NCC Group plc Due Diligence
Run due diligence on NCC Group plc: check compliance and get alerts when suppliers or ownership change.
United Kingdom · owned by Independent (publicly listed) (United Kingdom) · www.nccgroup.com · 37 vendors
NCC Group is a global cybersecurity company headquartered in Manchester, United Kingdom, providing a wide range of services including security assessments, penetration testing, managed detection and response, and software escrow. The company serves clients across multiple industries and geographies, helping organizations assess, develop, and manage cyber threats. It is listed on the London Stock Exchange (LSE: NCC).
Resilience scores
- Digital Sovereignty: 3
- Digital Resilience: 4
- Financial Resilience: 6
Technology vendors
- Apple Inc. — Technology — United States
- CrowdStrike Holdings, Inc. — Technology — United States
- Docker, Inc. — Technology — United States
- and 39 more
Services catalogue
4 services in catalogue across 2 categories; runs on 37 sub-vendors.
- IP Address Allocation
- AS Number Assignment
- Local Internet Registry services
Insights
Last updated 2026-09-26 · revision 8
37 direct vendors, 309 subvendors
Direct vendors by controlling owner country (sample)
- Germany: 1
- Denmark: 2
- UK: 1
Subvendors by controlling owner country (sample)
- Israel: 3
- Switzerland: 2
- Canada: 10
Compliance
4 in-scope frameworks identified; showing 3.
ISO 27001 (source) — No public evidence
Evidence: https://www.nccgroup.com/, https://www.nccgroup.com/solutions/compliance-and-regulations/, https://www.nccgroup.com/consulting-implementation/strategy-risk-compliance/compliance-privacy/standards-frameworks/
SOC 2 (source) — No public evidence
Evidence: https://www.nccgroup.com/managed-services/, https://www.nccgroup.com/solutions/compliance-and-regulations/, https://www.nccgroup.com/
NIS2 (source) — No public evidence
Evidence: https://www.nccgroup.com/campaign/nis2-prepare-your-organisation-for-compliance/, https://www.nccgroup.com/solutions/compliance-and-regulations/, https://www.nccgroup.com/our-office-locations/
Financials
Three-year financials
- 2024: revenue £311M, EBIT £18.5M, equity £300M
- 2023: revenue £334M, EBIT £26M, equity £215M
- 2022: revenue £322M, EBIT £44M, equity £230M
Financial Resilience Score: 6/10
NCC Group's financial resilience has materially improved following the 2024 divestment of its Software Resilience (Escrow) business to Iron Mountain for approximately £220m in cash. This transaction transformed the balance sheet, moving the group from a modest net debt position in FY23 to a materially strengthened net cash position, with proceeds used for a ~£30m share buyback and debt reduction. Historically, the company maintained an RCF with NatWest and HSBC providing adequate working capital headroom, and a progressive dividend policy (~4.65p annual). However, resilience is tempered by significant operational challenges. Adjusted operating margins have compressed from ~14% in FY22 to high single digits in FY23-FY24, reflecting weakening demand and elongated sales cycles, particularly in North America. The company now depends almost entirely on the cyclical Cyber Security division following the Escrow disposal, reducing earnings diversification. Significant goodwill from prior acquisitions (Iximus, Fox-IT, IPM) presents impairment risk, and statutory results have been impacted by impairments and restructuring charges. A cost-reduction programme targeting £17-20m in annualised savings was implemented in early 2023, including ~125 redundancies, indicating reactive management of cyclical pressures.
Key strengths: Escrow disposal proceeds of ~£220m materially strengthened balance sheet, Net cash position post-disposal (vs. modest net debt in FY23), RCF facility with NatWest and HSBC syndicate provides liquidity headroom, Progressive dividend policy maintained (~4.65p annual), £30m share buyback announced from disposal proceeds, Diversified customer base with no material single-customer concentration
Risk factors: Earnings volatility in cyber consulting due to project-based revenue, Goodwill impairment risk on prior acquisitions (Fox-IT, Iximus, IPM), Material USD FX exposure, Talent costs in competitive cyber labour market, Execution risk on post-disposal strategy, Reduced earnings diversification post-Escrow sale, Margin compression from ~14% (FY22) to high single digits (FY23-FY24), Tightened dividend cover amid weak trading
Revenue by geography
- UK & Europe: 57%
- North America: 38%
- Asia-Pacific: 5%
Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.