NCC Group is a UK cyber security consultancy that spent three years selling off everything except its core services business. Its software escrow arm, Escode, went to TDR Capital for £275m in May 2026, and the company is returning £185m of the proceeds to shareholders. What remains is a smaller business that is growing again but still earns thin profit margins.
People-led cyber services, now the only business left
NCC Group employs about 1,800 people across Europe, North America and Asia Pacific. It sells cyber security work to public and private sector clients: penetration testing (hiring experts to break into a client's systems), consulting, managed services (round-the-clock monitoring) and incident response after attacks. Managed Services and Consulting together now make up 55.8% of cyber revenue, against 37.5% in the year to May 2023.
The UK is the largest market. Named clients and partners include TikTok, where a three-year extension of its European data security programme, Project Clover, was signed in January 2025. NCC also holds partnerships with Microsoft, Splunk and Dragos and is a paid research partner for Google. In 2026 it joined OpenAI's Daybreak cyber partner programme and signed a memorandum of understanding with Siemens on UK critical infrastructure. 11 Jun 2026 19 Jun 2025 28 Jan 2025 23 Jun 2026 15 Jul 2026
Fixing testing, margins and the portfolio
CEO Mike Maddison set out a transformation plan in 2023. It targeted the delivery model, an over-reliance on short-term testing work and dependence on US tech customers. The company also aimed to sell non-core assets. In December 2023 it sold the DetACT fraud detection unit for €9.0m.
The first results were painful. In the half to November 2023, cyber revenue fell about 10% and adjusted EBITDA (operating profit before depreciation and amortisation) dropped to £15.6m from £24.2m. Management then lifted staff utilisation in testing from about 60% to about 76% and built a delivery hub in Manila. Managed Services grew to 26% of cyber revenue by May 2024. Adjusted EBITDA for the year to May 2024 rose 7.4% to £42.1m, and the shares climbed from about 107p in October 2023 to 178p by September 2024. 21 Dec 2023 25 Jan 2024 1 Aug 2024 19 Jun 2025
Fox Crypto sale clears the debt, but clients hold back
In August 2024 NCC agreed to sell its Fox Crypto unit for €77m, a multiple of 16.5 times EBITDA. The sale completed in March 2025 at €78.5m. It wiped out net debt of £45m, and in April 2025 NCC arranged a new £120m credit facility.
Cyber trading went the other way. In December 2024 the board guided to flat to low single-digit revenue growth for FY25. By June 2025 it expected cyber revenue to fall about 5%. Cyber revenue did fall 4.0% for the year, to £227m. Management blamed clients' macroeconomic caution and the end of high-volume testing work. The FY25 pre-tax profit of £20.6m, against a £17.8m loss, depended on the Fox Crypto gain of £11.4m.
The shares drifted from the 150p range to about 130p in early 2025. 1 Aug 2024 28 Mar 2025 28 Apr 2025 10 Dec 2024 19 Jun 2025 11 Dec 2025
“We experienced a decline in our high-volume, lower value testing and compliance engagements as clients reacted to macroeconomic uncertainties in the autumn and spring.” 19 Jun 2025
Escode sold, Cyber stays listed
In April 2025 the board began exploring options for Escode, which holds software source code in escrow for clients. In July it also opened a review of the cyber business. In January 2026 NCC agreed to sell Escode to TDR Capital at an enterprise value of £275m, about 9 times FY25 EBITDA. It launched a £70m buyback the same day. The deal closed on 29 May 2026 with net proceeds of about £253m.
The three disposals together raised an enterprise value of about £349m at about 9.8 times EBITDA. On 11 June 2026 the board said its review had considered a sale of the whole company and concluded NCC should stay listed. It said it was in no talks with any party. Shareholders approved a capital reduction in July. A £170m tender offer at 145p, an 11% premium to the prior close, retired 117.2m shares in September, leaving 167.5m in issue. A £15m buyback followed. 28 Apr 2025 16 Jul 2025 21 Jan 2026 29 May 2026 11 Jun 2026 7 Jul 2026 23 Jul 2026 2 Sep 2026
“The Board has concluded that pursuing a sale of the Company is not in the interests of shareholders at this time.” 11 Jun 2026
Disposals delivered; the cyber margin is still the test
Asset sales did what management said they would. Net debt went from £45m to net cash of £13m, and the Escode sale left about £230m of net cash at 1 June 2026 before returns. The cyber business itself was harder. FY25 revenue fell where guidance had promised growth, and the company reversed that guidance mid-year.
Operational fixes worked more slowly than hoped but did show up. Cyber gross margin reached a record 38.4% in the first half of FY26, and cyber EBITDA more than doubled to £8.3m. Even so, that is a small profit on £118m of revenue. The board forecasts a cyber EBITDA margin of only 5.5% to 7.5% for FY26. 11 Dec 2025 11 Jun 2026 19 Jun 2025
Same CEO, same plan, new owners on the register
Maddison has run the plan since 2023, with Guy Ellis as finance chief. Both bought small share parcels through 2026, and Maddison holds about 2.8m nil-cost performance options. Independent director Mike Ettling leaves the board on 30 September 2026 after nine years.
The register changed after the tender. Aberforth Partners rose from 5.2% to 13.1% by late September 2026. Odyssean now holds 9.55%, and Artemis and Perpetual each hold above 5%. The Wellcome Trust cut its stake to 1.81%. 11 Jun 2026 29 Jan 2026 27 Aug 2026 9 Sep 2026 9 Sep 2026
A pure-play cyber group with cash returned
In the six months to March 2026, cyber revenue rose 5.9% to £118.4m at constant currency. UK and Asia Pacific grew 12.5%. Group adjusted EBITDA, including Escode, rose 27.7% to £23.5m, and Escode is now treated as discontinued. The company has no debt. It says it has no M&A plans and no proceeds set aside for deals.
NCC will provide transition services to Escode until May 2027 for £4.9m of income. Shares traded at 149p in October 2026, close to the 145p tender price. 11 Jun 2026 29 May 2026 2 Sep 2026 7 Sep 2026
Mid-single-digit growth, £25m of savings, mid-teens margins
For FY26 (to 30 September 2026) the board expects cyber revenue to grow at a mid to low single-digit rate. It expects EBITDA to grow faster than revenue. On 11 June 2026 it set out its medium-term targets in full. Cyber revenue should grow at a mid-single-digit rate in FY27 and FY28. Costs should fall by about £25m against FY25 by FY28, with £7m in FY26 and the rest split evenly over FY27 and FY28. Cyber EBITDA margins, including head office costs, should reach the mid-teens by the end of FY28.
Earlier statements referred to medium-term goals without giving these terms. The company has not said how much of the £25m comes from headcount. 11 Jun 2026 11 Dec 2025
Written by AI from NCC Group's own announcements since Oct 2023 · every paragraph links to its sources