WhiteHawk Limited Overview
WhiteHawk Limited is an ASX-listed micro-cap cyber-risk software company whose operations, customers and revenue have historically sat almost entirely in the United States. Founded by former US Navy deputy director of naval intelligence Terry Roberts, it bills itself as the first global online AI-based cybersecurity exchange. It sells subscription Software-as-a-Service and Platform-as-a-Service products: Cyber Risk Radar, Cyber Risk Program, Cyber Analyst PaaS and Global Entity Illumination. These products use publicly available information and open-source intelligence to assess, prioritise and help mitigate cyber risk across enterprises, supply chains and critical-infrastructure sectors. Its customers include a US federal CISO office, US cities, universities, investment firms and defence-industrial-base companies. In 2026 the company went through a full leadership and governance reset. It also closed the related-party acquisition of Quixxi (AI governance and mobile app security) in October 2026, repositioning around "cyber plus AI governance" with an Australia/APEC growth emphasis. The company has revenue below US$2.1M, persistent losses and a going-concern material uncertainty.
Company's own description (latest filings)
In its 2026 Half Year Report, the company states that the Group "has developed and operates an online Cybersecurity Exchange platform" delivering Cyber Risk SaaS, PaaS, and virtual cyber and risk consultation services focused on cyber-risk identification, prioritisation and mitigation for organisations of all sizes.
The report lists the following product-line subscriptions:
Independent Cyber Risk Program: for mid- to large-sized industry and government organisations.
Cyber Risk Radar: for AI-driven, automated supply-chain or critical-infrastructure risk management at scale.
Cyber Risk Analyst PaaS: for consulting partners, state/local government, higher education and critical-infrastructure sectors.
- Global Entity Illumination, launched in 2025, which identifies all critical-infrastructure organisations across a region globally "within days."
All product lines are stated to use AI and machine-learning analytics. By design they draw on Publicly Available Information (PAI) and Open-Source Intelligence (OSINT) risk datasets, together with cyber maturity models and analytics. The company also says it vets next-generation innovation and partners with "best of breed" solution and channel providers to offer remediation options.
The FY2025 Appendix 4E "About" statement describes WhiteHawk as "the first global online AI based cyber security exchange enabling all businesses and organizations to take smart action to prevent cybercrime, fraud and disruption" through automated, scalable cyber-risk assessments, SaaS and PaaS product lines.
Independent characterisation
Stripped of its "exchange" branding, WhiteHawk is best understood as a niche, outside-in cyber-risk intelligence and assessment vendor, with a smaller but growing compliance-services line (CMMC in the US, Essential Eight in Australia). Its analytical core is non-intrusive: it scores and monitors organisations using external data (dark-web, OSINT, vulnerability and threat feeds, firmographic data from partners such as Dun & Bradstreet). It does not deploy agents inside customer networks.
This places it in the same functional category as security-ratings and third-party/supply-chain cyber-risk management (C-SCRM/TPRM) vendors such as SecurityScorecard, BitSight, UpGuard, RiskRecon and Black Kite. WhiteHawk differs in three ways:
-
It wraps the ratings with analyst-led prioritisation and remediation roadmaps (the "Program").
-
It sells heavily into US public-sector and higher-education buyers.
-
It is about three orders of magnitude smaller than the category leaders.
Historically the company has combined:
-
Recurring annual subscriptions (Radar, Program, PaaS).
-
Large episodic engagements. Examples include a US federal CISO Radar contract (a five-year program in its 5th year in 2024, valued at US$705K that year; S3) and a two-year US$2.4M global social-media-platform contract renewed in Q1 2025 and later discontinued.
-
Smaller consulting/assessment services and, since November 2025, CMMC certification-readiness services.
The Quixxi acquisition (completed October 2026) adds a distinct product family:
Clarity AI: (AI inventory, discovery and governance).
PromptGuard: (generative-AI usage controls).
Scan, Shield and Supervise: (mobile application SAST/DAST/API scanning, runtime application self-protection, and threat monitoring).
This moves WhiteHawk from pure outside-in risk scoring into inside-out application security and AI governance tooling.
Business and revenue model
| Revenue type | Description | Approx. share of revenue | Evidence |
|---|---|---|---|
| Subscription SaaS (Cyber Risk Radar) | Annual subscriptions for continuous supply-chain or sector-wide risk monitoring; priced per portfolio or cohort of entities | Largest historical line; exact split not publicly disclosed | S1, S3, S7 |
| Subscription / program (Cyber Risk Program) | Annual independent cyber-risk program for an enterprise: quarterly deep-dive assessments, semi-annual dark-net assessments, subject-matter expert (SME) support | Material; split not publicly disclosed | S3; Q1 2024 quarterly via Listcorp |
| PaaS (Cyber Analyst PaaS / CAPaaS) | Platform licences to universities, consulting partners and workforce programs (e.g., Miami-Dade County talent program, US$75K grant) | Small; growing | S1, S9 |
| Compliance services (CMMC; AU Essential Eight) | Automated and semi-automated compliance and certification readiness; three CMMC contracts of US$35K–US$171K each after November 2025 | Small; new from Q4 2025 | S1 |
| Data / licensing | Cyber Risk Scorecard licences (e.g., to Dun & Bradstreet), dataset listings via Grist Mill Exchange | Small | S3, S7 |
| Quixxi subscriptions (from Oct 2026) | Clarity AI, PromptGuard, mobile security SaaS; Quixxi FY25 revenue approximately A$575K | Not yet consolidated | S9 (Globe and Mail / TipRanks summary) |
Revenue is recognised over time (100% of H1 2026 and H1 2025 revenue was "goods and services transferred over time"; S2 Note 2). This is consistent with a subscription/service model. The large drop in FY2025 contract liabilities, from US$801K to US$80K, shows that FY2025 revenue benefited from US$801K of revenue invoiced in 2024 and recognised in 2025. Underlying FY2025 billings were therefore weaker than reported revenue, a point corroborated by the 42% fall in customer receipts.
Value-chain position, customers and end-markets
| Customer type | Named / described examples | Source |
|---|---|---|
| US Federal civilian | Federal CISO department (Cyber Risk Radar, 5-year program); Top-10 federal systems integrator pilot; US Federal cyber resilience program (~400 organisations) | S3, S7, S9 |
| US Defense Industrial Base | Top-10 DIB company engagement (US$250K in final stages per Q1 2026); CMMC clients | S9, S1 |
| US state and local government | City of Atlanta (first city-wide Radar, US$92K); "major city in Southeastern US"; Miami-Dade County EDC | S15, S8, S9 |
| Higher education | Georgetown University (4th consecutive year from April 2026); University of South Florida (CAPaaS pilot); Norwich University Applied Research Institute | S3, S9, S15 |
| Commercial / financial | Global investment firm (Radar across 17 subsidiaries); US investment firm (GRC Program, US$77K); ASX 100 company; Cailabs US subsidiary | S1, S8, S3 |
| Technology / media | Global social-media platform (US$2.4M two-year renewal in Q1 2025; later discontinued) | S15, S2 |
| Australia | Four new APEC clients since mid-November 2025; CAUDIT member pathway | S1, S8 |
WhiteHawk sits at the assessment / intelligence layer of the cyber value chain, upstream of remediation tooling and managed security services. It frequently works as a subcontractor to prime integrators. Examples include Guidehouse in 2021, Peraton in 2023, Leidos via a Teaming Agreement on the APOLLO recompete in 2025, and an unnamed "top 10 U.S. federal government systems integrator" in 2026. It also works as a technology partner to consultancies, such as Evolver CLEAR and Novera RiskWise.
Strategy
Stated corporate strategy: key themes
From the 2024 Annual Report: "2025 Business Strategy and Objectives"
-
"2024 was the year that has positioned 2025 to be a growth year for WhiteHawk."
-
Maintain 80% or higher contract renewal rates for annual recurring revenue.
-
Drive new Cyber Risk Analyst PaaS annual subscriptions with universities and colleges, supporting cyber workforce development and cyber R&D while generating revenue for the institutions.
-
Expand Australian presence, including roadshows in Sydney, Melbourne and Perth in May 2025.
From the FY2025 Appendix 4E outlook
-
Advance engagement and subcontracting for WhiteHawk SaaS/PaaS on two large US programs: the FAA National Airspace System modernisation (awarded December 2025; quoted at roughly US$31.5–32.5B) and the US Navy/Marine Corps NGEN network contract (US$7.7B, 2020–2028).
-
Pursue near-term acquisitions positioned for APEC cyber and AI compliance and security (realised via Quixxi).
-
Exploit AUKUS-driven CMMC and Essential Eight compliance, including annual re-certification across prime contractors and their supply chains.
-
Fast-track APEC/US partnerships and sales campaigns focused on CMMC compliance and cyber resilience.
-
Leverage partners and memberships: CAUDIT, DoxAI, AmCham, Novera, ECCOI and Armis.
-
Advance US federal, state and local opportunities, including the US Department of War Critical Infrastructure Resilience Phase 1 Program and State of Florida and State of Texas critical-infrastructure Cyber Risk Radars.
From the 2026 Half Year Report and the new CEO
-
Become a "leading global cybersecurity provider."
-
Expand a global, partner-led and diversified distribution strategy across industries and government agencies.
-
Accelerate commercialisation and scaling of Quixxi Clarity AI.
-
Grow Annual Recurring Revenue (ARR) via scalable operations and diversified channels, reducing concentration risk.
-
Position at the convergence of cyber resilience, operational resilience, AI governance and digital-risk intelligence.
-
Expand university and education collaborations using US government grant programs (cyber workforce, mentorship).
-
The Board and management state that success "must ultimately be demonstrated through disciplined execution, recurring revenue growth and the creation of sustainable shareholder value."
The CEO's 100-day plan (announced 18 Aug 2026; S9)
| Phase | Focus |
|---|---|
| Stabilise (Days 1–30) | Cost discipline and operating reset (A$1.24M annualised savings); cash management |
| Commercialise (Days 61–100) | Complete the Quixxi acquisition and integrate it into the product suite; convert the pipeline |
| Diversify | Partner-led channels; reduce reliance on single large customers |
Strategic initiatives register (last 24 months)
| Initiative | Date | Description | Status |
|---|---|---|---|
| CMMC compliance platform and services | 2025 – Nov 2025 | Automated / semi-automated CMMC and AU E8 platforms; certification services at scale | Live; three contracts (US$35K–US$171K) |
| WhiteHawk APEC Operation | Nov 2025 | AUKUS, defence and regulated-sector focus | Four new clients since mid-November 2025 |
| GSA SCRIPTS BAA vehicle | Jun 2025 | Position on a 10-year, up-to-US$99M SCRM vehicle | Task orders delayed by FY26 US appropriations |
| Leidos APOLLO teaming | 2,025 | OSINT AI/ML analytics role on the ~US$2B APOLLO recompete; RFP expected March 2026, award August 2026 | Outcome not publicly disclosed as at October 2026 |
| Novera RiskWise | Late 2025 – Apr 2026 | Joint solution MSA; JV revenue share targeted for April 2026 | Finalisation not confirmed in retrieved sources |
| Evolver CLEAR | Dec 2025 | Partner product powered by the WhiteHawk platform | Launched |
| Leadership restructure | Mar–Jul 2026 | Chair/CEO split; Australia-based leadership | Completed |
| Quixxi acquisition | Apr–Oct 2026 | AI governance and mobile app security | Completed October 2026 |
| Adisyn Services partnership | Q2 2026 | Enhance cyber-risk solutions in APEC markets | Announced |
| Grist Mill Exchange dataset listing | Q2 2026 | Data monetisation | Advanced |
| Operating reset | Aug–Nov 2026 | A$1.24M annualised cost savings | In progress |
| Options funding (WHKOB) | Jul–Aug 2026 | 139.3M options at A$0.013 strike; up to approximately A$1.5M | Issued; exercise uncertain |
Medium-term financial targets / guidance
WhiteHawk provides no quantitative revenue, EBITDA or ARR guidance. The H1 2026 report states that likely developments and expected results "have not been included… because the directors believe it could potentially result in unreasonable prejudice to the Group". The only quantified operational target found is the 80%+ renewal-rate objective (S3, for 2025). No ESG or sustainability commitments have been made.
Products & Services
Pricing is generally not publicly disclosed. Where contract values are known they are shown as indicative price points.
Cyber Risk to Resilience (WhiteHawk legacy)
| Product | Description and capabilities | Target customer | Launch / latest | Pricing evidence |
|---|---|---|---|---|
| Cyber Risk Radar (CRR) | Scalable, automated cyber supply-chain risk management. Continuously monitors portfolios of hundreds to thousands of entities (vendors, subsidiaries, sector cohorts, critical-infrastructure operators) using OSINT/PAI; produces prioritised vulnerability, compliance and mitigation views. Moved to "100% automated" AI/ML portfolio analytics in 2025, which management says materially improved margin | Federal agencies, primes, cities, states, investment firms with many portfolio companies | In market since at least 2019–2020; automated version 2025 | Federal CISO: US$705K in contract year 5 (2024); City of Atlanta: US$92K; Southeastern US city: US$92K base year; 2021 supplier deployment: US$1.1M for 1,000 suppliers; 2026 federal SI pilot: A$356K for 90 days (~400 organisations) |
| Cyber Risk Program (Independent Cyber Risk Program) | Annual or continuous third-party cyber-risk assessment for one organisation: quarterly deep-dive assessments, semi-annual dark-net assessments, SME services, prioritised risk-mitigation-to-resilience plan | Mid-to-large companies, universities, investment firms | Long-standing; renewed annually | Georgetown University: US$42K (year 2, 2024); US investment firm GRC Program plus Radar: US$77K |
| Cyber Risk Scorecard | Automated assessment of a company's threat landscape, priority risks, maturity and compliance, with an actionable mitigation strategy; delivered quarterly via a Vendor Risk Management SaaS dashboard | SMBs; licensed via partners (e.g., D&B) | Made 100% automated c. 2019–2020 | — |
| Business Risk Online Suite / automated Business Risk Reports | On-demand business-risk reports bundled with C-SCRM subscriptions | Supply-chain program customers | — | — |
| Cyber Analyst Platform-as-a-Service (CAPaaS / APaaS) | Online platform enabling universities, consulting partners and state/local entities to run cyber-risk monitoring, analytics and assessment services themselves; supports experiential cyber internships and workforce development | Universities/colleges, consulting partners, state/local government, critical infrastructure | Piloted with University of South Florida 2024; Miami-Dade program from 2026 | Miami-Dade County EDC grant: US$75K |
| Global Entity Illumination | Identifies all critical-infrastructure organisations/companies across any region globally "within days" | Public- and private-sector clients mapping national or sector exposure | Launched 2025 | — |
| CMMC Compliance and Certification Services | Automated and semi-automated online platform aligned to the US CMMC rule (finalised 10 Nov 2025); claims up to 30% time and resource savings to achieve certification | US Defense Industrial Base primes and suppliers | Platform developed 2025; services at scale from Nov 2025 | Three contracts of US$35K–US$171K each |
| Australian Essential Eight (E8) Compliance | Integration of the ASD Essential Eight framework into automated offerings; positioned for AUKUS supply chains | Australian defence suppliers, regulated sectors | 2,025 | — |
| RiskWise (joint solution with Novera) | Joint solution development, marketing and sales under an MSA with Sydney-based Novera; joint-venture revenue share targeted for finalisation in April 2026 (completion status not confirmed) | Australian enterprise | MSA late 2025 | — |
| Evolver CLEAR (partner-branded) | Cyber Landscape Exposure and Assessment of Risk, an AI-powered rapid supplier-risk assessment mapped to NIST, CMMC, ISO 27001, SOC 2, HIPAA, GDPR and PCI-DSS. Built in Evolver's Innovation Center and powered by the WhiteHawk analytics platform | US federal, state/local, Fortune 500 via Evolver | Launched 10 Dec 2025 | — |
| Cyber datasets (Grist Mill Exchange) | Listing of WhiteHawk datasets on the Grist Mill Exchange data marketplace | Government and analytic consumers | Advanced in Q2 2026 | — |
| Virtual Cyber and Risk Consultation | Analyst-led virtual consultations and SME reach-back | All customers | Long-standing | — |
AI Governance and AI Security (Quixxi, from October 2026)
| Product | Description | Target customer | Notes |
|---|---|---|---|
| Clarity AI | Discovers, monitors and governs AI systems across enterprise environments; builds an AI risk inventory and supports compliance reporting (e.g., EU AI Act) | Government, financial services, industrial enterprises | Flagship. Four-year A$635K contract with an Italian industrial engineering group via DoxAI (signed pre-completion) |
| PromptGuard | Generative-AI usage controls (prompt-level guardrails) | Enterprises adopting GenAI | Added via Quixxi |
Mobile Application Security (Quixxi, from October 2026)
| Product | Description | Notes |
|---|---|---|
| Scan | SAST, DAST and API vulnerability scanning for mobile apps | Quixxi markets a free SAST trial |
| Shield | Runtime Application Self-Protection (RASP) and app hardening via no-code integration | Quixxi claims patented, proprietary technology and two US patent applications |
| Supervise | Continuous threat monitoring for deployed mobile apps | Selected by the NSW Government for the GovConnect app (2019, per Quixxi) |
Quixxi markets SOC 2 Type II and CMMI credentials on its website. Quixxi's FY25 revenue was reported at approximately A$575K, with an international customer base across government, financial services and enterprise.
Financial Narrative
Basis: FY2024 and FY2025 figures are from the FY2025 Appendix 4E (S1, primary; the audit was in progress at release). FY2021–FY2023 income-statement figures are from TipRanks (S4, aggregator, USD, rounded to US$10K).
Income statement
Notes:
-
FY2021–FY2023 EPS are derived (net loss divided by S4 weighted shares); FY2024–FY2025 EPS are as reported in S1.
-
FY2025 weighted shares are an approximation derived from reported EPS. Shares on issue were 641.5M at the start of 2025 and 915.4M at the end.
-
FY2024 and FY2025 EBIT are derived as segment EBITDA less depreciation.
-
FY2020 for reference: revenue US$1.89M, net loss US$1.81M.
-
S1's headline table states "Revenue up 15.6% to US$2,080,744", but its income statement shows FY2025 revenue of US$2,083,270 against FY2024's US$2,080,744. The 15.6% figure appears to compare FY2024 with FY2023 and was carried over in error.
Source conflict: TipRanks' AUD revenue history shows FY2022 at A$4.64M and FY2023 at A$1.23M (−73.6%). This is inconsistent with its own USD statements (US$3.22M and US$1.80M). The USD series is used here.
Margin profile
Revenue CAGR FY2021–FY2025: (2,083 / 2,300)^(1/4) − 1 = −2.4% per year. On a five-year basis from FY2020 (US$1.89M) to FY2025, the CAGR is +2.0% per year.
Balance sheet
Notes:
-
Debt split: all FY2024 borrowings (the Lind facility, US$314.6K) were current. FY2025 leases were current only (US$23.7K). There was no long-term debt in FY2025.
-
Net debt is negative, meaning a net cash position.
-
At 30 Jun 2026: total assets US$618K, cash US$333K, receivables US$261K, no borrowings or leases, total liabilities US$256K (including contract liabilities of US$109K), equity US$362K, working capital US$356K.
-
The 2021 interim report recorded cash of approximately US$2M and no debt at 30 Jun 2021.
-
At 30 Jun 2024, current liabilities exceeded total assets by US$74,612 (H1 2024 report summary via InvestSMART).
Cash flow
H1 2026: operating cash flow −US$1,407K; payments to acquire businesses −US$27.6K (Quixxi transaction costs); share issue proceeds US$1,204K gross. Q2 2026 alone: net operating outflow of US$752K, which equates to roughly 2.3 quarters of runway on the 30 June cash balance of US$333K before new funding.
Commentary on trends, inflections and drivers
Revenue: a structurally stuck top line. WhiteHawk's revenue has oscillated between US$1.8M and US$3.2M for five years without establishing a growth trajectory. The FY2022 peak (~US$3.2M) coincided with the federal CISO Radar contract at full run-rate plus large subcontract work (Guidehouse), as described in S11. FY2023 fell 44% as that work normalised.
FY2024 and FY2025 were flat at about US$2.08M. The FY2025 figure is flattered by the recognition of US$801K invoiced in 2024. Cash receipts give a better read on underlying demand, and they fell 42% to US$1.44M in FY2025.
Inflection to the downside in 2026. H1 2026 revenue fell 65% to US$382K. The company attributes this to "the discontinuation of a material client with social media client", almost certainly the global social-media platform whose two-year US$2.4M contract was renewed in Q1 2025. This was the clearest materialisation of customer-concentration risk in the company's history.
Q2 2026 invoicing of US$353K and the post-period federal cyber-resilience award (A$356K, 90-day) indicate partial replacement. Even so, H2 2026 would need roughly US$1.7M of revenue to match FY2025, which looks unlikely on disclosed bookings.
Gross margin: genuine improvement, then collapse. Gross margin expanded from 41.5% in FY2021 to 71.4% in FY2025. S1 attributes the 26.7% gross-margin improvement to a more profitable sales mix. Management also credits automation ("100% automated Cyber Risk Radar AI/ML Portfolio Analytics, dramatically improving the platform's margin").
In H1 2026 gross margin collapsed to 24.6%. Cost of goods (US$288K) is semi-fixed: analyst labour and data subscriptions did not fall in line with revenue. This shows the cost base is less variable than the "automated SaaS" narrative implies.
Operating costs. Total operating expense excluding COGS fell from approximately US$3.5M in FY2023 to US$2.4M in FY2025. Payments to suppliers and employees fell 16% in FY2025. Within this:
-
R&D fell 25% (US$673K to US$505K).
-
Marketing fell 72% (US$153K to US$42K).
-
Professional fees rose 25%.
H1 2026 operating costs were "steady" per management. The newly announced operating reset targets A$1.24M (approximately US$0.8M) of annualised savings, phased over roughly three months from late August 2026. If delivered, this would cut the cash cost base by roughly a third.
Losses and per-share dilution. Net losses narrowed from US$2.84M in FY2023 to US$1.20M in FY2025 before re-widening (H1 2026: US$1.32M, already more than all of FY2025). EPS optically improved from −1.04 to −0.15 US cents, but mostly because the weighted share count roughly tripled (272M to about 790M). The share count has since risen to 1.15B (June 2026) and roughly 1.40B after the Quixxi upfront consideration. This is a dilution-funded business model.
Balance sheet and liquidity. The company has no goodwill or intangibles; R&D is fully expensed and no acquisition accounting has been booked yet. Equity was negative at end-2023 (−US$806K), restored to small positives by placements, and stood at US$362K at June 2026. The Lind convertible-style facility (which generated finance costs of US$216K in FY2025) was repaid and terminated in 2025, leaving the company debt-free.
Cash of US$333K at 30 June 2026 against quarterly burn of about US$0.75M prompted RSM's review report to draw attention to a material uncertainty related to going concern. The directors' mitigants are:
-
A letter of support for an unsecured loan of up to US$1.5M from an investor, repayable by 31 August 2027.
-
Pursuit of a further up to A$1.5M of loan funding.
-
An options issue that could raise approximately A$1.5M if fully exercised. With a strike of A$0.013 against a share price of A$0.003, exercise is unlikely without a large re-rating.
-
Post-period receipts of US$225K plus US$93K.
-
The cost reset.
-
Expected Quixxi subscription revenue.
Unlock Company Financials
Unlock this company profile to view its financial data.
View Subscription PlansFinancial Detail
Revenue by Segment (USD) and Segment Assets & Liabilities (USD)
| Metric | FY2024 | FY2025 | H1 2025 | H1 2026 |
|---|---|---|---|---|
Australia external revenue (USD) | 0 | 0 | 0 | 6,042 |
USA external revenue (USD) | 2,080,744 | 2,083,270 | 1,099,836 | 376,235 |
Total revenue (USD) | 2,080,744 | 2,083,270 | 1,099,836 | 382,277 |
Australia segment EBITDA (USD) | -748,133 | -485,014 | -278,018 | -530,755 |
USA segment EBITDA (USD) | -788,475 | -438,927 | -226,300 | -769,853 |
Group EBITDA (USD) | -1,536,608 | -923,941 | -504,318 | -1,300,608 |
Australia loss before tax (USD) | -910,814 | -698,381 | -493,864 | -530,755 |
USA loss before tax (USD) | -869,816 | -497,346 | -260,221 | -785,229 |
Australia segment assets (USD) | 174,507 | 394,591 | — | 227,377 |
USA segment assets (USD) | 1,413,216 | 399,984 | — | 390,783 |
Product Families
| Product family | Origin | Components |
|---|---|---|
Cyber Risk to Resilience | WhiteHawk legacy | Cyber Risk Program, Cyber Risk Radar, Cyber Analyst PaaS, Global Entity Illumination, CMMC / Essential Eight compliance |
AI Governance and AI Security | Quixxi (from Oct 2026) | Clarity AI, PromptGuard |
Mobile Application Security | Quixxi (from Oct 2026) | Scan (SAST/DAST/API), Shield (RASP), Supervise (threat monitoring) |
Income Statement and Margin Analysis (%)
| Metric | FY2021 | FY2022 | FY2023 | FY2024 | FY2025 |
|---|---|---|---|---|---|
Revenue (USD K) | 2,300 | 3,220 | 1,800 | 2,081 | 2,083 |
Revenue growth YoY (%) | 21.7 | 40.0 | -44.1 | 15.6 | 0.1 |
Cost of goods sold (USD K) | 1,346 | 1,470 | 837 | 907 | 596 |
Gross profit (USD K) | 954 | 1,750 | 963 | 1,174 | 1,487 |
Operating expenses excl. COGS (USD K) | 3,130 | 3,160 | 3,490 | 2,710 | 2,410 |
EBITDA (USD K) | -2,240 | -1,410 | -2,530 | -1,537 | -924 |
Operating income / EBIT (USD K) | -2,170 | -1,420 | -2,530 | -1,595 | -980 |
Finance costs (USD K) | — | — | — | 186 | 224 |
Pre-tax income (USD K) | -2,470 | -1,540 | -2,840 | -1,781 | -1,196 |
Net income (USD K) | -2,470 | -1,540 | -2,840 | -1,781 | -1,196 |
Basic EPS (US cents) | -1.07 | -0.65 | -1.04 | -0.39 | -0.15 |
Diluted EPS (US cents) | -1.07 | -0.65 | -1.04 | -0.39 | -0.15 |
Dividends per share (US cents) | 0 | 0 | 0 | 0 | 0 |
Weighted avg shares (millions) | 231.11 | 237.16 | 272.42 | 456.57 | 790 |
Unlock Company Financials
Unlock this company profile to view its financial data.
View Subscription PlansMargin Analysis (%)
| Metric | FY2021 | FY2022 | FY2023 | FY2024 | FY2025 |
|---|---|---|---|---|---|
Gross margin (%) | 41.5 | 54.3 | 53.5 | 56.4 | 71.4 |
EBITDA margin (%) | -97.4 | -43.8 | -140.6 | -73.8 | -44.4 |
Operating margin (%) | -94.3 | -44.1 | -140.6 | -76.6 | -47.0 |
Net margin (%) | -107.4 | -47.8 | -157.8 | -85.6 | -57.4 |
Income Statement (USD) and Margin Analysis (%)
| Metric | H1 2025 | H1 2026 |
|---|---|---|
Revenue (USD) | 1,099,836 | 382,277 |
Gross profit (USD) | 719,219 | 94,058 |
Gross margin (%) | 65.4 | 24.6 |
R&D expense (USD) | 233,872 | 162,957 |
Employee benefits expense (USD) | 630,691 | 630,277 |
Professional expenses (USD) | 218,901 | 349,138 |
Finance costs (USD) | 221,731 | 0 |
EBITDA (USD) | -504,318 | -1,300,608 |
Net loss (USD) | -754,085 | -1,315,984 |
Basic EPS (US cents) | -0.11 | -0.14 |
Operating cash flow (USD) | -726,733 | -1,407,085 |
Balance Sheet
| Metric | FY2021 | FY2022 | FY2023 | FY2024 | FY2025 |
|---|---|---|---|---|---|
Total assets (USD K) | — | — | — | 1,588 | 795 |
Cash and equivalents (USD K) | — | — | 103 | 1,074 | 654 |
Trade and other receivables (USD K) | — | — | — | 171 | 86 |
Financial liabilities / borrowings (USD K) | — | — | — | 315 | 0 |
Lease liabilities (USD K) | — | — | — | 110 | 24 |
Total debt incl. leases (USD K) | — | — | — | 425 | 24 |
Net debt (USD K) | — | — | — | -649 | -630 |
Contract liabilities (USD K) | — | — | — | 801 | 80 |
Total liabilities (USD K) | — | — | — | 1,524 | 344 |
Total equity (USD K) | — | — | -806 | 63 | 450 |
Goodwill and intangibles (USD K) | 0 | 0 | 0 | 0 | 0 |
Working capital (USD K) | — | — | — | 12 | 430 |
Accumulated losses (USD K) | — | — | -17,961 | -19,478 | -20,582 |
Balance Sheet — Receipts from customers
| Metric | FY2021 | FY2022 | FY2023 | FY2024 | FY2025 |
|---|---|---|---|---|---|
Receipts from customers (USD K) | — | — | — | 2,481 | 1,441 |
Operating cash flow (USD K) | — | — | — | -1,106 | -1,568 |
Capex (USD K) | — | — | — | 0 | 0 |
Free cash flow (USD K) | — | — | — | -1,106 | -1,568 |
Equity issued, gross (USD K) | — | — | — | 2,382 | 1,502 |
Borrowings drawn (USD K) | — | — | — | 50 | 0 |
Borrowings repaid (USD K) | — | — | — | 220 | 359 |
Dividends paid (USD K) | 0 | 0 | 0 | 0 | 0 |
Share buybacks (USD K) | 0 | 0 | 0 | 0 | 0 |
Returns & Leverage Ratios (%) and Financial Ratios (x)
| Ratio | FY2024 | FY2025 | H1 2026 (annualised where relevant) |
|---|---|---|---|
ROE (%) | n/m (negative equity at start of year) | -466 (on average equity of US$257K) | n/m |
ROA (%) | n/m | -100.4 | -373 |
ROIC (%) | n/m (negative invested capital) | n/m | n/m |
Current ratio (x) | 1.01 | 2.25 | 2.39 |
Debt / equity (x) | 6.7 | 0.05 | 0.00 |
Net debt / EBITDA (x) | n/m (net cash; negative EBITDA) | n/m | n/m |
Interest coverage (EBIT / finance costs, x) | -8.6 | -4.4 | n/m (no finance costs) |
Asset turnover (x) | not computed (FY2023 assets unavailable) | 1.75 | 1.09 |
Cash conversion cycle | Not meaningfully computable. Receivables days were roughly 15 days of FY2025 revenue and roughly 125 days of H1 2026 annualised revenue, reflecting end-of-period billing; there is no inventory | — | — |
Revenue by Region and Region Margins & Growth (%)
| Region | FY2023 | FY2024 | FY2025 |
|---|---|---|---|
United States revenue (USD K) | — | 2,081 | 2,083 |
Australia revenue (USD K) | — | 0 | 0 |
Total revenue (USD K) | 1,800 | 2,081 | 2,083 |
United States growth YoY (%) | — | — | 0.1 |
Valuation Snapshot
| Metric | Value | Date | Source |
|---|---|---|---|
Latest retrieved price | A$0.003 | 30 Sep 2026 | S5 |
52-week range | A$0.002 – A$0.013 | To 30 Sep 2026 | S5 |
All-time high | A$0.45 | 25 Jan 2021 | S13 |
All-time low (closing basis, per TradingView) | A$0.003 | 26 Jun 2026 | S13 |
Market capitalisation | A$3.45M (1.15B shares) | 30 Sep 2026 | S5 |
Enterprise value | A$3.65M (on A$4.60M market cap) | 24 Jul 2026 | S5 |
Beta | 2.12; 1.11 one-year | 2026 | S5, S13 |
Market cap 12-month change | −65.8% | To Sep 2026 | S5 |
Market Valuation
| Metric | Jan 2025 | Jul 2025 | Dec 2025 | Jul 2026 | Sep 2026 |
|---|---|---|---|---|---|
Market cap (AUD Mn) | 7.7 | 9.4 | 5.5 | 4.6 | 3.45 |
Share Price & Returns
| Period | Approximate performance | Basis |
|---|---|---|
1-year | Roughly −65% to −75% | Market cap −65.8% while shares rose about 26% QoQ and about 68% YoY; price fell from about A$0.010–0.013 to A$0.003 |
3-year | Roughly −90% or worse | Price around A$0.03–0.05 in late 2023 (indicative; the 2023 share issue at A$0.0275 option strike suggests trading in the A$0.02–0.04 range) vs A$0.003 now |
5-year | Roughly −99% | A$0.45 peak (Jan 2021) vs A$0.003 |
Since IPO | Roughly −97% to −99% | — |
Valuation Multiples
| Multiple | WhiteHawk | Comment |
|---|---|---|
P/E | Not meaningful (losses) | — |
EV/EBITDA | Not meaningful (negative EBITDA) | — |
EV/Sales (trailing) | About 1.8x on A$3.45M market cap vs TTM revenue of about A$1.9M (Simply Wall St P/S 1.8x) | Deep discount to SaaS norms, reflecting going-concern risk |
P/B | About 6x (A$3.45M vs net assets of US$362K ≈ A$0.55M) | Derived |
Capital Instruments
| Instrument | Number | Exercise price | Expiry |
|---|---|---|---|
Unlisted options | 12,500,000 | A$0.022 | 17 Oct 2027 |
Listed options | 70,333,335 | A$0.02 | 24 Apr 2028 |
Unlisted options | 30,000,000 | A$0.02 | 24 Apr 2029 |
Unlisted options | 93,489,869 | A$0.02 | 24 Apr 2029 |
WHKOB options (issued 28 Aug 2026) | 139,285,715 | A$0.013 | 31 Jul 2029 |
NED performance rights | 9,000,000 | — | Vest per year of service |
Stock appreciation rights | 25,029,711 | per terms | per terms |
Stock appreciation rights | 30,000,000 | per terms | per terms |
Quixxi performance shares (from completion) | 250,000,000 | — | Revenue milestones |
Analyst Conclusions
Management guidance
There is no quantitative guidance. Qualitative priorities are:
-
Stabilise costs (A$1.24M annualised savings).
-
Integrate and commercialise Quixxi / Clarity AI.
-
Grow ARR through partner-led, diversified channels.
-
Expand in Australia/APEC and US government, Defense Industrial Base and critical infrastructure.
-
Develop university and education programs.
Consensus expectations
None. There is no analyst coverage.
Bull case
-
Federal program flywheel. The July 2026 sole-source selection by a leading federal SI places Cyber Risk Radar inside a multi-billion-dollar resilience initiative covering about 400 organisations. Conversion of the 90-day A$356K phase into a multi-year rollout could exceed WhiteHawk's entire FY2025 revenue (US$2.08M), as the 2021 precedent shows: US$1.1M for a 1,000-supplier Radar deployment.
-
Gross-margin leverage on a reset cost base. WhiteHawk has already shown 71% gross margins at about US$2M revenue (FY2025). Post-reset cash opex should be around US$1.6–1.8M per year (derived from FY2025 opex of US$2.4M less about US$0.8M of savings). Combined revenue of roughly US$2.5–3M (WhiteHawk plus Quixxi, including the A$635K four-year Italian contract) could approach EBITDA breakeven.
-
Option value at a micro-cap price. At about A$3.5–4.2M market cap, the market ascribes near-zero value to a debt-free platform with federal vehicles (GSA SCRIPTS, up to US$99M), CMMC compliance tooling and an AI-governance product line in a market projected to grow at about 35% per year. Any material prime award (APOLLO, FAA NAS, NGEN) would be re-rating.
Bear case
-
Solvency first. Cash of US$333K against a burn of about US$0.75M per quarter makes the investor loan letter and further dilution existential, not optional. With options struck at 4x the share price, equity funding will probably require further deeply discounted placements.
-
Revenue base has broken. H1 2026 revenue of US$382K is the lowest half-year in the disclosed record. FY2025 revenue was inflated by US$801K of 2024 deferred revenue, and FY2025 receipts fell 42%. Five years of flat-to-down revenue (CAGR of −2.4% FY2021–FY2025) indicate a product-market-fit or go-to-market problem that a new CEO and an A$575K-revenue acquisition do not obviously solve.
-
Governance and related-party drift. The company is now chaired by the founder of the vendor it bought with up to 500M shares. Board independence is thin, and filings contain basic errors: the 4E growth headline, an unreconciled equity figure, a third-party web address on the 4D letterhead, and contradictory Chair status. The founder who held the federal relationships has left.
Key catalysts and monitorables (next 12 months)
| Timing | Catalyst / monitorable | What to watch |
|---|---|---|
| By 31 Oct 2026 | Q3 2026 Appendix 4C | Cash balance; draw on the US$1.5M investor loan; receipts vs US$750K burn; post-completion share count |
| Q4 2026 | Federal resilience program follow-on | Extension beyond the 90-day A$356K phase; scale of rollout |
| Q4 2026 – Q1 2027 | Quixxi integration | First consolidated Quixxi revenue; Clarity AI pipeline conversion; performance-share milestone definitions |
| Ongoing | Leidos APOLLO / FAA NAS / NGEN | Any disclosed subcontract award |
| Ongoing | Funding events | Placements, loan terms (interest rate yet to be agreed), WHKOB exercise |
| By end-Nov 2026 | Cost reset | Delivery of A$1.24M annualised savings visible in quarterly payments |
| c. 4 Mar 2027 | FY2026 Appendix 4E and audited accounts | Going-concern opinion; revenue vs FY2025 US$2.08M |
| H1 2027 | Australia/APEC traction | Reported Australian segment revenue; CMMC and Essential Eight contract count |
Concluding analyst verdict
WhiteHawk Limited is best viewed as a distressed, sub-scale cyber-risk micro-cap in the middle of a forced transformation, not as a growth SaaS company. Its eight-year record under founder Terry Roberts produced real assets. These include a credible OSINT-based risk-scoring capability, a multi-year US federal CISO reference, positions on federal contract vehicles, relationships with major primes, sticky university and city customers, and a demonstrated ability to run gross margins above 70% when revenue mix is favourable. What it did not produce was scale. Revenue has never sustainably exceeded about US$3M, losses persisted every year, and the share count roughly quadrupled to fund them.
2026 has been a hinge year. Losing a single social-media client cut first-half revenue by two-thirds and pushed the auditor to flag a material going-concern uncertainty. The board responded with a full leadership reset: a new CEO from financial services, a Sydney-based chair, and a near-complete board renewal. It also made a scrip-funded, related-party acquisition of Quixxi that brings AI governance and mobile security into the group. Strategically, the combination of compliance-driven cyber risk (CMMC, Essential Eight) and AI governance is coherent and aligned with real regulatory demand. The July 2026 federal resilience selection is the most important commercial signal in two years.
The investment case, however, is gated by liquidity, not strategy. With roughly one quarter of cash on hand before support funding, the next six months turn on four things: drawing or replacing the investor loan, delivering the A$1.24M cost reset, converting the federal pilot into multi-year revenue, and showing that Quixxi adds recurring revenue rather than just more shares. Investors should also price in governance risk from the Chair's related-party position and recurring disclosure errors.
Verdict: a high-risk, binary special situation. The upside is real if federal and AI-governance bookings land quickly, but further heavy dilution is the base case. The stock is suitable only for speculative capital, and it should be monitored quarter by quarter through Appendix 4C cash and receipts data rather than through narrative announcements.
*All figures are in USD unless marked AUD; fiscal years end 31 December. Primary sources: WhiteHawk ASX filings (FY2025 Appendix 4E, released 27 Feb 2026; 2026 Half Year Report, released 31 Aug 2026; 2024 Annual Report, released 28 Mar 2025; quarterly 4C reports). Market data: StockAnalysis, TradingView, Simply Wall St, TipRanks (aggregators).
Unlock Company Financials
Unlock this company profile to view its financial data.
View Subscription PlansExecutive Leadership
Board of Directors
| Name | Role | Appointed | Background (as publicly disclosed) | Source |
|---|---|---|---|---|
Giuseppe Porcelli | Chair (from 1 Jul 2026). Listed as "Non-Executive Chair" but signs the H1 report as "Executive Chair" | — | Founder of Lakeba Group, a Sydney venture "catalyst" that says it has conceived and commercialised 15 ventures, with partnerships including Microsoft, FUJIFILM and Perpetual. Lakeba was the vendor of Quixxi and is an existing WhiteHawk shareholder, making Porcelli a related party to the Quixxi transaction | S2, S10 |
Brian Hibbeln | Non-Executive Director and "Acquisitions Lead" | — | — | S2 |
Demetrio Russo | Non-Executive Director | 29 May 2026 | — | S2 |
Lisa Wade | Non-Executive Director | 29 May 2026 | — | S2 |
Terry Roberts (former) | Founder; former CEO, President and Executive Chair | Executive Chair since 19 Jan 2018; resigned 30 Jun 2026 | Former Deputy Director of US Naval Intelligence; Executive Director, Acquisition Support Program at Carnegie Mellon's Software Engineering Institute; VP Intelligence and Cyber at Engility; VP Cyber Engineering and Analytics at TASC; Chairman-Emeritus of the Intelligence and National Security Alliance (INSA); undergraduate studies at the University of Maryland | S2, MarketScreener, S6 |
Melissa King (former) | Non-Executive Director; former Governance and Risk Lead | Retired 29 May 2026 at AGM | — | S2, S6 |
Executive Leadership Team
| Name | Title | Tenure | Background | Source |
|---|---|---|---|---|
Adrian Vallino | Group Chief Executive Officer | From 1 Jul 2026 (announced 2 Jul 2026) | More than 25 years scaling technology businesses, building partnerships and delivering revenue growth in global markets; prior roles at Challenger, Genworth Financial and BNY | S2, S9 |
Louisa (Louis) Ho | Company Secretary | From 1 Mar 2026 (replacing Mindy Ku, resigned 31 Mar 2026) | — | S2 |
CFO | Kevin Goodale is listed as CFO by ZoomInfo. The H1 2026 report names the CEO and CFO as CODMs but does not name the CFO. | — | — | ZoomInfo; S2 |
CTO / COO | FY2025 notes reference a COO as a CODM; the name is not disclosed in retrieved sources | — | — | S1 |
“—” = not publicly disclosed.
Directors' Remuneration
| Executive | Year | Salary share of total (%) | Total compensation (USD) | Source |
|---|---|---|---|---|
Terry Roberts (former CEO) | Latest FY reported (FY2025) | 59.67 | 293,258 | S6 (Simply Wall St, derived from the remuneration report) |
Adrian Vallino (CEO) | FY2026 | — | — | — |
Non-executive directors | FY2025 | — | — | S2 Note 3 |
Board & Management Changes
| Date | Change | Context |
|---|---|---|
1 Mar 2026 | Louisa Ho appointed Company Secretary | Transition from Mindy Ku (resigned 31 Mar 2026) |
c. Mar 2026 | Plan announced to split Chair/CEO roles and relocate CEO to Australia | AUKUS/APEC pivot |
29 May 2026 | Melissa King retires; Russo and Wade appointed | AGM board refresh |
30 Jun 2026 | Terry Roberts resigns as CEO, Executive Chair and director | The earlier plan had her staying as an executive director for US business development; she ultimately left the board entirely |
1 Jul 2026 | Adrian Vallino appointed Group CEO; Porcelli becomes Chair | Next-phase growth strategy; Quixxi integration |
Major Shareholders
| Holder category / holder | Stake (%) | Shares | Date | Source |
|---|---|---|---|---|
Insiders (all) | 18.31 | — | Jul 2026 | S5 |
Institutions (all) | 3.15 | — | Jul 2026 | S5 |
Free float | approx. 71.9 (825.95M of 1.15B shares) | 825,950,000 | Jul 2026 | S5 |
Lavya Pty Ltd (substantial holder) | 6.25 | 71,848,744 | 20 Jul 2026 | S17 (Investing.com) |
Terry Roberts (founder) | 3.31 (at the time of S6 data) | — | 2026 | S6 |
Lakeba Group (Porcelli-associated) | — | 250000000 (upfront) | Oct 2026 | S10 |
“—” = not publicly disclosed.
Competitive Landscape
Competitors by Segment
| Product area | Competitor | Ownership / listing | Relative positioning vs. WhiteHawk |
|---|---|---|---|
Security ratings / TPRM | SecurityScorecard | Private (US) | Category leader in outside-in ratings; vastly larger data and sales scale |
Security ratings / TPRM | BitSight | Private (US) | Leader with insurance, financial and government adoption; acquired Cybersixgill (2024) |
Security ratings / TPRM | UpGuard | Private (Australia/US) | Australian-founded TPRM/attack-surface platform with direct relevance in ANZ |
Security ratings / TPRM | RiskRecon | Owned by Mastercard | Bank-grade ratings with a large enterprise footprint |
Supply-chain cyber risk | Black Kite | Private (US) | AI-driven TPRM; overlaps directly with Cyber Risk Radar |
Supply-chain cyber risk | Interos | Private (US) | Multi-tier supply-chain risk with federal customers |
TPRM workflow | ProcessUnity (merged with CyberGRX) | Private | Third-party risk exchange plus workflow |
TPRM workflow | Prevalent (Mitratech) / Panorays | Private | Mid-market TPRM |
CMMC compliance | Many C3PAOs, RPOs and compliance SaaS vendors (e.g., Exostar, PreVeil, Kiteworks; MSSPs) | Mixed | Fragmented; WhiteHawk competes on automation and price |
AI governance (Quixxi) | OneTrust, Credo AI, Holistic AI, IBM watsonx.governance, ServiceNow AI Control Tower | Private / large caps | Well-funded incumbents; Quixxi is sub-scale |
Mobile app security (Quixxi) | Guardsquare, Promon, Appdome, Zimperium, Digital.ai | Private | Established leaders in app shielding / RASP |
ASX-listed cyber peers | archTIS (ASX: AR9); Cyber CX (private); Tesserent (acquired by Thales, 2023) | ASX / private | archTIS is the closest ASX-listed small-cap; different product (data-centric access control) |
Peer Comparison FY2025
| Metric | WhiteHawk (FY2025) | SecurityScorecard | BitSight | UpGuard |
|---|---|---|---|---|
Revenue | US$2.08M | Not publicly disclosed (private) | Not publicly disclosed (private) | Not publicly disclosed (private) |
Revenue growth | +0.1% (FY2025); −65% (H1 2026) | — | — | — |
Gross margin | 71.4% (FY2025) | — | — | — |
EBITDA margin | −44.4% | — | — | — |
R&D intensity | 24.2% of revenue | — | — | — |
Funding / capital | About A$1–2.4M per year via placements | Venture-backed (large rounds) | Venture- and PE-backed | Venture-backed |
“—” = not publicly disclosed.
Recent Developments
Upcoming: the Q3 2026 Quarterly Activities Report and Appendix 4C is due by 31 October 2026, and will be the first with Quixxi partly reflected post-period.



