F-Secure
Extensive report
11/17/2021 07:45

Atte Riikola+358 44 593 4500
atte.riikola@inderes.fi

Inderes Corporate customer

Stable growth and value creation through special situation
F-Secure is currently in an interesting special situation when the company is strategically assessing the possibility toseparate its consumer and corporate activities into own companies. We see consumer and corporate security as morevaluable separately than together but believe that this is already fully reflected in the share value. We reiterate our
Reduce recommendation for F-Secure, but raise the target price to EUR 5.3 (previously EUR 4.8 ).

Recommendation

Separating consumer and corporate security would clarify the focus and value creation of the businesses
Over the past six years, F-Secure has successfully transformed into a versatile provider of cyber security products andservices, whose growth investments focus on corporate security. At the same time, the growth outlook in consumer
security has also improved in recent years, and to exploit this potential, F-Secure is assessing strategic options, where
one is listing consumer security as a separate company. We believe this arrangement would considerably sharpen FSecure's strategy and also clarify the value creation of the share. Consumer security that is growing strongly andgenerating very good cash flow (revenue 2021e: 106 MEUR) would, in our view, be profiled as a stable dividend payer
as a stand-alone listed company. Similarly, in the more rapidly growing corporate security market, growth is still the key
value driver and available market shares are in part being fought for at the expense of profitability. Thus an
independent corporate security business (revenue 2021e: 131 MEUR) would, in our view, be priced through a
combination of the EV/Sales multiple and growth and profitability.

EUR 5.3(previous EUR 4.8)

Accelerated growth targeted in corporate security
In the medium term, F-Secure aims for double-digit growth in corporate security and high single-digit growth inconsulting. With the launch of the cloud-native and modular Elements platform last summer, F-Secure can provide
modular individual solutions or comprehensive endpoint protection (EPP) solutions. The stronger product offering has
also increased cross-selling potential in recent years. For example, the detection and response product EDR can help
more than double the value of a traditional EPP client. Significant investments in managed detection and response
solutions (MDR) in recent years have also started to bear fruit as accelerating growth.
Good growth opportunities in consumer security through partner channel
In consumer security, F-Secure's target is medium-sized single digit growth (~5%) in the medium-term. Consumers
seem increasingly willing to pay for cyber security, order renewal rates (>97%) are excellent, and average invoicing(ARPU) has been raised with F-Secure's expanding product offering. In view of future growth, the operator channel(73% of revenue) is particularly important and increasingly players outside the operator realm (e.g. insurancecompanies) also act as F-Secure’s partners.
Separating business activities creates value
We believe consumer and corporate security are more valuable as separate companies and consider the arrangement
likely. Thus, a sum of the parts calculation currently works best for the valuation of F-Secure. In our updated sum of theparts calculation (EUR 5.3 per share), we rely more on 2022 estimates, which indicates that F-Secure's share seems tobe neutrally priced. We feel that stretching the valuation further would require stronger growth in corporate security ora path to significant profitability improvement, which is not happening based on F-Secure's medium-term objectives(adj. EBITDA 20% vs. 2021e: 15%).

Share price:
5.46

R isk
Buy

Recommendation

Reduce(previous Reduce)

Accumulate
Reduce
Sell

High

Low

Key figures
Revenue
growth-%EBIT adj.
EBIT-% adj.
Net Income
EPS (adj.)

2020
220
1%
22.9
10.4 %
12.9
0.10

2021e
237
7%
26.6
11.2 %
15.7
0.13

2022e
255
8%
29.6
11.6 %
19.3
0.14

2023e
273
7%
33.5
12.2 %
22.9
0.16

P/E (adj.)
P/B
Dividend yield-%
EV/EBIT (adj.)
EV/EBITDA
EV/S

39.8
7.4
1.0 %
26.0
16.7
2.7

43.4
9.4
0.7 %
31.8
24.1
3.6

40.3
8.3
0.9 %
28.0
20.5
3.3

34.6
7.2
1.1 %
24.2
18.2
3.0

Source: Inderes

Guidance(Unchanged)

Revenue from corporate security products is expected to
grow at a high single-digit rate. Revenue from consumer
security is expected to grow approximately at the samerate as last year (2020: 5.5%). Adjusted EBITDA is
expected to remain approximately at the previous year's
level (35.7 MEUR).

Share price
6,0
5,5
5,0
4,5
4,0
3,5
3,0
2,5
2,0
1,5
1,0
11/19

Revenue and EBIT %

217

•

0,16

12,0 %
0,13

10,0 %

4,0 %

0,04

2,0 %
2/20 5/20 8/20 11/20

2/21

5/21

0,0 %

8/21

2018

2019

OMXHCAP

Separating consumer and corporate security
Strong demand outlook on corporate security
marketF-Secure has good preconditions to invest in
growthStable growth and good cash flow in
consumer security
Scalable and recurring business model by
nature2020
Revenue

2021e 2022e 2023e

Risk factors•••

Tight competitive situation in the market andrapid rate of change
Success of growth investments in corporate
security
Cyber security market potentially overinvested

0,03

0,00

0,00

2018

2019

EBIT-% (adj.)

Source: Inderes

0,14

0,10

6,0 %

Value drivers•

14,0 %

8,0 %Source: Thomson Reuters

•

273

191

F-Secure

•
•

220

237

255

EPS and dividend

0,04

0,04

2020

2021e

EPS (adjusted)

0,06

0,05

2022e

2023e

Dividend / share

Source: Inderes

Valuation

2021e

2022e

2023e

Share price

5.46

5.46

5.46

Number of shares, millions

158.4

158.4

158.4

Market cap

865

865

865

EV

846

828

808

P/E (adj.)

43.4

40.3

34.6

P/E

55.0

44.7

37.7

P/FCF

62.5

33.9

31.4

P/B

9.4

8.3

7.2

P/S

3.7

3.4

3.2

EV/Sales

3.6

3.3

3.0

EV/EBITDA

24.1

20.5

18.2

EV/EBIT (adj.)

31.8

28.0

24.2

Payout ratio (%)

40.3 %

40.9 %

41.5 %

Dividend yield-%

0.7 %

0.9 %

1.1 %

Source: Inderes

Contents

Company description and business model

5-13

Investment profile

14-16

Industry

17-22

Competition

23-24

Strategy

25-27

Financial position

28-30

Estimates and valuation

31-37

Tables38-42Disclaimer and recommendation history

43

4

F-Secure in brief•

F-Secure offers cyber security products and services,
whose solutions help thousands of companies andmillions of consumers protect themselves fromsecurity threats.

•

Endpoint protection
focused antivirus
company•

Focus on consumer
customers

1988
Year of establishment•

Cloud storage
business sold in
2015•

Transforming into a
more versatile
provider of cybersecurity products
and services•

Focus on growing
corporate security
markets

1999
IPO

Expansion to
the cloudstorage market•

250

EUR 220.2 million (+1.3% vs. 2019)•••

Growth pick-up
following the COVID
pandemic
Planned separation of
consumer andcorporate security
Sharpness and focus in
the strategies of bothbusinesses

MWR acquisition
to accelerate
growth strategy

Revenue 2020

200

+16% 2015-2021e

106

EUR 35.7 million (16.2% of revenue)
Adjusted EBITDA 2020

1,678

Revenue (MEUR)

Average revenue growth from corporate security

150
13
2

45% / 55%

19

16

2

120

2019

2020 2021e

98
96

66

74

86

78

94

92

92

96

50

Share of consumer/corporate security in revenue 2020

122

95

4

100

Personnel at the end of 2020

16

95

100

131

96
47

50

49

47

47

45

46

52

2008

2009

2010

2011

2012

2013

2014

2015

63

72

0
Source: F-Secure / Inderes

Corporate security
Yritystietoturva

Consumer security
Kuluttajatietoturva

2016

2017

2018

Discontinued (lopetetut
operations toiminnot)(Cloud storage)
Pilvitallennus

5Company description and business model 1/6
Company description
Software company focusing on cyber security
F-Secure’s roots are deep in antivirus software
business, where the company has operated since its
establishment (1988) and, in practice, for as long as
computer viruses have existed. Through its history, FSecure has developed strong expertise, reputation
and brand in preventing malware and security
attacks, and in how malware develop and theirindustrial logic works. F-Secure’s antivirus softwarefor endpoint devices have won numerous awards ininternational security testing and the company’s
endpoint device protection products have been soldto millions of consumers and hundreds of thousandsof companies worldwide.
Historically, F-Secure’s business has focused onstrong antivirus expertise, where the basis is theprevention of attacks and threats. However, thesecurity market has changed over the past decadeand the idea of preventing all attacks has become
impossible. Technological developments have mademalware and data breaches much more intelligent
and constantly evolving. Thus the market has shiftedfrom attack prevention increasingly towards rapid
detection and a mindset where cyber security is seen
more as processes than products. This is particularly
evident in the corporate security market, where theneed for different detection and response solutions
and consulting services has grown significantly andthe market is growing strongly. In response to market
changes, F-Secure has successfully transformed froman antivirus company to a versatile provider of cybersecurity products and services over the past six
years, with growth investments focusing on
corporate security.

The consumer security market is in a much moremature phase and growth is more stable. However,with the COVID pandemic and increased remote
work, consumers are more willing to pay for cybersecurity and thus F-Secure's growth potential in thisarea has improved. To exploit these opportunities, FSecure is assessing strategic options, one of which islisting consumer security as a separate company. We
believe this arrangement would considerably
sharpen F-Secure's strategy and also clarify the value
creation of the share. In recent years, consumer
security has been overshadowed by corporate
security in F-Secure's strategy and its strong cash
flows have primarily been invested to grow corporate
security.

Revenue distribution (MEUR)
250
200
150
100

95

100

122

120

106

95
92

92

98

96

96

50

96

45

46

52

63

72

2013

2014

2015

2016

2017

131

0
Corporate security
Yritystietoturva

20182019 2020 2021e

Kuluttajatietoturva
Consumer security

F-Secure today
In 2021, we estimate that F-Secure's revenue willgrow by 7.5% to EUR 237 million and adjusted
EBITDA will be EUR 37.8 million (16% of revenue). We
estimate that the share of corporate security inrevenue is 55% and consumer security is 45%. In
corporate security, revenue growth (CAGR 15-21e:16%) has been strong in recent years and partly
supported by acquisitions. In consumer security,
growth (CAGR 15-21e: 2.1%) has been stable.
Revenue is highly recurring by nature and is basedon annual licenses of various durations and monthly
subscription sales. Geographically the company
focuses on Europe. In 2020, the Nordic countries
accounted for 32% of revenue and the rest of Europe
for 45%. The company employed 1,689 people at theend of Q3’21 .

Geographical revenue distribution
250
200

150
100
50
0
2013

2014

2015

2016

2017

2018

2019

2020

Nordic countries

Europe excl. Nordics

North America

Rest of world

Source: Inderes

6Company description and business model 2/6
Business model
Sales, marketing and distribution channels
In recent years, F-Secure has invested heavily ingrowing its corporate security revenue, which has
been reflected as high investment in sales andmarketing resources. The cost of sales andmarketing has fallen due to COVID, but stillaccounted for about 43% of revenue in 2020 (2019:49%). We believe that the relative share of sales
and marketing in revenue has room to decrease incoming years, as F-Secure’s largests investments insales channel development are already over.
F-Secure sells its corporate security products
through an extensive reseller network, which
globally consists of over 7,000 IT service partners.
The task of the company’s own sales organization
is to support and serve the resellers, as well as
develop and grow this network. Critical in terms of
success is that selling of F-Secure’s products andrelated services is good business for the resellers.
F-Secure's security product customers consists
mostly of relatively small companies, but thecompany has shifted its focus to medium and large
companies with corporate security solutions. The
company provides managed security services(MDR) for large companies and cyber security
consulting with outcome-based solutions throughits own sales organization.
In consumer security, most of the revenue iscreated globally through a network that covers
over 200 operators (mainly telecom operators),
which is one of F-Secure’s key strengths andcompetitive advantages. Consumer products arealso sold through many online and reseller

partners, and in the company’s own online store.

Adjusted EBITDA and EBIT

Product development

40

20%

A total of 535 people worked in F-Secure's productdevelopment in 2020 and R&D costs
corresponded with some 19% of revenue. The
focus of R&D is on developing the functionalities ofcorporate security detection and response (MDR
and EDR) solutions and integrating the productportfolio. The goal is to provide customers withmore comprehensive security solutions. In
consumer security, the development costs ofendpoint device protection products are stable, but
R&D investments are made in certain new productareas (Sense and ID Protection).

35

18%

F-Secure’s core technologies, especially indetecting malware, are basically very similar both inconsumer and corporate security products, which
creates certain synergies in R&D. F-Secure’s
consulting business also enriches productdevelopment as consultants can investigate
security breaches at large companies and transfer
the knowledge they gained to productdevelopment. At the same time, the company’s
products collect vast amounts of data from
customers’ online traffic that are processed with AI
and machine learning to detect malware andsecurity threats. With the help of processed
information from this constant data stream, FSecure can refine its existing products and develop
new ones.

16%

30

14%

25

12%

20

10%

15

8%
6%

10

4%

5

2%

0

0%
2015

2016

2017

2018

2019

2020

EBITDA (adj.)

EBIT (adj.)

EBITDA-% (adj.)

EBIT-% (adj.)

2021ePersonnel distribution 2020

Consulting andcustomer deliveries

187
476

535

Product development
480

Source: Inderes

Sales and marketing

Administration

7

Partners

Operations

Business idea
F-Secure offers a comprehensive
selection of cyber security solutions andservices to enterprises and consumers.

Product
development

IT service partners

Customer segments

Large companies &public associations

Consumers

SMEs

Products/Services

Sales andmarketing

Cloud-based Elements platform for selected security solutions:

F-Secure Labs
research center

Operators and otherservice providers➢ Strong endpoint protection expertise➢ New solutions for detection andresponse

Resources••

Sales channels

Extensive reseller
network

Corporate security

Cyber security services

Consumer security

IT resellers:+7,000 partners

Strong brand,
especially in Europe•+200 operators
Resellers

Income flows (2020)

1,678 employees (2020)34%(22 % of revenue)
Source: Inderes(43%)

Safe, Freedome, Key, Sense and ID Protection

Online store

Research anddevelopment(19%)

Administration(8%)

Corporate security(products)
Corporate security(consulting)45%

Sales andmarketingHigh-quality consulting services in all areas of cyber security
Consumer security•

Cost structure (2020)

Materials andservices

MDR: F-Secure Countercept - managed threat hunting service
to detect and respond to targeted attacks.
Cloud Protection for Salesforce: Content sharing security
solution for Salesforce’s cloud service
F-Secure Business Suite: On-site endpoint device protection
solution (EPP)
phishd: Behavior management platform to prevent phishing•➢ High-quality consulting services
complement the solution offering

Cyber security
technologies andsoftwareResellers

Individual security solutions:•➢ Ability to deliver comprehensive
product and service packages

Long-term cybersecurity expertise

Endpoint protection solution (EPP)
Detection and response to targeted attacks (EDR)
Vulnerability scanning and management platform
Data security solution for content sharing (Elements for Microsoft 365)

•
•
•
•

Nordic countries

12%

32%

11%

Consumer security

21%

Revenue 220.2 MEUR
Adj. EBITDA 35.7 MEUR
(2020)

Europe excl.
Nordics
North America

45%

Rest of world

Company description and business model 3/6
Corporate security
F-Secure’s corporate security business consists ofproduct business, managed services, where theproduct and service are combined, and pureservice business. In 2020, the product businessaccounted for 62% of corporate security revenue
and consulting for 38%. The product business is
excellently scalable due to replicability. Managed
services (MDR) are also scalable, even if a service
component is included. In consulting, scalability islimited due to the nature of the business. The
transition from “cyber security as a technology”
towards “cyber security as a process” constantly
blurs the line between products and services in FSecure.

In Q2’21, F-Secure launched the cloud-native andmodular Elements platform around which corporate
security product offering is built. The platform
enables the company to provide flexible individual
or turnkey solutions for endpoint device security
based on customer needs. Through the platform,
the customer can flexibly choose from a
conventional annual license, continuous monthly
billing, or a usage-based security model. Elements
is an essential new launch in F-Secure's quest to
win new customers and grow them over time (Landand Expand), as well as offering opportunities for
additional and cross-selling to existing customers.
We will now go through F-Secure’s main products .
Endpoint protection products (EPP)
A majority of F-Secure’s corporate security revenue
currently comes from selling protection products
for endpoint devices (Endpoint Protection, EPP),
whose demand is stable and market grows

moderately. These products represent F-Secure's
core competence, virus prevention, and are a key
part of the product portfolio.
The customer target segment for these products
are SMEs and F-Secure’s security products forendpoint devices are used by over 100,000
companies globally. The annual deal size in theseproducts varies from hundreds of euros to sometens of thousands of euros.
Competition is tight in security products forendpoint devices and the field is quite established.
F-Secure’s competitors are numerous companies
that offer antivirus software, like NortonLifeLock,
Kaspersky, McAfee, Sophos, and Trend Micro. FSecure’s customer base in this product groupfocuses heavily on small companies, where the roleof the reseller is emphasized in the customer’spurchase decision. Customer awareness of cybersecurity issues is usually low and purchasing
decisions are often made based on price or therecommendation of a reseller partner. Comparisonsby research institutes that test security software
also significantly affect customers’ purchasedecision. F-Secure’s protection products forendpoint devices have performed very well insecurity tests within the industry (AV-Test, AV-LAB
PL, V3) over the years and their ability to detectmalware are world class compared to thecompetition.

Development of annual recurring revenue(ARR) in corporate security products
90
80
70
60

29

35

32

32

29

30

42

43

43

46

47

52

Q1'20

Q2'20

Q3'20

Q4'20

Q1'21

Q2'21

50
40
30
20
10
0
Cloud-based

On-premise

Development of order book in corporate
security products
80
70
15

60
50

5

4

6

9

48

46

46

47

H2'18

H1'19

H2'19

H1'20

16

40
30
20

53

57

H2'20

H1'21

10

0
Other products

Source: F-Secure (CMD), Inderes

MDR

9Company description and business model 4/6
Countercept (MDR)Countercept is F-Secure’s response to “theparadigm shift” on the security markets, where
mere prevention of malware and data breaches
has evolved to rapid detection of threats that havepassed the security and responding to them.
Countercept is a managed service (MDR, Managed
Detection & Response), where technology plays amajor role. The current Countercept consists of an
RDS solution introduced by F-Secure in 2016 andCountercept acquired in the MWR acquisition,
which has been integrated into a unified andcompetitive MDR solution in the past few years.
When implementing MDR, sensors are installed on
the customer’s IT-network and endpoint devices tocollect and transmit data to F-Secure’s data center.
AI and machine learning are then used to detect
anomalies in the company's data traffic, which canmean a security threat has passed through or an
outside entity is penetrating the customer'ssystems. F-Secure’s data center monitors
customers’ IT environments 24/7 and provides
immediate response to security alerts as necessary.
Countercept’s sensors collect a huge amount ofdata daily and the overall picture of the customer’s
IT network becomes clearer over time. Thus,
machine learning constantly tailors the product tobetter respond to the customer's environment andthe threshold to switch to a competing productgrows over time.
Countercept is suitable for companies whose
security requirements are high and the target groupare companies with more than 1,000 employees.
On average, the contracts start at around EUR

100,000 and for the largest customers, long-term
contracts run around million euros. Key customer
groups for Countercept include banks, media,
technology, and industrial companies. MDR
solutions are mainly sold as direct sales andbecause of the large size of contracts and complex
technology, the sales cycles are typically long.

Countercept is an important product for F-Secure’s
growth and its sales development has a significant
effect on corporate security growth due to the large
size of the contracts. At the end of H1’21,
Countercept’s order book was EUR 16 million,
indicating that it has already increased to asignificant size for F-Secure. F-Secure sees growth
opportunities in this product area for several years
to come, and the company's efforts to scale thesolution will somewhat burden profitability ofcorporate security. After the growth phase, MDR
solutions (gross margin target >65%) have thepotential to reach good profitability, as strong
customer retention provides continuity in revenue
and the service component scales with growth.
The rapidly growing MDR market has attracted a lotof competition and Gartner estimates that well over
100 players already offer MDR solutions. F-Secure's
main competitors come mainly from the US, andinclude, e.g. Crowdstrike, Darktrace, Cybereason
and Rapid7. According to F-Secure, it distinguishes
itself from competitors with strong technologicalexpertise, which means that Countercept’s
detection ability of cyber-attacks is excellent.
Countercept's technology stands out especially inresponding to detected threats and the fightagainst ongoing targeted cyber attacks. In addition,
in Europe, the company has competitive advantage

against its competitors in that geopolitical factors
may affect the decision making of some customers.
Endpoint Detection& Response (EDR)
At the end of 2018, F-Secure launched an
automated tool for detecting and responding to
endpoint device attacks (Endpoint Detection andResponse, EDR). The product is based on the same
technology as Countercept but does not include
the service component. Thus, it scales with
automation to the size class of smaller businesses
as well.
EDR acts as an additional functionality on top of
endpoint protection products (EPP) and on themarkets this product area has integrated with EPP
products in recent years. The main potential for
EDR is to sell the product to F-Secure's extensive
EPP customer base. Medium-sized companies
have the highest cross-selling potential, as theneed for detection and response to threats is
growing in this segment. According to F-Secure,the value of conventional EPP customers can be
more than doubled when a complete endpoint
device protection solution including EDR is offered.
EDR can also be sold separately on top of othersecurity suppliers' EPP solutions.

10Company description and business model 5/6
The operating principle of EDR is highly similar toCountercept but when the product detects ananomaly in the company network the information is
automatically delivered to the company’s IT heador reseller partner. The product also provides
instructions on how to respond to the threat. The
product is suitable for companies of all sizes, but
the main target group is SMEs. The end customer
or reseller partner will also be able to send
information on the detected abnormal event to FSecure's service center, where F-Secure experts
will assist in resolving the issue. Thus, EDR also
generates service revenue for F-Secure, eventhough the outset is a pure software product.
Next to Countercept, F-Secure’s EDR is key in thegrowth strategy for corporate security. The EDR
market is in a fast-growing phase, and, e.g., Gartner
has estimated that the number of endpoint devices
with detection capabilities will multiply in coming
years. Also in this product category F-Secure faces
competition on a broad front, as almost allcompetitors offering EPP products also have EDR
capability. In addition, an emerging and rapidly
growing market attracts new competitors.

Solutions for third-party environments
F-Secure has developed complementing security
solutions for Salesforce’s and Microsoft’s cloud
platforms that have been well received by thecustomers in recent years and are already visible as
growth in corporate security. F-Secure hasdeveloped cyber security capabilities into
Salesforce’s platform for checking links andattachments for malware. The product is distributed
as an application directly through Salesforce's
platform, enabling high profitability. The producthas good growth prospects and currently has no
actual competitor. However, the risk is that
Salesforce would build its own solution to replace
F-Secure's product.
In addition, F-Secure offers the Elements for 365
solution designed to complement Microsoft 365's
own security features. The solution aims to protect
content transmitted through Microsoft 365
applications. The product is offered via F-Secure’s
Elements platform, either separately or as part ofthe overall solution.
Cyber security services
F-Secure provides consulting for large businesses
and other critical IT system owners in all areas ofcyber security. The offered services include cybersecurity audits, cyber security stress tests (Red
Teaming), strategic risk and cyber security
management, cyber security in softwaredevelopment, and responding to data breaches
and leaks.
F-Secure's consulting business focuses on themost demanding security issues, but the service
portfolio has expanded in the past few years, ascompanies increasingly want a more extensive
turnkey solution in cyber security services. The
scope of the consulting business increased
significantly with the MWR acquisition in 2018 and
F-Secure currently employs over 300 experts in
consulting. The consulting customer base consistsof hundreds of large companies.
Consulting revenue decreased by 8% in 2020 to
EUR 45.8 million, representing 38% of corporate
security revenue. The COVID pandemic has
temporarily weakened demand as companies

withdrew and slowed down their cyber projects lastyear. This year, demand has started to recover andmedium-term growth outlook is good. Lack ofexperts is a growth challenge on the market andcompetition for top experts is tight.
F-Secure’s consulting is still primarily a projectdriven business but F-Secure constantly tries tosign continuous consulting agreements with its
customers. In the consulting business, thecompany's largest markets (UK and the Nordic
countries) are already partly developed withprofitability first, but in smaller markets operations
are still clearly in a growth phase, which burdens
profitability.
The strategic focus of F-Secure’s consulting is not
to expand its service business to compete withregular IT service companies even though theservice offering sometimes overlaps with these.
More extensive cyber security service packages
are offered by consultancy companies (like KPMG),
IT generalists (like CGI) and specialized players (likeNixu).
F-Secure’s ability to offer consulting services gives
the company a competitive advantage against
players who only offer cyber security products. In
addition, consulting offers cross-selling possibilities
with the products. Consulting also polishes FSecure’s brand as a comprehensive cyber security
company.

11

Company description and business model 6/6
Consumer security
Products
F-Secure’s products are used by millions ofconsumer customers across the world. The main
products in the current product portfolio are: 1)
endpoint device security product Safe, 2) privacy
protection product F-Secure Freedome, 3)
password management and personal dataprotection product F-Secure ID Protection, and 4)
security router that protects all smart devices in thehome F-Secure Sense
Most of consumer security revenue comes fromselling endpoint protection products (Safe).
However, in direct sales, more and more customers
are changing their order when renewing it to the
combined solution Total, which includes all FSecure's main consumer products. This productbundling is a key growth driver for consumer
security sales.
Among newer products, Sense launched insummer 2017 and ID Protection released in 2019,
have gradually started supporting the growth of
consumer security. Sense's path to wider
commercial distribution is taking place as asoftware product installed on third party routers. FSecure has already entered into such agreementswith several operators, but the base of routers with
Sense software is slowly expanding, which has
been further slowed down by COVID.
F-Secure’s ID Protection combines monitoring ofdata breaches containing personal data withpassword management. The product has been wellreceived in the operator channel and F-Secure has

already signed several dozen operator agreements
for the product.
In consumer endpoint device protection products,
F-Secure’s competitors consist largely of the same
companies as on the corporate side, as the producttechnologies are very similar. Competition istightened by the fact that there are several free
antivirus software available on the market (e.g.
Avast, Avira, Windows Defender).
Service provider channel (operators)
F-Secure started building a sales channel throughoperators already in the early 2000s and today its
over 200 operator strong network is the largest
compared to other cyber security companies. 74%
of consumer security revenue came from theoperator channel in 2020.
Operators sell F-Secure’s products as part of theirown continuous security packages, and F-Securereceives wide distribution and volume for its
products through operators. This way the
replicability and scalability of the products enable
good profitability even though the operators take alargish chunk of the gross sales of the products asthey are responsible for the lion’s share of productmarketing.
For operators, cooperation with F-Secure is also
fruitful. By providing security packages for mobile
and broadband subscriptions, operators have beenable to improve customer retention and satisfactionin addition to getting profitable additional sales. In
our opinion, the success of F-Secure’s products inthis channel comes from the fact that it solves twocore problems of the operator business (average
price and customer turnover). In recent years, F-

Secure's operator channel has expanded fromtelecom operators to, e.g., insurance companies
and other financial sector players whose offering iswell complemented by security products.
Direct sales channel
Consumer products are also sold through many
resellers operating physically and online. In
addition, products are increasingly sold through its
own online store, which means there are no
middlemen between F-Secure and the end
customer. Competition on the market is extremely
tough and customer acquisition requiresconsiderable marketing investments, and various
free products and freemium models make theconsumer market challenging to reach throughdirect sales. 26% of consumer security revenue
came from direct sales channels in 2020.
Consumer security would be a stable dividend
payer as an independent listed company
In connection with its CMD in August 2021 FSecure announced that it is reviewing andevaluating various strategic options by the end of
H1’22, including the possible listing of consumer
security on Nasdaq Helsinki.
In our view, consumer security that is growing
stably and generating good cash flow would be
profiled as a stable dividend payer as anindependent listed company. As an independentcompany, consumer security could also focus fullyon pursuing growth in its own markets with asharpened strategy without having to consider thedifferent needs of corporate security in decision
making.
12

F-Secure's business model
Shared technology and product development
Virus prevention lab

Management
services (companies)

Consumer security

Corporate security

45 % of revenue in 2020
Gross margin >85%
Privacy protection (F-Secure Freedome)
Endpoint protection (F-Secure Safe)
Password management (F-Secure Key)
Cyber security router (F-Secure Sense)

Analytics andmonitoring platform

Products

Consulting

34% of revenue 2020

21% of revenue 2020

Software products
Gross margin>85%

Managed services (MDR)
Gross margin target>65%

Service business
Gross margin>50%

Protection of personal data (F-Secure ID
Protection)

Operators

Resellers andonline store

Resellers

IT service partners

IT integrators/direct
sales (services)

Consumers

Consumers

Small businesses

Medium sized

Large businesses(200-5,000)(>5,000)

Product and service
sales

Product and service
sales(25-200)

Product sales(retail sales/revenue
sharing with operators)
Source: Inderes

Product sales

Product sales

Threat detection
and sensor datafrom millions of
products in use

13

Investment profile
Separation of consumer and corporate security
would clarify focus and value creation
F-Secure has been difficult to perceive for investors
in its current development stage as the sharecombines a stable cash flow business (consumers)
with a business that is still in an investment stage
with negative cash flow (corporate). In addition,
corporate security is made up of businesses withdifferent profiles and development stages, which
are partly complementary. All in all, there are
growth opportunities in corporate security products
in many areas, but the investments required for
growth still burden profitability. In consulting,growth prospects are also picking up and there isclear room for improvement in profitability.

In the big picture, F-Secure’s various businesses
should be priced at very different valuation
multiples due to different growth, scalability andprofitability profiles. Thus, the current form of FSecure is not a full-scale growth company, but not amature stage technology company either. We
therefore welcome the planned separation of
consumer and corporate security, which would
provide considerable clarity into the company's
strategy and clarify the value creation of the share.
In our view, consumer security that is growing
stably and generating good cash flow would be
profiled as a stable dividend payer as anindependent listed company. The share pricewould thus be mainly based on earnings-based
valuation multiples. Similarly, in the more rapidly
growing corporate security market, growth is still
the key value driver and available market sharesare in part being fought for at the expense ofprofitability. Thus, independent corporate security

would, in our view, be priced through a
combination of the EV/Sales ratio, and growth andprofitability. We see consumer and corporate
security as more valuable separately than together
and consider the arrangement likely.
Strengths and drivers

Growth in corporate security products is at thecore of value creation. In many product areas, themarket is still in the early phase, growing quickly
and market shares are being distributed now.
A scalable and strong customer retention
business model enables very good profitability inthe long-term.
A unified product portfolio in corporate security
offers additional and cross-selling opportunities andenables shifting toward larger customers in thevalue chain.
Stable and profitable growth in consumer
security. In addition, the new products Sense andID Protection offer scalable growth potential in thelong term.
A stable and established position in endpoint
device protection provides F-Secure good
resources to expand its core competence andtechnology to new segments and sell new
solutions to the existing customer base.
Weaknesses and key risks

Secure’s established and new product areas.
Dissolving of high valuation levels in the sector
would probably also have a negative effect on theaccepted valuation on F-Secure's share.
Competitive threat in consumer security and slow
revenue growth due to free antivirus software.
Despite these threats that have been present for
years, consumer security seems to remain a very
dynamic business and the growth outlook has
strengthened in recent years.
Growth in corporate security still burdens
profitability: In a highly competed market, winningshares requires significant sales investments andcontinuous product development. Also, as a brand,
F-Secure is not yet really seen as a provider ofcorporate security solutions. Therefore, thecompany plans to separate consumer andcorporate security activities and has launched abrand reform for corporate security.
The COVID pandemic still creates certain
uncertainty in consulting and MDR solution sales:
The consulting business suffered significantly fromCOVID as customers held back their cyber security
projects. COVID has also been reflected in thealready long sales cycles of MDR solutions. Now
the outlook is already clearly picking up in bothareas, and the distance selling models learned
during the pandemic will also help boost sales
efficiency in the future.

The industry is potentially overinvested, which inrecent years has been reflected as tightening
competition. The gold rush of new players can leadto there not being enough to go around despite
the growing market. This is a clear threat both in F14

Investment profile

1.
2.

3.
4.
5.

Strong growth focus in corporate security

Stable growth and good profitability inconsumer security

Potential•

Growth in corporate security, especially in detection andresponse solutions•

Strengthening growth and competitive edge throughrenewal and integration of product portfolio•

Strong demand outlook on the market•

Stable and profitable business in consumer security
including growth potential in new products

A scalable and continuous businessmodel that generates good cash flow

A large and growing total market

Separation of consumer and corporate
security would clarify focus and value
creation

Source: Inderes

Risks
•

The industry is potentially overinvested, which has beenreflected as tightening competition in recent years•

Success of investments in corporate security•

Dissolving of high valuation levels in the sector could
have a negative effect on share valuation•

Competitive threat in consumer security and slow growth15

Risk profile of the business model

4

REVENUE

2

CAPITAL STRUCTURE PROFITABILITY

1

OPERATINGLANDSCAPE

Assessment of F-Secure’s overall businessrisk

Change rate in
the industry

Cyber security market technologies andthreats are changing rapidly.
Competition in the industry is very
fierce.

1Company’s
development
stage

Many mature products, for MDR and EDR
solutions and cyber security services thestrategy is still in the investment phase.

1Marketcyclicality

Long-term demand drivers are strong on
the market. COVID pandemic has slowed
down consulting demand in the short
term.

2

Revenue
dispersion andcontinuity

Revenue is by nature continuous andbased on annual licenses of various
durations and monthly SaaS fees. The
customer base is widely dispersed.

2

Scalability of
costs

Cost structure mostly fixed, flexibility inthe cost structure by adjusting sales
investments.

3

Strategy targets growth in corporate
security, which still burdens profitability.

3

Cost structure
Capitalcommitment

4

Operations tie a little capital andworking capital is negative.

Financing need4

Net debt-free balance sheet provides
leeway in strategy implementation andacquisitions.

Source: Inderes

LOW RISK LEVELHIGH RISK LEVEL

16

Industry 1/4
Market definition, size and growth
Cyber security companies are solving one of thebiggest problems of the digitalizing society. Big
problems also mean big business opportunities,
which makes the market very interesting, dynamic,
and rapidly growing.

Cyber security refers to processes, technologies,
solutions, and services that protect companies’ andother organizations or individual users’ data against
criminality that occurs in networks. Cyber threats
can be divided into three categories: 1) criminalitythat aims at financial profit, 2) hacking that aims at
disrupting companies’ or governments’ activities,
and 3) spying that aims at gaining a competitive
business advantage or phishing on state security.
The number of cyber threats and their intelligenceis constantly growing and the market is, in practice,driven by an endless race between criminals andcyber security technologies and processes.

correlate with the size of the customer
organizations as the biggest organizations andstate administration are typically the main targets ofcyber criminals. For organizations at the top of thehierarchy, solutions that have been created for themasses at the bottom of the hierarchy do not offer
sufficient protection. Correspondingly, the solutions
focusing on the top levels of the hierarchy are too
expensive for organizations whose activities do not
require a high protection level. Development of
new technology focuses on the more demanding
top level segments after which the technology is
replicated to the lower levels for broader segments.
The top of the cyber security market is represented
by state espionage and the defense industry. Thisis a niche market from the viewpoint of cybersecurity companies, but it represents the highest
technology and level of expertise and is thus
important.

Market segments

The largest volume of the market is found in the
middle of the pyramid that covers targeted attacks.
In this case, the primary target group is in practice
all large organizations and public administration,and especially the players whose activities include
critical security of supply activities (like energy,banks and operators). Crucial in this target group isthat its size is constantly growing as cyber security
threats increase, which also expands the market for
demanding cyber security solutions.

The target groups of the cyber security market canbe roughly divided into three areas in a pyramid
model (see next page) based on the intelligence of
attacks and technologies. These also broadly

In the big picture, market growth is the result of 1)
cyber security issues playing an important role for
an increasing number of industries when planning
new digital businesses and 2) the rising trends on

The cyber security market develops quickly and theestimates on the total market size and growth stillvary dramatically. Gartner estimates that the global
cyber security market will grow by about 12% to
USD 150 billion in 2021, as last year growth
temporarily slowed down due to the COVID
situation. The market is expected to grow at about
10% per year and reach USD 221 billion in 2025.

the IT markets (industrial IoT, social media, digitalcommerce, cloud transformation) force
organizations to pay more attention to cybersecurity.
In the segment of targeted attacks (large andmedium sized organizations), cyber security cannot
be solved only with mass solutions. The cybersecurity budgets of companies in this segment are
annually roughly around EUR 1-5 million, whichmakes it attractive to companies that offer cybersecurity services and products. F-Secure has
expanded into this segment through acquisitions(consulting service) and a wider product portfolio(MDR).
The most important segment for F-Secure is still thebottom level of the pyramid that includes SMEs andconsumers. For small companies and consumers,
the main thing is to be protected against mass
attacks, which can be done with regular “off the
shelf” cyber security products like endpoint
protection products and firewalls.
Among medium-sized enterprises, the need forcyber security beyond mere endpoint protection isincreasing, but the security budgets (0.1-1.0 MEUR)
are significantly lower than for large enterprises. In
this case, it may not be possible to purchase thebest technologies or managed/outsourced cybersecurity services. Especially rapid detection of
threats that pass endpoint protection isemphasized in the segment.

17SectorMarket drivers

Distribution and operating logic of the cyber security market

Cyber security
consultingStateespionageR&D focus on highest leveltechnologies
Replicating technology to larger
markets

Detection of advanced
attacks (Countercept and
EDR)

Targeted attacks

Digitalization

Regulation

Digital commerce
Industrial IoTOpen systems
Cloud
Mobility

EU's Data
Protection
Regulation

Risk-basedpurchasing

Forcedpurchasing

Large companies and organizations,public administration

Mass solutions(endpoint
protection, EPP)

Mass attacks
Medium-sized companies
Small companies and consumers

Complexity and change rate as growth drivers
for cyber security products, expert services,and outsourced cyber security

Market size / number of buyers

Source: Inderes

18Industry 2/4
Market sub-segments for F-Secure
F-Secure’s potential market can be examined moreclosely through the company’s product and service
selection. Overall, F-Secure's target market is solarge that the size of the market does not limit thecompany's growth.

F-Secure estimates that its consumer security
market in 2020 was about EUR 7.0 billion and is
expected to grow steadily at an annual rate ofabout 4% until 2025. The relatively slow growth on
the consumer security market is explained by the
popularity of constantly evolving free antivirus
solutions (e.g. Windows Defender) but growing
product areas can be found, e.g., in privacy
protection and in solutions designed to protect
smart devices in the home. With the COVID
pandemic and the resulting increase in remote
work, consumers are more prepared to pay forcyber security, which has also been reflected in FSecure's growth figures.
For corporate security, F-Secure has estimated thecurrent target market to be around EUR 11 billion.
The growth profiles of the different product areas
are very different, but the overall market is
expected to grow at an annual rate of as much as
15% until 2025.
The market for enterprises’ endpoint protection
platforms is growing as new automated threat
detection and response products (EDR) arecomplementing EPP products. For example,
Gartner already puts these products in the same
category. IDC has estimated the size of the
EPP/EDR market in 2021 to be close to USD 10
billion and it is expected to grow by about 7%
annually by 2024. Growth of EDR products is driven

by the fact that data breaches against companies isoften not detected for months, and this has shifted
the focus from merely preventing attacks towards
faster detection and response. Large companies
can buy detection capabilities as managed services(like F-Secure’s Countercept) but especially forsmaller companies a pure product solution is the
only sensible solution in terms of costs. In addition,other new solutions that complement the securityof endpoint devices (e.g. F-Secure Cloud Protection
for Salesforce) support the growth outlook of theoverall market for endpoint security platforms.
The market for managed detection and response
services (MDR) is still being shaped and estimatesof market size and growth are indicative. The
significant growth potential is shown by Gartner's
estimate that about 50% of organizations will use
MDR services by 2025. F-Secure aims to contributeto the growth of this market with its Countercept
solution. However, in recent years, the market has
already started to mature slightly, which is visible in
F-Secure's expectations for corporate security
products growth (15%). Over the past five years, therapidly developing market has attracted a lot ofcompetition, and Gartner has estimated that there
are more than 100 players offering MDR solutions.

Size (EUR bn.) and growth expectations of
F-Secure’s market segments

39

CAGR 10%22

CAGR 15%

8

CAGR 4%24

11
7

ljohuhh2020 Iiooj
2025e
Consumer security
Corporate secuity (products)
Corporate security (consulting)

In cyber security services, F-Secure has estimatedthat the size of the relevant target market is around
EUR 24 billion and the market is expected to growby some 10% p.a. in 2020-2025.

Source: F-Secure’s estimate based on various
market studies

19

Industry 3/4
Market drivers
Cyber security market growth will probably
continue to be steady driven by digitalization
investments. In addition, constant news of serious
data breaches (risk-based purchasing) andpressure created by regulations (forced purchasing)boost market growth. At the top level, growth is, inpractice, driven by three forces: digitalization,
regulation, and increasing threat scenarios.
The commonly recognized megatrends in the IT
world like cloud services, industrial IoT, social
media and digital commerce are strongly linked
with cyber security. In many of these areas, thebarrier for creating new applications, products anddigital services comes from cyber security
challenges. These challenges are related, e.g., toprivacy protection, e-commerce or security.
Another megatrend worth mentioning is the evergrowing and diverse number of endpoints andlinking of various systems and online services. This
makes the market more attractive from a criminal’s
viewpoint than when companies still mainly only
operated in their own individual closed
environments. Thus, digitalization progressing
constantly increases the potential attacking area forcyber criminals.
Building new digital services requires thatcompanies and governments solve the challenges
related to cyber security in advance. The demandfor cyber security related products and services isalso often supported by the fact that cyber security
is increasingly becoming a critical and integral partof any new IT system, digital service, or product.

This means that problems related to cyber security
cannot be solved simply by acquiring cyber security
software and equipment off the shelf but also
requires the use of high-level expertise services. As
a result of these market drivers, F-Secure has also
been transformed from an endpoint device
centered antivirus company to a provider ofcomprehensive cyber security solutions forcompanies.
Consumer security changing
In consumer security, the changing device portfolio
has been visible as a slight drop in endpoint
protection software but, overall, the number ofdevices connected to the web is growing rapidly inconsumers’ homes. This provides growth
opportunities for new cyber security products that
protect smart devices in the home even though PC
driven antivirus sales is a challenging market.

EU's Data Protection Regulation
EU's Data Protection Regulation (GDPR), thatentered into force in May 2018, has increased thedemand for cyber security services. The regulation
imposed new obligations on organizations handlingpersonal data, like the obligation to report any
breach of security. The authority that supervises theregulation can impose sanctions if the regulation isbreached. The sanctions can be massive, for more
serious breaches the fine is EUR 20 million or 4% of
the company's annual revenue, which has resulted
in companies taking the regulation seriously. GDPR
also supports F-Secure’s business as the regulationmeans that companies must build better
capabilities to detect realized security breaches.

In consumer security, the nature of the market ischanging rather than the market faltering with PC
antivirus. For example, Windows’ own cybersecurity is cannibalizing conventional cybersecurity, but this does not solve the consumer’s
problem of how to protect several different
endpoint devices. In addition, demand for privacy
protection solutions is growing. Thus, there is anatural need for F-Secure’s comprehensive
consumer solutions as the array of endpoint
devices and operating systems is vast andconstantly changing.

20

Cyber security industry M&A transactions

Industry 4/4Over the past decade, the growth outlook of thecyber security market has attracted a lot of
investments to the sector. This has been visible as
dramatic growth in venture capital investments in
new cyber security companies and as lively M&A
activity both in North America and Europe. Several
cyber security company IPOs have been seen on
stock exchanges, while some of the listedcompanies have also been acquired. In 2020,
COVID temporarily put on hold on M&A
transactions, which, considering statistics, has been
dissolved as a wave of transactions in H1’21.
The cyber security market is still highly fragmented,
and consolidation is bound to continue as, despite
market growth, there is not room for all current
players on the market if it starts maturing in the
future. We have been worried for several years thatthe industry is overinvested. In our opinion, this has
already been visible as a tightening competitive
situation in the sector in recent years and can in
future become more visible in the sector’s
profitability when new players enter the market
with new solutions that try to solve cyber security
problems more efficiently and/or cheaply than thecompetition. Some players in the sector are still
generating heavy losses and their lifeline ofexternal financing will end if they cannot generate
growth or profitability.
The investment pressure in the sector has led toacquisitions’ valuation levels remaining high, andthe valuation levels of listed cyber companies havealso increased significantly in recent years. This
makes it more difficult for F-Secure to carry out

104

30

25

178

150

85

24,7
10

5

100

39,5

20

Due to the lack of experts, acquisitions are the only
way for many service companies to get a piece ofthe market or they can act as an alternative torecruitment. In this case, the target is often small,
specialized players. In acquisitions of productcompanies, the buyers can seek technologies thatcomplement their product portfolio and in larger
M&A transactions the aim is to generate synergy,
e.g., in product development, sales and distribution.
Consolidation pressure also increases because,
instead of point solutions, cyber security is
increasingly turning into turnkey solution andprocess deliveries, which forces players tointegrate their offerings. We believe that F-Secure
will continue to be part of the industry consolidation
as a buyer but currently the high valuation levels inthe sector slow down acquisition plans.

200

163

112

28

15

The crucial question for investors is whether it isworth investing in the sector after the investment
boom and whether it is already too late. We feelthere is not much room to stretch the valuation
multiples of the market and value must primarily becreated from the growth and profitability of thecompanies in the sector.

189

134

35

acquisitions that generate shareholder value. At
present, well above 30x EV/S multiples are paid forthe hottest listed cyber security companies.

181

158

40

Industry consolidation continues

177

175

45

5,9

4,8

9,0

13,6

21,4

11,4

16,2

50

20,5

0

0

2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 H1'21
M&A volume USD bn.

Number of M&As

Median EV/S ratio of M&A transactions
(LTM)
6,8x

3,6x 3,5x 3,3x

3,9x 3,6x 3,6x

5,0x 4,8x 5,0x

4,3x2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 H1'21

Capital investments in cyber security
companies
745
716 727 710

14
10

462

515

600

430

8
6
4

2
0

800

599

12

196

13

250

120
0,9

1,3

1,4

2,9

4,4

4,5

6,1

8,2

9,7

400
11,5

200
0

2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 H1'21
Investments USD bn.
Source: Momentum Partners

Number of investments21Acquisitions and investments in the industry
M&A transactions in the sector with public valuation information
Buyer
AdventThoma Bravo
STG
Wipro
NasdaqFrancisco Partners
IvantiAdventLexisNexis Risk Solutions
F5 Networks
Open Text
Thoma Bravo
Broadcom
VmwareOrangeCarbonite
BlackBerryThoma Bravo
Shearwater Group
Cisco Systems
F-Secure
ThalesWarburg Pingus
Thoma Bravo
Open Text
Sophos Group
Palo Alto Networks
Keysight Technologies
Symantec
TPG
Avast
Symantec
FireEye
NCC Group
F-SecureSingtelMarlin Equity Partners
NCC Group
BeldenCisco Systems

Target
McAfeeProofpoint
McAfee (Yritysliiketoiminta)
Capco
VerafinForcepoint
Mobileiron
Forescout
ID Analytics
Shape Security
Carbonite
SophosSymantec Enterprise
Carbon Black
SecureLink
Webroot
Cylance
Imperva
Brookcourt Solutions
Duo Security
MWR Infosecurity
Gemalto
Cyren
Barracuda Networks
Guidance Software
Invincea
LightCyber
Ixia
LifeLock
McAfee
AVG
Blue CoatiSight Security
Fox-IT GroupnSenseTrustwave Holdings
Fidelis Cybersecurity
Accumuli
Tripwire
SourceFire
MedianAverage

Source: Capital IQ, Momentum Partners, Inderes

EV (MUSD)
14,000
11,489
4,000
1,450
2,750
1,100
859
1,884
375
1,028
1,400
3,948
10,700
2,100
576
618
1,500
1,800
40
2,350
110
5,541
119
1,405
245
120
105
1,603
2,362
4,200
1,463
4,722
269
141
20
786
200
83
710
2,194
1,400
1,958

EV/S
7.5x
9.6x
3.1x
2.0x
19.5x
1.7x
4.2x
4.8x
7.8x
17.1x
3.4x
5.1x
4.6x
9.1x
2.1x
2.9x
11.5x
5.2x
1.4x
>20x
3.1x
1.8x
3.8x
3.8x
2.1x
4.8x
10.5x
3.3x
3.6x
2.5x
3.4x
7.9x
6.7x
4.9x
2.6x
3.6x
3.3x
2.4x
6.0x
7.5x
3.8x
5.3x

Private cyber security companies that have raised
most capital
1200

Cumulative funding USD bn.

Time
11/2021
4/2021
3/2021
3/2021
11/2020
10/2020
9/20202/20201/202012/2019
11/2019
10/20198/20198/20195/20192/201911/2018
10/2018
8/20188/20186/2018
12/2017
11/2017
11/2017
7/20172/20172/20171/2017
11/2016
9/20167/20166/20161/2016
11/2015
6/20154/20154/20153/2015
12/20147/2013

1000
800
600

400
200
0

IPO activity has been lively in the sector
Company
Okta
SailPoint
Zscaler
Avast
TenableSolarwinds
Tufin
Crowdstrike
Cloudflare
Ping Identity
Sumo Logic
McAfee
Telos
KnowBe4
Darktrace
SentinelOne

IPO year
2017
2017
2018
2018
2018
2018
2019
2019
2019
2019
2020
2020
2020
2021
2021
2021

2021e EV/S
31.7
13.1
49.5
9.3
10.3
5.4
2.8
66.2
101.6
8.0
7.5
6.8
4.3
16.6
18.0
91.3

22

Competition
Growing market attracts a lot of competition

Competition factors on the cyber security market

F-Secure's competitive advantages

Rapid growth of the cyber security market and thewave of investments that swept across the sector
have, over the past decade, strongly shaped thecompetitive landscape. The market is still very
fragmented and still looking for its shape. A
growing share of market growth is grabbed by new
cyber security industry start-ups that often are
specialized in a particular niche segment of cybersecurity with their services or products. Some of thecompanies set up in the past decade have alreadygrown to a size class where they are eating market
shares from the more traditional players in the
sector. For example, the very rapid growth of USbased Crowdstrike in recent years has beenreflected in the market for endpoint protection in
the market share of traditional players among large
enterprise-size customers.

In cyber security products, the quality of the
product and its ability to prevent or detect malware
is naturally emphasized as a competition factor. In
endpoint protection products, the threshold toenter the field has, however, lowered as AI andcloud environments offer the required algorithms
and capacity for virus prevention software. At thesame time, detection and response capabilities are
increasingly important. In addition, customers'
confidence in the product, their success in various
tests and the brand are emphasized in thecompetition.

F-Secure’s strong brand, especially in Northern
Europe, is based on the company’s long-term andsolid expertise in virus prevention technologies. A
testament of this are the numerous awards thecompany has won in malware detection tests. FSecure’s brand is particularly strong in endpoint
protection products among SMEs and consumers.
The company still has brand work to do on thecorporate side to be perceived more as acomprehensive cyber security house whose
solutions also cover the cyber security needs oflarger companies. F-Secure's consulting services
polish the company's brand on the corporate sideand help it to position itself more strongly as acomprehensive cyber company. Consulting also
gives a competitive edge to companies that onlyoffer cyber security products.

Traditional players, and those who have been on
the market longer, try to make their offering morecomprehensive to respond to the competition andthis has accelerated consolidation in the industry as
bigger players buy smaller product and service
companies.

In the big picture, global IT sector giants like IBM,
Microsoft and Cisco, whose cyber security revenue
is in the billion range also operate on the market. In
recent years, especially Microsoft has raised its
head on the corporate side with good products andvery strong distribution power. We have listed FSecure's competitors in different product areas on
the following page.

The role of distribution channels is also important incompetition as it is difficult for a product business
operating without working channels to generate
volume and thus scalability. Especially in corporate
security, products are sold mainly through service
partners and the product solutions must be built sothat they also enable the possibility for the service
partner to build value-added services on top ofthem.
In medium sized and large enterprises, theuniformity of the product portfolio is an emphasizedcompetition factor as the customers rather
purchase an extensive turnkey solution instead ofseveral point product solutions. However, themarket is still highly fragmented and there areplenty of entities to protect in an organization, evenoutside F-Secure's solution offering. F-Secure
estimates that on average, larger customers havesecurity solutions from six different suppliers andthe total number of different solutions easily
reaches 20-30.

F-Secure's extensive reseller channel in corporate
security and operator channel in consumer security
are an asset especially among small companies
and consumers. In Europe, the company hascompetitive advantage against its competitors inthat geopolitical factors may affect the decision
making of some customers.
In addition to antivirus expertise, we feel that FSecure also has technological competitive
advantage in new corporate solutions(Countercept). This is partly reflected in the alreadystrong customer relationships among demanding
customers, like large banks.

23Competitive field
F-Secure's
competence areas

Weight in F-Secure's businessand strategy

Main competitors

Other competitors

Endpoint protection(EPP)

Endpoint detection andresponse (EDR)Managed detection andresponse (MDR)

Cyber security services

No individual maincompetitors

Vulnerability management

Source: Inderes, F-Secure, Gartner

24

Strategy 1/2
Successful transformation into a cyber security
house

usage-based model, which is not yet very common
in the industry.

In 2015, F-Secure started evolving from an antivirus
company focusing on consumer business towards
a more comprehensive cyber security company,
whose business focus lies on the rapidly growing
corporate security markets. The change waslaunched by selling the consumer-focused cloudstorage business and acquiring nSense that
expanded the corporate security portfolio andexpertise considerably. Simultaneously, the focus
of R&D in corporate security shifted to developing
detection and response solutions. Cyber security
consulting was also strengthened with two smalleracquisitions in 2017.

Overall, F-Secure has been successful in its
transformation and a strong corporate security
business has grown alongside consumer security.
However, these businesses are in very different
stages and must be managed with very different
strategies. We therefore welcome F-Secure's plan
to list consumer security as a separate company.
Reflecting business separation, F-Secure has
started preparing a brand reform in corporate
security.

In 2018, the MWR acquisition moved F-Secure's
growth strategy and transformation process basedon corporate security forward in bounds and leaps.
The weight of consulting in the company's businessgrew significantly and the Countercept productobtained in the acquisition strengthened thecompany's detection and response solution
offering. MWR's integration into F-Secure was
successful as expected.
The change in F-Secure has required significant
investment in unifying the product and service
offerings and the development of the partner
channel. At the same time, the business model haschanged from selling one-time licenses tocontinuous subscription sales. With the Elements
platform launched last summer, F-Secure is taking
further steps in servitization of cyber security. Now
customers can also buy cyber security with a

The separation of business activities would sharpen
F-Secure's strategy considerably. In a rapidly
growing corporate security market, growth is still
the key value driver and available market sharesare being fought for partly at the expense ofprofitability. Thus the business must be driven withgrowth first for years and profitability optimization
can only begin when the market starts to mature.
We believe that the independent corporate security
business would be priced based on a combinationof the EV/Sales ratio and growth and profitability.

In consumer security, the growth outlook is morestable and the business already generates strong
cash flow. In our view, the strategy would thus
focus more on optimizing the capital structure andstriking the right balance between growthinvestments and profit distribution to owners.
Consumer security would, in our view, be profiled
as a stable dividend payer as an independent listedcompany.

Financial targets
In August 2021, F-Secure published new mediumterm financial targets. In corporate security
products, the company aims to achieve a doubledigit revenue growth rate. In cyber security
consulting, the aim is high single-digit growth %. We
believe that achieving low double-digit growth inproducts organically is realistically achievable withgood strategy implementation. In consulting,growth roughly in line with the market should also
be achievable, as market recovery from COVID
alone supports growth in coming years.
In consumer security, F-Secure aims to grow at a
medium single-digit growth rate (~5%). In practice,
this means that the growth rate seen in 2020-2021
will continue in coming years, which seems to be arealistic target.
In terms of profitability, F-Secure expects theadjusted EBITDA margin to develop towards 20%
in the medium term (2021e: 16%). Achieving thislevel should be more than possible thanks to thecompany's scalable software business. According
to our estimates, consumer security is already well
above the target level, so we feel the profitability
improvement must come mainly from corporate
security products where growth investments stillburden profitability. We estimate that the
profitability potential of consulting is around 15%,
but currently profitability is still far from this level.

25

Strategy 2/2
F-Secure’s dividend policy is to distribute around
one-half of the company’s annual profit toshareholders. In 2018-2019, the company skipped
dividend payment after the MWR transaction
increased debt in the balance sheet and thereported result was low due to growth investments.
In 2020, the company returned to dividend
payment, paying approximately half (EUR 0.04 pershare) of its earnings as dividends. F-Secure's value
creation is primarily based on growth in corporate
security and the company is not profiled as adividend company.
Acquisitions
Acquisitions are part of F-Secure’s strategic tools
and the company has boosted its transformation
into a comprehensive cyber security company withacquisitions in the past. In consulting, acquisitions
are carried out to increase geographical coverageor acquire experts, in which case the acquisition
also acts as an alternative to recruitment. Examplesof these are the small (3.5 MEUR) acquisitions(Inverse Path in Italy and Digital Assurance
Consulting in Britain) in 2017.

On the product side, F-Secure looks for small
acquisitions to complement its current productoffering. In 2015, F-Secure acquired the FinnishDanish service company nSense for EUR 18 million
which, in addition to cyber security consultants,
gave the company a product for vulnerability
management. We consider it most likely that any
subsequent acquisitions would fall into thiscategory.

In 2018, F-Secure acquired the British MWR
InfoSecurity with approximately 400 employees
and about EUR 31 million in revenue. The cash
purchase price was GBP 80 million (91.6 MEUR)
and the earn-out was GBP 5 million. At the final
purchase price, the EV/Sales multiple of theacquisition was around 3.1x, which can beconsidered as neutral reflecting F-Secure's own
valuation at the time of the transaction (EV/S last 12
months: 3.1x) or acquisitions in the sector. The
acquisition increased F-Secure’s geographicalcoverage, significantly strengthened consulting(>50% of revenue from services) and introduced
complementing technologies for strategicallyimportant detection and response solutions(Countercept) to F-Secure's product portfolio.

We believe that given the right opportunity, FSecure is also ready for a larger M&A transaction toachieve economies of scale in corporate security or
to establish a wider distribution channel in SMEs.
We expect a larger transaction could only become
topical after the likely separation of consumer
security is completed. We also believe that the highvaluation levels of the cyber security sector slow
down F-Secure’s willingness for larger transactions.

26

Strategy
2015
2017

2018
2020

2021-

Transformation into comprehensive
cyber security company starts

Growth acceleration

Separation of corporate and consumer
businesses• Focus on growing corporate security markets• MWR InfoSecurity acquisition• Successful exit from cloud storage business• Shift to the mid-market target customer vertical• Assessment of strategic options for separate
listing of consumer security• Acquisition of three cyber security service
companies• Better product portfolio integration• Product development focuses on products that
detect and respond to security threats• Stable growth and good profitability in consumer
security• Corporate security products target double-digit
growth, consulting high single-digit growth• In consumer security, the target is a high singledigit growth rate
• Adjusted EBITDA is expected to develop toward
20% in the medium term

• Developing and growing the partner channel• Possible acquisitions that accelerate growth

Success factors of the strategy
Implemented

Near future, 1-2 years

The next 5 years• Strengthening corporate security product andservice offering• Separation of consumer and corporate businesses
and brands• Strong growth and achieving sufficient scale in allareas in corporate security• Increase revenue from corporate security toexceed consumer security• Growth in corporate security with the modular
Elements cloud platform and additional/crossselling, as well as MDR solutions• Maintaining a strong distribution channel andpartner network for medium sized and large
companies• Raising the average price and expanding theoperator channel in consumer security• In the consumer business, optimizing profitability
and stable growth, maintaining the viability of theoperator channel• Competitiveness of consumer security remains
strong and turns to growth path
• Adapting the organization and culture tocorrespond with the growth strategy

Source: Inderes• Focus in consulting will shift from growth toprofitability on more mature markets, achieving
sufficient scale on smaller markets• Ability to continuously strengthen the productand service portfolio in line with market trends
and technology shifts organically or throughacquisitions
27

Financial position
Growth and earnings development in 2015 to2020
In 2015, F-Secure sold its cloud storage businessfor EUR 52 million (purchase price EUR 30 million in2009). Since then, F-Secure started to invest
significantly in rapidly growing corporate security
markets, and growth has been sought bothorganically and through acquisitions. Corporate
security revenue has grown from EUR 46 million in2014 to EUR 120 million by 2020 with an averageannual growth percent of 17%. A rough estimation isthat half of the growth is organic and half comesfrom acquisitions. In consumer security, thecompany grew modestly by some 1.4% per year
during this period and revenue was EUR 100 million
in 2020. In 2020-2021, however, consumer
security growth has risen to around 5-6%.
F-Secure accelerated its growth investments in linewith its strategy in 2017-2019, which was reflectedin the company's profitability. The adjusted EBIT%in 2015-2016 was about 12-15% and decreased tosome 4-6% in 2018-2019. The biggest growthinvestments have now been made and 2020
profitability was already above 10%. This was partly
due to one-off cost savings caused by COVID, but
we also expect a slightly improvement in
profitability this year. Depreciation of intangible
assets related to the MWR acquisition (some 3
MEUR p.a.) burden the reported result.
Cost structure
F-Secure's gross margin was 78% in 2020, which isa good level for a software company in general. For
example costs arising from producing cloud-based
services and customer support, as well as direct
costs from producing cyber security services arerecorded under direct sales costs. We see a slight
upside in the gross margin as the share of new
corporate security products in company revenue
increases.
Sales and marketing expenses stood at EUR 95.6
million, representing 43% of revenue in 2020. The
expense item includes salaries, marketing
expenses and other operating expenses.
According to our estimates, the cost of sales andmarketing will have most downward flexibility as FSecure's focus moves from growth to profitability.
R&D costs was EUR 41.9 million in 2020 or 19% ofrevenue. We do not expect the relative share of theexpense item to scale down significantly in the longterm. Most R&D costs are personnel costs. FSecure capitalizes product development costs
quite modestly in the balance sheet as capitalized
costs amounted to EUR 5.5 million in 2020 (2019:
6.2 MEUR).
Administrative costs stood at EUR 17.1 million in2020 (2019: 28.1 MEUR) or 7.8% of revenue. We
see a slight potential for long-term scalability in the
expense item with growth.

Cash flow
F-Secure’s business normally generates good cash
flow and operating cash flow was EUR 22-29
million p.a. in 2013-2017. Cash flow weakened to
EUR 6.8 million in 2018, mainly due to the MWR
acquisition and its integration. Cash flow improved
to EUR 18.5 million in 2019 and to as much as EUR
46.7 million in 2020. Cash flow was supported by asignificant earnings improvement, higher deferred
revenue from increased orders, and otherwise
good working capital control in the midst of the

COVID pandemic.
In general, F-Secure's cash flow is supported bydeferred revenue from customers, as contract
payments are often received at the beginning of
the contract period. As a result, F-Secure’s working
capital is typically negative. The improved growthrate in deferred revenue last year indicates thatgrowth will also continue in coming quarters.
Balance sheet and financial position
F-Secure's balance sheet is in good condition andthe balance sheet figures (Q3’21: equity ratio 61%,
gearing -14%) indicate that the large MWR
acquisition from 2018 has been fully merged. Thebalance sheet that has strengthened quarter by
quarter and good cash flow provide F-Secure witha backrest for strategy implementation and enables
M&A transactions.
At the end of Q3’21, the balance sheet total was
EUR 234 million. The balance sheet contains EUR
85 million in goodwill from acquisitions. Goodwill
testing is based on a high WACC of about 11-15%
and we do not consider significant impairment risk
likely. Other intangible assets stood at EUR 34
million. Balance sheet assets consisted primarily ofcash in hand (44 MEUR) and receivables (47MEUR).
Balance sheet liabilities consisted mainly of equity(93 MEUR) and non-current (25 MEUR) and current(84 MEUR) non-interest bearing liabilities. Of noninterest bearing liabilities, EUR 82 million weredeferred revenue. Interest-bearing debt totaled
EUR 31 million at the end of Q3’21.
28

Historical development
Revenue and profitability

EPS and dividend

250

25%

200

20%

150

15%

0,18
0,16
0,14
0,12
0,1
0,08

100

10%

50

5%

0,06

0,04
0,02

0

0%

0
2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021e

Yritystietoturva
Corporate security

Kuluttajatietoturva
Consumer security

Pilvitallennus(lopetetut
toiminnot)
Discontinued
operations

Adj,
EBIT-%Oik.
EBIT-%EPS

Revenue and growth % of consumer security

Revenue and growth % of corporate security
140

35%
30%

120

25%

100

20%

80

Dividend
Osinko

120

14%
12%

100

10%

80

8%

15%
10%

60

5%

40

6%

60

4%

40

2%

0%
20

-5%

0

-10%
2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021e

Source: Inderes
Source: F-Secure

0%

20

-2%

0

-4%
2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021e29

Financial position
Balance sheet Q3’21(MEUR)

AssetsOther items
Short-term interestbearing debt

8,2

Other
items

43,6

Liquid assets

4,1

Deferred tax
assets46,5Receivables

12,6

Tangible assets(incl. IFRS16)

Non-current
interest-bearing
liabilities

34,3

Intangible assets

Non-current
liabilities

Non-interest
bearing current
liabilities

Development of balance sheet key figures
Liabilities
1,2

53%

49%

10,6

58%

65%

62%

43%

83,8
2018

2019

2020

2021e

2022e

2023e

Gearing
Nettovelkaantumisaste

Equity ratio
Omavaraisuusaste
20,2Deferred revenue growth

24,8
50%

41%
36%

35%

40%
30%
84,7

Goodwill

Shareholders’equity

30%
20%
10%
0%
-10%
-20%
-30%
-40%
-50%
-60%

93,3

22%

15%

20%
10%
10%

4%

0%

-5%

2%
0%

1%

5%
1%

Q4'19

Q1'20

Q2'20

-2%

2%

4%

8%

10%

-10%
Q3'19

Lyhytaikaiset
Current

Source: Inderes

Q3'20

Q4'20

Q1'21

Q2'21

Q3'21

Pitkäaikaiset
Non-current

30

Estimates and valuation 1/5
Estimates
Basis for the estimates
Our estimates are in line with F-Secure's financial
targets, and we expect the company to continue on
the strengthened growth path also in coming years.
In corporate security, especially in MDR and EDR
solutions, growth potential is considerable, and weestimate that F-Secure's significant investments inthese areas will continue to be reflected as productrevenue growth in future as well. In coming years,
growth should also be visible as a gradualprofitability improvement, as the largest
investments have been completed.
In consulting, the demand outlook looking beyond
COVID is good and consulting revenue has alreadystarted to recover in 2021. The profitability of
consulting in the next few years is, in addition to therate of demand pick-up, largely dependent on how
F-Secure can grow in smaller markets to achievesufficient scale.
In corporate security, a significant share of revenue(estimated to be close on half) still comes fromendpoint protection products (EPP). However, newsolutions have already reached a scale where they
are becoming more and more apparent in revenue
growth. Bundling products into larger
comprehensive solutions through the new
Elements platform offers clear additional/crossselling opportunities in F-Secure's extensive EPP
customer base. Among newer products, Cloud
Protection for Salesforce has also become an
important product for growth in recent years.

In consumer security, the growth outlook has
picked up by a few percentage points from theprevious very low single-digit growth in recent
years. A key factor behind this is increased remote
working caused by the COVID pandemic and, thus
the increased desire of consumers to pay for cybersecurity. F-Secure has managed to grow theoperator channel and increasingly players outside
the operator realm (e.g. insurance companies) also
act as F-Secure’s partners. This will support thegrowth of the partner channel in coming years as
well.
Estimates for 2021

Revenue and growth % in corporate
security
180
160

30%

140
120
100
80

50

46

49

53

40
20

61

57

25%
20%
15%

32

10%

60
64

73

74

2018

2019

2020

82

90

99

109

5%

0%

0

Our estimates for 2021 are in line with F-Secure's
guidance. 2021 has been a time of increasing
growth for F-Secure after the COVID year. Overall,visibility into F-Secure's short-term revenue
development is relatively good thanks to its stable
and continuous software business.
In its guidance, F-Secure expects high single-digit
growth from its corporate security product revenue.
This seems cautious considering 1-9/2021 (YTD:9%), and especially Q3 (+13%) growth (our estimate10%). F-Secure expects consulting to grow (ourestimate 6%) and in the first 9 months, a clear
recovery was already been seen in revenue (7%).
Consumer security is expected to grow at about
the same rate as in 2020 (5.5%) and our estimate is
6%. As a whole we expect that F-Secure’s 2021
revenue will grow by 7.5% to EUR 237 million.

35%

-5%
Tuotteet
Products

2021e 2022e 2023e 2024e
Konsultointi
Consulting

kasvu-%
Growth-%Revenue and growth % in consumer
security
140

7%
6%
5%
4%
3%
2%
1%
0%
-1%
-2%
-3%

120
100
80
60
40

111

117

122

95

95

100

106

2018

2019

2020

2021e 2022e 2023e 2024e

20
0
Kuluttajatietoturva
Consumer security

Source: Inderes

Growth-%kasvu-%

31

Estimates and valuation 2/5
Adjusted EBITDA is expected to remain
approximately at 2020 level (35.7 MEUR). In linewith the comments from F-Secure, we expect thecompany’s cost level to continue increasing fromexceptional COVID times. Nevertheless, ouradjusted EBITDA estimate for 2021 (37.8 MEUR) is
some 6% above the previous year. It is therefore
very likely that F-Secure will revise its outlook forthe result upward closer to year end.
Estimates for the next few years
In 2022-2023, we expect corporate security togrow at an annual rate of about 10-9%. The mostimportant growth driver for the product business(+10%) is MDR solutions and the growing sales ofcomprehensive endpoint protection solutions. In
consulting (+8%), we expect demand recovery tocontinue once COVID lets up. In our estimates theshare of corporate security (2023e: 157 MEUR) of FSecure's revenue rises to 57% by 2023 (2020:55%). We expect consumer security revenue tocontinue on a good 5% growth path and therevenue to rise to EUR 117 million in 2023.
According to our estimates, accelerating growth incorporate security will still burden the performancein the next few years, while good margins in
consumer security will support profitability. We
expect some normalization in the cost level fromCOVID times over the next few years, for example
in terms of sales and marketing and travel
expenses.
We estimate that F-Secure's profitability will
gradually scale toward the company's mediumterm target of 20% adjusted EBITDA margin. We
expect that profitability will improve mainly as thegross margin increases and the relative share ofsales and marketing costs decrease with growth.
Overall, however, we do not expect significant
profitability scaling in the next few years. In 20222023, we expect the adjusted EBITDA to bearound 16% and adjusted EBIT of 12%.

Development of revenue and profitability
20%

191

273

255

237

220

217

293
16%
12%

Long term estimates
In 2024-2029, the growth rate of corporate security
will gradually fall in our estimates from 9% to 4%. In
turn, we expect consumer security revenue growth
to gradually decrease from 5% to 2%. We expectthat the terminal growth of F-Secure’s revenue
needed for the DCF cash flow calculation, will be
2.5% from 2030 onwards.
We estimate that F-Secure's adjusted EBIT margin
will be 13.5% in 2024 and gradually increase to 19%
by 2029 as growth stabilizes. This is also our
profitability expectation in the terminal period. In
the past, before increasing investment in corporate
security, F-Secure's adjusted operating profit was
15.0-17.5% in 2010-2015, considering which theprofitability estimate seems realistic. In light of
scalable software business, F-Secure could reacheven better profitability in a positive scenario.
However, the strong competitive pressure andspeed of change in the cyber security market
create uncertainty in assessing long-termsustainable profitability levels.

8%

4%
0%
2018

2019

2020

2021e

2022e 2023e 2024e

Liikevaihto
RevenueOik.
Adj.liikevoitto-%
EBIT-%EPS and dividend
0,19
0,16
0,13

0,14

0,10

0,04

0,03

0,00

0,00

2018

2019

0,04

0,04

2020

2021e

EPS
(oikaistu)
EPS(adj.)

Source: Inderes

0,09
0,05

2022e

0,06

2023e

2024e

Dividend
Osinko/ osake32

Estimates
Income statement

2019

Q1'20

Q2'20

Q3'20

Q4'20

2020

Q1'21

Q2'21

Q3'21

Q4'21e

2021e

2022e

2023e

2024e

Revenue

217

54.8

53.0

54.5

57.9

220

57.8

58.2

58.7

62.0

237

255

273

293

Corporate security (products)

72.5

18.6

18.5

18.5

18.7

74.3

19.5

20.2

21.0

21.1

81.8

90.4

99.4

109

Corporate security (consulting)

50.0

11.9

9.7

10.9

13.3

45.8

12.0

11.6

11.2

14.0

48.8

52.9

57.1

61.1

Consumer security

94.8

24.4

24.8

25.0

25.9

100

26.3

26.3

26.5

26.9

106

111

117

122

EBITDA excl. NRI

23.2

7.2

10.2

11.1

7.3

35.7

9.6

8.1

11.0

9.0

37.8

40.4

44.5

50.5

EBITDA

31.1

7.6

10.2

11.1

6.9

35.7

9.6

5.8

10.6

9.0

35.1

40.4

44.5

50.5

Depreciation

-24.0

-4.0

-4.2

-4.1

-3.7

-16.0

-3.5

-3.5

-3.4

-3.6

-14.0

-13.6

-13.8

-13.8

EBIT (excl. NRI)

9.6

4.0

6.8

7.7

4.3

22.9

6.9

5.4

8.2

6.1

26.6

29.6

33.5

39.5

EBIT

7.2

3.6

6.0

7.0

3.1

19.7

6.2

2.4

7.2

5.4

21.1

26.8

30.7

36.7

Net financial items

-2.9

-1.3

-0.7

-0.7

-0.5

-3.2

0.3

-0.3

-0.3

-0.3

-0.6

-1.0

-0.5

-0.5

PTP

4.2

2.3

5.3

6.3

2.6

16.5

6.4

2.0

7.0

5.1

20.5

25.8

30.2

36.2

Taxes

-0.9

-0.2

-2.2

-1.3

0.1

-3.6

-1.5

-0.5

-1.5

-1.3

-4.8

-6.4

-7.2

-8.7

Net earnings

3.4

2.1

3.1

5.0

2.7

12.9

4.9

1.5

5.5

3.8

15.7

19.3

22.9

27.5

EPS (adj.)

0.03

0.02

0.02

0.03

0.02

0.10

0.03

0.02

0.04

0.03

0.13

0.14

0.16

0.19

EPS (rep.)

0.02

0.01

0.02

0.03

0.02

0.08

0.03

0.01

0.03

0.02

0.10

0.12

0.14

0.17

Key figures

2019

Q1'20

Q2'20

Q3'20

Q4'20

2020

Q1'21

Q2'21

Q3'21

Q4'21e

2021e

2022e

2023e

2024e

Revenue growth-%

14.0 %

2.6 %-2.0 %

1.4 %

3.3 %

1.3 %

5.4 %

9.8 %

7.8 %

7.1 %

7.5 %

7.6 %

7.4 %

7.0 %

Adjusted EBIT growth-%-9.4 %

130.4 %

396.9 %

125.1 %

40.9 %

138.3 %

71.2 %-21.1 %

7.1 %

41.1 %

16.4 %

11.3 %

13.0 %

18.0 %EBITDA-%

14.3 %

13.9 %

19.2 %

20.3 %

11.8 %

16.2 %

16.7 %

10.0 %

18.1 %

14.5 %

14.8 %

15.9 %

16.3 %

17.3 %

Adjusted EBIT-%

4.4 %

7.4 %

12.9 %

14.1 %

7.4 %

10.4 %

11.9 %

9.3 %

14.0 %

9.8 %

11.2 %

11.6 %

12.2 %

13.5 %Net earnings-%

1.5 %

3.8 %

5.8 %

9.1 %

4.7 %

5.8 %

8.5 %

2.7 %

9.3 %

6.1 %

6.6 %

7.6 %

8.4 %

9.4 %

Source: Inderes

33Estimates and valuation 3/5
Valuation
Investment view
F-Secure's business is currently moving in the right
direction in all areas and COVID has proven thestability and quality of the company's software
business. The stability of the software business andthus relatively low risk level supports the highvaluation of the share in the current market
environment.
In the short term, a key value driver for the share is
the planned separation of consumer and corporate
security. We see consumer and corporate security
as more valuable separately than together but
believe that this is already fully reflected in theshare value. We feel that stretching the valuation
further would require stronger growth in corporate
security or a path to significant profitability
improvement, which is not happening, however,based on F-Secure's medium-term targets.
Valuation multiples
With our estimates, F-Secure's earnings-based
valuation multiples look high for the next few years.
The adjusted 2021e-2022e P/E multiples are 43x
and 40x and the corresponding EV/EBIT multiples
are 32x and 28x. In 2024, when we expect
profitability (adj. EBITDA 17%) to be closer to themedium-term target, the P/E multiple is 29x and
EV/EBIT 20x. These multiples can still not be seen
as especially cheap and, to materialize, they require
moderate success of the company’s strategy,
which naturally involves risks. With our earnings
growth estimate for the next few years, the PEG

ratio of the share (2.4x) is high. When looking solely
at earnings-based multiples, F-Secure's shareseems expensive.
With the EV/Sales multiple, F-Secure’s valuation isclearly more modest compared to earnings-based
multiples. With our estimates, the 2021e-2022e
EV/Sales multiples are 3.6x and 3.3x. F-Secure’s
forward looking EV/Sales multiple has varied
between 1.5x and 3.7x in 2014-2021 with a medianof 2.5x. Thus, the current valuation is at the top of
the historical valuation range.
F-Secure's sales-based valuation looks particularly
low when comparing to the valuation level of cybersecurity sector peer companies (see page 36). The
low sales-based valuation, is in our view, explainedby F-Secure’s combined growth (2021e +7.5%) andprofitability (2021e adj. EBIT: 11%) that is low
compared to many peers. Also with our 2022
estimates (growth +7.6%, adj. EBIT% 12%) thesituation doesn’t change much. We believe that asustained increase in sales-based valuation fromthe current level would require a better
combination of growth and profitability.

The growth expectations loaded into F-Secure's
share can be illustrated by assuming that thecompany will reach the adjusted EBIT% of 15-20%
already next year, which reflects the mature stage.
In this case the share’s P/E ratio would be 23x-31x
and EV/EBIT 16x-22x. Even these multiples do notappear to be particularly low, which indicates that
F-Secure’s current valuation requires good growthin coming years.

Valuation

2021e

2022e

2023e

Share price

5.46

5.46

5.46

Number of shares, millions

158.4

158.4

158.4

Market cap

865

865

865

EV

846

828

808

P/E (adj.)

43.4

40.3

34.6

P/E

55.0

44.7

37.7

P/FCF

62.5

33.9

31.4

P/B

9.4

8.3

7.2

P/S

3.7

3.4

3.2

EV/Sales

3.6

3.3

3.0

EV/EBITDA

24.1

20.5

18.2

EV/EBIT (adj.)

31.8

28.0

24.2

Payout ratio (%)

40.3 %

40.9 %

41.5 %

Dividend yield-%

0.7 %

0.9 %

1.1 %

Source: Inderes

F-Secure's historical EV/S-multiple
4
3,5
3
2,5
2
1,5
1
2015

2016

2017

2018

Forward EV/S
Source: Inderes, Bloomberg

2019

2020

2021

MediaaniMedian34

Estimates and valuation 4/5
Peer group
We have included listed cyber security companies
in F-Secure’s peer group, most of which are FSecure’s direct competitors or compete, at least to
some extent, with F-Secure in a particular productarea. The companies in the peer group are, for themost part, clearly larger than F-Secure and thisshould be partly reflected in F-Secure’s pricing
compared to peers. The companies are also in
different business development stages, which isvisible in their growth and profitability profiles and,to some extent, makes comparison difficult.
Measured by the EV/Sales multiple, F-Secure isvalued at a discount of over 60% compared to its
peers. However, the combination of F-Secure's
growth and profitability is well below the averagelevel of the peer group, which is rightly reflected asa lower valuation. Most of F-Secure's businesscomes from stable consumer business and lessscalable consulting, which means that the company
cannot be profiled in the same basket with thefastest growing SaaS companies in the sector. We
also point out that the sales-based valuation levelof the peers is very high in absolute terms (2021e2022e 10x-9x) and there is a risk that the market
will not necessarily accept such high multiples forthe companies in future.

and next. Looking at 2022, the premium of FSecure’s multiple is around 10% to the peer group.

2022e EV/EBITDA of consumer security
peers

DCF model
The DCF value for equity for F-Secure is EUR 836
million, i.e. EUR 5.3 per share. Considering the DCF
model, the good and stable growth outlook we
expect is already fully priced in F-Secure's share.
Our terminal assumption is that EBIT % is 19% andgrowth 2.5%. The cost of capital (WACC) in the DCF
model is 7.7%. This is justified considering therelatively low risk profile of F-Secure's stablesoftware business in the current interest rateenvironment. The weight of the terminal
assumption is 68% of the enterprise value, which inpart indicates that most of F-Secure’s value will be
generated from cash flow long in the future, which
increases uncertainty.

Avast

Trend Micro

NortonLifeLock

McAfee

15,9

12,7

11,5

16,6

Comparing F-Secure's earnings-based valuation
multiples with the peers is not particularly
meaningful, as most peer group companies still
have low profitability or are loss making due togrowth investments. F-Secure’s profitability also still
has scalability potential. The median EV/EBIT
multiples of the peer group are 45x-26x this year35Valuation of F-Secure and cyber security companies
Valuation of cyber security companies relative to combination of growth and profitability*

14x

12x

EV/Sales 2022e

10x

8x

6x

4x

F-Secure
2x

0x
-10%

0%

10%

20%

30%

40%

50%

60%

Average growth-% + EBIT-% 2021e-2023e

Source: Refinitiv, Inderes, *Cloudflare and Crowdstrike found in the peer group that are extremely highly valued have been excluded from the graph36

Estimates and valuation 5/5
Sum of the parts calculation
We use the sum of the parts method to illustrate FSecure’s value creation. This method requires certain
assumptions, but it now serves as a more relevant
approach as consumer and corporate security arebeing separated. The calculation is now based on
2022 (previously 2021) estimates that have resulted in
the sum of the parts increasing from our previous
update.
We price consumer security on an earnings basis due
to its stable growth profile. F-Secure does not break
down business profitability, so we assume that
consumer security EBIT% is 22-28%, which reflects
good profitability for a mature business. F-Secure's
significantly larger consumer security peers are priced
at 11x-16x EV/EBITDA ratios, and a short while ago, apurchase offer was made for McAfee with a 16.6x
EBITDA. Applying this we assume that consumer
security could be priced with an 11x-15x EV/EBIT ratio
as an independent listed company. Thus, consumer
security would be valued at EUR 362 million in theneutral scenario, the range being EUR 270-468
million.
In corporate security, F-Secure opens the share of
consulting and products of revenue, based on which
we have separately assessed the values of thesebusinesses. We believe the EV/Sales multiple ofconsulting (revenue 2022e 53 MEUR) that is
personnel driven and thus less scalable requires lessinterpretation. The multiples of IT service companies,
for example, can be used as a good benchmark. Thus
we have set the acceptable EV/Sales ratio for
consulting in the range of 1.2x-1.8x.

A significant share of product turnover (2021e: 82
MEUR) consists of stably growing endpoint protection
products (EPP), whose growth is accelerated by new
products (e.g. EDR) and their bundling into acomprehensive solution. Managed detection andresponse (MDR) solutions are also a rapidly growing
product area that is strategically important for FSecure. F-Secure targets double-digit growth inproduct revenue, and our estimate for the next few
years is about 10%. We believe, the profitability of the
product business will not be particularly high incoming years, reflecting the combination of growthand profitability, which will remain relatively low
compared to many fast-growing product companies.
Considering all this, we price product turnover in aneutral scenario with a 4.0x EV/Sales ratio, the range
being 3.0x-4.5x. By comparison, McAfee's corporate
operations were sold in March 2021 to a private equity
company with a 3.1x EV/Sales ratio.
By applying the above assumptions, the value ofcorporate security in the neutral scenario is EUR 441
million with a range of EUR 335-502 million. By adding
F-Secure’s estimated net cash on top of the businessactivities, the value of F-Secure’s entire stock is EUR
840 million or EUR 5.3 per share. The range of thepessimistic and optimistic scenario is EUR 4.0-6.4. The
sum of the parts calculation does not indicate an
upside for the share based on the neutral scenario.
The risk in the sum of the parts calculation is cybersecurity companies’ high valuation levels, which could
also have a negative impact on the multiples we use
in the sum of the parts model.

Consumer security

Pessimistic

NeutralOptimistic

Assumed EBIT-%

22 %

25 %

28 %

EBIT 2022e

25

28

31

x multiple (EV/EBIT)

11.0x

13.0x

15.0x

EV

270

362

468

Corporate security

Pessimistic

NeutralOptimistic

Revenue 2022e

143

143

143

Product revenue

90

90

90

x multiple (EV/S)

3.0x

4.0x

4.5x

Value of product business

271

362

407

Consulting revenue

53

53

53

x multiple (EV/S)

1.2x

1.5x

1.8x

Value of consulting

63

79

95

Total value of corporate
security

335

441

502

Sum of the parts

Pessimistic

NeutralOptimistic

Consumer security

270

362

468

Corporate security

335

441

502

EV

604

803

970

+ Net debt at end of 2022

37

37

37

Equity value

641

840

1,007

Value per share

4.0

5.3

6.4

37

Peer group valuation
Peer group valuation

Share priceCompany

Market cap

EV

MEUR

MEUR

EV/EBIT

EV/EBITDA

2021e

2022e

2021e

2022e

Mandiant Inc

18.7

3990

4149

NortonLifeLock Inc

25.3

12872

14905

13.5

11.7

13.2

11.5

Trend Micro Inc

6740.0

7312

5462

16.5

15.8

12.7

12.7

Rapid7 Inc

130.9

6582

7067

Fortinet Inc

341.1

48204

46359

EV/S

P/E

2021e

2022e

2021e

2022e

9.7

8.2

6.7

6.1

17.6

14.4

29.8

29.3

85.8

72.6

86.5

71.5

3.8

3.6

15.2

12.3

15.8

13.3

61.2

51.2

55.7

47.3

14.9

13.1

51.5

56.6

45.6

12.1

9.6

Cyberark Software Ltd

197.4

6893

6486

Palo Alto Networks Inc

524.6

44673

44959

65.8

Check Point Software Technologies Ltd

116.3

13667

12139

13.3

13.0

13.0

12.7

6.4

6.2

16.9

15.9

Qualys Inc

139.0

4662

4358

31.0

29.5

26.1

25.0

12.1

10.7

43.0

41.0

NCC Group PLC

244.5

904

847

20.6

14.0

14.6

11.0

2.6

2.3

27.5

20.9

Nixu Oyj

7.0

52

54

108.0

21.6

21.6

12.0

1.0

0.9

Crowdstrike

261.0

51021

50105

66.2

40.5

Avast PLC

597.4

7310

7763

18.2

16.9

16.9

15.9

9.3

8.8

21.9

Tenable Holdings Inc

54.5

5101

4851

116.8

92.8

94.0

75.9

10.3

8.6

172.7

SolarWinds Corp

16.7

2337

3379

11.1

13.1

10.3

12.5

5.4

5.2

12.5

SecureWorks Corp

20.5

1508

1335

71.3

2.7

2.8

89.6

Splunk Inc

139.8

19524

20014

10.5

8.8

Mimecast Ltd

83.6

4831

4581

10.4

8.8

SailPoint Technologies Holdings Inc

59.2

4837

4804

13.1

11.2

Tufin Software Technologies Ltd

10.0

332

268

2.8

2.5

Cloudflare Inc

211.7

58479

57889

101.6

74.5

Ping Identity Holding Corp

27.8

2018

2078

Varonis Systems Inc

60.1

5707

5188

Telos Corp

17.94

1030

928

Sumo Logic Inc

15.97

1575

1320

Knowbe4 Inc

25.38

3808

3568

16.6

13.1

Darktrace PLC

545.50

4680

4410

18.0

12.9

F-Secure (Inderes)

5.46

865

846

3.6

3.3

58.9

89.7

45.0

40.2

77.6

49.4

42.4

79.3

43.0

31.6

64.6

27.7

8.0

7.1

15.3

12.4

4.3

3.5

7.5

6.3

25.9

20.6

15.3

75.6

60.0

114.1

82.5

70.1

48.9

43.4

40.3

31.8

28.0

24.1

20.5

Average

49.7

35.6

36.3

29.0

14.9

14.5

61.7

39.9

Median

45.0

25.5

26.1

20.4

10.3

8.8

56.6

29.3

Diff-% to median

-29%

10%

-8%

0%

-65%

-63%

-23%

37%

Source: Thomson Reuters / Inderes. NB: The market cap Inderes uses does not consider own shares held by the company.

Valuation table
Valuation

2016

2017

2018

2019

2020

2021e

2022e

2023e

2024e

Share price

3.48

3.89

2.32

3.05

3.84

5.46

5.46

5.46

5.46

Number of shares, millions

156.0

156.7

157.5

157.8

158.1

158.4

158.4

158.4

158.4

Market cap

544

610

365

480

606

865

865

865

865

EV

451

519

375

496

595

846

828

808

785

P/E (adj.)

34.6

55.1

53.0

92.5

39.8

43.4

40.3

34.6

29.2

P/E

34.6

55.1

>100

>100

47.1

55.0

44.7

37.7

31.5

P/FCF

40.1

43.3

neg.

neg.

16.5

62.5

33.9

31.4

26.0

P/B

7.2

8.6

5.5

6.3

7.4

9.4

8.3

7.2

6.3

P/S

3.4

3.6

1.9

2.2

2.8

3.7

3.4

3.2

3.0

EV/Sales

2.8

3.1

2.0

2.3

2.7

3.6

3.3

3.0

2.7

EV/EBITDA

18.4

29.1

27.1

15.9

16.7

24.1

20.5

18.2

15.5

EV/EBIT (adj.)

23.5

45.0

35.4

51.8

26.0

31.8

28.0

24.2

19.9

Payout ratio (%)

119.5 %

56.7 %

0.0 %

0.0 %

49.1 %

40.3 %

40.9 %

41.5 %

50.0 %

Dividend yield-%

3.4 %

1.0 %

0.0 %

0.0 %

1.0 %

0.7 %

0.9 %

1.1 %

1.6 %

Source: Inderes

EV/EBITP/E (adj.)
92.5

EV/Sales
3.6

51.8
45.0

55.1

2016

35.4

53.0
39.8

34.6

2017

2018

P/E (adj.)

2.8

43.4

40.3

53.0
34.6

2019 2020 2021e 2022e 2023e
Median 2016 - 2020

31.8

26.0

23.5

2016

2017

2018

28.0

2.7

3.0
2.7

2.3

35.4

2.0

24.2

2019 2020 2021e 2022e 2023e

EV/EBIT (adj.)

3.3

3.1

Median 2016 - 2020

2016

2017

2018

EV/Sales2019 2020 2021e 2022e 2023e
Median 2016 - 2020

DCF calculation
DCF model

2020

2021e

2022e

2023e

2024e

2025e

2026e

2027e

2028e

2029e

2030e

EBIT (operating profit)

19.7

21.1

26.8

30.7

36.7

44.0

49.2

58.9

65.1

70.8

72.6

+ Depreciation

16.0

14.0

13.6

13.8

13.8

13.7

13.3

11.7

12.1

11.9

11.8

- Paid taxes

-5.6

-4.8

-6.4

-7.2

-8.7

-10.1

-11.3

-13.5

-15.0

-16.3

-16.7

- Tax, financial expenses

-0.7

-0.1

-0.3

-0.1

-0.1

0.0

0.0

0.0

0.0

0.0

0.0

+ Tax, financial income

0.0

0.0

0.0

0.0

0.0

0.0

0.0

0.0

0.0

0.0

0.0

- Change in working capital

10.0

-3.0

2.5

1.3

2.6

0.9

2.4

2.1

2.0

1.4

1.2

Operating cash flow

39.4

27.2

36.2

38.4

44.3

48.6

53.6

59.2

64.2

67.9

68.9

+ Change in other long-term liabilities

2.8

-1.3

0.5

0.5

0.5

0.5

0.5

0.0

0.0

0.0

0.0

- Gross CAPEX

-5.5

-12.0

-11.2

-11.3

-11.5

-11.5

-11.5

-11.5

-11.5

-11.5

-12.0

Free operating cash flow

36.6

13.8

25.5

27.6

33.3

37.6

42.6

47.7

52.7

56.4

56.9

TERM

+/- Other

0.0

0.0

0.0

0.0

0.0

0.0

0.0

0.0

0.0

0.0

0.0

FCFF

36.6

13.8

25.5

27.6

33.3

37.6

42.6

47.7

52.7

56.4

56.9

1116

Discounted FCFF

13.7

23.5

23.6

26.4

27.7

29.1

30.3

31.1

30.8

28.9

567

Sum of FCFF present value

831

818

794

771

744

717

688

657

626

595

567

Enterprise value DCF

831- Interesting bearing debt

-39.9

+ Cash and cash equivalents

51.4-Minorities

0.0-Dividend/capital return-6.3

Equity value DCF

837

Equity value DCF per share

5.3

Cash flow distribution

2021e-2025e

14%

Wacc
Tax-% (WACC)

25.0 %

Target debt ratio (D/(D+E)

0.0 %Cost of debt

4.0 %Equity Beta

1.10

Market risk premium

4.75%

Liquidity premium

0.50%

Risk free interest rate

2.0 %Cost of equity

7.7 %Weighted average cost of capital (WACC)

7.7 %Source: Inderes

2026e-2030e

18%

TERM

68%

2021e-2025e

2026e-2030e

TERM

Balance sheet
Assets

2019

2020

2021e

2022e

2023e

Liabilities & equity

2019

2020

2021e

2022e

2023e

Non-current assets

125

142

139

136

133

Equity

76.2

82.3

91.7

105

120

Goodwill

88.4

81.9

81.9

81.9

81.9

Share capital

1.6

1.6

1.6

1.6

1.6

Intangible assets

17.3

41.4

38.5

36.9

34.6

Retained earnings

67.2

79.6

89.0

102

117

Tangible assets

15.6

14.1

13.6

12.4

12.2

Hybrid bonds

0.0

0.0

0.0

0.0

0.0

Associated companies

0.0

0.0

0.0

0.0

0.0

Revaluation reserve

0.0

0.0

0.0

0.0

0.0

Other investments

0.0

0.0

0.0

0.0

0.0

Other equity

7.4

1.2

1.2

1.2

1.2

Other non-current assets

0.6

0.6

0.6

0.6

0.6

Minorities

0.0

0.0

0.0

0.0

0.0

Deferred tax assets

3.1

4.0

4.0

4.0

4.0

Non-current liabilities

54.4

50.6

47.8

41.8

36.3

Current assets

85.2

103

107

123

142

Deferred tax liabilities

2.5

1.3

1.3

1.3

1.3

Inventories

0.1

0.1

0.1

0.1

0.1

Provisions

3.0

0.0

0.0

0.0

0.0

Other current assets

2.3

0.9

0.9

0.9

0.9

Long term debt

29.5

23.9

22.5

16.0

10.0

Receivables

57.3

50.9

59.2

63.7

69.7

Convertibles

0.0

0.0

0.0

0.0

0.0

Cash and equivalents

25.5

51.4

47.3

58.0

71.3

Other long term liabilities

19.5

25.3

24.0

24.5

25.0

Balance sheet total

229

238

240

253

270

Current liabilities

98.8

105

101

106

114

Short term debt

11.9

15.9

6.2

5.0

5.0

Payables

85.4

83.3

92.3

99.3

107

Source: Inderes

Other current liabilities

1.5

5.7

2.0

2.0

2.0

Balance sheet total

229

238

240

253

270

Summary
Income statement

2018

2019

2020

2021e

2022e

Per share data

2018

2019

2020

2021e

Revenue

190.7

217.3

220.2

236.7

254.7

EBITDA

13.8

31.1

35.7

35.1

40.4

EBIT

4.5

7.2

19.7

21.1

26.8

OCF / share

PTP

1.7

4.2

16.5

20.5

25.8

FCF / share

Net Income

0.8

3.4

12.9

15.7

19.3

Book value / share

Extraordinary items

-6.1

-2.4

-3.2

-5.5

-2.8

2022e

EPS (reported)

0.01

0.02

0.08

0.10

0.12

EPS (adj.)

0.04

0.03

0.10

0.13

0.14

0.06

0.20

0.25

0.17

0.23

-0.59

-0.07

0.23

0.09

0.16

0.42

0.48

0.52

0.58

0.66

Dividend / share

0.00

0.00

0.04

0.04

0.05
2022e

Balance sheet

2018

2019

2020

2021e

2022e

Growth and profitability

2018

2019

2020

2021e

Balance sheet total

228.0

229.4

237.8

240.0

252.8

Revenue growth-%

12%

14%

1%

7%

8%

Equity capital

66.3

76.2

82.3

91.7

104.7

EBITDA growth-%

-23%

126%

15%

-2%

15%

Goodwill

90.7

88.4

81.9

81.9

81.9

EBIT (adj.) growth-%

-8%

-9%

138%

16%

11%

Net debt

9.3

15.8

-11.6

-18.6

-37.0

EPS (adj.) growth-%

-38%

-25%

193%

31%

8%

EBITDA-%7.2 %14.3 %

16.2 %

14.8 %

15.9 %Cash flow

2018

2019

2020

2021e

2022e

EBIT (adj.)-%

5.6 %

4.4 %

10.4 %

11.2 %

11.6 %EBITDA

13.8

31.1

35.7

35.1

40.4

EBIT-%

2.4 %

3.3 %

8.9 %

8.9 %

10.5 %

Change in working capital

-5.8

3.0

10.0

-3.0

2.5

ROE-%

1.2 %

4.7 %

16.2 %

18.1 %

19.7 %

Operating cash flow

9.3

32.0

39.4

27.2

36.2

ROI-%

5.7 %

6.5 %

16.4 %

17.4 %

21.8 %

CAPEX-115.3

-30.4

-5.5

-12.0

-11.2

Equity ratio

42.7 %

49.0 %

52.5 %

57.7 %

61.8 %

Free cash flow

-92.1

-10.8

36.6

13.8

25.5

Gearing

14.0 %

20.8 %-14.1 %

-20.3 %

-35.3 %

Valuation multiples

2018

2019

2020

2021e

2022e

EV/S

2.0

2.3

2.7

3.6

3.3

EV/EBITDA (adj.)

27.1

15.9

16.7

24.1

20.5

EV/EBIT (adj.)

35.4

51.8

26.0

31.8

28.0

P/E (adj.)

53.0

92.5

39.8

43.4

40.3

P/E

5.5

6.3

7.4

9.4

8.3

Dividend-%

0.0 %

0.0 %

1.0 %

0.7 %

0.9 %

Source: Inderes

Disclaimer and recommendation history
The information presented in Inderes reports is obtained from several
different public sources that Inderes considers to be reliable. Inderes
aims to use reliable and comprehensive information, but Inderes does
not guarantee the accuracy of the presented information. Any opinions,estimates and forecasts represent the views of the authors. Inderes is
not responsible for the content or accuracy of the presented
information. Inderes and its employees are also not responsible for thefinancial outcomes of investment decisions made based on the reports
or any direct or indirect damage caused by the use of the information.
The information used in producing the reports may change quickly.
Inderes makes no commitment to announcing any potential changes tothe presented information and opinions.
The reports produced by Inderes are intended for informational use
only. The reports should not be construed as offers or advice to buy,sell or subscribe investment products. Customers should also
understand that past performance is not a guarantee of future results.
When making investment decisions, customers must base theirdecisions on their own research and their estimates of the factors that
influence the value of the investment and take into account theirobjectives and financial position and use advisors as necessary.
Customers are responsible for their investment decisions and theirfinancial outcomes.
Reports produced by Inderes may not be edited, copied or madeavailable to others in their entirety, or in part, without Inderes’ writtenconsent. No part of this report, or the report as a whole, shall betransferred or shared in any form to the United States, Canada or Japanor the citizens of the aforementioned countries. The legislation of othercountries may also lay down restrictions pertaining to the distribution of
the information contained in this report. Any individuals who may besubject to such restrictions must take said restrictions into account.
Inderes issues target prices for the shares it follows. The
recommendation methodology used by Inderes is based on the share’s
12-month expected total shareholder return (including the share priceand dividends) and takes into account Inderes’ view of the risk
associated with the expected returns. The recommendation policy
consists of four tiers: Sell, Reduce, Accumulate and Buy. As a rule,
Inderes’ investment recommendations and target prices are reviewed
at least 2–4 times per year in connection with the companies’ interim
reports, but the recommendations and target prices may also bechanged at other times depending on the market conditions. The
issued recommendations and target prices do not guarantee that theshare price will develop in line with the estimate. Inderes primarily uses
the following valuation methods in determining target prices andrecommendations: Cash flow analysis (DCF), valuation multiples, peergroup analysis and sum of parts analysis. The valuation methods andtarget price criteria used are always company-specific and they mayvary significantly depending on the company and (or) industry.
Inderes’ recommendation policy is based on the following distribution
relative to the 12-month risk-adjusted expected total shareholder return.

Buy
The 12-month risk-adjusted expected shareholder
return of the share is very attractive
Accumulate
The 12-month risk-adjusted expected shareholder
return of the share is attractive
ReduceThe 12-month risk-adjusted expected shareholder
return of the share is weakSell
The 12-month risk-adjusted expected shareholder
return of the share is very weak
The assessment of the 12-month risk-adjusted expected total
shareholder return based on the above-mentioned definitions iscompany-specific and subjective. Consequently, similar 12-month
expected total shareholder returns between different shares may resultin different recommendations, and the recommendations and 12-month
expected total shareholder returns between different shares should not
be compared with each other. The counterpart of the expected total
shareholder return is Inderes’ view of the risk taken by the investor,
which varies considerably between companies and scenarios. Thus, ahigh expected total shareholder return does not necessarily lead topositive performance when the risks are exceptionally high and,correspondingly, a low expected total shareholder return does notnecessarily lead to a negative recommendation if Inderes considers therisks to be moderate.
The analysts who produce Inderes’ research and Inderes employees
cannot have 1) shareholdings that exceed the threshold of significant
financial gain or 2) shareholdings exceeding 1% in any company subject
to Inderes’ research activities. Inderes Oyj can only own shares in thetarget companies it follows to the extent shown in the company’s model
portfolio investing real funds. All of Inderes Oyj’s shareholdings arepresented in itemised form in the model portfolio. Inderes Oyj does nothave other shareholdings in the target companies analysed. The
remuneration of the analysts who produce the analysis are not directly
or indirectly linked to the issued recommendation or views. Inderes Oyj
does not have investment bank operations.
Inderes or its partners whose customer relationships may have afinancial impact on Inderes may, in their business operations, seek
assignments with various issuers with respect to services provided byInderes or its partners. Thus, Inderes may be in a direct or indirectcontractual relationship with an issuer that is the subject of research
activities. Inderes and its partners may provide investor relations
services to issuers. The aim of such services is to improve
communication between the company and the capital markets. These
services include the organisation of investor events, advisory services
related to investor relations and the production of investor research
reports.
More information about research disclaimers can be found at
www.inderes.fi/research-disclaimer.
Inderes has made an agreement with the issuer and target of this report, which
entails compiling a research report.

Recommendation history (>12 mo)
Date

Recommendation

09-03-18

Accumulate

Target price Share price3.90 €

3.65 €

07-05-18

Accumulate

3.90 €

3.68 €

20-06-18

Accumulate

4.20 €

3.85 €

09-08-18

Accumulate

4.00 €

3.62 €

19-10-18

Reduce2.70 €

2.88 €

05-11-18

Accumulate

2.90 €

2.65 €

14-02-19

Accumulate

2.90 €

2.51 €

09-05-19

Accumulate

2.90 €

2.60 €

22-07-19

Accumulate

2.90 €

2.55 €

31-10-19

Accumulate

3.00 €

2.85 €

13-12-19

Reduce3.00 €

3.13 €

13-02-20

Reduce3.10 €

3.25 €

07-04-20

Reduce2.60 €

2.54 €

04-05-20

Reduce2.60 €

2.75 €

17-07-20

Reduce2.90 €

3.08 €

23-09-20

Reduce3.00 €

3.06 €

30-10-20

Reduce3.50 €

3.57 €

10-02-21

Reduce3.60 €

3.92 €

30-04-21

Reduce3.80 €

4.09 €

15-07-21

Reduce4.00 €

4.30 €

01-09-21

Reduce4.60 €

4.79 €

22-10-21

Reduce4.80 €

4.95 €

17-11-21

Reduce5.30 €

5.46 €

Inderes’ mission is to connect listed companies andinvestors. We produce high-quality research and content
for the needs of our extensive investor community.
At Inderes we believe that open data is every investor’s
fundamental right. We guarantee investors’ access toaward-winning research, insightful video content and an
active investor community.

Juha Kinnunen
2012, 2016, 2017, 2018, 2019, 2020

Mikael Rautanen
2014, 2016, 2017, 2019

Sauli Vilén
2012, 2016, 2018, 2019, 2020

Antti Viljakainen
2014, 2015, 2016, 2018, 2019, 2020

Petri Kajaani
2017, 2019, 2020

Joni Grönqvist
2019, 2020

Erkki Vesola
2018, 2020

Petri Gostowski
2020

Atte Riikola
2020

For listed companies we ensure that there is always highquality information available on the company for investors
and shareholders for decision making, and that datacollected from investors can be utilized by the companies.
Over 100 Finnish listed companies want to serve theirshareholders and investors through us by utilizing ourcompany research services, data driven IR services,
content creation and consulting.
Inderes Oyj
Itämerentori 2
FI-00180 Helsinki, Finland+358 10 219 4690
Award-winning research at inderes.fi

Olli Koponen
2020

Research belongs
to everyone.

www.inderes.fi