Cambridge-based GRC International (GRC:AIM) has raised £5m to support growth plans as part of its listing on the London Stock Exchange’s AIM market today (5 March).
Its shares jumped more than 23% to 86.5p in early trading as investors rushed to get exposure to the cyber security training and consultancy business.
Investors are no doubt also attracted to the stock because its chairman and 19.6% shareholder Andrew Brode has made many people rich with his other interest, patent translation firm RWS (RWS:AIM).
RWS has increased 10-fold in value since December 2008, helped by acquisitions and a general growth trend for intellectual property protection.
Brode led the management buy-in of RWS and is now executive chairman, owning 33% of the business with his stake worth £403m.
WHAT DOES GRC DO?
GRC operates in three parts: publishing/software, training and consultancy.
Publishing and software includes in-house or third-party technical manuals for IT professionals, plus a bit of intellectual property developed through its subsidiary Vigilant Software.
As one analyst tells Shares, this isn’t cyber security software per se, more like management and enterprise decision-making tools focused on information security.
Training comprises classroom-based courses for educational and professional/ISO (International Organisation for Standardisation) certification purposes.
The most important bit appears to be consultancy services. This provides clients with expertise advice and guidance around governance, risk and compliance - you can see where it got its name.
It also advises on technical services, includes IT system and website penetration testing, payment card security assessments and more.
Investors reasonably familiar with the UK stock market-quoted cyber security space might think of GRC as a mini NCC (NCC), without the escrow business line.
GRC claims to have ‘grown strongly over the last two years’ and while that seems to be the case judging by the numbers, it’s from a very small base.
For example, it generated revenue for the year ended 31 March 2017 of £6.83m versus £4.85m in 2016. Pre-tax profit came was £0.71m in 2017 versus £0.17m the year earlier.
WHAT’S THE MAIN DRIVER?
Consulting looks likely to be the chief growth river down the line. There is little doubt that against the backcloth of new and complex EU-wide GDPR rules (General Data Protection Regulation) demand for cyber security consulting is high.
The question for investors is whether GRC is can overcome its limited scale to capture a decent chunk of potential new business. For example, does it have the trust of larger organisations? Can it also cope with possible lumpy new business wins?
As other small cyber specialist hopefuls have found to their cost, new contracts come in fits and starts making accurate forecasting a bit of a minefield, leading to growth surprises both good and bad.
