Summary
- CROC is best understood less as a single-product cloud vendor than as a Russian enterprise continuity contractor: its public materials emphasise IT landscapes, complex integration, local and foreign vendor coordination, support and sector-specific implementation for large companies.
- The 2024 public accounts show why this is a labour-and-procurement business rather than a clean platform annuity: CROC reported RUB 32.0 billion of revenue, RUB 640.8 million of net profit and a mix of bought goods, own services and software-rights resale, which points to thin net margins wrapped around high-value implementation.
- The investment case is not "Russia must replace foreign IT, therefore CROC wins". The stronger thesis is that replacement under sanctions creates expensive coordination work, but customers now demand faster payback, lower total cost, better support and clearer accountability.
- Public evidence can prove CROC's legal identity, revenue scale, service positioning, public-procurement exposure, adjacent cloud/localisation use cases and the market's substitution pressure. It cannot prove individual contract margins, project success rates, customer renewal quality or the real cost of support behind each implementation.
The buyer is trying to avoid an outage, not buy a slogan
Imagine the chief information officer of a Russian manufacturer that has been told to replace a foreign ERP module, a virtualisation layer, security tooling and a European-hosted collaboration service before the next renewal. The factory cannot pause its production schedule while lawyers test license rights and engineers rebuild directories, backups, integrations and user permissions. The finance department still needs month-end close. The warehouse still needs stock movement. The sales office still needs customer history. The regulator still expects personal-data controls and critical-system documentation. In that setting, a systems integrator is not priced only by server hours or software seats. It is priced by the avoided cost of breaking a working enterprise.
CROC's public identity fits that continuity problem. The company says it has spent more than 30 years building IT landscapes for key Russian enterprises and moved from supplier and systems integrator to technology partner for large companies and holding structures (https://www.croc.ru/). Its company page describes 34 years of project experience, broad expertise, sector specialisation and partnerships with Russian, western and Asian vendors (https://www.croc.ru/about-us/). Its requisites page identifies the legal entity as Closed Joint Stock Company "CROC incorporated", with INN 7701004101 and OGRN 1027700094949 (https://www.croc.ru/profile/). Those are dry details, but they matter because the economic unit here is a contract with a legally accountable integrator, not a generic claim about Russian cloud demand.
The direct substitute is not only another integrator. A buyer can try five routes. It can build an in-house IT team, hire more architects and accept slower delivery. It can use a state-backed integrator that may be favoured in public-sector or strategic projects. It can take direct support from local software and hardware vendors, leaving the buyer to coordinate cross-system risk. It can buy a cloud platform bundle from Cloud.ru, Yandex Cloud, Selectel, K2 Cloud, T1 Cloud or another provider and keep custom integration separate. Or it can freeze the legacy estate, stretch unsupported foreign systems, postpone upgrades and hope audit, security and failure costs stay lower than the migration bill. CROC's opening question is whether it can be paid enough to make the first four routes less attractive than a single partner taking responsibility for continuity.
That is a narrow claim. Public CROC and registry evidence can show the firm has scale, legal standing, contracts, staff and a broad solution catalogue. It cannot show whether a particular ERP migration was profitable, whether a client renewed at attractive margin, whether a support desk was overloaded, or whether local substitutes achieved the same reliability as the systems they replaced. It can show the market is asking for localisation, import substitution, continuity and lower total cost. It cannot turn those needs into proof of durable margin. This article therefore prices CROC as a converter of uncertainty into billable integration labour, not as a beneficiary of a simple substitution wave.
The accounts show a contracting engine, not a pure software annuity
The clearest financial evidence is Russia's public accounting resource for 2024. The BFO download dated 24 May 2026 identifies CROC's 2024 financial statements and shows units in thousand roubles (https://bo.nalog.gov.ru/download/bfo/pdf/6611789?detailId=51853421&period=2024). In the income statement, CROC reported 2024 revenue of RUB 32,003.946 million against RUB 32,474.590 million in 2023. Net public summaries from Checko show the same broad picture: revenue down about 2 percent to RUB 32 billion and net profit down about 6 percent to RUB 640.8 million (https://checko.ru/company/krok-inkorporeyted-1027700094949).
The composition is more revealing than the top line. The BFO statement breaks 2024 revenue into RUB 10,851.497 million from resale of purchased goods, RUB 19,183.143 million from goods, works and services of own production, and RUB 1,969.306 million from rights to use software. Cost of sales was RUB 24,368.271 million, including RUB 9,370.066 million on purchased goods, RUB 13,542.845 million on own goods, works and services, and RUB 1,455.360 million on software rights (https://bo.nalog.gov.ru/download/bfo/pdf/6611789?detailId=51853421&period=2024). That mix is exactly what one would expect from an integration contractor living between vendors and enterprise customers. Hardware and software resale creates scale, but the real defence is in design, migration, customisation, support and the customer's reluctance to rerun a complex selection process.
Net profit of RUB 640.8 million on RUB 32.0 billion of revenue is a net margin of roughly 2 percent. Profit from sales was RUB 1.340 billion, about 4.2 percent of revenue, before interest and other items. That is not the margin profile of a dominant proprietary software platform. It is the profile of a firm carrying labour, procurement, credit, project-management and support risk while trying to make enough spread on a large volume of work. The same statements show interest expense of RUB 795.345 million in 2024, including bank-credit interest and lease or rental interest, which means the cost of money matters to the contract model (https://bo.nalog.gov.ru/download/bfo/pdf/6611789?detailId=51853421&period=2024).
The balance sheet also fits a project business. Inventories were RUB 5.150 billion at year-end 2024, including work in progress of RUB 3.335 billion and goods for resale of RUB 1.431 billion. Receivables were RUB 10.335 billion, with short-term buyers and customers at RUB 7.906 billion. Payables were RUB 8.285 billion, including supplier and contractor payables of RUB 4.919 billion and advances received of RUB 1.753 billion (https://bo.nalog.gov.ru/download/bfo/pdf/6611789?detailId=51853421&period=2024). A buyer sees a technical partner; the accounts show a financing bridge between customer milestones, vendor deliveries, support obligations and payroll.
This matters for valuation of the thesis. Replacement demand can raise CROC's addressable work without raising its margin. If a client wants an unsupported system replaced by a domestic stack, CROC may need scarce architects, test environments, certification documents, procurement staff, security reviewers and support engineers. Some of that can be billed. Some becomes overrun. The more complex the legacy estate, the more CROC can argue for a premium. The more customers demand fixed prices and quick payback, the more that premium is competed away.
CROC sells the work between vendors
CROC's own site does not present a narrow cloud-product story. It presents a broad technology-partner story. The company says it works across sectors, with competence in IT infrastructure, business solutions, data centres and services (https://www.croc.ru/about-us/). The solution navigator lists business systems, engineering and multimedia systems, infrastructure, networks, contact centres, computing power, building management, MES, WMS, ERP-related work, security, cloud and industry solutions (https://www.croc.ru/solution-navigator/). That range is commercially useful because substitution in a large enterprise rarely stops at one application.
The practical buyer problem is cross-dependence. Replacing a foreign virtualisation platform changes backup design, monitoring, disaster recovery, access control, hardware utilisation and support training. Replacing an ERP module changes integration with warehouse management, accounting, tax reporting, master data, data warehouses and process controls. Replacing collaboration tools changes identity management, archives, mobile access, endpoint security and user training. Replacing network equipment changes operations documentation and incident response. The contractor able to describe those dependencies before a failure happens has a claim on budget even when customers are cutting discretionary IT.
CROC's 2026 commentary confirms that buyer psychology has moved from romantic digital experimentation to strict economics. In a June 2026 press release, CROC deputy general director Valentin Gubarev said companies are paying more attention to information security, business-process continuity and reliable support of critical systems after the large import-substitution phase (https://www.croc.ru/press_releases/valentin-gubarev-krok-konecz-epohi-czifrovogo-romantizma-it-rynok-v-rezhime-strogoj-ekonomii/). The same item says customers now judge not only the fact of switching to Russian solutions but also maturity, functionality and service quality. That is precisely the zone where a systems integrator can be necessary and annoying at the same time: necessary because the buyer needs a working whole, annoying because the buyer suspects a large service wrapper around each product swap.
Another CROC release, based on a survey of 200 CIOs at companies with revenue above RUB 5 billion, says quick payback became the main argument for IT spending in 2026 (https://www.croc.ru/press_releases/dlya-biznesa-v-2026-godu-bystraya-okupaemost-stala-glavnym-obosnovaniem-it-rashodov/). It says import substitution is no longer an end in itself; buyers focus on security economics, functionality, lower total cost of ownership and scalable cost growth. It also says 68 percent of respondents planned to refuse premium vendor support in favour of their own service, 57 percent planned to reduce contractor headcount on support, and 53 percent still saw import substitution as a main challenge. The contradiction is the market. Customers want less outside support and more accountable integration at the same time.
That contradiction can help a strong integrator if it is translated into long-term support contracts around critical systems. It can hurt if customers demand a one-time migration discount and then bring support inside. The 2026 survey says 40 percent of CIOs reported a shortage of qualified architects and engineers, while 57 percent wanted partners able to design complex architectures, 53 percent wanted integration of multi-vendor ecosystems, 47 percent wanted technological independence and 46 percent wanted long-term responsibility for business results and continuity (https://www.croc.ru/press_releases/dlya-biznesa-v-2026-godu-bystraya-okupaemost-stala-glavnym-obosnovaniem-it-rashodov/). Those numbers describe CROC's opportunity and its bargaining problem: customers need the skill, but want to squeeze the bill.
The cloud channel shows the same economics in compressed form
Cloud evidence around CROC needs careful handling. The legacy cloud.croc.ru address redirects to K2 Cloud's localisation page (https://cloud.croc.ru/). K2 Cloud describes cloud infrastructure and services for business tasks, professional services for design, implementation, support and development of infrastructure and development platforms, and customer cases around localisation and migration (https://k2.cloud/products/localization/). This is highly relevant to the market CROC serves, but it should not be treated as a clean disclosure of CROC's own standalone cloud margin. The public evidence proves an adjacent legacy channel and a service pattern, not consolidated CROC economics.
The K2 Cloud localisation page is still useful because it names the buyer tasks plainly. It describes projects to create an IT contour in Russia and migrate from international platforms to a Russian cloud provider without business interruption (https://k2.cloud/products/localization/). The work is broken into audit and design, installation, and handover to the customer. The audit stage includes target architecture, hardware and software choices, localisation of western software or import substitution, critical functions, compute volume, license counts, timing, cost and vendors. The handover stage includes support across cloud infrastructure, equipment at customer sites, virtualisation, operating systems, databases, infrastructure services, security services, ERP and business applications.
That is not a commodity compute sale. It is a bundle of risk analysis and labour, with cloud as the execution venue. K2 Cloud's "Plan B" localisation scenario says a Russian branch of an international company may keep receiving IT services from head office but wants a contingency roadmap; the page describes a one-month first stage and a two-to-three-month activation stage (https://k2.cloud/products/localization/). Its MVP scenario describes a Russian branch that may be disconnected from the global office's cloud infrastructure and services, with regulatory and operational consequences, and names a two-month implementation of a minimum service set and security controls. Its full localisation scenario describes an international company leaving the market and a Russian unit becoming independent, including strict deadlines, limited internal IT resources and a two-month full deployment of corporate services, security and cloud infrastructure.
These scenarios map directly onto CROC's broader integration contract. The buyer is not only renting infrastructure. It is buying a way to keep identity services, files, mail, remote access, ERP, security controls and business applications functioning after a parent, vendor or foreign provider changes access conditions. The value is not the virtual machine. The value is the path from "unsupported but working" to "locally supportable and auditable" without a business halt.
K2 Cloud's public customer cases show what this looks like in practice. The "Automobile Technologies" plant case says the company lost access to some critical services after separation from a foreign headquarters and needed to localise IT infrastructure in Russia, restore production processes, deploy accounting and HR systems without employee downtime, and create a basis for hybrid architecture (https://k2.cloud/cases/zavod-avtomobilnye-texnologii-lokalizoval-it-infrastrukturu-na-baze-k2-oblaka/). The public result claims IT systems scaled fourfold in a few months and more than 300 office employees continued work without downtime. The Remind insurance-broker case says the Russian unit needed to rebuild IT processes from scratch in a few months, lacked sufficient internal IT competence, and selected K2 Cloud for local cloud, network, security and office-service support (https://k2.cloud/cases/za-2-mesyatsa-s-nulya-lokalizatsiya-v-k2-oblake-it-infrastruktury-i-servisov-mezhdunarodnogo-strahovogo-brokera/).
These are vendor-written cases and should be treated as selected evidence, not an audited success-rate sample. But they are valuable because they identify the cost components customers actually face: separation from foreign HQ, lack of internal skills, need for local cloud, rebuilding mail and portals, remote access, backups, security tooling, branch connectivity, ERP and production-system continuity. A CROC contract that covers those components is not competing only on price per server. It is competing against the customer's fear of operational failure.
Regulation turns migration into documentation
Russian enterprise IT substitution is not only a sanctions story. It is also a compliance story. The Personal Data Law, Federal Law No. 152-FZ, sits behind many cloud and locality decisions (https://www.consultant.ru/document/cons_doc_LAW_61801/). Critical-information-infrastructure obligations under Federal Law No. 187-FZ add another layer for sectors that operate significant information systems (https://www.consultant.ru/document/cons_doc_LAW_220885/). CROC's customer base includes large companies and public buyers, which means the contractor is often selling documents, responsibilities and audit comfort alongside technical implementation.
This is where integration labour becomes a hidden line item. A cloud migration can be cheaper than buying new on-premise hardware, but the compliance work is not free. The buyer needs data classification, access matrices, incident procedures, retention rules, responsible parties, tested backups, security monitoring, cross-border transfer analysis where relevant, and evidence that the system fits local requirements. K2 Cloud's documents page lists compliance and certification materials around 152-FZ, PCI DSS v4.0, GOST R 57580.1-2017, GOST R ISO/IEC 27001-2021, GOST R ISO/IEC 27017-2021, ISO 9001, Uptime Institute, SLA and the Russian software registry (https://k2.cloud/about/documents/). These documents are not a substitute for CROC-specific proof, but they show why regulated customers buy a platform and a professional-services wrapper together.
CROC itself publishes a compliance-policy page describing business-conduct, antimonopoly, anticorruption and ethics policies (https://www.croc.ru/compliance-policy/). Its official profile also lists IT activity codes under the Ministry of Digital Development's 2023 list of IT activities (https://www.croc.ru/profile/). Checko records 16 active licenses and public procurement exposure, including 1,874 supplier contracts worth RUB 50.7 billion in total (https://checko.ru/company/krok-inkorporeyted-1027700094949). Those items do not prove project quality. They do show that the company operates in a market where procurement form, licensing, auditability and legal counterparties matter.
For buyers, this changes the make-or-buy calculation. An in-house team may understand the old estate better than CROC, but it may not have the capacity to run parallel vendor selection, migration design, regulatory documentation and post-change support during an urgent replacement. A local vendor may know its own product better than CROC, but may not take responsibility for how that product interacts with ERP, identity, network segmentation, user training and a legacy database. A cloud provider may offer a good platform but may not own the full enterprise process. A large integrator sells the missing coordination layer. The question is whether the customer sees that layer as insurance or as overhead.
Sanctions pressure increases work but not automatically pricing power
The post-2022 sanctions and vendor-exit environment increased the need for domestic substitutes, localised support and procurement creativity. A Wired report on Russia's technology self-sufficiency push noted that after the invasion of Ukraine many technology companies stopped or curtailed operations in Russia, with Cisco, SAP, Oracle, IBM, TSMC, Nokia, Ericsson, Samsung and Apple among those affecting industries from telecoms to factories and state-owned companies (https://www.wired.com/story/russia-ncc-phone-android-sanctions). Business Insider reported in 2025 that Microsoft and Zoom had stopped new sales or operations in Russia after 2022 while some services remained accessible, illustrating the messy distinction between formal exit, residual access and practical dependence (https://www.businessinsider.com/putin-russia-strangle-western-tech-firms-microsoft-zoom-2025-5).
For CROC, the opportunity is not only that western vendors exited or reduced support. It is that enterprise systems rarely have one-for-one replacements. A Russian buyer can replace a foreign collaboration suite with domestic mail, file and messenger services, but the operational question is how to migrate archives, permissions, mobile access, records retention and user workflows. A bank can replace a database, but the operational question is performance, testing, recovery time, reporting and vendor support. A retailer can replace a warehouse system, but the operational question is how stores, suppliers, e-commerce, loyalty and accounting stay in sync. Those questions are where CROC's labour is monetised.
But pressure does not mean a blank cheque. CROC's own 2026 CIO survey says buyers are shifting away from formal substitution and toward payback, total cost and support quality (https://www.croc.ru/press_releases/dlya-biznesa-v-2026-godu-bystraya-okupaemost-stala-glavnym-obosnovaniem-it-rashodov/). It also says one third of companies already had precedents of replacing one Russian product with another because of functionality or service-support problems. That is a warning. The first wave of substitution creates implementation work. The second wave can expose weak domestic products, buyer fatigue and pressure to consolidate vendors. CROC can profit if it is the trusted remediator. It can lose margin if it is blamed for immature products it did not build.
The financial statements show how this can happen. Revenue from software-use rights fell from RUB 3.004 billion in 2023 to RUB 1.969 billion in 2024, while revenue from own goods, works and services rose from RUB 16.822 billion to RUB 19.183 billion (https://bo.nalog.gov.ru/download/bfo/pdf/6611789?detailId=51853421&period=2024). That shift is consistent with a market where resale alone is less attractive and service work is more central. It does not prove sanctions caused the change, but it supports the view that CROC's economics are increasingly about doing the hard implementation work around a changing vendor base.
Labour is the scarce input
CROC's careers site says the company has 2,500 employees, more than 2,700 projects a year, 33 years in IT and a top-25 hh.ru employer ranking (https://careers.croc.ru/). It lists hiring or career categories across development, software and computing infrastructure, cybersecurity, engineering and multimedia systems, telecommunications, business applications, analytics, service and support, project management, finance, legal and back office. That breadth fits the integration model: the company needs consultants, architects, engineers, support staff, project leaders, procurement knowledge and sector specialists, not only coders.
Labour scarcity is a direct cost. The CROC survey says 40 percent of CIOs reported a shortage of qualified architects and engineers (https://www.croc.ru/press_releases/dlya-biznesa-v-2026-godu-bystraya-okupaemost-stala-glavnym-obosnovaniem-it-rashodov/). If CROC can keep scarce specialists, it can price complex work above simple resale. If salary inflation or attrition rises faster than bill rates, margin compresses. The 2024 BFO accounts show managerial expenses rising to RUB 5.243 billion from RUB 2.733 billion in 2023, while gross profit rose to RUB 7.636 billion from RUB 5.495 billion (https://bo.nalog.gov.ru/download/bfo/pdf/6611789?detailId=51853421&period=2024). Public statements do not break that expense movement into labour, administration or other items, but the direction reinforces the point that scale in services is not costless.
Retention risk is not a soft issue. An integration contractor often earns repeat work because the customer's environment has been learned by a named team. If those people leave, the customer may face knowledge loss and CROC may face expensive replacement hiring. If CROC locks too much knowledge into individuals, support becomes fragile. If it systematises knowledge well, it can support more clients per engineer and improve margin. The public evidence cannot tell which is happening. It can only show that skilled labour is central enough for CROC to market its career ecosystem and for customers to report skill shortages.
The labour issue also affects the substitute routes. An in-house team may seem cheaper if the buyer counts only salaries. It is less cheap if the buyer needs a temporary surge of rare virtualisation, security, ERP and network specialists while still running daily operations. Direct local-vendor support may seem cheaper if each product supplier handles its own tool. It is less cheap if the buyer has to coordinate fault diagnosis between vendors whenever a business process crosses system boundaries. A state-backed integrator may seem safer for regulated projects. It is less attractive if speed, custom knowledge or commercial service quality matters more than administrative comfort.
Procurement risk sits inside the gross margin
CROC's accounts show a large resale component and substantial supplier payables, so procurement is not background noise. In a normal market, an integrator can quote hardware, software and services with predictable vendor lead times. In a sanctions-constrained market, the quote may depend on available local products, parallel logistics, Asian vendors, licence-right uncertainties, replacement parts and customer tolerance for changed performance. CROC's own company page says it partners with Russian, western and Asian vendors (https://www.croc.ru/about-us/). That breadth is an advantage only if the company can translate it into workable combinations.
The risk is that substitution does not only change the vendor name; it changes the operating model. A customer that replaces a foreign appliance with a local product may need new monitoring, new support escalation, new security documentation, new training and new procurement timing. A customer that moves to a Russian cloud may reduce capex but take on migration risk, platform concentration risk and changed service-level dependencies. A customer that moves from proprietary software to open source may save on licences but need more internal or integrator support. CROC can make money on these transitions, but the more it promises fixed outcomes, the more procurement and labour risk it holds.
The BFO figures illustrate this in accounting language. In 2024, purchased-goods revenue was RUB 10.851 billion and cost of purchased goods was RUB 9.370 billion, implying a limited gross spread before overhead. Own goods, works and services had revenue of RUB 19.183 billion and cost of RUB 13.543 billion, a larger gross spread but one exposed to labour utilisation, project overruns and support commitments. Software-use rights had revenue of RUB 1.969 billion and cost of RUB 1.455 billion (https://bo.nalog.gov.ru/download/bfo/pdf/6611789?detailId=51853421&period=2024). The pattern says the more CROC can move the contract toward high-value services, the better the gross economics. The more the contract is equipment pass-through, the more it depends on volume and working capital discipline.
This is why "freezing legacy systems" remains a competitor. A buyer may decide that an unsupported foreign system still works and that the migration risk is worse than the vendor risk. That decision is dangerous if security updates, audit requirements or hardware failure catch up. But it is rational when capital is expensive and replacement products are immature. CROC wins when it can show the cost of waiting: rising security exposure, audit risk, unavailable spares, staff knowledge decay, unsupported interfaces and a more expensive future migration. It loses when the buyer sees substitution as a compliance performance rather than a business necessity.
The premium is paid for reversibility
The most valuable integration contract is not the one that simply announces a replacement. It is the one that gives the buyer a reversible, staged path. Russian enterprises that still operate foreign systems often cannot move everything at once. They need a tested minimum service set, a fallback plan, a data-migration route, a way to run old and new environments in parallel, and support rules for the period when nobody is sure which layer caused a fault. K2 Cloud's localisation scenarios use exactly that language: a "Plan B" road map, an MVP site in Russia, and full localisation when a foreign parent or provider leaves (https://k2.cloud/products/localization/). The commercial lesson for CROC is that reversibility can be billed because it reduces executive fear.
Reversibility also explains why the avoided-cost comparator is not always a cheaper rival quote. A customer comparing CROC with an in-house team may initially see a large external-services bill. But the internal team must still run production, answer users, keep audits alive and support old systems while learning new products. A customer comparing CROC with direct local-vendor support may get lower product-specific pricing, but every integration point remains a coordination problem. A customer comparing CROC with a cloud bundle may get faster infrastructure but still needs application migration, security documentation, user migration and branch connectivity. A customer comparing CROC with freezing legacy systems gets the lowest immediate cost but keeps a growing failure option on the balance sheet.
That is where CROC's thin net margin should be interpreted carefully. A 2 percent net margin does not mean customers see little value. It may mean CROC operates in a market where customers capture much of the avoided-cost benefit through competitive procurement, where vendor pass-through dilutes reported margin, and where project risk consumes part of the integration premium. The gross spread on own works and services is much better than the final net result, but the final net result reminds the reader that overhead, finance cost, selling cost and project discipline are central to the model (https://bo.nalog.gov.ru/download/bfo/pdf/6611789?detailId=51853421&period=2024).
The renewal conversation starts during this reversible stage. If CROC documents the old estate, designs the target state, trains the customer's staff, creates support runbooks and handles the cutover, it owns knowledge that the customer may not want to rebuild with another party. But that same knowledge can become a bargaining chip against CROC if the customer demands handover and then asks cheaper providers to operate the new stack. The commercial defence is to make the continuing service valuable enough: monitoring, incident response, version upgrades, security review, vendor evaluation, capacity planning, backup testing and periodic reassessment of domestic substitutes.
The public evidence hints at that direction but does not prove it. CROC's homepage says it creates integrated teams with the client, CROC experts, technology partners and vendors for practical sessions and demo days (https://www.croc.ru/). K2 Cloud's localisation page lists project roles including project manager, architect, security technical manager, support engineers, telecom technical manager and infrastructure-services technical manager (https://k2.cloud/products/localization/). Those roles are the paid anatomy of reversibility. They are also expensive. If utilisation falls, if projects slip, or if the customer's internal team absorbs the knowledge faster than expected, the premium leaks away.
The best CROC contract therefore has three characteristics. It starts with a business-critical process where failure would be more expensive than the integration fee. It includes enough cross-system complexity that a single-product vendor cannot cheaply replace CROC. And it ends with ongoing support or further modernisation rather than a clean handoff to the lowest-cost operator. The weakest contract is the opposite: hardware-heavy, fixed-price, politically urgent, thinly scoped, and judged by formal substitution rather than operational performance. Public accounting cannot tell how many contracts sit in each bucket, but it can tell why the difference matters.
Competition comes from every layer of the stack
CROC competes with large Russian integrators, cloud providers, local software vendors, hardware suppliers, in-house teams and procurement inertia. The cloud side is especially visible because customers can buy infrastructure directly. CNews Analytics ranked K2 Cloud fifth among Russia's largest IaaS suppliers in 2024 revenue, with RUB 6.002 billion of IaaS-project revenue, behind Cloud.ru, Turbo Cloud, Selectel and Yandex Cloud (https://www.cnews.ru/reviews/oblachnye_servisy_2025/review_table/d3db970d9d8f46e00fb6adc92249027124c2c701). The same table shows T1 Cloud, ITglobal.com, beeline cloud, Softline, Megafon Cloud and VK Cloud in the wider field. These are not all direct substitutes for CROC's integration work, but they are plausible pieces of a buyer's alternative architecture.
The customer can bundle with a cloud platform, then use local vendors for applications and security. It can work with a telecom-affiliated cloud for network integration. It can use a state or quasi-state technology group when procurement and regulatory comfort dominate. It can select best-of-breed Russian software products and force its internal team to stitch them together. CROC's defence is the claim that stitching is the hard part. Its weakness is that cloud providers and software vendors increasingly sell their own professional services.
K2 Cloud's own localisation page says its professional-services team designs, implements and accompanies cloud infrastructure for business services, and that it has completed more than 400 complex projects for large business (https://k2.cloud/products/localization/). That is evidence of demand for the service model, but also of competition. If K2 Cloud, Cloud.ru, Yandex Cloud or Selectel can wrap enough support around the platform, some buyers may reduce the integrator role. If CROC brings deeper application, network, security and industry process knowledge, it can remain the prime contractor even when the platform is somebody else's.
This makes partner strategy crucial. CROC's broad vendor positioning is valuable if customers believe it chooses architecture rather than merely reselling inventory. It is risky if customers believe a preferred vendor list drives choices more than fitness. The official site's "demo day" language, where CROC says it shows tested combinations of hardware and software for replacing ecosystems of departed manufacturers, is commercially sensible (https://www.croc.ru/). But customers now ask for total-cost evidence. A tested lab combination is only the beginning; the decisive question is whether it survives the buyer's data, integrations, staff and failure modes.
Public procurement is proof of access, not proof of comfort
Checko's public data says CROC is an active supplier in the government-procurement system, with 1,874 supplier contracts worth RUB 50.7 billion and top customers including Moscow healthcare information infrastructure (https://checko.ru/company/krok-inkorporeyted-1027700094949). That matters because public and quasi-public buyers often value legal standing, licenses, documented delivery and the ability to support critical systems. It also creates exposure to formal procurement, price competition and reputational consequences.
Public procurement should not be overread. The total is cumulative, not annual revenue. It does not disclose margins. It does not tell whether a contract was a high-margin support engagement, a low-margin equipment supply, a services framework or a mixed project. It does, however, confirm that CROC is not merely a private-enterprise consultant operating in a loose market. It operates in a documented procurement environment where project references, license coverage and legal identity help win work.
The public-sector channel also reinforces the compliance value of localisation. Russian government and regulated customers have stronger reasons to use domestic software registries, local data handling and certified infrastructure. The Russian software registry at https://reestr.digital.gov.ru/ is a market instrument in that substitution environment, while laws such as 152-FZ and 187-FZ shape data and critical-infrastructure obligations. Integrators do not simply install products into that world; they translate regulation into architecture and evidence files.
For investors or editors judging CROC as an economic subject, the right question is whether public-sector and large-enterprise complexity produces recurring service income or one-off project volume. Recurring support is the higher-quality answer. One-off replacement is more cyclical. The public statements hint at the move toward ongoing accountability: CROC's survey says buyers want long-term responsibility for business results and continuity (https://www.croc.ru/press_releases/dlya-biznesa-v-2026-godu-bystraya-okupaemost-stala-glavnym-obosnovaniem-it-rashodov/). But public accounts do not split recurring managed services from project delivery, so confidence must remain bounded.
Network records are a control-surface signal, not a business proof
Technical records add a small but useful piece of evidence. A DNS lookup on 6 July 2026 resolved croc.ru to 178.248.234.15, and RIPE WHOIS showed that individual address assigned under the description "Zakritoe akcionernoe obshestvo CROC incorporated" at the Volochaevskaya address, with the route 178.248.234.0/24 originated by AS51115. The same lookup resolved cloud.croc.ru and k2.cloud to 109.238.90.120; RIPE WHOIS placed the 109.238.88.0/22 block with SERVICEPIPE LLC and route 109.238.90.0/24 originated by AS201706. These records are operational evidence only.
They should not be used to infer customer hosting, private cloud architecture, revenue, sanctions exposure or service quality. They say the public web presence uses identifiable Russian network resources and, in CROC's case, an IP assignment carrying the legal company's name. They also show that the legacy cloud.croc.ru endpoint now lands on the same address as k2.cloud. That is consistent with the observed web redirect to K2 Cloud, but it does not prove ownership economics or contract allocation.
The value of including network evidence is discipline. It prevents a purely narrative article from ignoring the actual public control surface. It also prevents exaggeration. CROC's public website, K2 Cloud's localisation pages and RIPE records can tell us what is visible. They cannot tell us whether a customer's production environment is hosted by CROC, K2 Cloud, a third-party data centre, an in-house site or a hybrid architecture. Network facts belong in the evidence column, not the conclusion.
The renewal question decides the margin
The first substitution project is expensive because the estate must be discovered, mapped, rebuilt and tested. The second contract is more important. If the customer renews support, extends the architecture, adds security monitoring, increases cloud capacity or gives CROC another business process to transform, the original migration becomes an entry point into a recurring account. If the customer treats CROC as a temporary migration crew and then takes support inside or gives it to a cheaper vendor, the contract becomes a labour-intensive one-off.
CROC's 2024 accounts show enough scale to matter, but not enough profitability to assume easy renewal economics. RUB 32.0 billion of revenue and RUB 640.8 million of net profit leave limited room for broad execution mistakes (https://checko.ru/company/krok-inkorporeyted-1027700094949). Receivables near RUB 10.3 billion and supplier payables near RUB 8.3 billion show working-capital intensity (https://bo.nalog.gov.ru/download/bfo/pdf/6611789?detailId=51853421&period=2024). A project delay, disputed acceptance, currency shock, hardware availability problem or support-cost overrun can affect the economics even if the customer ultimately goes live.
This is also why customer references matter but cannot carry the whole argument. K2 Cloud's Automobile Technologies and Remind cases show the appeal of localisation under deadline pressure (https://k2.cloud/cases/zavod-avtomobilnye-texnologii-lokalizoval-it-infrastrukturu-na-baze-k2-oblaka/ and https://k2.cloud/cases/za-2-mesyatsa-s-nulya-lokalizatsiya-v-k2-oblake-it-infrastruktury-i-servisov-mezhdunarodnogo-strahovogo-brokera/). They do not show renewal margin. They do not show how many similar projects were harder, slower or less profitable. They do show what customers are willing to name publicly: continuity, speed, local infrastructure, security, independence from foreign software and support without expanding internal staff.
The better renewal test is whether CROC can keep translating new constraints into practical work. Data-sovereignty requirements, cloud migration, local-vendor maturity gaps, security incidents, staff shortages and high interest rates all create reasons to revisit architecture. But the same forces make buyers demanding. They want fewer suppliers, lower total cost, clearer accountability and less technical romance. CROC benefits from complexity, but only if it simplifies the buyer's life faster than it complicates the buyer's invoice.
What would change the judgement
The bullish case would strengthen if CROC disclosed or external records showed rising recurring managed-services revenue, better operating margins, stable receivables, high renewal rates and more named customer cases where local substitutes performed under real production load. It would also strengthen if the company showed repeatable service catalogues around Russian software stacks, cloud security, migration factories, database modernisation, ERP localisation and support automation. The market clearly needs these capabilities. The question is whether CROC can industrialise them.
The bearish case would strengthen if revenue stayed flat while labour and finance costs rose, if customers moved support in-house after one-off migrations, if cloud platforms captured more professional-services work directly, if local-vendor quality issues increased support burden, or if public-procurement competition pushed CROC toward low-margin resale. A thin net margin means management cannot simply accept all substitution demand. It must choose projects where the complexity premium is real and collectible.
The current judgement is balanced but not neutral. CROC is positioned in a structurally important part of the Russian IT market: the place where foreign-vendor withdrawal, local software maturity, compliance and operational continuity meet. Its official identity, public accounts, CROC buyer research, K2 Cloud localisation evidence, public procurement exposure and labour footprint all support the thesis that integration is the paid work hidden beneath the phrase "import substitution". But the same evidence shows why the work is hard to monetise. The customer is under pressure, the products are uneven, capital is expensive, labour is scarce and a large part of the contract may be pass-through procurement.
So the right way to price CROC is not as a simple winner from sanctions. It is a continuity contractor whose value rises when enterprises cannot safely replace foreign IT by themselves. Its best contract absorbs hidden substitution costs and turns them into a multi-year support relationship. Its weakest contract absorbs the same costs and leaves CROC with a thin spread, high receivables and a customer eager to cut contractors next year. The difference will be visible less in slogans about technological sovereignty than in gross margin, renewal quality, support utilisation and whether the next Russian enterprise can replace foreign IT without breaking the business.