NCC Group has replaced chief executive Mike Maddison with its finance chief, Guy Ellis, effective immediately, alongside a year-end trading update showing modest growth and sharply better profitability. For UK organisations that buy testing, incident response and managed security from the Manchester firm, the bigger question is what a margin-hungry, cyber-only NCC will look like as a supplier.
What happened
On the morning of 27 October 2026, NCC Group plc told the London Stock Exchange that Guy Ellis, its chief financial officer since June 2023, had taken over as chief executive with immediate effect. Mike Maddison, who ran the company for about four and a half years, has stepped down. Group financial director Andy Beaver moves into the finance chief’s seat on an interim basis.
Chair Chris Stone framed the departure as the natural end of a completed project: Maddison’s team had turned NCC into a focused cyber business, sold the Escode software escrow arm and returned a large slice of capital to shareholders. The board says it chose Ellis after running both an internal and an external process.
The leadership news came bundled with a trading update for the year to 30 September 2026. NCC expects audited results, due on 10 December, to land in line with market forecasts for revenue and ahead of them for adjusted EBITDA. According to AskTraders, the shares were 1.3% lower at 172.2p at 8.53am, having climbed roughly 11% across the two previous sessions to a one-year high.
The detail
Stripping out the businesses it has sold, NCC expects cyber revenue of about £235m, compared with £227.4m in FY25, which is growth of 3.7% on a constant currency basis. It is guiding to a record cyber gross margin of 38.4%, an improvement of 1.8 points. Cyber adjusted EBITDA is forecast at £16.3m, which works out at roughly 6.9% of revenue.
Including the eight months of Escode trading before the May disposal, group revenue for the year comes to about £280m and group adjusted EBITDA to £36m. Escode alone contributed around £44m of revenue and £19.7m of EBITDA in that period, which shows how much of the old group’s profit sat in escrow rather than security services. A transitional services agreement with Escode’s buyer runs until 28 May 2027.
The balance sheet has been reshaped as well. NCC returned £170m through a tender offer in August, after an initial £40m buyback finished in April, and is part way through a further £15m programme, with 35% completed by year end. Net cash stood at about £53m on 30 September, and a fresh £60m borrowing facility, lasting three years, was agreed in September. Guidance for the year to September 2027 is unchanged.
Ellis set out four priorities: deeper client relationships, more managed services, scaling cyber expertise and helping clients cope with a more complex threat landscape. He also attached a number to it, saying NCC plans to reach mid-teen EBITDA margins, though no date was given. In his statement he argued that, with AI reshaping risk, “the need for trusted independent cyber expertise has never been greater.”
Why it matters for UK organisations
NCC is one of the best-known names in the UK assurance market. It has roughly 1,800 cyber staff across Europe, North America and Asia Pacific and a long history in penetration testing, incident response and consultancy for both public and private sector clients. Many UK organisations have it on a framework, in a retained incident response arrangement or in a managed detection contract.
The figure that matters most to customers is the gap between 6.9% and the mid-teens. Roughly doubling the cyber margin will not come from 3.7% top-line growth alone. Expect a mix of higher utilisation, tighter pricing, more standardised delivery and a deliberate push from one-off projects towards recurring managed services. None of that is bad in itself. Recurring services can give buyers more predictable costs and continuity of staff. But margin programmes in consultancies tend to show up in day rates, minimum engagement sizes, how much senior time goes into a scoping call and how hard account teams push bundled services.
Customers of the former Escode business should note the transitional arrangements running to May 2027. Escrow agreements protect access to source code if a software supplier fails, so any change in who operates them deserves a check that release triggers, verification testing and contacts are still correct.
Expert view
After a leadership change like this at a large testing house, the pattern is fairly predictable. The first visible changes rarely touch the technical teams. They appear in commercial terms: renewal conversations get firmer, discounts get scrutinised and you are offered a managed service where you used to buy a project.
The quality of a penetration test or an incident response engagement depends almost entirely on the individuals who turn up. When a services business chases margin, the risk is subtle: more junior-heavy teams, tighter time boxes and less room for the exploratory work that finds the issues automated scanners miss. In my experience, the buyers who get the best results are the ones who specify outcomes and named seniority in the statement of work rather than leaving it to the supplier’s resourcing desk.
There is a positive reading too. A pure-play cyber firm with net cash, a fresh credit facility and no distracting escrow division can invest in the areas buyers actually need, such as AI-related testing, cloud assurance and round-the-clock detection. Ellis has been central to the turnaround, so continuity of strategy is likely.
What to do now
- Check your exposure. List every contract, framework call-off and retainer you hold with NCC, including incident response retainers that may only be used in an emergency, and note renewal dates over the next 12 months.
- Lock in what matters before renewal. Write named roles, minimum seniority, testing methodology, accreditation requirements (CREST, CHECK where relevant) and report turnaround times into statements of work rather than relying on past practice.
- Test your incident response retainer. Confirm the hotline, escalation contacts and response commitments still work. A tabletop exercise that includes your supplier is the cheapest way to find out.
- Review supplier access. Any accounts, VPN profiles or tooling a managed service provider uses inside your estate should sit under the Cyber Essentials user access control and secure configuration controls: named accounts, MFA, least privilege and prompt removal when engagements end.
- Escrow customers: verify arrangements. If you relied on Escode, confirm your agreements, release conditions and verification schedules with the current operator before the transitional period ends in May 2027.
Bottom line
NCC has swapped a transformation chief executive for a finance-led one with an explicit target to roughly double cyber margins. The business looks financially sturdier than it has for years, but customers should expect commercial changes as that target is pursued. Use the moment to tighten contracts, check retainers and make sure the quality you pay for is written down rather than assumed.
Sources
- Investegate (RNS): NCC Group plc FY26 trading update and new CEO appointed
- AskTraders: NCC Group Names CFO Guy Ellis CEO, Guides EBITDA Ahead
- BusinessCloud: NCC Group CEO steps down
- TheBusinessDesk: Guy Ellis steps up as NCC Group chief after pivot to cyber
- ADVFN: NCC Group Appoints Guy Ellis as CEO as FY2026 Cyber Revenue Rises 3.7% to £235 Million
