More annual reports from Century Communities:
2023 ReportREDUCING CYBER RISK GLOBALLY Annual Report and Accounts 2022 for the year ended 31 December 2022 Contents Strategic Report Financial Highlights About Crossword Cybersecurity Chair’s Statement Chief Executive Officer’s Statement Performance Review Operational Review Section 172(1) Statement Corporate Social Responsibility Principal Risks & Uncertainties Governance Report The Board Corporate Governance Report Directors’ Report & Statement of Directors’ Responsibilities Financial Statements Independent Auditor’s Report Consolidated Statement of Comprehensive Income Statement of Financial Position Statement of Changes in Equity Statement of Cash Flows Notes to the Financial Information Notice of AGM Company Information 04 06 07 08 10 12 24 26 28 32 38 50 56 66 67 68 69 70 96 99 About Crossword Cybersecurity plc Crossword offers a range of cyber security solutions to help companies understand and reduce cyber security risk. We do this through a combination of people and technology, in the form of SaaS and software products, consulting, and managed services. Crossword’s areas of emphasis are cyber security strategy and risk, supply chain cyber, threat detection and response, and digital identity. We partner with organisations to keep them secure in the digital world, reducing cyber risks by providing a portfolio of innovative products and services, powered by university and other research driven insights. In the area of cybersecurity strategy and risk our consulting services include cyber maturity assessments, industry certifications, and virtual chief information security officer (vCISO) managed services. Crossword’s end-to-end supply chain cyber standard operating model (SCC SOM) is supported by our industry leading SaaS platform, Rizikon Assurance, along with cost- effective cyber audits, security testing services and complete managed services for supply chain cyber risk management. Threat detection and response services include our Nightingale AI-based network monitoring, our Trillion™ and Arc breached credentials tracking platforms, and incident response. Crossword’s work in digital identity is based on the World Wide Web Consortium W3C verifiable credentials standard and our current solution, Identiproof, enables secure digital verification of individuals to prevent fraud. Crossword serves medium and large clients including FTSE 100, FTSE 250 and S&P listed companies in various sectors, such as defence, insurance, investment and retail banks, private equity, education, technology and manufacturing and has offices in the UK, Poland, Oman and Singapore. Crossword is traded on the AIM market of the London Stock Exchange. Visit Crossword at www.crosswordcybersecurity.com R E P O R T S T R A T E G C I R E P O R T G O V E R N A N C E S T A T E M E N T S F I N A N C A L I Building a portfolio of cyber security products and services with recurring revenue models www.crosswordcybersecurity.com 3 3 3 Highlights Financial Highlights Operational Highlights 68% revenue growth to £3.65m £ 55% organic revenue growth 81% growth in ARR in 2022 • Rizikon grew to over 1,000 users by end 2022 • Leonardo UK selected Rizikon to assist with assessment of supply chain cyber risks, underlining Rizikon’s capacity to deliver at scale • Acquisition of Threat Status Limited, adding two new products: Trillion™ (credential breach SaaS platform) and Arc (account protection for e-commerce platforms and organisations) 54% recurring revenue in 2022 • Size of sales deals being secured by Trillion increased significantly compared to before its acquisition by Crossword in March 2022 Average revenue per client up 40% year on year Consulting gross profit margin improved as proportion of larger clients increased Oversubscribed £3.6m equity fund raise in September 2022 Total loss for the year £3.4m £2.1m cash and cash equivalents at year end • Consulting increased its cross selling drive, selling services into numerous Rizikon clients and successfully introducing Nightingale to numerous Consulting clients • Integration of Arc into Sticky Password, one of the industry’s most well-established secure password vaults • Opened an office in Singapore to support the 24/7 monitoring services provided by Nightingale. • Launch of specialist Supply Chain Cyber Risk practice, with Rizikon wrapped in a full-service consulting offer 4 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 R E P O R T S T R A T E G C I • Oman Data Park (ODP) signed a strategic cooperation agreement to provide cyber security risk services to over 800 government, corporate and SME organisations and enhance the protection of the cyber security structure of sensitive information in Oman • Crossword’s employees grew to 63 during 2022, up from 51 in 2021, representing a 24% increase Post Period Highlights • Launch of Ransomware Readiness Assessment service in March 2023, helping organisations reduce their exposure to ransomware attacks Outlook • Targeting revenue growth of circa 50% in 2023 • Having invested significantly for rapid growth in 2022, focus in 2023 is on a clear path to profitability • Increased emphasis on targeting larger clients that can make full use of Crossword’s range of products and services www.crosswordcybersecurity.com 5 Crossword Cybersecurity keeps organisations secure in the digital world through a combination of software products and expert-led cybersecurity consulting and services Since admission to AIM in 2018, Crossword has grown revenues almost three-fold from £1.3 million (excluding discontinued operations) in 2019 to £3.65 million in 2022, through a combination of organic growth and acquisitions. Crossword’s services Crossword’s services have gained a strong reputation in the market thanks to a deep expertise in cyber security and a hands-on approach. Crossword’s full-service consulting team provides strategy, assessment and risk management services. The constantly evolving nature and increasing number of cyberattacks means that demand for our consulting services keeps growing strongly. Our May 2022 report “Strategy and collaboration: a better way forward for effective cybersecurity” showed that over 40% of respondents believed their existing cyber strategy will be outdated in two years, and a further 37% in three years. This dynamic creates growing demand for the expert consulting that Crossword provides. Crossword’s products Crossword’s products are driven by research from some of the UK’s leading universities and other research-driven insights. Crossword has developed strong and extensive research and development relationships with many UK university academic centres of excellence in cyber security. Crossword offers a portfolio of cyber security software products, having successfully integrated three acquisitions since its admission to AIM. Crossword’s products serve some of the fastest growing sectors in cyber security, including supply chain risks, threat intelligence and credentials breaches. Cyber security industry drivers Several inter-connected factors are driving the growth in cyber security software and services. • • • Increasing use of cyber-attacks by nation states against each other as a result of a significant intensification in geopolitical confrontation; Increased interconnectivity of networks and trust domains; Increased proliferation and commercial availability of cyber capabilities; • • • Increasing number of devices, including from operational technology and internet of things, and interactions drives growth in attack opportunities; Increase in remote working (accelerated by the pandemic) and resultant movement of data to the cloud; Increased dependency on third party suppliers of managed services; • Commoditisation of higher-end cyber capabilities, lowering the barrier to entry for cyberthreat actors; With 39% of UK businesses experiencing a cyber-attack in 2022, according to the UK’s National Cyber Security Centre (NCSC), the constantly increasing number and growing sophistication of cyberattacks means that spending on cyber security defence is a key priority for business and governments. As a result, Gartner predicts end-user spending for the information security and risk management market will grow from $172.5 billion in 2022 to $267.3 billion in 2026, attaining a compound annual growth rate (CAGR) of 11%, with 84% of C-level executives agreeing that cyber resilience is a business priority for their organisations in 2022, according to the WEF Global Cybersecurity Outlook Report 2022. The UK is home to the largest, most concentrated and accessible cyber security market in Europe, worth over £10bn, growing 14% in 2021 and representing twice the growth on the previous year. The UK’s reputation as a centre of cyber security excellence means it is the third largest exporter of cyber security services globally, worth £4.2bn in 2020, as reported in the UK Cyber Security Sector Analysis commissioned by the UK Government’s Department for Digital, Culture, Media & Sport. As one of the UK’s leading cyber security commercialisation specialists, Crossword is well positioned to benefit from sector growth, both in the UK and internationally. The above cyber security industry drivers, combined with a strong set of products and services, mean that Crossword is well positioned to keep growing strongly. 6 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Chair’s statement Sir Richard Dearlove KCMG OBE Chair, Crossword Cybersecurity R E P O R T S T R A T E G C I Growth accelerates rapidly in 2022 Crossword continued to build a strong and stable business, backed by our strategy of building a significant intellectual property-based, AIM quoted cyber security business. Crossword recorded impressive revenue growth of 68% in 2022. The Company completed its third acquisition and continued to reap the benefits of successfully integrating previous acquisitions, with annual recurring revenue growing by 81%. Rizikon ended 2022 with over 1,000 organisations using the platform and our blue chip cyber security consulting team is growing its client base with major FTSE and Fortune clients. Our focus now is to drive to profitability, underpinned by targeting healthy revenue growth of over 50% in 2023. Further progress with our acquisition strategy Crossword continued to build on its acquisition strategy in 2022 with the successful acquisition of Threat Status Ltd., a threat intelligence company. This added two additional products to the Crossword portfolio, Trillion™ and Arc. Arc is a similar product to Nixer, so post-acquisition, management took the decision to merge the two products, under the Arc product brand. Later in the year, in line with its stated acquisition strategy, Crossword tested a further acquisition opportunity and decided it would not be in the interests of the company to proceed at that time. This exploratory approach signals the scale of Crossword’s ambition to build a scaled up, profitable cyber security company. A strong balance sheet and robust governance To ensure that we had the funds to progress with our rapid growth, Crossword issued additional £550k of Convertible Loan Notes in July 2022 and carried out a £3.6m oversubscribed equity fund raise in September 2022. We are very pleased that our shareholders continue to see the growth opportunities for Crossword and we would like to thank them for their commitment. To ensure that we maintain a robust framework of controls and high standards, the Board continues to adhere to the Quoted Companies Alliance (“QCA”) Corporate Governance Code (the “QCA Code”) in line with the London Stock Exchange’s requirement for all AIM quoted companies to adopt a recognised corporate governance code. The Corporate Governance Statement on page 38 of this report provides further details. Continued healthy growth with a clear path to profitability Having invested significantly in 2022 to achieve impressive growth of nearly 68% over the past year, Crossword has now shifted its focus to defining a clear path to profitability. This is backed by strong current momentum, which aims to grow revenue in the region of 50% in 2023. I am very proud of what our expert team has achieved over the past year and I would like to acknowledge them all. Crossword has a very strong culture and its core values of responsibility, openness, flexibility and learning underpin everything we do and are a source of particular strength that we will leverage to grow into a strong, stable and profitable business. Sir Richard Dearlove KCMG OBE Chair, Crossword Cybersecurity 18 April 2023 www.crosswordcybersecurity.com 7 Chief Executive Officer’s review Tom Ilube Chief Executive Officer Crossword Cybersecurity It is my pleasure, as Chief Executive Officer, to present the Annual Report and audited accounts for Crossword Cybersecurity Plc (‘Crossword’ or the ‘Company’ or the ‘Group’) for the financial year ended 31 December 2022. Crossword grew revenue by a very impressive 68% to reach £3.65m in 2022, its highest growth rate since admission to AIM in 2018. This proves that Crossword’s services and products have achieved real traction with a wide range of clients. With this momentum, we expect to see our growth rate continue strongly into 2023, whilst we drive towards profitability, which is our main priority now. We were particularly pleased to see annual recurring revenue increase by 81% over the prior year and reach £2.4m. Whilst acquisitions naturally contributed to this strong growth in revenues, Crossword also recorded 55% growth in organic revenues. The constantly increasing number and the growing sophistication of cyberattacks means that spending on cyber security defence is a key priority for business and governments. In 2021, the average number of cyberattacks and data breaches increased by 15.1 per cent. from the previous year. Over the next two years, security executives from over 1,200 companies polled by ThoughtLab in its 2022 cybersecurity benchmarking study see a rise in attacks from social engineering and ransomware as nation-states and cybercriminals grow more sophisticated. As a result, “Cybersecurity failure” was ranked as a top-five risk over the next two years in East Asia and the Pacific as well as in Europe in the World Economic Forum’s 2022 Global Risks Report, while four countries, namely Australia, Great Britain, Ireland and New Zealand ranked it as the number one risk. Many small, highly digitalized economies such as Denmark, Israel, Japan, Taiwan (China), Singapore and the United Arab Emirates also ranked the risk as a top-five concern. With the ever increasing cybersecurity market, in 2022 we made it our mission to achieve critical mass by investing for growth. The executive team wanted to accelerate Crossword’s growth aiming to achieve real momentum that would carry us into 2023 and beyond. We also made the decision to continue with our acquisition strategy and we succeeded in closing another excellent transaction by securing Threat Status Limited. Threat Status brought two excellent products into Crossword’s portfolio, Trillion™ and Arc. Both products deliver recurring revenue to the business and brought a range of new clients to Crossword. Trillion™ is a data breach platform that contains billions of carefully curated and continuously updated credentials that organisations can search to check the status of their usernames and passwords. Arc makes this same vast pool of information available in a different form to product websites to protect against credential attacks. Due to Arc’s overlap with our existing product, Nixer, we made the decision to merge the two products, under the product brand name of Arc. Rizikon, Crossword’s lead product, ended 2022 with more than 1,000 organisations using the freemium version, trialling or contracted to use the product. In June we launched a new service, Supply Chain Cyber, with Rizikon at its heart wrapped in a full-service consulting offer. We are developing new leading edge modules for Rizikon and are in conversation with several potential large scale supply chain cyber clients. Increasing regulatory pressure on companies to monitor and take control of supply chain cybersecurity risks is also aiding the growth of Rizikon’s sales pipeline. 8 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 R E P O R T S T R A T E G C I Crossword is now a 70-strong, well respected, British cyber security business, with a growing reputation in the UK and beyond. We take our wider social responsibilities seriously and have supported our Polish colleagues in their efforts to help Ukrainians exiled in Poland, by matching staff donations each month for a period of 6 months up to PLN 2,500 each month. As I close, I particularly wish to thank everyone who has helped Crossword achieve this record revenue growth which, at 68% is our fastest annual growth rate since Crossword joined AIM. Having invested significantly for rapid growth in 2022, we have now shifted our focus in 2023 towards a clear path to profitability. The momentum from last year places us in a strong position to achieve at least 50% revenue growth in 2023 and our focus on margin improvement will ensure that there is a clear, carefully managed route to achieving profitability in the medium term. Crossword’s exceptional team and its culture of responsibility, openness, flexibility and learning, gives me and the whole Executive team the confidence that we will achieve our goals for our staff, our clients and our investors. Tom Ilube, Chief Executive Officer Crossword Cybersecurity 18 April 2023 Crossword’s profitable and fast growing consulting business is now a trusted supplier to a number of large and medium sized companies, as well as continuing to work with smaller, entrepreneurial companies. Our vCISO (virtual Chief Information Security Officer) service, continues to be popular with all sizes of client and delivers a growing stream of recurring revenue. Along with our Nightingale network monitoring platform, which we acquired the previous year with the Stega acquisition, the Services business saw very positive overall growth of 80%, of which 51% is recurring. On the international front, Crossword invested time and effort to firmly establish itself in Oman and is using that as a base to explore opportunities in the wider Gulf region. This effort has put us in prime position for a major Government contract in the region that, if we are successful, will generate significant revenue as well as make Crossword a strategic cyber security supplier across Government. We also signed a distribution agreement with Oman’s major cloud services provider who will offer our Trillion™ product and other Crossword services to their 600 client organisations. Outside of Oman, we won business in the insurance sector in Bermuda as well as established a small team in Singapore to enable us to offer our Nightingale network monitoring service on a 24 hour basis to major clients. During 2022, Crossword took steps to ensure that it had the funding it needed to continue executing on its strategy. Crossword extended its Convertible Loan Note programme by adding a further £550k of loan notes in July and completed a £3.6m equity fundraise in September through an oversubscribed subscription of Crossword Ordinary Shares. I was very pleased to welcome several major new shareholders and delighted that our existing shareholders continue to back our vision and support our commitment to the journey. www.crosswordcybersecurity.com 9 Performance review Financial review Financial review Strong growth in revenue and ARR Crossword recorded revenue of £3.65m in 2022. This represented a large increase of £1.5m vs. the prior year, equating to 68% growth. All revenue streams recorded strong growth, other than software development with related parties, which ceased during 2021. The Company achieved an excellent 81% growth in ARR, with 54% recurring revenue at year end. ARR growth rates continued, with Rizikon ARR growing by 43% during the year, Nightingale ARR growing by 29%, and vCISO ARR growing by 68%. vCISO, ‘virtual chief information security officer’ is a bespoke service offered by Crossword’s experienced consulting team which supports clients of all sizes in improving their cybersecurity posture. In 2022 for the first time, Crossword completed delivery of a project focused on cyber security engineering services to a strategic partner. It is expected that additional engineering services will be provided in 2023. Investing for growth Total comprehensive loss for the year was £3.4m. Total cost of sales and administrative expenses increased by £2.6m in 2022 compared to 2021. The increase reflects the acquisition of Threat Status Limited in March 2022, and the inclusion of Stega UK Limited, acquired in August 2021, and Verifiable Credentials Limited, acquired in April 2021, for a full year in the 2022 accounts. Legal and professional fees increased by c£250k, which included £346k for a potentially transformational transaction which did not progress because the vendor made other choices for their business. This reflects Crossword’s ongoing drive for acquisitions during 2022. A primary driver for the increase in costs was a 30% increase in the number of staff compared to the closing FTE (full time employee) count at the end of 2021. In 2022, Crossword invested significantly in sales and marketing and product development, which are the areas which saw the largest FTE growth. A significant improvement in Consulting gross margin was achieved while an improved and larger deployment of services was delivered by a higher number of staff. We are pleased to see that Crossword’s increased investment in sales and marketing and products development is reaping results, with average product and consulting revenue per client increasing to £28.7k per client, up from £20.5k in 2021. Focus on profitability Staff numbers have stabilised in 2023, with a strong foundation in place to drive the revenue growth and path to profitability on which the Company is currently focused. Profitability will be underpinned by improving margins, as Consulting revenue scales to achieve critical mass and as product revenues increase. Crossword’s diversified product and services offering will drive scale while containing risk. Acquisitions Loss before taxation using the 2021 presentation was £3.8m (2021: £2.4 million). In March 2022, Crossword acquired the entire share capital of Threat Status Limited, the threat intelligence company and provider of Trillion™, the cloud based software as a service (SaaS) platform for enterprise- level credential breach intelligence. Threat Status’s more recently released product, Arc, protects the users of customer-facing applications from the threat of account takeovers. Equity fundraise In September 2022 Crossword completed a £3.6m equity fundraise through a placing and subscription of Crossword ordinary shares at a price of 21.7 pence per share. Cashflows Net cash outflows of the Group in 2022 were £1.3m. Excluding proceeds from issue and repayments of loan notes, the equity fuindraise and cash paid for acquisitions, net cash outflows of the Group were £4.4m (2021: £3.3m). Taxation The Group continues to claim research and development tax credits, with £747k accounted for in 2022 (2021: £206k). R&D Tax Credits in FY2022 accounts have been reported in Tax, due to the majority of the claim being under the SME scheme. Historically, R&D Tax Credits have been reported as Other Operating Income. There has also been a prior year adjustment to R&D Tax Credits in FY2021. Financial Position Loss before taxation using the 2021 presentation was £3.8m (2021: £2.4 million). Crossword Cybersecurity plc finished the year with a cash balance of £2.1m. 10 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Crossword recorded an excellent 81% growth in ARR, with 54% recurring revenue in 2022 R E P O R T S T R A T E G C I Average product and consulting revenue per client Number of clients £30,000 £25,000 £20,000 £10,000 £10,000 £5,000 0 140 120 100 80 60 40 20 0 2018 2019 2020 2021 2022 2018 2019 2020 2021 2022 www.crosswordcybersecurity.com 11 Operational review Services In 2022, Crossword saw increased strong demand across all offerings in its Services division. Crossword continued successfully progressing in its strategy of increasing the proportion of midmarket and larger clients in its client mix, which are in an ideal position to make more widespread use of Crossword’s full range of growing services and products. This is leading to increased annual recurring revenues from such clients. Services recorded very positive overall growth of 80%, of which 51% is recurring The value of the acquisitions made by Crossword in recent years shone through powerfully in 2022. Additionally vCISO (Virtual Chief Information Security Officer) ARR grew by 68% and Nightingale monitoring services ARR grew by 29%. In 2022, Services won its first FTSE 100 client project and carried out international work in new territories including Bermuda and the Caribbean. Consulting Crossword’s consulting services delivered outstanding results in 2022, achieving 63% year on year growth. Consulting increased its cross-selling drive, selling services into numerous Rizikon clients and successfully introducing Nightingale to numerous Consulting clients. This is increasing the level of recurring revenues that the Consulting division generates, as well as strengthening client relationships as we meet their evolving needs and grow with them. To address the increased demand for consulting and product in supply chain cyber risk, in 2022 we launched the Supply Chain Cyber practice, which offers consulting services wrapped around a new set of strategic Rizikon modules with a recurring revenue proposition. The proposition targets the needs of large organisations regarding their third party supplier cyber risk and continued to be well received by larger clients, thereby adding to incremental revenue per client. The Consulting division grew to a total of 18 specialists by year end. With higher staffing levels, we continued to improve our consulting methodologies and develop a more scalable model to provide our services. This is leading to work with larger clients with multi-faceted and more complex needs. Crossword’s team of expert consultants provides bespoke cyber security consulting advice tailored to clients’ business needs. The team leverages years of experience in national security, defence and commercial cyber intelligence and operations. Crossword’s full-service cyber security consulting team provides strategy, assessment and risk management services. Crossword’s consulting services play a strategic role in its growth and are an integral part of its offering. By consulting 12 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 R E P O R T S T R A T E G C I on clients’ needs and challenges, Crossword gains valuable market insights that help inform its product development. In turn, the products business provides consulting opportunities, such as the many third party and other, risk consulting opportunities that have arisen out of Rizikon Assurance product sales. Crossword’s consultants work with over 100 clients across multiple sectors, including insurance, professional services, financial services, nuclear energy and technology. Consulting clients include one of the world’s largest, global S&P500 insurance brokers, several FTSE 250 companies and a FTSE 100 company. vCISO (Virtual Chief Information Security Officer) vCISO ARR grew by 68% vCISO recorded very strong growth of 68% in ARR thanks to its integrated and tailor-made service designed to meet clients’ evolving cyber security needs. Through the vCISO service, clients can avail themselves of the breadth and depth of cyber security services offered by Crossword. vCISO provides a fixed and predictable operational cost for clients, in contrast to the high costs and recruitment challenges that building an in-house cyber security capability entails. Nightingale ARR grew by 29% Nightingale The integration of Nightingale continued to deliver on expectations and saw significant successes in the period, with ARR growing by 29%. These included new investment management clients, deployment to a major insurance company in a dual running assessment and carrying out a cyber incident response at a top ten law firm. To service the needs of global clients, Nightingale’s capabilities were increased and we opened an office in Singapore to support its 24/7 global monitoring services. In March 2023, Crossword launched its Ransomware Readiness Assessment Service. Conducted by the Nightingale team, an organisation’s current exposure, control systems and ability to respond to a ransomware incident is analysed in detail by using an industry-specific approach and cyber incident response forensics. The service helps organisations reduce their exposure to ransomware attacks, provides detailed assessments on areas requiring protection and recommends how they should respond to attacks. Nightingale, Crossword’s world class platform, is a comprehensive security monitoring service. It mitigates the cyber threats and vulnerabilities an organisation faces by bringing together multiple facets to identify and monitor organisational assets, users, traffic, networks and endpoints. www.crosswordcybersecurity.com 13 Crossword Services timeline 2016 First consulting services revenues FTSE 250 2021 Two FTSE 250 clients acquired 2020 £1m+ in annual consulting revenues reached August 2021 Completion of acquisition of Stega UK Limited (threat intelligence and monitoring company) and its in-house monitoring platform, Nightingale 2022 First engagement with a FTSE 100 company, delivering high end cyber consulting services May 2022 “Strategy and collaboration: a better way forward for effective cybersecurity” Crossword launches research report based on interviews with over 200 CISOs (Chief Information Security Officer) and senior UK cyber security professionals June 2022 Launch of specialist Supply Chain Cyber Consultancy practice 14 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Crossword Cybersecurity products Crossword’s product portfolio addresses some of the most pressing needs in the cyber security sector, including supply chain security, credential attacks, account breaches and account protection. Crossword’s product portfolio currently numbers four products and is the result of both internal development and acquisitions. For products developed internally, Crossword’s specialist product development and software engineering teams develop the initial concept into a fully-fledged commercial product that Crossword then takes to market. Crossword has an established tradition in commercialising cyber security research from leading UK universities. Rizikon, Crossword’s flagship product focused on supply chain risk management, was based on research by the Centre for Cyber Security Sciences at City University, London, whilst Nixer CyberML was developed in collaboration with Imperial College, University of London. Nixer CyberML applies machine-learning to user behaviour analysis to detect and prevent credential stuffing and other account takeover attacks. The acquisitions undertaken to date are Trillion™ and Arc (acquisition of Threat Status Ltd completed in March 2022) and Identiproof (acquisition of Verifiable Credentials Limited completed in May 2021). Capitalising on other Crossword assets, e.g. the launch of the Supply Chain Cyber practice in May 2022, which leverages the Rizikon Platform. R E P O R T S T R A T E G C I Rizikon Identiproof Supply chain risk management Wallet verification technology Rizikon Assurance helps organisations of all sizes to assess and manage their supply chain risk at scale, in a cost-effective way. Rizikon is Crossword’s leading product and is provided as a SaaS platform. Identiproof is a credentials verification wallet technology that is compatible with the World Wide Web Consortium (W3C) standards. Trillion™ Arc Breached Account Mining platform Account protection for eCommerce platform owners Trillion™ continuously tracks, correlates and analyses billions of stolen usernames and passwords, searching for digital identities that could belong to client customers or users. www.crosswordcybersecurity.com Arc queries for access attempts in real time, using username and password pairs already known to criminals. This enables clients to instantly step in and avoid losses. Trillion™ and Arc are the latest additions to Crossword’s product suite, offering some of the strongest and most advanced credential leak monitoring services in the market 15 Products Crossword’s product portfolio addresses some of the most pressing needs in the cyber security sector, including supply chain security, credential attacks, account breaches and account protection. Rizikon and Trillion™ are well established products with distinct USPs. This led to strong growth in their revenues in 2022, with Rizikon ARR growing 43% Crossword currently offers four products, with three products being revenue generating and one in development. Rizikon and Trillion™ are well established products with distinct USPs, which led to strong growth in their revenues in 2022. Rizikon Rizikon is a supplier assurance and third party risk management platform and is Crossword’s flagship product. In 2022, Rizikon continued its strong sales growth with ARR growing 43% during the period. Rizikon enjoys a strong position in the market as a leading product for supply chain risk management, with organisations using it growing to over 1,000 by the end of 2022. As Crossword’s first product to be developed in 2015, Rizikon benefits highly from its accumulated expertise in supply chain cyber risk assessment. There is a clear need in the market for specialist providers focused on supply chain cyber risk management. In 2022, the UK arm of international defence and security company Leonardo selected Rizikon to assist in its assessment of cyber risk in its supply chain. This very significant client win underlined Rizikon’s capacity to deliver at scale and serve the largest of companies. In 2022 we increased our focus on growing Rizikon Assurance, which is aimed at mid-market and larger companies with a higher number of users per client. Rizikon Assurance is a highly versatile product that can be tailored to meet the different risk appetites of clients with different levels of risk modelling. Key to successful implementation is understanding a client’s supplier ecosystem. This is carried out in an initial consulting exercise for Rizikon Assurance clients. To ensure Rizikon remains strongly positioned we made substantial progress in re-engineering Rizikon, by moving its coding from Java to ReactJS + Java. This will speed up future development and enable Rizikon to keep quickly addressing emerging supply chain cyber security needs. Other notable product developments for Rizikon included the completion of analysis & designs for new higher value modules, and a number of improved features for Rizikon. In the second half of 2022, work continued on readying new modules for launch in 2023. The supply chain cyber risk sector Preventing cyber risk attacks in supply chains is a fast growing market. For organisations of any size, the greatest threats to cybersecurity are suppliers, third parties and connected technologies given they are so hard to control. Recent research independently conducted for Crossword of over 200 Chief Information Security Officers (CISOs) found that 83 per cent. of CISOs viewed “ensuring that the entire supply chain is water-tight in its ability to defend and recover against threat actors” as a challenge. The European Union Agency for Cybersecurity (ENISA) reported in 2021 that it expected supply chain attacks to quadruple over the following 12 months. Simultaneously, supply chains are going through a period of digital transformation, with automation increasing efficiencies, whilst at the same time introducing possible vulnerabilities to businesses. As a result, industries including but not limited to banking, retail and manufacturing are under mounting financial, reputational and regulatory pressure to monitor and take control of supply chain cybersecurity risks. These include the Supervisory Statement SS2/21 by the Bank of England’s Prudential Regulation Authority (PRA), in effect since 31st March 2022 and the EU’s NIS2 Directive and Digital Operational Resilience Act, in effect since 16th January 2023, amongst others. 16 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Nixer CyberML was a product in development by Crossword and sharing similar features to Arc. Operating in the same sector as Arc, it uses machine learning to match application credentials against a list of 555M+ leaked username/ password combinations, making recommendations if matches are made. As with Arc, it does so with zero friction to user experience. Given that ARC and Nixer Cyber ML operate in similar focus areas, in 2022 Crossword took the decision to merge the best features from both products in order to provide a best in class proposition to clients, retaining the name Arc for this product. In December 2022, Arc gained its first commercial contract when Sticky Password, one of the industry’s most well- established secure password vaults, announced a partnership with Arc. R E P O R T S T R A T E G C I Identiproof The advantages of being able to easily access and share qualifications through digital wallets is driving strong demand worldwide for verifiable credentials software. During the period we made good progress on both product development and go-to-market plans for Identiproof, which is our credentials verification wallet technology. A new demo portal was made available enabling demos of Identiproof to potential customers. It covers both flows in which the verifier requests credentials to the mobile wallet, and in which users want to share their credentials as badges. Experimental R&D proof of concept work continued with grant funded development in the areas of interoperability and trustability. Progress was made on the second major version of the Identiproof suite of products. The new versions will have a new architecture and use later versions of the development stack for better scalability, reliability and resilience. Trillion™ Trillion™ saw strong revenue growth in 2022, with the size of sales deals being secured becoming noticeably larger compared to before being acquired by Crossword. Since its launch in 2017, Trillion™ benefits from being a more mature and established product with each year that passes. Together with continuous product development, this enables Trillion™ to maintain a premium product offering excellent value for money. Trillion’s revenue growth in 2022 was supported by an increase in dedicated and specialist sales people, an increase in cross-selling, supporting a number of Consulting activities, and inclusion in the sales partnerships launched by Crossword during the period. In parallel, we continued with our sales strategy of seeking to include Trillion™ into third- party MSPs (managed service providers). On the development side, we improved product functionality to support much larger multi-organisational clients as well as multi-tiered SAAS providers. This dramatically increased the revenue universe which Trillion™ can target. Trillion™ continuously tracks, correlates and analyses billions of stolen usernames and passwords, searching for digital identities that could belong to client’s customers. Trillion™ was one of two products that Crossword added to its product portfolio as a result of its acquisition of Threat Status Limited in March in 2022, the other product being Arc. ARC Arc provides account protection for eCommerce platforms and organisations, querying for access attempts in real time, using username and password pairs already known to criminals. This enables clients to instantly step in and avoid losses. www.crosswordcybersecurity.com 17 Crossword Products timeline 2015 Rizikon launched 2016 Worked with Coventry University to help create CyberOwl Ltd 2017 Worked closely with our university partners, Warwick and EPFL, to create ByzGen Ltd 2019 Accepted onto the UK Government G-Cloud framework 2019 Nixer CyberML machine-learning version launched 2019 Rizikon Assurance 2.0 launched; designed with Creditsafe integration, 360-degree Supplier Scorecards and an Assurance Framework Dashboard 2020 Launch of Rizikon Pro May 2021 Completion of acquisition of Verifiable Credentials Limited, adding Identiproof to the product portfolio March 2022 Acquired Threat Status Limited, the cyber intelligence company, in March 2022, adding Trillion™ and Arc to Crosssword’s product portfolio November 2021 Integrated DarkBeam’s cyber risk audits into Rizikon, significantly enhancing Rizikon’s functionality 18 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Sales & Business Development Focus on high retention rates and increased contract value The customer success team continued to ensure high retention rates and increased contract value by demonstrating the value of products to clients. We saw this markedly in the case of Rizikon, leading to high levels of contract renewals as supply chain risks increase and become more widely recognised. Sales team restructured In 2022, Crossword’s sales team was restructured into direct and indirect/ channel sales to keep improving results. As part of this restructure, for direct sales we are placing more emphasis on sector-based sales campaigns, e.g. targeting sectors such as large clients facing supply chain risks for Rizikon. For indirect/channel sales we are expanding channel sales via resellers and distributors. To generate a better sales pipeline and results overall we also implemented the MEDDICC sales methodology, whilst continuing to further develop CRM and sales reporting/automation. New sales partnerships We were pleased to establish several new sales partnerships during the period. Sales partnerships are part of Crossword’s indirect/channel sales and enable Crossword to reach large audiences quickly and effectively. The new partnerships included BESA (British Educational Suppliers Association), the SWCRC (South West Cyber Resilience Centre), techUK, (the UK digital technology trade association), the Chartered Insurance Institute and the International Federation of Consulting Engineers. We were also delighted that the IASME Consortium Limited, a UK Government Cyber Essentials Partner, selected Rizikon Assurance as the core platform to support a new Maritime Security certification, taking the number of certifications it delivers via Rizikon to three. In 2022, Crossword also supported the British Educational Suppliers Association with Cyber Essentials and Rizikon, as well as techUK’s SMEs with Cyber Essentials and Rizikon Assurance. R E P O R T S T R A T E G C I 19 Rizikon - Expertise in supply chain cybersecurity Time consuming, arms length assurance process • Assessing cyber security risk emanating from hundreds of suppliers, usually at arms- length, is very inefficient and highly labour intensive without technology support • Creates strong demand for integrated single point software solutions that can address this and give clients a top-down view of their supply chain risk Increased Regulatory Pressure • Regulatory developments are increasing pressure on companies to monitor and react to supply chain risk • In the UK, the Network and Information Systems Regulations 2018 (NIS), which are currently being consulted upon under three pillars, and the UK Prudential Regulation Authority (PRA), are of particular importance Increasing and evolving supply chain risk • Supply chain cyber security has suffered from under investment in relation to other cyber sectors, such as combating Ransomware • Hackers are targeting the vulnerabilities and evolving their attacks within increasingly complex integrated supply chains • Has created pent-up demand to improve supply chain cyber security Rizikon reduces risk and improves compliance in supply chain cyber risk management Increased Cost Efficiency Improved Compliance Reduced Cyber Risk • Increased automation is driving better use of resources and improved ROI • Rapid assessment of regulatory and other cyber risk compliance • Rapid assessment of supply chain cyber risks in the supply chain • Enhanced ability to focus activities on areas of greatest need and higher risk • Simple scheduling and timely deployment of assessment activities • Scalable SaaS solution that grows with clients, from small to very large supplier chains • Enhances client’s capability by building on Crossword knowledge base, advisory support and services • Efficient planning and tracking of mitigating actions • Effective escalation and senior level reporting • Continuous improvement based on Crossword’s accumulated supply chain cyber expertise 20 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 • Comprehensive overview of risk mitigation pipeline • Customisable categorisation for speedy prioritisation • Fast and efficient planning and tracking of mitigation & transformation • Timely escalation and senior level reporting Trillion™ - A sole focus on credential breach detection since 2017 R E P O R T S T R A T E G C I Trillion’s attractiveness derives from its sole focus on solving one core problem area: stolen passwords, otherwise known as credential breach detection. Trillion’s specialisation since its launch in 2017 has led to an outstanding degree of expertise that is highly regarded in the market. Trillion™ focuses on serving the corporate market, for which password/credential breach protection is one of the highest priorities. Trillion’s hallmarks of speed of service, quality of data and confidentiality are highly valued by corporate clients. Trillion™ is strongly positioned in the feature rich yet price accessible higher segment of the market, combining highly automated processes that are driven by AI, thereby simplifying onboarding and operation for its clients. Trillion’s distinct servicing model serves as an additional strong differentiator, in contrast to providers that will limit themselves to dumping raw and unstructured data on clients. Trillion’s USPs 1. Privacy. Trillion™ maximises privacy whilst continuously filtering through constantly increasing amounts of stolen data. When it alerts clients about stolen data, it does so by only disclosing data appropriate for risk management while restricting all critical privacy elements to the data subject themselves. 2. Relevant and cleanest data. Trillion™ prioritizes the most relevant data through a number of methods, including automatically testing whether discovered email addresses are still active or defunct. 3. Most dangerous users. Trillion™ targets the highest risk people by identifying top offenders of password re-use. www.crosswordcybersecurity.com 21 Delivering credential protection at scale for Spain’s public administration Protecting large, distributed organisations, such as exist in the public sector, where many individual entities exist is one of the more challenging aspects of cyber security at scale. Crossword considers CCN-CERT a true business partner, and we learn as much from their feedback on our products as they do from our data. By listening closely to clients’ needs, we are continuously enhancing Trillion™ to support the cybersecurity needs of organisations operating at the top of their game” Jon Inns, Product Director for Arc and Trillion™ Covid-19 During the height of the Covid-19 pandemic, CCN-CERT needed to act immediately to enhance the cybersecurity of Spain’s national health infrastructure. Time Once the team at CCN was given access to Trillion™, in a matter of hours every health organisation across Spain was configured in the platform and breached credential data was being fed back into the CERT. CCN-CERT CCN-CERT is the Information Security Incident Response Team (CERT) of the National Cryptologic Centre in Spain (CCN), which is accountable to the Spanish National Intelligence Centre. Support Head of the cybersecurity department at CCN contacted the Trillion™ operations team after Trillion’s global offer of support to help protect digital identities within health services. 22 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 R E P O R T S T R A T E G C I Certification Crossword collaborated with the CERT to implement new features which would enable it to extend the use of Trillion™ to local Government departments and organisations, while still maintaining a central, national view within the CERT. Expansion CCN-CERT decided that a wider scope for Trillion™ will protect the wider Spanish public services infrastructure. Success Trillion™ is now monitoring hundreds of organisations, thousands of domains and reporting leaked data on hundreds of thousands of public workers across Spain. Roll out Trillion™, with the new features, was rolled out over the following weeks. CCN-CERT invited hundreds of local authorities, municipalities, town halls and central government departments to come on board using simple automated signups, which took a matter of minutes to complete. www.crosswordcybersecurity.com 23 Section 172 (1) Statement The Company has complied with the requirements of s414CZA of the Companies Act 2006 by including certain information within the Strategic and Governance Reports, that informs members of the Company how the Directors have considered the matters set out in section 172(1)(a) to (f) of the Companies Act 2006 when performing their duty under section 172 to promote the success of the Company. The following table outlines where the key content as required by the regulations can be found in this report. Crossword in the UK has an Employee Assistance Programme (EAP) which includes a wealth of resources like confidential health assessments, online resources, and telephone support. Matters considered by the Board Where to read more in this Annual Report The likely consequences of any decision in the long term The interests of the Company’s employees The need to foster the Company’s business relationships with suppliers, customers and others Strategic Report on page 3 Corporate Governance Report on page 38 Directors’ Report on page 50 Corporate Social Responsibility on page 26 Corporate Governance Report on page 38 Corporate Governance Report on page 38 The impact of the Company’s operations on the community and the environment Corporate Social Responsibility on page 26 Corporate Governance Report on page 38 The desirability of the Company maintaining a reputation for high standards of business conduct The need to act fairly as between members of the Company Performance Review on page 10 Strategic Report on page 3 Corporate Governance Report on page 38 Corporate Governance Report on page 38 Directors’ Report on page 50 24 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 R E P O R T S T R A T E G C I 25 Corporate Social Responsibility It’s a really lively, young, fast moving company. Everyone is very engaged it’s a really great company to work for. The atmosphere is second to none” The greatest thing about Crossword is the culture. I find our CEO very charismatic and focused on keeping the culture alive but not being not being something which is forced on people. It feels very natural, very modern, a great place to work.” ENVIRONMENTAL, SOCIAL & GOVERNANCE As Crossword continues to grow and mature as an organisation, a keen focus is kept on our wider stakeholder and social responsibilities. Crossword holds itself to high standards in relation to stakeholders, in areas such as governance, employees, community, environment and customers. Crossword recognises that we have a responsibility to manage our environmental impacts carefully, including meeting all legal and regulatory requirements. We are committed to reducing our environmental impact and continually improving our environmental performance as an integral part of our business strategy and operating methods, with regular review points. We encourage customers, suppliers and other stakeholders to do the same. At Crossword, we value the people and we believe our greatest strength is a good team of experts. We are focussed on gender diversity with the Board being 37.5% women and Advisory Board at 50:50 parity. The Women at Crossword Group was established during 2021 and has met 3 times covering an interesting range of topics and speakers. Our culture Our culture is that distinct differentiator which drives our decisions and actions. We are energetic, agile and passionate about the quality of work we deliver. We encourage responsibility early in the lifecycle of an employee’s career, along with which comes valuable learning. We make sure we have fun while doing our work and look out for each other by being open, transparent and flexible to adapt to each other’s needs and the needs of our customers and stakeholders. The Board is committed to promoting a strong ethical and values-driven culture throughout the Company and has a people- oriented ethos where hard work and commitment is recognised. The benefit of experience The make-up of our team gives us something unique to offer. It’s rare to find such richness of leadership experience in a small organisation and the advantage of our size is that our leadership team are present, accessible and engaged with the whole team. Employees get to know the leadership well and our staff tell us time and time again that they find this level of exposure invaluable in developing their own knowledge and business acumen. In 2022, we looked after our health and well-being in many ways, including with online yoga classes, laughter yoga, financial wellbeing workshop, celebrating Men’s Health week, a Wellness Week and several enjoyable social events. We have a Mental Health First Aider to provide support where required. We have a ‘Balance’ channel on Slack, which is a dedicated space to bring interesting articles, blogs, websites and general content about Mental Wellbeing. Our Mental Wellbeing Policy outlines our provisions to prevent and address mental health issues among our employees. Mental Health is just as important as physical health. Mental ill health may be detrimental to a person as it impacts happiness, productivity, and collaboration. Crossword in the UK has an Employee Assistance Programme (EAP) which includes a wealth of resources like confidential health assessments, online resources, and telephone support. 26 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Company values Flexibility We adapt to changing needs and empower our employees with the trust and autonomy they need to deliver high quality work. Learning We promote continuous learning culture and believe that knowledge and competence drives performance and growth of the individual and organisation. R E P O R T S T R A T E G C I Responsibility We take the ownership to demonstrate a high standard of work as we are personally responsible for the work we deliver. Openness We encourage openness between all employees and with clients, we are inclusive adaptive collaborative, and committed to accepting people from diverse backgrounds. More reasons to join us Leadership support Asking for help and support is celebrated and highly encouraged at Crossword. The support can be available in the form of Mentoring, knowledge sharing and we also have a ‘Buddy system’ for new starters. The Executive team is committed to their team’s professional development. Great working environment We strive to better the employee experience by providing proper work equipment and also through workplace engagement surveys which encourage open communication and feedback. Our offices are modern and equipped with kitchen and shower facilities, coffee machines and breakout spaces. Inclusivity & Diversity Work-life balance Our collective strength is in our individual uniqueness and the range of experiences we can bring to the table. When we recruit, we don’t look for a ‘Culture fit’, to fit any specific but rather what the person brings, but our culture is extremely collaborative and adapts to cater to the needs of our biggest asset – our people! We are focused on achievements at work, not how long you spend in the office. We believe in being agile and adapt to work around employees’ commitments and working styles. We prioritise our employees’ mental well-being above everything else. All employees are encouraged to take timely breaks to spend time doing what they love and pursue their recreations. Some of the initiatives which highlight the elements of our culture are as follows: • Employee Engagement through our Corporate Social Responsibility initiative drives a common goal and brings employees together for a higher purpose. We have partnered with SPEAR, a local charity in Richmond, to raise funds and help the homeless. Our Krakow office employees carry out philanthropic initiatives every year to help the disadvantaged and needy. • We also have other interesting employee engagement events like our company away days, social events, lunch Mondays, etc. • Excellent communication channels like Slack, Google Meet, virtual fortnightly coffee mornings allow for an easy flow of communication. • Flexible and family-friendly policies which enable an enviable work environment. • Open recognition initiatives as well as a 5-year Long Service Award to acknowledge hard work and commitment to the business www.crosswordcybersecurity.com 27 Principal Risks & Uncertainties The Board has overall responsibility for ensuring that risk is appropriately managed throughout the business. The Board is aware of the need to conduct regular risk assessments to identify any deficiencies in the controls currently operating over all aspects of the Company. Risks to the achievement of strategic objectives are identified by the Executive. The degree of risk is evaluated by reference to the impact and probability of the risk, considering inherent and residual risk. The Executive considers the nature and extent of the risks, the threat of such risks becoming reality, the ability to reduce the incidence and impact on its business if the risk materialises, and the costs and benefits resulting from operating relevant controls. A Risk Register is prepared and regularly reviewed by the Executive, and shared with the Audit Committee for independent review and robust challenge. The Risk Register includes a plan for mitigation of risks above the risk appetite of the business. RISKS RELATING TO THE GROUP AND THE INDUSTRY IN WHICH IT OPERATES 1 INTELLECTUAL PROPERTY ACQUISITION AND DEVELOPMENT 2 TECHNOLOGICAL CHANGES Generally, product markets are exposed to rapid technological change, changes in use, changes to customer requirements and preferences, and services employing new technologies and the emergence of new industry standards and practices. The Group operates in a market with such changes, which have the potential to render the Group’s existing technology and products obsolete or uncompetitive. To remain competitive, the Group must ensure continued product improvement, and the development of new markets and capabilities to maintain a pace congruent with changing technology. This added strain may stretch the Company’s capital resources, which may adversely impact the revenues and profitability of the Company. The Company’s success is dependent on the ability to effectively respond and adapt to technological changes and changes to customer preferences. There can be no assurance that the Company will be able to effectively anticipate future technological changes or changes in customer preferences. Furthermore, there is also no assurance that the Company will have sufficient financial resources to effectively respond in a timely manner if such a change is anticipated. 3 REPUTATIONAL RISKS As a cyber security company, Crossword is very conscious of its external reputation. If the Group is compromised as a result of a cyber incident, it would impact its clients’ confidence. As Crossword expands its products and services, it is holding more client data and intellectual property, increasing the potential impact in the event of a cyber incident. Crossword acquires intellectual property (IP) rights from universities via licensing, IP transfer arrangements and acquisitions, and then develops this IP into commercial products. Failure to secure good quality IP deals, and to quickly and appropriately meet new cyber security challenges, will make it difficult for the Group to generate new products. Crossword has an experienced cyber security expert acting as its Chief Information Security Officer (CISO) and a strong technical team who actively seek to mitigate threats. Nonetheless, should an event take place which adversely affects the reputation of the Group, its future prospects and value could suffer. The success of this strategy depends on the ability of Crossword to source suitable IP and use its expertise in business management, marketing and product development to build solutions attractive to its potential customer base. Ultimately, Crossword will only succeed if it is able to acquire design, develop and sell new software solutions in a timely fashion that deliver operational reliability and effectiveness. 4 COMPETITION There is no guarantee against new entrants or current competitors providing superior technologies, products or services to the market. There is no certainty that new entrants or current competitors will not provide equivalent products for a lower price. The Company may be forced to make changes to one or more of its products or to its pricing strategy to effectively respond to changes in customer preferences in order to remain competitive. This may impact negatively on 28 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 R E P O R T S T R A T E G C I the Company’s financial performance. The Group’s consulting division operates in an environment that includes large international accounting firms and consultancies and a number of smaller niche players. There are very low start-up costs for any new entrant into the market and the Group cannot prevent any person or organisation from seeking to compete with it. There is a risk that an existing competitor or a new entrant may, over time, be able to win work from the Group’s existing and future customers. In addition, larger competitors may, in the future, adopt more aggressive expansion strategies, which could include hiring additional experienced consultants and changing their business model and service offering to one that is directly comparable to that of the Group. This could, in theory, result in a material loss of customers from the Group to larger competitors and therefore have a material adverse impact on the financial performance of the Group. 5 KEY SYSTEM FAILURE, DISRUPTION OR INTERRUPTION The Company’s reliance on technology exposes the Company to a significant risk in the event that such technology, or the Company’s systems, experience damage, interruption or failure in some form. A malfunctioning of the Company’s technology and systems, or those of key parties, could result in a diminished confidence in the Company’s services, resulting in a consequential material adverse effect on the Company’s operations and results. 6 DEPENDENCE ON THIRD PARTIES AND BUSINESS CONTINUITY and therefore materially and adversely affect its reputation, performance or financial condition. 7 ABILITY TO RECRUIT AND RETAIN SKILLED PERSONNEL The Company believes that it has the appropriate incentive structures and culture to attract and retain the calibre of employees and contractors necessary to ensure the efficient management and development of the Company. However, any difficulties encountered in hiring, and retaining, appropriate employees and/or contractors and the failure to do so, or a change in market conditions that renders current incentive structures unattractive, may have a detrimental effect upon the trading performance of the Company. With recognised shortage of skilled technical people, the ability to attract new employees and contractors with the appropriate expertise and skills cannot be guaranteed. 8 FINANCIAL CONTROLS AND INTERNAL REPORTING PROCEDURES The Company’s future growth and prospects will depend on its ability to manage growth and to continue to maintain, expand and improve operational, financial and management information systems on a timely basis, whilst at the same time maintaining effective cost controls. Any damage to, failure of or inability to maintain, expand and upgrade effective operational, financial and management information systems and internal controls in line with the Company’s growth could have a material adverse effect on the Company’s business, financial condition and results of operations. Key components of Crossword’s technology platform may be dependent on the continuing availability of a particular supplier. GENERAL BUSINESS RISKS 9 TAXATION RISK The software development environment or data processing platforms may become unavailable for an extended period of time thereby disrupting customers’ experience of Crossword’s products and services. Crossword’s business is at risk from disruption of key systems and assets on which it depends. The Company is subject to taxation and the application of such taxes may change over time due to changes in laws, regulations or interpretations by the relevant tax authorities. The recent proposed changes to the research and development tax incentives may have an adverse effect on the Company’s results of operations. The functioning of the IT systems on which it relies could be disrupted for reasons either within or beyond its control, including but not limited to: accidental damage; disruption to the supply of utilities or services; security breaches; extreme weather events; systems failure; or workforce actions. There is a risk that such disruption may materially and adversely affect Crossword’s ability to offer services to customers The continuing status of the Ordinary Shares as a qualifying holding for VCT and/or EIS purposes will be conditional (amongst other things) on the qualifying conditions being satisfied throughout the period of ownership. There can be no assurance that the Company will continue to conduct its activities in a way that will secure or retain qualifying status for VCT and/or EIS purposes. www.crosswordcybersecurity.com 29 10 COUNTERPARTY CREDIT RISK 14 CURRENCY EXCHANGE RISK The Group’s functional currency is Sterling. One subsidiary, Crossword Cybersecurity Sp. Z.o.o is based in Poland, and another subsidiary, Crossword Cybersecurity LLC, is based in Oman. Crossword Cybersecurity Sp. Z.o.o, where the functional currency is zloty, accounts for approximately 11 per cent of the total costs of the business. Crossword Cybersecurity LLC‘s functional currency is Omani rials, which is pegged to the US Dollar. Exposure to this and other exchange rates may effect the Company’s results. The Company may consider implementing policies to limit its currency exposure and will consider currency hedging instruments when they prove to be available and cost-effective. 15 GOING CONCERN RISK There is a risk that the Group will not be able to raise cash when it is required. This could be as a result of poor performance within the Group or turmoil within the markets following COVID-19, or other economic issues such as the Ukraine crisis. The Strategic Report was approved by the Board of Directors on 18 April 2023. TOM ILUBE CEO 18 April 2023 There is a risk that parties with whom the Company trades or has other business relationships (including partners, customers, suppliers, subcontractors and other parties) may become insolvent. This may be as a result of general economic conditions or factors specific to that company, or exceptional circumstances such as COVID-19. In the event that a party with whom the Company trades becomes insolvent, this could have an adverse impact on the revenues and profitability of the Company. 11 LEGAL RISK Legal risks include the inability to enforce security arrangements, an absence of adequate protection for intellectual property rights, an inability to enforce foreign judgments relating to contracts entered into by the Company that are governed by law outside England and Wales, absence of a choice of law, and an inability to refer disputes to arbitration or to have a limited choice with regard to arbitration rules, venue and language. Mitigation measures for these risks may also be limited. 12 INSURANCE RISK There can be no certainty that the Group’s insurance cover is adequate to protect against every eventuality. The occurrence of an event for which the Group did not have adequate insurance cover could have a materially adverse effect on the Group’s business, revenue, financial condition, profitability, results, prospects and/or future operations. 13 ECONOMIC CONDITIONS The Group could be affected by unforeseen events outside its control including economic and political events and trends, inflation and deflation or currency exchange fluctuations. The impact is likely to include interrupted power supply, disruption to financial markets and higher inflation. Any economic downturn either globally or locally in any area in which the Group operates may have an adverse effect on the demand for the Group’s products and services. A more prolonged economic downturn may lead to an overall decline in the volume of the Group’s activities and sales, restricting the Group’s ability to realise a profit. The markets in which the Group offers its services are directly affected by many national and international factors that are beyond the Group’s control. 30 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Governance Report The Board The Directors in office during the year and at the date of this report are as shown below: Sir Richard Dearlove KCMG OBE Tom Ilube CBE Mary Dowd Non-Executive Chair Chief Executive Officer Chief Financial Officer Appointment Date: 1 September 2016 Skills and Experience: Sir Richard brings to the Board extensive experience across government, education and global business. Sir Richard joined MI6 in 1966, undertaking various overseas and head office roles before being promoted to Chief of the Secret Intelligence Service in 1999. He retired from the Service in 2004. External Appointments: Sir Richard is presently Chair of Trustees of University of London, Chair of Ascot Underwriting Limited at Lloyd’s of London and a Director of Kosmos Energy, the New York Stock Exchange listed oil and gas exploration company. Sir Richard is also a Director of The Cambridge Security Initiative 2017, the Cambridge Arts Theatre Trust Limited, Lower Tamar Fishing Club Limited and Endsleigh Fishing Club Limited. He also holds several advisory roles. Committee Memberships: None Appointment Date: 6 March 2014 Skills and Experience: Tom is founder and CEO of Crossword. Tom served as Chief Information Officer of Egg Banking PLC, which at the time was a pioneering main market listed UK internet bank. Tom chaired the UK Government Technology Strategy Board’s Network Security Innovation panel. He was a member of the High Level Expert Group on cyber security at the International Telecommunication Union (ITU), a Geneva- based UN agency. He was awarded a Doctor of Science (Honoris Causa) by City, University of London, an Honorary Doctor of Technology by the University of Wolverhampton and was appointed a CBE in the 2018 Birthday Honours for services to Technology and Philanthropy. External Appointments: Non-Executive Director of WPP plc and Chair of the RFU. Director of Iternal Limited, Honorary Fellow of St Anne’s College, Oxford and of Jesus College, Oxford and Chair of the African Gifted Foundation. Committee Memberships: None Appointment Date: 14 June 2018 Skills and Experience: Mary brings over 20 years’ experience of working alongside business leaders. She has demonstrated a track record of managing finance teams to ensure timely delivery of relevant financial information to all stakeholders, providing clear leadership, continuous process improvement, and excellent communication. She also brings to Crossword extensive experience of working in acquisitive businesses and providing transactional support. Mary graduated from University College Galway, Ireland and has a postgraduate Diploma in Business Studies from the same university. She is a Fellow of the Chartered Institute of Management Accountants. External Appointments: Trustee at The Groundwork South Trust Limited and member of the Audit and Risk Committee of the University of Essex. Committee Memberships: None 32 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Dr Robert Coles Dr David Secher Independent Non-Executive Director Appointment Date: 25 May 2021 Skills and Experience: Robert is a highly experienced IT Risk and Cyber Security leader. He has over 30 years commercial experience, including Chief Information Security Officer of the NHS. Prior to this, Robert worked for GSK, National Grid, and Merrill Lynch. He held various senior information security roles at Royal Bank of Scotland and he was a partner in KPMG. Robert is a Senior Fellow at the Centre for Assurance Research and Engineering at George Mason University, Washington DC. He is also an Honorary Professor at UCL. He was awarded a PhD in psychology by the University of Leeds for his work on the perceptions of information and IT risk and has published and presented on this and other topics. He continues to undertake research in these areas. He was also awarded an MBA from Manchester Business School. He has extensive links with major industry information security networking groups. Robert is Chair of the Group’s subsidiary, Crossword Consulting Limited. External Appointments: Director & Chair of Cumberland House Consulting Ltd, Director & Chair of Think Cyber Security Ltd, Governor/Trustee and Audit Committee Member of the University of Brighton. Committee Memberships: Audit and Nomination (Member) www.crosswordcybersecurity.com Independent Non-Executive Director Appointment Date: 16 June 2014 Skills and Experience: David is an international expert in intellectual property, technology transfer and research management. His experience includes Japan, Jordan, South Africa, Brazil, Chile, Australia, Argentina, India, Saudi Arabia and Lebanon as well as Europe and the USA. David is a Life Fellow and until 2018 was Senior Bursar at Gonville & Caius College, Cambridge where he was responsible for the investment of a £210m endowment. David was co-founder and chair of Praxis (now PraxisAuril), the leading UK technology transfer training programme, of which he is now Patron. He served as Director of Research Services, University of Cambridge, where he was responsible for creating and directing a new division of 80 staff, for designing and implementing an intellectual policy for the university and for technology transfer throughout the university resulting in £2m licensing revenue, 40 new licences and six spin outs per year. David was Chief Executive of N8 Limited, a consortium of eight research-intensive universities in the North of England, securing initial funding of £6m from Regional Development Agencies. His earlier career was in molecular biology research with MRC Laboratory of Molecular Biology, Celltech Limited and Cancer Research Campaign (now Cancer Research UK). David held or was named on three patents and is the holder of a Lifetime Queen’s Award for Enterprise Promotion for creating ‘environments that favour enterprise, specialising in the practical aspects of commercialising the results of academic research’ External Appointments: David is a Director of Cambridge KT Limited, Trustee of Cambridge United Charities, Chair of Fitzwilliam Museum (Enterprises) Limited, Trustee of The Trinity Challenge, a Governor of Coventry University Group and Treasurer of the César and Celia Milstein Foundation. Committee Memberships: Audit (Chair), and Remuneration (Member). R E P O R T G O V E R N A N C E 33 The Board continued Ruth Anderson Tara Cemlyn-Jones Andy Gueritz Independent Non-Executive Director Appointment Date: 25 May 2021 Skills and Experience: Tara has over 30 years’ experience in financial services namely in capital markets, M&A, strategy and digital transformation across many sectors, including financial services (banking, asset & wealth management,and fintech), energy & infrastructure and healthcare. Tara was head of M&A at Lastminute. com and has held senior positions at Schroders, Citigroup and Espirito Santo Investment Bank. External Appointments: 25x25 Limited. Committee Memberships: None Independent Non-Executive Director Appointment Date: 1 February 2018 Skills and Experience: Ruth has over 15 years’ experience in the fields of security, intelligence, cyber crime and risk management. She brings to the Board extensive experience across defence and law enforcement sectors and within financial services, developing and implementing cyber risk governance frameworks. Ruth is currently Chief Operating Officer for Technology, Security and Data divisions at Lloyds Banking Group. She was previously a Director of Cyber in the Financial Services Department of KPMG. She served as the Head of Specialist Operational Support and also as the Head of Intelligence at the Child Exploitation and Online Protection Centre, where she delivered the first-ever strategic threat assessment on child abuse in the online environment. Prior to this, Ruth served in intelligence and security in the British Army. External Appointments: Halifax Share Dealing Limited. Committee Memberships: Audit (member), Remuneration (Member) and Nomination (Member). Independent Non-Executive Director Appointment Date: 21 September 2015 Skills and Experience: Andy is an experienced Senior Advisor with a successful track record in helping clients improve and transform their business by managing technology better and creating new technology-based ventures. In recent years, Andy has advised clients in a broad range of industries on topics such as business/technology strategy and investment planning; customer data analytics; transformation for innovation and agility; performance improvement and cost optimisation, and other ways using technology to get and deliver better value. Before becoming a consultant, he attained Board-level responsibility in a successful career in software development and systems implementation. Andy is a Chartered Fellow of the BCS (FBCS), Chartered IT Professional (CITP), Chartered Engineer (C.Eng), Fellow of the IET (FIET), and a European Engineer registered at FEANI. He holds a First Class Honours degree in Electrical and Electronic Engineering with Computer Science from Queen Mary University of London. External Appointments: Sixhills Consulting Limited. Committee Memberships: Audit (member), Remuneration (Chair) and Nomination (Chair). 34 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 The Executive board R E P O R T G O V E R N A N C E Tom Ilube CBE Mary Dowd Jake Holloway Chief Executive Officer Chief Financial Officer Chief Product Officer Skills and Experience: Jake has over 30 years of experience in technology across a wide range of industries and roles – including as CTO and Head of Product for two well-known software houses, and as CEO/Founder of an innovative Online Systems House. In his two most recent roles before joining Crossword, he was advising Worldpay on their separation from RBS, and founded Xendpay, a Fintech startup, where he was COO. Jake authored books on project management in 2015 and 2016. Appointment Date: 6 March 2014 Appointment Date: 14 June 2018 Skills and Experience: Tom is founder and CEO of Crossword. Tom served as Chief Information Officer of Egg Banking PLC, which at the time was a pioneering main market listed UK internet bank. Tom chaired the UK Government Technology Strategy Board’s Network Security Innovation panel. He was a member of the High Level Expert Group on cyber security at the International Telecommunication Union (ITU), a Geneva- based UN agency. He was awarded a Doctor of Science (Honoris Causa) by City, University of London, an Honorary Doctor of Technology by the University of Wolverhampton and was appointed a CBE in the 2018 Birthday Honours for services to Technology and Philanthropy. External Appointments: Non-Executive Director of WPP plc and Chair of the RFU. Director of Iternal Limited, Honorary Fellow of St Anne’s College, Oxford and of Jesus College, Oxford and Chair of the African Gifted Foundation. Committee Memberships: None Skills and Experience: Mary brings over 20 years’ experience of working alongside business leaders. She has demonstrated a track record of managing finance teams to ensure timely delivery of relevant financial information to all stakeholders, providing clear leadership, continuous process improvement, and excellent communication. She also brings to Crossword extensive experience of working in acquisitive businesses and providing transactional support. Mary graduated from University College Galway, Ireland and has a postgraduate Diploma in Business Studies from the same university. She is a Fellow of the Chartered Institute of Management Accountants. External Appointments: Trustee at The Groundwork South Trust Limited and member of the Audit and Risk Committee of the University of Essex. Committee Memberships: None www.crosswordcybersecurity.com 35 The Executive board Stuart Jubb Sean Arrowsmith Group Managing Director Group Sales Director Skills and Experience: Stuart joined Crossword from KPMG where he was Associate Director, Defence & Security. Prior to that, he was Chief Operating Officer of a global consulting team of over 200 in KPMG Advisory. Stuart spent nine years as an officer in HM Forces, after Sandhurst, serving in Afghanistan, NATO and elsewhere. Skills and Experience: Sean has over 20 years’ sales experience in cyber/information security and technology. He was previously Group Sales Director at IRM Limited, the World Class Centre in Cyber Security of Altran Technologies SA, the global innovation and engineering consulting firm. Here, Sean was accountable for revenue target achievement across all of IRM’s business streams including consulting, software and training. Prior to that, Sean was responsible for leading consulting sales at Siemens Insight Consulting. 36 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 The Advisory board R E P O R T G O V E R N A N C E Alison Dyer Professor David Stupples Naina Bhattacharya Chair of the Advisory Board Advisory Board Member Advisory Board Member Skills and Experience: Naina Bhattacharya is Global Chief Information Security Officer at Danone S.A., the multinational food product corporation with over 100,000 staff in 120 countries. She is responsible for delivering the cyber security vision and roadmap for the company. Prior to Danone, she worked in consulting and had the privilege of working on complex cyber security and data privacy projects across multiple companies in several industries. She is passionate about diversity and inclusion with a specific interest in increasing the representation of women in technology. Naina holds a BEng in Computer Science from BITS, Pilani, India and a post-graduation in management from the Indian School of Business in Hyderabad. Skills and Experience: Alison Dyer joined ASOS.com in August 2022 as CISO. Prior to this, Alison was CISO at URENCO, a global supplier of enrichment services and fuel cycle products. Alison was responsible for all aspects of their information and cyber security, covering both information and operational technology. Alison has also held the position of Director of GlaxoSmithKline’s (GSK) global cyber security programme, where she led multiple strategic delivery workstreams including security technology, governance, culture, third party management and operational technology security. Alison holds a BEng in Mechanical Engineering from Imperial College, London and an MSc in Information Security from Royal Holloway University. Skills and Experience: David is currently Director of the Centre for Cyber and Security Sciences at City University London. In his early career, he was employed as an engineer in signals intelligence in the Royal Air Force followed by a period of intensive research into surveillance systems at the Royal Signal and Radar Establishment, Malvern. He spent three years developing highly secure communications for surveillance satellites for Hughes Aircraft Corporation in the United States of America. Later, he became a senior partner with PA Consulting Group where he undertook surveillance and intelligence systems research for Ministry of Defence (Navy) and was responsible for consultancy in secure communications and surveillance systems for world-wide clients. Since 2003, David has been researching internet security at City University focused on cyber terrorism and organized cyber crime for both the UK government and commercial companies. However, he still maintains an active interest in radar surveillance research. Professor Stupples is a member of the Defence Scientific Advisory Council (DSAC), the Defence Procurement Agency’s Independent Advisory Board on Systems Integration, and he consults worldwide in cyber intelligence. www.crosswordcybersecurity.com 37 Corporate Governance Report CHAIR’S INTRODUCTION The Directors acknowledge the importance of high standards of corporate governance and have adopted the principles set out in the Quoted Companies Alliance Corporate Governance Code for Small and Mid-Size Quoted Companies (the ‘QCA Code’) 2018, given the Group’s size and the constitution of the Board. The QCA Code sets out a standard of minimum best practice for small and mid-size quoted companies, particularly AIM companies. The Chair and the Board accept the importance and responsibility of setting good corporate culture, values and behaviours. The Board also acknowledges its responsibility in delivering the long-term success of the Company for the benefit of shareholders and other stakeholders. This Corporate Governance Report describes how the Company has applied the principles and standards set out in the Code during the year and, to the extent it has not done so, any deviations from them. It is the Board’s view that the Company has complied with all of the provisions of the Code during the year ended 31 December 2022. operating model (SCC SOM) is supported by our best-selling SaaS platform, Rizikon Assurance, along with cost-effective cyber audits, security testing services and complete managed services for supply chain cyber risk management. Threat detection and response services include our Nightingale AI- based network monitoring, our Trillion™ and Arc breached credentials tracking platforms, and incident response. Crossword’s work in digital identity is based on the World Wide Web Consortium W3C verifiable credentials standard and our current solution, Identiproof, enables secure digital verification of individuals to prevent fraud. Crossword serves medium and large clients including FTSE 100, FTSE 250 and S&P listed companies in various sectors, such as defence, insurance, investment and retail banks, private equity, education, technology and manufacturing and has offices in the UK, Poland, Oman and Singapore. Crossword is traded on the AIM market of the London Stock Exchange. Where appropriate, Crossword will transfer the IP to separate companies in which it will retain a commercial interest. So far, Crossword has been instrumental in the development of two such companies, ByzGen Limited and CyberOwl Limited. 1: ESTABLISH A STRATEGY AND BUSINESS MODEL WHICH PROMOTE LONG-TERM VALUE FOR SHAREHOLDERS 2: SEEK TO UNDERSTAND AND MEET SHAREHOLDER NEEDS AND EXPECTATIONS The Company’s Strategic Report is on pages 3 to 30 of this report. Crossword’s vision is to partner with organisations to keep them secure in the digital world. The Group reduces cyber risks for their clients by providing a portfolio of innovative products and services, powered by university and other research-driven insights. Crossword offers a range of cyber security solutions to help companies understand and reduce cyber security risk. We do this through a combination of people and technology, in the form of SaaS and software products, consulting, and managed services. Crossword’s areas of emphasis are cyber security strategy and risk, supply chain cyber, threat detection and response, and digital identity with recurring revenue models in these four areas. We work with UK universities and our products and services are often powered by academic research-driven insights. In the area of cybersecurity strategy and risk our consulting services include cyber maturity assessments, industry certifications, and virtual chief information security officer (vCISO) managed services. Crossword’s end-to-end supply chain cyber standard Crossword is committed to engaging with its shareholders to ensure that its strategy, business model and performance is clearly understood. The Company communicates with shareholders and potential investors through a variety of channels, including webinars, regular financial reporting, direct contact with its major shareholders and release of regulatory announcements, which are available on its website. Regulatory announcements include details of the Company’s website and the relevant contact at the Company, as well as its professional advisors. The Annual General Meeting (AGM) provides another opportunity for dialogue between shareholders and the Board. The Chair of the Board and of the Committees, together with other Directors, routinely attend the AGM and are available to answer questions raised by the shareholders. At the meeting, each vote, the number of proxy votes received for, against and withheld is announced. The results of the AGM are subsequently published on the Company’s website and released via a regulatory information service provider. 38 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 R E P O R T G O V E R N A N C E A range of corporate information, including all Company announcements, is also available to shareholders, investors and the public on the Company’s corporate website, www.crosswordcybersecurity.com 3: TAKE INTO ACCOUNT WIDER STAKEHOLDER AND SOCIAL RESPONSIBILITIES AND THEIR IMPLICATIONS FOR LONG-TERM SUCCESS Crossword considers it’s relationships with internal and external stakeholders. Apart from our shareholders, our most important stakeholder groups are our employees, our clients and partners. The Board is regularly updated on stakeholder feedback and their potential impact on our business to enable them to understand and consider the feedback in decision- making. The Board understands that maintaining the support of all its stakeholders is paramount for the long-term success of the Company. Employees Crossword aims to provide an environment which will attract, retain and motivate its team. The Company has a growing number of permanent staff employed across the UK, Poland, Oman and Singapore. Employee engagement with the senior management, who pride themselves on their availability and flexibility, is frequent through daily discussions and meetings. Staff are encouraged to give regular feedback in relation to their needs, interests and expectations on away days, general discussions or one-to-one meetings with their line managers. These can then be addressed at the fortnightly management meeting to all senior members of the team where further actions will be discussed. Furthermore, the team engages in a bi-weekly call where staff are able to communicate with all levels of the team across all jurisdictions. Crossword reviews its processes and policies, which are guided by our values of Responsibility, Openness, Learning and Flexibility, to make continuous improvements for its staff. The Company has developed its induction programme for new staff, engages with employees to maintain its culture and values and expected behaviours, performs exit interviews in the event people decide to leave the business, and follow-up interviews with new employees. Crossword is supportive of career development of its employees and provides training programmes and Masters degree opportunities where appropriate. Crossword’s clients and partners Crossword develops mutually beneficial commercial relationships with companies to support sourcing and commercialising cyber security intellectual property originating from university and other research projects and evaluating and exploiting routes to distributing and reselling its products. Crossword recognises that the establishment of a close working relationship with its partners is essential for its long-term success. Crossword maintains its relationship with its partners through regular meetings, mutual understanding and aligned objectives. Feedback from partners is communicated to the relevant teams and the Board as appropriate. Crosswords interacts closely with its clients to understand the cyber issues organisations are facing, in order to support clients and help them to reduce cyber risks. Crossword provides a portfolio of innovative products and services, aimed at addressing risks clients have identified. Social responsibility Crossword partners with charities both in UK and Poland. Crossword employees propose and vote on which charity they would like to support. Previously work has been undertaken to help a charity local to the London office in their efforts to support the homeless and lead them to independence and also a national mental health charity. In Poland, Crossword is supporting one of the largest, most recognisable and effective social schemes in Poland which implements and develops a system of smart, personalised aid that is unique in the world. 4: EMBED EFFECTIVE RISK MANAGEMENT, CONSIDERING BOTH OPPORTUNITIES AND THREATS, THROUGHOUT THE ORGANISATION Audit, risk and internal control Financial controls The Group has an established framework of internal financial controls, the effectiveness of which is regularly reviewed by the Executive Management, the Audit Committee and the Board, in light of an ongoing assessment of significant risks facing the Group. • The Board is ultimately responsible for the effectiveness of the Group’s system of internal controls. Its key strategy has been to establish financial reporting procedures that provide the Board of Directors with a reasonable basis upon which to make judgements as to the financial position and prospects of the Group. Executive Directors and Non- Executive Directors have been appointed by the Board to www.crosswordcybersecurity.com 39 assist with the implementation of this strategy and report progress to the Board. • The Audit Committee has the primary responsibility for monitoring the quality of internal controls to ensure that the financial performance of the Group is properly measured and reported on. It receives and reviews reports from the Group’s management and external auditors relating to the interim and annual accounts and the accounting and internal control systems in use throughout the Group. The Audit Committee meets not less than three times in each financial year and has unrestricted access to the Group’s external auditors. • Regular budgeting and forecasting is conducted to monitor the Group’s ongoing cash requirements and cash flow forecasts are circulated to the Board. • The Group has a Risk Register which identifies the potential possibility and impact of risks associated with the Group and allocates an owner to mitigate each risk. The Risk Register is updated by the Chief Financial Officer and reviewed by the Executive, the Audit Committee and the Board. Non-financial controls The Board has ultimate responsibility for the Group’s system of internal control and for reviewing its effectiveness. However, any such system of internal control can provide only reasonable, but not absolute, assurance against material misstatement or loss. The Board considers that the internal controls in place are appropriate for the size, complexity and risk profile of the Group. The principal elements of the Group’s internal control system include: • Close management of the day-to-day activities of the Group by the Executive Directors; • An organisational structure with defined levels of responsibility, which promotes entrepreneurial decision- making and rapid implementation whilst minimising risks; • Central control over key areas such as capital expenditure authorisation and banking facilities; • A comprehensive annual budgeting process producing a detailed integrated profit and loss, balance sheet and cash flow, which is approved by the Board; and • Detailed monthly reporting of performance against budget. The Group continues to review its system of internal control to ensure compliance with best practice, whilst also having regard to its size and the resources available. Standards and policies The Board is committed to maintaining appropriate standards for all the Group’s business activities and ensuring that these standards are set out in written policies. Key examples of such standards and policies include: • Anti-bribery and Corruption Policy • Information Security Policy • Data Protection Policy • Share Dealing Code. All policies are documented and senior managers and Directors are responsible for monitoring the compliance with these policies. Approval process An approvals matrix exists and is published on the Company’s intranet to ensure clear and appropriate levels of authority across the business. 5: MAINTAINING THE BOARD AS A WELL-FUNCTIONING, BALANCED TEAM, LED BY THE CHAIR Composition, qualification and independence of the board The Board comprises six Non-Executive and two Executive Directors. The names and responsibilities of the current Directors, together with their biographical details, are set out on pages 32 to 37. 37.5% of the Board are female. 62.5% of the Board are male. The Board considers each of the Non-Executive Directors to be independent in character and judgement. Two of the Non-Executive Directors do not meet the strict criteria for independence set out in the QCA Code, due to their participation in the Company’s share option arrangements, as part of their remuneration arrangements. The Board considers that the ownership of shares and participation in the Company’s share options to certain of the Non-Executive Directors encourages the alignment of their interests with those of the Company’s shareholders and are not material enough to compromise their independence, character and judgement. Therefore, the Company considers all Non-Executive Directors to be independent for the purposes of the QCA Code. The Non-Executive Directors provide independent, robust and constructive challenge to the Executive Management and monitor the performance of the management team in delivering the agreed objectives. 40 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 All Directors have disclosed their other significant commitments and confirmed that they have sufficient time to discharge their duties effectively. Appointment and tenure The Board makes decisions regarding the appointment and removal of Directors and there is a formal, rigorous and transparent procedure for appointments, some of which has been delegated to the Nomination Committee. Appointments are made on merit, taking account of the balance of skills, experience and knowledge required. The Company’s Articles of Association require that all Directors retire by rotation at regular intervals and that any new Directors appointed during the year must stand for election at the AGM immediately following their appointment. 6: ENSURE THAT, BETWEEN THEM, THE DIRECTORS HAVE THE NECESSARY UP-TO-DATE EXPERIENCE, SKILLS AND CAPABILITIES The Board believes that its composition brings a desirable range of skills and experience to address the Group’s challenges and opportunities, while at the same time ensuring that no individuals or a small group of individuals can dominate the Board’s decision-making. The current Board, although considered to have a sufficient level of skills in all areas of the business, is always looking to improve and further its knowledge of the industry. All Directors receive regular and timely information on the Group’s operational and financial performance and on technical issues. R E P O R T G O V E R N A N C E An Advisory Board exists to advise and support the main Board. The Advisory Board is not a formal Committee of the Company’s Board. The Advisory Board considers specific cyber security projects that the Company is interested in and share its views on them, ranging from technical innovation, engineering complexity, business viability, attractiveness to partners and investors and any other observations that the Advisory Board has. It also considers and shares thoughts on major trends in cyber security that the Company may want to engage in and share its views on the trends that the Company believes are important. Induction Upon appointment, all Directors are provided with training in respect of their legal, regulatory and governance www.crosswordcybersecurity.com 41 responsibilities and obligations, in accordance with the UK regulatory regime. The induction includes face-to-face meetings with Executive Management and site visits to orientate and familiarise the new Directors with the Company’s industry, organisation, business, strategy, commercial objectives and key risks. The Board is kept up to date on legal, regulatory and governance matters at Board meetings. Additional training is available on request, where appropriate, so that Directors can update their skills and knowledge as applicable. Independent advice All Directors are able to take independent professional advice in the furtherance of their duties, if necessary, at the Company’s expense. In addition, the Directors have direct access to the advice and services of the Company Secretary and Chief Financial Officer. 7: EVALUATE BOARD PERFORMANCE BASED ON CLEAR AND RELEVANT OBJECTIVES, SEEKING CONTINUOUS IMPROVEMENT Board effectiveness review The Board undertook a further evaluation of its performance for the during the financial year and has continued throughout the year to measure progress against the recommendations resulting from the Board evaluation and will continue to assess its effectiveness in implementing new processes to achieve the recommendations. Furthermore, the Board conducted an evaluation in January 2023 to assess current performance and the progress made against the key focus areas. The Nomination Committee and Board were satisfied that previous recommendations and focus areas had been implemented and were being continually assessed. The Nominations Committee will regularly review the structure, size and composition (including the skills, knowledge, independence, experience and diversity) of the Board and make recommendations concerning plans for succession for both Executive and Non-Executive Directors and in particular for the key roles of Chair and Chief Executive Officer. 8: PROMOTE A CORPORATE CULTURE THAT IS BASED ON ETHICAL VALUES AND BEHAVIOURS The Board is committed to promoting a strong ethical and values-driven culture throughout the Company and has a people-oriented ethos where hard work and commitment are recognised. The Company has articulated its values as Responsibility, Openness, Learning and Flexibility, and develops its values and expected behaviours on an ongoing basis. Crossword also recognises that employees will have interests outside work and consequently supports flexibility around these interests. Further details on how the board monitors and assesses the state of the corporate culture are included in the Directors’ Report. 9: MAINTAIN GOVERNANCE STRUCTURES AND PROCESSES THAT ARE FIT FOR PURPOSE AND SUPPORT GOOD DECISION-MAKING BY THE BOARD The role of the Board The Board is responsible for the long-term success and strategic leadership of the Group. It is responsible for reviewing, formulating and approving the strategy of the Group and its subsidiaries, corporate actions and overseeing the Group’s progress towards its goals. In addition, it also approves the annual and interim results and monitors the exposure to key business risks. The Board’s full responsibilities are set out in a schedule of matters reserved for the Board. The matters reserved for the attention of the Board include: • The approval of interim and annual financial statements, dividends and significant changes in accounting practices; • Review of bi-monthly financial statements; • Board membership, reviewed by NOMAD, and powers including the appointment and removal of Board members, determining the terms of reference of the Board and establishing the overall control framework; • AIM-related issues including the approval of communications to the London Stock Exchange and communications with shareholders will be dealt with by the Market Disclosure Committee and reviewed by the NOMAD, or delegated by the Board to the Executive Directors; • Senior management, remuneration, contracts, and the grant of share options will be addressed by the Remuneration Committee; • Key commercial matters where the financial commitment is 42 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 in excess of £50,000 per annum; • Taking of loans or other credit; • Financial matters including the approval of the budget and financial plans and performance against such plans and budgets; • Approval of the appointment of the current period auditor, year-end audited statutory accounts and audit-related queries addressed by the Audit Committee; • Risk management review; • Changes to the Company’s capital structure, its business strategy, acquisitions and disposals of businesses, and capital expenditures outside of budget approval; and • Other matters including, but not limited to, health and safety policy, insurance and legal compliance. Role of the Chair and Chief Executive Officer There is a clear division of responsibility at the head of the Company. The Chair is responsible for running the business of the Board and for ensuring appropriate strategic focus and direction, whilst the Chief Executive Officer is responsible for proposing the strategic focus to the Board, implementing it once approved, and overseeing the management of the Company through the Executive Management. The Chief Executive Officer is also responsible for communicating with shareholders, assisted by the Chief Financial Officer. This separation of responsibilities is clearly defined and agreed by the Board. Board and Committee meetings The Board meets at least six times each year, in accordance with its scheduled meeting calendar (these may be supplemented by additional meetings as and when required) to review, formulate and approve the Group’s strategy, budgets, corporate actions and oversee the Group’s progress towards its goals. At each meeting, the Board considers a number of matters, which include technical, operational, financial, risk and corporate governance reports, in addition to an update from its Committees, where applicable. Any Director can challenge proposals, and decisions are taken democratically after discussion. Any Director who feels that any concern remains unresolved after discussion may ask for that concern to be noted in the minutes of the meeting, which are then circulated to all Directors. Specific actions arising from such meetings are agreed by the Board or relevant committee and then followed up by Management. The Group has established an Audit Committee, a Remuneration Committee, and a Nomination Committee, each with formally delegated duties and responsibilities outlined within terms of reference reviewed and approved by the Board on an annual basis. R E P O R T G O V E R N A N C E From time to time, separate committees may be set up by the Board to consider specific issues when the need arises. The Board and its Committees are supported by the Company Secretary, who ensures that the Board receives regular and timely information ahead of each meeting. A formal agenda is produced for each meeting and the Company Secretary distributes papers several days before meetings take place to provide the Board with sufficient time to consider the matters to be discussed. Each Committee has access to such resources, information and advice as it deems necessary, at the cost of the Company, to enable it to discharge its duties. The table below sets out the attendance record of individual Directors at the scheduled and unscheduled Board meetings held during the year: Name Richard Dearlove Tom Ilube Andy Gueritz Ruth Anderson David Secher Mary Dowd Tara Cemlyn Jones Robert Coles* * Robert Coles was appointed to the Audit Committee during the year. Board Meetings 5/6 6/6 6/6 6/6 6/6 6/6 5/6 6/6 Audit – – 2/2 1/2 2/2 – – 1/1 Nomination – – 2/2 2/2 – – – 2/2 Remuneration – – 2/3 3/3 3/3 – – – www.crosswordcybersecurity.com 43 PRINCIPLE 10: COMMUNICATE HOW THE COMPANY IS GOVERNED AND IS PERFORMING BY MAINTAINING A DIALOGUE WITH SHAREHOLDERS AND OTHER RELEVANT STAKEHOLDERS The Board attaches considerable importance to the maintenance of constructive relationships with shareholders and its other stakeholders. As mentioned above, the Company communicates with shareholders through the Annual Report and accounts, full-year and half- year results announcements, the AGM and one-to-one meetings with large existing or potential new shareholders. The Company regularly releases regulatory and other announcements covering operational and corporate matters. A range of corporate information (including all Company announcements) is also available to shareholders, investors and the public on the Company’s corporate website, www.crosswordcybersecurity.com including: • Our Articles of Association and admission document; • A detailed account of how we have applied the principles of the QCA Code; • Latest Crossword Cybersecurity news and press releases; and • Annual and Interim Reports. The Board receives regular updates on the views of shareholders through briefings from the Chief Executive Officer, Chief Financial Officer and the Company’s brokers. SIR RICHARD DEARLOVE KCMG OBE Chair 18 April 2023 44 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 R E P O R T G O V E R N A N C E AUDIT COMMITTEE REPORT I am pleased to present the Committee’s report for the year ended 31 December 2022. The following pages provide an insight into how the Committee discharged its responsibilities during the year and the key topics that it considered in doing so. The role of the Audit Committee is to monitor the integrity of the Group’s Financial Statements, including its annual and half- yearly reports and any other formal statements relating to its financial performance. It monitors and reviews the effectiveness of the Group’s system of internal financial control systems that identify, assess, manage and monitor financial risks, and other internal control and risk management systems. Committee membership and governance The Audit Committee is comprised of four independent Non- Executive Directors, currently David Secher, Ruth Anderson, Andrew Gueritz and Robert Coles. David Secher, Chair of the Committee, is considered by the Board to have recent and relevant financial experience and the Committee as a whole has competence relevant to the sector in which the Company operates. At the request of the Chair of the Committee, the Chief Executive Officer, Chief Financial Officer and other members of the senior management team may also be invited to attend meetings as guests. The Audit Committee aims to meet twice in each financial year and has unrestricted access to the Group’s external Auditor. The Committee works to a planned programme of activities focused on key events in the annual financial reporting cycle and standing items that it considers regularly under its Terms of Reference. Principal activities during the year The Committee held two meetings during the year under review and considered the following: • The external Auditor’s 2021 year-end audit report and opinion; • The Company’s Report for the financial year ended 31 December 2021 and the related results announcements and the Half-Yearly Report to 30 June 2022; • Evaluation of the performance of the external Auditor including their independence, objectivity and the effectiveness of the audit process; • The re-appointment of MHA MacIntyre Hudson as the external Auditor for the Company; • The Committee’s Terms of Reference; and • The Company’s Risk Register as well as the internal controls and risk management systems in place. The Committee is planning the following activities during 2023: • Review the Company’s procedures, systems and controls for the prevention of bribery or fraud; • Review the adequacy and security of the Company’s arrangements for its employees to raise concerns, in confidence, about possible wrongdoing in financial reporting or other matters. The Committee shall ensure that these arrangements allow proportionate and independent investigation of such matters and appropriate follow-up action; • Review and approve the FY23 external Auditor’s plan, including the proposed materiality threshold, the scope of the audit, the significant audit risks and fees; • Review the Committee’s internal audit role, in the absence of an external provider of an internal audit service; and • Risk – review and challenge the Risk Register, and consider the risk appetite of the business. The Committee members’ attendance at meetings during the year is set out on page 43. External Auditor MHA MacIntyre Hudson has been the external Auditor of the Group since 2014. The continued appointment of MHA MacIntyre Hudson is reviewed by the Committee each year, taking into account the relevant legislation, guidance and best practice appropriate for a Company of Crossword’s size, nature and stage of development. The Committee considers a number of areas when reviewing the external Auditor appointment, namely its performance in discharging the audit, the scope of the audit and terms of engagement, its independence and objectivity, and its reappointment and remuneration. The breakdown of fees between audit and non-audit services paid to MHA MacIntyre Hudson during the financial year is set out in Note 10 to the Group’s Consolidated Financial Statements. The non-audit fees relate to tax advice. Following Implementation of the Revised Ethical Standard by MHA MacIntyre Hudson, non-audit services have ceased. www.crosswordcybersecurity.com 45 Internal audit Board effectiveness review The Audit Committee presently considers it appropriate that the Group uses the audit committee to undertake the internal audit function. This is due to the effectiveness of the Group’s internal financial control systems that identify, assess, manage and monitor financial risks, and other internal control and risk management systems, and the close involvement of the Executive Directors and senior management on a day-to-day operational basis. However, the need for an internal audit function will be kept under review by the Audit Committee on behalf of the Board. DAVID SECHER Chair, Audit Committee 18 April 2023 NOMINATION COMMITTEE REPORT The Nomination Committee is responsible for reviewing the composition of the Board taking into account the skills, experience and diversity of the Directors in light of the challenges and opportunities facing the Company and makes recommendations for the appointment and reappointment of Board members. Committee membership and governance The Nomination Committee is chaired by Andrew Gueritz and its other members are Ruth Anderson and Robert Coles. Under the Committee’s Terms of Reference, the Committee is required to meet at least twice in each financial year and must comprise of at least three members, two of whom must be independent Non-Executive Directors. The Committee held two meetings during the year. The Committee members’ attendance at meetings during 2022 is set out on page 43. In compliance with the QCA Code, the Board undertook an evaluation of its performance in January 2022. The evaluation was conducted by way of a questionnaire designed to assess the effectiveness of the Board, the Directors and the Chair, as well as the Board’s Committees and identify any areas for improvement. The results of the evaluation were presented to the Board for review in early April 2022 and revealed no significant concerns amongst Directors about the effectiveness of the Board. Actions arising from recommendations to further improve the effectiveness of the Board are being implemented and include the review of succession plans for key members of management and Board members. Diversity The Company has not adopted a formal policy on diversity and, therefore, has no measurable objectives to disclose. Appointments, including appointments to the Board and senior management positions, are made on merit, taking account of the balance of skills and experience required. Key areas of focus for 2023: • Review the time committed to the development of individual Directors and the Board as a whole; • Review succession plans for both Executive and Non-Executive Directors and, in particular, for the key roles of Chair and Chief Executive Officer; and • Conduct a further internal evaluation of the Board, its Committees and individual Directors, to assess improvements in the key focus areas, using questionnaires. ANDREW GUERITZ Chair, Nomination Committee 18 April 2023 46 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 REMUNERATION COMMITTEE REPORT Mary Dowd (Chief Financial Officer) The Remuneration Committee is responsible for determining and agreeing with the Board the framework or broad policy for the remuneration of all Executive Directors, the Chair of the Board, including pension rights and any compensation payments, and such other members of the senior management as it is designated to consider. In addition, the Committee makes recommendations to the Board on proposals for the granting of share options and other equity incentives, pursuant to any employee share option scheme or equity incentive plans in operation from time to time. Committee membership and governance The Remuneration Committee is a formal committee of the Board and has powers delegated to it under the Articles of Association. Its remit is set out in Terms of Reference formally adopted by the Board, which are reviewed annually. The Remuneration Committee is currently comprised of Andrew Gueritz (as Chair), David Secher and Ruth Anderson. The Committee meets at least once in each financial year and held three meetings during the year. The Committee members’ attendance at meetings during the year is set out on page 43. Letters of appointment, service contracts and termination Tom IIube (Chief Executive Officer) Tom Ilube is appointed as Chief Executive Officer under an Executive service contract dated 1 April 2014 (as amended). The employment commenced on 1 April 2014 and will continue unless terminated by either party giving 12 months’ written notice. The Company may terminate the contract without notice (or with payment in lieu of notice) if, inter alia, Tom is guilty of gross misconduct, commits a serious breach of the employment contract, commits a criminal offence, is declared bankrupt or becomes of unsound mind. The Company may, after giving or receiving notice of termination, immediately end the employee’s employment and make payment in lieu of salary with no other benefit for the remaining period of notice. R E P O R T G O V E R N A N C E Mary Dowd is employed as Chief Financial Officer under an employee service contract dated 10 May 2018. The employment commenced on 16 May 2018 and will continue unless terminated by either party giving six months’ written notice. The Company may terminate the contract on shorter notice if the employee is absent from work for an extended period through sickness or injury and may terminate without notice (or with payment in lieu of notice) if, inter alia, Mary is guilty of gross misconduct, commits a serious breach of the employment contract, commits a criminal offence, is declared bankrupt or becomes of unsound mind. The Company may, after giving or receiving notice of termination, immediately end the employee’s employment and make payment in lieu of salary with no other benefit for the remaining period of notice. Following termination of employment, Mary is subject to certain restrictions for a period of six months, including a restriction on dealing with the Company’s customers and suppliers and from working for a competing business. Non-Executive Directors All Non-Executive Directors, including the Chair, serve on the basis of letters of appointment which are terminable by three months’ written notice and are available for inspection at the Company’s registered office. Subject to continued satisfactory performance, the Board does not think it appropriate at this time to limit the term of appointment of the Non-Executive Directors. The Executive Directors’ service contracts are also available for inspection at the Company’s registered office. The remuneration of the Directors who served in the current year was as follows: www.crosswordcybersecurity.com 47 The remuneration of the Directors who served in the current year was as follows: Executive Directors Tom Ilube* Mary Dowd Non-Executive Directors Sir Richard Dearlove Ruth Anderson Andy Gueritz Dr David Secher Robert Coles Tara Cemlyn-Jones Total Basic Salary and Fees £ 130,000 140,000 25,000 12,000 16,000 16,000 12,000 12,000 362,999 Bonus £ – 10,000 – – – – – – 10,000 Taxable Benefits £ 3,926 2,216 25,000 – – – – – 31,142 Employer’s Pension Contribution £ Total £ 1,321 10,000 135,247 162,216 – – – – – – 11,321 50,000 12,000 16,000 16,000 12,000 12,000 415,462 Directors’ shareholdings and share interests The table below sets out the Directors’ interests in the ordinary shares of the Company as at 31 December 2022. There have been no changes in the current Directors’ interests in shares or options granted by the Company between the end of the financial year and 18 April 2023. Name Tom Ilube* Dr David Secher Number of Issued Ordinary Shares 14,560,250 263,650 % of Issued Shares 15.76% 0.29% * Tom Ilube’s shareholding is made up of 12,255,810 shares held by him personally and 1,304,440 held by Share Nominees Limited on his behalf. 48 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 SHARE OPTION AND INCENTIVISATION ARRANGEMENTS The Board considers employee share ownership to be an important part of its strategy for employee incentivisation and retention. The Group has established share option programmes that entitle certain employees to purchase shares in the Company. These were issued in July 2014, November 2014, July 2015, December 2015, January 2016, June 2016, September 2016, June 2017, January 2018, May 2018, July 2018, October 2018, June 2019, November 2019, June 2020, October 2020, August 2021, November 2021 and March 2022. There are no performance conditions attaching to these options, other than to awards made under the Long-Term Incentive Plan awards issued in Nov 2021. The Directors hold the following shares under option: Name Sir Richard Dearlove Sir Richard Dearlove Sir Richard Dearlove Sir Richard Dearlove Sir Richard Dearlove Sir Richard Dearlove Dr David Secher Mary Dowd Mary Dowd Mary Dowd Number of Ordinary Shares under option 131,580 67,570 45,870 52,080 94,340 70,423 150,000 79,360 100,000 25,000 Exercise Price 19p 37p 54.5p 48p 26.5p 35.5p 5.4p 31.5p 54.5p 30.5p Date of grant 03/10/2016 25/05/2018 04/06/2019 28/11/2019 16/10/2020 10/08/2021 18/07/2014 24/10/2018 04/06/2019 18/06/2020 R E P O R T G O V E R N A N C E Vesting Conditions 1 1 1 1 1 1 1 1 1 1 Expiry Date 03/10/2026 25/05/2028 04/06/2029 28/11/2029 16/10/2030 10/08/2031 17/07/2024 24/10/2028 04/06/2029 18/06/2030 (1) Option Shares to vest in three equal tranches on the first, second and third anniversary of the date of grant. In addition, the Company has issued 1,036,790 options to members of staff and up to 3,000,000 share options to Executives. EMI SHARE OPTION PLAN The Company has established an enterprise management incentive share option plan under scheme rules dated 21 May 2014 (‘EMI Option Plan’) for the purposes of recruiting and retaining its staff. The Company may grant an Option intended to be a qualifying option under the Income Tax (Earnings and Pensions) Act 2003 (‘ITEPA 2003’) (‘EMI Option’) to any eligible employee it chooses, subject to the limitations and conditions of the EMI Option Plan. EMI Options may not be granted where prohibited by law or any corporate governance code which applies to the Company or after the tenth anniversary of the date of the EMI Option Plan. Long-Term Incentive Plan During the 2021, the Company implemented a Long-Term Incentive Plan (LTIP) whereby awards were made to the following Executives – Mary Dowd, Stuart Jubb, Jake Holloway and Sean Arrowsmith. Each award is of nominal cost (0.5p) options to acquire up to 750,000 Crossword ordinary shares of 0.5p each which vest at the average mid-market price of the Ordinary Shares over the 20 trading days preceding the end of the performance period which ends on 30 September 2024. 25% of the options will vest if the Award Price is 50p, and 100% will vest if the Award Price is equal to or greater than 100p, with straight-line vesting between 50p and 100p. ANDREW GUERITZ Chair, Remuneration Committee 18 April 2023 www.crosswordcybersecurity.com 49 Directors’ Report & Statement of Directors’ Responsibilities DIRECTORS’ REPORT This Directors’ Report includes the information required to be included under the Companies Act 2006 or, where provided elsewhere, an appropriate cross-reference is given. The Corporate Governance Report approved by the Board is provided on pages 32 to 53 and incorporated by reference into this Directors’ Report. Principal activity, review of the business and future developments Crossword Cybersecurity PLC (08927013) is a public company, limited by shares, incorporated in the United Kingdom under the Companies Act, with operations in the UK, Poland, Oman and Singapore. Its shares are traded on AIM, a sub-market of the London Stock Exchange (‘AIM’). Crossword offers a range of cyber security solutions to help companies understand and reduce cyber security risk. We do this through a combination of people and technology, in the form of SaaS and software products, consulting, and managed services. Crossword’s areas of emphasis are cyber security strategy and risk, supply chain cyber, threat detection and response, and digital identity and the aim is to build up a portfolio of cyber security products and services with recurring revenue models in these four areas. We work with UK universities and our products and services are often powered by academic research-driven insights. In the area of cybersecurity strategy and risk our consulting services include cyber maturity assessments, industry certifications, and virtual chief information security officer (vCISO) managed services. Crossword’s end-to-end supply chain cyber standard operating model (SCC SOM) is supported by our best-selling SaaS platform, Rizikon Assurance, along with cost-effective cyber audits, security testing services and complete managed services for supply chain cyber risk management. Threat detection and response services include our Nightingale AI- based network monitoring, Nixer to protect against application layer DDoS attacks, our Trillion™ and Arc breached credentials tracking platforms, and incident response. Crossword’s work in digital identity is based on the World Wide Web Consortium W3C verifiable credentials standard and our current solution, Identiproof, enables secure digital verification of individuals to prevent fraud. Crossword serves medium and large clients including FTSE 100, FTSE 250 and S&P listed companies in various sectors, such as defence, insurance, investment and retail banks, private equity, education, technology and manufacturing and has offices in the UK, Poland, Oman and Singapore. Crossword is traded on the AIM market of the London Stock Exchange. More details on the strategy, nature of the Group’s operations and future developments are set out in the Strategic Report on page 3. Share capital and rights attaching to the shares The number of shares in issue as at the date of publication of this report was 93,717,641 (31 December 2021: 74,957,150 ordinary shares of 0.5 pence) ordinary shares of 0.5 pence, each with one vote. In accordance with applicable laws and the Company’s Articles of Association, holders of ordinary shares are entitled to: • Receive shareholder documentation including the notice of any general meeting; • Attend, speak and exercise voting rights at general meetings, either in person or by proxy; and • A dividend, where declared and paid out of profits available for such purposes. On a return of capital on a winding up, holders of ordinary shares are entitled to participate in such a return. Articles of Association The Company’s Articles of Association can only be amended by special resolution and are available at www.crosswordcybersecurity.com Engagement with employees Crossword aims to provide an environment which will attract, retain and motivate its team. The Company has a growing number of permanent staff employed across the UK, Poland, Oman and Singapore. Employee engagement with the senior management, who pride themselves on their availability and flexibility, is frequent through daily discussions and meetings. Staff are encouraged to give regular feedback in relation to their needs, interests and expectations on away days, general discussions or one-to-one meetings with their line managers. These can then be addressed at the fortnightly management meeting to all senior members of the team where further actions will be discussed. Furthermore, the team engages in a bi-weekly call where staff are able to communicate with all levels of the team across all jurisdictions. Crossword reviews its processes and policies, which are guided by our values of Responsibility, Openness, Learning and Flexibility, to make continuous improvements for its staff. 50 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 R E P O R T G O V E R N A N C E The Company has developed its induction programme for new staff, engages with employees to maintain its culture and values and expected behaviours, performs exit interviews in the event people decide to leave the business, and follow-up interviews with new employees. Crossword is supportive of career development of its employees and provides training programmes and Masters degree opportunities where appropriate. With the continuing growth in staff numbers, the Directors recognise the need to ensure excellence in engagement with employees. Regular staff away days take place and engagement survey are undertaken, with feedback from staff forming a prioritised action plan. Included was an action to ensure that the Company’s culture is maintained during its growth. To this effect, a project to define the Company’s culture was started. At the end of this project, the Company was in a position to state its values and expected behaviours. The values were shared with all staff at an away day in February 2020. Engagement with charities was an action from an away day. Crossword partners with charities both in UK and Poland. Crossword employees propose and vote on which charity they would like to support. Previously work has been undertaken to help a charity local to the London office in their efforts to support the homeless and lead them to independence and also a national mental health charity. In Poland, Crossword is supporting one of the largest, most recognisable and effective social schemes in Poland which implements and develops a system of smart, personalised aid that is unique in the world. More details are available on page 26. Sustainability and climate change The group is not required to required to disclose climate- related financial information and does not need to comply with SECR. However, the Directors take their responsibilities relating to the environment seriously and aim to minimise the impact of the Company’s activities on the environment. The key points of their strategy to achieve this are: • Minimise waste by evaluating operations and ensuring they are as efficient as possible; • Minimise toxic emissions through the selection and use of its power requirement; • Actively promote recycling; • Source and promote a product range to minimise the environmental impact of both production and distribution; and • Meet or exceed all the environmental legislation that relates to the Company. www.crosswordcybersecurity.com 51 Powers of Directors Political donations The Directors may exercise powers subject to applicable legislation and regulations and the Company’s Articles of Association. The Directors in office at the date of this Annual Report are shown on pages 32 to 34. Directors’ conflict of interest The Board may authorise, to the fullest extent permitted by law, any matter which, if not so authorised, would or may result in a Director infringing their duty to avoid a situation in which they can have a direct or indirect interest that conflicts, or possibly may conflict, with the interests of the Company and which may reasonably be regarded as likely to give rise to a conflict of interest. The Company has effective procedures in place to monitor and deal with conflicts of interest. The Board is aware of the other commitments and interests of its Directors, and changes to these commitments and interests are reported to and, where appropriate, agreed with the rest of the Board. Directors’ insurance and indemnity The Group maintains Directors’ and Officers’ liability insurance which gives appropriate cover for any legal action brought against its Directors. In accordance with Section 234 of the Companies Act 2006, qualifying third-party indemnity provisions are in place for the Directors in respect of liabilities incurred as a result of their office to the extent permitted by law. Purchase of own shares The Company has not acquired any of its own shares in the period to 31 December 2022, nor in the period up to the date of approval of this Annual Report. Subsequent events There are no events after the reporting date to be disclosed. Dividend The Directors do not intend that the Company will declare a dividend in the near term, but instead channel the available cash resources into funding the expansion of the Group. The Board intends to commence the payment of dividends only when it becomes commercially prudent to do so, having regard to the Group’s earnings, financial position, cash requirements and availability of distributable profits, as well as the provisions of relevant laws and/or generally accepted accounting principles from time to time. No political donations have been made during this financial year. Principal shareholder Tom Ilube is the Company’s principal shareholder, holding a total of 14,560,250 ordinary shares, representing 15.76% of the voting rights attached to the current issued share capital of the Company. Of the 14,560,250 shares are held, 12,255,810 shares held by Tom Ilube and 1,304,440 held by Share Nominees Limited. Annual General Meeting The Annual General Meeting of the Company will be held on the 11 May 2023 at 3.00 pm at the offices of Shakespeare Martineau LLP, 6th Floor, 60 Gracechurch Street, London EC3V 0HR. The Notice of Meeting will be available to view on the Company’s website in advance of that meeting. Approval of Directors’ Report This Directors’ Report, including the Corporate Governance Statement and Strategic Report, was approved for and on behalf of the Board on 18 April 2023. STATEMENT OF DIRECTORS’ RESPONSIBILITIES IN RESPECT OF THE ANNUAL REPORT AND THE FINANCIAL STATEMENTS The Directors are responsible for preparing the Annual Report and the financial statements in accordance with applicable law and regulations. Company law requires the Directors to prepare financial statements for each financial year. Under that law, the Directors have elected to prepare the consolidated and parent company financial statements in accordance with International Accounting Standards as adopted in the United Kingdom (“UK adopted IFRS”). Under Company law, the Directors must not approve the financial statements unless they are satisfied that they give a true and fair view of the state of affairs and profit or loss of the Group and parent company for that period. In preparing the financial statements, the Directors are required to: • Select suitable accounting policies and then apply them consistently; 52 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 description of the principal risks and uncertainties that they face; • The Annual Report and accounts, taken as a whole, is fair, balanced and understandable and provides the information necessary for the shareholders to assess the Group and parent company’s position, performance, business model and strategy; and • The Strategic Report includes a fair review of the development and performance of the business and the position of the Group and parent company, together with a description of the principal risks and uncertainties that it faces. DISCLOSURE OF INFORMATION TO THE AUDITOR We, the Directors of the Company who held office at the date of approval of these financial statements as set out above, each confirm, so far as we are aware, that: • There is no relevant audit information of which the Company’s Auditor is unaware; and • We have taken all the steps that we ought to have taken as Directors in order to make ourselves aware of any relevant audit information and to establish that the Company’s Auditor is aware of that information. This Statement of Responsibilities and the Directors’ Report were approved by the Board on18 April 2023. R E P O R T G O V E R N A N C E TOM ILUBE Chief Executive Officer 18 April 2023 Crossword Cybersecurity PLC 60 Gracechurch Street, London EC3V 0HR e: info@crosswordcybersecurity.com twitter: @crosswordcyber t: +44 (0)333 090 2587 • Make judgements and accounting estimates that are reasonable and prudent; • State whether applicable UK adopted IFRS has been followed, subject to any material departures disclosed and explained in the financial statements; and • Prepare the financial statements on the going concern basis, unless it is inappropriate to presume that the Group and parent company will continue in business. The Directors are responsible for keeping adequate accounting records that are sufficient to show and explain the Group and parent company’s transactions and disclose with reasonable accuracy at any time the financial position of the Group and parent company and enable them to ensure that the financial statements and the Directors’ Remuneration Report comply with the Companies Act 2006. They are also responsible for safeguarding the assets of the Group and parent company and, hence, for taking reasonable steps for the prevention and detection of fraud and other irregularities. The Directors are responsible for the maintenance and integrity of the parent company’s website. Legislation in the United Kingdom governing the preparation and dissemination of financial statements may differ from legislation in other jurisdictions. Responsibility Statement of the Directors in respect of the Annual Report and Accounts The Directors consider that the Annual Report and accounts, taken as a whole, is fair, balanced and understandable and provides the information necessary for shareholders to assess the Group and parent company’s position, performance, business model and strategy. Each of the Directors, whose names and functions are listed in the Corporate Governance Section confirm to the best of our knowledge, that: • The parent company and Group financial statements, prepared in accordance with International Financial Reporting Standards in conformity with the requirements of the Companies Act 2006, give a true and fair view of the assets, liabilities, financial position and profit or loss of the Company and the undertakings included in the consolidation as a whole; • The Annual Report includes a fair review of the development and performance of the business and the position of the Company and the undertakings included in the consolidation taken as a whole, together with a www.crosswordcybersecurity.com 53 54 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Financial Statements 55 Independent auditor’s report to the members of Crossword Cybersecurity plc For the purpose of this report, the terms “we” and “our” denote MHA MacIntyre Hudson in relation to UK legal, professional and regulatory responsibilities and reporting obligations to the members of Crossword Cybersecurity plc. For the purposes of the table on pages 58 to 59 that sets out the key audit matters and how our audit addressed the key audit matters, the terms “we” and “our” refer to MHA MacIntyre Hudson. The Group financial statements, as defined below, consolidate the accounts of Crossword Cybersecurity plc and its subsidiaries (the “Group”). The “Parent Company” is defined as Crossword Cybersecurity plc, as an individual entity. The relevant legislation governing the Company is the United Kingdom Companies Act 2006 (“Companies Act 2006”). Opinion We have audited the financial statements of Crossword Cybersecurity plc for the year ended 31 December 2022. The financial statements that we have audited comprise: • • • • the Consolidated Statement of Comprehensive Income; the Statements of Financial Position; the Statements of Changes in Equity; the Statements of Cash Flows; and • Notes 1 to 32 to the financial statements, including significant accounting policies. The financial reporting framework that has been applied in the preparation of the Group and Parent Company’s financial statements is applicable law and UK adopted International Financial Reporting Standards (“UK adopted IFRS”). In our opinion, the financial statements: • give a true and fair view of the state of the Group’s and of the Parent Company’s affairs as at 31 December 2022 and of the Group’s loss for the year then ended; • have been properly prepared in accordance with UK adopted International Financial Reporting Standards (“UK adopted IFRS”); and • have been prepared in accordance with the requirements of the Companies Act 2006. Our opinion is consistent with our reporting to the Audit Committee. Basis for opinion We conducted our audit in accordance with International Standards on Auditing (UK) (ISAs (UK)) and applicable law. Our responsibilities under those standards are further described in the Auditor’s Responsibilities for the Audit of the Financial Statements section of our report. We are independent of the Group in accordance with the ethical requirements that are relevant to our audit of the financial statements in the UK, including the FRC’s Ethical Standard as applied to listed entities, and we have fulfilled our ethical responsibilities in accordance with those requirements. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our opinion. Material uncertainty relating to going concern We draw your attention to note 1.3 of the financial statements which indicates for the Group and Parent to continue as a going concern they will require fundraising in 2023 to support the cash flow requirement of the Group’s business model and aims for growth. As stated in note 1.3, these events or conditions, along with the other matters as set forth in note 1.3 indicate that a material uncertainty exists that may cast significant doubt on the Group and Parent Company’s ability to continue as a going concern. Our opinion is not modified in respect of this matter. In auditing the financial statements, we have concluded that the Directors’ use of the going basis of accounting in the preparation of the financial statements is appropriate. 56 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Our evaluation of the Directors’ assessment of the Group’s and the Parent Company’s ability to continue to adopt the going concern basis of accounting included: • The consideration of inherent risks to the Group’s and the Parent Company’s operations and specifically their business model; • The evaluation of how those risks might impact on the available financial resources; • Where additional resources may be required, the reasonableness and practicality of the assumptions made by the Directors when assessing the probability and likelihood of those resources becoming available; • Liquidity considerations including examination of cash flow projections at Group and Parent Company level; and • The evaluation of the base case scenarios and stress scenarios, in respect of the Group and the Parent Company, and the respective sensitivities and rationale. Our responsibilities and the responsibilities of the directors with respect to going concern are described in the relevant sections of this report. Overview of our audit approach Materiality Group 2022 £150,000 2021 £100,000 2% (2021: 2%) of aggregate of cost of sales and administrative expenses. £87,250 Parent company Key Audit Matters In addition to the matters described in the basis for qualified opinion and in the material uncertainty about going concern sections, we have determined the matters described below to be key audit matters to be communicated in our report. Recurring • Valuation of investment and non-current loans to its subsidiaries. 2% (2021: 2%) of aggregate of cost of sales and administrative expenses. £99,000 Recurring Parent • Impairment of goodwill and intangible assets. The scope of our audit Our audit was scoped by obtaining an understanding of the Company and its environment, including the Company’s system of internal control, and assessing the risks of material misstatement in the financial statements. We also addressed the risk of management override of internal controls, including assessing whether there was evidence of bias by the directors that may have represented a risk of material misstatement. S T A T E M E N T S F I N A N C A L I www.crosswordcybersecurity.com 57 Independent auditor’s report Continued Key Audit Matters Key Audit Matters are those matters that, in our professional judgement, were of most significance in our audit of the financial statements of the current period and include the most significant assessed risks of material misstatement (whether or not due to fraud) that we identified. These matters included those matters which had the greatest effect on: the overall audit strategy; the allocation of resources in the audit; and directing the efforts of the engagement team. These matters were addressed in the context of our audit of the financial statements as a whole, and in forming our opinion thereon, and we do not provide a separate opinion on these matters. Valuation of investment and non-current loans to its subsidiaries Key audit matter description The Parent Company makes non-interest-bearing loans available to its subsidiaries Crossword Consulting Limited and Stega UK Limited through a mix of debt finance and loans. The investment and loans owed to the Parent Company have been subject to an impairment review to determine whether an expected credit loss provision is required. As no interest is charged on these loans then a notional interest is assumed to be embedded in the principal amount of the loan which is computed and treated as a further capital contribution by the Parent Company in its subsidiaries. Our audit work included, but was not restricted to the following: How the scope of our audit responded to the key audit matter Key observations • Challenged management’s allocation of the financing arrangement between a capital contribution and loans in the subsidiaries. • Challenged management’s assessment of expected credit losses. • Benchmarked the discount rate used in management’s assessment. • Reviewed and checked management’s amortised cost calculations. • Considered management’s assessment of the strategy options which the Parent Company would pursue in recovering the amounts due from the subsidiaries. • Reviewed management’s assessment as to the impairment of the Parent Company’s investment in its subsidiaries. • Ensured that the disclosures in the financial statements are adequate. We concluded that the financing arrangement at Parent Company level was correctly classified between capital contribution and loans due from its subsidiaries and that the carrying amounts exceeded the recoverable amounts and no impairment was required of these non-current assets at the Parent Company level. 58 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Valuation of intangibles and goodwill Key audit matter description There is a risk that the fair value of goodwill arising on investments made by the Group, or intangible assets exceed their recoverable amount and may therefore need to be impaired. Management prepares a detailed impairment assessment, taking into consideration: • • • current year developments relating to each intangible; expected useful lives of the intangible; completion of forecasts for all subsidiaries taking into account growth and discount rates. We draw attention to note x to the financial statements which describes the judgements and estimates used by management to estimate the recoverable amount of the Group’s Cash Generating Units. Our opinion is not modified in respect of this matter. Our audit work included, but was not restricted to the following: • Reviewed the mathematical accuracy of the value in use calculation to identify any computational errors that may have fed into the forecasts; • Reviewed and challenged the calculations to ensure pre-tax weighted average cost of capital and pre-tax cash flows had been used in accordance with IAS 36; • We have reviewed, with the help of our internal valuation expert, the determination of the discount rate applied in the value in use calculation and considered whether it is reasonable in the Group’s circumstances; • Reviewed the growth assumptions used by management and compared them to actual results in 2022 and previous forecasts prepared by management in the past; • Performed sensitivity analysis to understand which of the key judgements were resulting in the most significant change to the calculations; • Challenged management whether the inputs into the impairment assessment are reasonable and accurate based on supporting evidence; • Assessed any evidence of management bias in selecting key assumptions and assessed the impact of changes in the model vs. the assumptions used in previous periods. Based on the audit procedures performed, we noted that the recoverability of the intangible assets and goodwill is heavily reliant upon future growth to be sustained for several years. Based upon the growth achieved in the 12 months to 31 December 2022 this does not appear unreasonable but this is a key judgement. We concluded that based upon the evidence received there is enough supporting evidence to conclude that the growth plans appear reasonable and no impairment is required in respect of the intangible assets and goodwill as at 31 December 2022. S T A T E M E N T S F I N A N C A L I How the scope of our audit responded to the key audit matter Key observations www.crosswordcybersecurity.com 59 Independent auditor’s report Continued Our application of materiality Our definition of materiality considers the value of error or omission on the financial statements that, individually or in aggregate, would change or influence the economic decision of a reasonably knowledgeable user of those financial statements. Misstatements below these levels will not necessarily be evaluated as immaterial as we also take account of the nature of identified misstatements, and the particular circumstances of their occurrence, when evaluating their effect on the financial statements as a whole. Materiality is used in planning the scope of our work, executing that work and evaluating the results. Overall Materiality Basis of determining overall materiality Group £150,000 (2021: £100,000) We determined materiality based on 2% (2021: 2%) of the Group’s aggregate cost of sales and administrative expenses. Parent Company £87,250 (2021: £99,000) We determined materiality based on 2% (2021: 2%) of the Company’s aggregate cost of sales and administrative expenses. We have considered the primary users of the financial statements to be shareholders, loan note holders, management, and banks. We have considered the primary users of the financial statements to be shareholders, loan note holders, management, and banks. This was deemed to be the most appropriate metric for materiality as this is primarily what the users of the financial statements are concerned with. Performance materiality £105,000 (2021: £85,000) Basis of determining overall performance materiality We set performance materiality based on 70% (2021: 85%) of overall materiality. Performance materiality is the application of materiality at the individual account or balance level, set at an amount to reduce, to an appropriately low level, the probability that the aggregate of uncorrected and undetected misstatements exceeds materiality for the financial statements as a whole. This was deemed to be the most appropriate metric for materiality as this is primarily what the users of the financial statements are concerned with. £61,075 (2021: £84,150) We set performance materiality based on 70% (2021: 85%) of overall materiality. Performance materiality is the application of materiality at the individual account or balance level, set at an amount to reduce, to an appropriately low level, the probability that the aggregate of uncorrected and undetected misstatements exceeds materiality for the financial statements as a whole. Error reporting threshold The determination of performance materiality reflects our assessment of the risk of undetected errors existing, the nature of the systems and controls and the level of misstatements arising in previous audits. We agreed to report any corrected or uncorrected adjustments exceeding £7,500 (2021: £5,000) to the Audit Committee as well as differences below this threshold that in our view warranted reporting on qualitative grounds. The determination of performance materiality reflects our assessment of the risk of undetected errors existing, the nature of the systems and controls and the level of misstatements arising in previous audits. We agreed to report any corrected or uncorrected adjustments exceeding £4,363 (2021: £4,950) to the Audit Committee as well as differences below this threshold that in our view warranted reporting on qualitative grounds. 60 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 How we tailored the audit scope Our assessment of audit risk, evaluation of materiality and our determination of performance materiality sets our audit scope for each company within the Group. Taken together, this enables us to form an opinion on the consolidated financial statements. This assessment takes into account the size, risk profile, organisation / distribution and effectiveness of group-wide controls, changes in the business environment and other factors such as recent internal audit results when assessing the level of work to be performed at each component. In assessing the risk of material misstatement to the consolidated financial statements, and to ensure we had adequate quantitative and qualitative coverage of significant accounts in the consolidated financial statements, of the 7 reporting components of the group. Full scope audits – 3 entities were subject to a full scope audit. These entities were selected based upon their size or risk characteristics. Specified audit procedures – 3 entities were subject to specified audit procedures. These procedures have been determined based on the size and nature of the balances. 1 entity remains dormant during the year. Our audit scoping coverage for the key balances is summarised in the charts below: Cost of sales administrative costs Loss before tax Gross assets 8.9% -5.6% 8.6% S T A T E M E N T S F I N A N C A L I 91.1% 105.6% 91.4% Full scope Specified audit procedures www.crosswordcybersecurity.com 61 Independent auditor’s report Continued The control environment We evaluated the design and implementation of those internal controls of the Group, including the Parent Company, which are relevant to our audit, such as those relating to the financial reporting cycle. We performed control testing over the purchase and payroll cycles. Reporting on other information The other information comprises the information included in the annual report other than the financial statements and our auditor’s report thereon. The directors are responsible for the other information contained within the annual report. Our opinion on the financial statements does not cover the other information and, except to the extent otherwise explicitly stated in our report, we do not express any form of assurance conclusion thereon. Our responsibility is to read the other information and, in doing so, consider whether the other information is materially inconsistent with the financial statements or our knowledge obtained in the course of the audit, or otherwise appears to be materially misstated. If we identify such material inconsistencies or apparent material misstatements, we are required to determine whether this gives rise to a material misstatement in the financial statements themselves. If, based on the work we have performed, we conclude that there is a material misstatement of this other information, we are required to report that fact. We have nothing to report in this regard. Strategic report and directors’ report In our opinion, based on the work undertaken in the course of the audit: • the information given in the strategic report and the directors’ report for the financial year for which the financial statements are prepared is consistent with the financial statements; and • the strategic report and the directors’ report have been prepared in accordance with applicable legal requirements. In the light of the knowledge and understanding of the Group and the Parent Company and their environment obtained in the course of the audit, we have not identified material misstatements in the strategic report or the directors’ report. Matters on which we are required to report by exception We have nothing to report in respect of the following matters in relation to which the Companies Act 2006 requires us to report to you if, in our opinion: • • • adequate accounting records have not been kept by the Parent Company, or returns adequate for our audit have not been received by branches not visited by us; or the Parent Company financial statements are not in agreement with the accounting records and returns; or certain disclosures of directors’ remuneration specified by law are not made;.or • we have not received all the information and explanations we require for our audit. Responsibilities of directors As explained more fully in the directors’ responsibilities statement, the directors are responsible for the preparation of the financial statements and for being satisfied that they give a true and fair view, and for such internal control as the directors determine is necessary to enable the preparation of financial statements that are free from material misstatement, whether due to fraud or error. In preparing the financial statements, the directors are responsible for assessing the Group’s and the Parent Company’s ability to continue as a going concern, disclosing, as applicable, matters related to going concern and using the going concern basis of accounting unless the directors either intend to liquidate the Group or Parent Company or to cease operations, or have no realistic alternative but to do so. 62 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Auditor responsibilities for the audit of the financial statements Our objectives are to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and to issue an auditor’s report that includes our opinion. Reasonable assurance is a high level of assurance but is not a guarantee that an audit conducted in accordance with ISAs (UK) will always detect a material misstatement when it exists. Misstatements can arise from fraud or error and are considered material if, individually or in aggregate, they could reasonably be expected to influence the economic decisions of users taken on the basis of these financial statements. A further description of our responsibilities for the financial statements is located on the FRC’s website at: www.frc.org.uk/auditorsresponsibilities. This description forms part of our auditor’s report. Extent to which the audit was considered capable of detecting irregularities, including fraud Irregularities, including fraud, are instances of non-compliance with laws and regulations. We design procedures in line with our responsibilities, outlined above, to detect material misstatements in respect of irregularities, including fraud. These audit procedures were designed to provide reasonable assurance that the financial statements were free from fraud or error. The risk of not detecting a material misstatement due to fraud is higher than the risk of not detecting one resulting from error and detecting irregularities that result from fraud is inherently more difficult than detecting those that result from error, as fraud may involve collusion, deliberate concealment, forgery or intentional misrepresentations. Also, the further removed non-compliance with laws and regulations is from events and transactions reflected in the financial statements, the less likely we would become aware of it. Identifying and assessing potential risks arising from irregularities, including fraud The extent of the procedures undertaken to identify and assess the risks of material misstatement in respect of irregularities, including fraud, included the following: S T A T E M E N T S F I N A N C A L I • We considered the nature of the industry and sector the control environment, business performance including remuneration policies and the Group’s, including the Parent Company’s, own risk assessment that irregularities might occur as a result of fraud or error. From our sector experience and through discussion with the directors, we obtained an understanding of the legal and regulatory frameworks applicable to the Group focusing on laws and regulations that could reasonably be expected to have a direct material effect on the financial statements, such as provisions of the Companies Act 2006, UK tax legislation or those that had a fundamental effect on the operations of the Group including the regulatory and supervisory requirements of the AIM regulations. • We enquired of the directors and management including the audit committee concerning the Group’s and the Parent Company’s policies and procedures relating to: identifying, evaluating and complying with the laws and regulations and whether they were aware of any instances of - non-compliance; - detecting and responding to the risks of fraud and whether they had any knowledge of actual or suspected fraud; and - the internal controls established to mitigate risks related to fraud or non-compliance with laws and regulations. • We assessed the susceptibility of the financial statements to material misstatement, including how fraud might occur by evaluating management’s incentives and opportunities for manipulation of the financial statements. This included utilising the spectrum of inherent risk and an evaluation of the risk of management override of controls. We determined that the principal risks were related to posting inappropriate journal entries to increase revenue or reduce costs, creating fictitious transactions to hide losses or to improve financial performance, and management bias in accounting estimates. www.crosswordcybersecurity.com 63 Audit response to risks identified In respect of the above procedures: • we corroborated the results of our enquiries through our review of the minutes of the Group’s and the Parent Company’s board meetings; • audit procedures performed by the engagement team in connection with the risks identified included: - - reviewing financial statement disclosures and testing to supporting documentation to assess compliance with applicable laws and regulations expected to have a direct impact on the financial statements. testing journal entries, including those processed late for financial statements preparation, those posted by infrequent or unexpected users, those posted to unusual account combinations; - evaluating the business rationale of significant transactions outside the normal course of business, and reviewing accounting estimates for bias; - enquiry of management around actual and potential litigation and claims. - challenging the assumptions and judgements made by management in its significant accounting estimates, and - obtaining confirmations from third parties to confirm existence of a sample of balances. • we communicated relevant laws and regulations and potential fraud risks to all engagement team members, including experts, and remained alert to any indications of fraud or non-compliance with laws and regulations throughout the audit. Use of our report This report is made solely to the Parent Company’s members, as a body, in accordance with Chapter 3 of Part 16 of the Companies Act 2006. Our audit work has been undertaken so that we might state to the Parent Company’s members those matters we are required to state to them in an auditor’s report and for no other purpose. To the fullest extent permitted by law, we do not accept or assume responsibility to anyone other than the Parent Company and the Parent Company’s members as a body, for our audit work, for this report, or for the opinions we have formed. Andrew Moyser FCA FCCA (Senior Statutory Auditor) for and on behalf of MHA MacIntyre Hudson, Statutory Auditor London, United Kingdom 18 April 2023 64 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 S T A T E M E N T S F I N A N C A L I www.crosswordcybersecurity.com 65 Consolidated Financial Statements for Crossword Cybersecurity PLC company number 08927013 CONSOLIDATED STATEMENT OF COMPREHENSIVE INCOME 12 Months ended 31 December 2022 £ 3,648,000 (2,755,662) 39,814 932,152 12 Months ended 31 December 2021* £ 2,171,137 (1,631,384) 152,347 692,100 (4,967,499) (304,457) (1,569) (395,762) 170,283 (4,566,852) (3,481,809) (104,124) 4,956 (220,545) 456,803 (2,652,619) Notes 2 3 6 3,4 7 8 9 11 1,144,302 378,995 (3,422,550) (2,273,624) 1,782 1,782 (13,220) (13,220) (3,420,768) (2,286,844) (3,408,149) (14,401) (3,422,550) (2,229,296) (44,328) (2,273,624) (3,406,367) (14,401) (3,420,768) (2,242,516) (44,328) (2,286,844) 23 (0.04) (0.04) (0.03) (0.03) Revenue Cost of Sales Other income Gross Profit Administrative expenses Other operating expense Finance income-bank interest income and foreign exchange Finance costs-other interest expense Gain on remeasurement of financial assets and liabilities Loss for the year before taxation Tax credit / (expense) Loss for the Year Other Comprehensive Income Items that may be reclassified to profit or loss: Foreign exchange translation Gain / (Loss) Total Other Comprehensive Income Total Comprehensive Loss Loss for the period attributable to: Owners of the parent Non-controlling interests Total Loss for the Year Total comprehensive loss for the period attributable to: Owners of the parent Non-controlling interests Total Comprehensive Loss Loss Per Share (basic) Loss Per Share (diluted) All results are derived from continuing operations * Restated (as per note 1.2) 66 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 STATEMENT OF FINANCIAL POSITION AS AT 31 DECEMBER Group 2022 £ Group 2021 £ Company 2022 £ Company 2021 £ Notes Non-Current Assets Intangible assets Tangible assets Goodwill Unlisted investment Investments in subsidiaries Intercompany receivable greater than one year Total non-current assets Current Assets Trade and other receivables Current tax receivable Cash and cash equivalents Total current assets Total Assets EQUITY Attributable to the owners of the Company Share Capital Share premium account Convertible debt reserve Equity reserve Retained earnings Translation of foreign operations Attributable to owners of the parent Non-controlling interests Total equity LIABILITIES Current Liabilities Trade and other payables Other current liabilities Total current liabilities Long Term Liabilities Convertible loan notes Bank loans Other non-current liabilities Total long term liabilities Total Liabilities Total Equity & Liabilities 13 14 15 16 17 18 22 22 24 19 20 30 21 2,708,423 45,039 875,277 456,834 - - 4,085,573 1,103,679 5,460 875,277 456,834 - - 2,441,250 2,197,206 - - 456,834 1,649,145 1,067,185 5,370,370 521,603 - - 456,834 1,637,518 918,206 3,534,161 2,078,050 398,511 2,077,771 4,554,332 8,639,905 1,066,076 - 3,373,062 4,439,138 6,880,388 1,918,525 368,393 1,746,530 4,033,448 9,403,818 838,622 - 3,106,817 3,945,439 7,479,600 462,019 18,534,372 195,685 370,762 (15,235,500) (13,210) 4,314,128 (153,527) 4,160,601 374,786 14,971,221 - 240,310 (11,827,351) (14,992) 3,743,974 (139,127) 3,604,847 462,019 18,534,372 195,685 370,762 (14,127,624) - 5,435,214 - 5,435,214 374,786 14,971,221 - 240,310 (10,800,700) - 4,785,617 - 4,785,617 S T A T E M E N T S F I N A N C A L I 2,456,783 17,000 2,473,783 1,413,658 1,368,638 2,782,296 2,146,775 - 2,146,775 1,049,960 1,351,471 2,401,431 1,329,678 51,000 624,843 2,005,521 - 68,000 425,245 493,245 1,329,678 - 492,151 1,821,829 - - 292,552 292,552 4,479,304 8,639,905 3,275,541 6,880,388 3,968,604 9,403,818 2,693,983 7,479,600 The company’s loss for the year was £3,326,925 (2021: £1,964,825). The financial statements were approved by the Board and authorised for issue on18 April 2023. They were signed on its behalf by www.crosswordcybersecurity.com 67 Consolidated Financial Statements CONTINUED STATEMENT OF CHANGES IN EQUITY Convertible Debt Reserve Share Capital Share Premium 14,971,221 374,786 Group 2022 £ At 1st January Issue of shares 87,233 3,750,012 Transaction costs Issue of convertible debt Employee share schemes - value of employee services Loss for the period Other comprehensive loss for the period At 31st December Group 2021 At 1st January Issue of shares Transaction costs Employee share schemes - value of employee services Loss for the period Other comprehensive loss for the period - - - - - (186,861) - - - - 256,605 118,181 8,518,391 6,770,954 - (318,124) - - - - - - At 31st December 374,786 14,971,221 Equity Reserve 240,310 Retained Earnings (11,827,351) Translation Reserve Attributable to owners of the parent Non- controlling interests (14,992) 3,743,974 (139,126) - - - 130,452 - - - - - (3,408,149) - - - - - 3,837,245 (186,861) 195,685 130,452 - - - - Total 3,604,848 3,837,245 (186,861) 195,685 130,452 (3,408,149) (14,401) (3,422,550) - - 1,782 1,782 - 1,782 - - 195,685 - - - - - - - - - - 181,618 (9,598,056) (1,772) (643,214) (94,799) (738,013) - - 58,692 - - - - (2,229,296) - - - - 6,889,135 (318,124) 58,692 - - - 6,889,135 (318,124) 58,692 (2,229,296) (44,328) (2,273,624) - - 240,310 (11,827,351) (13,220) (14,992) (13,220) - (13,220) 3,743,974 (139,126) 3,604,847 462,019 18,534,372 195,685 370,762 (15,235,500) (13,210) 4,314,128 (153,527) 4,160,601 Company 2022 £ At 1st January Issue of shares Transaction costs Issue of convertible debt Employee share schemes - value of employee services Loss for the period At 31st December Company 2021 At 1st January Issue of shares Transaction costs Employee share schemes - value of employee services Loss for the period At 31st December Share Capital 374,786 Share Premium 14,971,221 87,233 3,750,012 (186,861) Convertible Debt Reserve - - - - - - - - - - 195,685 - - Equity Reserve 240,310 Retained Earnings (10,800,699) - - - 130,452 - - - - - (3,326,925) 462,019 18,534,372 195,685 370,762 (14,127,624) 256,605 118,181 8,518,391 6,770,954 - (318,124) - - - - 374,786 14,971,221 - - - - - - 181,618 (8,835,874) - - 58,692 - - - - (1,964,825) 240,310 (10,800,699) Translation Reserve Attributable to owners of the parent Non- controlling interests - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Total 4,785,617 3,837,245 (186,861) 195,685 130,452 (3,326,925) £5,435,214 120,740 6,889,135 (318,124) 58,692 (1,964,825) 4,785,617 68 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 STATEMENT OF CASHFLOWS Years Cashflows From Operating Activities Loss for the year Movement in trade and other receivables Movement in trade and other payables Depreciation Amortisation Finance costs Gain on remeasurement of financial assets and liabilities Employee share schemes Tax (credit) / expense Tax received / (paid) Net Cashflow from Operating Activities Cashflow From Investing Activities Investment in intangible assets Purchase of tangible assets Acquisition of subsidiaries, net of cash acquired Net Cashflow from Investing Activities Cashflows From Financing Activities Proceeds from issue of ordinary shares Share issuance costs Proceeds from issue of convertible loan notes Repayment of convertible loan notes Interest paid on convertible loan notes Other interest paid Payments for right of use assets Net Cash Inflow from Financing Activities Net Increase in Cash & Cash Equivalents Foreign Currency Translation Difference Cash and Cash Equivalent at the beginning of the period Cash and Cash Equivalent at the end of the period * Restated as per Note 1.2 TOM ILUBE Chief Executive Officer 12 Months ended 31st December Group 2022 £ 12 Months ended 31st December Group 2021* £ 12 Months ended 31st December Company 2022 £ 12 Months ended 31st December Company 2021* £ Notes (3,422,550) (786,642) 381,130 11,287 293,170 395,762 (170,283) 130,452 (1,144,302) 348,662 (3,963,314) (2,273,624) (412,005) 86,231 66,243 37,881 220,545 (456,803) 58,692 (378,995) 200,984 (2,850,851) (3,326,924) (1,649,101) 646,965 - 222,310 468,084 (365,968) 130,452 (423,572) 295,763 (4,001,990) (1,964,825) (837,873) 40,374 38,392 9,931 138,742 (456,803) 58,692 (206,380) 206,380 (2,973,370) (203,627) (48,971) (625,408) (878,006) (183,796) - (645,390) (829,186) (203,627) - (715,415) (919,042) (183,796) - (700,000) (883,796) S T A T E M E N T S F I N A N C A L I 3 3 8 4 11 13 14 3,837,245 (186,861) 800,000 (700,000) (189,640) (16,495) - 3,544,249 6,639,135 (318,124) - - (168,000) (1,638) (43,734) 6,107,639 3,837,245 (186,861) 800,000 (700,000) (189,640) - - 3,560,744 6,639,135 (318,124) - - (168,000) (186) (13,507) 6,139,319 (1,297,071) 1,780 3,373,062 2,077,771 2,427,602 (12,881) 958,341 3,373,062 (1,360,288) - 3,106,818 1,746,530 2,282,151 - 824,667 3,106,818 www.crosswordcybersecurity.com 69 Consolidated Financial Statements CONTINUED Furthermore, Amortisation and Depreciation have been separated from Administrative expenses into Other operating expense category. Prior period has been reclassified. The Group has revised the treatment of Research and development tax credits from the approach where these get recorded following the receipt of tax relief to being recognised in the period they relate to. Prior year has not been restated. During the period the Group has changed presentation of Research and development tax credits from Other operating income to Income tax to reflect the fact that most of the credit relates to tax relief for small and medium-sized enterprises. The following table demonstrates re-classification of 2021 Consolidated Income Statement: NOTES TO THE FINANCIAL INFORMATION 1. ACCOUNTING POLICIES 1.1 The Group and its operations Crossword Cybersecurity plc (the “Company”) is a Company incorporated on 6 March 2014 in England and Wales under the Companies Act 2006. The Company is the parent company of the Crossword Group of Companies focusing on the cybersecurity sector. Crossword offers a range of cyber security solutions to help companies understand and reduce cyber security risk. We do this through a combination of people and technology, in the form of SaaS and software products, consulting, and managed services. The financial information includes the results of the Company and its subsidiaries (together referred to as the “Group” and individually as “Group entities”). The principal accounting policies applied in the preparation of the financial information are set out below. These policies have been consistently applied to all the periods presented, unless otherwise stated. 1.2 Basis of preparation of financial information The financial information has been prepared in accordance with the requirements of the London Stock Exchange plc AIM Rules for Companies and in accordance with International Financial Reporting Standards as adopted in the United Kingdom (“UK adopted IFRS”) and those parts of the Companies Act 2006 applicable to companies reporting in accordance with UK adopted IFRS. The financial information has been prepared on the historical cost basis. The preparation of financial information in conformity with UK adopted IFRS requires the use of certain critical accounting estimates. It also requires management to exercise its judgement in the process of applying the Group’s accounting policies. Changes in assumptions may have a significant impact on the financial information in the year the assumptions changed. Management believes that the underlying assumptions are appropriate. The areas involving a higher degree of judgement or complexity, or areas where assumptions and estimates are significant to the financial information are disclosed in note 1.22. Changes in accounting policy and disclosures During the year the Group has reviewed presentation of Gross Margin in the Income Statement to align with general principles adopted by Software-as-a-Service industry. The costs to be included in Costs of Sales are primarily application hosting expenses, customer success and customer service costs. Research and Development expenses, which were previously included in Costs of Sales, have been reclassified to Administrative expenses. 70 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Consolidated Statement of Comprehensive Income 12 Months ended 31 December 2021 Revenue Cost of Sales Other income Gross Profit Administrative expenses Other operating income Other operating expense Finance income Finance costs-other interest expense Gain on revaluation of financial assets Loss for the year before taxation Tax credit / (expense) Loss for the Year Other Operating Expense seperate from Admin costs £ - - Research and development Tax Credits £ - - - - 104,124 - (104,124) - - - - - (206,380) - - - - (206,380) Change in Gross Margin calculation £ - 325,794 152,347 478,141 (325,794) (152,347) - - - - - Restated £ 2,171,137 (1,631,384) 152,347 692,100 (3,481,809) - (104,124) 4,956 (220,545) 456,803 (2,652,619) - - - - 206,380 378,995 - (2,273,624) As previously reported £ 2,171,137 (1,957,178) - 213,959 (3,260,139) 358,727 - 4,956 (220,545) 456,803 (2,446,239) 172,615 (2,273,624) At the year end, the following standards and interpretations which have not been applied in these financial statements were in issue but not yet effective. The Group is considering their impact but do not expect a material on the future results of the Group. New standards, interpretations and amendments effective in current period None of the new standards and amendments to the existing standards effective in the current period have been applicable to the Group’s consolidated financial statements. New standards, interpretations and amendments not yet effective The Group adopt early the following amendments to standards which are not yet mandatory. IFRS 17 Insurance Contracts (including the June 2020 Amendments to IFRS 17, effective from 1 January 2023) Amendments to IAS 8 Accounting Policies, Changes in Accounting Estimates and Errors - Definition of Accounting Estimates (effective 1 January 2023). Amendments to IAS 1 Presentation of Financial Statements and IFRS Practice Statement 2: Disclosure of Accounting policies (effective 1 January 2023). Amendments to IAS 12 Income Taxes - Deferred Tax related to Assets and Liabilities arising from a Single Transaction (effective 1 January 2023). Amendments to IAS 1 Presentation of Financial Statements - Classification of Liabilities as Current or Non-current (effective 1 January 2023). 1.3 Going Concern The financial information has been prepared on a going concern basis. The Group’s business model has been enhanced following the two acquisitions in 2021 and a further acquisition in early 2022. The Group’s operations have incurred a loss in the financial year whilst the Group’s products and services continue to be enhanced, developed and brought to market. The Directors’ forecast in 2023 shows a trading loss with net cash outflows as the business continues to develop and enhance its products and services and grows revenue. In 2022, the Group’s operations have been supported by cash inflows from customers and from the issue of £3.6m equity gross during 2022. The Directors have considered the Group’s future and forecast business and cash requirements. Following the completion of a successful fundraise in 2022, the Directors have determined that the group wants to continue to expand, while having a clear and determined focus on a path to profitability, which is expected to require successful additional fundraise. On 12 July 2022 holders of £700,000 of loan notes extended their loan notes to be repayable 30 June 2025 and two loan note holders loaned a further £150,000 to the Company on the above terms. In both cases the conversion price was amended to 25.2p. S T A T E M E N T S F I N A N C A L I www.crosswordcybersecurity.com 71 Consolidated Financial Statements CONTINUED On 15 July 2022 a further £550,000 of loan notes were issued repayable on 14 July 2025, otherwise on the same terms as above save that the conversion price is 26.1p. Currently, £1.5 million of loan notes remain outstanding. The Directors have concluded that these circumstances could give rise to a material uncertainty arising from events or conditions that may cast significant doubt on the entity’s ability to continue as a going concern if a further fund raise was unsuccessful. However, considering recent successful fund raises the Directors are confident that they can continue to adopt the going concern basis in preparing the financial statements. The financial statements do not include any adjustment that may arise in the event that the Group is unable to raise finance, realise its assets and discharge its liabilities in the normal course of business. 1.4 Basis of consolidation Subsidiaries are fully consolidated from the date on which control is transferred to the Group. Control exists when then the Group has: • • • the power over the investee; exposure, or rights, to variable returns from its involvement with the investee; the ability to use its power over the investee to affect the amount of the investor’s returns. All intra-Group transactions balances income and expenses are eliminated on consolidation. Uniform accounting policies are applied by the Group entities to ensure consistency. 1.5 Revenue Revenue comprises the fair value of consideration received or receivable for licence income and the rendering of services in the ordinary course of the Group’s activities. Revenue is shown net of value added tax and trade discounts. Income is reported as follows: (a) Licence Income Technology and product licensing revenue represents amounts earned for licenses granted under licensing agreements and recognized over time. Revenues relating to up-front payments are recognised when the obligations related to the revenues have been completed. Revenues for maintenance and support services are recognised in the accounting periods in which the services are rendered. (b) Rendering of Services Services relate to implementation and deployment fees for the technology and products licensed to customers. Revenue is recognised in the accounting periods in which the services are rendered. (c) Consulting Consulting revenue is recognised when the performance obligation is met, primarily at a point of time. Contracts are structured to support the revenue recognition process by stating what the objectives and deliverables are for each part of the project, and the revenue attributable to each deliverable. (d) Software Engineering Services Revenues for software engineering services are recognised in the accounting periods in which the services are rendered. Contract balances Contract related balances comprise of contract assets and contract liabilities. Contract assets – are recognised when services are transferred to customers before consideration is received or before the Group has an unconditional right to payment for performance completed to date. Contract assets are subsequently transferred to receivables when the right of payment becomes unconditional. Contract liabilities – are recognised when amounts are received from customers in advance of transfer of goods or services. Contract liabilities are subsequently recognised in revenue as or when the Group performs under contracts. 1.6 Functional and presentation currency The presentation currency of the Group is pounds sterling (GBP). The functional currency of the Company is pounds sterling. The functional currency of the Company’s polish subsidiary is Polish Zloty (PLN). 1.7 Business combinations The acquisition of subsidiaries is accounted for using the acquisition method. The cost of the acquisition is measured as the aggregate of the fair values, at the date of exchange, of assets given, liabilities incurred or assumed, and equity instruments issued by the Group in exchange for control of the acquiree. Acquisition related costs are recognised in the income statement as incurred. Any contingent consideration to be transferred by the Group is recognised at fair value at the acquisition date. Subsequent changes to the fair value of the contingent consideration that is deemed to be an asset or liability is recognised in the consolidated income statement. Contingent consideration that 72 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 is classified as equity is not remeasured, and its subsequent settlement is accounted for within equity. Goodwill arising on acquisition is recognised as an asset and initially measured at cost, being the excess of the cost of the business combination over the Group’s interest in the net fair value of the identifiable assets, liabilities and contingent liabilities recognised. For the purpose of impairment testing, goodwill acquired in a business combination is, from the acquisition date, allocated to the cash generating unit (“CGU”) that is expected to benefit from the synergies of the combination. CGU to which goodwill has been allocated is tested for impairment annually, or more frequently when there is an indication that the unit may be impaired. Any impairment loss is recognised directly in the income statement. 1.8 Foreign operations The assets and liabilities of foreign operations are translated into Pound sterling using the exchange rates at the reporting date. The revenues and expenses of foreign operations are translated into Pound sterling using the average exchange rates, which approximate the rates at the dates of the transactions, for the period. All resulting foreign exchange differences are recognised in other comprehensive income through the foreign currency reserve in equity. On disposal of a foreign operation, the cumulative exchange differences recognised in the foreign exchange reserve relating to that operation up to the date of disposal are transferred to the consolidated statement of comprehensive income as part of the profit or loss on disposal. development can be reliably measured. Directly attributable costs that are capitalised as part of the software product include the software development employee costs and an appropriate portion of relevant overheads. Other development expenditure that does not meet these criteria is recognised as an expense as incurred. 1.10 Property, plant and equipment Property, plant and equipment is stated at purchase price less accumulated depreciation and impairment losses. The cost includes all expenses directly related to the purchase of a relevant asset. All other repair and maintenance costs are charged to the income statement for the period during the reporting period in which they are incurred. 1.11 Depreciation and amortisation Each item of property, plant and equipment is depreciated using the straight-line method over the estimated useful life and depreciation charge is included in the income statement for the period. The depreciation is charged to the income statement for the period and determined using the straight-line method over the estimated useful life of the item of property, plant and equipment. The expected useful lives of property, plant and equipment in the reporting and comparative periods are as follows: Computers Furniture & fittings Useful lives in years 3.33 3.33 1.9 Intangible assets – research and development Expenditure on research is written off in the period in which it is incurred. Computer software development expenditure recognised as assets is amortised on a straight-line basis over their estimated useful lives, which does not exceed 5 years. Development expenditure incurred on specific projects is capitalised where the management is satisfied that the following criteria have been met: • it is technically feasible to complete the software product so that it will be available for use; • management intends to complete the software product and use or sell it; 1.12 Impairment of non-financial assets The residual value of an asset is the estimated amount that the Group would currently obtain from disposal of the asset less the estimated costs of disposal, if the asset was already of the age and in the condition expected at the end of its physical life. The assets’ residual values and useful lives are reviewed, and adjusted if appropriate, at each reporting date. • • • there is an ability to use or sell the software product; it can be demonstrated how the software product will generate probable future economic benefits; At the end of each reporting period management assesses whether the indicators of impairment of property, plant and equipment exists. adequate technical, financial and other resources to complete the development and to use or sell the software product are available; and The carrying amounts of property, plant and equipment and all other non-financial assets are reviewed for impairment if there is any indication that the carrying amount may not be recoverable. • the expenditure attributable to the software product during its S T A T E M E N T S F I N A N C A L I www.crosswordcybersecurity.com 73 Consolidated Financial Statements CONTINUED For the purpose of impairment testing the recoverable amount is measured by reference to the higher of value in use (being the net present value of expected future cashflows of a relevant cash generating unit) and fair value less costs to sell (the amount obtainable from the sale of an asset or cash generating unit in an arm’s length transaction between knowledgeable, willing parties who are independent from each other less the costs of disposal). Where there is no binding sale agreement or active market, fair value less costs to sell is based on the best information available to reflect the amount the Group would receive for the cash generating unit. A cash generating unit is the smallest identifiable group of assets that generates cash inflows that are largely independent of the cash inflows from other assets or groups of assets. If the carrying amount of the asset exceeds its recoverable amount, the asset is impaired and an impairment loss is charged to the income statement so as to reduce the carrying amount in the statement of financial position to its recoverable amount. A previously recognised impairment loss is reversed if the recoverable amount increases as a result of a reversal of the conditions that originally resulted in the impairment. This reversal is recognised in profit or loss for the period and is limited to the carrying amount that would have been determined, net of depreciation, had no impairment loss been recognised in prior years. 1.13 Financial Instruments Financial assets and financial liabilities are recognised when the Company becomes a party to the contractual provisions of the instrument. Financial assets and financial liabilities are initially measured at fair value. Transaction costs that are directly attributable to the acquisition or issue of financial assets and financial liabilities (other than financial assets and financial liabilities at fair value through profit or loss) are added to or deducted from the fair value of the financial assets or financial liabilities, as appropriate, on initial recognition. Transaction costs directly attributable to the acquisition of financial assets or financial liabilities at fair value through profit or loss are recognised immediately in profit or loss. All financial instruments are classified in accordance with the principles of IFRS 9 Financial Instruments. 1.13 a Financial assets Classification of financial assets Debt instruments that meet the following conditions are subsequently measured at amortised cost: • • the financial asset is held within a business model whose objective is to hold financial assets in order to collect contractual cash flows; and the contractual terms of the financial asset give rise on specified dates to cash flows that are solely payments of principal and interest on the principal amount outstanding. Debt instruments that meet the following conditions are subsequently measured at FVTOCI: • • the financial asset is held within a business model whose objective is achieved by both collecting contractual cash flows and selling the financial assets; and the contractual terms of the financial asset give rise on specified dates to cash flows that are solely payments of principal and interest on the principal amount outstanding. By default, all other financial assets are subsequently measured at FVTPL. Amortised cost and effective interest method The effective interest method is a method of calculating the amortised cost of a debt instrument and of allocating interest income over the relevant period. For financial instruments other than purchased or originated credit-impaired financial assets, the effective interest rate is the rate that exactly discounts estimated future cash receipts (including all fees and points paid or received that form an integral part of the effective interest rate, transaction costs and other premiums or discounts) excluding expected credit losses, through the expected life of the debt instrument, or, where appropriate, a shorter period to the gross carrying amount of the debt instrument on initial recognition. For purchased or originated credit-impaired financial assets, a credit-adjusted effective interest rate is calculated by discounting the estimated future cash flows, including expected credit losses, to the amortised cost of the debt instrument on initial recognition. The amortised cost of a financial asset is the amount at which the financial asset is measured at initial recognition minus the principal repayments, plus the cumulative amortisation using the effective interest method of any difference between that initial amount and the maturity amount, adjusted for any loss allowance. On the other hand, the gross carrying amount of a financial asset is the amortised cost of a financial asset before adjusting for any loss allowance. 74 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Impairment of financial assets Derecognition of financial liabilities The Company recognises a loss allowance for expected credit losses on financial assets that are measured at amortised cost. The amount of expected credit losses is updated at each reporting date to reflect changes in credit risk since initial recognition of the respective financial instrument. Expected credit loss measurement The consolidated entity has applied the simplified approach to measuring expected credit losses, which uses a lifetime expected loss allowance. To measure the expected credit losses, trade receivables have been grouped based on days overdue. 1.13 b Financial liabilities and equity Debt and equity instruments are classified as either financial liabilities or as equity in accordance with the substance of the contractual arrangement. Equity instruments An equity instrument is any contract that evidences a residual interest in the assets of an entity after deducting all of its liabilities. Equity instruments issued by the Company entity are recognised at the proceeds received, net of direct issue costs. Financial liabilities All financial liabilities are subsequently measured at amortised cost using the effective interest method or at “Fair Value Through Profit or Loss” (“FVTPL”). Financial liabilities at FVTPL Financial liabilities are classified as at FVTPL when the financial liability is contingent consideration of an acquirer in a business combination to which IFRS 3 applies, or it is designated as at FVTPL. Financial liabilities subsequently measured at amortised cost Financial liabilities that are not 1) contingent consideration of an acquirer in a business combination, 2) held-for-trading, or 3) designated as at FVTPL, are subsequently measured at amortised cost using the effective interest method. The effective interest method is a method of calculating the amortised cost of a financial liability and of allocating interest expense over the relevant period. The effective interest rate is the rate that exactly discounts estimated future cash payments (including all fees and points paid or received that form an integral part of the effective interest rate, transaction costs and other premiums or discounts) through the expected life of the financial liability, or (where appropriate) a shorter period, to the amortised cost of a financial liability. The Company derecognises financial liabilities when, and only when, the Company’s obligations are discharged, cancelled or they expire. The difference between the carrying amount of the financial liability derecognised and the consideration paid and payable, including any non-cash assets transferred or liabilities assumed, is recognised in the statement of comprehensive income. 1.14 Leases The Company assesses whether a contract is or contains a lease, at inception of the contract. The Company recognises a right-of- use asset and a corresponding lease liability with respect to all lease arrangements in which it is the lessee, except for short- term leases (defined as leases with a lease term of 12 months or less) and leases of low value assets. For these leases, the Company recognises the lease payments as an administrative expense on a straight-line basis over the term of the lease. 1.15 Taxes Current tax is calculated using rates and laws enacted or substantively enacted at the reporting date. Current tax is recognised in profit or loss unless it relates to an item of other comprehensive income or equity whereby it is recognised in other comprehensive income or equity respectively. Deferred income tax is calculated using rates and laws enacted or substantively enacted at the reporting date that are expected to apply on reversal of the related temporary difference, and is determined in accordance with the expected manner of recovery of the related asset. Deferred income tax is recognised in profit or loss unless it relates to an item of other comprehensive income or equity whereby it is recognised in other comprehensive income or equity respectively. 1.16 Share Based Payments On occasion, the Company has made share-based payments to certain Directors and employees by way of issue of share options. The fair value of these payments is calculated by the Company using the binomial option valuation model and Monte Carlo simulation model. The expense, where material, is recognised on a straight-line basis over the period from the date of award to the date of vesting, based on the Company’s best estimate of the number of shares that will eventually vest. S T A T E M E N T S F I N A N C A L I www.crosswordcybersecurity.com 75 Consolidated Financial Statements CONTINUED 1.17 Investments Shares in subsidiary undertakings are stated at cost less provision for impairment. Unlisted investments are measured at fair value through profit or loss. 1.18 Intercompany Financing arrangements The amortised cost methodology is applied to the financing arrangement between the Company and subsidiary Crossword Consulting Limited. An assessment in undertaken to determine the market rate of interest for a similar loan given the credit rating of the subsidiary to apply discounting with the principal conceptually including a financing element. 1.19 Pension Obligations The Group operates a defined contribution pension scheme for employees in the United Kingdom. A defined contribution scheme is a pension plan under which the Group pays fixed contributions into a separate entity. Contributions payable to the Group’s pension scheme are charged to the income statement in the year to which they relate. The Group has no further payment obligations once the contributions have been paid. In Poland, the Group pays the statutory employer’s contribution into the public pension scheme for each employee, but does not operate any pension schemes. The Group implemented the Employee Capital Plans (PPK) programme which involved employee consultation and selection of a financial institution. 1.20 Cash and Cash Equivalents Cash comprises cash-in-hand and demand deposits. Cash equivalents are short-term, highly liquid investments that are readily convertible to known amounts of cash, and which are subject to an insignificant risk of change in value. 1.21 Accounting for Government Grants Government grants are not recognised until there is reasonable assurance that the Group will comply with the conditions attached to them and that the grants will be received. Government grants are recognised as income over the periods necessary to match them with the costs for which they are intended to compensate, on a systematic basis. Government grants that are receivable as compensation for expenses or losses already incurred or for the purpose of giving immediate financial support to the Group with no future related costs are recognised in the income statement in the period in which they become receivable. 1.22 Critical accounting estimates and judgements and key sources of estimation uncertainty Estimates and judgements are continually evaluated and are based on experience and other factors, including expectations of future events that are believed to be reasonable under the circumstances. The following are the key estimates that the directors have made in the process of applying the Group’s accounting policies and have the most significant effect on the amounts recognised in the financial information. There are no further critical accounting judgements. Fair value of options granted to employee The Group uses the Binomial model and Monte Carlo simulation model in determining the fair value of options granted to employees under the Group’s various share schemes. The determination of the fair value of options requires a number of assumptions. The alteration of these assumptions may impact charges to the income statement over the vesting period of the award. Details of the assumptions used are shown in note 4. Convertible Loans The Group has given consideration to the measurement and presentation of the convertible loans. On legal execution of the loans the financial liability is initially measured at its fair value which is the face value of the loans. Immediately after recognition, at fair value, the financial liability is measured at amortised cost, using a reasonable estimate of the Group’s cost of capital. The difference between the fair value and the amortised cost is taken to the P&L account. Impairment An impairment assessment of the carrying value in the Company of the investment in subsidiaries is undertaken using an NPV model over the projected cash flows, with a discount rate based on the assessment of weighted average cost of capital. Business combinations The recognition of business combinations requires management to make estimates in order to determine fair value of consideration payable on acquisition as well as fair value of identifiable assets, particularly intangibles, and liabilities acquired. These estimates are based on all available information and in some cases assumptions with respect to the timing and amount of future revenues and expenses associated with an asset. Deferred tax Deferred tax assets are recognised for unused tax losses to the extent that it is probable that taxable profit will be available 76 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 against which the losses can be utilised. Significant management judgement is required to determine the amount of deferred tax assets that can be recognised, based upon the likely timing and the level of future taxable profits, together with future tax planning strategies. The company has taxable temporary differences that partly support the recognition of the losses as deferred tax assets based on the above. The company has determined that it cannot recognise deferred tax assets on all of the tax losses carried forward however, based on the likely characteristics, timing and level of future taxable profits, together with future tax planning strategies. Further details on taxes are disclosed in note 11. 2 REVENUE AND SEGMENTAL INFORMATION An analysis of the Group’s revenue for each period for its continuing operations, is as follows: £ Revenue from the sale of goods/licences Revenue from the rendering of services Revenue from consulting services Software engineering revenue Total Revenue Group 2022 479,849 64,667 3,013,884 89,600 3,648,000 Group 2021 189,252 183,855 1,660,207 137,823 2,171,137 The IFRS 8 Operating segments requires the Group to determine its operating segments based on information which is provided internally. Based on the internal reporting information and management structures within the Group, it has been determined that there are two operating segments established in accordance to differences in products and services provided - Software product and services and Cybersecurity consulting. These operating segments are based on the internal reports that are reviewed and used by the Board of Directors (who are identified as the Chief Operating Decision Makers (‘CODM’)) in assessing performance and in determining the allocation of resources. There is no aggregation of operating segments. The CODM reviews EBITDA (earnings before interest, tax, depreciation and amortisation). The accounting policies adopted for internal reporting to the CODM are consistent with those adopted in the financial statements. The information regarding the Group’s reportable segments is presented below: S T A T E M E N T S F I N A N C A L I www.crosswordcybersecurity.com 77 Consolidated Financial Statements CONTINUED 2022 £ Revenue Cost of Sales Other income Gross Profit Administrative expenses Other operating expense Financial income and expenses Loss for the year before taxation Tax credit / (expense) Loss for the Year Software product and services 634,116 (136,287) 39,814 537,643 Cybersecurity consulting 3,131,103 (2,619,375) - 511,728 Eliminations (117,219) - - (117,219) Total 3,648,000 (2,755,662) 39,814 932,152 (4,561,425) (226,447) (29,958) (4,280,186) (523,292) (78,010) (197,090) (286,666) 117,218 - - - (4,967,499) (304,457) (227,048) (4,566,852) 1,144,302 (3,135,884) - (286,666) - - 1,144,302 (3,422,550) Total Comprehensive Loss (3,134,102) (286,666) - (3,420,768) Segment assets Segment liabilities EBITDA 2021* £ Revenue Cost of Sales Other income Gross Profit Administrative expenses Other operating expense Financial income and expenses Loss for the year before taxation Tax credit / (expense) Loss for the Year 10,413,274 4,234,893 1,594,370 2,649,280 (3,367,738) (2,404,869) 8,639,905 4,479,304 (4,023,782) (11,565) - (4,035,347) Software product and services 462,108 (32,539) 152,347 581,917 Cybersecurity consulting 1,784,309 (1,598,845) - 185,464 Eliminations (75,280) - - (75,280) Total 2,171,137 (1,631,384) 152,347 692,100 (2,956,758) (72,045) 323,725 (2,123,161) (600,331) (32,079) (82,512) (529,458) 75,280 - - - (3,481,809) (104,124) 241,214 (2,652,619) 378,995 (1,744,166) - (529,458) - - 378,995 (2,273,624) Total Comprehensive Loss (1,757,386) (529,458) - (2,286,844) Segment assets Segment liabilities EBITDA * Restated (as per note 1.2) 8,178,282 2,924,439 1,029,509 1,762,053 (2,327,403) (1,410,951) 6,880,388 3,275,541 (2,168,462) (414,866) - (2,583,328) 78 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 During the year ended 31 December 2022 approximately 14% (2021: 17%) of the consolidated entity’s external revenue was derived from sales to a major United Kingdom client in Cybersecurity consulting segment. No other clients accounted for more than 10% of the consolidated entity’s external revenue. No analysis of net assets by geographic segment is provided as the net assets are principally all within the UK. 3 EXPENSES BY NATURE £ Staff and related costs Consultancy and related costs Professional fees Property related costs Depreciation Amortisation Capitalised costs Other expenses Total cost of sales, administrative and other operating expenses Included in Cost of Sales £ Staff and related costs Consultancy and related costs Other expenses Total cost of sales Included in Administrative expenses £ Staff and related costs Professional fees Property related costs Capitalised costs Other expenses Total administrative expenses Expenses by geographic segment £ UK Poland Total cost of sales, administrative and other operating expenses Administrative expenses include-short term lease expense of £188,643 (2021: £171,714). Group 2022 4,914,076 854,972 808,910 201,590 11,287 293,170 (162,680) 1,106,293 8,027,618 Group 2022 1,874,960 854,972 25,730 2,755,662 Group 2022 3,039,116 808,910 201,590 (162,680) 1,080,563 4,968,499 Group 2021 3,305,430 450,028 616,791 172,823 66,243 37,881 (138,067) 706,188 5,217,317 Group 2021 1,133,519 450,028 47,837 1,631,384 Group 2021 2,171,911 616,791 172,823 (138,067) 658,351 3,481,809 Group 2022 7,355,231 672,387 8,027,618 Group 2021 4,695,737 521,580 5,217,317 S T A T E M E N T S F I N A N C A L I www.crosswordcybersecurity.com 79 Consolidated Financial Statements CONTINUED 4 STAFF COSTS Staff costs, including directors’ remuneration, were as follows: £ Wages and salaries: - Administrative - Consulting - Research and development Social security costs Other pension costs Group 2022 Group 2021 Company 2022 Company 2021 2,342,943 1,719,588 348,910 432,124 70,511 4,914,076 1,420,624 1,226,231 277,503 327,012 54,061 3,305,430 2,066,066 - - 231,583 47,838 2,345,487 1,321,393 - - 142,103 37,003 1,500,499 The average monthly number of employees, including the directors, during the period was as follows: Staff Directors Total Share based payments Group 2022 52 11 63 Group 2021 42 9 51 Company 2022 30 8 38 Company 2021 17 8 25 The amount recognised in respect of share-based payments was £130,452 (2021: £58,692). The Group has established share option programmes that entitle certain employees to purchase shares in the Group. There are no performance conditions attaching to these options. No options were exercised in 2022 (5,840 in 2021). Total options issued as at 31 December 2022 amount to 2,278,653 (2021: 2,348,653). The share options have been valued using a binomial model applying the following inputs: • Exercise price – equal to the share price at grant date, • Vesting date – all options vest in three tranches, on the first, second and third anniversary from the grant date; • Expiry/Exercise date – 10 years from the grant date; • Volatility (sigma) – 40%. This has been calculated based on the historic volatility of the Company’s share price. • Risk free rate – yield on a zero coupon government security at each grant date with a life congruent with the expected option life; • Dividend yield – 0%, • Future staff turnover – 0%. We have however adjusted the P+L charge for the current year (and future years) to account for lapsed options due to Leavers; and • Performance conditions – none 80 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Reconciliation of share options – Company 1st January Granted during the period Lapsed during the period Exercised during the period End of the period Weighted average exercise price 2022 2,348,653 10,000 (85,000) - 2,273,653 2022 0.36 0.33 0.34 - 0.36 Weighted average exercise price 2021 2,065,730 352,923 (64,160) (5,840) 2,348,653 2021 0.36 0.36 0.36 0.28 0.36 The weighted average share Price at the exercise date was £0.36. The range of exercise prices is from £0.05 to £0.55. The weighted average remaining life of the options was 6.5 years (2021: 6.5 years). 5 DIRECTORS’ REMUNERATION The remuneration of the Directors who served in the current year was as follows: 2022 Executive Directors Tom Ilube Mary Dowd* Non-Executive Directors Sir Richard Dearlove Ruth Anderson Andy Gueritz Dr David Secher Robert Coles Tara Cemlyn-Jones Total Executive Directors Tom Ilube Mary Dowd* Non-Executive Directors Sir Richard Dearlove Ruth Anderson Andy Gueritz Gordon Matthew Dr David Secher Prof David Stupples Robert Coles Tara Cemlyn-Jones Total Basic Salary and Fees £ 130,000 140,000 25,000 12,000 16,000 16,000 12,000 12,000 363,000 128,311 130,000 25,000 12,000 16,000 6,000 16,000 4,750 7,250 7,231 352,541 Taxable Benefits £ Employer’s Pension Contribution £ Total £ 3,926 2,216 1,321 10,000 135,247 162,216 Bonus £ 10,000 25,000 10,000 31,142 11,321 S T A T E M E N T S F I N A N C A L I 50,000 12,000 16,000 16,000 12,000 12,000 415,463 3,942 1,318 10,000 133,572 140,000 25,000 - 28,942 11,318 50,000 12,000 16,000 6,000 16,000 4,750 7,250 7,231 392,801 * Denotes highest paid director. In the year ended 31 December 2022, certain of the directors received remuneration (which is included in the amounts above) through payments by the Group to third parties as follows: £12,000 was paid to Cumberland House Consulting Ltd for the services of R Coles (2021: £7,250); £12,000 was paid to Caprica Nelson Ltd for the services of R Anderson (2021: £12,000); £16,000 was paid to Cambridge KT Ltd for the services of D Secher (2021: £16,000). www.crosswordcybersecurity.com 81 Consolidated Financial Statements CONTINUED Share Options issued Mary Dowd Sir Richard Dearlove Sir Richard Dearlove Year 2020 2020 2021 Share Options 25,000 94,340 70,423 Exercise Price £0.31 £0.27 £0.36 Total Value £2,903 £9,496 £25,000 In 2021 the Company implemented a Long Term Incentive Plan (LTIP) whereas awards have been made to the following executives - Mary Dowd, Stuart Jubb, Jake Holloway and Sean Arrowsmith. Each award is of nominal cost (£0.005) options to acquire up to 750,000 Crossword ordinary shares of 0.5p each which vest at the average mid-market price of the Ordinary Shares over the 20 trading days preceding the end of the performance period which ends on 30 September 2024. 25% of the options will vest if the Award Price is 50p, and 100% will vest if the Award Price is equal to or greater than 100p, with straight line vesting between 50p and 100p. 6 OTHER OPERATING INCOME Grant income 7 OTHER OPERATING EXPENSE Amortisation of intangible assets Depreciation of property, plant and equipment Depreciation of right-of-use assets 8 FINANCE COSTS Finance cost of loan notes Interest on deferred consideration Right to use assets Interest Other interest expense Group 2022 £ 39,814 39,814 Group 2022 £ 293,170 11,287 - 304,457 Group 2022 £ 272,400 115,766 - 7,596 395,762 Group 2021 £ 152,347 152,347 Group 2021 £ 37,881 8,072 58,171 104,124 Group 2021 £ 184,149 34,978 187 1,231 220,545 9 GAIN ON REMEASUREMENT OF FINANCIAL ASSETS AND LIABILITIES £ Gain on remeasurement of contingent consideration Gain on revaluation of investment in Cyberowl Group 2022 £ 170,283 - 170,283 Group 2021 £ - 456,803 456,803 82 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 10 AUDITOR’S REMUNERATION The expenses for services rendered by the Group auditor present themselves as follows: £ Fees for the parent company individual and consolidated financial statements Fees for legal audit of subsidiary financial information 11 TAX £ Corporation tax on profits for the period R&D tax credit Deferred tax credit Total tax (credit) / expense * Restated (as per note 1.2) Group 2022 £ 41,400 24,050 65,450 Group 2021 £ 46,000 17,000 63,000 Group 2022 6,115 (753,288) (397,129) (1,144,302) Group 2021* 5,396 (206,380) (178,011) (378,995) There is no tax charge in respect of other comprehensive income. The deferred tax liability arising on fair value revaluation on acquisitions of Verifiable Credentials Ltd, Stega UK Ltd (both in 2021) and Threat Status Ltd (in 2022), as reflected in note 12, has been offset with a deferred tax asset recognised in respect of losses brought forward from prior periods, resulting in deferred tax credit to the statement of comprehensive income. There is a deferred tax liability of £114,201 arising on the fair value uplift of £456,803 of the unlisted investment in CyberOwl Limited. This deferred tax liability has been offset by trading losses of the group. Corporation tax losses carried forward for offset against future year’s trading profits amount to approximately £8.5m (2021: £4.8m). S T A T E M E N T S F I N A N C A L I £ Loss before taxation Average rate of corporation tax Tax on loss Effects of: Expenses not deductible for tax purposes Additional deduction for R&D expenditure Adjustments in respect of prior period Tax rate changes / adjustments Deferred tax not recognised Total tax charge * Restated (as per note 1.2) Factors that may affect future tax changes Group 2022 4,566,852 19.00% (867,702) 116,084 (164,009) (354,777) (12,199) 138,301 (1,144,302) Group 2021* 2,652,619 19.00% (503,998) 24,578 (167,168) - 104,124 163,468 (378,995) On 24 May 2021 the Finance Bill was substantively enacted with the consequence that the main rate of corporation tax will increase from 19% to the rate of 25%, with effect from 1 April 2023, with a corresponding effect on deferred tax balances after that date. Polish Corporation Tax has been 19% until 1 January 2017, when Crossword started to benefit from the new small companies reduced rate of 15% adopted by the Parliament Act amendment to Polish CIT Law. www.crosswordcybersecurity.com 83 Consolidated Financial Statements CONTINUED 12 BUSINESS COMBINATIONS On 11 March 2022 the Group acquired 100% of the issued share capital of Threat Status Ltd (“TSL”), the threat intelligence company and provider of Trillion, the cloud-based software as a service platform for enterprise-level credential breach intelligence. The net consideration used in the acquisition of TSL and the provisional fair value of assets acquired and liabilities assumed on the acquisition date are detailed below: Intangible assets Tangible assets Deferred tax asset Non-current assets Trade and other receivables Cash and cash equivalents Current assets Deferred tax liability Non-current liabilities Trade and other payables Current liabilities Book value - 1,208 26,854 28,062 Adjustment 1,694,287 - - 1,694,287 Fair value 1,694,287 1,208 26,854 1,722,349 10,420 90,007 100,427 - - - 10,420 90,007 100,427 - - 423,572 423,572 423,572 423,572 57,784 57,784 - - 57,784 57,784 Total fair value of net assets acquired 70,706 1,270,715 1,341,420 Fair value of consideration Cash on completion Deferred consideration in cash Deferred consideration in shares Total consideration 500,915 343,339 497,166 1,341,420 Acquisition costs of £16,894 relating to this transaction have been recognised as part of administrative expenses in the statement of comprehensive income. Since the acquisition date, TSL has contributed £177,223 to group revenues and £127,483 to group result. If the acquisition had occurred on 1 January 2022, group revenue would have been £3,703,829 and group loss for the period would have been £3,229,407. The acquisitions help to implement the Group’s strategy to create a portfolio of subscription-based, enterprise-class products and services for its clients. 84 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 13 INTANGIBLE ASSETS Software Development £ Cost b/f Acquired through business combinations Additions Accumulated Depreciation B/F Charge for the period C/d Net Book Value Group 2022 1,141,560 1,694,287 203,627 3,039,473 Group 2021 - 957,764 183,796 1,141,560 Company 2022 531,534 1,694,287 203,627 2,429,447 Company 2021 - - 531,534 531,534 37,881 293,170 331,051 - 37,881 37,881 9,931 222,310 232,241 - 9,931 9,931 2,708,422 1,103,679 2,197,206 521,603 Intangible assets comprise of 5 different software development projects with remaining useful life of approximate between 5 and 10 years each and the carrying amounts of £1,173,512, £810,244, £344,206, £255,491 and £124,970. The intangible assets have been evaluated to determine whether there are any indicators of impairment. Assessment of the recoverable value for Identiproof software has been based on calculating the net present value of the future cash flows. The cash flow projections are based on the most recent 3 year forecast extrapolated to 5 years with a growth rate for revenue of 20% and costs of 10%. The pre- tax discount rate used in the calculation was 24%. Please refer to note 15 for matters relating to impairment assessment for Nightingale product. S T A T E M E N T S F I N A N C A L I www.crosswordcybersecurity.com 85 Consolidated Financial Statements CONTINUED 14 TANGIBLE ASSETS Computers £ Cost b/f Additions Acquired through business combinations Accumulated Depreciation B/F Charge for the period Translation adjustments C/d Net Book Value Furniture and Fittings £ Cost b/f Additions Accumulated Depreciation B/F Charge for the period C/d Net Book Value Group 2022 31,845 48,971 1,207 82,023 26,385 11,287 (688) 36,984 Group 2021 24,675 - 7,170 31,845 21,124 4,924 337 26,385 45,039 5,460 Company 2022 Company 2021 - - - - - - Group 2022 15,157 Group 2021 15,157 Company 2022 15,157 Company 2021 15,157 15,157 15,157 15,157 15,157 15,157 - 15,157 12,009 3,148 15,157 15,157 - 15,157 12,009 3,148 15,157 - - - - 86 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Right of Use Assets £ Cost b/f Disposals Accumulated Depreciation B/F Charge for the period Translation adjustments Disposals C/d Net Book Value Total £ Cost b/f Additions/(disposals) Acquired through business combinations Accumulated Depreciation B/F Charge for the period Translation adjustments Disposals C/d Net Book Value Group 2022 - - - - - - - - - Group 2022 47,002 48,971 1,207 97,180 41,542 11,287 (688) - 52,141 Group 2021 344,058 (344,058) - 280,694 58,171 5,193 (344,058) - - Group 2021 383,890 (344,058) 7,170 47,002 313,826 66,243 5,530 (344,058) 41,542 Company 2022 - - - - - - - - - Company 2022 15,157 - - 15,157 Company 2021 231,935 (231,935) - 196,687 35,248 - (231,935) - - Company 2021 247,092 (231,935) - 15,157 15,157 - - - 15,157 208,696 38,396 - (231,935) 15,157 45,039 5,460 - - S T A T E M E N T S F I N A N C A L I www.crosswordcybersecurity.com 87 Consolidated Financial Statements CONTINUED 15 GOODWILL The goodwill arises on acquisition of Stega UK Ltd in 2021 and forms a part of Nightingale cash generating unit. The goodwill has been tested for impairment alongside Intangible asset of NBV of £255,491 allocated to the same unit. The recoverable amount has been determined by value in use calculation. The cash flow projections are based on the most recent 3 year forecast extrapolated to 5 years with a growth rate for revenue of 25% and costs between 10% and 15%, these are based primarily on past experience. The growth rate beyond 5 year period is assumed as a perpetuity at 10%. The pre-tax discount rate used in the calculation was 24%. £ Goodwill B/F Additions in the period C/F 16 UNLISTED INVESTMENTS £ Fair value at 1 January and 31 December Group 2022 Group 2021 875,277 - 875,277 - 875,277 875,277 Group 2022 456,834 Group 2021 456,834 Company 2022 456,834 Company 2021 456,834 The above Group investment represents Crossword Cybersecurity Plc’s 2022 – 3.1% (2021 - 4.4%) holding in CyberOwl Limited which was purchased on 18 April 2016. The investment value has not changed during the period and has been based on the values from the latest fundraise by CyberOwl in August 2022. 88 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 17 INVESTMENT IN SUBSIDIARIES £ Cost b/f 1 January Acquired during the year Transfer to intangibles on hive up Reversal of contingent consideration Capital contribution Cost c/f 31 December Company 2022 Company 2021 458,164 1,088,740 - - 90,614 1,637,518 1,637,518 1,341,420 (1,270,715) (170,283) 111,205 1,649,145 The group’s subsidiary undertakings are listed below, including name, country of incorporation, and proportion of ownership interest: Name Crossword Consulting Limited Registered office 6th Floor, 60 Gracechurch Street, London EC3N 0HR United Kingdom Principal activity Cybersecurity services 2022 % 90 2021 % 90 Crossword Cybersecurity SP Z.o.o. Stega UK Ltd ul. Wiejska 12a, 00-490 Warszawa, Poland Cybersecurity services 100 100 6th Floor, 60 Gracechurch Street, London EC3N 0HR United Kingdom Cybersecurity services 100 100 Verifiable Credentials Ltd 6th Floor, 60 Gracechurch Street, London EC3N 0HR United Kingdom Cybersecurity services 100 100 Crossword Cybersecurity LLC PO Box 808, Alwattayah / Muttrah / Muscat Governorate, Postcode: 100, Oman Cybersecurity services 90 90 Threat Status Ltd 6th Floor, 60 Gracechurch Street, London EC3N 0HR United Kingdom Cybersecurity services 100 – S T A T E M E N T S F I N A N C A L I Verifiable Credentials Ltd, a company incorporated in England and Wales, registered No 11923813 and Threat Status Ltd, a company incorporated in England and Wales, registered No 10877044, are exempt from the requirements from the UK Companies Act relating to the audit of individual accounts by virtue of s479A of the Act. www.crosswordcybersecurity.com 89 Consolidated Financial Statements CONTINUED 18 TRADE AND OTHER RECEIVABLES £ Trade receivables Other receivables Prepayments Accrued income VAT Refund Intercompany receivables within one year Group 2022 1,110,697 524,721 239,066 133,883 69,683 - 2,078,050 Group 2021 509,576 254,451 149,309 140,708 12,033 - 1,066,076 Company 2022 505,451 445,603 183,160 23,383 46,421 714,507 1,918,525 Company 2021 192,975 247,274 105,101 131,025 - 162,247 838,622 All of the above amounts are considered to be due within one year. The maximum exposure to credit risk at the reporting date is the carrying value as above and the cash and cash equivalents and none are either past or impaired. Of the above amounts held within the Group, £32,735 is denominated in Polish Zloty with the remainder in GBP (2021: £18,419). Foreign exchange risk is currently minimal as balances in Polish Zloty are between the parent and its wholly owned subsidiary. 19 TRADE AND OTHER PAYABLES £ Trade payables Employment taxes and VAT payable Accruals Deferred income Deferred consideration Other payables Group 2022 659,282 306,168 434,705 460,853 568,146 27,629 2,456,783 Group 2021 331,043 242,642 226,623 331,198 261,606 20,546 1,413,658 Company 2022 1,025,828 69,300 187,197 279,125 568,146 17,179 2,146,775 Company 2021 459,753 56,790 164,284 94,333 261,606 13,194 1,049,960 All of the above amounts are considered to be due within one year. The deferred income relates to contract liabilities arising from contracts with customers. Of the Trade and Other Payables amounts held within the Group, £83,965 (2021: £57,836) is denominated in Polish Zloty with the remainder in GBP. 20 OTHER CURRENT LIABILITIES £ Convertible loan notes Bank loan Group 2022 - 17,000 17,000 Group 2021 1,351,471 17,167 1,368,638 Company 2022 - - - Company 2021 1,351,471 - 1,351,471 90 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 21 OTHER NON-CURRENT LIABILITIES £ Deferred consideration Contingent consideration Deferred grant income 22 SHARE CAPITAL Allotted called up and fully paid Number of shares (all ordinary shares £0.005 each) B/f Shares Issued in period C/d Group 2022 492,151 - 132,692 624,843 Group 2021 111,900 180,652 132,693 425,245 Company 2022 492,151 - - 492,151 Company 2021 111,900 180,652 - 292,552 2022 74,957,150 17,446,565 92,403,715 2021 51,320,900 23,636,250 74,957,150 The shares issued in the period were ordinary shares of £0.005 at a premium of £3,563,151 (2021: £6,452,830). All shares carry the same voting and capital distribution rights. £ Share Capital Cost b/f Shares Issued in period Share Premium B/F Shares Issued in period C/d 23 LOSS PER SHARE 2022 2021 374,786 87,233 462,019 256,605 118,181 374,786 14,971,221 3,563,151 18,534,372 8,518,391 6,452,830 14,971,221 S T A T E M E N T S F I N A N C A L I Earnings per share is calculated by dividing the loss for the period attributable to ordinary equity shareholders of the parent by the weighted average number of ordinary shares outstanding during the year. During the year the calculation for basic loss per share was based on the loss for the year attributable to owners of the parent of £3,408,149 (2021: £2,229,296) divided by the weighted average number of ordinary shares of 80,022,937 (2021: 64,491,462). 24 RESERVES The following describes the nature and purpose of each reserve within owners’ equity: Reserve Share capital Share premium Convertible debt reserve Equity reserve Retained earnings Translation of foreign operations Description and purpose This represents the nominal value of shares issued Amount subscribed for share capital less any issue costs more than nominal value The residual amount after deducting from the fair value of the convertible loan notes the liability component Represents amounts charged on share options that have been granted to employees Cumulative net gains and losses recognised in the consolidated statement of comprehensive income Is the difference that arises due to consolidation of foreign subsidiaries using an average rate during the period and a closing rate for the period end statement of financial position www.crosswordcybersecurity.com 91 Consolidated Financial Statements CONTINUED 25 FINANCIAL INSTRUMENTS £ Current Financial Assets Financial assets measured at amortised cost Trade and other receivables Cash and cash equivalents Non-Current Financial Assets Financial assets measured at amortised cost Loan to subsidiary Financial assets measured at fair value through profit or loss Financial investments Group 2022 Group 2021 Company 2022 Company 2021 1,769,301 2,077,771 904,735 3,373,062 1,688,943 1,746,530 733,521 3,106,817 - - 1,067,185 918,206 456,834 4,303,906 456,834 4,734,631 456,834 4,959,493 456,834 5,215,378 The financial investments comprise of investment in CyberOwl Ltd, which has been valued on the basis of valuation per share at as March 2022 during the investment round, multiplied by the number of shares the Company owns in it. This methodology of determining a fair value equates to a level 2 assessment based on observed transactions of share price in recent transactions in the entity’s equity. £ Current Financial Liabilities Financial liabilities measured at amortised cost Trade and other payables Loans Convertible loan notes Non-Current Financial Liabilities Financial liabilities measured at amortised cost Loans Convertible loan notes Non-current deferred consideration Financial liabilities measured at fair value through profit or loss Non-current contingent consideration Group 2022 Group 2021 Company 2022 Company 2021 1,689,761 17,000 - 839,818 17,167 1,351,471 1,798,351 - - 898,836 - 1,351,471 51,000 1,329,678 492,151 68,000 - 111,900 - 1,329,678 492,151 - - 111,900 - 180,652 - 180,652 3,579,590 2,569,008 3,620,180 2,542,858 In relation to the loan there was a fair value revaluation of £195,685 (2021: £nil) recorded in Convertible debt reserve arising from the loan notes being initially measured at fair value and subsequently measured at amortised cost. During the year, the management changed its estimate that Stega would achieve its revenue target for the period between 12 and 18 months from the date of acquisition and concluded that this will be very unlikely. Therefore, contingent consideration, recorded as part of acquisition accounting for Stega, has been reversed via Income Statement in full. Reconciliation of Level 3 fair value measurements of financial liabilities: £ B/f Unwinding of discount Reversed C/d 92 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Contingent consideration 180,652 (10,369) (170,283) - 26 FINANCIAL INSTRUMENTS – RISK The Group could be exposed to risks that arise from its use of financial instruments. Risks in relation to financial assets include: Market risk Market risk covers foreign exchange risk, price risk and interest rate risk. As the majority of the Group’s transactions are either in Sterling or in Polish Zloty the Group considers its exposure to foreign exchange risk to be minimal. There are no derivatives and hedging instruments. The Group is not exposed to price risk given that no securities are held under financial assets. The Group is not exposed to interest rate or cash flow risk due to the fact that the Group has no borrowing or complex financial instruments. Credit risk Credit risk is considered to be the risk of financial loss incurred by the Group in the event that a customer or counterparty to an asset fails to meet contractual obligations. The Group has adopted a policy of only dealing with credit worthy counterparties. The Group’s maximum credit exposure at the reporting date is represented by the carrying value of its financial assets. The Group’s financial instruments do not represent a concentration of credit risk since the Group deals with a variety of counterparties. Financial Assets £ Cash and cash equivalents Trade and other receivables Loan to subsidiary Financial investments Total Liquidity risk £ Trade payables Accruals Deferred consideration Contingent consideration Other Payables Loans Convertible loan notes Total Group 2022 2,077,771 1,769,301 - 456,834 4,303,906 Group 2021 3,373,062 904,735 - 456,834 4,734,631 Company 2022 1,746,530 1,688,943 1,067,185 456,834 4,959,492 Company 2021 3,106,817 733,521 918,206 456,834 5,215,378 S T A T E M E N T S F I N A N C A L I 2022 2021 due <1 year 659,282 434,705 568,146 - 27,629 17,000 - 1,706,762 due 1–2 years - - 492,151 - - 51,000 1,329,678 543,150 due <1 year 331,043 226,623 261,606 - 20,546 17,167 1,351,471 2,208,456 due 1–2 years - - 111,900 180,652 - 68,000 - 360,552 www.crosswordcybersecurity.com 93 Consolidated Financial Statements CONTINUED 27 CAPITAL MANAGEMENT The Group considers its capital to comprise of its equity share capital, share premium, foreign exchange reserve, share options reserve and capital redemption reserve, less its accumulated losses. Quantitative detail is shown in the consolidated statement of changes in equity. The directors’ objective when managing capital is to safeguard the Group’s ability to continue as a going concern in order to provide returns for the shareholder and benefits for other stakeholders and to maintain an optimal capital structure to reduce the cost of capital. The directors monitor a number of KPIs at both the Group and individual subsidiary level on a monthly basis. As part of the budgetary process, targets are set with respect to operating expenses in order to effectively manage the activities of the Group. Performance is reviewed on a regular basis and appropriate actions are taken as required. These internal measures indicate the performance of the business against budget/forecast and to confirm that the Group has adequate resources to meet its working capital requirements. 28 PENSIONS Employer contributions to the Group defined contribution pension scheme for employees in the United Kingdom were £70,695 (2021: £46,509). A defined contribution scheme is a pension plan under which the Group pays fixed contributions into a separate entity. Contributions payable to the Group’s pension scheme are charged to the income statement in the year to which they relate. The Group has no further payment obligations once the contributions have been paid. In Poland, the Group pays the statutory employer’s contribution into the public pension scheme for each employee, but does not operate any pension schemes. 29 RELATED PARTY TRANSACTIONS 2022 Services received from £ Services supplied to £ Balance trade payable to £ Balance trade receivable from £ Intercompany loan receivable from £ 2021 Services received from £ Services supplied to £ Balance trade payable to £ Balance trade receivable from £ Intercompany loan receivable from £ Crossword Consulting Limited 102,877 - - 143,779 1,178,367 Crossword Cybersecurity SP Z.o.o 746,355 - 284,420 - - Stega UK Limited" 42,000 - - 156,870 88,818 274,099 - 150,311 165,757 918,207 580,704 - 102,067 - - 7,000 - 4,200 - - Cumberland House Consulting Limited - 318,800 - 54,235 - - - - - Verifiable Credentials Limited - - - 1,385 - - - - 10,736 - Tom Ilube, CEO, had made a loan of £250,000 to the Company on the same terms as the other Lenders as described in note 30. This loan was repaid in December 2022. The Company has a related party relationship with its key management who are the Executives: Tom Ilube, Mary Dowd, Jake Holloway, Sean Arrowsmith and Stuart Jubb, whose total compensation amounted to £796,444 (2021: £793,233). 94 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 30 CONVERTIBLE LOAN NOTES The following table explains movements in the undiscounted Convertible Loan Notes in the year: £ B/f 2022 Expired in the period Extended loans Increased loan amounts Additional loans issued in the period C/d 2022 Convertible Loan Notes 1,400,000 (1,400,000) 700,000 150,000 650,000 1,500,000 The discounted amount of the Convertible Loan Notes at the year end was £1,329,678. The equity component of the Convertible Loan Notes at the date of issue was £195,685. Repayment of the loan notes is at the end of the term, in cash, save that each lender may opt to convert part or all of their loan into Ordinary Shares at £0.252. On repayment of the loans in cash, each lender will be issued warrants valid for three months to subscribe for Ordinary Shares representing 10% of the value of the loan at £0.252. The loan from Tom Ilube, CEO, for an amount of £250,000 was repaid in December 2022. 31 CONTROLLING PARTY The Company does not have a controlling party. 32 SUBSEQUENT EVENTS There are no events after the reporting date to be disclosed. S T A T E M E N T S F I N A N C A L I www.crosswordcybersecurity.com 95 Notice of AGM Notice is hereby given that the Annual General Meeting of Crossword Cybersecurity plc (the “Company”) will be held at the offices of Shakespeare Martineau LLP, 6th Floor, 60 Gracechurch Street, London EC3V 0HR on Monday 22nd May 2023 at 11.00 am to consider, and if thought fit, to pass the following resolutions, of which 1 to 5 will be proposed as Ordinary Resolutions and resolution 6 will be proposed as a Special Resolution: Ordinary Business 1. To receive and adopt the report of the directors and the financial statements for the year ended 31 December 2022 and the report of the auditors thereon. 2. To re-elect, as a director of the Company, Sir Richard Dearlove who retires in accordance with Article 93.2 of the Company’s Articles of Association and offers himself for re-election. 3. To re-elect, as a director of the Company, Dr David Secher who retires in accordance with Article 93.2 of the Company’s Articles of Association and offers himself for re-election. 4. To re-appoint MHA MacIntyre Hudson LLP as auditors of the Company and to authorise the directors to determine the auditor’s remuneration. Special Business 5. THAT the Directors be and they are hereby generally and unconditionally authorised pursuant to Section 551 of the Companies Act 2006 (“the Act”), in substitution for all previous powers granted to them, to exercise all the powers of the Company to allot and make offers to allot relevant securities (within the meaning of the Act) up to an aggregate nominal amount of £46,858.82 such authority shall, unless previously revoked or varied by the Company in general meeting, expire on the conclusion of the Annual General Meeting of the Company to be held in 2024 provided that the Company may, at any time before such expiry, make an offer or enter into an agreement which would or might require relevant securities to be allotted after such expiry and the Directors may allot relevant securities pursuant to any such offer or agreement as if the authority conferred hereby had not expired. 6. THAT, subject to and conditional upon the passing of Resolution 5 the Directors be and they are hereby authorised pursuant to Section 570 of the Act to allot equity securities (as defined in Section 560 of the Act) for cash pursuant to the authority conferred by resolution 5 above as if Section 561(1) of the Act did not apply to any such allotment, provided that this power shall be limited to: (a) the allotment of equity securities in connection with an issue in favour of shareholders where the equity securities respectively attributable to the interests of all such shareholders are proportionate (or as nearly as may be practicable) to the respective number of Ordinary Shares in the capital of the Company held by them on the record date for such allotment, but subject to such exclusions or other arrangements as the Directors may deem necessary or expedient in relation to fractional entitlements or legal or practical problems under the laws of, or the requirements of, any recognised regulatory body or any stock exchange, in any territory; (b) the allotment of equity securities arising from the exercise of options or the conversion of any other convertible securities outstanding at the date of this resolution; and (c) the allotment (otherwise than pursuant to sub-paragraph (a) and (b) above) of further equity securities up to an aggregate nominal amount of £46,858.82 provided that this power shall, unless previously revoked or varied by special resolution of the Company in general meeting, expire at the conclusion of the Annual General Meeting of the Company to be held in 2024. The Company may, before such expiry, make offers or agreements which would or might require equity securities to be allotted after such expiry and the Directors are hereby empowered to allot equity securities in pursuance of such offers or agreements as if the power conferred hereby had not expired. BY ORDER OF THE BOARD B HARBER Company Secretary 18 April 2023 96 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Notes 1. Members are entitled to appoint a proxy to exercise all or any of their rights to attend and to speak and vote on their behalf at the meeting. A proxy need not be a shareholder of the Company. You can register your vote(s) for the Annual General Meeting either: • by logging on to www.shareregistrars.uk.com, clicking on the “Proxy Vote” button and then following the on-screen instructions; • by post or by hand to Share Registrars Limited, 3 The Millennium Centre, Crosby Way, Farnham, Surrey GU9 7XX using the proxy form accompanying this notice; • in the case of CREST members, by utilising the CREST electronic proxy appointment service in accordance with the procedures set out in note 5 below. 2. In order for a proxy appointment to be valid the proxy must be received by Share Registrars Limited by Thursday 18th May 2023 at 11am. 3. Any member entitled to attend and vote at the meeting may appoint one or more proxies to attend and, on a poll, vote instead of him. A proxy need not also be a member. 4. The completion and return of a form of proxy will not preclude a member from attending in person at the meeting and voting should he wish to do so. 5. CREST members may appoint a proxy through CREST by using the procedures described in the CREST Manual (available via www.euroclear.com/CREST). CREST personal members or other CREST sponsored members and those CREST members who have appointed a voting service provider should refer to their CREST sponsor or voting service provider, who will be able to take the appropriate action on their behalf. In order for a proxy appointment or instruction made using the CREST service to be valid, the appropriate CREST message (“a CREST proxy instruction”) must be properly authenticated in accordance with Euroclear UK & Ireland Limited’s specifications and must contain the information required for such instructions, as described in the CREST Manual. All messages relating to the appointment of a proxy or an instruction to a previously appointed proxy must be transmitted so that they are received by Share Registrars Limited (ID 7RA36) by Thursday 18th May 2023 at 11am (or, if the meeting is adjourned, the time that is 48 hours (excluding non- working days) before the time fixed for the adjourned meeting). For this purpose, the time of receipt will be taken to be the time (as determined by the time stamp applied to the message by the CREST Applications Host) from which the issuer’s agent is able to retrieve the message by enquiry to CREST in the manner prescribed by CREST. Any change of instructions to proxies appointed through CREST should be communicated to the appointee through other means. CREST members and, where applicable, their CREST sponsors or voting service providers should note that Euroclear UK & Ireland Limited does not make available special procedures in CREST for any particular message. Normal system timings and limitations will, therefore, apply in relation to the input of CREST proxy instructions. It is therefore the responsibility of the CREST member concerned to take (or procure the taking of) such action as shall be necessary to ensure that a message is transmitted by means of the CREST system by any particular time. In this connection, CREST members and, where applicable, their CREST sponsors or voting service providers are referred, in particular, to those sections of the CREST Manual concerning practical limitations of the CREST system and timings. The Company may treat a CREST Proxy Instruction as invalid in the circumstances set out in Regulation 35(5)(a) of the Uncertificated Securities Regulations 2001. 6. The Company has specified that only those members entered on the register of members at 11am on Thursday 18th May 2023 shall be entitled to vote at the meeting in respect of the number of ordinary shares of £0.05 each in the capital of the Company held in their name at that time. Changes to the register after Thursday 18th May 2023 at 11am shall be disregarded in determining the rights of any person to attend and vote at the meeting. 7. Resolutions 2 and 3 – Article 93.2 of the Company’s Articles of Association require that a director of the Company who held office at the time of the two preceding annual general meetings and who did not retire at either of them must offer themselves for re-election at the next Annual General Meeting. This year Sir Richard Dearlove and Dr David Secher are offering themselves for re-election. 8. Resolution 5 – As required by the Act, this resolution, to be proposed as an Ordinary Resolution, relates to the grant to the Directors of authority to allot unissued Ordinary Shares until the conclusion of the Annual General Meeting to be held in 2024, unless the authority is renewed or revoked prior to such time. If approved, this authority is limited to a maximum of 9,371,764 Ordinary Shares. This represents one-third of the issued share capital of the Company. S T A T E M E N T S F I N A N C A L I www.crosswordcybersecurity.com 97 Notice of AGM CONTINUED 9. Resolution 6 – The Act requires that if the Directors decide to allot unissued Ordinary Shares in the Company the shares proposed to be issued be first offered to existing shareholders in proportion to their existing holdings. This is known as shareholders’ pre-emption rights. However, to act in the best interests of the Company the Directors may require flexibility to allot shares for cash without regard to the provisions of Section 561(1) of the Act. Therefore this resolution, to be proposed as a Special Resolution, seeks authority to enable the Directors to allot equity securities up to a maximum of 9,371,764 Ordinary Shares. This authority expires at the conclusion of the Annual General Meeting to be held in 2024 and represents 10% of the issued share capital. 98 CROSSWORD CYBERSECURITY PLC Annual Report and Accounts 2022 Company Information DIRECTORS Sir Richard Dearlove (Chair) T Ilube (CEO) Dr D Secher A Gueritz R Anderson M Dowd Dr R Coles T Cemlyn Jones REGISTERED NUMBER 08927013 REGISTERED OFFICE 60 Gracechurch Street London EC3V 0HR INDEPENDENT AUDITOR MHA MacIntryre Hudson Chartered Accountants & Statutory Auditors 6th Floor 2 London Wall Place London EC2Y 5AU NOMAD Grant Thornton LLP 30 Finsbury Square London EC2P 2YU CORPORATE BROKER Hybridan LLP 1 Poultry London EC2R 8EJ PUBLIC RELATIONS ADVISER Kinlan Communications 2-4 Exmoor Street London W10 6BD S T A T E M E N T S F I N A N C A L I www.crosswordcybersecurity.com 99 Crossword Cybersecurity plc 60 Gracechurch Street, London EC3V 0HR e: info@crosswordcybersecurity.com twitter: @crosswordcyber t: +44 (0) 203 953 8466
Continue reading text version or see original annual report in PDF format above