AIM-listed Shearwater Group has posted revenue of £42.3m for the year to 30 June 2026, with big telecoms and banking renewals pushing it to the edge of statutory profit. Its own access management software went the other way, and the reason it gives should interest every UK security buyer: Microsoft bundling.
What happened
On 27 October 2026, Shearwater Group, the UK cyber security, advisory and managed services group, published its results for the financial year ended 30 June 2026 (FY26). Revenue was £42.3m. The previous financial year ran for 15 months after a change of year end, so the company gives growth on an annualised basis: 34%. Adjusted EBITDA rose an annualised 44% to £2.6m, and adjusted profit before tax was £1.4m.
On a statutory basis, the loss before tax fell to £0.3m from £13.4m in FY25. Cash at year end stood at £5.6m, up 10%, and the group has no bank borrowings.
Broker reaction was positive. Cavendish Capital Markets, the group’s nominated adviser and broker, held its FY27 forecasts and raised its target price from 90p to 121p, against a closing price of 72p the night before the results, according to SQC Research. Cavendish pointed to record contracted future revenue of £28.5m, up 85% on the year.
Shearwater has also begun a capital reduction, which shareholders approved at a general meeting on 13 October. The process would let the board pay a dividend or buy back shares later on, though no decision on either has been made.
The detail
Services covers resold third-party security technology, engineering, advisory work and penetration testing through subsidiaries including Brookcourt and Pentest Limited. It now makes up 96% of revenue. Services revenue reached £40.6m, an annualised increase of 37%, driven mainly by three large deals:
- A renewal and expansion worth about £25m with a major UK-based global telecoms provider, covering packet monitoring, forensic analysis and service assurance. Around £12.5m of it was recognised in FY26.
- A three-year renewal worth about £9m with a global financial organisation for email gateway and insider threat tooling, with £2.7m booked in the year.
- A £7.3m extension with a UK mobile network operator for data protection, visibility and managed support, with £3.5m recognised in FY26.
Those deals came at a price. Because they contained a lot of third-party software, the gross margin in Services slipped to 18.7%.
Software is where things went wrong. The division sells proprietary multi-factor authentication and access management tools, deployed in more than 400 organisations, plus a data discovery product. Revenue fell 17% on an annualised basis to £1.7m, and the division’s adjusted EBITDA dropped to £0.2m. Shearwater says outright that its MFA product has lost ground to Microsoft Authenticator, which is sometimes included at no extra charge in wider Microsoft software packages. In June the board restructured software sales and cut £0.8m of annual spending, and it is relaunching the upgraded data discovery tool.
In the public sector, Brookcourt’s approved technologies on the G-Cloud 15 framework rose from 31 to 55, and Pentest Limited won its own listing for services including red teaming. Since the year end it has added a £1.2m email protection client among Japan’s largest financial groups, plus a £1.7m two-year threat intelligence renewal and expansion with a central government department. Management says FY27 trading so far is in line with expectations.
Why it matters for UK organisations
Shearwater is small, but its results show three pressures familiar across the UK market.
First, platform bundling is squeezing standalone security products. When a buyer already pays for a Microsoft 365 tier that includes an authenticator, a separate MFA product has to earn its place on features, integration or price. For buyers, a cheaper estate is good news, but it also concentrates risk: identity, email and endpoint controls increasingly sit with a single supplier.
Second, the money in UK security services is flowing towards large, multi-year managed and integration deals in telecoms and financial services. Both sectors face heavy regulatory scrutiny, from Ofcom’s telecoms security requirements to the operational resilience rules from the FCA and PRA. That demand is unlikely to ease as the Cyber Security and Resilience Bill brings more managed service providers into scope.
Third, the public sector is opening up through frameworks such as G-Cloud. More approved listings give departments and councils more choice, but also more suppliers to check before they sign anything.
Expert view
I have spent a long time on both sides of the reseller relationship, and the margin figure is what caught my eye. A services business running below 20% gross margin is mostly passing third-party software through its books. Buyers should be clear that they are mainly paying for integration and support around someone else’s product. When we test environments built this way, the weak points are rarely the products themselves. They are usually in configuration, ownership and the handover between reseller, vendor and the client’s own team.
The Microsoft Authenticator point deserves careful reading. Moving to an authenticator you already pay for is usually sensible, but consolidation is not a security control in its own right. Plenty of organisations replace a dedicated MFA tool and quietly lose conditional access rules, legacy protocol blocks or break-glass procedures along the way. In my experience, those gaps tend to come to light in a pentest or an incident rather than in a project review.
On the money side, Shearwater looks steadier than it did a year ago: net cash, a large contracted order book and losses nearly gone. Even so, it relies heavily on a handful of very large customers, and the loss of one telecoms renewal would change the picture quickly. CEO Phil Higgins describes the group as having entered FY27 “from a position of strength”, and the contracted revenue supports that, for now.
What to do now
- Review supplier concentration. List which security controls depend on one platform vendor and one reseller. Make sure contracts cover support, escalation and exit if either relationship fails.
- Test consolidation projects. If you are replacing a standalone MFA or access management tool with a bundled one, check that MFA covers every user and service, and that legacy authentication is blocked. This links directly to the Cyber Essentials user access control requirements.
- Check resellers properly. For large integration deals, ask who owns configuration, patching and monitoring after go-live, and request evidence of certifications such as CREST or CHECK for any testing work.
- Use frameworks with care. A G-Cloud listing gets a supplier through procurement, not through assurance. Public sector buyers should still review scope, staff clearance and incident handling for each engagement.
- Look at financial resilience. For smaller listed suppliers, published accounts, cash position and customer concentration are worth reviewing at every renewal, in the same way you would review their security posture.
Bottom line
Shearwater’s FY26 shows a UK security group whose revenue now comes almost entirely from large telecoms and banking services deals, while its in-house software struggles against Microsoft’s bundled tools. For buyers, the lessons are practical: watch where consolidation leaves you exposed, read reseller margins for what they reveal about who does the work, and check supplier resilience as carefully as their security.
