NCC Group’s 4-insider buying cluster after the cyber reset

Cybersecurity is one of the few technology budgets that still gets defended when the rest of the stack is under pressure. Regulation helps. So do the threats themselves. NIS2 and DORA are not marketing slogans, they are compliance regimes that force spending into the system, and that is why names like NCC Group plc keep getting read as recurring-revenue stories rather than one-off consulting shops.

That backdrop matters because the market has already split the sector into two camps. The first camp is the names with obvious platform scale and cleaner margins. The second is the services-heavy operators that have to prove they can convert demand into durable cash flow. NCC sits in the second camp, but it has been trying to move itself closer to the first by leaning harder into managed services and away from the old mixed portfolio structure. The sale of Escode in May 2026 was the clearest sign of that shift.

The comparison set is not perfect, and that is the point. NCC is not a software vendor with a neat subscription model, and it is not a pure consulting house either. It sits in the awkward middle, where the market tends to reward progress only after it sees several quarters of it. That is why the insider buying is worth reading against the operating backdrop rather than in isolation. Small purchases can be noise. Small purchases from a chief executive, a finance chief and a marketing chief, all in the same month, are at least a pattern.

NCC’s post-Escode operating mix

NCC’s six months to 31 March 2026 were not a blowout, but they were better than the old version of the business would have looked. Cyber security revenue rose 5.9% on a constant-currency basis to £118.4 million, with UK and APAC growth of 12.5% offsetting softer North American performance. That is the kind of split you expect from a business with uneven geographic exposure, not a company that has already earned a premium multiple.

The more interesting line is the mix. Managed services now account for 55% of cyber revenue. That is the sort of detail that changes how you think about the name. Consulting and technical assurance can be lumpy. Managed services are stickier. They do not make a business bulletproof, but they do make the revenue line easier to underwrite, especially when the board is telling you to expect mid- to low-single-digit cyber revenue growth for the full year to 30 September 2026 and faster EBITDA growth than revenue.

The company’s medium-term targets are more ambitious than the current numbers. NCC is talking about mid-single-digit revenue growth in FY27 and FY28, £25 million in cost savings by FY28 relative to FY25, and mid-teens cyber EBITDA margins by the end of FY28. That is a lot of work for a business that is still in transition. It is also the right sort of work if you want the market to stop treating the company as a legacy services roll-up with a cyber label on top.

The balance sheet and capital allocation story also matter here. NCC completed a £170 million tender offer in early September 2026 and launched a £15 million share buyback programme. On 17 September, the company bought 200,000 shares at a weighted average 134.6 pence. That is not a cosmetic gesture. It tells you management is willing to return capital while it tries to re-rate the operating story. The stock closed at 131 pence on 18 September, which leaves the market still below the company’s own buyback execution level.

The top-table purchases

The filing that matters here was not a lone director nibbling at the margin. Mike Maddison bought 125 shares at £1.3173 each for roughly £165, Guy Ellis bought 124 shares at the same price for roughly £163, and Angela Brown made the same 125-share purchase on the same date and terms. The filings were released on 18 September 2026, and the trades were made through the company’s UK Share Incentive Plan.

That detail matters because it keeps the interpretation honest. These were not large discretionary bets. They were small, recurring purchases, and the company’s own history suggests they are part of a monthly pattern rather than a one-off statement of faith. You should not pretend otherwise. But you also should not flatten them into pure administration. When the chief executive, chief financial officer and chief marketing officer all buy on the same date, in the same plan, at the same price, the market is being shown a coordinated internal habit of ownership.

Our scoring puts the name at 45, and the reason is plain enough. The role matters, the cluster matters, and the market-cap size band matters because smaller and mid-cap names have historically been less efficiently priced around insider activity. The euro-normalised filing value is also tiny, near EUR 192 for each of the top-table buyers. That is not the sort of number that changes a model on its own. It does, however, fit the broader pattern of repeated insider participation in a business that is trying to show discipline after a portfolio reset.

The internal dossier also shows 12 recent declarations and 4 distinct insiders in the cluster, with repeated buys from Maddison, Ellis and Brown in August and September. That is the part the market should not ignore. A single purchase can be ceremonial. Repeated purchases across the same management group are less easy to write off as random calendar noise, especially when they arrive alongside a buyback programme and a cleaner corporate shape.

Why the market may care more about the reset than the size of the buys

The stock is not priced like a broken story, but it is not priced like a clean compounder either. Shares closed at 131 pence on 18 September, inside a 52-week range of 107.20 to 161.60 pence, and consensus sits at a Moderate Buy with an average target of 162.50 pence. That leaves room for the market to re-rate the name if the operating transition keeps going. It also leaves room for disappointment if the promised margin path stalls.

This is where the insider filing becomes useful as a secondary check rather than a thesis by itself. The company has already done the hard, visible part of the reset by selling Escode. It has also told you what it wants the next phase to look like, namely more recurring revenue, better margins and lower costs. When management then buys stock, even in small amounts, it is at least consistent with the idea that the internal view of the reset is not deteriorating.

The market will still care more about execution than symbolism. UK and APAC growth of 12.5% is good, but North America remains softer. Managed services at 55% of cyber revenue is encouraging, but the company still has to prove that mix can support the margin targets it has put in front of the market. The buyback helps. The tender offer helped. Neither replaces the need for the next few trading updates to show that the post-Escode business can hold its shape.

There is also a valuation nuance here. NCC is a technology name, but not the kind that gets a free pass on growth. The market tends to give cybersecurity specialists some benefit of the doubt because the demand backdrop is real and persistent. It does not hand out that benefit forever. If the company can keep turning a larger share of revenue into managed services and keep costs moving in the right direction, the stock has a path. If not, the insider buying will look like what it often is in small-cap land, a modest internal gesture that the market briefly overreads.

How to read the cohort data

InsiderTrades data for chief-executive buys at sweet-spot names, defined here as EUR 300 million to EUR 1 billion market-cap companies, shows a 90-day win rate of 50.5% and an average return of 5.71% across 2,389 observations. The 365-day average return in that bucket is 63.9%. That is historical cohort data, not a forecast, and it should not be treated as a promise about NCC Group specifically.

Still, the bucket is relevant because NCC sits in the size range where insider activity has historically mattered more than it does at the very largest names. The company’s market value is about EUR 465.8 million, which puts it squarely in the zone where management’s own buying can carry more informational weight than it would at a mega-cap. That does not make the trade predictive. It makes it worth noticing.

The internal score’s other drivers line up with the same logic. The chief executive role carries the most weight. The cluster adds another layer. The size of the trade, at under 0.01% of market value, keeps the signal modest rather than dramatic. That combination is why the score is in the middle rather than the top of the range. It is a useful nudge, not a verdict.

The strategy framework in the dossier is there for context, not as a promise. The live out-of-sample tokens are 0.81, 26.4 and 51.5, and they apply to a restricted EU venue universe with a short, single-regime window. That is enough to show the framework has been tested. It is not enough to turn one company’s filing into a trading law.

What would make this story better, and what would spoil it

The next useful data point is not another insider filing. It is whether NCC can keep the cyber business growing while the post-sale structure settles. The company has already told the market to expect mid- to low-single-digit cyber revenue growth for the full year to 30 September 2026. If the next update confirms that managed services are still doing the heavy lifting, the market will have something concrete to lean on.

Cost savings are the other hinge. NCC has set a £25 million target by FY28 relative to FY25. That is a real number, not a slogan. If the company starts showing progress there, the margin target stops looking aspirational and starts looking like a plan. If it does not, the market will go back to treating the business as a low-growth services operator with a cyber wrapper.

The capital return story also needs watching. The tender offer is done, the buyback is live, and the company bought 200,000 shares at 134.6 pence on 17 September. That tells you management is not sitting on its hands. But buybacks only help if the underlying business is stable enough to support them. If trading weakens, the market will stop caring about the repurchases and start caring about the gap between the company’s targets and its delivery.

For now, the insider cluster is best read as a small but coherent sign that management is still leaning into the reset it has already sold to the market. The buys were tiny. The operating change is not. The next trading update will tell you whether the company can keep the cyber mix moving in the right direction and whether the market should keep giving the name credit for the transition.

Filings, buybacks and the operating reset

The filings show the insider purchases and the buyback activity. The interim presentation lays out the revenue mix, growth rates and medium-term targets. The price and consensus data frame where the stock sits now, not where it ought to go.

The useful part is the combination. NCC is not just a cyber name with a few small buys on the tape. It is a company that has sold a division, tightened the story, returned capital and now has management buying into the same reset it is asking the market to price.

The next test is simple enough. The company has to keep the cyber business growing, keep managed services above half of revenue and keep the cost programme moving toward FY28. If it does, the 17 September purchases will look like a management group buying into a cleaner business. If it does not, they will look like the kind of small, routine filings that fill databases and do not change much.

This is not investment advice.

Dig deeper: Mike Maddison's filing track record.

This is not investment advice.