Welcome to SSH Communications Security's investor call for Q2 of 2026. My name is Aino Virolainen, and I will be hosting the call. The results will be presented by our CEO, Rami Raulas, and our CFO, Mikael Kommonen. After their presentation, we will have a Q&A session, and you can ask questions throughout the call by writing in the chat. The call is being recorded, and we will share the recording as well as the presentation material on our investor pages later. Now we are good to start. Mikael, the floor is yours. Thank you, Aino, and good morning also on my behalf. In the second quarter of 2026, our net sales grew by 6.8%, and our EBITDA returned positive, being EUR 0.2 million in the second quarter. Sales reached EUR 5.7 million. Driving that growth underlying was the subscription growth. Subscription ARR grew 14.3%, and overall PrivX sales grew 25% in the second quarter. The growth continues to come from PrivX on the product basis. As mentioned, EBITDA was EUR 0.2 million, down from the previous year, but an improvement sequentially from the first quarter of this year. We continued to spend in sales and marketing, and we also worked on in the R&D area on PrivX integrations to improve PrivX competitiveness in the market. Regionally, sales were strongest in EMEA, in our home market, and less strong in the Americas and the APAC region. We did close several PrivX deals, mostly in EMEA, also in the Americas during the quarter. On the balance sheet side, we announced the results from the voluntary tender offer that we announced in the first quarter of this year. The outcome of that was that we paid down most of the hybrid loan. There is currently less than EUR 0.5 million of nominal hybrid loan remaining on the balance sheet of the company. Looking a bit more into the numbers, subscription sales grew 14.4%, in line with the ARR subscription growth mentioned previously. Deferred revenues year-over-year, they improved to EUR 14 million. Sequentially, they were essentially flat compared to the first quarter of this year. EBITDA EUR 0.2 million, EBIT negative EUR 0.5 million. Cash flow from operations was EUR 1 million in the second quarter, a clear improvement here versus the previous year. With that, I'll hand over to Rami. Thank you, Mikael. In the past three years, we've done a lot in terms of sharpening up our product portfolio for growth, building the organization and hiring new talents and resources. Actually, just about a 20% more new resources in the past year and a half, and building a partner network for a go-to market and improving our awareness of our growth solutions and for marketing for increased demand. Some of those are beginning to show in the second quarter and moving forward. The PrivX, as mentioned, PrivX PAM is our growth engine. It's the biggest market opportunity for us in our portfolio as well, grew 25%. We've been growing about 20% per quarter and in the past two years on it. Now it's accelerating a little bit. If we count in the whole business area of PrivX, including the Key Manager and transition from Key Manager customers, I'll come to that in a minute, then over 30% growth. SalaX, our secure mail, secure messaging platform grew also a bit. With NQX, we are expecting that to become a growth product as well. Not yet so much in Q2, but we had a lot of qualifications and certification approvals for potential few new businesses moving forward. On the go-to-market side, of course, Leonardo is the biggest opportunity to grow and really important strategic partnership that was inked at the end of last year. We've been working now for under a year together, and I'll come back to some of the successes in second quarter. Outside of Leonardo, LDO, we also have enhanced or strengthened the partner network, especially in Asia, but also other areas and now increasingly in the U.S. market as well. One of the challenges for us has been kind of awareness of our solutions. Everybody knows SSH. Everybody in the industry uses SSH Secure Shell, but people don't necessarily know what this company does. We've been putting a lot of effort in the past year or so in getting analyst recognitions and awareness for our growth solution, PrivX. I'll share a few highlights of that. Then we've been now, a lot of our marketing investment, which is pretty big, has gone into face-to-face, speed dating, face-to-face industry, and analyst-driven events where we meet face-to-face with potential partners or customers and prospects. Now we are migrating that to a digital face and kind of inbound demand. Also developing from SEO to AEO, from search engine optimization to AI optimization. Of course, the majority of the work that potential customers do to research candidates for their solutions is done without talking to salespeople. People do it online. They use AI tools for them. We certainly have been optimizing for that. Let's have a bit closer look into the modern portfolio. In our portfolio, we have three areas. I think it's a very balanced portfolio. We have two cash cows, the Tectia business and SalaX business, and we have three growth businesses in there. SalaX messaging, secure messaging, NQX, quantum-safe network encryption, and of course, PrivX PAM on the market. If you have a quick look at those. On the NQX, we've been kind of waiting for the market to understand the transition to quantum-safe and post-quantum cryptography. There are legislation standards in the U.S., they now accelerated it. I have a strong feeling at the moment that the market is picking up moving forward. The compelling reason for customers to move to Quantum Safe hasn't been there earlier, but now I think we're seeing that people have done their analysis, their cryptography inventory, and they are preparing and executing their transition plans. For instance, we've seen that, and you may remember an announcement right at the end of Q1 on some new satellite operators choosing post-quantum cryptography with our NQX tools. We just demonstrated together with a partner kind of secure encrypted satellite link connection in the Italian defense event, Cyber Garage, just first days of July. On SalaX messaging, a very strong base. Now, of course, the key thing, some new deals also there in the Nordic markets and Central Europe. We are in the transition to migrate and move customers and to win new customers with SalaX messaging, which is all about sovereignty, right? We see more and more, especially in Europe, but also in Asia, countries and government organizations that do not want to keep secret messaging or secure messaging in foreign platforms that can be susceptible or accessible for foreign governments like Skype or Teams or Slack or WhatsApp and so on and so forth. The kind of the control, France in Europe is a leader in that. Italy is very advanced in that execution as well, and many more. Of course, PrivX, which has a lot of functionalities nowadays. It can compete with any PAM on the market, including the market leaders. It is a modern solution, so it's different from the legacy solutions on the market. I'll show you a picture in a bit about the awareness and recognition of that moving forward. Like Mikael said, from a growth point of view, the growth is coming from PrivX, a little bit from SalaX. From the regional point of view, Europe grew 9% in Q2, U.S. 10%, even with the still weakened dollar exchange rate. In APAC, we haven't been able to turn it back to growth yet, but that is certainly in our plans. If you have a quick look at PrivX and where are the growth opportunities and where's the growth indeed actually coming. There are four kind of elements in there. First of all, it's about the modern PAM for tech-savvy customers like hedge funds, modern hedge funds. Some of the latest customer wins there are neobanks and modern finance institutes and other tech companies, e-tailers who have actually built their own data centers for AI because there's not enough capacity in the cloud for AI tools. That is certainly number one driver for the market. We have a competitive advantage. There are not that many modern PAMs like PrivX on the market, and the legacy PAMs don't really work in that. They are too complicated, too cumbersome, and too expensive to run in that kind of technologically scalable, automated environment. The other market opportunity is with the secure remote access or OT market for PrivX. For sure, for defense, because in defense, like I said earlier, everything is privileged, but also with critical infrastructures, energy networks, public safety, and so on, and logistics and manufacturing. Big growth anticipated is really with the rise of identities from non-human identities, right? Whether they are agentic AIs or they are automated tools that do things in the IT environment, code repository accesses, automation in deploying new applications and services to the market. That's going to be like 100 or 1,000 times more accesses that need to be controlled. For instance, we're already having that, the legacy access authentication, which are the SSH keys, are innovation from 30 years ago. is predominantly machine-to-machine, non-human access, and we have already been having customers for a number of years who've just been using our solution for machine identity access and machine-to-machine connections. Last but not least is this trend, especially with large finance organizations, big banks and insurance companies and the likes, to quickly now move from standing credentials, having passwords or keys or certificates that lie around and need to be renewed or rotated every once in a while, to automating that so that you get rid of standing credentials, move to zero standing access or zero standing privileges, and SSH keys are part of that. We have a unique solution. Nobody else can offer it at the moment on the market, where we scan and read all the credentials, keys, and automatically, without having to change anything on the application side, which would be a burden, can automate that and migrate that to short-lived certificates. Indeed, there was one European finance institute that made that migration and placed an order for it. We have a few more on the back of it. We have dozens and dozens of Key Manager customers, big banks in the U.S., in Europe. Now we are seeing also increasing demand in APAC market for that. Four areas for growth drivers for the market, and we just need to balance that right and have the right partners working on it to have access to the right potential customers on the market. Now, I said that the challenge has been that not many people know that we have a solution like PrivX. They don't understand where it's positioned and what are the competitive advantages of that. With the new digital phase launched at the end of Q1, we are improving on that, and like I mentioned earlier, we've been working to get analysts to understand and recognize our solution. I'll just flash through a few of them. There's no time to read through them more in detail. You can find all of these published on our web pages. For the secrets management part, for instance, PrivX solution was last year recognized as a market leader right up there, even ahead of IBM HashiCorp solution. Info-Tech made a very positive summary and analysis of PrivX, citing it as a significant PAM solution and thoughtful modern zero trust positioning. Moving forward on the secure remote access or OT side, KuppingerCole, one of the leading analysts, recognized PrivX as a leader in all categories in that domain. Industrial Cyber, which really focused on that, also took our portfolio analysis so then and said that this is a really good secure access solution on the market. The most recent in the beginning of this year now is Gartner. Gartner Group's Cyber-Physical Systems summary, where they listed 14 vendors, three Europeans, rest are Israeli or Americans, and gave a positive statement on how PrivX works in that environment for the OT secure remote access as well. On the IT side and modern PAM side, the most prominent market analysis is so-called Magic Quadrant for PAM by Gartner Group. Already last year, PrivX achieved an honorable mention status in there, which means that it fulfills all the technical and functional requirements. There were 17 companies that do that, and then five more that do not fulfill, are honorable mentions but do not fulfill all the marketing requirements, like IBM HashiCorp, Microsoft, Okta, Teleport, and Xshell. Well-positioned there. Now the most recent one published actually this week on our web pages, this came out in Q2, is KuppingerCole similar analysis of privilege and access management. They call it Leadership Compass, where we are one of the market leaders. The analysts are highlighting the modernity, the scalability, the automation, and the cost efficiency, plus also quantum safety. Hasn't been talked much in this critical access to critical resources, whether they are databases, development environments like code, which is our main asset in this company, or networks or server environments that it needs to be also quantum safe, and we have built quantum safety into the product. There are not that many PAMs that talk about that yet, but it will certainly be. Apologies for a very small picture. Here's a bit bigger version of it. You can see that PrivX is one of the red balloons on the right-hand corner there. Once again, up there, and the main findings is that the market is also changing now. Customers are migrating away from legacy environments to modern hyperscaler, private cloud, public cloud, auto-scaling environments using Kubernetes architectures and platforms. The PAMs have to move as well that way. We have that designed from the scratch to fulfill those kind of modern architecture requirements. We just added legacy support in the past years to it. Indeed, we are seeing quite a few customers now that are using the market leading products up on the right-hand corner there that are looking for a more modern alternative for their use as well. Mikael already mentioned that there were a couple of deals. We didn't announce them separately, we got some European aerospace defense public safety company related. This is Leonardo, as you can understand, cases through Polo Strategico Nazionale, which is the Italian sovereign cloud environment. I mentioned in Q1 reporting that we were approved as a technical solution for the PSN environment, now initial first deals came through that one as well, as well as some other government office deals. The last European retail and investment bank, one of the largest internet exchange points, a global MSSP, managed service solution provider, an Asian IT giant and their U.K. European arm, and real estate holding company. On the OT, operational technology manufacturing side and energy, power generation and industrial energy systems manufacturer in the U.S. as well. A few words about partnering, one of the four key elements for growth. That I think can really be divided in two. The main strategic partnership, of course, is with Leonardo, who became the largest shareholder with the targeted share rights issue. As I mentioned in end of last quarter, we have integrated our solution suite into the Zero Trust offering. I'll show a picture of that in a minute. That is really active at the moment, and initial deals have started to come in in Q2 as well now finally. We need to complement that then also outside of the markets where Leonardo is not that prevalent regionally or in terms of market segments and industries. There we have strengthened our partner network moving forward. Organized also very successful partner events in Tokyo for APAC and here in Helsinki for EMEA in Q2. Another new partnership was also announced together with Nokia. The PrivX secure remote access is now part of Nokia's Industrial Edge 5G computing platform. Customers can shop it from there as well. I wanted to say a bit more about the Leonardo partnership. I think that is raising a lot of interest. The first point is that Leonardo has built now through acquisitions and strategic partnerships, what I think is a really compelling and competitive value proposition and offering for Zero Trust access management and security. Driven by identities, and we already spoke about machine identities. Driven by decision policies, policymaking. Here a company, a Swedish company, Axiomatics, and to some extent PrivX and other identity management solutions also provision policies for access. Adding more granular access controls on what a person or non-person can and cannot do on the targets. Then of course the enforcement, which is privileged access management, which is PrivX, together with integration with the policy engine, and then data-related security, which are Leonardo's own solutions available. That combined with the data in transit and network security, where NQX plays a role. Also a strategic partnership with a Danish company called Arbit, which is a really leader in data diodes and switches, and gateways. Last but certainly not least, the whole end-to-end cybersecurity, global cybersecurity center operations, which Leonardo has established multiple in Europe, in Middle East, in Asia, in the U.S. as well moving forward. To have kind of detection and response-driven security, not just identity security driven. Most of our competitors talk about identity security, but that's just a perimeter security. You have to monitor all the time what are the risks, what are the vulnerabilities, how will they affect the target environments, and how should you govern your access. If, for instance, network components are under threat, stop providing access to them before they are patched or updated. This whole concept of integrating all of these together is unique on the market, and we have a major role in that. Here are a couple of cases where that has already started to materialize. I already mentioned the sovereign cloud environment in Italy where PrivX is getting into. This is a massive investment. There's been about EUR 900 million investment in Italy for that. It's a EUR 3.6 billion investment altogether over 10 years, so about EUR 360 million per year. Multiple kinds of services for data centers for private cloud in Italy orchestrated by Telecom Italia and Leonardo. Then all the access-related controls to public clouds and private clouds, including access management, which in this case is then PrivX. We have been secondly, a frame agreement, EUR 300 million frame agreement that was signed earlier by Leonardo and the European Commission entities, over 70 entities. Now, we have already been a supplier in the European area, organizational area. This will now strengthen the opportunity to provision our solutions together with Leonardo into a wider space and a wider scope in the European environment. This is all about sovereignty, right? European origin of solutions and services and support. The last, which was just announced early days in July here is NATO PBN, Protected Business Network, where Leonardo together with Accenture won a 10-year, EUR 200 million deal for protecting NATO networks, modernizing the whole networks, cloud access and infrastructure security, adding Zero Trust architecture, utilizing the Global Cybersecurity Center on the top of the previous picture, and including solutions, including PrivX moving forward as well. Okay. After all these advancements, it is now time for a change as well. First of all, we announced just a few weeks back that the new CFO, Cristian Arias, Cristian is actually sitting back here, but you will see him in the next quarterly call, will join us in October, and Mikael will continue till end of August. First of all, I'd like to express, Mikael, my sincere thanks and gratitude for the work in the past years that you've done here very competently and professionally. That has been a really important part of us moving forward. There's another change, which was announced today, is that I've agreed with the board that I will actually retire from this position. I reached my retirement age, turned 65 earlier this year. Still going strong, it's time for a change for the CEO. The search for a new CEO has started now, and I will be still here until the new CEO has been appointed and started and will help with the transition. Nothing dramatic about that, per se. That's it for today. I think we have an opportunity now for questions and answers. If, Mikael, you want to join me here as well. All right. As usual, we will start with questions from our analysts. Jacob, please go ahead. Hi. Good morning, Rami and Mikael. Can you hear me? Yes, perfectly. Great. Thank you for the presentation and for taking my questions. I will start with the question on the subscription ARR. That continues to grow nicely, especially PrivX accelerating growth here. I have a question regarding maintenance ARR. Can you maybe remind us how we should think about this revenue line as it's weighing on overall growth? Is there any different go-to-market approach, for example, when you sell together with Leonardo or other partners that affects maintenance ARR? Yeah. I can answer on that, then maybe Rami can add if he wants. Most of our new sales, almost all of our new sales, is subscription sales, and PrivX is basically almost exclusively sold through subscription. Very few licenses here and there. The legacy business, that would be PKM and Tectia, the majority of that has been sold through licenses, then with maintenance agreements and hence maintenance revenue associated with those license agreements when they have been sold. That continues to generate ARR, those maintenance agreements. If we look at the total ARR and the subscription ARR, so clearly the subscription ARR is growing, but we have some churn in the legacy products. Most of that is in Tectia, which has some slight churn, and that is then offsetting the total ARR growth because the maintenance sales is slightly declining, which is then offsetting the growth that is coming from the subscription sales. If I may, Jacob, add to that as well. We are still closing the final bits of getting to 100% subscription sales, both on Key Manager, PKM, and Tectia as well. Those steps have been taken. I mentioned this migration from key management to automated just-in-time short-lived access by combining key management and PrivX together. That journey is already going, and the first two orders have been received on that. That will transition over time to a subscription. Also on Tectia, we've been accepting maintenance service payments and licenses for existing customers. New sales business is on subscription, Quantum Safe Subscription also on Tectia. We're still finalizing the final steps of moving to all subscription sales. Yep. Perfect. Thank you for the refreshment there. When you sell a subscription as well, for example, a PrivX subscription, there should be some components of support or maintenance into that as well, but I guess it's maybe baked into the subscription then. Yeah. Like you say, the subscription contains everything, the license, the maintenance, the support, everything. That's one revenue covering all of that. Yep. Okay. The only addition may be in cases where we deliver together with partners or directly some professional services for the initial deployment of larger environments. The rest is embedded into the subscription payment. Crystal clear. Thank you. Another question about the sales cycles and the seasonality. We're entering the vacation period here, at least in the Nordics and much of Europe as well. Do you tend to usually see a slower period of new sales in Q3, or is it more or less the same? Yeah. I don't think we Q3 differs that much from the first and second quarter in terms of seasonality. If we look at it historically, the fourth quarter has generally been the most active quarter. Clearly more active than the last quarters. Maybe some of that effect has slightly declined, but it's still the most active quarter, the fourth quarter. The third quarter, I don't think you can really see any significant difference to the first two quarters of the year. Of course, there's some vacations, like you said, but it's flowing into several quarters globally when people keep their vacations, and I wouldn't say it overall slows down significantly the sales cycle. Okay. Thank you for that. I have one question as well. You were listed as an overall leader in the KuppingerCole Compass here recently, and you have previously been named by Gartner, I think it was in Q1, and you have many of these industry acknowledgments. Out of curiosity, does these awards generate any interest or inbounds once you have received them, or is it more good to have that acknowledgment when you are in the customer dialogues? Yeah. I guess both. First of all, when we think about the top balloon on the four PrivX go-to-market opportunities, I would say that these modern tech-savvy organizations that have technical resources, I think they trust more their own technological assessment of vendor's goodness and technology. Other large organizations tend to also read, tend to also check from analyst reports on who is a player, what are the alternatives. Maybe making a long list and then working down to a short list by examining and studying the offering before they then commit to talking to a vendor and getting into a trial period or test period of proof of concept period, which we always want to get, of course, because then the win rate, probability of winning deals grows significantly once we get our hands on it. In the early stages of studying, they do play a role. That's why we decided to put a bit more effort and cost into that work as well. It's not only that that matters, for sure. Yep. Good. Just finally from me, sorry to hear that you are both leaving now, both Rami and Mikael. Thank you both very much for your contribution to the company over the years and very well-deserved retirement, Rami. I hope you will enjoy it. It would be interesting to hear from your perspective, what kind of CEO profile do you think the company needs going forward to be even more successful than you are today? It would be just interesting to hear from your perspective, Rami. First of all, it's not my decision anyhow what and who the next one will be, but I think, like I said, we put in place a lot of good things now for growth. I think it's all about driving growth and accelerating the growth. I think that's the kind of personality. I've been trying for sure, and I've been spending long days in running around the world, helping the sales teams and marketing to create demand. I think it's all about accelerating the growth, in my opinion. Yeah. Sounds very fair. That's all from me. Thanks for taking my questions. I'll get back in queue. Yep. Thanks. All right. Thank you very much. I will now check the chat. We don't seem to have any more questions, thank you very much, Rami and Mikael, and thank you for participating. Our next investor call will be in Q3 in October, thank you again, and we hope to see you in October.