Cellebrite DI Ltd. (CLBT)

How it makes money

Cellebrite sells mostly through annual and multi-year subscription agreements rather than one-off licences. The filing splits revenue into four lines. Subscription services — cloud and hosted software billed over the term — were $330.8 million in fiscal 2025 and are recognised over the life of the subscription. Term licences — on-premise subscription licences — were $96.2 million and are recognised immediately at the point of sale. Together these two lines make up what the company calls subscription revenue, $427.0 million in 2025, up 21% on 2024. Professional services (advanced access work performed in Cellebrite's own labs, training and consulting) were $30.9 million, and other non-recurring revenue, which includes hardware, was $17.8 million. Two consequences matter for a reader: the company itself notes that a subscription model makes it hard to grow reported revenue quickly, because new business is spread across the contract term; and the upfront recognition of term licences can make individual quarters lumpy even when the underlying contract base is stable.

The difficult, repeatable thing Cellebrite does is re-engineer lawful access to devices whose makers keep hardening encryption and locking down operating systems. That is a research capability — proprietary methods, a large accumulated body of device and app knowledge, and the staff who maintain it — that very few firms can fund and sustain year after year. Around it sit softer but real frictions: evidence produced by the tool has to stand up in court, examiners are trained and certified on it, and the software is embedded in agency workflows and government purchasing vehicles, so switching is disruptive rather than merely inconvenient. The advantage is narrow rather than wide because competitors exist in the same niche, and because a phone maker closing a method can erase part of the capability at any time — the filing itself lists keeping pace with technological change and intense competition among its principal risks.

Demand is driven by the volume of digital evidence in ordinary casework rather than by the economic cycle: crimes are investigated, and phones and cloud accounts are part of nearly every case, whether the economy is expanding or contracting. Police, prosecution and intelligence budgets are among the last public expenses to be cut, which makes the underlying demand defensive. The qualification is timing rather than direction: the company's own risk factors point to government budgeting cycles, appropriations uncertainty, spending reductions and long sales cycles for larger transactions, so orders can slip between quarters or years even when the need has not changed.

Key risks

• Dependence on government and law-enforcement buyers — The company states that its business depends materially on the purchase, acceptance and use of its solutions by law enforcement and government agencies, and that more than 90% of revenue in 2023, 2024 and 2025 came from public-sector customers. Government contracts bring budgeting cycles, appropriations uncertainty, termination rights and the risk of spending reductions.
• Keeping pace with technological change — Cellebrite lists its ability to keep pace with technological advances and evolving industry standards as a principal risk. Its access capabilities must be rebuilt continuously as device manufacturers and operating-system vendors change their security.
• Renewal of subscriptions — Because the business is sold on annual and multi-year subscriptions, the filing identifies dependence on customers renewing those subscriptions as a specific risk; revenue is not secured beyond the contract term.
• Errors, defects or bugs in the solutions — The company flags real or perceived errors, failures, defects or bugs in its digital investigation solutions as a risk. Output used as evidence is held to a higher standard than ordinary software output, so a defect can carry legal as well as commercial consequences.
• Misuse of the solutions and reputational harm — Among its risk factors the company includes misuse of its solutions by customers and the negative publicity and reputational harm that can follow. Tools designed for lawful investigation can be deployed in ways that draw public and regulatory scrutiny.
• Competition and consolidation — The filing lists intense competition and market consolidation among its risks, alongside dependence on technology licensed from third parties and on retaining sales and marketing personnel.
• Artificial intelligence and currency exposure — The company names risks tied to implementing artificial intelligence in its products, and foreign-currency exposure: the filing notes that a substantial share of its expenses — around 32% — is denominated in Israeli shekels while revenue is largely in dollars. Geopolitical instability affecting its Israeli operations is also disclosed.

The filing does not disclose a combined share for a set number of largest customers, so no figure is given here. What it does disclose is concentration by customer type: public-sector customers were more than 90% of revenue in 2023, 2024 and 2025, and U.S. federal government customers alone were approximately 16% of 2025 revenue. The practical reading is that the risk is not one large account walking away but a whole class of buyer — government agencies, and in particular the U.S. federal budget — moving together.