Fundamentals
~ 10m MarketCap
23.8m outstanding shares, share-price ~43p
est. net-cash FY26 ~5.6m
est. adj. EBITDA FY26 ~2.4m.
est. EV/EBITDA FY26: 1.8x
debt-free
TL;DR
Shearwater Group is a cybersecurity company that emerged from Aurum Mining, a gold exploration shell, in 2017 and subsequently burned money through expensive and underperforming acquisitions in its early days, requiring regular impairments, restructuring costs and other one-off charges.
I believe that today, in light of recent management actions and a significant acceleration in multi-year contract renewals and expansions, Shearwater Group is more clearly positioned for value realisation than at any point in its history as a cybersecurity business.
Part of the reason is that a deliberate “big hit” impairment was applied in FY25 — the new CFO’s explicit decision to clear all (potential, there is still significant goodwill left) legacy goodwill in a single year, eliminating near-term impairment risk on remaining acquisitions. Further, the overhead cost structure has been actively reduced by completing the remaining integration challenges, and is now supported by a higher revenue base that is back on a growth track through multiple initiatives.
All of this will result in the first genuinely clean set of annual numbers since FY2022 — no goodwill impairments, no legacy restructuring charges, and a statutory P&L that for the first time reflects what the business actually earns. Yet the market assigns essentially zero credit to the improvement. At today’s price of 43p, Shearwater trades at approximately 1.8× forward EV/EBITDA on FY2026 estimates — a multiple at which you would expect to find a distressed or structurally declining business, not one that just signed £44 million of new contracts in just six months.
By FY2027, the numbers become genuinely difficult to ignore. Based on contracted revenue visibility and the cash receipt profile of the £25 million five-year agreement signed in July 2026, Shearwater should report adjusted EBITDA of between £3.0 million and £4.5 million alongside a net cash position of approximately £12 million — against a current market capitalisation of £10 million. At that point, the enterprise value of the entire business becomes negative, and you are effectively being paid to own a profitable, debt-free cybersecurity incumbent with twenty-year relationships across every major UK telecommunications operator.
The bears have a point: this is a low-margin services business with a lumpy cash conversion profile and nine years of statutory losses behind it. Both criticisms are fair. What they miss is that at this valuation, none of that matters. The margin can stay low. The cash can stay lumpy. The re-rating does not require multiple expansion, analyst coverage, or a takeover bid. It requires only that the cash pile grows past the market capitalisation — which the contracted payment schedule suggests will happen within the next twelve months regardless.
Act I: Shearwater Group - a history of shares under water (2017-2019)
Shearwater started life as Aurum Mining, an AIM-listed gold explorer that listed in 2004, returned £23.5 million to shareholders in 2010, and by 2016 had essentially become a cash shell looking for a new direction.
The board — led by Chairman David Williams, known for building the £1 billion Breedon quarrying group through aggressive acquisitions — decided that cybersecurity was the future and renamed the company Shearwater Group in January 2017. What followed was a rapid-fire series of acquisitions that consistently underperformed, burned cash, and required write-downs.
SecurEnvoy: MFA software (on-premise and cloud)
Xcina: Consulting arm, advisory and assurance services
GeoLang: Software for data discovery and data loss prevention
Crystal IT and others: Cybersecurity and business IT services
Obviously, the Breedon (buy and build) playbook did not work out well for Shearwatergroup. This quote from an article in Sharewatch summarizes it quite good:
Williams’ problem early on was too high a central cost base as he put a team in place and a rag bag of four businesses but the fifth one, Brookcourt, has allowed it to prosper. Brookcourt’s founder, Phil Higgins, now heads up the group.
In 2018 Shearwater acquired Brookcourt Solutions for £30.3m followed by Pentest. But the surrounding acquisitions burned cash and destroyed value.
Act II: The turnaround (2019 - 2022)
By 2019, so many shares had been issued that the stock required a 100:1 consolidation, Phil Higgins, founder of Brookcourt, was installed as CEO, Xcina was dismantled, and the company that exists today began. The 700p-to-43p story is largely a story about that era. The business worth owning is what Higgins built from the wreckage: Brookcourt, Pentest, and a leaner SecurEnvoy, now generating £35m+ in revenue and approaching positive adj. EBITDA of ~2.4-3m for FY26.
Brookcourt provides high level consulting for architecture design of a system and engage in penetration testing. Architecture design uses bought-in third party software with Managed services, where consultants manage the various systems.
Typical contract structure: 1-3 year software licenses, accompanied by hardware, support and engineering services, High proportion of repeat business, often with multi-year renewal cycle, ability to service all sectors, with particular strength in FS and telcos.
SecurEnvoy is the higher margin, recurring software business but makes only 6% of total revenues so it is almost negligible. Yet it still has potential (later more).
License own proprietary identity & access management software
Developed in-house through UK-based development team. Sold
globally through network of distributors and resellers
Software deployed with more than 750 clients around world
Typical contract structure: 1-5 year software licenses, contracted through global distribution network. Lower level of ongoing support and maintenance revenue
Act III: 2022 — Light at the end of the tunnel
In 2022, the changes initiated by Phil Higgins seemed to bear fruits when posting the first decent set of results for years.
"I am pleased to announce a year of double-digit revenue and adjusted EBITDA growth for the Group. Key performance highlights include a strong year for advisory work, penetration testing and managed security services. Developing trusted long term client relationships whilst deepening our expertise has allowed us to provide extended offerings to our blue-chip clients resulting in securing some of the largest contracts in our history. In addition, seeing the size of the opportunity in the identity and access management software space, we have continued to invest significantly in our platform catering to this area. This market backdrop, alongside the strength of our teams and security of our financial position, provide us with great confidence into the current financial year and beyond. Source
The group delivered strong organic revenue growth, up 13% to a Group record of £35.9m (FY21: £31.8m)
Adjusted EBITDA up 19% to £4.4m (FY21: £3.7m) with margin maintained at 12%
Adjusted profit before tax up 24% to £3.0m (FY21: £2.4m)
Adjusted basic earnings per share up 10% at 11p (FY21: 10p)
Strong financial position with zero debt and a year-end net cash balance of £5.6m as of 31 March 2022 (31 March 2021 adjusted net cash: £6.0m).
Act IV: 2023/2024 — Disappointing again
FY2023 saw revenue fall 26% from £35.9m to £26.7m — driven by a combination of the end of a large Pentest project that had elevated FY22 revenues, a sterling collapse following the Truss mini-budget that reduced the GBP value of dollar-denominated contracts, and a broader corporate procurement freeze that delayed new contract starts. The order book remained intact though.
FY2024 was the year that continued to disappoint — revenue fell a further 8.5% from £26.7m to £24.4m, and the company explicitly confirmed results were below market expectations when it reported in July 2024. Three things were still working against it: the contract delays from FY23 had not fully unwound, Pentest had not found a replacement for the US project that had inflated FY22, and SecurEnvoy was losing new business ground to Microsoft's free authenticator product. What made FY2024 different from FY23 was not the revenue line — it was what was happening beneath it.
… Looking forward
Between April 2024 and July 2026 — roughly twenty-six months — a lot has changed. This does not mean that it is safe to assume that SWG will become a fundamentally better business with strong growth, solid margins and ultra-high predictybility in their revenue and cash generation profile. I admit it is early. And: Looking at 9 years of destroying value for shareholders does not make it easier to believe in a bright future.
Yet, it is important to understand what changed to understand why I believe that SWG looks interesting today.
The Changes
Appointed a new CFO with public company IPO experience in September 2024 (RNS)
Appointed Robin Southwell (RNS) in January 2026 (yellow flag: Former NED since 2016, so still involved in the ugly history) as new Chairman with forty years in UK aerospace and defence (recently SWG renewed its defence sector contracts, by accident?)
Expands into goverment sector with first government contracts won through G-Cloud 15 (record no. of applications submitted)
Capex Cycle for SecureEnvoy looks kind of completed with promising comments regarding growth potential through its option to be deployed on-premise where Microsoft Authenticator is no competitor (Expanded into the Middle East through a capital-light distributor)
Completed integration of the last of its legacy acquired businesses xcina
Signed £44m of new and expanded contracts in just 6 months including a £25m five-year renewal with a global telco
Wrote down every piece of (estimated!) remaining acquisition goodwill in a single clean hit to report “clean” numbers going forward
Forecasted net cash to amount to almost 7m in FY26 (revised down to 5.6m with 1.4m falling into Q1 FY27)
And here is the teaser:
The only publicly available resarch report on SWG (Cavendish) is outdated as it was published in March 2026, before the company announced the 25m deal (RNS). This has two important consequences.
In that RNS they announced that the cash shorftall of 1.4m for FY26, however the Cavendish report modelled 1.4m within FY26, so the Cavendish net cash forecast of 7.8m excludes the 1.4m so updated net cash forecast for FY27E must be 9.2m.
The 25m deal is not modelled in the estimated net-cash position for FY27 at all. 12.5m was recognized in FY26 and the contract runs for 5 years so 12,5m distributed across 4 remaining years could result in additional cash inflow of 3m or more. But what about the 12.5m recognized in FY26? Will it be paid as lump-sum payment in early FY27 or also distributed across man years? At this point we can only guess but the most conservative estimate would be 9.2m plus further 3m net cash (total 12.2m net cash against mcap of 10m) for FY27 - excluding any cash effects from the 12.5m revenue recognition in FY26 to be conservative.
So in FY27 shareholders get most likely paid to own a now profitable cybersecurity business that could grow from here for free!
44m+ Recent Contract Wins, increasingly multi-year contracts
Jun 2026: £25m / 5-year contract / global Telco / 12.5m recognized in FY26 / first cash receipt in Q1 FY27
Apr 2026: £1.8m / major UK Telco
Mär 2026: £1.3m / major UK Telco
Jan 2026: £9.0m / 3-year contract / global financial organisation / 2.7m recognized in FY26
Dez 2025: £7.3m / 3-year contract / UK mobile network operator
Nov 2024: £12.4m / 5-year contract / global mobile telecom
The reason to believe it continues: the revenue base is now anchored in three to five year contracts rather than annual projects, every major UK telco is a client, the overhead structure has been actively reduced, and three growth channels — government, defence, and Middle East — did not exist in the business that peaked in FY2022. The business entering FY2027 is something structurally different to the one that collapsed in FY2023.
Goverment as opportunity
From FY26 H2 results:
Historically we stayed away from the government business simply on a large scale, simply because of the bidding and we're so aggressive in the price point. But we have some unique services and solutions which we can take to the government now, and we, won our position on the GCloud 14, and we've now submitted our GCloud 15, and, we've nearly doubled the solutions and services we're presenting through.
We've been winning some very large departments, some of the biggest departments in the, in the government, are now clients of ours.
So, and with the, when you look at our services and solutions, we do see a lot of repeat business, a lot of opportunity to renew. And we've seen it with one government department where they purchased one year from us and they, renewed in, H1, and we saw that as being a, that moved to a 3 year deal. So they're seeing value in the product set, they're seeing value in the solutions we're offering, and commercially, obviously we're, landing with the right number. And, you know, to us now, it's, certainly worth the investment.
Growth channels that did not exist in FY2022
Government was zero in FY2022. Shearwater secured G-Cloud 14 approval during FY2025, submitting approximately 25 solutions. G-Cloud 15, submitted in FY2026, nearly doubled that to over 50. CEO Higgins stated in the H1 FY2026 investor presentation: “Some of the biggest government departments are now clients.” An internally-built AI tool now processes bid documentation in thirty seconds rather than days, increasing bidding capacity without additional headcount.
From their final results (RNS) FY2024.
The team remains focused on converting the significant pipeline of opportunities across both divisions, with deepened expansion into Government departments remaining a key strategic priority and a major growth avenue for the business. We are confident in returning to growth in FY25 and in delivering solid, sustainable revenue and profit growth in the years ahead.
The H1 FY2026 interims disclosed renewals and expansions of existing contracts with suppliers to the UK Naval Defence sector — confirming Brookcourt already had a foothold in the defence supply chain, which is now being actively developed under Robin Southwell, replacing David Williams as Chairman in Jan ‘26, with forty years of aerospace and defence experience.".
Tier 2 and Tier 3 managed services are earlier in development but potentially the most significant margin lever. CEO Higgins described the opportunity in the FY2025 investor presentation:
What we’re looking to do is step down from some of the larger corporates into the tier 2 and tier 3 marketplace where they don’t have the skill sets available — managed services where we can enjoy margins of 20, 30 and 40%.
The Middle East and West Asia, entered through represent a structural opportunity for SecurEnvoy specifically. Data sovereignty rules across the Gulf mandate on-premise authentication solutions — precisely the model that Microsoft’s free cloud-based Authenticator cannot displace. Shearwater secured AdvanzaTech as a regional distributor during H1 FY2026, a capital-light entry requiring no local infrastructure.
The overhead structure is demonstrably leaner
The H1 FY2026 interims (RNS) showed revenue up 31% year-on-year while adjusted administrative expenses fell 6%. That is operating leverage made visible. The integration of Xcina into Brookcourt and GeoLang into SecurEnvoy — completed in FY2025 — removed the cost drag that had made the business structurally fragile when revenue fell.
From their final results (RNS) FY2023:
We aim to further enhance our internal efficiencies by merging GeoLang with SecurEnvoy to form a unified software company, which will be referred to as SecurEnvoy Data Discovery. Furthermore, we are merging the client-facing activities of Xcina IS and Xcina Consulting into Brookcourt Solutions. This integration will result in improved efficiencies, reduced complexity, and a simplified message for the Group.
The half-year break-even point now sits at approximately £13m of revenue; H1 FY2026 delivered £14m. At the FY2027 revenue trajectory of £19-21m per half-year, the operating leverage effect becomes substantial.
Management Team has been rebuilt
Goodwill impairments
Shearwater Group has had a lot of (non-cash) impairments related to its underperforming acquisitions and other exceptional “one-off” charges distorting accounting profit and making its performance look even worse.
FY19: 1m impairment (for legacy mining assets)
FY20-FY22: No Impairment
FY23: A non-cash impairment of £6.0 million has been recorded in the current year reflecting a write down of goodwill held for the Group’s SecurEnvoy and Xcina assets.
FY24: No impairment
FY25: Impairment of goodwill and intangible assets: £11.1 million (FY24: £nil); primarily relating to a reduction in the carrying value of goodwill and acquired intangible items from the acquisitions of SecurEnvoy Limited and Pentest Limited
However, as FY25 was the year of the “big hit” in terms of impairments and restructuring has completed to reach clean numbers, Shearwater Group will report clean numbers in FY26 and FY27.
From the FY25 (15 months ended June) Q&A
Maybe we could have fought a little bit harder this year to have impaired a little less. Some impairment was always going to be appropriate. We decided to be relatively strong in terms of how much we wrote that down by for exactly that reason — we want a clean set of numbers next year. (CFO Hall)
So while the significant impairment shocked investors, it removed uncertainty about numbers for the next years where no further impairments are expected.
New accounting policy
It is to mention that from FY25 onwards Shearwater Group uses a new accounting policy that recognizes higher margin deployment revenues and costs separately from lower margin revenues and costs associated with hosting.
Pre-FY25 the deployment of a cloud-hosted solution recognized everything upfront at time of deployment resulting in overstatement of revenues in the short-term and understatement of future revenues.
After the policy change, for cloud hosted solutions only the deployment part is recognized upfront, the remaining “tail” of lower margin hosting/reseller revenues are spread over the contract time.
This increases revenue visibility, albeit making margins a bit more fluctuating. H1 FY26 demonstrates exactly this: H1 FY26 had lots of tail revenue from prior contracts and less deployments making the gross margin look lower while it is actually somewhere around 21-22%.
The new policy is more conservative and more accurate.
Move of the year-end
In January 2025, Shearwater moved its financial year-end from 31 March to 30 June. The reason, as CFO Hall explained to investors, was straightforward: the March year-end fell in the middle of the busiest contract-closing period in the UK calendar, when corporate budgets are finalised. Small timing differences — a contract signed days before or after 31 March — created outsized swings in reported revenue and working capital that told investors very little about the underlying business. The June year-end smooths this effect and, as Hall put it, "gives us a clean basis from which to move forward." FY2026 will be the first full twelve-month period reported on this basis — another reason why September 2026 is the first set of numbers worth reading.
Quotes from recent Management interviews
In a recent interview (link) by vox markets, Higgins makes clear that their strategy is two-fold.
First, “organic growth is very very important”. Secondly they are looking at “aquisitions of suitable cash generative organizations which will complement our portfolio.”
From the investor call (link):
We weren't involved in the previous acquisitions [… ] we get an awful lot of opportunities thrown at us as [… ] and we're going to be very selective about what we buy. We're not buying for the sake of buying […] sort of things that we are interested in, it's managed services, good, strong, double digit margins [… ] obviously, software, if we can find complementary software at a reasonable price, then, that will be added. But it's gotta be able to actually stand on its own 2 ft and be able to contribute to the bottom line.
So this seems to be very different in a positive way than what Shearwater did in the years 2017-2019.
And finally: “We spent the last few years building our organization into a position where we can actually start returning shareholder value.”
In another interview, Southwell confirms some of these points indirectly:
We will look back on these two years as a solid organic growth business... In two years I want to show that we've delivered it, maybe overdelivered it… On the way there may be a company or two that we can pick up to drive it forward. I think we're very lucky that we have a really strong executive management team. I think the recent introduction of Jonathan into this has been really well-received and he's taken us to the next level.
And this makes sense. CFO Hall …
decided to take the aggressive goodwill impairment ("we could have impaired less — we chose not to")
decided the accounting policy change ("it's the right thing to do under IFRS 15")
explicitly sets the cash threshold for buybacks ("north of £5m genuine cash, then we look at options")
commented on acquisition criteria ("cash generative organizations only")
Valuation
At 43p, the market cap is £10m. At any reasonable cybersecurity services multiple on current EBITDA, the business is worth £20-35 million. In a base case where EBITDA returns to FY2022 levels (£4m+), which the operating trajectory supports, the business is worth £25-40 million.
The downside is real but bounded: no debt, operating cash generation from Brookcourt, a CEO whose personal wealth is tied to the share price, and a contract pipeline that makes the next 12 months of revenue largely visible.
The upside is a 2-4× return when the market reads the Annual Report properly.
Conclusion
There are two angles to look at a potential investment in Shearwatergroup.
Approach A: SWG is a lumpy low-margin business with a loss making history
SWG has burned through underperforming acquisitions, has been consistently loss-making over the last nine years and a single good financial year never proofed to be a safe catalyst. Why should future acquisitions not destroy value as the have always done?
Approach B: SWG is changing to the better and has a huge cash-pile
SWG has shown credible momentum in the last 6-12 months. 20 years of telco relationships is a valuable asset, multi-year contract renewals and expansions don’t happen by accident. Impairments are gone, admin expenses have been reduced, accounting policy has changed for the better, new growth avenues as well as margin levers have been identified. We don’t pay for the business, nor for the improved outlook. It’s a free lunch.
Both angles matter — but differently
The asset-play is the floor. At 1.8× EV/EBITDA with no debt and sufficent cash to sustain operations, the downside is bounded. Even a mediocre business doesn’t trade at 1.8× EV/EBITDA for long.
The business quality is the ceiling. If Brookcourt is genuinely the 20-year incumbent with sticky telco relationships and growing government exposure, the upside is 2-4× from here. If the company continues to disappoint despite all of those strategic actions and looses momentum again from FY27 onwards, the upside is still 1.5-2×.
You don’t nee to believe in the ceiling to make money on the floor. At current prices, you are being compensated to own the floor regardless of whether the ceiling materialises.
Why nobody has noticed
1MCap £9m: Below every institutional mandate threshold
Zero analyst coverage: No EPS estimates, no price targets
Outdated Broker research: Net-Cash for FY27 significantly understated by 40-50%
Screener distortion: –£9m “EBITDA” drives auto-filters
Name: “Shearwater Group” gives no sector signal
AIM: Lower visibility than Main Market
Pentest impairment scared retail investors
Not investment advice. My own views, my own mistakes. I may be long. Do your own research.
I noticed.
Thanks for the pitch! One question: Where did you buy it? Seems that on IB it is hard to buy? Did you use a German Broker?