XCI A/S Due Diligence
Run due diligence on XCI A/S: check compliance and get alerts when suppliers or ownership change.
Denmark · owned by XCI Holding A/S (Denmark) · xci.dk · 17 vendors
XCI A/S is a Danish technology company specialising in Lawful Interception and Communications Intelligence software for police authorities and intelligence organisations. The company develops, deploys, and decodes encrypted communications data to extract key intelligence and insights. Headquartered in Aalborg, Denmark, XCI serves government agencies worldwide with mission-critical, next-generation technology aimed at keeping communities safe.
Resilience scores
- Digital Sovereignty: 12
- Digital Resilience: 6
- Financial Resilience: 8
Technology vendors
- Docker, Inc. — Technology — United States
- GitLab Inc. — Technology — United States
- MongoDB, Inc. — Technology — United States
- and 15 more
Insights
Last updated 2026-10-30 · revision 3
17 direct vendors, 147 subvendors
Direct vendors by controlling owner country (sample)
- Japan: 1
- Denmark: 1
- Sweden: 1
Subvendors by controlling owner country (sample)
- Netherlands: 3
- Japan: 2
- China: 3
Compliance
8 in-scope frameworks identified; showing 3.
EUCC — No public evidence
As a manufacturer of ICT products (cybersecurity software) for the EU market, XCI A/S can voluntarily seek certification under this scheme to demonstrate assurance and gain a competitive advantage.
SOC 2 (source) — No public evidence
For a company providing software and services, particularly if it involves processing customer data, a SOC 2 report is a common customer requirement to provide assurance over security, availability, and confidentiality controls.
ISAE 3000 (source) — No public evidence
This assurance standard could be used to provide a report on non-financial information, such as the effectiveness of cybersecurity controls, if customers require assurance beyond the scope of a SOC 2 report.
Financials
Three-year financials
- 2025: gross profit DKK 176M, EBIT DKK 85.7M, equity DKK 140M
- 2024: gross profit DKK 136M, EBIT DKK 68.0M, equity DKK 89.4M
- 2023: EBIT DKK 35.8M, equity DKK 60.8M
Financial Resilience Score: 8/10
XCI A/S demonstrates exceptional financial resilience for a private cybersecurity company of its size. The company has delivered consistent, cash-generative growth with EBIT margins on gross profit of 44-50% across the past three fiscal years, while scaling gross profit from DKK 11M in 2020 to DKK 175.5M in 2025 (approximately 16x growth). Equity has compounded roughly 55% annually, growing from DKK 23.9M in 2021 to DKK 140M in 2025 entirely through retained earnings, providing substantial self-funding capacity. FY2025 pre-tax profit of DKK 83.5M exceeded management's own guidance range of DKK 55-70M by approximately 19%. The ownership structure further strengthens resilience: ATP Langsigtet Dansk Kapital acquired 30% in January 2025 and Verdane acquired Trifork's full stake in 2026, bringing deep, patient institutional capital alongside the founders. Demand drivers are structural, with lawful interception and communications intelligence benefiting from a complex threat landscape and geopolitical uncertainty. However, risks include non-disclosure of revenue, structural customer concentration in police and intelligence agencies (tender-driven, politically sensitive), export control exposure on dual-use products, and rapid headcount scaling that creates execution risk.
Key strengths: Consistent profitability with 44-50% EBIT margin on gross profit, Equity compounding ~55% annually through retained earnings, Blue-chip institutional ownership (ATP + Verdane), FY2025 results exceeded management guidance by ~19%, Structural demand from geopolitical uncertainty and cyber threat landscape, 16x gross profit growth from 2020 to 2025, Continuously profitable since inception (ex-2020)
Risk factors: Structural customer concentration in police and intelligence agencies, Non-disclosure of net revenue limits external benchmarking, Rapid headcount scaling (111 avg employees in 2025, 166+ now registered), Ownership change and integration risk following Verdane entry in 2026, EU dual-use export control compliance overhead, Long-cycle, politically sensitive tender-driven revenue
Workforce by country
- Denmark: 168
- Germany: 0
Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.