NAPCO Security: The Quiet Flywheel

The Form 10-K for fiscal 2026 puts two numbers side by side that refuse to fit together: revenue at NAPCO Security Technologies rose 11.4% to $202.3m, while operating income fell 1.3% [1]. Between them sits a single line of the income statement, “Litigation settlement cost 16,000” (in thousands of dollars), and how you treat that line decides whether you credit this company with a ROIC of 74% or of 96%. I have run both versions. The answer is a range, and it is unambiguous all the same.

From the outside, NAPCO looks like a niche manufacturer from Long Island that sells alarm panels and door locks: an industrial company exposed to the construction cycle, tidy on the books, but nothing special. The usual counter-thesis is “recurring revenue at a 90% margin”. That is true, but it falls short, because ADT has even more recurring revenue and still earns only a fraction of the return on capital. I consider the distribution architecture to be the key, meaning the question of who in the system carries the capital and who collects the fee. NAPCO has built a three-tier channel structure in which the capital-intensive work (installation, service, end-customer acquisition) sits with the partner, while the monthly communication fee flows directly to NAPCO, bypassing the distributor. The result for the completed fiscal year 2026: $97.5m of service revenue at a 90.3% gross margin, no financial debt, $137.6m in cash and securities, and a cash-adjusted ROIC between ~74% (GAAP) and ~96% (adjusted for the one-off litigation charge) [1].

The foundation: four divisions, one logic

NAPCO Security Technologies (founded 1969, Amityville, NY) runs four divisions: NAPCO, Alarm Lock, Continental Instruments and Marks USA. The product range covers intrusion and fire alarm systems, access control, electronic door locking and, as the decisive element, the StarLink family of wireless communicators. Over 90% of production runs through the company’s own plant in the Dominican Republic, tax-advantaged and close to the US core market [3].

The company makes money in two stages. First through hardware sales via a multi-tier distribution network, more on that shortly. Second, and this is the more important part: every installed device with a StarLink module activates a monthly communication fee. This Recurring Service Revenue (RSR) reached 48.2% of revenue in fiscal 2026 ($97.5m of $202.3m) at a gross margin of 90.3%, three times that of the hardware business (30.3%) [1]. In individual quarters the RSR share was higher: Q3 FY2026 reached 51% [2]. On a full-year basis, 48.2% is the reliable figure.

The structural strength shows most clearly in weak hardware periods: the RSR base can keep growing even when device sales decline, as long as the cumulative installed base rises. FY2025 proved it. When equipment revenue collapsed by 16%, RSR grew 14% to $86.3m [3]. The infrastructure installed in earlier years keeps sending its monthly fees. FY2026 continued the series: RSR +13.0% to $97.5m, this time alongside hardware that was growing again (+10.0%) [1].

Fiscal 2026 in numbers

The FY2026 10-K (balance sheet date 30 June 2026) delivers the first complete annual accounts, on which all following chapters are built [1].

Balance sheet as of 30 June 2026: cash $126.93m plus marketable securities $10.64m = $137.57m; equity $191.00m; net intangibles $2.99m; still no financial debt [1].

Three findings from this table

First: the margin jump came from hardware, not from mix. For me this is the most surprising number of the year, and it refutes the comfortable version of the convergence thesis. Total gross margin rose by 3.6 percentage points. Decomposing that increase gives roughly +3.5 pp from the higher equipment margin (23.6% → 30.3%, weighted by the hardware share), only +0.5 pp from the mix shift (RSR share 47.5% → 48.2%) and −0.3 pp from the slightly lower service margin. The thesis that “gross margin rises automatically with the RSR mix” holds in principle; in fiscal 2026, however, it contributed almost nothing to the result. Price increases on the hardware side worked far more strongly than I had assumed.

Second: the litigation charge sits in the P&L. The income statement contains the line “Litigation settlement cost 16,000” (in thousands of dollars) [1]. That is why operating income fell 1.3% even though revenue rose 11.4%. Anyone who additionally deducts these $16m from net cash while also working with reported GAAP earnings counts them twice. The first version of this article did exactly that.

Third: the service gross margin has declined for the first time. 90.3% after 91.0%: in absolute terms a triviality, but as a change of direction it is the first data point in years that does not fit the compounder narrative. The figure remains clearly above the 88% cut-off threshold I have defined for my monitoring.

The distribution architecture: who NAPCO’s partners really are

Anyone who wants to understand the ROIC thesis must first understand the channel structure. “50,000 partners” is the marketing number. The economic reality is a three-tier architecture with very different power relationships at each tier.

Tier 1: large distributors (few, powerful, hardware focus). The FY2025 10-K cites roughly 9,000 direct customers, but concentration at the top is substantial: a single customer accounted for 11% of receivables as of June 2025 (up to 19% in prior years), a second for another 13% [3]. The strategically most important large partner for about two years has been ADI Global Distribution, the world’s largest security wholesale platform with over 200 locations, part of Resideo. On the Q2 FY2026 earnings call, COO Kevin Buchel described the ADI relationship as excellent and stressed that ADI had given NAPCO access to some of the largest dealers in the world, particularly through fire-radio deployments [4]. Management’s stated goal: ADI is to become a 10% equipment customer.

Tier 2: regional distributors and wholesalers. A network of smaller regional traders (historically including Anixter/Wesco) that buy for their own account and resell to installers. They smooth out the geography but individually have little bargaining power.

Tier 3: installers, integrators, locksmiths (many, fragmented, RSR focus). The base of the system: tens of thousands of small security firms that sell, install and maintain NAPCO systems. Here sits the decisive wording of the FY2025 10-K: NAPCO describes a national network of independent dealers and integrators that depend on the NAPCO platform for the communication services of their radios and smart security devices, and that pay a monthly fee to run and manage their own business [3]. That is the clearest statement of dependence the company itself makes.

The asymmetry: hardware runs through the distributor, the fee does not

The analytically most important point of the entire channel structure: the RSR payment relationship runs directly between dealer and NAPCO; the distributor is not part of it. ADI controls the hardware purchasing flow (and can throttle it, as the FY2025 destocking showed), but not the service stream. Once a device is activated, the monthly fee is decoupled from inventory cycles, distributor moods and channel conflicts.

This asymmetry also explains the share’s behaviour in weak quarters: equipment disappointments (such as Q2 FY2025, −25% equipment due to two distributors) trigger sell-offs, even though the most valuable part of the business, the RSR annuity, keeps running practically untouched.

Are the dealers really locked in?

The dependence is real but not absolute, and it is deliberately constructed to be attractive to both sides.

What binds: First, the installed base. A dealer with hundreds of active StarLink accounts would have to physically retrofit every system on switching, on site at the end customer. Second, the certification and training investment: NAPCO trains actively, and over a thousand dealers signed up for a single product-launch class at ISC West alone [7]. Third, the dealer’s own RMR interest: the dealer earns on the monitoring contract with the end customer, and NAPCO’s fee is his input cost for his own recurring business. NAPCO explicitly positions itself towards the channel as an RMR enabler: every installed system is meant to bring the dealer recurring income too.

What does not bind: NAPCO’s own Connected Home dealer programme expressly allows dealers to keep their preferred alarm-panel brand and their preferred central station and to use only the StarLink universal communicators [7]. That lowers the barrier to entry, but it means, mirror-image, that the lock-in happens at communicator level, not at system level. For new installations a dealer can reach for Telguard, Alula or Alarm.com-compatible communicators at any time. The moat protects the installed base (existing accounts), not automatically the flow of new business.

Unit economics: what a single device really delivers

I understand the essence of the NAPCO model best on a single-unit basis. Take a typical StarLink communicator:

What matters for assessing the unit economics is the dual role of the device sale: the hardware margin of roughly 30% is not the product, it is the customer-acquisition-cost subsidy. NAPCO in effect sells an annuity contract whose acquisition is paid for by the dealer. In classic SaaS terminology: CAC is negative, because NAPCO already earns on the acquisition event (the hardware sale) before the recurring revenue even begins. No peer in the comparison universe has this constellation.

These figures explain why NAPCO’s gross margin can rise structurally: the more devices are cumulatively installed, the larger the share of RSR with its 90% margin in total revenue. Gross margin reached 59.2% in FY2026 after 55.6% the year before [1], although, as shown above, the lion’s share of that jump came from the hardware margin and not from mix. The convergence target is an RSR share of >60% on a five-year view; at a progress of 0.7 percentage points in FY2026, that is a slower path than the narrative suggests.

The reinvestment rate confirms the capital-light nature: CapEx for all of FY2026 was only $1.92m, 0.9% of revenue, against $61.15m of operating cash flow [1]. Because NAPCO runs neither an installer base nor monitoring stations (the channel does that) and communication runs over leased cellular networks rather than its own cloud, the incremental capital need of RSR growth stays minimal.

ROIC vs. WACC: where value is created

A central finding: NAPCO shows no separate goodwill item on its balance sheet [1]. The historical acquisitions (Alarm Lock, Marks USA, Continental Instruments) are fully amortised. What remains is $2.99m of intangibles, primarily customer relationships and patents. With invested capital of $53.4m, the distinction between ROIC including and excluding intangibles is therefore computationally meaningless (the gap is less than six percent of IC). That is not coincidence but structure: NAPCO’s capital was built organically, not by inflating the balance sheet through acquisitions.

Methodological note: My ROIC figures are based on net-cash-adjusted invested capital, that is, the capital actually working in the operating business. For asset-light models with large cash balances this approach is methodologically correct and common practice (cf. Mauboussin / HOLT), but it has to be stated explicitly: a classic book-value ROIC without netting off cash would give lower but still exceptional values (~25% on full equity).

“A company that generates $39m to $52m of NOPAT on $53m of net invested capital: that is the chain of evidence, installed base, high service mix, CapEx of 0.9% of revenue, operating cash flow of $61m.”

The peer comparison: four models, one sector

The question of why NAPCO’s cash-adjusted ROIC sits at 74–96% (the first version put it at ~85–90% here), while comparable companies reach 7–20%, is the most important analytical question of this article. The answer lies not in the margin but in who in each business model owns the customer relationship and who carries the capital for it.

Alarm.com (ALRM), the platform that shares the channel: The structurally closest counterpart. ALRM also sells through independent installation partners (B2B2C), ALRM also lives on recurring revenue (68% SaaS share on $1.0bn of revenue in 2025, ~54% gross margin) [5]. But Alarm.com runs its own cloud platform with substantial engineering and infrastructure spend, and growth was supplemented for years through acquisitions, with the corresponding goodwill load on the balance sheet. Both push invested capital up. Result: ROIC ~10–12% despite a high recurring share. ALRM also splits the service margin with the dealer channel differently: the platform fee has to fund ongoing product development of a full smart-home suite, whereas NAPCO’s StarLink fee is at its core cellular pass-through with minimal own infrastructure.

Allegion (ALLE), the classic industrial model: Around $4bn of revenue, premium locking systems, global manufacturing and distribution. ~24% adjusted EBITDA margin, but the invested capital ($3–4bn: plants, warehouses, field sales, ~$2bn of net debt) is the counter-model to NAPCO [5]. Recurring share: only ~15%. ROIC ~19–20%, solid for an industrial company, but every additional unit of revenue requires proportional capital. Allegion often owns the end-customer relationship itself (large projects, specification business) and pays for that control with capital intensity.

ADT Inc. (ADT), the inverse trap and the most important lesson: ADT has ~80% recurring revenue, far more than NAPCO, and still only ~7% ROIC [5]. The reason lies precisely in the channel architecture: ADT owns the entire customer relationship itself. Its own technician network, its own customer acquisition (subscriber acquisition costs), its own monitoring centres, financed with ~$9bn of net debt. Every new subscriber consumes capital before it delivers recurring revenue. Invested capital sits at $15–20bn. NAPCO replicates the same basic economic principle (a monthly fee per installed unit) with ~$53m of IC, because the capital-intensive half of the business sits with the partner.

* For NAPCO the figure shown is the EV/EBIT that can be computed exactly from the FY2026 10-K, not EV/EBITDA: market capitalisation of $1.33bn less $137.6m of net cash gives an enterprise value of $1.19bn [5]; on adjusted EBIT of $61.6m that is 19.3x, on GAAP EBIT of $45.6m 26.1x. On an EBITDA basis the values would be correspondingly lower. The peer multiples in the same column come from market data and are EV/EBITDA [5]; the rows are therefore not directly comparable.

The table shows the pattern: ROIC does not correlate with the recurring share, but inversely with the share of the value chain the company has to capitalise itself. ADT (100% self-capitalisation of the customer relationship) has the lowest ROIC despite the highest recurring share. NAPCO (channel carries installation, acquisition and service) has the highest, at the lowest CapEx intensity of the entire comparison field (~1% vs. 8–20%).

The three structural ROIC drivers

Driver 1: extremely small invested capital. ROIC = NOPAT / IC. NAPCO’s NOPAT (around $45m as the midpoint of the two readings) meets net-cash-adjusted IC of only ~$53m: no US factory of its own in the capital base (Dominican Republic plant, depreciated), no field-sales apparatus, no monitoring infrastructure, no cloud data centres. Alarm.com carries goodwill and platform, Allegion carries plants and warehouses, ADT carries a technician network and $9bn of debt.

Driver 2: margin expansion through RSR mix, though not the main driver in FY2026. Total gross margin is the weighted average: 30.3% × (1 − 0.482) + 90.3% × 0.482 = 59.2%, exactly the reported figure. So the mechanism holds. It just barely worked in the past year: the RSR share rose only from 47.5% to 48.2%, which explains roughly 0.5 percentage points of margin uplift. The remaining 3.1 percentage points of the increase came from the equipment margin (23.6% → 30.3%), dampened by a service margin that declined slightly for the first time. Price increases on the hardware side are therefore biting far harder than I had assumed. That is a better finding than the mix thesis, but also a less automatic one: price increases cannot be repeated every year, mix shift can.

Driver 3: outsourcing capital to the channel while binding the fee directly. That is the design achievement of this model: installation, end-customer service, technicians and initial acquisition sit with the partner (capital-intensive, low-margin). The communication fee flows directly from the dealer to NAPCO, bypassing the distributor (capital-free, high-margin). NAPCO has secured the best spot in the value chain and delegated the rest. ADT does the exact opposite, and the ROIC gap of ~80 percentage points is the bill.

“The ADT paradox in one sentence: more recurring revenue alone does not create high ROIC. What matters is who has to put up the capital to win and serve the customer, at NAPCO the channel, at ADT the company itself.”

Why the flywheel runs and where the growth came from

NAPCO’s RSR flywheel does not work because the company is particularly large or technically superior. It works because of a channel architecture built over decades: an installed base with real switching costs per device, a dealer ecosystem that needs NAPCO’s platform for its own recurring business (that is how the 10-K itself describes it [3]), and a fee relationship that runs directly and independently of distributors. The moat primarily protects the installed base; in new business NAPCO competes every quarter against Telguard, Alula and other communicator vendors. That RSR has nevertheless grown at double-digit rates for years (FY2025: +14% [3], Q2 FY2026: +12.5% [4], Q3 FY2026: +15% [2]) shows that NAPCO has been winning that competition so far.

The structural growth driver of recent years is well known in the industry: the shutdown of 3G cellular networks forced a nationwide communicator replacement cycle from which StarLink profited directly. That tailwind is fading. The growth question of the next five years will be decided on two fronts: the continued conversion of the remaining POTS landline connections (NAPCO’s TriCarrier products address exactly this migration) and MVP Access adoption.

Optionality: MVP Access as a call option on a second RSR wave

MVP Access is NAPCO’s first fully cloud-based product line: access control with a monthly fee per door instead of a one-off system sale. The strategic point lies in the target channel: MVP is aimed at locking dealers and locksmiths, that is, the Marks USA and Alarm Lock customer base, which so far bought pure hardware and knew no recurring business. On the Q2 FY2026 call, COO Buchel put it roughly like this: the locking dealers should in future receive recurring income like the alarm dealers [4]. That is the attempt to transfer the StarLink playbook to a second, so far untapped dealer population.

Management has named a concrete time frame and managed expectations: material RSR contributions from MVP are expected only for the second half of calendar 2026, or Q1–Q2 FY2027; the first half of FY2026 ran, as expected, without a notable MVP contribution [4]. Subscriber numbers are not reported. For me, MVP Access therefore remains a call option: a potentially significant second RSR stream with identical channel logic, but still without reliable public adoption data and thus not a viable base-case assumption.

Valuation: bear, base, bull

I value NAPCO with a DCF model on free cash flow, in three scenarios, unweighted:

The terminal-value share in the base case is ~72% of equity value, high, but appropriate for a recurring-revenue model with structurally growing FCF. The net cash buffer as of 30 June 2026 is $137.6m (cash $126.9m + marketable securities $10.6m) [1].

Bear versus bull

What has been added since June

The first version of 10 June 2026 relied on the 10-Q for the third quarter of FY2026 and the FY2025 10-K. With the FY2026 10-K of 24.08.2026 I have recomputed all annual figures and corrected three statements [1]. The RSR share on a full-year basis is 48.2%, not 51%; the 51% was a single-quarter value from Q3 [2]. The equipment gross margin is 30.3% rather than the ~29% of the first version, and it is the main driver of the margin jump. And the $16m litigation charge sits in the income statement, not just on the balance sheet; it must therefore not be deducted from net cash on top when one is simultaneously working with GAAP earnings. The resulting correction to the net cash calculation is in the valuation chapter.

My own monitoring triggers, checked against FY2026

I have defined three cut-off conditions for this position. This is where they stand after the FY2026 accounts:

No trigger has been tripped. But two of three are pointing in the wrong direction for the first time, and the third falls due in the next two quarters. The fourth, informal trigger, a renewed distributor destocking cycle combined with rising ADI revenue concentration, remains in place and did not occur in FY2026: equipment grew 10.0% [1].

My assessment after FY2026: the fiscal year was operationally better and, on the earnings line, worse than I had expected in the first version. Better, because the hardware margin jumped by almost seven percentage points and operating cash flow grew 14.2%. Worse, because a one-off lawsuit pulled $16m through the income statement and let operating income fall 1.3% despite double-digit revenue growth. Anyone holding the shares should let both sentences stand side by side; they describe the same year.

The three open questions for the next step

First, the RSR saturation curve: how many addressable units remain for the POTS-to-cellular migration in the US, and how quickly does the fading of the 3G cycle erode the activation rate? NAPCO publishes no activation numbers; revenue development (FY2025 $86.3m → FY2026 $97.5m, +13.0%) is the only public proxy [1]. The growth rate slowed slightly against the prior year’s +14%.

Second, MVP Access adoption from FY2027: management has set the date itself (Q1–Q2 FY2027 for material contributions) [4]. If MVP misses that timeline, the second growth engine is missing exactly when the first weakens. As soon as subscriber or door counts are reported, they will be the share’s most important leading indicator.

Third, the competitive position in new business: the moat lies in the installed base, but what is NAPCO’s win rate on new installations against Telguard, Alula and Alarm.com-compatible communicators? Channel voices (dealer forums, distributor feedback) would be more valuable here than any filing number.

Conclusion

NAPCO Security Technologies is no bargain, but it is one of the qualitatively strongest capital-allocation models in the North American small-cap security segment. A cash-adjusted ROIC of 74% (GAAP) to 96% (adjusted) against a ~12.5% WACC was built organically, and the channel architecture (capital with the partner, fee directly with NAPCO) makes it structurally defensible. Two things I hold on to: the moat protects the base and not new business, and fiscal 2026 showed that the margin story is currently carried by hardware prices and not by RSR mix.

Update log

• 05.09.2026 — Language revised to house style, list of sources added; figures and valuation unchanged.
• 04.09.2026 — Updated on the basis of the FY2026 10-K (24.08.2026): RSR share 48.2% instead of 51% (Q3 single-quarter value), equipment gross margin 30.3% instead of ~29%, $16m litigation charge recognised as a P&L item and double counting against net cash removed; ROIC as a 74–96% range instead of a ~85% point estimate; monitoring triggers checked against FY2026. Price basis $37.05 (03.09.2026).
• 10.06.2026 — First published, based on the Q3 FY2026 10-Q and the FY2025 10-K.

Sources

1. NAPCO Security Technologies, Inc., Form 10-K for the fiscal year ended 30.06.2026, filed with the SEC on 24.08.2026. Income statement (revenue by segment, gross margins, litigation settlement cost, operating income, tax rate), balance sheet as of 30.06.2026 (cash, marketable securities, equity, intangibles), cash-flow statement (operating cash flow, CapEx), dividend increase. → https://www.sec.gov/Archives/edgar/data/69633/000110465926100081/nssc-20260630x10k.htm
2. NAPCO Security Technologies, Inc., Form 10-Q for the quarter ended 31.03.2026, filed 05.05.2026. Single-quarter RSR share (51%), RSR growth Q3 FY2026, nine-month tax rate as the basis of the normalised tax rate. → https://www.sec.gov/Archives/edgar/data/69633/000110465926055383/nssc-20260331x10q.htm
3. NAPCO Security Technologies, Inc., Form 10-K for the fiscal year ended 30.06.2025, filed 25.08.2025. Customer concentration (receivables), number of direct customers, description of the dealer network and platform dependence, manufacturing in the Dominican Republic, segment development FY2025. → https://www.sec.gov/Archives/edgar/data/69633/000155837025011750/nssc-20250630x10k.htm
4. NAPCO Security Technologies, Inc., fiscal Q2 2026 results and earnings call, 02.02.2026. Statements by COO Kevin Buchel on the ADI partnership, the 10% customer target, MVP Access and the timeline for RSR contributions; RSR growth Q2 FY2026. → https://investor.napcosecurity.com/2026-02-02-NAPCO-Security-Technologies,-Inc-Reports-Fiscal-2026-Q2-Results (transcript: https://seekingalpha.com/article/4865003-napco-security-technologies-inc-nssc-q2-2026-earnings-call-transcript)
5. Market data, as of 03.09.2026: price $37.05 (NASDAQ: NSSC), market capitalisation $1.33bn, enterprise value; peer metrics (recurring share, margins, ROIC, CapEx intensity, EV/EBITDA) for Alarm.com, Allegion and ADT from market data and the respective 2025 annual reports.
6. Aswath Damodaran, Implied Equity Risk Premium 2026, NYU Stern; StockAnalysis.com, beta NSSC. Inputs to the CAPM WACC. → https://pages.stern.nyu.edu/~adamodar/New_Home_Page/datafile/implpr.html
7. NAPCO Security Technologies, Inc., company communications on the Connected Home dealer programme and ISC West (product training, universal communicators). → ‹TODO: Link›