StarHub: Deep dive into cybersecurity
- Market has ignored its cybersecurity business, which could be worth S$0.35 per share and is a potential candidate for public listing, in our view
- Ensign has achieved operating profit breakeven in FY23F; we project 20% revenue CAGR at Ensign over FY23-25F
- BUY with a higher TP of S$1.54. The stock is cheap at 13x FY24F PER vs 5-year average of 18x; offers 8% earnings CAGR over FY23-25F and a 6.2% yield; potential catalyst could be news flow on Ensign’s listing
STH’s Ensign has strong growth potential, and could go public before October 2025, in our view. In Sep 2018, STH, in a joint venture (JV) with Temasek, launched Ensign, a managed security service provider supporting government agencies and enterprises across the Asia Pacific (APAC) region. The business has grown by over 30% till FY23. STH divested D’Crypt for S$67.5m in Dec 2023, to focus on Ensign, as D’Crypt was primarily focused on hardware development for the defense industry. A key pillar of STH’s DARE+ programme has been to offer converged solutions in the areas of cloud, cybersecurity, and connectivity (3C). Ensign remains pivotal for STH and its DARE+ programme, and its platform-based offering is scalable across the region. STH retained the assigned rights on Ensign for an additional two years, with the automatic termination date being fixed for 4 Oct 2025.
Ensign InfoSecurity is the largest end-to-end pure-play cybersecurity service company in APAC. It consults on cyber posture, strategy and risk management, designs and builds advanced security operations centres (SOCs), and implements best-of-breed solutions. Ensign also operates end-to-end cybersecurity management, which includes advanced threat detection, continuous monitoring, triage, and response. The company also provides cyber response and recovery services in the event of a cyber breach. Over the last five years, Ensign has grown to 870 employees, with the number of offices growing from three to five, to include Singapore, Malaysia, Hong Kong, South Korea, Indonesia, and Australia. With sustained R&D investment of 6%-9% of group revenue, the company has developed unique cybersecurity solutions. In 2022, the company derived 24% of its revenue from markets outside of Singapore, and 43% of its revenue from the commercial sector across all markets Ensign operates in (government sector accounts for the remaining 57%).
Future plans include incorporating proprietary elements into complex solutions, boosting managed services’ revenue share, exploring new sales channels for underserved segments, and continuing R&D investment. The company aims to strengthen Ensign’s proprietary tech stack through outcome-focused innovation in the areas of high-impact threat detection & hunting, regional and global cyber threat intelligence, rapid incident response and remediation, threat and vulnerability exposure monitoring, and unified visibility of an organisation’s digital terrain. The company also aims to expand into new markets by growing its international footprint and pursuing inorganic growth options where business conditions permit.
Global cybersecurity market, at US$188bn, is expected to grow at a CAGR of 13% over 2023-2025. The cybersecurity market is made up of three key pillars: network security, endpoint security, and endpoint and network security integrations. The global cybersecurity market was valued at US$188bn in 2023 and is expected to grow at a CAGR of 13% over 2023-2025. This is to be driven by the adoption of cloud technologies, the rise of hybrid work environments, the use of generative AI (GenAI), and evolving regulatory requirements that are pushing organisations to enhance their security and risk management spending.
Cloud security to record 25% y-o-y growth in FY24F. While total global cybersecurity spending is to grow ~14% in each year of 2023 and 2024, cloud security & data privacy are expected to show the highest growth rate among all the segments, at ~25% y-o-y, each in 2023 and 2024, driven by privacy regulations and the expansion of public cloud services. In 2024, cloud security spending is expected to reach US$7bn, increasing by 25% y-o-y. STH, which provides cloud security threat prevention solutions, is set to benefit from this market growth. The managed security services market leads with a 19.2% share in global cybersecurity spending in 2023, where STH is also a Managed Security Services Provider (MSSP).
Increasing number of threats leading to increased demand for cybersecurity solutions. Cyberattacks accelerated in 2023 and the threat environment is expected to further intensify in 2024, with attacks growing in volume and sophistication. According to CrowdStrike, identity-based security threat resents the highest risk with over 80% of attacks, using email phishing and social engineering. Other top threats for 2024 include ransomware, supply chain attacks, cloud security risks, phishing/social engineering, and OT/IoT vulnerabilities.
It is estimated that the growth of GenAI would lead to additional security spending, as GenAI presents risks such as insecure code, exposure of sensitive data, and cybercriminals leveraging GenAI to increase their proficiency. Gartner predicts a more than 15% increase in spending on application and data security by 2025 due to the rise of GenAI. Spending will be more on data security tools, including those that help with sensitive data discovery, classification, and governance.
Regulations around data privacy leading to higher cybersecurity spending. In addition to the above drivers, new regulations such as the ENISA (the European Union Agency for Cybersecurity) and European Cyber Resilience Act (CRA) have also pushed for further spending. ENISA provides support to EU member states, businesses, and institutions in the cybersecurity sector and delivers solutions and improvements to the EU’s cybersecurity framework. Similarly, CRA acts as a legal framework describing the cybersecurity requirements for hardware and software products with digital elements placed on the market of the EU.
STH’s cybersecurity business could fetch a valuation of S$0.23-0.35 per share based on our estimated FY24F revenue. Ensign recorded S$303.9m (+21% y-o-y) in revenue and reached operating profit of S$2.0m in FY23 (cybersecurity operating profit was S$1.5m and D’Crypt recorded loss of S$0.5m). Ensign has grown by an estimated 30% over the last five years but was making losses as it continued to invest for growth. Ensign secures 51% of its revenue from services and 49% from products.
STH has retained the assigned rights of Ensign for an additional two years, with the automatic termination date being fixed for 4 Oct 2025. Achieving breakeven excluding D’Crypt should be a stepping-stone towards the public listing of Ensign, in our view. Based on the peer average of 4x-6x for cybersecurity companies, which are largely product focused, we apply a conservative 2x-3x price to FY24F revenue (excluding D’Crypt) for Ensign’s relatively smaller size and a lower product business contribution. We estimate Ensign alone to be worth S$729m-1,094m. Given STH’s 55.73% effective stake in Ensign, the stake is worth S$0.23-0.35 per share. This represents 20%-30% of STH’s market cap of S$2,060m.
Ensign is expected to grow at a CAGR of 20% over 2023-2025. We expect Ensign to grow at 20% CAGR over 2023-2025, slightly above the Asia Pacific (APAC) cybersecurity spending CAGR of 19% (vs. global CAGR of 13%). Ensign will pursue higher value and more complex projects across the region while improving its revenue mix.
Share buyback to provide downside protection. To enhance total shareholder return, STH established a S$50m share buyback programme in June 2023 to repurchase up to 3% (51.9m) of its issued share capital (1,730m). By the end of FY23, STH repurchased 16.7m shares, at a total cost of S$17.6m (S$1.05 per share), representing ~1% of its issued share capital. Share buybacks can be seen as a signal of confidence in a company’s future prospects, which can positively impact investor sentiment.
Our FY24F/25F earnings are 2% higher than consensus, on slightly higher service EBITDA expectations. We have factored in 1.6%/4.8% service revenue growth in FY24F/25F, in line with management’s expectation of 1%-3% y-o-y growth in FY24F. The management’s guidance for service revenue growth would have been 3%-5% if not for the D’Crypt divestment, which generated revenue of S$46.2m (-8% y-o-y), accounting for 2% of overall FY23 revenue. We have guided for service EBITDA margin of 21.8%/22.0% in FY24F/25F, in line with management’s expectations of 22%. Our dividend per share (DPS) for FY24F is at 7.3 Scts, (vs. consensus’ 7.1 Scts), translating to an 80% payout ratio, compared to management’s guidance of 6.0 Scts or 80% payout ratio (whichever is higher). Furthermore, capex commitment guidance for FY24F is 11%-13% of total revenue including transformation investments. STH has incurred 70% of the S$270m (60% capex: 40% opex) of transformation costs as of FY23, translating to S$83m in FY23. STH expects to incur transformation costs of S$54m in FY24F and S$27m in FY25F. We have also factored in the initial consideration of S$67.5m following the completion of the D’Crypt sale in 1Q24F (29 Feb 2024).
Maintain BUY with a higher TP of S$1.44, on 3%/4% upward revision in FY24F/25F earnings. We use the DCF methodology with a WACC of 8.2% (prev: 8.5%) on lower beta and terminal growth rate of 0% to arrive at S$1.25 for STH excluding Ensign. We value Ensign at S$0.23-0.35 per share, at 2x-3x 192-month forward revenue, with the mid-point being S$0.2 per share. Our sum-of-the-parts-based valuation is S$1.4. We expect StarHub to re-rate from a 13x FY24F price-to-earnings ratio (PER) to 17x, still lower than its last five-year historical average of 18x. At our TP of S$1.44, StarHub would be trading at a 5.3% FY25F dividend yield.
Access the full report and more at DBS Insights Direct
FY Dec | 2H2022 | 1H2023 | 2H2023 | % chg yoy | % chg hoh |
|
|
|
|
|
|
Revenue | 1,269 | 1,106 | 1,267 | (0.1) | 14.5 |
Cost of Goods Sold | (1,214) | (878) | (1,149) | (5.4) | 30.8 |
Gross Profit | 55 | 228 | 118 | 116.8 | (48.1) |
Other Oper. (Exp)/Inc | (124) | (121) | (117) | (5.2) | (3.1) |
Operating Profit | 59 | 107 | 119 | 102.1 | 11.5 |
Other Non Opg (Exp)/Inc | (29) | 0 | (9) | 67.8 | nm |
Associates & JV Inc | 1 | 2 | 1 | 0.0 | (70.6) |
Net Interest (Exp)/Inc | (16) | (13) | (11) | 31.1 | 11.1 |
Exceptional Gain/(Loss) | 2 | 0 | 1 | (35.0) | nm |
Pre-tax Profit | 16 | 96 | 101 | 525.0 | 4.6 |
Tax | (8) | (21) | (30) | 283.3 | 43.1 |
Minority Interest | (7) | 2 | 2 | nm | 60.0 |
Net Profit | 1 | 77 | 73 | 5,603.1 | (4.8) |
Net profit bef Except. | (1) | 77 | 72 | nm | (6.5) |
EBITDA | 159 | 232 | 229 | 44.3 | (1.2) |
Margins (%) |
|
|
|
|
|
Gross Margins | 4.3 | 20.6 | 9.3 |
|
|
Opg Profit Margins | 4.7 | 9.7 | 9.4 |
|
|
Net Profit Margins | 0.1 | 6.9 | 5.8 |
|
|
GENERAL DISCLOSURE/DISCLAIMER
This report is prepared by DBS Bank Ltd. This report is solely intended for the clients of DBS Bank Ltd, DBS Vickers Securities (Singapore) Pte Ltd, its respective connected and associated corporations and affiliates only and no part of this document may be (i) copied, photocopied or duplicated in any form or by any means or (ii) redistributed without the prior written consent of DBS Bank Ltd.
The research set out in this report is based on information obtained from sources believed to be reliable, but we (which collectively refers to DBS Bank Ltd, DBS Vickers Securities (Singapore) Pte Ltd, its respective connected and associated corporations, affiliates and their respective directors, officers, employees and agents (collectively, the “DBS Group”) have not conducted due diligence on any of the companies, verified any information or sources or taken into account any other factors which we may consider to be relevant or appropriate in preparing the research. Accordingly, we do not make any representation or warranty as to the accuracy, completeness or correctness of the research set out in this report. Opinions expressed are subject to change without notice. This research is prepared for general circulation. Any recommendation contained in this document does not have regard to the specific investment objectives, financial situation and the particular needs of any specific addressee. This document is for the information of addressees only and is not to be taken in substitution for the exercise of judgement by addressees, who should obtain separate independent legal or financial advice. The DBS Group accepts no liability whatsoever for any direct, indirect and/or consequential loss (including any claims for loss of profit) arising from any use of and/or reliance upon this document and/or further communication given in relation to this document. This document is not to be construed as an offer or a solicitation of an offer to buy or sell any securities. The DBS Group, along with its affiliates and/or persons associated with any of them may from time to time have interests in the securities mentioned in this document. The DBS Group, may have positions in, and may effect transactions in securities mentioned herein and may also perform or seek to perform broking, investment banking and other banking services for these companies.
Any valuations, opinions, estimates, forecasts, ratings or risk assessments herein constitutes a judgment as of the date of this report, and there can be no assurance that future results or events will be consistent with any such valuations, opinions, estimates, forecasts, ratings or risk assessments. The information in this document is subject to change without notice, its accuracy is not guaranteed, it may be incomplete or condensed, it may not contain all material information concerning the company (or companies) referred to in this report and the DBS Group is under no obligation to update the information in this report.
This publication has not been reviewed or authorized by any regulatory authority in Singapore, Hong Kong or elsewhere.
There is no planned schedule or frequency for updating research publication relating to any issuer.
The valuations, opinions, estimates, forecasts, ratings or risk assessments described in this report were based upon a number of estimates and assumptions and are inherently subject to significant uncertainties and contingencies. It can be expected that one or more of the estimates on which the valuations, opinions, estimates, forecasts, ratings or risk assessments were based will not materialize or will vary significantly from actual results. Therefore, the inclusion of the valuations, opinions, estimates, forecasts, ratings or risk assessments described herein IS NOT TO BE RELIED UPON as a representation and/or warranty by the DBS Group (and/or any persons associated with the aforesaid entities), that:
(a) such valuations, opinions, estimates, forecasts, ratings or risk assessments or their underlying assumptions will be achieved, and
(b) there is any assurance that future results or events will be consistent with any such valuations, opinions, estimates, forecasts, ratings or risk assessments stated therein.
Please contact the primary analyst for valuation methodologies and assumptions associated with the covered companies or price targets.
Any assumptions made in this report that refers to commodities, are for the purposes of making forecasts for the company (or companies) mentioned herein. They are not to be construed as recommendations to trade in the physical commodity or in the futures contract relating to the commodity referred to in this report.
DBSVUSA, a US-registered broker-dealer, does not have its own investment banking or research department, has not participated in any public offering of securities as a manager or co-manager or in any other investment banking transaction in the past twelve months and does not engage in market-making.
General | This report is not directed to, or intended for distribution to or use by, any person or entity who is a citizen or resident of or located in any locality, state, country or other jurisdiction where such distribution, publication, availability or use would be contrary to law or regulation. |
Australia | This report is being distributed in Australia by DBS Bank Ltd, DBS Vickers Securities (Singapore) Pte Ltd (“DBSVS”) or DBSV HK. DBS Bank Ltd holds Australian Financial Services Licence no. 475946. DBS Bank Ltd, DBSVS and DBSV HK are exempted from the requirement to hold an Australian Financial Services Licence under the Corporation Act 2001 (“CA”) in respect of financial services provided to the recipients. Both DBS and DBSVS are regulated by the Monetary Authority of Singapore under the laws of Singapore, and DBSV HK is regulated by the Hong Kong Securities and Futures Commission under the laws of Hong Kong, which differ from Australian laws. Distribution of this report is intended only for “wholesale investors” within the meaning of the CA. |
Hong Kong | This report has been prepared by a personnel of DBS Bank, who is not licensed by the Hong Kong Securities and Futures Commission to carry on the regulated activity of advising on securities in Hong Kong pursuant to the Securities and Futures Ordinance (Chapter 571 of the Laws of Hong Kong). This report is being distributed in Hong Kong and is attributable to DBS Bank (Hong Kong) Limited (''DBS HK''), a registered institution registered with the Hong Kong Securities and Futures Commission to carry on the regulated activity of advising on securities pursuant to the Securities and Futures Ordinance (Chapter 571 of the Laws of Hong Kong). DBS Bank Ltd., Hong Kong Branch is a limited liability company incorporated in Singapore. For any query regarding the materials herein, please contact Dennis Lam (Reg No. AH8290) at [email protected] |
Indonesia | This report is being distributed in Indonesia by PT DBS Vickers Sekuritas Indonesia. |
Malaysia | This report is distributed in Malaysia by AllianceDBS Research Sdn Bhd ("ADBSR"). Recipients of this report, received from ADBSR are to contact the undersigned at 603-2604 3333 in respect of any matters arising from or in connection with this report. In addition to the General Disclosure/Disclaimer found at the preceding page, recipients of this report are advised that ADBSR (the preparer of this report), its holding company Alliance Investment Bank Berhad, their respective connected and associated corporations, affiliates, their directors, officers, employees, agents and parties related or associated with any of them may have positions in, and may effect transactions in the securities mentioned herein and may also perform or seek to perform broking, investment banking/corporate advisory and other services for the subject companies. They may also have received compensation and/or seek to obtain compensation for broking, investment banking/corporate advisory and other services from the subject companies. |
Singapore | This report is distributed in Singapore by DBS Bank Ltd (Company Regn. No. 196800306E) or DBSVS (Company Regn No. 198600294G), both of which are Exempt Financial Advisers as defined in the Financial Advisers Act and regulated by the Monetary Authority of Singapore. DBS Bank Ltd and/or DBSVS, may distribute reports produced by its respective foreign entities, affiliates or other foreign research houses pursuant to an arrangement under Regulation 32C of the Financial Advisers Regulations. Where the report is distributed in Singapore to a person who is not an Accredited Investor, Expert Investor or an Institutional Investor, DBS Bank Ltd accepts legal responsibility for the contents of the report to such persons only to the extent required by law. Singapore recipients should contact DBS Bank Ltd at 6878 8888 for matters arising from, or in connection with the report. |
Thailand | This report is being distributed in Thailand by DBS Vickers Securities (Thailand) Co Ltd. For any query regarding the materials herein, please contact Chanpen Sirithanarattanakul at [email protected] |
United Kingdom | This report is produced by DBS Bank Ltd which is regulated by the Monetary Authority of Singapore. This report is disseminated in the United Kingdom by DBS Bank Ltd, London Branch (“DBS UK”). DBS Bank Ltd is regulated by the Monetary Authority of Singapore. DBS UK is authorised by the Prudential Regulation Authority and is subject to regulation by the Financial Conduct Authority and limited regulation by the Prudential Regulation Authority. Details about the extent of our regulation by the Prudential Regulation Authority are available from us on request. In respect of the United Kingdom, this report is solely intended for the clients of DBS UK, its respective connected and associated corporations and affiliates only and no part of this document may be (i) copied, photocopied or duplicated in any form or by any means or (ii) redistributed without the prior written consent of DBS UK. This communication is directed at persons having professional experience in matters relating to investments. Any investment activity following from this communication will only be engaged in with such persons. Persons who do not have professional experience in matters relating to investments should not rely on this communication. |
Dubai International Financial Centre | This communication is provided to you as a Professional Client or Market Counterparty as defined in the DFSA Rulebook Conduct of Business Module (the "COB Module"), and should not be relied upon or acted on by any person which does not meet the criteria to be classified as a Professional Client or Market Counterparty under the DFSA rules. This communication is from the branch of DBS Bank Ltd operating in the Dubai International Financial Centre (the "DIFC") under the trading name "DBS Bank Ltd. (DIFC Branch)" ("DBS DIFC"), registered with the DIFC Registrar of Companies under number 156 and having its registered office at units 608 - 610, 6th Floor, Gate Precinct Building 5, PO Box 506538, DIFC, Dubai, United Arab Emirates. DBS DIFC is regulated by the Dubai Financial Services Authority (the "DFSA") with a DFSA reference number F000164. For more information on DBS DIFC and its affiliates, please see http://www.dbs.com/ae/our--network/default.page. Where this communication contains a research report, this research report is prepared by the entity referred to therein, which may be DBS Bank Ltd or a third party, and is provided to you by DBS DIFC. The research report has not been reviewed or authorised by the DFSA. Such research report is distributed on the express understanding that, whilst the information contained within is believed to be reliable, the information has not been independently verified by DBS DIFC. Unless otherwise indicated, this communication does not constitute an "Offer of Securities to the Public" as defined under Article 12 of the Markets Law (DIFC Law No.1 of 2012) or an "Offer of a Unit of a Fund" as defined under Article 19(2) of the Collective Investment Law (DIFC Law No.2 of 2010). The DFSA has no responsibility for reviewing or verifying this communication or any associated documents in connection with this investment and it is not subject to any form of regulation or approval by the DFSA. Accordingly, the DFSA has not approved this communication or any other associated documents in connection with this investment nor taken any steps to verify the information set out in this communication or any associated documents, and has no responsibility for them. The DFSA has not assessed the suitability of any investments to which the communication relates and, in respect of any Islamic investments (or other investments identified to be Shari'a compliant), neither we nor the DFSA has determined whether they are Shari'a compliant in any way. Any investments which this communication relates to may be illiquid and/or subject to restrictions on their resale. Prospective purchasers should conduct their own due diligence on any investments. If you do not understand the contents of this document you should consult an authorised financial adviser. |
United States | This report was prepared by DBS Bank Ltd. DBSVUSA did not participate in its preparation. The research analyst(s) named on this report are not registered as research analysts with FINRA and are not associated persons of DBSVUSA. The research analyst(s) are not subject to FINRA Rule 2241 restrictions on analyst compensation, communications with a subject company, public appearances and trading securities held by a research analyst. This report is being distributed in the United States by DBSVUSA, which accepts responsibility for its contents. This report may only be distributed to Major U.S. Institutional Investors (as defined in SEC Rule 15a-6) and to such other institutional investors and qualified persons as DBSVUSA may authorize. Any U.S. person receiving this report who wishes to effect transactions in any securities referred to herein should contact DBSVUSA directly and not its affiliate. |
Other jurisdictions | In any other jurisdictions, except if otherwise restricted by laws or regulations, this report is intended only for qualified, professional, institutional or sophisticated investors as defined in the laws and regulations of such jurisdictions. |
HONG KONG | SINGAPORE |
INDONESIA PT DBS Vickers Sekuritas (Indonesia) Contact: William Simadiputra DBS Bank Tower Ciputra World 1, 32/F Jl. Prof. Dr. Satrio Kav. 3-5 Jakarta 12940, Indonesia Tel: 62 21 3003 4900 Fax: 6221 3003 4943 e-mail: [email protected] | THAILAND |