Unaudited H1 2026 Interim Results

Corero (AIM: CNS) (OTCQX: DDOSF), the distributed denial of service ("DDoS") protection specialists and champion of adaptive, real-time service availability, announces its unaudited results for the six months ended 30 June 2026 ("H1 2026" or the "Period").

Financial Highlights

• Strong revenue growth of 42% to $15.5 million (H1 2025: $10.9 million)

o Underpinned by new customer wins and contract expansions

• EBITDA1 improved to $2.6 million (H1 2025: loss of $1.4 million)
• Order intake2 increased 14% to $14.3 million (H1 2025: $12.5 million)

o Year-on-year progress highlights ongoing traction with channel partners and ongoing expansion of product offering

• Annualised Recurring Revenues3 ("ARR") grew by 12% to $24.1 million (H1 2025: $21.6 million)
• Continued high customer retention4 at 96% further underpins Corero's market leading position (H1 2025: 98%)

Operational Highlights

• Key customer contract extension for new Web Application Security ("WAAP") product

o $1.1 million, 3-year contract with TierPoint, one of the world's leading data centre providers

• Significant customer wins with Tier-1 service providers post period end

o $1.4 million, 3-year contract with Tier-1 US-based leader in global telecommunications

o $3.4 million, 5-year contract with a Tier-1 UK-based telecommunications provider

• $0.5 million, 3-year initial contract with one of the world's leading NeoClouds, demonstrating further our capabilities in the NeoCloud market

Directorate Change during the Period

Jeremy Nicholls joined the board on 2 February 2026 as a Non-Executive Director, bringing over 35 years of experience in security, networking and unified collaboration technologies.

Current Trading & Outlook

• H2 2026 has started positively, driven by notable customer wins and an improving sales pipeline enhanced by an extended product portfolio
• ARR growth momentum expected to continue with continuing shift to Corero's subscription-based sales model
• As a result, management now expects Corero to exceed market expectations5 for revenue and significantly exceed market expectations for EBITDA for FY 2026

Carl Herberger, Chief Executive Officer at Corero, commented:

"I am delighted with the progress Corero has made in the first half of the year with growth in all our major financial KPIs of revenue, ARR and EBITDA, which reflects our ongoing transition towards a more predictable, recurring revenue model.

DDoS attacks are becoming increasingly sophisticated and thus demand for comprehensive protection solutions is continuing to grow. We therefore believe we are well-positioned to capitalise on our expanding product portfolio with new go-to-market partnerships and our strong sales pipeline.

This positive momentum has continued into the second half with notable customer wins secured. With our strong customer retention, new Tier-1 customer wins, expanding global partner ecosystem, and the strength of our proposition, we remain confident in delivering continued growth and exceeding market expectations for the full year."

Investor Presentation

The Company will be hosting an investor presentation covering its interim results.

The online presentation will be hosted by Carl Herberger, Chief Executive Officer, and Chris Goulden, Chief Financial Officer.

This event will take place at 12.00 p.m. BST on Wednesday, 9 September 2026. The presentation will be hosted on the Investor Meet Company ("IMC") platform and is open to all existing and potential shareholders. Questions can be submitted pre-event via your IMC dashboard up until 9.00 a.m. the day before the meeting or at any time during the live presentation.

Investors can sign up to IMC for free and add to meet Corero via: https://www.investormeetcompany.com/corero-network-security-plc/register-investor

Those who have already registered on IMC will be automatically invited.

1 EBITDA is defined as earnings before interest, tax, depreciation, and amortisation.

2 Order intake is defined as orders received from customers in the period.

3 ARR is defined as the normalised annualised recurring revenues and includes recurring revenues from contract values of annual support, software subscriptions including terms greater than one year, and from DDoS Protection-as-a-Service ("DDPaaS") contracts.

4 Customer retention is defined as the percentage of annual recurring revenue retained from existing customers during the renewal cycle across the measurement period.

5 For the purpose of this announcement, the Group believes market consensus for FY 2026 to be revenue of $29.2 million and EBITDA of $3.3 million.

Chief Executive Officer's Review

Introduction

The first half of FY 2026 has been one of continued growth, characterised by ongoing execution of the go-to-market strategy following an accelerated product innovation drive that brought six new products to market in H2 2025. Strong sales execution generated bookings growth of 14% to $14.3 million and revenue growth of 42% to $15.5 million.

Demand for Corero's SmartWall ONE DDoS protection and CORE platform cyber resiliency capabilities continues to grow due to a number of complimentary factors.

• The threat landscape continues to evolve, and attacks are becoming more complex.
• High-growth industries, such as NeoClouds and AI Data Centres, have high-specification DDoS protection and cyber resiliency requirements.
• For the first time, DDoS protection has become a regulatory requirement for critical infrastructure organisations in multiple geographies.

In our most recent Threat Intelligence Report1 we identify that DDoS attacks are getting larger, faster and more complex as attack techniques become more advanced and accessible, in part due to the proliferation of readily available AI tools.

With our market-leading DDoS mitigation solutions, strong sales execution and continued focus on operational excellence, demonstrated by 96% customer retention in the Period, we are well-placed to leverage this first half performance and continue to deliver growth in the second half of 2026 and beyond.

1 https://www.corero.com/lp-report-threat-intelligence-report-2026/

2 https://www.corero.com/corero-wins-two-global-infosec-awards-2026/

Operational Review

The strategic focus has been to expand Corero's addressable market by expanding the product portfolio and targeting new geographies and customer markets. One of the key pillars of this strategy was to strengthen our channel organisation by recruiting an accomplished channels leader and experienced team, which we did through H1 2026. Under Michelle Ragusa-McBain's leadership Corero has implemented a refreshed channel partner programme and go-to-market strategy.

Early successes from this programme include strengthened go-to-market positions with all three of our alliance partners and a growing number of strategic channel partners making a meaningful difference to our business globally. One example is our recent new partnership with EdgeUno, a regional connectivity provider in LATAM, which has generated strong customer traction with their DDoS mitigation offering powered by Corero's SmartWall ONE solution.

Portfolio enhancements, ongoing investment in the global sales team and implementing the new channels organisation have contributed to strong order intake in the Period. Notable customer deals secured in H1 2026 include:

• $1.1 million, 3-year contract with TierPoint, one of the world's leading data centre providers, for Corero's Web Application Security ("WAAP") product
• $1 million, 3-year contract with one of Brazil's largest telecommunications providers, for Corero's SmartWall ONE DDoS protection solution

Post period end, Corero secured two meaningful Tier-1 customer wins, highlighting our market-leading DDoS mitigation solution and expanded feature set via our CORE observability and resiliency platform:

• $1.4 million, 3-year contract with Tier-1 US-based leader in global telecommunications
• $3.4 million, 5-year contract with a Tier-1 UK-based telecommunications provider with specific security, regulatory and sovereign requirements

We believe we are taking market share by successfully displacing incumbent competitors and by demonstrating the best-in-class solution for high-growth industries such as AI Data Centres and NeoClouds. We have a high success rate in competitive scenarios due to a number of unique differentiators, including:

• Corero is the only pure play DDoS operator in the market that was created to tackle the issue of DDoS. This is evident in the high efficacy of our solutions and the high customer retention rates we maintain.
• Our software-led and hardware-agnostic approach. The Corero solution does not require customers to deploy specific vendor hardware or route their traffic through a vendor platform.
• Our solutions are repeatedly identified through customer testing as having the lowest time-to-detect ("TTD") and time-to-mitigate ("TTM") on the market, as well as being highly automated.
• Through our alliance partners we offer a hybrid solution of on-premises and cloud DDoS mitigation, widely accepted as the optimal deployment methodology.
• We offer a fully managed turnkey service to lower the total cost of ownership for our customers.
• Our market-leading customer service underpins our customer retention rates, consistently achieving 96-98% retention.

Product innovation

A key highlight for the Group was the continued commercial and industry validation of our product offering. In March 2026, Corero was named 'Most Innovative DDoS Protection Solution' - a Global InfoSec Award from Cyber Defense Magazine at the RSA Conference 2026.1 Post period end, Corero retained its position as a Leader and as the 'Emerging Innovator' in the 2026 SPARK Matrix™ for DDoS Mitigation, awarded for our differentiated approach to improving cyber resiliency.2 These awards reflect Corero's mature product capabilities and leadership in the DDoS mitigation market.

1 https://www.corero.com/corero-wins-two-global-infosec-awards-2026/

2https://www.corero.com/corero-named-leader-and-innovator-2026-ddos-spark-matrix/

Addressable Market and Market Drivers

Demand for DDoS protection solutions continues to accelerate against the backdrop of an increasingly sophisticated threat landscape, with the global market estimated to be worth $10.28 billion by 2031 (2026: $5.38 billion), representing a CAGR of 13.83%.1 Corero operates across a significant segment of this overall market, with an expanding customer footprint in the fastest growing region - the Asia Pacific - following contract wins in the Period.2

The threat landscape itself continues to evolve rapidly. The average number of DDoS attacks per customer rose to 12.3 per day in 2025,3 the sharpest annual increase in a decade, while multi-vector attacks, which combine multiple attack techniques simultaneously to evade detection, now account for 42% of incidents.4 Corero's 2026 Threat Intelligence Report (published in April) found that peak attack sizes have increased 262% year-on-year, with pulse attacks capable of reaching terabit scale within six seconds and combining over 50 simultaneous vectors, as attackers increasingly deploy AI to find vulnerabilities, automate reconnaissance and evade threshold-based defences.5

DDoS attacks disrupt day-to-day operations and expose businesses to losses amounting to millions. This is driving broader adoption of DDoS protection across a wide range of sectors - including retail, banking, financial services and insurance, government and defence, healthcare and manufacturing - as organisations become increasingly alert to the operational and financial risks posed by large-scale attacks.

The US, Corero's largest customer base and geographical footprint, remains a rapidly growing market for DDoS mitigation, which is forecast to grow to $5.02 billion by 2033.6 The concentration of attacks against telecommunications - the most heavily targeted sector accounting for approximately 452,000 attacks in the US in 2025 - signals a sustained demand for automated, real-time DDoS detection and mitigation.7

AI presents a significant opportunity for Corero both in the market opportunity it drives as well as tools to optimise Corero's product development process and output. Additionally, AI tools are being used to drive internal operational efficiencies with a number of AI enabled processes implemented.

Globally, the proliferation of AI tools provides bad actors greater access and opportunity to launch more sophisticated attacks, to monitor their efficacy and to adapt attack vectors in real-time. Corero's SmartWall ONE solution is built to respond to these challenges, with its high levels of accuracy and automation and sub-second mitigation providing market-leading capabilities against this ever-evolving attack landscape.

Emerging AI companies and the AI data centres that power them are increasingly providing revenue growth opportunities for Corero. Data centres require, as standard, highly sophisticated DDoS protection to protect their own infrastructure and as a service for their hosted tenants. AI models are highly sensitive to latency, meaning effective DDoS mitigation is ineffectual to AI companies if it initiates latency in the network. Corero's market-leading time to mitigation has been proven to meet these latency demands for a number of AI customers.

Combined with growing digital adoption and connectivity across Latin America and APAC, Corero is well-placed to capitalise on this expanding market opportunity, leveraging its established technology leadership, growing product portfolio and expanding partner network to address an increasingly complex threat landscape.

1 https://www.mordorintelligence.com/industry-reports/ddos-protection-market

2 https://www.mordorintelligence.com/industry-reports/ddos-protection-market

3 https://www.corero.com/corero-finds-ai-drives-faster-multi-vector-threats/

4 https://www.mordorintelligence.com/industry-reports/ddos-protection-market

5 https://www.corero.com/corero-finds-ai-drives-faster-multi-vector-threats/

6 https://www.grandviewresearch.com/horizon/outlook/distributed-denial-of-service-protection-market/united-states

7 https://www.netscout.com/threatreport/country/united-states-of-america

Directorate Change during the Period

Jeremy Nicholls was appointed as Non-Executive Director in February 2026. Jeremy has over 35 years of experience in security, networking, and unified collaboration technologies, having held global leadership roles across channel, alliance, and direct sales with leading international technology organisations.

Current Trading & Outlook

I am delighted to report that we have made a positive start to H2 2026, buoyed by a series of notable contract wins alongside continued financial and operational momentum. Consequently, we expect revenue momentum for FY 2026 to reflect the sales momentum and expansion of partnerships delivered in H1 2026. The second half of the year has traditionally accounted for a higher proportion of our annual business as a result of customer buying patterns, and we expect this to continue for H2 2026.

Our investment in sales and marketing, together with the further development of our sales partner ecosystem, continues to extend our market reach and unlock significant new business opportunities.

With global demand for DDoS protection services increasing at pace, our expanded product portfolio continues to create multiple touchpoints with both existing and new customers.

Looking ahead to the remainder of the current financial year, based on a strong start to H2 2026, recent customer wins and an improving pipeline, management now expects Corero to exceed market expectations for revenue and significantly exceed market expectations for EBITDA for FY 2026.

Carl Herberger

Chief Executive Officer

Chief Financial Officer's Review

I am pleased to report a strong start to 2026 with growth across our major financial KPIs in H1 2026 versus the same period in 2025. The second half of the year has traditionally accounted for a higher proportion of our annual business as a result of customer buying patterns, and we expect this to continue for H2 2026.

Revenue for H1 2026 increased by 42% to $15.5 million (H1 2025: $10.9 million). This reflects the greater revenue visibility from brought forward ARR, continued success in new customer wins and expansions with existing customers.

This accelerated revenue growth had a marked impact on EBITDA, which improved significantly in H1 2026 to $2.6 million (H1 2025: loss of $1.4 million), with adjusted EBITDA excluding share-based payments of $2.7 million (H1 2025: loss of $1.3 million). Gross margin traded higher than historic trends at 93% (H1 2025: 91%) due to an increased mix of higher margin, upfront software licence contracts won in H1 2026. Management expects gross margin to trend towards rates of 90-91% in H2 2026.

ARR increased by 12% to $24.1 million (H1 2025: $21.6 million) and gross margin improved to 93% (H1 2025: 91%), with an increased software sales mix compared to prior periods mainly due to the success of Corero's commercial off-the-shelf ("COTS") software-only deployment option, developed and released in H2 2025. ARR growth during H1 2026 was relatively modest (FY 2025: $23.9 million) due to a combination of timing and a higher proportion of customers buying up-front licenses, rather than subscriptions, than in previous periods.

Total operating expenses before amortisation and depreciation were $11.8 million (H1 2025: $11.3 million) with the increase largely allocated to sales and marketing activities, including investment in customer success and channel organisations.

Depreciation and amortisation of intangible assets amounted to $1.2 million (H1 2025: $1.0 million), with capitalised R&D costs of $2.1 million (H1 2025: $1.4 million). The increase in capitalisation was driven by a $0.3 million incremental spend on CORE development, $0.1 million incremental spend on SmartWall ONE development and $0.3 million driven by higher mix of development versus BAU maintenance activity within the existing team.

EBITDA for H1 2026 was $2.6 million (H1 2025: loss $1.4 million), with the significant increase driven by accelerated revenue growth and higher gross margin in the Period.

Profit before taxation for H1 2026 was $1.4 million (H1 2025: loss $2.4 million). The reported earnings per share was $0.3 cents (H1 2025: loss $0.5 cents).

Cash and cash equivalents as at 30 June 2026 was $2.1 million (H1 2025: $3.1 million), a reduction of $1.9 million in the six-month period (H1 2025: $2.2 million decrease) as the Group continues to navigate the changing cashflow profile from the uptake of subscription services. Receivables have increased to $11.1 million as at 30 June 2026 (H1 2025: $8.7 million) as a result of revenue growth.

The Group has no debt and has a $2.0 million overdraft facility in place which remains unused.

Chris Goulden

Chief Financial Officer

Condensed Consolidated Income Statement

for the six months ended 30 June 2026

Continuing operations

1 See note 6 for definitions and reconciliation.

Condensed Consolidated Statement of Total Comprehensive Income

for the six months ended 30 June 2026

Capital and reserves attributable to the equity owners of the parent

Notes to the Condensed Consolidated financial statements

General information and basis of preparation

Corero Network Security plc (the "Company") is a company domiciled in England. The condensed consolidated interim financial statements of the Company for the six months ended 30 June 2026 comprise the Company and its subsidiaries (together referred to as the "Group").

1.1 Basis of Preparation

These condensed interim consolidated financial statements have been prepared in accordance with UK-adopted IAS 34,"Interim Financial Reporting". They do not include all disclosures that would otherwise be required in a complete set of financial statements and should be read in conjunction with the Annual Report and Accounts for the year ended 31 December 2025 ("2025 Annual Report and Accounts"). Estimates and judgements that can have a significant impact on the Group's interim consolidated financial statements are the same as that of the prior year annual financial statements. The financial information for the half years ended 30 June 2026 and 30 June 2025 do not constitute statutory accounts within the meaning of Section 434(3) of the Companies Act 2006 and have neither been audited nor reviewed by the Group Auditor.

The annual financial statements of Corero Network Security plc are prepared in accordance with international accounting standards in conformity with the requirements of the Companies Act 2006. The comparative financial information for the year ended 31 December 2025 included within this report does not constitute the full statutory accounts for that period. The statutory Annual Report and Financial Statements for 2025 have been filed with the Registrar of Companies. The Independent Auditors' Report on the Annual Report and Accounts for 2025 was unqualified and did not contain a statement under 498(2) or 498(3) of the Companies Act 2006.

There have been no related party transactions or changes in related party transactions described in the latest Annual Report and Accounts that could have a material effect on the financial position or performance of the Group in the first six months of the financial year.

These consolidated interim financial statements were approved by the Board on 8 September 2026 and approved for issue on 9 September 2026.

A copy of this Interim Report can be viewed on the company's website: www.corero.com.

1.2 Going Concern

The financial statements have been prepared on a going concern basis.

The Directors have prepared detailed income statement, balance sheet and cash flow projections for the period to 30 September 2027 ('going concern assessment period'). The cash flow projections have been subjected to sensitivity analysis of the revenue, cost and combined revenue and cost levels through this period. In the half year period to 30 June 2026, the Group has seen the impact of ARR growth from 2025, with revenue increasing by 42% to $15.5m (H1 2025: $10.9m). In H1 2026 ARR has grown by a further 12% to $24.1m which provides further revenue visibility into H2 2026 and 2027.

The Group continues to navigate the changing cash profile experienced FY 2025, with customers buying more subscription services than up front products, and put in place a $2.0 million overdraft facility, which remains unused.

As part of the sensitivity analysis, the Directors have noted that should the forecasted revenues not be achieved, mitigating actions can be taken to address any cash flow concerns. These actions include deferral of capital expenditure, reduction in marketing and other variable expenditure alongside a hiring freeze.

The Directors are also not aware of any significant matters in the remainder of calendar 2026 that occur outside the going concern period that could reasonably possibly impact the going concern conclusion.

The Directors have also considered the geo-political environment, including rising inflation in some of our key markets, impacts of US tariff changes and the conflict in Ukraine and the Middle East, and whilst the impact on the Group is currently deemed not material, the Directors remain vigilant and ready to implement mitigation action in the event of a downturn in demand or an impact on operations.

On this basis, the Directors have therefore concluded that it is appropriate to prepare the financial statements on a going concern basis.

Material accounting policies

The basis of preparation and accounting policies used in preparation of these interim financial statements have been prepared in accordance with the same accounting policies set out in the 2024 Annual Report and Accounts.

Segment reporting and revenue

The Group is managed according to one business unit, Corero Network Security, which makes up the Group's reportable operating segment. This business unit forms the basis on which the Group reports its primary segment information to the Board, which management consider to be the Chief Operating Decision maker for the purposes of IFRS 8 Operating Segments. Consequently, there is no separable 'other segmental information' not otherwise shown in these Condensed Consolidated Financial statements.

The Group's revenues from external customers are divided into the following geographies:

Revenues from external customers are identified by invoicing systems and adjusted to take into account the difference between invoiced amounts and deferred revenue adjustments as required by IFRS accounting standards.

The revenue is analysed for each revenue category as:

The revenue is analysed by timing of delivery of goods or services as:

Taxation

Due to the utilisation of past tax losses, the Group does not recognise a material taxation income tax expense or credit.

Earnings per share

Earnings/(loss) per share is calculated by dividing the earnings attributable to ordinary shareholders by the weighted average number of ordinary shares in issue during the period. The effects of anti-dilutive ordinary shares resulting from the exercise of share options are excluded from the calculation of loss per share.

Key performance measures

EBITDA and Adjusted EBITDA

Earnings before interest, tax, depreciation, and amortisation ("EBITDA") is defined as earnings from operations before all interest, tax, depreciation, and amortisation charges. The following is a reconciliation of EBITDA and further adjustment for all three periods presented: