NCC Group’s 3 director buys sit inside a cyber reset

UK cyber is still being paid for, just more selectively

Cybersecurity is one of the few technology pockets where buyers still have to spend, even when they would rather not. Regulation keeps tightening, threat activity does not politely slow down for budget season, and digital infrastructure keeps expanding. But the market has become choosier. The easy multiple expansion that followed the first wave of security spending is gone, and the names that still command premium valuations are the ones that can show scale, recurring demand, and a cleaner growth path than the rest.

That is the backdrop for NCC Group plc. The stock sits in a part of the market where UK small and mid-cap names have had to work harder for attention, while larger US cyber peers such as CrowdStrike and Palo Alto Networks still trade on much richer multiples because they can point to faster growth and bigger platforms. NCC is not in that league. It is closer to regional peers like WithSecure, and that matters because the market tends to treat those names differently, especially when the growth rate is in the mid to low single digits rather than the double-digit kind that gets people excited.

NCC’s own numbers explain why the market is still willing to listen. In H1 FY2026, cyber revenue rose 5.9% at constant currency to £118.4m, gross margin reached a record 38.4%, and adjusted EBITDA grew faster than revenue. That is not a blowout growth profile. It is a cleaner margin profile than the market often gives this kind of name credit for, and it is the sort of improvement that can matter when the sector is being valued more on execution than on narrative.

Escode is gone, and the equity story is now cleaner

The May 2026 completion of the Escode disposal changed the company in a way the market should not ignore. NCC is now a pure-play cybersecurity provider, and that is a different proposition from a mixed business with a disposal hanging over it. The company used the proceeds to support a £40m completed share buyback, then announced a planned £170m tender offer and a further £15m repurchase programme in June. That is a lot of capital return for a company of this size, and it tells you management is not sitting on the cash waiting for a grand reinvention.

The market has already had time to price some of that in, but not all of it. The shares were around 131p in the days after the director filings, which leaves them between the 52-week low of 107.2p and the high of 161.6p. That is not a distressed chart, but it is not a market that has fully bought the post-disposal story either. You can see why. The company is still guiding to mid- to low-single-digit full-year cyber revenue growth to September 2026, with cyber EBITDA margins expected in the 5.5% to 7.5% range. Solid. Not flashy.

Insiders Trades data puts the company in a bucket where chief executive buys at sweet-spot names have historically produced a 50.5% 90-day win rate and an average 90-day return of 5.71%, with a 365-day average return of 63.9% across 2,389 cases. That is historical cohort data for a role-and-size bucket, not a promise about NCC. Still, it is the kind of context that helps when the filing itself is small and the business backdrop is doing more of the heavy lifting than the trade size.

The filing itself is tiny, but the pattern is not random

On 17 September 2026, Mike Maddison, NCC’s chief executive, bought 125 ordinary shares at £1.3173 each through the UK Share Incentive Plan. Guy Ellis, the chief financial officer, bought 124 shares at the same price. Angela Brown, the chief marketing officer, bought 125 shares at the same price. The filings were disclosed via RNS on 18 September and executed on the London Stock Exchange.

The euro-normalised filing value was roughly EUR 192 for Maddison, EUR 190 for Ellis, and EUR 192 for Brown. That is not a typo and it is not a typo-sized signal. These are small monthly contributions, the sort of thing that comes with participation in a share plan rather than a boardroom decision to lean hard into the stock. You should read them that way first. But you should not ignore the fact that the chief executive, the finance chief, and the marketing chief all showed up in the same disclosure window.

That is where the pattern matters more than the pound amount. Insiders Trades data marks the filing as a cluster, and the cluster is not just one person making a routine contribution. It is multiple senior executives buying the same name on the same day, and it follows earlier August purchases from the same trio. The company’s own disclosure cadence suggests this is ongoing participation, not a one-off gesture designed to catch a headline. That makes the signal more durable than a single isolated buy, even if the cash amount is tiny.

What the market can and cannot take from a share plan buy

The temptation with a filing like this is to overread it. Don’t. A UK Share Incentive Plan purchase is not the same thing as a director stepping in with a discretionary open-market buy after a selloff. It is a smaller, more mechanical act. The executives are contributing to a plan, not making a dramatic statement about intrinsic value. That distinction matters because the market has a bad habit of treating all insider buys as if they were the same species.

Still, the role mix is useful. Our scoring weights the chief executive most heavily, then picks up the cluster and the fact that the filing value is negligible relative to market value, under 0.01% of NCC’s roughly EUR 465.8m market cap. That is why the signal score sits at 45. It is not a grand conviction call. It is a modest positive read on a small-cap name where insider activity has historically been less fully priced in than at larger companies.

The fundamental screen is not screaming either. Insiders Trades data shows a fundamental score of 48, with value at 49 and quality at 47. That is a middling read, which fits the company better than a heroic one. NCC is improving, but it is improving from a base that still asks the market for patience. The filing does not change that. It does, however, tell you management is still in the plan, still buying, and still showing up in the same pattern after the August round.

Margin progress is the real story, not the share plan mechanics

If you want the part that actually matters for the stock, it is the operating mix. NCC’s H1 FY2026 cyber revenue growth of 5.9% at constant currency is respectable in a market that has become more cautious on IT spend. The more interesting line is gross margin at 38.4%, a record for the period, because that tells you the company is getting better economics out of the work it sells. Adjusted EBITDA growing faster than revenue says the same thing in a different register.

That matters because the market has been willing to pay for cyber names that can show operating leverage. It has been less forgiving of names that grow, but only just. NCC is trying to move from the second camp toward something sturdier. The June interim presentation pointed to continued pipeline momentum and margin expansion through operational discipline. That is not a glamorous sentence, but it is the kind of sentence that can support a rerating if the numbers keep behaving.

The catch is that the guidance still points to mid- to low-single-digit full-year cyber revenue growth and a 5.5% to 7.5% EBITDA margin range. So the company is not pretending to be a hypergrowth security platform. It is trying to be a cleaner, more cash-generative cyber business with capital returns attached. In this market, that can work. It just tends to work slowly, and only if execution stays tight.

Why the stock still looks like a UK small-cap, not a US cyber compounder

Comparables are doing a lot of work here. CrowdStrike and Palo Alto Networks trade at much higher valuations because the market sees scale, recurring demand, and a growth runway that NCC cannot match. That is not a criticism. It is a category difference. NCC’s UK and European focus, smaller size, and single-digit growth outlook put it in a different lane, closer to regional peers such as WithSecure than to the US leaders that dominate the sector conversation.

That relative positioning explains why the shares can sit around 131p even after a decent operational update and a meaningful capital return programme. The market is not paying for a fantasy. It is paying for a business that has become cleaner after Escode, is returning cash, and is showing some margin discipline. The valuation pressure on UK small and mid-cap names has also not gone away, even with policy stabilisation and a broader tilt toward defensives.

This is where the insider cluster adds a little texture rather than a thesis. Senior management is still buying into the plan, and the company is still buying back stock. Those are aligned signals, but they are not the same thing as a full rerating catalyst. The stock still needs the operating numbers to keep doing the work. If the margin line stalls, the market will care more about the 131p chart than the 17 September filings.

The next print matters more than the September paperwork

The useful question now is not whether the directors bought 124 or 125 shares. It is whether NCC can keep the post-Escode story moving in the right direction while the market stays selective on cyber names. The next update will need to show that the H1 margin improvement was not a one-off clean-up effect and that the revenue base can keep growing without leaning on hope or a better macro tape.

You also want to watch how the capital return programme lands. A completed £40m buyback, a planned £170m tender offer, and a further £15m repurchase programme are not small gestures for a company of this size. They can support the share price, but they do not substitute for operating progress. If the business keeps delivering record gross margin and steady EBITDA expansion, the capital returns become a reinforcement. If not, they become a way to pass time.

For now, the insider filing sits in the right place. It is small, routine, and clustered across senior roles. It lines up with a company that has just simplified itself, is returning cash, and is trying to prove that a better margin profile deserves a better multiple. That is enough to keep NCC on the list, especially with the stock still below its 52-week high and the cyber sector still rewarding names that can show discipline rather than drama.

Dig deeper: NCC Group plc's full insider filing history.

This is not investment advice.