cyan AG Confirms Its Annual Outlook Following a Strong First Half-year

cyan AG reported H1 2026 preliminary revenue up 11% to EUR 4.9m (from EUR 4.4m), with recurring revenue steady at 96% and a 30% increase in the end-customer base. EBITDA was EUR 0.2m, down from EUR 0.5m, as planned investments in product development and sales expansion outweighed higher revenue (with prior-year EBITDA boosted by one-time effects). The company reaffirmed FY2026 guidance of EUR 10.2m–EUR 11.5m revenue and expects positive EBITDA below 2025 due to continued market expansion.

Analysis

This is a validation point for a very small white-label security vendor, not a read-through that should move the telecom partners’ fundamentals. The only meaningful mechanism is attach-rate: if cyan is still adding end customers while keeping recurring revenue high, it supports the idea that cybersecurity can be sold as a low-churn bundle inside operator apps, but at this scale the revenue contribution to AMX, DTEGY, or ORANY is immaterial. Any market move in those names would likely be a narrative trade, not a valuation event.

The more important question is whether growth is being bought with sales intensity rather than improving product-market fit. Near term, the 9/24 full report matters more than this update because cash conversion, customer concentration, and the cost of expansion will tell us whether EBITDA can scale or is merely being managed to a positive print. If bookings or retained revenue softens in H2, the confirmed outlook becomes less interesting and the stock should give back the reaction quickly.

Contrarian view: the consensus may overgeneralize this as "cybersecurity strength" across the telco complex. In reality, white-label security is a feature, not a moat, unless it materially reduces churn or lifts ARPU; without that proof, the read-through to telecom multiples is minimal. The only real upside surprise would be a disclosed partner expansion that turns cyan into a distribution asset rather than a point solution.

Key Decisions for Investors

• No immediate trade in AMX, DTEGY, or ORANY on this release; treat it as company-specific noise unless the 9/24 filing shows quantified ARPU or churn benefits.
• Fade any 1-day pop in ORANY/DTEGY/AMX caused by a mistaken "cyber growth" read-through; use a 1-3 day mean-reversion horizon, invalidated only by partner disclosures of material monetization.
• Set an alert for cyan’s 9/24 half-year report: watch bookings, free cash flow, and customer concentration. If EBITDA stays positive only because of spending restraint, the equity story remains fragile.
• If telecom operators later disclose cybersecurity bundle attach rates above ~5% of mobile base, revisit with a more durable long telecom-security pair trade; until then, stay flat.