NCC Group: 3 director buys, £1.32 shares, and a cyber reset, Sigma Journal

InsidersTradesSigma

InsiderTrades data puts the company in a bucket where chief executive buys at sweet-spot names have historically produced a 50.5% 90-day win rate and an average 90-day return of 5.71%, with a 365-day average return of 63.9% across 2,389 cases. That is historical cohort data for a role-and-size bucket, not a promise about NCC. Still, it is the kind of context that helps when the filing itself is small and the business backdrop is doing more of the heavy lifting than the trade size.

The filing itself is tiny, but the pattern is not random

On 17 September 2026, Mike Maddison, NCC’s chief executive, bought 125 ordinary shares at £1.3173 each through the UK Share Incentive Plan. Guy Ellis, the chief financial officer, bought 124 shares at the same price. Angela Brown, the chief marketing officer, bought 125 shares at the same price. The filings were disclosed via RNS on 18 September and executed on the London Stock Exchange.

The euro-normalised filing value was roughly EUR 192 for Maddison, EUR 190 for Ellis, and EUR 192 for Brown. That is not a typo and it is not a typo-sized signal. These are small monthly contributions, the sort of thing that comes with participation in a share plan rather than a boardroom decision to lean hard into the stock. You should read them that way first. But you should not ignore the fact that the chief executive, the finance chief, and the marketing chief all showed up in the same disclosure window.

That is where the pattern matters more than the pound amount. InsiderTrades data marks the filing as a cluster, and the cluster is not just one person making a routine contribution. It is multiple senior executives buying the same name on the same day, and it follows earlier August purchases from the same trio. The company’s own disclosure cadence suggests this is ongoing participation, not a one-off gesture designed to catch a headline. That makes the signal more durable than a single isolated buy, even if the cash amount is tiny.

What the market can and cannot take from a share plan buy

Photograph from the technology sector illustrating the NCC Group plc insider-trading story

The temptation with a filing like this is to overread it. Don’t. A UK Share Incentive Plan purchase is not the same thing as a director stepping in with a discretionary open-market buy after a selloff. It is a smaller, more mechanical act. The executives are contributing to a plan, not making a dramatic statement about intrinsic value. That distinction matters because the market has a bad habit of treating all insider buys as if they were the same species.

Still, the role mix is useful. Our scoring weights the chief executive most heavily, then picks up the cluster and the fact that the filing value is negligible relative to market value, under 0.01% of NCC’s roughly EUR 465.8m market cap. That is why the signal score sits at 45. It is not a grand conviction call. It is a modest positive read on a small-cap name where insider activity has historically been less fully priced in than at larger companies.

The fundamental screen is not screaming either. InsiderTrades data shows a fundamental score of 48, with value at 49 and quality at 47. That is a middling read, which fits the company better than a heroic one. NCC is improving, but it is improving from a base that still asks the market for patience. The filing does not change that. It does, however, tell you management is still in the plan, still buying, and still showing up in the same pattern after the August round.

Margin progress is the real story, not the share plan mechanics

If you want the part that actually matters for the stock, it is the operating mix. NCC’s H1 FY2026 cyber revenue growth of 5.9% at constant currency is respectable in a market that has become more cautious on IT spend. The more interesting line is gross margin at 38.4%, a record for the period, because that tells you the company is getting better economics out of the work it sells. Adjusted EBITDA growing faster than revenue says the same thing in a different register.

That matters because the market has been willing to pay for cyber names that can show operating leverage. It has been less forgiving of names that grow, but only just. NCC is trying to move from the second camp toward something sturdier. The June interim presentation pointed to continued pipeline momentum and margin expansion through operational discipline. That is not a glamorous sentence, but it is the kind of sentence that can support a rerating if the numbers keep behaving.

The catch is that the guidance still points to mid- to low-single-digit full-year cyber revenue growth and a 5.5% to 7.5% EBITDA margin range. So the company is not pretending to be a hypergrowth security platform. It is trying to be a cleaner, more cash-generative cyber business with capital returns attached. In this market, that can work. It just tends to work slowly, and only if execution stays tight.

Why the stock still looks like a UK small-cap, not a US cyber compounder

Comparables are doing a lot of work here. CrowdStrike and Palo Alto Networks trade at much higher valuations because the market sees scale, recurring demand, and a growth runway that NCC cannot match. That is not a criticism. It is a category difference. NCC’s UK and European focus, smaller size, and single-digit growth outlook put it in a different lane, closer to regional peers such as WithSecure than to the US leaders that dominate the sector conversation.

That relative positioning explains why the shares can sit around 131p even after a decent operational update and a meaningful capital return programme. The market is not paying for a fantasy. It is paying for a business that has become cleaner after Escode, is returning cash, and is showing some margin discipline. The valuation pressure on UK small and mid-cap names has also not gone away, even with policy stabilisation and a broader tilt toward defensives.

This is where the insider cluster adds a little texture rather than a thesis. Senior management is still buying into the plan, and the company is still buying back stock. Those are aligned signals, but they are not the same thing as a full rerating catalyst. The stock still needs the operating numbers to keep doing the work. If the margin line stalls, the market will care more about the 131p chart than the 17 September filings.

The next print matters more than the September paperwork

The useful question now is not whether the directors bought 124 or 125 shares. It is whether NCC can keep the post-Escode story moving in the right direction while the market stays selective on cyber names. The next update will need to show that the H1 margin improvement was not a one-off clean-up effect and that the revenue base can keep growing without leaning on hope or a better macro tape.

You also want to watch how the capital return programme lands. A completed £40m buyback, a planned £170m tender offer, and a further £15m repurchase programme are not small gestures for a company of this size. They can support the share price, but they do not substitute for operating progress. If the business keeps delivering record gross margin and steady EBITDA expansion, the capital returns become a reinforcement. If not, they become a way to pass time.

For now, the insider filing sits in the right place. It is small, routine, and clustered across senior roles. It lines up with a company that has just simplified itself, is returning cash, and is trying to prove that a better margin profile deserves a better multiple. That is enough to keep NCC on the list, especially with the stock still below its 52-week high and the cyber sector still rewarding names that can show discipline rather than drama.

Dig deeper: NCC Group plc's full insider filing history.

NCC Group’s 3 director buys sit inside a cyber reset

UK cyber is still being paid for, just more selectively

Act on this

Escode is gone, and the equity story is now cleaner