The directors present the strategic report for the year ended 31 December 2025.
Audience, Purpose and Statutory Context
This Strategic Report has been prepared by the Board of Directors of CyberIAM Holdings Limited (the “Company”) for the benefit of its members and other stakeholders, including creditors and counterparties.
The purpose of this report is to provide a fair, balanced and comprehensive review of the development, performance and position of the Company’s business for the financial year ended 31 December 2025, together with a description of the principal risks and uncertainties facing the Company.
This report is prepared in accordance with the requirements of Sections 414A to 414C of the Companies Act 2006. It forms part of the Company’s annual report and financial statements and has been approved by the Board. As such, this report is publicly available and has been prepared on a basis that is factual, objective, and does not disclose confidential, commercially sensitive or legally privileged information.
The Board has exercised reasonable care to ensure that the information contained in this Strategic Report is accurate, consistent with the underlying financial statements, and provides stakeholders with a clear understanding of the Company’s strategic direction and performance during the period under review.
Review of the Business
The Group’s principal business is the provision of Identity Professional Services in the Identity Access Management (“IAM”) and Privileged Access Management (“PAM”) segments within the Cybersecurity sector. This includes the provision of specialist technical expertise to design, implement and optimise complex identity access management systems for customers.
During 2025, the Group operated in a challenging market environment and maintained a strategic focus on improving operational efficiency, strengthening service delivery and refining its market positioning. The Group also continued to assess and selectively adopt emerging technologies, including artificial intelligence tools, to enhance internal processes and client outcomes.
Revenue for the year decreased by 3.3% on the prior year to £14.6m (2024: £15.1m), primarily reflecting reduced contribution from international operations. In response, the Group undertook a review of its international footprint and made a strategic decision to scale back operations in underperforming regions in order to reduce financial exposure and focus on core markets.
Despite the reduction in revenue, Gross Profit increased to £5.4m (2024: £4.5m) as a result of improved cost management and operational efficiencies. Operating profit improved to £0.6m in 2025 from £0.1m, reflecting the impact of cost control measures and a more disciplined approach.
The Group also progressed initiatives to enhance utilisation and delivery efficiency, including workforce optimisation and improved deployment of technical resources. These measures contributed to improved performance trends during the latter part of the year.
The Board continues to evaluate opportunities to expand the Group’s service capabilities, including in adjacent areas within cybersecurity, while maintaining a disciplined and commercially focused approach to growth.
The Board regularly reviews the principal risks and uncertainties facing the Group.
Key external risks include macroeconomic conditions, geopolitical developments and changes in regulatory requirements, all of which may impact client demand and the Group’s ability to operate effectively across multiple jurisdictions.
Operational risks include the ability to attract and retain skilled personnel, manage wage inflation, maintain service quality and ensure effective utilisation of the workforce. The Group also faces risks related to maintaining accurate forecasting and visibility over sales pipelines.
The Group maintains a framework of formal and informal internal controls and governance processes designed to identify, monitor and mitigate these risks. These controls are appropriate and reasonably proportionate to its size and complexity.
Artificial Intelligence and Technological Change
The cybersecurity sector continues to be influenced by rapid technological developments, particularly in the field of artificial intelligence ("AI"). These developments present both opportunities and risks to the Group.
The Group has undertaken initiatives to explore the use of AI to improve operational efficiency and support service delivery. While such technologies have the potential to enhance productivity and client outcomes, there remains a risk that the Group may not adapt quickly enough to evolving market requirements or that competitors may achieve greater success in deploying such technologies.
The Board continues to monitor developments in this area and to ensure that any adoption of AI technologies is undertaken responsibly, with appropriate consideration given to security, data protection and governance.
The Board sets financial KPI’s through an annual budget and monitors performance through regular management reporting.
Financial KPI’s include revenue, profitability, utilisation, cash flow and working capital management. Performance during the year was below target in certain areas, particularly revenue and sales, although improvements were observed in profitability and operational efficiency.
The Group also monitors non‑financial KPIs, including staff retention, staff satisfaction and quality of service delivery, to support sustainable long‑term growth.
The Group’s policy is to settle supplier liabilities in accordance with agreed contractual terms. Payment performance is monitored on a regular basis to ensure timely settlement and effective working capital management.
On behalf of the board
The directors present their annual report and financial statements for the year ended 31 December 2025.
The results for the year are set out on page 9.
Ordinary dividends were paid amounting to £94,200. The directors do not recommend payment of a further dividend.
No preference dividends were paid. The directors do not recommend payment of a final dividend.
The directors who held office during the year and up to the date of signature of the financial statements were as follows:
In accordance with the company's articles, a resolution proposing that be reappointed as auditor of the group will be put at a General Meeting.
United Kingdom company law requires the directors to prepare financial statements for each financial year. Under that law, the directors have elected to prepare the group and parent company financial statements in accordance with United Kingdom Generally Accepted Accounting Practice (United Kingdom Accounting Standards and applicable law). Under company law, the directors must not approve the financial statements unless they are satisfied that they give a true and fair view of the state of affairs of the group and parent company, and of the profit or loss of the group for that period.
In preparing these financial statements, the directors are required to:
select suitable accounting policies and then apply them consistently;
make judgements and accounting estimates that are reasonable and prudent;
state whether applicable United Kingdom Accounting Standards have been followed, subject to any material departures disclosed and explained in the financial statements; and
prepare the financial statements on the going concern basis unless it is inappropriate to presume that the group and parent company will continue in business.
The directors are responsible for keeping adequate accounting records that are sufficient to show and explain the group’s and parent company’s transactions and disclose with reasonable accuracy at any time the financial position of the group and parent company, and enable them to ensure that the financial statements comply with the Companies Act 2006. They are also responsible for safeguarding the assets of the group and parent company, and hence for taking reasonable steps for the prevention and detection of fraud and other irregularities.
This report has been prepared in accordance with the provisions applicable to groups and companies entitled to the exemptions of the small companies regime.
We have audited the financial statements of CyberIAM Holdings Limited (the 'parent company') and its subsidiaries (the 'group') for the year ended 31 December 2025 which comprise the group statement of comprehensive income, the group balance sheet, the company balance sheet, the group statement of changes in equity, the company statement of changes in equity, the group statement of cash flows, the company statement of cash flows and notes to the financial statements, including significant accounting policies. The financial reporting framework that has been applied in their preparation is applicable law and United Kingdom Accounting Standards, including Financial Reporting Standard 102 The Financial Reporting Standard applicable in the UK and Republic of Ireland (United Kingdom Generally Accepted Accounting Practice).
Basis for opinion
Conclusions relating to going concern
In auditing the financial statements, we have concluded that the directors' use of the going concern basis of accounting in the preparation of the financial statements is appropriate.
Based on the work we have performed, we have not identified any material uncertainties relating to events or conditions that, individually or collectively, may cast significant doubt on the group's and parent company's ability to continue as a going concern for a period of at least twelve months from when the financial statements are authorised for issue.
Our responsibilities and the responsibilities of the directors with respect to going concern are described in the relevant sections of this report.
Other information
Opinions on other matters prescribed by the Companies Act 2006
In our opinion, based on the work undertaken in the course of our audit:
The information given in the strategic report and the directors' report for the financial year for which the financial statements are prepared is consistent with the financial statements; and
The strategic report and the directors' report have been prepared in accordance with applicable legal requirements.
Irregularities, including fraud, are instances of non-compliance with laws and regulations. We design procedures in line with our responsibilities, outlined above, to detect material misstatements in respect of irregularities, including fraud. The extent to which our procedures are capable of detecting irregularities, including fraud, is detailed below.
We identify and assess the risks of material misstatement of the financial statements, whether due to fraud or error, and then design and perform audit procedures responsive to those risks, including obtaining audit evidence that is sufficient and appropriate to provide a basis for our opinion.
Identifying and assessing potential risks related to irregularities
In identifying and assessing risks of material misstatement in respect of irregularities, including fraud and non-compliance with laws and regulations, we considered the following:
the nature of the industry and sector, control environment and business performance;
the company's own assessment of the risks that irregularities may occur either as a result of fraud or error;
the results of our enquiries of management of their own identification of and assessment of the risks of irregularities;
any matters we identified having obtained and reviewed the company's documentation of their policies and procedures relating to:
identifying, evaluating and complying with laws and regulations and whether they were aware of any instances of non-compliance;
detecting and responding to the risks of fraud and whether they have knowledge of any actual, suspected or alleged fraud; and
the internal controls established to mitigate risks of fraud or non-compliance with laws and regulations; and
the matters discussed among the audit engagement team regarding how and where fraud might occur in the financial statements and any potential indicators of fraud
As a result of these procedures, we considered the opportunities and incentives that may exist within the organisation for fraud and identified the greatest potential for fraud in the following areas:
(i) The presentation of the Profit and Loss Account, (ii) the accounting policy for revenue recognition (iii) understatement of creditors (iv) going concern. In common with all audits under ISAs (UK), we are also required to perform specific procedures to respond to the risk of management override.
We also obtained an understanding of the legal and regulatory framework that the company operates in, focusing on provisions of those laws and regulations that had a direct effect on the determination of material amounts and disclosures in the financial statements. The key laws and regulations we considered in this context included the UK Companies Act.
In addition, we considered provisions of other laws and regulations that do not have a direct effect on the financial statements but compliance with which may be fundamental to the company’s ability to operate or to avoid a material penalty.
Our procedures to respond to risks identified included the following:
reviewing the financial statement disclosures and testing to supporting documentation to assess compliance with relevant laws and regulations described above as having a direct effect on the financial statements;
enquiring of management concerning actual and potential litigation and claims;
performing analytical procedures to identify any unusual or unexpected relationships that may indicate risks of material misstatement due to fraud;
in addressing the risk of fraud through management override of controls, testing the appropriateness of journal entries and other adjustments; assessing whether the judgements made in making accounting estimates are indicative of a potential bias; and evaluating the business rationale of any significant transactions that are unusual or outside the normal course of business.
We also communicated relevant identified laws and regulations and potential fraud risks to all engagement team members and remained alert to any indications of fraud or non-compliance with laws and regulations throughout the audit.
Owing to the inherent limitations of an audit, there is a risk that we will not detect all irregularities, including those leading to a material misstatement in the financial statements or non-compliance with regulation. This risk increases the more that compliance with a law or regulation is removed from the events and transactions reflected in the financial statements, as we will be less likely to become aware of instances of non-compliance. The risk is also greater regarding irregularities occurring due to fraud rather than error, as fraud involves intentional concealment, forgery, collusion, omission or misrepresentation.
A further description of our responsibilities is available on the Financial Reporting Council’s website at: https://www.frc.org.uk/auditorsresponsibilities. This description forms part of our auditor's report.
Use of our report
This report is made solely to the parent company’s members, as a body, in accordance with Chapter 3 of Part 16 of the Companies Act 2006. Our audit work has been undertaken so that we might state to the parent company’s members those matters we are required to state to them in an auditor's report and for no other purpose. To the fullest extent permitted by law, we do not accept or assume responsibility to anyone other than the parent company and the parent company’s members as a body, for our audit work, for this report, or for the opinions we have formed.
As permitted by section 408 of the Companies Act 2006, the company has not presented its own profit and loss account and related notes. The company’s profit for the year was £827,861 (2024 - £60,018 loss).
These financial statements have been prepared in accordance with the provisions relating to medium-sized companies.
CyberIAM Holdings Limited (“the company”) is a private limited company domiciled and incorporated in England and Wales. The registered office is The Steam Mill Business Centre, Steam Mill Street, Chester, CH3 5AN.
The group consists of CyberIAM Holdings Limited and all of its subsidiaries.
These financial statements have been prepared in accordance with FRS 102 “The Financial Reporting Standard applicable in the UK and Republic of Ireland” (“FRS 102”) and the requirements of the Companies Act 2006.
The financial statements are prepared in sterling, which is the functional currency of the company. Monetary amounts in these financial statements are rounded to the nearest £.
The financial statements have been prepared under the historical cost convention. The principal accounting policies adopted are set out below.
The consolidated group financial statements consist of the financial statements of the parent company CyberIAM Holdings Limited together with all entities controlled by the parent company (its subsidiaries) and the group’s share of its interests in joint ventures and associates.
All financial statements are made up to 31 December 2025. Where necessary, adjustments are made to the financial statements of subsidiaries to bring the accounting policies used into line with those used by other members of the group.
All intra-group transactions, balances and unrealised gains on transactions between group companies are eliminated on consolidation. Unrealised losses are also eliminated unless the transaction provides evidence of an impairment of the asset transferred.
Subsidiaries are consolidated in the group’s financial statements from the date that control commences until the date that control ceases.
Entities in which the group holds an interest and which are jointly controlled by the group and one or more other venturers under a contractual arrangement are treated as joint ventures. Entities other than subsidiary undertakings or joint ventures, in which the group has a participating interest and over whose operating and financial policies the group exercises a significant influence, are treated as associates.
Investments in joint ventures and associates are carried in the group balance sheet at cost plus post-acquisition changes in the group’s share of the net assets of the entity, less any impairment in value. The carrying values of investments in joint ventures and associates include acquired goodwill.
If the group’s share of losses in a joint venture or associate equals or exceeds its investment in the joint venture or associate, the group does not recognise further losses unless it has incurred obligations to do so or has made payments on behalf of the joint venture or associate.
Unrealised gains arising from transactions with joint ventures and associates are eliminated to the extent of the group’s interest in the entity.
At the time of approving the financial statements, the directors have a reasonable expectation that the group and parent company have adequate resources to continue in operational existence for the foreseeable future. Thus the directors continue to adopt the going concern basis of accounting in preparing the financial statements.
Revenue comprises sales of goods or services provided to customers net of value added tax and other sales taxes, less an appropriate deduction for actual and expected returns and discounts. Revenue is recognised when performance obligations are satisfied and the control of goods or services is transferred to the buyer. Where the performance obligation is satisfied over time, revenue is recognised in accordance with its progress towards complete satisfaction of that performance obligation.
When cash inflows are deferred and represent a financing arrangement, the promised consideration is adjusted for the effects of the time value of money, which is recognised as interest income.
Revenue from contracts for the provision of professional services is recognised by reference to the stage of completion when the stage of completion, costs incurred and costs to complete can be estimated reliably. The stage of completion is calculated by comparing costs incurred, mainly in relation to contractual hourly staff rates and materials, as a proportion of total costs. Where the outcome cannot be estimated reliably, revenue is recognised only to the extent of the expenses recognised that it is probable will be recovered.
The gain or loss arising on the disposal of an asset is determined as the difference between the sale proceeds and the carrying value of the asset, and is recognised in the profit and loss account.
Equity investments are measured at fair value through profit or loss, except for those equity investments that are not publicly traded and whose fair value cannot otherwise be measured reliably, which are recognised at cost less impairment until a reliable measure of fair value becomes available.
In the parent company financial statements, investments in subsidiaries, associates and jointly controlled entities are initially measured at cost and subsequently measured at cost less any accumulated impairment losses.
A subsidiary is an entity controlled by the group. Control is the power to govern the financial and operating policies of the entity so as to obtain benefits from its activities.
At each reporting period end date, the group reviews the carrying amounts of its tangible assets to determine whether there is any indication that those assets have suffered an impairment loss. If any such indication exists, the recoverable amount of the asset is estimated in order to determine the extent of the impairment loss (if any). Where it is not possible to estimate the recoverable amount of an individual asset, the company estimates the recoverable amount of the cash-generating unit to which the asset belongs.
The carrying amount of the investments accounted for using the equity method is tested for impairment as a single asset. Any goodwill included in the carrying amount of the investment is not tested separately for impairment.
Recoverable amount is the higher of fair value less costs to sell and value in use. In assessing value in use, the estimated future cash flows are discounted to their present value using a pre-tax discount rate that reflects current market assessments of the time value of money and the risks specific to the asset for which the estimates of future cash flows have not been adjusted.
If the recoverable amount of an asset (or cash-generating unit) is estimated to be less than its carrying amount, the carrying amount of the asset (or cash-generating unit) is reduced to its recoverable amount. An impairment loss is recognised immediately in profit or loss, unless the relevant asset is carried at a revalued amount, in which case the impairment loss is treated as a revaluation decrease.
Recognised impairment losses are reversed if, and only if, the reasons for the impairment loss have ceased to apply. Where an impairment loss subsequently reverses, the carrying amount of the asset (or cash-generating unit) is increased to the revised estimate of its recoverable amount, but so that the increased carrying amount does not exceed the carrying amount that would have been determined had no impairment loss been recognised for the asset (or cash-generating unit) in prior years. A reversal of an impairment loss is recognised immediately in profit or loss, unless the relevant asset is carried at a revalued amount, in which case the reversal of the impairment loss is treated as a revaluation increase.
The group has elected to apply the provisions of Section 11 ‘Basic Financial Instruments’ and Section 12 ‘Other Financial Instruments Issues’ of FRS 102 to all of its financial instruments.
Financial instruments are recognised in the group's balance sheet when the group becomes party to the contractual provisions of the instrument.
Financial assets and liabilities are offset and the net amounts presented in the financial statements when there is a legally enforceable right to set off the recognised amounts and there is an intention to settle on a net basis or to realise the asset and settle the liability simultaneously.
Basic financial assets, which include debtors and cash and bank balances, are initially measured at transaction price including transaction costs and are subsequently carried at amortised cost using the effective interest method unless the arrangement constitutes a financing transaction, where the transaction is measured at the present value of the future receipts discounted at a market rate of interest. Financial assets classified as receivable within one year are not amortised.
Financial liabilities and equity instruments are classified according to the substance of the contractual arrangements entered into. An equity instrument is any contract that evidences a residual interest in the assets of the group after deducting all of its liabilities.
Basic financial liabilities, including creditors, bank loans, loans from fellow group companies and preference shares that are classified as debt, are initially recognised at transaction price unless the arrangement constitutes a financing transaction, where the debt instrument is measured at the present value of the future payments discounted at a market rate of interest. Financial liabilities classified as payable within one year are not amortised.
Debt instruments are subsequently carried at amortised cost, using the effective interest rate method.
Trade creditors are obligations to pay for goods or services that have been acquired in the ordinary course of business from suppliers. Amounts payable are classified as current liabilities if payment is due within one year or less. If not, they are presented as non-current liabilities. Trade creditors are recognised initially at transaction price and subsequently measured at amortised cost using the effective interest method.
Equity instruments issued by the group are recorded at the proceeds received, net of transaction costs. Dividends payable on equity instruments are recognised as liabilities once they are no longer at the discretion of the group.
The tax expense represents the sum of the tax currently payable and deferred tax.
The tax currently payable is based on taxable profit for the year. Taxable profit differs from net profit as reported in the profit and loss account because it excludes items of income or expense that are taxable or deductible in other years and it further excludes items that are never taxable or deductible. The group’s liability for current tax is calculated using tax rates that have been enacted or substantively enacted by the reporting end date.
Deferred tax liabilities are generally recognised for all timing differences and deferred tax assets are recognised to the extent that it is probable that they will be recovered against the reversal of deferred tax liabilities or other future taxable profits. Such assets and liabilities are not recognised if the timing difference arises from goodwill or from the initial recognition of other assets and liabilities in a transaction that affects neither the tax profit nor the accounting profit.
The carrying amount of deferred tax assets is reviewed at each reporting end date and reduced to the extent that it is no longer probable that sufficient taxable profits will be available to allow all or part of the asset to be recovered. Deferred tax is calculated at the tax rates that are expected to apply in the period when the liability is settled or the asset is realised. Deferred tax is charged or credited in the profit and loss account, except when it relates to items charged or credited directly to equity, in which case the deferred tax is also dealt with in equity. Deferred tax assets and liabilities are offset if, and only if, there is a legally enforceable right to offset current tax assets and liabilities and the deferred tax assets and liabilities relate to taxes levied by the same tax authority.
The costs of short-term employee benefits are recognised as a liability and an expense, unless those costs are required to be recognised as part of the cost of stock or fixed assets.
The cost of any unused holiday entitlement is recognised in the period in which the employee’s services are received.
Termination benefits are recognised immediately as an expense when the company is demonstrably committed to terminate the employment of an employee or to provide termination benefits.
Payments to defined contribution retirement benefit schemes are charged as an expense as they fall due.
Rentals payable under operating leases, including any lease incentives received, are charged to profit or loss on a straight line basis over the term of the relevant lease except where another more systematic basis is more representative of the time pattern in which economic benefits from the leased asset are consumed.
Transactions in currencies other than pounds sterling are recorded at the rates of exchange prevailing at the dates of the transactions. At each reporting end date, monetary assets and liabilities that are denominated in foreign currencies are retranslated at the rates prevailing on the reporting end date. Gains and losses arising on translation in the period are included in profit or loss.
In the application of the group’s accounting policies, the directors are required to make judgements, estimates and assumptions about the carrying amount of assets and liabilities that are not readily apparent from other sources. The estimates and associated assumptions are based on historical experience and other factors that are considered to be relevant. Actual results may differ from these estimates.
The estimates and underlying assumptions are reviewed on an ongoing basis. Revisions to accounting estimates are recognised in the period in which the estimate is revised where the revision affects only that period, or in the period of the revision and future periods where the revision affects both current and future periods.
The following judgements (apart from those involving estimates) have had the most significant effect on amounts recognised in the financial statements.
Revenue for the provision of services is recognised by reference to the stage of completion.
At the end of each period the directors will assess the stage of completion for all ongoing projects and assess the recoverability of each accrued income balance.
Sales for the provision of services are recognised by reference to the stage of completion. Deferred income balances are recognised where net cash inflows are greater than the revenue recognised.
At the end of each period the directors will assess the stage of completion for all ongoing projects.
Bad debts are recognised where there are indicators of non-recoverability, and appropriate action has been taken to recover the debt unsuccessfully. When assessing recoverability, the directors consider factors such as the ageing of the receivables, past experience of recoverability, and the credit profile of individual groups of customers.
The average monthly number of persons (including directors) employed by the group and company during the year was:
Their aggregate remuneration comprised:
The actual charge for the year can be reconciled to the expected charge/(credit) for the year based on the profit or loss and the standard rate of tax as follows:
The company operated an invoice discounting arrangement and received cash advances secured against invoiced trade debtors. As at 31 December 2025, invoiced trade debtors amounted to nil (2024: £1,280,209) against which nil (2024: £360,046) was advanced to the company.
Balances due under invoice discounting arrangements of nil (2024: £360,046) are included within bank overdrafts and are secured by way of a fixed and floating charge against the assets of the company.
The following are the major deferred tax liabilities and assets recognised by the group and company, and movements thereon:
The deferred tax liability set out above is expected to reverse and relates to accelerated capital allowances that are expected to mature within the same period.
A defined contribution pension scheme is operated for all qualifying employees. The assets of the scheme are held separately from those of the group in an independently administered fund.