD 4.6 billion and it is       and in particular the actors whose activities         budgets (EUR 0.1 to 1.0 million) are clearly lower
expected to grow at an annual rate of 1.6%. The      include critical activities in terms of security of   than in the large company segment, which
majority of the market is formed by corporate        supply (like energy, banks and operators). Crucial    means that buying of the best technologies or
cyber security services and products. The share      in this target group is that its size is constantly   managed/outsourced cyber security services is
of services is good one-half of the total market     growing as data security threats expand, which        not necessarily possible.
and they are expected to grow by 8.3% annually.      also expands the market for demanding cyber
The rest consists of corporate security products,    security solutions.
the market of which grows by 7.4% annually.
                                                                                                                                                                   18
Sector
      Distribution and operating logic of the cyber security
                                                                                                                              Market drivers
      market

                                                                                                                  Digitalization               Regulation
                                                                                    R&D focus on highest level
                                                                                         technologies
                                    Cyber security             State
                                    consulting               espionage
                                                                                                                   Digital commerce
                                                                                    Duplication of technology    Industrial Internet of        EU's Data
                                                                                       to larger markets                 things
                                                                                                                    Open systems
                                                                                                                                               Protection
                                                                                                                         Cloud                 Regulation
     Detection of evolved attacks
                                                         Targeted attacks                                               Mobility
     (RDS & EDR)

     Vulnerability management                  Large companies and organizations,
     (Radar)
                                                      public administration
                                                                                                                    Risk-based                   Forced
                                                                                                                    purchasing                 purchasing
     Mass solutions
     (endpoint
                                                         Mass attacks
     protection)
                                                     Medium sized companies                                       Complexity and change rate as growth drivers
                                                                                                                 for cyber security products, expert services and
                                               Small companies and consumers                                                outsourced cyber security

                                                Market size / number of buyers

Source: Inderes                                                                                                                                                     19
Industry 2/4
Especially the rapid detection of threats that       management solutions. The size of the market        Weights, size and annual growth
have passed endpoint protection is now               for outsourced corporate cyber security services    rate of F-Secure’s market
emphasized in the segment of medium sized            (including managed security services) was,
companies. For this need, F-Secure is                according to Gartner’s estimate, USD 16.7 billion
                                                                                                         segments
developing an automated alert system for             in 2017 and the market is expected to grow on
endpoints (EDR) that will be launched this year,     average by 11.4% per year in 2015 to 2020. IDC                                   USD 4.6 bn
which offers additional/cross-selling                has estimated that the market size for
                                                                                                         Consumer security
opportunities for the company in this partially      vulnerability management solutions is around
under-serviced segment. In medium sized              USD 1.0 billion and the market is expected to       Significant product area        1.6%
companies, IT managers demand more                   grow at an annual rate of around 13% in 2015 to
comprehensive cyber security solutions instead       2020. F-Secure expanded to these markets
of point product solutions, which creates            through the nSense acquisition in 2015 and the
challenges for F-Secure to integrate its product     launch of the RDS product and it has been able                                   USD 3.6 bn
portfolio to meet the needs of this customer         to grow faster than the market in these             Endpoint protection
segment.                                             segments.                                           products for companies
                                                                                                          Significant product area       2.6 %
Market sub-segments for F-Secure                     In terms of F-Secure’s growth in coming years,
                                                     an interesting market is the segment for
F-Secure’s potential market can be examined          automated detection and response products for
more closely through the company’s product           cyber-attacks. (Endpoint detection and                                           USD 0.4 bn
and service selection. According to Gartner, the     response, EDR), where F-Secure is launching its     Endpoint detection and
market for consumer security products was USD        own product in 2018. The market is at the           response (EDR)
4.6 billion in 2017 and it is expected to grow at    beginning of its life cycle and Gartner estimates    New product area
                                                                                                                                          45%
an average annual rate of 1.6 % in 2016 to 2021.     that its size was USD 0.4 billion in 2016 but the
The slow growth on the consumer security             market is expected to grow by an average of
market is explained by the popularity of             over 45% per year in 2015 to 2020. The
constantly evolving free antivirus solutions (e.g.   definition of the EDR segment is blurred by the
                                                                                                                                      USD 1.0 bn
Windows Defender) but growing product areas                                                              Vulnerability
                                                     fact that it can be seen as a market area that
                                                                                                         management
can be found, for example, in privacy protection     overlaps with the market for endpoint protection
                                                                                                         Small product area
                                                                                                                                           13%
(VPN solutions) and in solutions designed to         products. Growth is driven by the fact that
protect smart equipment in the home.                 malicious hacking against companies is often
                                                     not detected for months, and this has shifted the
In corporate security, a majority of F-Secure’s
                                                     focus from merely preventing hacking towards
net sales still comes from endpoint protection
                                                     faster detection and response. Large companies                                   USD 16.0 bn
products, the market size of which was USD 3.6                                                           Cyber security services
                                                     can buy detection capabilities as managed
billion in 2017 and Gartner estimates it will grow                                                       Important, growing area
at an annual rate of 2.6% in 2015 to 2021.
                                                     services (like F-Secure’s RDS) but especially for                                     10%
                                                     smaller companies a pure product solution is the
The most rapidly growing markets for F-Secure        only sensible solution in terms of costs.
in corporate security can be found in cyber
security services, detection and response
solutions for malicious hacking and vulnerability                                                                                                  20
                                                                                                          Source: Gartner, IDC
Industry 3/4
Gartner estimates that the share of endpoints          by the fact that cyber security is increasingly     EU's Data Protection Regulation
equipped with automated detection and                  becoming a critical and integral part of any new
response products of all endpoints will grow           IT system, digital service or product. This means   EU's Data Protection Regulation (GDPR), that
from 10% on 2017 to 35% by 2020.                       that problems related to cyber security cannot      was passed in spring 2016 and that will enter
                                                       be solved simply by acquiring cyber security        into force in May 2018, has clearly increased the
Market drivers                                         software and equipment off the shelf but solving    demand for cyber security services, which also
                                                       of cyber security also requires the use of high-    supports F-Secure’s business. The regulation
In our opinion, the cyber security market is still                                                         imposes new obligations on organizations that
                                                       level expertise services. Due to these market
emerging and will develop strongly over the                                                                handle personal data. Through EU's Data
                                                       drivers, F-Secure’s business has also been in
next few years, which is why current market                                                                Protection Regulation organizations are, for
                                                       turmoil in recent years where the company is
estimates are even at best only indicative.                                                                example, obliged to report any breach of
                                                       transforming from a endpoint focused antivirus
Market growth will probably be steady and                                                                  security. The authority that supervises the
                                                       company to a more versatile provider of cyber
strong and accelerate pushed by digitalization                                                             regulation can impose sanctions if the regulation
                                                       security products and services in the corporate
investments. In addition, constant news of                                                                 is breached. The sanctions can be massive, as
                                                       segment.
serious hacking (risk-based purchasing) and                                                                for more serious breaches the fine is EUR 20
pressure created by regulations (forced                Consumer security changing                          million or 4% of the company's annual net sales,
purchasing) will boost market growth. At the top                                                           which is intended to make companies take the
level, growth is, in practice, driven by two forces:   In consumer security, the changing endpoint         new regulation seriously. At the same time, the
regulation and threat scenarios.                       portfolio has been visible as a slight drop in      monetary definition of the sanctions provide
                                                       antivirus software for PCs but, as a whole, the     cyber criminals with a price tag, which they can
The commonly recognized mega trends in the IT          number of devices connected to the web is           use to blackmail companies after a successful
world like mobility, cloud, industrial Internet of     growing rapidly in consumers’ homes. This           hacking operation. GDPR also supports F-
things, social media and digital commerce are          provides growth opportunities for new cyber         Secure’s product business as the regulation
strongly linked with cyber security. In many of        security products that protect smart devices in     means that companies have to build better
these areas, the barrier for creating new              the home even though PC driven antivirus            capabilities to detect realized security breaches.
applications, products and digital services is         software sales is a challenging market. In
information security challenges. These                 consumer security, the nature of the market is
challenges are related, for example, to privacy        changing rather than the market faltering with
protection, e-commerce or security. One mega           PC antivirus. For example, Windows’ own data
trend worth mentioning is also open systems            security is cannibalizing conventional cyber
(like Android) becoming more common. This              security but this does not solve the consumer’s
makes the market more attractive from a                problem of how to protect several different
criminal’s viewpoint than when companies still         endpoints. Thus, there is a natural need for F-
operated mainly in their own individual closed         Secure’s packages for comprehensive
environments.                                          consumer solutions as the array of endpoints
                                                       and operating systems is vast and constantly
Building of new digital services requires that
                                                       changing. Gartner estimates that the number of
companies and governments solve the
                                                       consumer devices connected to the web will
challenges related to data security in advance.
                                                       grow from 5.2 billion in 2017 to 12.8 billion by
This means that the demand for cyber security
                                                       2020.
related products and services is also supported
                                                                                                                                                                21
You can also read