Company unveils an AI agent governance platform built on AI, authentication and infrastructure. Accelerating GMO Trust Login orders and rising migrations from rival certificate authorities provide tailwinds.

Summary

9M results showed higher revenue and profit. Quarterly operating income, which dipped in 2Q, recovered as two one-off factors unwound: delayed revenue recognition from a large overseas customer and concentrated development spending. On the back of a gain on the sale of GMO Digital Lab shares, the company raised its net income guidance and its annual dividend forecast. On the data breach at GMO Trust Login, management said it will extend certificate authority-grade controls to the service. It added that the churn rate since October has been in line with the historical average. On growth strategy, the company outlined an AI agent governance platform combining GlobalSign, GMO Trust Login and JOINT Ai Flow by GMO. It plans to publish a medium-term management strategy by March 2027.

Key Points (Earnings Takeaways and Growth Actions)

• Management Strategy and Market View
  • Governance of AI agents rests on three elements: identity verification, privilege management and execution logging. GlobalSign, GMO Trust Login and JOINT Ai Flow by GMO will each cover one of them
  • The company will not compete on AI model performance. Its aim is to become a common trust infrastructure provider that lets customers use diverse AI tools safely
  • Management stated a clear capital allocation discipline: divest mature businesses and redeploy the capital into high-growth trust infrastructure areas such as GMO AI Connect. The gain on the sale of GMO Digital Lab shares was JPY 440M
  • The medium-term management strategy will be published by March 2027, and earlier if its content is finalized sooner
• Current Business Progress and Drivers
  • 3Q standalone operating income was JPY 412M (+5.7% YoY), moving past the 2Q revenue timing slippage and investment concentration
  • GMO Sign growth was driven by new customer wins, ARPU gains from pricing plan optimization, and development revenue from dedicated environments for large accounts
  • GMO Trust Login churn has stayed low and in line with the historical average since October. No material stalling of deal flow has been observed
  • Order velocity has picked up since 2H, led by GMO Trust Login. Inquiries, previously dominated by large enterprises, are now spreading to smaller companies
• Key Strategic Initiatives and Inflection Points
  • A Strategic Collaboration Agreement (SCA) with AWS was signed in July, and joint selling ramped up from 3Q. The CloudCREW deal pipeline has expanded significantly
  • GMO AI Connect was consolidated from 3Q. JOINT Ai Flow by GMO will be monetized on two fronts: integration into GMO Sign and embedded offerings for external SaaS providers
  • GMO Sign launched an AI Flow option. Users can move from generative AI through contract search, drafting and signature requests in a single workflow
  • Together with other companies, the group completed a successful proof of concept in which AI agents from different companies verified each other's identity and transaction authority
  • GMO Face Authentication eKYC now supports IC chip reading. The FSA's call to phase out image-upload identity verification creates an opportunity to capture demand

Outlook and Strategy

• Full-year revenue and operating income guidance was maintained. Management cited three supports: 4Q recognition of the delayed revenue from a major overseas customer, accumulating recurring revenue, and the completion of upfront development spending from 1H
• Backing out the full-year operating income guidance implies 4Q operating income of JPY 625M (our estimate). This requires +27.3% YoY versus 4Q of the prior year (our estimate)
• Net Income Attributable to Owners of Parent Company guidance was raised to JPY 1,312M (+30.5% YoY). The JPY 74.35 dividend against forecast EPS of JPY 114.38 implies a 65.0% payout ratio (our estimate)
• CLM is positioned as the largest growth opportunity, shifting the business from one-off certificate sales to a high-margin subscription-based management platform
• The AI agent governance platform will move toward commercial launch through repeated proofs of concept. Management considers development of the underlying existing services complete
• The President stated he will personally take responsibility for handling the incident and preventing recurrence

Positive Factors

• GMO Sign, GMO Trust Login and CloudCREW are all sustaining growth of around 30%, building up recurring revenue
• 3Q standalone SG&A-to-revenue ratio was 49.5%, an improvement of 3.2pt YoY. Personnel and sales expenses were kept in check
• Over the past month, incidents have hit rival certificate authorities, including a major overseas player. Migration deals to GlobalSign have increased as a result
• GlobalSign's root certificate ubiquity stands at 99.9%. Thirty years of operating history create entry barriers that differentiate it from free SSL
• GMO Sign is used by roughly 82% of listed companies in Japan, with cumulative transmissions exceeding 50M. Its electronic official seal, which supports signatures by heads of local governments, is being adopted by prefectures such as Ibaraki and Nara
• The VMC market has grown by about 50% YoY, and the company aims to capture this by strengthening partner sales

Concerns and Risks

• On the GMO Trust Login data breach (2,492 companies and 45,030 individuals affected), the President noted that the absence of reported secondary damage does not mean no damage will occur
• Security costs in Cloud Infrastructure may rise due to more frequent audits and source code reviews. Whether pricing revisions can absorb these costs needs to be monitored
• 9M Cost of Goods Sold rose +17.2%, outpacing revenue growth. Gross Profit Margin declined from 59.5% to 56.9% (our estimate)
• Achieving full-year operating income guidance depends heavily on 4Q recognition of the delayed revenue from a large overseas customer
• Following the unauthorized access incident at group company GMO Internet, the company partially held back on advertising, which affected sales activity for a period
• The net income upgrade stems from a one-off extraordinary gain and should be assessed separately from core earnings growth

Performance Highlights

9M Recurring Profit was JPY 1,038M (+8.5% YoY), Net Income Attributable to Owners of Parent Company was JPY 1,104M (+57.0% YoY), and EBITDA was JPY 2,395M (+7.4% YoY). Higher Cost of Goods Sold pushed Operating Income Margin down from 6.5% to 6.0%. Meanwhile, 3Q standalone revenue reached JPY 5,553M (+7.5% YoY). Progress against full-year guidance was 74.7% for revenue and 61.5% for operating income.

Segment Results

• GMO Sign 3Q Revenue: JPY 672M (+33.7% YoY)
• GMO Sign ARR: JPY 2,487M (+30.2% YoY)
• GMO Sign Contract Transmissions: 6.44M (+27.1% YoY)
• GMO Trust Login 3Q Revenue: JPY 200M (+39.5% YoY)
• GMO Trust Login ARR: — (+38.9% YoY)
• GMO Trust Login Paid IDs: — (+30.4% YoY)
• CloudCREW byGMO 3Q Revenue: JPY 939M (+29.1% YoY)
• JOINT Ai Flow by GMO API Connection Executions: 126.9M (+21.4% QoQ)
• Overseas Revenue Ratio (9M cumulative): 36.5%
• GMO Sign Local Government Adopters: 283 (as of September 30, 2026)

Q&A List

• Q

  Regarding the medium-term management strategy, you mentioned March 2027 at the end. Does that mean it will be presented separately from the full-year results announcement?

  A

  We are targeting by March. If it is finalized earlier, we would like to share it sooner.

• Q

  So the nuance is "by March" rather than "in March"?

  A

  That is correct.

• Q

  On the medium-term strategy, my recollection is that the strategic investment phase runs through this fiscal year, after which the medium-term view was a profit harvesting phase. Is that still correct? Or, given the various positives and negatives emerging around AI security, should we assume the strategic investment phase is being extended as you expand the business base? Please share your current thinking.

  A

  Our strategy going forward is to combine our existing offerings into even stronger services. Accordingly, we consider development of the underlying base services to be already complete.

• Q

  Given the current environment, one might think heightened security risk calls for various costs, such as replacing all servers, replacing software, or making additional investment in the certificate authority. Is it fair to understand that this can be handled as an extension of existing efforts, and that since you are entering a bundling and harvesting phase, the P&L burden will not be that heavy?

  A

  That is correct.

• Q

  On the Cloud Infrastructure business. I understand your services are separate from Desktop Cloud and assume there is no direct impact. However, Cloud Infrastructure serves many customers at low prices while holding large volumes of data. In an era of rising security risk, this seems a difficult business to operate. In fact, Sakura Internet is considering a full server replacement. I think CloudCREW is fine, but there are legacy businesses and businesses that joined the group only recently through partnerships, so I am concerned given the timing. How should we view the security risk in Cloud Infrastructure?

  A

  Cloud Infrastructure does include some fairly old services. Over the past several years, however, we have progressively integrated systems to reduce such risks and have been actively migrating to newer servers. Nothing has materially changed in that respect. That said, we believe we need to conduct security audits and checks more frequently than before. Furthermore, our security measures have so far focused on preventing external intrusion. Going forward, we will also assume an intrusion could occur and conduct thorough source code reviews. Costs may therefore rise. However, rather than simply letting this squeeze profits, we intend to consider measures including a review toward more appropriate pricing.

• Q

  You are presumably facing various attacks even now. Are you currently repelling them on the cloud side?

  A

  Yes.

• Q

  As a follow-up, I was not aware that securities trading was being conducted on Desktop Cloud, albeit at another company. You also handle important data in Cloud Infrastructure. As a risk scenario, what scope of data do you hold in the Cloud Infrastructure business, and what types of data should we assume are central?

  A

  I apologize, but we are legally prohibited from viewing data in customers' domains. Our customer contracts also stipulate that we have no involvement in it.

• Q

  In the recent cloud infrastructure incident, the GMO group offered compensation of up to JPY 3M per person in the event of a data leak. Seeing the case next door, did you hold internal discussions about a worst-case scenario?

  A

  This is not limited to the current case. We have always recognized that possibility, but we have not done anything special in relation to the Onamae.com matter. We are thoroughly prepared for responding to data intrusion and for what to do if an intrusion does occur. Beyond that, we are not envisaging anything further at this time.

• Q

  On single sign-on, I was reassured that churn has not risen due to this incident and that, including recurrence prevention measures, the earnings impact is currently minimal. Given talk of price increases among competitors, how should we think about your room for price revisions in single sign-on?

  A

  We will of course look closely at pricing while monitoring competitors, but there is no such discussion at present.

• Q

  If you decide on a price revision, what factors would go into it? It might be cost-push on your side, competitor pricing, or a desire to invest further. What are you considering and discussing?

  A

  Historically, our approach has been to raise unit prices by adding new features and value. We do not really consider raising prices simply because costs have gone up. Because we build our services in-house, we can improve margins as the customer base grows. We therefore keep base pricing largely unchanged and raise fees according to actual usage. It is less about raising list prices and more about increasing ARPU. Rather than letting this happen naturally, we intend to proactively pursue measures to lift unit prices.

• Q

  Are there currently any businesses where you have implemented price revisions or where margins are rising? It seems there have not been many price revisions since the one a while ago. Is that understanding correct?

  A

  Not GMO Trust Login, but at GMO Sign and elsewhere we have been able to raise ARPU through pricing and plan changes.

• Q

  On security, awareness has risen since October, and since you hold customers' security data, you may be seeing tailwinds. From the outside, there seem to be both positives and negatives, such as authentication being strengthened, or moves back to on-premises in cloud infrastructure. How have customers behaved since October in light of security concerns?

  A

  Excluding the past two weeks or so, when a lot happened, order velocity has increased since October, or more precisely since 2H this year, led by GMO Trust Login.

• Q

  With GMO Trust Login at the center, orders are rising while churn has not been significantly affected. Weighing positives and negatives, is the current 2H trend that the positives from security strengthening are outweighing the negatives?

  A

  Yes. Our customers are mostly large enterprises, but recently inquiries from somewhat smaller companies have also been increasing.

• Q

  Regarding other companies, there were certificate authorities with relatively weak safeguards, such as one in India. Has this drawn renewed attention to GlobalSign's high-standard certificate authority? If there are any negatives, please share them. How is the certificate authority business faring in light of other companies' situations?

  A

  Over the past month, various incidents have occurred at certificate authorities, including one in India and major overseas players. Nothing of the sort has occurred at our certificate authority. On the contrary, migrations from other certificate authorities are actually increasing as sales deals. As for the GMO Trust Login incident, the certificate authority runs on an entirely separate system and was not affected at all. As announced at the outset, GMO Trust Login will also move to the same level of security as the certificate authority. Through this, we aim to raise security across the company and further strengthen customer trust. Regarding other companies' cases this past month, there have been past instances, including on a large scale at US companies, where a certificate authority breached strict authentication rules and could no longer continue operating. Rigorously codifying such rules is one point. The other point is that free SSL has become widespread. As has actually happened, certificate authorities can suddenly change their rules, and because the service is free, their accountability to customers is low and certificates can become unusable. We play a role in firmly supporting corporate businesses, so we will fulfill these responsibilities while further enhancing trust.

• Q

  To sum up, demand for both SSL and GMO Trust Login is strengthening considerably. So even if security enhancement costs arise in Cloud Infrastructure, is it fair to say that, for the company as a whole, the current rise in security needs puts you in a position to better serve customers from a P&L perspective?

  A

  Exactly as you say.