Carl Herberger, Chief Executive Officer of Corero Network Security (LON:CNS), has outlined accelerating momentum across the business following a record performance in 2025, driven by recurring revenue growth, product innovation and expanded enterprise penetration.
Corero provides adaptive, real-time protection against distributed denial of service, DDoS, attacks, which are designed to exhaust network resources and disrupt online operations. The company operates as a software-only provider, offering platform-agnostic deployment across enterprise and large-scale environments.
Herberger described DDoS as “a category of attacks that deal with resource exhaustion”, adding that such attacks are “one of the top two attack types in the world” and are distinct from ransomware. He said that traditional ransomware protections do not address operational resilience risks associated with DDoS activity.
Corero differentiates itself by focusing exclusively on DDoS protection. According to Herberger, the company is the only major provider established specifically to address this segment. Its software-only model allows customers to procure protection without being tied to specific hardware platforms. He said the company also provides extensive telemetry capabilities and offers a fully managed service option.
The company reported that 2025 was a year of two halves, reflecting a shift in customer purchasing patterns. In the first half, customers increasingly moved from upfront software procurement to recurring operating expenditure models. This change resulted in 70% of revenue mix being recurring, affecting short-term revenue recognition and EBITDA, despite robust sales activity. Recurring revenue grew by more than 20% in the first half.
In the second half, Corero adjusted operating expenditure in line with revised revenue projections and accelerated sales execution. The company delivered record results across revenues, annual recurring revenue growth, EBITDA and cash generation. Order intake in the fourth quarter increased by 74%, and annual recurring revenue rose by 23%, adding approximately 5 million US dollars and bringing recurring revenue to approximately 24 million US dollars entering 2026.
Herberger said the company replaced competitors across the global DDoS market during the year, stating that “in 2025 there was not a provider of DDoS that we didn’t replace in a state somewhere in the world”.
Partnerships remain central to Corero’s go-to-market strategy. The company maintains OEM relationships with A10 Networks, HPE, following the acquisition of Juniper Networks, and GTT Communications. A recent contract win with a top five European bank was secured through the A10 relationship.
The banking sector opportunity has been influenced by the European Union’s Digital Operational Resilience Act, DORA, which requires critical infrastructure organisations, including banks and utilities, to strengthen cyber operational resilience, including DDoS protection measures.
To expand its channel strategy, Corero appointed Michelle McBain as channel leader. She joined from SonicWall and previously held senior channel roles at Cisco Networks. The company is building out a broader channel organisation under her leadership to support more repeatable, transaction-based growth.
Product development has been another focus area. During 2025, Corero launched six new products, including its Core portfolio and a 400 gigabit solution available in both hardware and software, bare metal versions. According to Herberger, all six products contributed to revenue in their first year of release.
The company entered 2026 with eight-digit first-quarter performance and stated that its recurring revenue base provides confidence in market consensus expectations. Herberger said, “the prospects of the business have never been better”, citing strengthened partnerships, improved sales execution and an expanded product portfolio as foundations for the year ahead.
