Cyber Security Cloud, Inc.
Cyber Security Cloud provides Shadankun, Japan’s leading cloud WAF by market share, and WafCharm for automated AWS WAF operations. Its AI engine accumulates more than two billion attack records a year. Around 90% of revenue is recurring, churn is below 1%, and sales and OP have grown more than 25% for six consecutive years.
Company
Cyber Security Cloud, Inc.
サイバーセキュリティクラウド
Subscription security software protecting web applications.
- Last Close
- ¥1,721 May 27
- −29% from 24-month peak ¥2,425 · +28% off 24-month trough ¥1,342
- Market Cap / enterprise value (EV)
- ¥17.6bn / EV ¥14.3bn
- net cash ¥3.4bn (cash ¥3.64bn − debt ¥0.25bn) = 19% of market cap
- EV / OP · forward
- 11.9x
- EV ÷ FY12/26E company OP guidance ¥1.2bn
- ROCE · trailing
- 24% · FY12/25
- EBIT ÷ capital employed · ROE 27% (per YUHO)
- OP margin · group
- 26.0% · 1Q FY12/26
- FY12/26 co. guidance 20.0%
- Shares & Float
- 10.25M sh · ex-treasury
- float ~ 80% · SilverCape 9.5%
What does Cyber Security Cloud do?
Cyber Security Cloud (CSC) sells subscription security software that protects web applications from cyberattacks and unauthorized access. It has two main products. Shadan-kun is a cloud-based WAF (Web Application Firewall) that detects and blocks attacks on a customer's website. WafCharm automatically manages WAF rules on AWS, saving companies the effort of configuring and maintaining their own security settings.
Customers pay monthly or annual subscription fees, and roughly 90% of CSC's revenue is this recurring "stock" revenue. Monthly churn is 1.03% for Shadan-kun (MRR basis) and 0.94% for WafCharm (user basis). As of 1Q FY12/26, annual recurring revenue (ARR) was ¥5.19bn and OP margin was 26.0%. Among approximately 4,000 listed companies in Japan, only two — including CSC — have recorded six consecutive years of 25%+ growth in both revenue and OP.
The investment question is straightforward: is CSC building a defensible application-security platform, or is too much of the business dependent on AWS?
What has driven the stock over the past two years?
Security demand grew, but expectations moved faster than reported earnings.
01 · PEAK REGIME From May through August 2024, the stock traded in the ¥2,200–2,400 band. FY12/23 revenue grew +35% YoY and OP +43%, and the combination of a domestic-market-leading cloud WAF share and broader SaaS inflows sustained a P/E of 40–50x. Turnover was thin; despite a ~80% free float, active institutional position-building remained limited.
02 · CORRECTION Between September 2024 and April 2025, the BoJ’s signalling of rate hikes and a correction in US tech equities compressed domestic growth stocks across the board. 4493 fell from ¥2,300 to ¥1,300, a decline of −43%. The P/E compressed below 20x and EV/EBITDA sank to the 13x level. Vector Group International, a major shareholder at FY12/24 end, exited during early 2025 (the company announced the prospective change of its largest shareholder on January 27, 2025; Vector’s change report of January 28, 2025 reported its holding at zero), adding to selling pressure.
03 · MTP-DRIVEN RECOVERY In March 2025, CSC completed a third-party allotment to the JICVGI Opportunity Fund (¥1.85bn, 940,000 shares), signalling its intention to accelerate M&A-led growth. Then, on February 13, 2026, CSC published a medium-term management plan targeting ¥20bn in revenue and ¥4bn in OP by FY12/30 (4x FY12/25 levels). The combination was received as a genuine shift into growth-investment mode. Six consecutive years of revenue and OP growth exceeding +25% underpinned credibility, and the stock recovered to the ¥2,000 zone.
04 · CURRENT The 1Q FY12/26 OP margin of 26.0% (exceeding the company guidance of 20.0% by +6pt) and the share buyback announced on 22 May (up to 250,000 shares, or 2.43% of shares outstanding excluding treasury based on the company’s May 21 denominator, capped at ¥450mn) support the downside. However, the full-year OP growth guidance is +8.8%, a sharp deceleration from the prior year’s +42.5%. Over the next four quarters, the verification agenda distils to three questions.
Three questions the market is debating
Growth durability, platform economics, and cash use divide investors.
- Infrastructure optimization lifted gross margin by 3.8 points, while AI is reducing support costs. Revenue is also rising faster than headcount, which gives CSC room to sustain a higher margin.
- The full-year guide still assumes a 20.0% margin because second-half R&D, advertising, and graduate hiring will rise. The first-half result therefore overstates the margin investors should carry forward.
- WafCharm automates firewall-rule management for customers who use AWS WAF; Managed Rules are pre-built rule sets sold through the AWS Marketplace.
- Both channels lock customers into AWS billing, raising switching costs. CSC is the first domestic ISV to earn AWS’s Security Incident Response Ready certification.
- AWS could narrow WafCharm’s edge simply by adding AI-generated rule suggestions to its own console.
- Marketplace commission terms are undisclosed, and multi-cloud diversification (an Azure version since 2020, a Google Cloud version since November 2021) remains a small share of ARR.
- Organic revenue above ¥7.5bn in FY12/27, with growth above 20%, would make more of the long-term target achievable without a large acquisition.
- CSC has not disclosed how much of the ¥20bn FY12/30 target would come from acquisitions.
- The remaining ~¥8.5bn would need to come from companies CSC acquires.
What could change over the next twelve months?
Three disclosures could make Cyber Security Cloud easier to value.
- WafCharm charges a base fee plus overage when traffic exceeds a threshold.
- AI crawlers and LLM training bots have increased web traffic to customer sites, and the company says WafCharm’s pay-as-you-go sales are on an upward trend as more users cross their included thresholds into automatic overage billing.
- Cyneural (AI detection engine) and WRAO (automated rule generation) are already embedded in products, meaning the “AI for Security” leg is operational.
- The next growth axis lies on the “protecting AI” side — AI agent monitoring, AI guardrails, and AI governance tools.
- CSC’s inorganic track record consists of two acquisitions (Softec, DataSign) and one subsidiary establishment (Generative Technology, capitalized at an estimated ¥9mn).
- All three have grown post-integration, with no goodwill impairment disclosed on its acquisitions.
- The stated use of the third-party allotment (JICVGI, ¥1.85bn) is to accelerate M&A.
What has to be true for the stock to work from here?
The range depends on ARR growth, margins, and acquisition returns.
This is not investment advice.
Japan Investor Interface Co., Ltd. (“JII”) is an investor-relations (IR) consultancy. JII is not a registered investment advisor, financial advisor, securities firm or Financial Instruments Business Operator in any jurisdiction. JII is not registered as a Financial Instruments Business Operator under Japan’s Financial Instruments and Exchange Act and does not hold an Investment Advisory and Agency Business registration. JII does not provide investment advice or solicit the purchase, sale or holding of securities.
JII Compounders is an editorial publication for educational and research purposes. Each company profile analyzes how the market has received public disclosures by Japanese listed companies. The intended readers are IR practitioners, finance students, journalists and people interested in corporate disclosure. The content does not constitute a recommendation, proposal or solicitation to buy, sell or hold any security, derivative or other financial instrument. Target prices, scenario ranges, valuation multiples and peer comparisons illustrate analytical methods and must not be interpreted as JII’s investment opinion.
Using this information. The information may be incomplete, out of date or incorrect. Forward-looking statements are uncertain. Past share-price performance does not indicate future results. Estimates and scenario values are not forecasts and may not materialize. JII does not warrant the accuracy, completeness, timeliness or reliability of the information, expressly or implicitly.
Use of this site. Reading this publication does not create an advisory, fiduciary or other professional relationship between the reader and JII. Before making investment, tax, accounting, legal or other decisions, consult appropriately qualified and registered professionals in your jurisdiction. Check the company’s primary disclosures and conduct your own independent research.
Trademarks and data. Company names, logos, ticker symbols and product names belong to their respective owners. Share-price data is licensed from third-party providers. TradingView is a trademark of TradingView, Inc. All rights reserved.
This publication is editorial research provided by Japan Investor Interface Co., Ltd. for educational and informational purposes only. It is not investment advice, a recommendation, or a solicitation to buy, sell, or hold any security. Readers should consult licensed advisors in their jurisdiction and conduct independent due diligence based on the company’s primary disclosures.