Cyber Security Cloud, Inc.
What does Cyber Security Cloud do?
Cyber Security Cloud (CSC) sells subscription security software that protects web applications from cyberattacks and unauthorized access. It has two main products. Shadan-kun is a cloud-based WAF (Web Application Firewall) that detects and blocks attacks on a customer's website. WafCharm automatically manages WAF rules on AWS, saving companies the effort of configuring and maintaining their own security settings.
Customers pay monthly or annual subscription fees, and roughly 90% of CSC's revenue is this recurring "stock" revenue. Monthly churn is 1.03% for Shadan-kun (MRR basis) and 0.94% for WafCharm (user basis). As of 1Q FY12/26, annual recurring revenue (ARR) was ¥5.19bn and OP margin was 26.0%. Among approximately 4,000 listed companies in Japan, only two — including CSC — have recorded six consecutive years of 25%+ growth in both revenue and OP.
The investment question is straightforward: is CSC building a defensible application-security platform, or is too much of the business dependent on AWS?
What has driven the stock over the past two years?
Security demand grew, but expectations moved faster than reported earnings.
01 · PEAK REGIME From May through August 2024, the stock traded in the ¥2,200–2,400 band. FY12/23 revenue grew +35% YoY and OP +43%, and the combination of a domestic-market-leading cloud WAF share and broader SaaS inflows sustained a P/E of 40–50x. Turnover was thin; despite a ~80% free float, active institutional position-building remained limited.
02 · CORRECTION Between September 2024 and April 2025, the BoJ’s signalling of rate hikes and a correction in US tech equities compressed domestic growth stocks across the board. 4493 fell from ¥2,300 to ¥1,300, a decline of −43%. The P/E compressed below 20x and EV/EBITDA sank to the 13x level. Vector Group International, a major shareholder at FY12/24 end, exited during early 2025 (the company announced the prospective change of its largest shareholder on January 27, 2025; Vector’s change report of January 28, 2025 reported its holding at zero), adding to selling pressure.
03 · MTP-DRIVEN RECOVERY In March 2025, CSC completed a third-party allotment to the JICVGI Opportunity Fund (¥1.85bn, 940,000 shares), signalling its intention to accelerate M&A-led growth. Then, on February 13, 2026, CSC published a medium-term management plan targeting ¥20bn in revenue and ¥4bn in OP by FY12/30 (4x FY12/25 levels). The combination was received as a genuine shift into growth-investment mode. Six consecutive years of revenue and OP growth exceeding +25% underpinned credibility, and the stock recovered to the ¥2,000 zone.
04 · CURRENT The 1Q FY12/26 OP margin of 26.0% (exceeding the company guidance of 20.0% by +6pt) and the share buyback announced on 22 May (up to 250,000 shares, or 2.43% of shares outstanding excluding treasury based on the company’s May 21 denominator, capped at ¥450mn) support the downside. However, the full-year OP growth guidance is +8.8%, a sharp deceleration from the prior year’s +42.5%. Over the next four quarters, the verification agenda distils to three questions.
Three questions the market is debating
Growth durability, platform economics, and cash use divide investors.
- Infrastructure optimization lifted gross margin by 3.8 points, while AI is reducing support costs. Revenue is also rising faster than headcount, which gives CSC room to sustain a higher margin.
- The full-year guide still assumes a 20.0% margin because second-half R&D, advertising, and graduate hiring will rise. The first-half result therefore overstates the margin investors should carry forward.
- WafCharm automates firewall-rule management for customers who use AWS WAF; Managed Rules are pre-built rule sets sold through the AWS Marketplace.
- Both channels lock customers into AWS billing, raising switching costs. CSC is the first domestic ISV to earn AWS’s Security Incident Response Ready certification.
- AWS could narrow WafCharm’s edge simply by adding AI-generated rule suggestions to its own console.
- Marketplace commission terms are undisclosed, and multi-cloud diversification (an Azure version since 2020, a Google Cloud version since November 2021) remains a small share of ARR.
- Organic revenue above ¥7.5bn in FY12/27, with growth above 20%, would make more of the long-term target achievable without a large acquisition.
- CSC has not disclosed how much of the ¥20bn FY12/30 target would come from acquisitions.
- The remaining ~¥8.5bn would need to come from companies CSC acquires.
What could change over the next twelve months?
Three disclosures could make Cyber Security Cloud easier to value.
- WafCharm charges a base fee plus overage when traffic exceeds a threshold.
- AI crawlers and LLM training bots have increased web traffic to customer sites, and the company says WafCharm’s pay-as-you-go sales are on an upward trend as more users cross their included thresholds into automatic overage billing.
- Cyneural (AI detection engine) and WRAO (automated rule generation) are already embedded in products, meaning the “AI for Security” leg is operational.
- The next growth axis lies on the “protecting AI” side — AI agent monitoring, AI guardrails, and AI governance tools.
- CSC’s inorganic track record consists of two acquisitions (Softec, DataSign) and one subsidiary establishment (Generative Technology, capitalized at an estimated ¥9mn).
- All three have grown post-integration, with no goodwill impairment disclosed on its acquisitions.
- The stated use of the third-party allotment (JICVGI, ¥1.85bn) is to accelerate M&A.
What has to be true for the stock to work from here?
The range depends on ARR growth, margins, and acquisition returns.
This is not investment advice.
Japan Investor Interface Co., Ltd. ("JII") is an investor-relations (IR) consultancy. JII is not a registered investment advisor, financial advisor, broker-dealer, or securities firm in any jurisdiction. JII is not registered as a Financial Instruments Business Operator under Japan's Financial Instruments and Exchange Act. JII does not have an investment advisory registration and does not provide investment advice or solicit the purchase, sale, or holding of any security.
JII Compounders is an editorial publication. Each profile is an analytical study of how publicly disclosed information about a Japanese listed company has been received by the market. It is intended for educational and research purposes for IR professionals, finance students, journalists, and other readers interested in corporate disclosure practice. Nothing in this publication constitutes a recommendation, opinion, suggestion, or solicitation to buy, sell, or hold any security, derivative, or other financial instrument. Price targets, scenario ranges, multiples, and comparable-company references are illustrative of analytical method only and must not be interpreted as JII's investment opinion.
No reliance. The information presented may be incomplete, out of date, or incorrect. Forward-looking statements are inherently uncertain. Past price performance does not indicate future results. Estimates and scenario figures are not predictions and may not be achieved. JII makes no representation or warranty, express or implied, regarding the accuracy, completeness, timeliness, or reliability of any information in this publication.
No fiduciary or advisory relationship. Reading this publication does not create any advisory, fiduciary, or professional relationship between you and JII. Before making any investment, tax, accounting, legal, or other decision, you should consult qualified, licensed advisors in your jurisdiction and conduct your own independent due diligence based on primary disclosures issued by the company concerned.
Trademarks & data. Company names, logos, tickers, and product names referenced are the property of their respective owners. Share-price data is licensed from third-party providers. TradingView is a trademark of TradingView, Inc. All rights reserved.
Conflicts of interest. JII, its officers, and related parties do not hold or trade securities of companies covered in JII research. If JII has a paid engagement with a company covered in a publication, that relationship is disclosed in the relevant publication. JII's publications are for informational purposes only and do not constitute investment advice or a recommendation to buy or sell any security.
本資料は、日本の金融商品取引法に基づく投資助言・代理業ではなく、特定の有価証券の売買その他の取引の勧誘・推奨を目的とするものではありません。本資料は教育・研究を目的とした分析記事であり、JII（株式会社ジャパン・インベスター・インターフェース）は、本資料の内容に基づく投資判断について一切の責任を負いません。投資の判断はご自身の責任と独立した調査に基づいて行ってください。