U.S. Cybersecurity Investor Looking at Excite (EXT) – Some Concerns Emerging

Please note: These are just my personal views as a retail investor based on publicly available information. Happy to be corrected by others with more direct knowledge.

I'm a relatively new investor from the U.S., with holdings in several major cybersecurity names including CrowdStrike (CRWD), Palo Alto Networks (PANW), SentinelOne (S), and Zscaler (ZS). I’ve recently started looking into some ASX-listed players and came across Excite Cyber (EXT) which, at first glance, appeared to be pursuing a growth-through-acquisition strategy, backed by ambitious plans in AI and cyber training.However, after reviewing their announcements, structural setup, and delivery model in more detail, I’ve started to notice what appear to be gaps between the stated strategy and the currently visible operational capability.One example is the Nangu facility, which has been promoted as a key training and DFIR initiative. It sounds impressive, but according to publicly available reports, Excite doesn’t own the facility; it leases it. That raises reasonable questions about long-term control, cost implications, and service continuity. If Nangu is meant to be central to their delivery platform, how secure is that position?There are also several disconnects that don’t align with what I’d expect from a company claiming national-scale capability:

• No visible training team to operate a credible cyber education platform,
• No public partnerships with certifying bodies or government-recognized frameworks,
• No detail on what’s actually being delivered from the Nangu site today.

More broadly, a few structural concerns stand out:

• Executive turnover in key roles, with little public explanation,
• Actual depth of capability in the core cyber security team outside of DFIR,
• No visible contract wins in enterprise or public sector,
• No known presence in national cyber standards, frameworks, or policy engagement,
• And what looks like growing reliance on announcements over actual delivery.

Hasn’t it been over two years since Bryan Saba became CEO? By now, investors should be seeing mature execution, not just vision statements!
I’ve also come across some unverified industry chatter suggesting internal instability and misalignment at the leadership level. While that’s anecdotal, it adds to the perception that the business may be running ahead of its delivery capability.
I usually like to focus on the Warren Buffet investment strategy two points of which amongst a number of others are:

• Focus on quality companies and
• Back strong leadership

On top of that, I’ll admit the company name feels oddly mismatched for a serious cybersecurity enterprise. The name may not intuitively evoke the gravitas typically associated with serious enterprise cyber security services. I think they have to seriously look at their competitors in this space and question whether clients would prefer to trust a Deloitte or McGrathNicol over an 'Excite' for serious cyber security services.

I’d welcome insights from longer-term holders, especially those who can speak to the company’s operational depth and direction. Compared to other mature cyber players, EXT just doesn't seem to have the same traction or strategic clarity.