Can NCC Group thrive without Escode? Inside the £275m pivot to Cyber

NCC Group plc has agreed to sell its Escode software escrow and verification business to entities controlled by TDR Capital LLP for a total enterprise value of £275 million. The transaction, expected to complete no earlier than April 30, 2026, marks the final step in the company’s multi-year divestiture of non-core assets and establishes NCC Group as a streamlined, pure-play cybersecurity and resilience firm. The move releases more than £260 million in net proceeds before transaction costs, enabling a mix of shareholder returns and forward-looking capital deployment into its technology-led cyber business.

This pivot is not just about operational focus. It is a recalibration of capital allocation, margin profile, and growth strategy. For TDR Capital, the acquisition unlocks a stable, high-margin asset with global reach in escrow and compliance services. For NCC Group, the exit of its highest-margin division raises the stakes for execution within its lower-margin but fast-growing cybersecurity business.

Why the sale of Escode signals more than a portfolio simplification for NCC Group

NCC Group’s decision to divest Escode, following earlier sales of Fox-IT DetACT and Fox-IT Crypto, is consistent with its ambition to become a cybersecurity specialist delivering scalable, recurring-revenue services. The £275 million transaction equates to an FY25 Adjusted EBITDA multiple of 8.9 times, which while competitive, trails the 16.4 times multiple achieved in the Fox-IT Crypto divestiture in 2025. In total, the three divestitures have yielded a combined enterprise value of £349 million at an average multiple of 9.8 times, suggesting disciplined capital recycling.

Escode contributed £66.5 million in FY25 revenue with a gross margin of 71.4 percent and Adjusted EBITDA of £30.9 million, implying an operating margin of 37.4 percent. Its removal will materially reduce NCC Group’s overall profitability and margin mix, effectively shifting the earnings burden onto the Cyber division. The board believes this rebalancing is justified by strategic clarity, with the group now focused entirely on cyber resilience, threat mitigation, and advisory services across regulated and digital-first sectors.

Chief Executive Officer Mike Maddison positioned the deal as a culmination of the group’s transformation efforts, noting that NCC Group has now exited all non-core business lines and retooled its operations around global account management, recurring revenue service models, and consulting-led implementations. Chair Chris Stone added that the proceeds will allow for a substantial return of capital to shareholders while also enabling focused reinvestment in cyber operations.

How TDR Capital plans to scale Escode’s escrow leadership in a compliance-first era

For TDR Capital LLP, the acquisition of Escode aligns with its strategy of backing market-leading, resilient service providers in sectors with strong regulatory tailwinds. Escode operates in over 17 jurisdictions and has achieved 13 consecutive quarters of revenue growth on a constant currency basis. The business provides critical software escrow, source code verification, and availability assurance services that support business continuity planning and risk compliance for clients in finance, legal services, utilities, transportation, and government.

With global supply chains increasingly vulnerable to software vendor failures, and regulators tightening resilience mandates, Escode sits at the intersection of enterprise risk mitigation and digital infrastructure assurance. TDR Capital is expected to scale the platform by investing in automation, jurisdictional expansion, and integration with software development and deployment pipelines. Although the current business is mature, the private equity thesis likely hinges on margin enhancement, digitisation of escrow delivery, and deeper integration with high-risk, high-compliance customer segments.

While the exit multiple of 8.9 times EBITDA may look modest relative to other software transactions, it reflects both Escode’s capital efficiency and the perceived stability of its cash flows. As a private asset, Escode will no longer contribute to NCC Group’s public metrics, but its predictable income profile is likely to be highly valued within a fund structure.

Why the shift to a single-stack cybersecurity model heightens execution pressure on NCC

With Escode, Fox-IT DetACT, and Fox-IT Crypto all sold, NCC Group is now structurally dependent on its Cyber business, which while larger in revenue terms, operates at a lower margin and carries higher delivery complexity. Management has stated that the Cyber unit delivered high single-digit constant currency revenue growth in Q1 FY26, building on momentum from Q4 FY25. These gains are seen as validation of the group’s repositioning efforts, which have focused on growing recurring revenue, introducing technology-led offerings, and improving global account coverage.

However, the removal of Escode’s 71 percent gross margins will place increased pressure on the Cyber business to deliver scale-driven margin expansion. Investors will be watching closely for progress on sales velocity, retention, and the adoption of the newly launched resilience services stack. The board has confirmed that a strategic review of the Cyber unit is underway, including assessment of overhead alignment and possible structural alternatives, such as a full sale of NCC Group.

In the interim, the company has launched a share buyback programme targeting up to 10 percent of its issued capital. This buyback is separate from the anticipated return of capital following the Escode transaction, which the board intends to finalise after shareholder consultation. NCC Group will also refinance its £120 million revolving credit facility, which will be reduced to £30 million post-completion, further streamlining the capital structure.

What regulatory approvals, completion conditions, and deal risks could still delay NCC Group’s Escode divestment

The sale of Escode is structured as the divestiture of both Escode Jersey Holdco Limited and NCC Group Software Resilience (Americas) LLC to Herringbone Acquisitions Limited and Herringbone Acquisitions Inc., respectively. Completion is conditional on customary separation steps and receipt of antitrust and regulatory approvals. The long stop date is six months from signing, with an extension of up to three months permitted if specific approvals remain outstanding.

While no shareholder vote is required under the United Kingdom Listing Rules, the transaction qualifies as a Significant Transaction and has been disclosed in accordance with applicable regulatory frameworks. If the transaction fails to complete, NCC Group would forfeit £262.4 million in expected net proceeds, while still incurring approximately £10 million in transaction-related costs. The board has explicitly noted that the Escode sale represents the best available route to value realisation following an extensive review of alternatives.

Warranties, indemnities, and transitional support obligations are in place. NCC Group has also entered into a Transitional Services Agreement to continue supporting Escode’s operations for 12 months post-closing, with a six-month extension possible for IT services. The terms include finance, HR, and governance services, as well as a separate cybersecurity services master agreement. Transitional liabilities are capped, with standard carveouts for fraud and exclusions under applicable law.

What strategic options remain on the table as NCC Group prepares investor-facing updates and capital markets messaging

As NCC Group leans into its identity as a focused cyber resilience provider, investors should expect further clarity at the upcoming Capital Markets Event, where management is expected to lay out financial targets, margin aspirations, and product investment priorities for the restructured business. The review of strategic options remains live, with no guarantee of a transaction or timeline.

In the meantime, NCC is betting that a leaner, more specialised company will outperform in an environment where digital threat landscapes continue to evolve and enterprises seek comprehensive, integrated cyber solutions. Whether public markets reward that focus, or whether the group ultimately finds a new owner aligned to its vision, may be the next inflection point after the Escode exit.

What NCC Group’s Escode divestment means for capital strategy, cyber execution, and investor risk profile

• NCC Group plc has signed a definitive agreement to sell Escode to TDR Capital LLP for £275 million.

• The transaction will result in NCC becoming a focused cybersecurity and resilience firm with no non-core business units.

• Escode’s exit removes £66.5 million in revenue and £30.9 million in FY25 EBITDA from NCC’s consolidated results.

• NCC will receive £262.4 million in pre-transaction net proceeds, with a significant portion set to be returned to shareholders.

• A separate share buyback programme targeting 10 percent of issued capital has already been launched.

• The transaction includes a 12-month Transitional Services Agreement to ensure operational continuity post-sale.

• TDR Capital is expected to grow Escode’s high-margin escrow business through digital scale and regulatory expansion.

• NCC faces increased execution risk as it leans entirely on its lower-margin but fast-growing Cyber business.

• The company remains under strategic review and may explore a full sale, keeping it within the UK Takeover Code offer period.

• A Capital Markets Event is planned in the coming months to outline NCC’s forward-looking cyber strategy and capital priorities.