Guest Pitch: NCC Group (NCC:L)

Strategic Review and Sale Process – 20% Upside (at 144p)

This idea was shared by Swen from Undervalued Shares.

Summary

NCC Group is running a sale process for its main business division, which could be worth 80% of the current market cap. Management has publicly committed to returning a significant portion of the proceeds to shareholders. NCC has also recently initiated a strategic review of the remaining business, opening the door to a full company sale. Several new developments suggest that a transaction announcement may be imminent. The company’s largest shareholder is a prominent dealmaker who has taken a sizeable position in NCC relative to his net worth, signaling high conviction in a near-term outcome. The potential upside in a full company sale scenario is around 20%, while the downside looks fairly limited. If only the main division is sold and the proceeds are returned to shareholders, the upside would likely be similar, as capital distribution would most likely be executed via tender offer at a premium.

The setup

NCC Group is a London-listed cyber-security and software resilience firm that operates two distinct divisions: cybersecurity (under the NCC brand) and software resilience (under the Escode brand). In cybersecurity, the company’s products and services help companies and governments to protect themselves against the evolving spectrum of cyber threats. In software resilience, the company offers an escrow service for safely storing software code. These two divisions jointly help clients to enhance their operational resilience for all things cyber and software, but they are operationally independent.

During the early 2020s, NCC Group benefited from the wider tech boom and its share price doubled within two years. However, post-pandemic headwinds exposed structural issues: excessive leverage, an overly complex global footprint, and heavy reliance on US clients. By mid-2023, the share price had fallen more than 75% from the peak.

Management responded by simplifying processes, refocusing on strategic clients, and disposing of non‑core assets. The latest divestment – a crypto‑related business sold for GBP 65.6m – left the group debt‑free with GBP 13m of net cash (30 September 2025).

During the next few months (or even weeks) attention turns to the future of Escode; and, by extension, the entire NCC Group.

As early as April 2023, analysts speculated that Escode might eventually be sold. The software escrow business is a crown jewel, but it has virtually no synergies with the core cybersecurity business run under the NCC brand. At the time, analysts at Panmure Gordon noted that “the accelerated investment in the high growth cyber security services business makes sense, with a disposal of Escode the most likely result of the strategic review.” Back then, Escode was believed to be worth roughly GBP 240m.

The sale of Escode didn’t happen that year, but the topic resurfaced in April 2024 when Mark Kleinman, the City editor of Sky News, reported:

“Buyout firms circle £400m NCC division Escode. Private equity groups including Montagu and Bridgepoint are exploring potential bids for the software escrow and verification unit of cybersecurity specialist NCC Group, Sky News learns. Several other private equity firms are also said to be interested, although a formal auction is not under way and the identities of the other parties was unclear.”

In a June 2025 update for shareholders, NCC Group reported:

“The Group is investigating options for its Escode business including a potential sale and is now holding discussions with interested parties. If a transaction were to conclude it would enable the Group to consider a significant return of capital to shareholders and further investment in the Cyber Security business.”

In an October 2025 update for shareholders, NCC Group stated it is “…investigating a number of options for its Escode business including a potential sale (Escode Review). We currently remain in that process and we will provide a further update in due course.”

Another “update” of sorts is now available to anyone who bothers to keep an eye on the company register of Jersey, the offshore financial centre that many British companies use for tax optimisation. Public filings in Jersey show that “Escode Jersey Holdco Limited” was reserved on 6 November and  incorporated on 18 November 2025, with NCC Group’s CEO, Michael Maddison, listed as a director.

Anyone familiar with M&A transactions will know that lawyers tend to reserve company names and incorporate shell companies once a deal is getting close. Having entities registered helps with getting deals to completion, or they can help with restructuring existing groups ahead of a deal.

One would assume that corporate bidders and their lawyers would not generally use “obvious” names, as this could give away the game if someone goes to the necessary lengths for monitoring company registers. Then again, not every lawyer realises there are eagle-eyed investment bloggers out there.

Is this company registration a guaranteed sign that something is about to happen in the case of Escode? Not necessarily. It is likely NCC Group registered this entity ahead of restructuring how it owns its subsidiaries. This could have been done with a view to using Jersey to tax-optimise proceeds from a sale, but there could also be other reasons.

However, there have simply been too many significant clues in the context of the company’s ongoing strategic review recently;

• “NCC Group Jersey HoldCo Limited” was reserved on 4 November 2025. Clearly, there is something going on regarding NCC Group’s future corporate structure.
• On 14 November 2025, a new entity – “Einstein BidCo Limited” – was registered. One of the two directors is Marc Bala, Managing Director at Symphony Technology Group (STG) in San Francisco, a USD 10bn software-focused private-equity firm. On LinkedIn, Bala’s role is described as “private equity investor in software and technology enabled services businesses. Specialties: Buyouts, recapitalizations, carve-outs, growth equity investments.“

Bala is also a director of Skyhigh Security, a cybersecurity firm established by STG in 2022 to provide cloud security solutions for large and small organisations. Furthermore, Bala is a board member of Trellix, a company that claims to deliver one of cybersecurity’s broadest AI-powered platforms.

STG also acquired Gresham Technologies PLC, a London-listed company that provides software to manage financial data, transaction processing, and regulatory reporting for the financial services industry. Through its bid vehicle, Alliance Bidco, STG paid GBP 147m which was a 27% premium. Clearly, the sectors that NCC Group operates in are of interest to the Californian private equity firm.

Is STG preparing a bid for Escode – or even for NCC Group as a whole?

Nothing is guaranteed, but the timing is conspicuous. Multiple entities related to NCC and Escode, and at the same time a company registration takes place in the same jurisdiction for a BidCo managed by a private equity veteran who is specialised in this sector.

In fact, NCC Group itself had mentioned in its October 2025 update that management was also considering the sale of the cybersecurity division:

Further to a subsequent announcement on 16 July 2025, the Board confirms that the Group remains in the early stages of a review of all strategic options for its Cyber business should the Escode business be sold, this includes a range of potential outcomes including potential offers for the entire issued and to be issued share capital of the Company, and that no decision has been made regarding which options will be pursued.

Given the overall circumstances, it seems more likely than not that we are getting very close to seeing some kind of transaction at NCC Group.

If you believe this to be the case, then the question is, what will it yield for shareholders?

The baseline assumption should be that Escode gets sold. The subsidiary generated adjusted EBITDA of GBP 14.8m during the first half of 2025 and should generate about GBP 30m for the entire year. Based on its market-leading position and its recurring revenue, it seems likely that Escode would fetch GBP 300-350m. It could fetch more if a bidder opines that Escode could easily raise prices, given how locked-in its customers usually are.

NCC Group is currently valued at GBP 454m (based on a share price of 148 pence). Considering net cash of GBP 13m, the remaining cyberse-
curity business is valued at ≈GBP 100m.

NCC’s cybersecurity business generates EBITDA of GBP 20-25m (based on GBP 11m generated during the first half of the current fiscal year). The cybersecurity sector is currently undergoing a consolidation, driven by large acquirers such as the Big Four firms. A strategic buyer could easily pay GBP 200m, if not more.

This leads to the following two possible scenarios for shareholders of NCC Group:

• Scenario 1: Escode is sold, generating net cash near GBP 350m or more. Undervalued-Shares.com learned that NCC has privately indicated to shareholders that the proceeds would be returned rather than reinvested. A tender offer would be the logical mechanism, and it would be unlikely to come in at anything less than 175 pence per share since this is the fair value currently attributed to the company by several analysts. Anyone who doesn’t tender their stocks would then remain invested in a focussed, successful cybersecurity firm.
• Scenario 2: the entire company is sold – potentially to a bidder such as STG – which would require a meaningful premium. The possibility of someone making a bid for the entire share capital of NCC Group was already mentioned in the October 2025 trading update. In other words, all possibilities seem to be on the table.

Someone who appears to be betting on *something* happening in any case is Richard Griffith, a major private investor in British public companies. In the 2000s and early 2010s, Griffith had made headlines as chairman of one of the UK’s fastest growing and dynamic investment banks, Evolution Beeson Gregory. He is a “self-confessed lover of deals” and regularly pops up on the shareholder registry of UK-listed companies. At the time, Griffith had taken his investment bank to be the #3 dealmaker in UK-listed companies. Clearly, he knows how corporate deals work, and he probably has a unique network to gather intel from.

At NCC Group, the man also known as the “Welsh Wizard” is currently the second largest shareholder with a 15% stake. His stake is split between owning 10.37% outright and a further 4.65% through CFDs. That’s Griffith controlling shares worth GBP 70m, which is unusually large even for him.

The most recent estimate of his net worth was GBP 300m and stems from 2018. Since then, information about Griffith has become difficult to come by. He has moved to a finance centre that is slightly more private – Jersey! Even if he was a fair bit richer now, shares worth GBP 70m will still be a hefty investment for him.

Griffith will have a good handle on developments at NCC Group. From 2018-2021, he held a disclosed stake in a public company called Idox PLC. The chairman of NCC Group, Chris Stone, is also the chair of Idox.

There are simply so many clues that sleuth investors will pick up on. E.g., Lombard Odier has also recently been buying more shares in NCC Group. Griffith and Lombard Odier were both involved with a company called Nanoco PLC, where in 2023 Griffith had joined an activist campaign.

There would have to be a lot of coincidences for some of these aspects not to conspire to an imminent deal at NCC Group.

After reaching 178 pence around two months ago, the share price has pulled back to 148 pence, offering renewed upside for investors willing to act before a catalyst. If NCC Group is sold at the baseline valuations outlined above, the upside is around 20%.

The upside could be higher if Escode receives an above-midpoint valuation. E.g., if Escode received a GBP 400m bid and the cybersecurity division was valued at GBP 250m, the stock would have ≈45% upside. This isn’t a speculation with huge upside, but the catalyst could be imminent, and downside appears fairly limited. For anyone following UK corporate action opportunities, this is now a situation to watch closely.