Corero 2025 Results: H2 acceleration, 23% ARR growth, and a sturdier subscription engine
Corero Network Security has posted its full-year 2025 audited numbers, and the headline is simple: a slow first half gave way to a much stronger second half, with subscription momentum pulling the business forward. Annual Recurring Revenue (ARR – the value of contracted recurring revenue normalised to a year) jumped 23% to $23.9 million, orders rose 20%, and customer retention stayed stellar at 98%.
The flip side: EBITDA and adjusted EBITDA were down year on year, and the Group reported a small loss before tax. That is the classic transition pain when a business shifts from upfront licences to subscriptions – lower near-term revenue recognition, higher predictability later. Management says Q1 2026 has started strongly, significantly ahead of a tough Q1 2025, which supports the H2 upturn story.
Key numbers investors should know
| Metric | FY 2025 | FY 2024 |
|---|---|---|
| Revenue | $25.5 million | $24.6 million |
| EBITDA (earnings before interest, tax, depreciation, amortisation) | $1.5 million | $2.5 million |
| Adjusted EBITDA | $2.0 million | $3.0 million |
| ARR | $23.9 million | $19.5 million |
| Order intake | $33.8 million | $28.2 million |
| Gross margin | 90% | 91% |
| (Loss)/profit before tax | $(0.7) million | $0.6 million |
| (Loss)/earnings per share | (0.1) cents | 0.1 cents |
| Net cash (year-end) | $4.0 million | $5.3 million |
| Customer retention | 98% | 97% |
H2 2025 momentum and the subscription pivot
Corero’s H2 sales traction was called out as “particularly strong”. The driver is the ongoing shift towards subscription and DDoS-Protection-as-a-Service (DDPaaS – Corero’s managed, as-a-service model). That transition reduced upfront appliance and licence revenue in the first half, but lifted ARR and improved revenue visibility.
The mix tells the story. Software licence and appliance revenue fell to $8.3 million (2024: $10.1 million), while subscription revenue rose to $8.3 million (2024: $5.9 million). Maintenance and support edged up to $8.9 million. Over-time revenue recognition increased to $17.2 million (2024: $14.5 million), reflecting more subscription contracts.
Opinion: this is the right strategic direction for a cybersecurity vendor. It depresses reported profits during the transition, but boosts predictability and lifetime value. The key is keeping churn low and landing expansion – and a 98% retention rate with upsell wins suggests the model is bedding in.
Big wins, bigger pipeline: why orders matter
Order intake rose 20% to $33.8 million, helped by a standout $6.8 million renewal and expansion with a leading US cloud computing provider in October. That deal rolls out over three years on a subscription basis. Management also called out a “strong new business pipeline for FY 2026”.
Channel and alliances added fuel: TechEnabler wins in Brazil, a broader HPE relationship, Certified Partner status with World Wide Technology, and DDPaaS wins via Akamai. Corero also signed its first Tier 1 telco in APAC through HPE. These partnerships extend reach without ballooning direct sales costs and can be powerful multipliers as product breadth grows.
Product edge: 400GB platform and CORE gaining traction
Corero sold more than 40 units of its next-generation 400GB platform enhancement in 2025 and notched new CORE platform wins. CORE is positioned as an observability and resiliency ecosystem – in plain terms, tools to see threats earlier and automate responses across hybrid environments. That positioning fits the direction of travel in DDoS defence, where speed, automation, and integration are critical.
Customer case studies back the momentum: a $1.5 million TierPoint expansion using CORE, 3-year $1.2 million with Forte Telecom in Brazil, a 5-year $1.2 million Lightedge extension displacing a competitor, and a $0.3 million deal introducing CORE Zero Trust Admission Control at Cooper Health.
Profitability, cash and balance sheet: what’s under the bonnet
EBITDA slipped to $1.5 million and adjusted EBITDA to $2.0 million, with an operating loss of $0.7 million. Gross margin remains excellent at 90%, a hallmark of software and services-led security models. Operating expenses rose as Corero invested in sales, marketing, and R&D to support the growth plan.
Cash closed at $4.0 million (2024: $5.3 million), with positive cash generation in H2 2025 – a reassuring datapoint during a model shift. The Group put in place a £1.5 million overdraft facility, unused at year end, and reports no debt. Contract liabilities – which represent billed amounts to be recognised as revenue over time – moved between current and non-current buckets, consistent with subscription timing. Overall net assets were steady at $18.6 million.
Opinion: the cash position looks sensible for the current scale, and the unused overdraft provides extra headroom. The investment outlay is visible in higher operating expenses and capitalised development spend, but that is aligned to the product roadmap and go-to-market push.
Geography and customer mix: still US-led, UK stepping up
By geography, the US remained dominant at $17.8 million. The UK rose to $3.5 million from $1.8 million, and Other regions delivered $4.3 million. That supports the narrative of broader international momentum, particularly in Latin America and the Middle East, with APAC starting to contribute via telco wins.
DDoS market backdrop: demand tailwinds and regulatory push
DDoS attacks are frequent and evolving. Corero cites research indicating organisations face an average of 11 attacks per day, up 37% since 2018. The DDoS mitigation market is projected at $15.94 billion by 2030 (2025: $7.21 billion), a compound annual growth rate of 17.23% over the next five years. Regulatory frameworks such as the EU’s DORA and the UK’s Cyber Security and Resilience Bill are raising the bar for service availability and preventative controls.
What this means: the direction of travel favours providers with automated, inline protection that can be deployed across data centre, edge, and hybrid cloud – exactly where Corero plays. These secular drivers add credibility to the longer-term ARR build.
Management outlook: confident tone, with a hot start to 2026
Management says Q1 2026 has started strongly and “significantly” exceeded Q1 2025, which was a tough comparator. The Board remains confident, citing robust cyber threat trends, product competitiveness, and a strong pipeline. No formal revenue or profit guidance is disclosed.
Opinion: the stronger Q1 start, combined with H2 2025 momentum and rising ARR, suggests the earnings trough may be behind the Group. Execution – converting orders to live revenue and keeping churn ultra-low – is now the main swing factor.
What I’m watching next
- ARR progression and net retention – with 98% retention already, can Corero keep lifting ARR above revenue growth through expansions.
- Subscription mix – further shift from point-in-time licences to over-time revenue should smooth cash flows and margins.
- Order conversion – timing of revenue recognition from the $33.8 million orders, including the $6.8 million cloud deal.
- Cash generation – sustaining the H2 2025 positive cash trend while investing in sales, marketing, and R&D.
- Channel scale – delivery from HPE, WWT, Akamai, and TechEnabler, plus any new Tier 1 telco logos in APAC, Latin America, and the Middle East.
- Product uptake – more 400GB platform deployments and CORE wins, especially in competitive displacements.
Bottom line: a constructive transition with improving momentum
Corero’s 2025 was a tale of two halves. The first half bore the cost of a business model shift; the second half showed why the shift is worth it. ARR up 23%, orders up 20%, retention at 98%, and a stronger start to 2026 all point in the right direction. The reported profit line is not there yet, but the leading indicators are.
If management keeps converting pipeline, scaling channels, and monetising its newer platforms, the subscription base should continue to deepen and the earnings profile should follow. For investors, this remains a story about compound ARR growth and disciplined execution in a growing, regulation-backed market.
