Welcome to SSH Communications Security's investor call for Q2 of 2026. My name is Aino Virolainen, and I will be hosting the call.

The results will be presented by our CEO Rami Raulas and our CFO Mikael Kommonen. After their presentation, we will have a Q&A session, and you can ask questions throughout the call by writing in the chat.

The call is being recorded, and we will share the recording as well as the presentation material on our investor pages later. Now we are good to start, Mikael, the floor is yours.

Thank you, Aino, and good morning also on my behalf. In the second quarter of 2026, our net sales grew by 6.8%, and our EBITDA returned positive, being €0.2 million in the second quarter.

Sales reached €5.7 million. Driving that growth underlying was the subscription growth.

Subscription ARR grew 14.3%, and overall PrivX sales grew 25% in the second quarter. The growth continues to come from PrivX on the product basis.

As mentioned, EBITDA was €0.2 million, down from the previous year, but an improvement sequentially from the first quarter of this year. We continued to spend in sales and marketing, and we also worked in the R&D area on PrivX integrations to improve PrivX competitiveness in the market.

Regionally, sales was strongest in EMEA, in our home market, and less strong in the Americas and the APAC region. We did close several PrivX deals, mostly in EMEA, also in the Americas during the quarter.

On the balance sheet side, we announced the results from the voluntary tender offer that we announced in the first quarter of this year. The outcome of that was that we paid down most of the hybrid loan.

There is currently less than half a million of nominal hybrid loan remaining on the balance sheet of the company. Looking a bit more into the numbers, subscription sales grew 14.4%, in line with the ARR subscription growth mentioned previously.

Deferred revenues year-over-year, they improved to €14 million. Sequentially, they were essentially flat compared to the first quarter of this year.

EBITDA €0.2 million, EBIT negative half a million. Cash flow from operations was €1 million in the second quarter, a clear improvement here versus the previous year.

With that, I'll hand over to Rami.

Thank you, Mikael. In the past three years, we've done a lot in in terms of sharpening up our product portfolio for growth, building the organization, and hiring new talents and resources—actually, just about a 20% more new resources in the past year, year and a half—and building a partner network for a go-to-market, and improving our awareness of our growth solutions and for marketing for increased demand.

Some of those are beginning to show in the second quarter and moving forward. The PrivX, as mentioned, PrivX PAM is our growth engine.

It's the biggest market opportunity for us in our portfolio as well. Grew 25%.

We've been growing about 20% per quarter and in the past two years on it. Now it's accelerating a little bit.

If we count in the whole business area of PrivX, including the key manager and transition from key manager customers—I'll come to that in a minute—then over 30% growth. SalaX, our secure mail, secure messaging platform, grew also a bit.

With NQX, we are expecting that to become a growth product as well, not yet so much in Q2, but we had a lot of qualifications and certification approvals for potential few new businesses moving forward. Then on the go-to-market side, of course, Leonardo is the biggest opportunity to grow and really important strategic partnership that was inked at the end of last year.

We've been working now for under a year together, and will will I'll come back back to some of the successes in second quarter. Outside of Leonardo, LDO, we also have been enhanced or strengthened the partner network, especially in Asia, but also other other areas, and now increasingly in the U.S.

market as well. One of the challenges for us has been kind of awareness of our solutions.

Everybody knows SSH, everybody in the industry uses SSH, Secure Shell, but people don't necessarily know what this company does. We've been putting a lot of effort in the past year or so in getting analyst recognitions and awareness for our growth solution, PrivX, and I'll share a few highlights of that.

Then we've been now a lot of our marketing investment, which is pretty big, has gone into face-to-face, speed dating, face-to-face industry analyst analyst-driven events where we meet face-to-face with potential partners or customers and prospects. Now we are migrating that to to a digital face and kind of inbound demand, also developing from SEO to AIO, from search engine optimization to AI AI optimization, of course.

Majority of the work that potential customers do to research candidates for their solutions is done without talking to sales people. People do it online, they use AI tools for them.

We certainly have been optimizing for that. Let's have a a bit closer look into the modern portfolio.

In our portfolio, we have three three areas. I think it's a very balanced portfolio.

We have two cash cows, the Tectia business and SalaX business, and we have three growth businesses in in there: SalaX messaging, secure messaging; NQX, quantum-safe network encryption; and, of course, PrivX PAM on the on the market. If you have a quick quick look at those, on the NQX, we've been kind of waiting for the market to understand the transition to quantum-safe and post-quantum cryptography.

There are legislations, standards, and in the U.S., they now accelerated it. I have a strong feeling at the moment that the market is picking up moving forward.

The compelling reason for customers to move to quantum-safe hasn't been there earlier, but now I think we're seeing that people have done their analysis, their cryptography inventory, and they they are preparing and executing their transition plans. For instance, we've seen seen that, and you may remember an announcement right at the end of Q1 on some new satellite operators choosing post-quantum cryptography with our NQX tools, and we just demonstrated together with a partner kind of secure encrypted satellite link connection in the Italian defense event, Cybertech, just first days of July.

On SalaX messaging, very strong base, and now, of course, the key thing, some new deals also there in the Nordic markets and Central Europe. We are in the transition to migrate and move customers and to win new customers with SalaX messaging, which is all about sovereignty, right?

We see more and more, especially in Europe, but also in Asia, countries and government organizations that do not want to keep secret messaging or secure messaging in foreign platforms that can be suspectable or accessible for foreign governments, like like Skype, or Teams, or Slack, or WhatsApp, and so on and so forth. They're going to have to control.

France in Europe is a leader in that. Italy is very advanced in in that execution as well, and many many more.

Then, of course, PrivX, which has a lot of functionalities nowadays, it can compete with any PAM on the market, including the market leaders. It is a modern solution, it differs it's different from the legacy solutions on the on the market.

I'll show you a picture in a bit about the awareness and recognition of that moving forward. Like Mikael said, from a growth point of view, the growth is coming from PrivX, a little bit from SalaX.

From the regional point of view, Europe grew 9% in Q2, U.S. 10% even with a weak still weakened dollar exchange rate, and in APAC, we haven't been able to turn it back to growth yet, but that is certainly in our plans.

If you have a quick look at PrivX, and where where where are the growth opportunities and where's the growth indeed actually coming? There are four kind of elements in there.

It's about the modern PAM, for tech-savvy customers, like hedge funds, modern hedge funds. Some of the latest customer wins there are are neobanks and and modern finance institutes and other tech companies, e-tailers, who actually built built their own data centers for AI because there's not enough capacity in in the cloud for AI tools.

That is certainly number one driver for the market, and there we have a competitive advantage. There are not that many modern PAMs like PrivX on the on the market, and the legacy PAMs don't really work in that.

They are too complicated, too cumbersome, and too expensive to run in in that kind of technologically scalable, automated environment. The other market opportunity is with a secure remote access, or OT market for PrivX, for sure for defense, because in defense, like said earlier, everything is privileged, but also with critical infrastructures: energy networks, public safety, and so on, on, and logistics and manufacturing.

Big growth anticipated is really with with the rise of identities from non-human identities, right? Whether they are agentic AIs or they are automated tools that do things in the IT environment, code repository access accesses, automation in deploying new applications and services to the market.

That's going to be like 100 or 10,000 1,000 times more accesses that need to be controlled. For instance, we've already been having that, the legacy access authentication, which are the SSH keys, are our innovation from 30 years ago, is predominantly machine-to-machine, non-human access, and we have already been having customers for a number of years who have just been using our solution for machine identity access and machine-to-machine connections.

Then last but not least, is this trend, especially with large finance organizations, big banks and insurance companies and the likes, to quickly now move from standing credentials, having passwords, or keys, or certificates that lie around and need to be renewed or rotated every once in a while, to automating that so that you get rid of standing credentials, move towards zero standing access or zero standing privileges. SSH keys are part of that.

We have a unique solution. Nobody else can offer it at the moment on the market, where we scan and read all the credentials, keys, and automatically, without having to change anything on the application side, which would be a burden, automatically can automate that and migrate that to short-lived certificates.

Indeed, we are now—there was one European finance institute that made that migration and placed an order for it. We have a few more on the back of it.

We have dozens and dozens of kind of key manager customers, big banks in the U.S., in in in Europe. Now we are seeing also increase in demand in in APAC market for that.

Four areas for for growth kind of drivers for for the market, and and we just need to balance that right and have the right partners working working on it to achieve have access to the right potential customers on the market. Now I said that the challenge has been that not many people know that we have a solution like PrivX.

They don't understand where it is positioned and what are the competitive advantages of that. With the new digital face, launched at the end of Q1, we are improving on that, and like like I mentioned earlier, we've been getting working to get analysts to understand and recognize our solutions.

I'll just flash through a few of them. There's no time to read through them more in detail.

You can find all of these published on our web pages. For the secrets management part, for instance, PrivX solution was last year recognized as a market leader right up there, even ahead of IBM HashiCorp solution.

Info-Tech made a very positive summary and analysis of PrivX, citing it as a significant PAM solution and a thoughtful modern zero-trust positioning. Then moving forward on the secure remote access or OT side, KuppingerCole, one of the leading analysts, recognized PrivX as a leader in all categories in that domain.

Industrial Cyber, which is really focused on that, also took our portfolio analysis, showed and and said that this is a really good secure access solution on the market. The most recent in the beginning of this year now is a Gartner Gartner Group's CPS, cyber-physical systems, summary where they listed 14 vendors—three Europeans, rest are Israeli or Americans—and gave a positive statement on how PrivX works in that environment for the OT secure remote access as well.

On the IT side and modern PAM side, the most prominent market analysis is so-called Magic Quadrant for PAM by Gartner Group. Already last year, PrivX achieved an honorable mention status in there, which means that it fulfills all the technical and functional requirements.

There were 17 companies that do that, and then five more that do not fulfill—are honorable mentions, but do not fulfill all the marketing requirements, like IBM HashiCorp, Microsoft, Okta, Teleport, and CyberArk. Well-positioned there.

Now the most recent one published actually this week on our web pages—this came out in Q2—is KuppingerCole's similar analysis of Privileged Access Management, they call it Leadership Compass, where we are one of the market leaders. The analysts are highlighting the modernity, the scalability, the automation, and the cost efficiency, plus also quantum safety, hasn't been talked much in this critical access to critical resources, whether they are databases, development environments like code, which is our main asset in this company, or networks, or server environments, that it needs to be also quantum-safe, and we have built quantum safety into the product.

There are not that many PAMs that talk about that yet, but it will certainly be. Apologies for a very small picture, here's a bit bigger version of it, you can see that PrivX is one of the red balloons on the right-hand corner there.

Once again, the up there, and the main main findings is is that the market is also changing now. Customers are migrating away from legacy environments to modern hyperscaler, private cloud, public cloud, autoscaling environments using Kubernetes architectures and and and platforms, and the PAMs have to move as well that way.

We have we have that designed from the scratch to fulfill those kind of modern architecture requirements. We just added legacy support in the past years to it.

Indeed, we are seeing quite a few customers now that are using the market-leading products up on the right-hand corner there that are looking for a more modern alternative for their use as well. Then Mikael already mentioned that there were a couple of deals.

We didn't announce them separately, but we we got some European aerospace, defense, public safety company related—this is Leonardo, as you can understand—cases through Polo Strategico Nazionale, which is the Italian sovereign cloud environment. I mentioned in Q1 reporting that we were approved as a technical solution for the PSN environment, and now initial deals, first deals came through that one as well, as well as some other government office office deals.

A large European retail and investment bank, one of the largest internet exchange points, a global MSSP, managed service solution provider, an Asian IT giant and their UK European arm, a real estate holding company, and on the OT, operational technology, manufacturing side, an energy power generation and industrial energy systems manufacturer in the U.S. as well.

A few words about partnering, one of the four key key elements for for growth. That I think can really be divided in two.

The main strategic partnership, of course, is with Leonardo, who became the largest shareholder with targeted share rights issue, and as I mentioned, in last end of last quarter, we have integrated our solution suite into the zero-trust offering. I'll show a picture of that in a minute.

That is really active at the moment, and initial deals have started to come in in Q2 as well, now finally. We need to complement that then also outside of the markets where Leonardo is not that prevalent regionally or in terms of market segments and industries, and there we have strengthened our partner network moving forward forward, and organized also very successful partner events in Tokyo for APAC and here in Helsinki for EMEA in Q2.

Another new partnership was also announced together with Nokia. The PrivX secure remote access is now part of Nokia's industrial edge 5G computing platform.

Customers can can shop it from there as well. Then I wanted to say a bit more about the Leonardo partnership.

I think that is raising a lot of interest. The first point is is that Leonardo has built now through acquisitions and strategic partnerships what I think is a really compelling and competitive value proposition and and offering for zero-trust access management and security.

Driven by identities—already spoke about machine identities—driven by decision policies, policymaking, here a company, a Swedish company Axiomatics, and to some extent PrivX and other identity management solutions also provision policies for access, adding more granular access controls on what a person or non-person can and cannot do on the targets. Then, of course, the enforcement, which is Privileged Access Management, which is PrivX, together with integration with the policy engine.

Then data-related security, which are Leonardo's own solutions available. That combined with the data in transit and network security, where NQX plays a role, also a strategic partnership with a Danish company called Arbit, which is a real leader in data diodes and switches and gateways.

Then last, but certainly not least, the whole end-to-end cybersecurity global cybersecurity center operations which Leonardo has established in multiple in Europe, in Middle East, in Asia, in the U.S. as well, moving forward, and to have kind of detection and response-driven security, not just identity security-driven.

Most of our competitors talk about identity security, but that's just a perimeter security. You have to monitor all the time what are the risks, what are the vulnerabilities, how will they affect the target environments, and how should you govern your access, you know.

If, for instance, network components are under threat, stop providing access to them before they are patched or updated. This whole concept of integrating all of this together is unique unique on the market, and we have a major role in that.

Here are a couple of cases where that has already started to materialize. Already mentioned the sovereign cloud environment in Italy, where PrivX is getting into.

This is a massive investment. There's been about €900 million investment in Italy for that.

It's a €3.6 billion investment all together over 10 years, about €360 million per year. Multiple kinds of services for data centers, for private cloud in Italy orchestrated by Telecom Italia and and and and Leonardo, and then all the access-related controls to public clouds and private clouds, including access management, which in this case is then PrivX.

We have been a secondly, a frame agreement, €300 million frame agreement that was signed earlier by Leonardo and European Commission entities, over 70 entities. Now we have already been a supplier in the European area, organizational area.

This will now strengthen the opportunity to provision our solutions together with Leonardo into a wider space and wider scope in the European environment. This is all about sovereignty, right, and European origin of solutions and services and support.

The last, which was just announced early days in in July here, is a NATO PBN, Protected Business Network, where Leonardo together with Accenture won a 10-year, €200 million deal for protecting NATO networks, modernizing the whole networks and and cloud access and infrastructure security, and adding zero-trust architecture, utilizing the global cybersecurity center on the top of the previous picture, and including including solutions, including PrivX moving forward as well. After all these advancements, it is now time for a change as well.

We announced just a few weeks back that the new CFO, Kristian Arias—Kristian is actually sitting back here, but you will see him in the next quarterly call—will join us in October, and Mikael will continue till end of August. I'd like to express, Mikael, my sincere thanks and gratitude for the for the work in the past years that you've done done here very competently and professionally.

That has been a been a really important part of us moving forward. Then there's another change, which was announced today, is that I have agreed with the board that I will actually retire from this position.

I reached my retirement age, turned 65 earlier this year, still going strong, but it's time for a change for for the CEO. The search for a new CEO has started now, and I will be still here until the new CEO has been appointed and started and will help with the transition, nothing dramatic about that per se.

That's it for today. I think we have an opportunity now for questions and answers, and if Mikael, you want to join me here as well.

All right. As usual, we will start with questions from our analysts, Jakob, please go ahead.

Hi, good morning, Rami and Mikael. Can you hear me?

Yes, perfectly.

Great. Thank you for the presentation and for taking my questions.

I will start with the question on the subscription ARR. That continues to grow nicely, especially PrivX accelerating growth here, but I have a question regarding maintenance ARR.

Can you maybe remind us how we should think about this revenue line as it's weighing on overall growth? Is there any different go-to-market approach, for example, when you sell together with Leonardo or other partners that affects maintenance ARR?

I can answer on that, and then maybe Rami can add if he wants. Almost all of our new sales is subscription sales, and PrivX is basically almost exclusively sold through subscription, very few licenses here and there.

The legacy business, so that would be TKM and Tectia, the majority of that has been sold through licenses, then with maintenance agreements, and hence maintenance revenue associated with those license agreements when they have been sold, and that continues to generate ARR, those maintenance agreements. If we look at the total ARR and the subscription ARR, clearly the subscription ARR is growing, but we have some churn in the legacy products.

Most of that is in Tectia, which has some slight churn, and that is then offsetting the total ARR growth because the maintenance sales is slightly declining, which is then offsetting the growth that is coming from the subscription sales.

If I may, Jakob, add to that as well, we are still kind of closing the final bits of getting to 100 kind of 100% subscription sales both on Key Manager, TKM, and Tectia as well. Those steps have been taken.

I mentioned this migration from Key Manager to automated just-in-time, short-lived access by combining Key Manager and PrivX together. That journey is already going, and the first orders have been received on that, so that will transition over time to subscription.

Also on Tectia, we've been accepting maintenance service payments and licenses for existing customers, but new sales businesses on subscription, quantum-safe subscription also on Tectia. We're still finalizing the final steps of moving to all subscription sales.

Yep. Perfect.

Thank you for the refreshment there. When you sell a subscription as well, for example, a PrivX subscription, there should be some components of support or maintenance into that as well, but I guess it's maybe baked into the subscription then?

Like you say, the subscription contains everything: the license, the maintenance, the support, everything. That's one revenue covering all of that.

Yep. Okay.

Perfect.

The only addition may be in cases where we deliver together with partners or directly some professional services for the initial deployment of larger environments, but rest is embedded into the subscription payment.

Crystal clear. Thank you.

Another question about sales cycles and seasonality. We're entering the vacation period here at least in the Nordics and maybe much of Europe as well.

Do you tend to usually see a slower period of new sales in Q3 or is it more or less the same?

I don't think Q3 differs that much from the first and second quarter in terms of seasonality. If we look at it historically, the fourth quarter has generally been the most active quarter, clearly more active than the last quarters.

Maybe some of that effect has slightly declined, but it's still the most active quarter, the fourth quarter. The third quarter, I don't think you can really see any significant difference to the first two quarters of the year.

Of course, there's some vacations like you say, but it's kind of flowing into several quarters globally when people keep their vacations. I wouldn't say it overall slows down significantly the sales cycle.

Okay. Thank you for that.

I have one question as well. You were listed as an overall leader in the KuppingerCole Compass here recently, and you have previously been named by Gartner, I think it was in Q1, and you have many of this industry acknowledgments.

Just out of curiosity, does these awards generate any interest or inbounds once you have received them, or is it more good to have that acknowledgment when you are in the customer dialogues?

I guess both. When we think about the kind of top balloon on the four PrivX go-to-market opportunities, I would say that this modern tech-savvy organizations that have technical resources, I think they trust more their own technological assessment of vendors' goodness and technology.

Other larger organizations tend to also read, tend to also check from analyst reports on who is a player, what are the alternatives, maybe making a long list and then working down to a short list by examining and studying the offering before they then commit to talking to a vendor and getting into a trial period or test period or proof of concept period, which we always want to get, of course, because then the win rate, probability of winning deals, grows significantly once we get our hands on it. In early stages of studying, they do play a role.

That's why we decided to put a bit more effort and cost into that work as well. It's not only that matters, for sure.

Yep. Good.

Just finally from me, sorry to hear that you are both leaving now, both Rami and Mikael, but yeah, thank you both very much for your contribution to the company over the years, and a very well-deserved retirement, Rami. I hope you will enjoy it.

It would be interesting to hear from your perspective, what kind of CEO profile do you think the company needs going forward to be even more successful than you are today? It would be just interesting to hear from your perspective, Rami.

It's not my decision anyhow. What and who the next one will be, but I think, like I said, we put in place a lot of good things now for growth.

I think it's all about driving growth and accelerating the growth, I think that's the kind of personality. I've been trying, for sure, and I've been spending long days in running around the world, helping the sales teams and marketing to create demand.

I think it's all about accelerating the growth, in my opinion.

Sounds very fair. That's all for me.

Thanks for taking my questions. I'll get back in queue.

Thanks.

All right. Thank you very much.

I will now check the chat. We don't seem to have any more questions, thank you very much, Rami and Mikael, and thank you for participating.

Our next investor call will be in Q3 in October, thank you again, and we hope to see you in October.