A very in depth 22 page report has just been recently completed by Trim Capital. Here is some of it. Very good read. I don't have a link. Initiation: hunting elephants in the US We believe the market is underappreciating the effort and investment WhiteHawk has made in its AI-based Product Lines, sales channels and relationships with key organisations over the past few years. WHK’s sales pipeline is currently at US$22m with pending RFPs at US$10.5m. If someof these contracts close (which we expect), this would result in a material step change in WhiteHawk’s revenue trajectory and will validate theCompany’s sales strategy of pursuing larger multi-year contracts.
We initiate on WhiteHawk with a valuation of A$0.026 Investment Thesis We believe the market is under appreciating the effort and investment WhiteHawk has made in its AI-Based Product Lines,technology and sales channels and relationships with key organisations over the past few years. Unfortunately, from the market’sperspective, some contracts have been delayed but this is naturally part of doing business with large government agencies.
If and when some of these contracts do close (note: WhiteHawk has pending RFP’s of US$10.5m through one sales partner) we would expect to see a material step change in WhiteHawk’s revenue trajectory and will validate the Company’s sales strategy of pursuing larger multi-year contracts. WhiteHawk provides next generation cyber risk analytics and audits through an automated, frictionless cloud-based platform. Thiswill enable WhiteHawk to scale more easily versus traditional consulting based cyber risk providers and allow it to generate higherprofit margins given the labour intensiveness of traditional providers. The Company is exposed to strong structural tailwinds of increased risk of cyber-attacks on organizations and companies and thecorresponding awareness of reducing this risk to an organisation’s operations. This risk has arguably been overlooked in the pastas most organisations have typically only vetted suppliers and vendors from a financial or regulatory perspective rather than through a cyber security lens. Incidents such as the SolarWinds attack in 2020 have highlighted the increased interconnectedness of organisations and the large and often rippling effects to a broad range of organisations (and users) once one link of the chain has been compromised by acyber-attack. In this example, SolarWinds’ software was compromised and eventually impacted more than 30,000 public and private organisations downstream, including major organisations and US government agencies. This unfortunate event showedt hat any data breach to a third-party system where there’s shared information or interests could have adverse outcomes to a broadrange of organisations and customers.
The increased threat of cyber-attacks on supply chains is seeing an increase in the need for companies to be aware but also comply with increased regulation around processes and reporting of cyber-attacks. In the US, the U.S. Department of Defence (DoD) isrequiring organisations that conduct business with the Defence Industrial Base (DIB) to receive a minimum level of CybersecurityManagement Model Certification (CMMC). This certification provides the DoD assurance that contractors and subcontractors aremeeting the cybersecurity requirements to protect unclassified information. After a ~4-year hiatus, version 2.0 of CMMC isexpected to be implemented from Q1 2025 and will require over 300,000 companies to receive this certification if they’re wantingto be involved with a DIB contact. WhiteHawk provides an automated CMMC baseline assessment with easy to execute action planas well as an automated path to CMMC compliance through its partnerships with AWS Federal and Dun & Bradstreet Public Sector.
In Australia, the Office of the Australian Information Commissioner (OAIC) has been established to oversee privacy, freedom ofinformation and government information policy. Cyber regulatory changes have seen increased penalties for serious or repeatedprivacy breaches with penalties up to A$2.22m for each contravention and the requirement to share information with other authorities and parties when a data breach has occurred. Highlighting the potential material cost of breaching this regulation, OAIChas recently filed civil penalty proceedings in the Federal Court against Medibank Private Limited in relation to its October 2022data breach which impacted 9.7 million Australians
WhiteHawk’s sales pipeline currently stands at US$22m and as discussed on page 7 there are over US$6m 2024 opportunities thatcould be won in the coming months. This large sales pipeline underpins our revenue growth forecast of around 50% pa from FY23to FY26E.The decline in FY23 revenue was primarily due to a change in how revenue was recognised in one of its major contracts resultingin US$1.2m contract being signed in December 2023, but revenue is being recognized monthly versus all upfront as was the previous case. Without this change, revenue in FY23 would have been closer to US$3m and broadly in line with FY22. Prior to this,WhiteHawk’s revenue had grown strongly from US$0.5m in FY18 to US$3.2m in FY22 (at a CAGR of 59% pa) and we expect growthto resume in FY24E. We are forecasting FY24E revenue of US$3.1m vs management’s guidance of US$5m as we have pushed back some of the expected contract wins to FY25E but acknowledge there is upside risk to our FY24E forecast.As ARR and revenue accelerates, WhiteHawk should experience strong operating leverage given its lean cost base (13 employees)and low cost to serve due to its scalable, automated cloud-based platform.
(20min delay)