Blog

DEEP RESEARCH · SANDS LAB

Sands Lab: The AI Security Platform Pivot Behind the SI Revenue Jump

Reviewing 2025 earnings, CAPEX, CTI data moat and 2026-2027 growth conditions

Published: 2026-03-13 · FY2025/AI security · Naver Blog

Investment decisions are your responsibility. This material is research, not a recommendation to buy or sell.

0. Bottom line first

My read is: revenue improved, but the quality transition is still being tested. The 2025 revenue jump was driven mainly by SI work and AI Deep consolidation; from 2026 onward, the key is whether proprietary solutions such as SANDY, GLX and MNX regain mix.

Official fact: 2025 consolidated revenue was KRW 11.61 billion, up about 40% from KRW 8.29 billion. SI revenue rose from KRW 2.79 billion to KRW 7.82 billion, while CTI products fell from KRW 5.50 billion to KRW 3.79 billion.

Interpretation: The top-line growth is real, but it was led by public-sector SI and M&A rather than high-margin CTI licenses, so the quality of controlling-shareholder earnings matters.

Sands Lab source attachment 1

1. Real driver of 2025 earnings

Item20242025ChangeMix change
Total revenueKRW 8,297mnKRW 11,612mn+39.9%100% → 100%
CTI productsKRW 5,498mnKRW 3,787mn-31.1%66.2% → 32.6%
SIKRW 2,799mnKRW 7,825mn+179.5%33.8% → 67.4%
Operating profit-KRW 3,709mn-KRW 1,770mnLoss narrowed-

The cited drivers include a KRW 2.38 billion public-sector software supply contract with Korea Information Certificate Authority and a KRW 2.05 billion KISA cyber-security AI dataset modernization project. Sands Lab also acquired an 80.91% stake in AI Deep for KRW 1.84 billion on March 7, 2025; after consolidation, AI Deep contributed KRW 1.51 billion in revenue and KRW 440 million in net income over roughly nine months.

2. Controlling-shareholder earnings

Item20242025Meaning
Consolidated net income-KRW 2,300mn-KRW 465mnHeadline loss narrowed
Net income to non-controlling interests0KRW 84mnAI Deep minority stake, 19.09%
Net income to controlling shareholders-KRW 2,300mn-KRW 549mnActual parent-shareholder result

Official fact: 2025 operating loss narrowed to KRW 1.77 billion from KRW 3.71 billion, and financial income of KRW 1.79 billion helped pre-tax loss improve to about KRW 37 million.

Interpretation: Public SI absorbed fixed costs, but a services-heavy structure is not enough for a true turnaround. The key is whether proprietary software such as SANDY, CTX and MDX rises in the mix.

Sands Lab source attachment 2

3. CAPEX and technology roadmap

Purpose of capital allocationFrom SI defense to AI security platform
M&AAI Deep KRW 1.84bn
R&DKRW 2.02bn expensed
IntangiblesSoftware/IP KRW 630mn
Government projectKRW 7bn deception tech through 2028
Commercial revenue from SANDY, GLX and MNX will determine the payback

Investment cash flow was -KRW 4.14 billion in 2025. The source links KRW 380 million of tangible assets, KRW 630 million of intangibles and KRW 2.02 billion of R&D spending to SANDY, CPU-based GLX and MNX.

4. Moat and risks

Data

30bn threat data points

The source highlights more than 2bn malware samples analyzed since 2004 and more than 30bn threat-analysis data points.

Technology

DBP, DDP and MDX

NET-certified profiling and non-execution malware analysis are positioned as differentiators for APT and file-less attacks.

Balance sheet

KRW 43.7bn liquidity

KRW 34.0bn of cash plus KRW 9.7bn of financial assets, with near-zero interest-bearing debt, provides runway.

5. Valuation and follow-up points

The source says the March 2026 share price was in the KRW 6,000-7,000 range, more than 70% below the KRW 27,300 post-IPO high. Around KRW 100 billion market cap, subtracting KRW 43.7 billion of net cash implies roughly KRW 50 billion of operating enterprise value.

  • Watch for major B2B orders for SANDY and GLX.
  • Track whether MNX expands into telecom or appliance partnerships.
  • If SI remains above 67% of revenue, controlling-shareholder profit turnaround can be delayed.
  • Competition from large IT services firms and global security vendors is a key risk.
Sands Lab source attachment 3

Sources

Naver original