CHALEIT - A CYBERSECURITY CHALLENGER ARRIVES - 07/10/26

The cybersecurity space is an area that features quite prominently for me on the investment front, where I am currently holding two AIM quoted companies.

These are Shearwater (SWG) and SysGroup (SYS), with the latter being the much larger of my two positions.

As we stand, I am showing a decent return on both and the space in which they operate is providing ongoing growth opportunities, largely driven by increased cyber threats and tightened regulations.

Whilst I never like to be too exposed to any specific sector, I feel that a debutant to AIM is worthy of an initial look and potentially an interest.

The subject being headquartered on my doorstep in Cambridge is an added interest for me, along with the presence of the highly experienced and shrewd Ken Ford, who sits as Chairman of this company.

I know Ken very well from my interest and extensive coverage of SDI over the years, where he was the architect of a highly successful buy-build operation. He also sat as Chairman for a lengthy period at Gear4music, whilst in earlier years was instrumental at broker Teather & Greenwood.

As for the newcomer, this is Chaleit (CHA), which is headed by founder and serial entrepreneur Dan Haagman, whose track record in building and scaling cybersecurity businesses is certainly worthy of close attention.

More on that to follow, but firstly, I’ll take a close look into the business, which is already profitable and cash generative.

Although CHA is just five years old with a limited track record, management has already demonstrated that its model and focus on organic growth works, which is the kind of starting point that provides for a good base.

Haagman and CFO Jody Hyde have successfully positioned the business around a combination of specialist technical expertise, where a number of services are provided to clients that include blue-chip businesses.

In an ever-evolving cyber threat landscape, CHA helps its end clients to identify and fix technical risks that may leave them exposed to malicious hackers and all that brings with it.

Across its operation, CHA provides hands-on, high-level services that include penetration testing, adversary simulations, cloud security and compliance management.

To provide a flavour of what this entails, it is perhaps worth imagining either a bank or large corporation that has invested millions in its own IT infrastructure, but is nevertheless concerned that it may be exposed.

Enter CHA, which is hired to actually try to stress test the infrastructure and penetrate its systems, just as a hacker or other malicious player may do.

With specialist operatives, CHA will undertake a protocol followed by an in-depth report highlighting what has been found and, importantly, what can be done to fix any issues that leave a business exposed.

Whilst the end client will pay for this service, the relationship can become an ongoing one, with clients returning regularly for further testing.

This can therefore lead to longer-term arrangements that provide CHA with an increasingly recurring and visible revenue stream.

Catching up with the management team in order to learn more, it is very clear that there is a firm belief in the prospects of delivering on its goal of driving organic growth and increasing profitability.

With Haagman at the helm, the story, to a degree, rests on his past exceptional track record of building and scaling valuable cybersecurity businesses, which were later acquired, providing highly successful exits.

Alongside him, the CFO Jody Hyde was also a pivotal part of both the previous businesses, so there is a continuity theme in evidence here.

Speaking on CHA and its origins, Dan said that before the company actually came into being, significant groundwork was undertaken.

That saw the team involved in putting the necessary corporate architecture and legal framework in place from the outset, paving the way for a future IPO.

“What we wanted to build,” said Dan, “was something that was scalable, sustainable and enduring and to be able to pay dividends out of the business.

We also didn’t want to have any debt and we were cash generative after month three, with recurring revenue also building.”

Jody was happy to elaborate and explained that a typical contract would commence over a 20-day project, that then expands to a 12-month period.

Within that, CHA will provide its services over a number of days during each month and that typically spans between 5-10 day periods, which can be pitched to tie in with a client’s requirements.

That, Jody added, allows them to invoice very regularly and also in advance, which provides clear and valuable visibility across the business.

She also highlighted that the early years saw investment channelled into the set-up phase, but that by FY2026 the operating profit margin which was delivered had achieved a level which should now be consistent going forwards.

The company’s year-end is March and so far, the first five months of the current financial year have seen a significant 49% revenue increase on the prior year.

For last year, 2026, the company delivered revenue of £2.1m.

Although that revenue figure remains very small, it is the growth trajectory that catches the eye, looking impressive and open to scale.

Importantly, the operating profit margin is particularly noteworthy, given the 32.2% that was delivered last year.

Indeed, the PBT figure of £0.68m is a standout, given the revenue number and provides a glimpse of the potential that exists.

And, with 21 employees, CHA is clearly a capital-light and efficient operation, and that lends itself well to maximising the growth opportunity and driving profitability.

On coming to market, CHA, which is only raising £1.1m of new money, will have a market cap of circa £11.2m and the indicative forward PER will be circa 11.

Although Cambridge based, management already describes the business as a global operation and there are clear plans to extend and broaden its reach.

With networks and partners already in place, the US, Australia and Singapore are specifically identified as growth markets, with the latter expected to follow on the expansion path in coming months.

As for its operating model, CHA is largely a remote, globally distributed, leader-led engineering delivery system that seamlessly integrates a heavy operational footprint across India.

The beauty of this model is that it provides a highly sophisticated offensive security operation without the significant overheads of large regional offices.

Additionally, given hackers do not operate across a specific time zone, the CHA model enables continuing functionality and a constant service to clients.

Within the mix, it operates colour-coded teams, such as its Red Team which writes custom malware, where the goal is to attempt to infiltrate networks and cloud infrastructure undetected.

The ultimate goal being to see just how far a would-be attacker could penetrate a system or network.

The Blue Team sits as a monitor of the actual infrastructure, providing firewall maintenance and incident response, its job largely being one of opposing the Red Team or actual malicious players.

Thirdly, there is the Purple Team which is effectively a bridge between the other two, acting like a hands-on security coach that brings both teams together.

Rather than just grading their performances, it can test specific attacks in real time to instantly address and fix blind spots.

Collectively, CHA is very much a people and services business, where unlike many of the other quoted cybersecurity plays it isn’t selling a software solution.

The company will itself use off-the-shelf products and tools in its day-to-day operations and also embraces AI to increase efficiency.

The latter is used as a highly restricted technical tool to help its elite engineers write custom exploitation scripts faster, while simultaneously stress-testing clients’ own AI systems to find and patch critical security flaws.

As with all potential growth stocks, there are always risks and CHA will be no exception to that, and it is important to weigh those up against the bull case.

One aspect worth bearing in mind is that at the current time a large amount of revenue is derived from around a dozen customers, so clearly new business will have to be won.

That said, its model isn’t one of chasing revenue to drive the numbers, as it is very much a premium offering that enjoys impressive margins.

The trick going forwards in driving organic growth though, will be to maintain the current margin levels as they inevitably increase the headcount.

And that is another aspect which will be instrumental in continuing delivery, ensuring that they are able to recruit the highest level of expertise that they have onboarded to date.

Dan sounded positive on each front and there is a distinct belief that the model can continue in its current vein and accelerate on both revenue and profit through the organic route.

Looking at Dan’s history and previous ventures, CHA would appear to be in extremely good hands.

He has a long-established and highly impressive 30-year track record as a top-performing entrepreneurial leader across the global cybersecurity sector.

This can be defined by not only pioneering internal structures and builds, but achieving extremely successful corporate exits.

At the London Stock Exchange, he pioneered the design, build and implementation of their very first modern Security Operations Centre (SOC) and the accompanying defensive engineering team.

He then successfully went on to co-found 7Safe and NotSoSecure where, having scaled both of the cybersecurity businesses, each subsequently attracted the attention of larger entities.

That resulted in PA Consulting acquiring 7Safe in 2012, whilst NotSoSecure was bought by Claranet in 2018.

That may not be a guarantee of future success, but it does go some way to provide a significant level of credibility for the business.

It will be interesting to see where the shares go on coming to the market and how the story evolves in both the near and longer term, and it may be one to keep a close eye on, if not an interest.