CyberArk Software Ltd. (CYBR) Earnings Call Transcript & Summary

Hi. I'm Matthew Parron, an associate on Sterling Auty's software technology team. Very happy to have with me here the management from CyberArk. I have with me CEO, Udi Mokady; and CFO, Josh Siegel. I'll begin the fireside chat with a couple of questions. [Operator Instructions]

So to start off, Udi, if you could give us a brief overview of what CyberArk does and where you fit within this -- within identity and access management?

Sure, and hello, everybody. We're a pioneer and a global leader in a layer called Privileged Access Management, which is a critical layer of IT security that protects data, protects infrastructure and across the enterprise, through cloud, on-prem and the DevOps pipeline. You can call it protecting the keys to the kingdom, really the underlings of all the security and IT infrastructure. It's basically a layer that allows, I would say, enable the employees to have privilege access in order to keep the business running regardless of the -- of what enterprise it is, and similarly allows applications to connect to each other and without -- and with preventing credential theft privilege abuse, privilege escalation, which are the attacks that really have been the ones that deliver a knock-out as we've seen over the last couple of years. So it's a new layer of security from, I would say, relatively in the last couple of years. It's a post perimeter layer that really protects the infrastructure itself. And of course, as a company, we pioneered it and marketed it and have amassed 5,500 customers, really half of the Fortune 500, more than 1/3 of the Global 2000, so very healthy footprint and take a very global view in our go-to-market. And probably Josh will touch it. We also take pride in being -- with delivering profitable growth in our business model. Matt, in terms of where it fits in identity and access management. So I would say, Privileged Access Management is considered the one, the layer that's most relevant to protecting against cyber attacks and/or rogue insiders because beyond privilege access, you can take over IT infrastructure. And I would say, up until now, pretty much was complemented by the general access management layer and the -- what's called the governance layer. And I'm sure you'll ask me, but yesterday, we announced the acquisition of California-based Idaptive that extends us also to access management.

Great. Yes. So on the back of that since you brought it up. So yesterday, you announced the acquisition of Idaptive, which plays more on the identity side with some players like OKTA. What was the rationale behind the acquisition? What were you thinking about in terms of expanding the platform?

Yes. I would say we took a very long view as to what is the -- our best interest for our shareholders and customers. How do we best leverage our leadership position in Privileged Access Management? And we decided that as we expand and with the proliferation of privilege, we're going to go and look for an asset that takes a security-first approach to access management. So that we can expand from the IT users, developers and application credentials that we manage today also to business users that require a privileged access, gives us access to the large TAM provided in identity and access management. But with this specific asset with Idaptive, it also has a security-first approach. So they have a multi-factor authentication and single sign-on and life cycle management and other components that are critical in identity and access management, and we'll bring it together to create an identity security platform focused on the enterprise.

Great. So Idaptive was spun out of a competitor of yours in the privilege access market. Was that -- how did you take that into consideration in terms of them being able to fit within your platform?

Yes. I think it's a very unique story. Our competitor, Centrify, was bought by Thoma Bravo several years ago. And they took this growth engine that was sprouted within the company and spun it out as a separate company. So by the time we were analyzing the market, we really were open-minded with, again, security-first approach, and we were looking for modern SaaS, born in the cloud. And we looked at the asset. And despite the fact that it was spun off from a competitor, we evaluated just like we would any other. And we saw that we actually benefit from the fact that came from security that they understand that kind of space and we can actually leverage that for a faster integration into our full umbrella. So it's a unique story out there, but I think it starts with private equity spinning it out, created a true separation and with us, we think we can give it, really, a better home and access to our customer base and the opportunity to execute on the identity road map.

So one of the questions that we've got from investors since you made the acquisition is this brings you into direct competition with some of the partners on the identity side. How does that change the partnership that you've had and how do you think about the competition that you'll see?

Yes. I would really encourage people to understand that we deal with enterprise. That's our fourth tail. Like I mentioned, the Fortune 500, the Global 2000, they often take a multi-vendor approach. We've invested a lot in partnerships and integrations, and we're going to continue to leverage it. So we don't view it this way. We think that there's been an erosion of these swim lanes that I mentioned before between PAM and the access and governance. But it's not a clear-cut swing and one vendor takes it all. There will be opportunities where the customers will want a single vendor. There will be those opportunities where customers that are very security focused will look at CyberArk because we bring that strong security element. But the full convergence will take time, and we can really all benefit from the tailwinds that this space is gathering. We will continue actually the integrations with all of them with OKTA, with Ping, with Microsoft. And specifically to Ping and Microsoft, we actually see already cases where we can integrate in enterprise environments. Our go-to-market would be very much a security-first approach to managing identities, going after enterprises where they put security in the center of their decision-making.

Great. Great. That makes sense. Josh, maybe for you, what did CyberArk see this past quarter in terms of impact from COVID?

Yes. So we saw some interesting things. First of all, what we saw in the first quarter was going into the back half of the quarter, where people started to quarantine and work remotely. We were all kind of a bit nervous about what was going to happen with regard to the sales process itself. And what we actually saw to our pleasure was that the sales process didn't stop. And we actually closed hundreds of deals in the last couple of weeks and even in the last days of the quarter, which is not atypical to us because we do a lot of our business in the end of the quarter. And we actually continued to do so as well, even with COVID. I think the other thing that we started to see in the first quarter on the positive side is that with the, all of a sudden, move to the remote, we did see the funnel opening, and we also saw a pipeline generation of opportunities that we expect is really going to be a tailwind as we go forward. I think the other thing I would focus on is when we got kind of towards the end of March and certain countries were more quarantine than others, certain verticals were more affected than others, we did see some deals slip into -- some of them we closed already in April, and some are still very much hot in the pipeline. And I think the other thing that we saw, particularly in the last couple of weeks, where some of the larger new customer deals going down in size. So instead of taking -- they're taking a smaller bite of the apple on the first go. And what's at least positive for us is that they're coming back to us now a few months later and saying, let's talk about adding on some of those things that we took off the table in the first quarter.

Great. So with that demand that you mentioned, were there any specific products that you saw, maybe increased interest in given the remote and work-from-home situations?

Yes. Well, we did -- it was our first real quarter of selling Alero, which is our remote access, into the Core PAS. And I think that we certainly started to hit a stride there in interest on one side and also closing deals. We also made an extension where we would offer free the first through June Alero to those who wanted to try it for free. And we don't have the returns yet on that, but we certainly expect to probably sit here in August and say that we had good -- we had some good conversion on that as well. And basically, it's really around our Core PAS was certainly still the majority of our sales.

So Matt, I would say demand for all products and basically, this new work-from-home environment really emphasizes that what we've been educating for years that there is no perimeter really and that very often for the attacker, it's going to be 1, 2, 3 steps of bouncing from an endpoint to a server to either enterprise infrastructure or cloud infrastructure to go after data, and therefore, you need Privileged Access Management. And of course, you need the protection on privilege and to manage privileges on the endpoint with EPM like Josh mentioned.

Great. Great. That makes sense. So different from some of the software companies that we've seen, you guys continued hiring through the first quarter and on the earnings call, you talked about you're still going to continue hiring, though you're going to be more -- it's going to be a lot dependent on the current situation. Just curious to hear your thoughts on hiring, why you're continuing to hire? And what specifically within your business you feel needs the most investment?

Yes, I think I'll start, and Udi, if you want to add color afterwards, please do. In terms of numbers, so we did hire about 100 people incrementally in the first quarter, and that was basically people that when, we started the plan this year already back in December, already hiring those people, mostly in sales organization and in the technology and the R&D organization. And that was per plan. Once, towards the end of March, we started to slow down the hiring. But we are going to hire, continue in Q2 more on the technology side and also some on the sales side because, in our business, we -- on the sales, they do take 6 to 9 months to ramp up. So we want to make sure that we come out stronger on the other side and also R&D keeps going. And innovation doesn't sleep. So we're clearly focused on there, but we're going to be more prudent and strategic on what those hires are. So we see about 30 to 35 incremental for Q2 and probably the same in Q3 at this point.

And obviously, we're excited to welcome 130 new employees from Idaptive that are extending us now. And so they are -- just, today is their second day.

Great. Great. So overall, after we get through COVID-19, hopefully, sooner rather than later, do you view this as a headwind or a tailwind to your business?

I would say that, definitely, when we take long term because, I think, Josh talked some of the short and midterm. Long term, we view this as a tailwind to our business, further accelerating digital transformation, and we were playing in that already even before the Idaptive acquisition. PAM, Privileged Access Management, in general, enables the adoption of new technologies and modernization. We have the component that I didn't talk much about at the beginning about enabling modern applications and securing modern applications with -- based on our 2017 acquisition of Conjur, which is part of our dynamic application protection. And this new reality, where organizations really understand that identity is -- the fact, though, the new perimeter, I think, they feel it on a daily basis with the employees starting in the way an employee starts the day. And so that's where Idaptive is an additional enforcer there where we can actually ride both digital transformation and this extension of enablement to the workforce, the customers and with access.

Great. Great. Maybe moving a little bit more towards the composition of the customer base. So you've talked about your focus more in the enterprise. What, if any, SMB exposure do you have currently in your customer base?

Matthew, we really are focused on the enterprise, and we do not have a lot of exposure on the SMB. We do sell into the low end of the enterprise and some mid-market, but I would say that's still kind of in the single digits of our business.

Understood. And then in terms of the impacted industries that -- from COVID, what's your exposure on that?

Yes. So we mentioned actually in the call just the other day that when you look at energy, retail, transportation and travel, obviously, those were hit -- are being hit hardest by COVID-19. If you combine those, it gets to about 15%. The interesting thing is that it's still in the first quarter. We very much were aligned kind of with those verticals with history. But certainly, we're keeping an eye on that going forward.

Great. And then a question here from the audience. Can you talk about implementation and the complexity -- any complexities behind that, that have slowed down due to COVID? And what are you guys doing to address that?

Yes. I was asked that yesterday, and I'm super pleased with our security services team. There was already -- I would say, implementing 85%, 90% were already doing remote implementations even before this, but now have moved to 100%, where they're guiding customers through implementations in a remote manner, and it's really been streamlined. There are some services that are actually have seen even a hike in these times in demand. And of course, that applies both to our on-prem implementations, they're streamlined. And of course, with Privilege Cloud, it's even a shorter time to value for customers and implementations. So I would say, it's on track and streamlined in this remote world.

Great. Moving a little now to the go-to-market side. So you guys recently brought over a new head of sales. What changes have you seen in the sales organization after those changes?

Yes. His name is also Matt. And Matt joined us at the end of -- really at the beginning -- end of last year and is very strategic in his thinking, but -- and also in the execution. I would say that the big -- I can summarize about 5 changes that are transformational to the company even before -- some are even before COVID, but it was really the right direction. If you look at the first one is -- was all about increasing demand generation with a strong teaming with marketing and moving more to digital marketing campaigns and then best-in-class, lead-to-revenue processes. It's something introduced as a high priority, even pre-COVID, and, of course, now it's a no-brainer, and the team is all mobilized there. The second one I've mentioned a couple of times, scaling our customer success organization and to drive down time-to-value for the customer and accelerating expansion rates to the customer base. I would also put a best-in-class customer success organization. Optimizing the cross-sell notion. We have a lot -- the portfolio has grown, and it's -- there's a lot more value that we can deliver to our Core PAS customers with upselling our EPM, our AAM for securing applications, our Alero for remote vendor access and now Idaptive for identity and access management. So really optimizing the cross-sell. The -- we have, over the years, accumulated really the best-in-class channels in almost every region. Again, as a pioneer in the space, we kind of have first picking, and I'm really proud of the partners who resell and advise on CyberArk. Matt believes that we can -- and is pushing a global partner strategy. So taking these -- this excellence in various regions, but globalizing it to drive scale and more feet on the street pushing the CyberArk folio. There's a whole notion on optimizing our revenue operations, functions with analytics, all the things that are more important as we scale globally. And he does that under a framework he calls the care framework, close, adopt, renew and expand. And the close basically is that time to value that -- in the -- close is the new client acquisition. Adopt is the time to value. It's everything that the customer success team is doing. Renew is to really retaining those customers, and expanding is the both upsell and the cross-sell I talked about. So that's a long answer, but to a very strategic framework.

Great. That's very helpful. So on the back of that, given your perpetual license model, are you increasing your sales coverage ratio to compensate for potentially lower close rates with the uncertainty that we see today?

Yes. I mean, I'll take that. And when we look at the coverage ratio, we kind of take it in -- from a couple of angles. First, we kind of look at the coverage rate by existing customers and by new customers. And then we look at coverage rate for the different products that we have, whether it's the Core PAS, the EPM, the Application Access Manager and Alero and Privilege Cloud. So if we think about it from the type of customers, and I kind of mentioned this earlier, I think from existing customers where we know the customers, we know what their IT framework, their infrastructure looks like, we have already physical relationships where we've seen them and met them in the past and have had coffee with them in the same room. We feel like, there, we're okay on keeping the same type of coverage and be able to evaluate kind of the risk for closing those transactions. I think when we look at new customers, and I noted this before as well, I think there, we are trying to build a higher coverage level on the pipeline because of the additional risks of the fact that we haven't yet been -- there's the physical side that's not happening. And we don't know -- we're a little bit less in their heads of exactly what are driving their decision processes. And with regard to the products, we have KPIs internally that we set out to kind of set our goals for the products. And I think, clearly, when there's a more volatile environment, you want more coverage. And our pipeline has been growing, partially because of the things that Udi talked about in terms of the security environment. And so we feel actually pretty good where the pipeline is relative to the kind of the new coverage levels that we need to get, but the visibility is a lot riskier.

Great. Great. That makes sense. In terms of just honing in a little bit on the vertical. It's an election year. How do you think about the federal vertical? How much of it is as a percentage of your revenue? And how do you think about that given the current year?

Yes so -- go ahead, Udi.

We don't break out the -- yes. I'll go for it. We don't break out the federal per se, but we cover it under the global government vertical, which in 2019 was 14% of the pie, and the federal is a piece of that, a significant piece of that. And it's been growing really nicely. I think we've shown that we can expand from the civilian side of the federal government that was our prime buyer in the past years to also the defense side. And so we see it as a nonpartisan issue, and there are more and more highlights of cyber initiatives within the government. So while in an election year, there could be some uncertainty, we think that our solutions and many security solutions, in general, would transcend that. We're not changing our sales motion. We're actually really investing in this vertical with -- also with local partnerships.

Great. Great. So moving now a little bit to some of the newer offerings. So you did mention that you are a perpetual business model, but you do have some newer subscription offerings, SaaS offerings. What is -- how much is SaaS currently in terms of your revenue? What are the products that you would put into that category?

Yes. I'll start. So coming out of 2019, the SaaS was really driven by our EPM, our Endpoint Privilege Manager. And that's a product that we've been selling for years. We've sold it on-prem, we've sold it as SaaS, and we've really have let the customer choose their -- how they wanted to consume. If we look -- if you asked me a couple of years ago, it would have been pretty much half and half in terms of the consumption. So already towards 2019, we saw some shift up towards SaaS consumption and partially from the customer side, but also because we were focused on the SaaS side of EPM. And if we look at 2019, it was roughly 2/3 of the bookings from EPM was going towards SaaS. When we go into 2020, we now have a whole -- another set of products that were really -- will be front and center this year. Alero, which we talked about; Privilege Cloud, which is now the ability for enterprises to purchase our Core PAS product as -- and consume it as a cloud offering; and as well as EPM. And of course, today, we now have acquired Idaptive, which allow -- which is a pure born-in-the-cloud product for identity access. If we look at the numbers, in the first quarter, we saw 5% of our license business coming out of SaaS products in terms of -- 5% of the revenue coming from SaaS. Obviously, that's still mostly EPM-generated SaaS. And -- but we'll start to see that move to some more to Alero and Privilege Cloud as we -- as those contracts, which we just started booking in the first quarter and at the end of fourth quarter last year, start to roll out into ratable revenue going forward. And that's compared to 3% of our license revenue in 2019. And of course, as Udi mentioned earlier, with Idaptive, we're immediately adopting another approximately $16 million to $18 million of ARR on the identity access side, while this year, I can't guide to what that revenue will be. We haven't yet done the purchase price accounting. But certainly, next year, that will certainly add to our SaaS revenue.

Great. Great. So just given that current possible mix shift, how do you see that possibly affecting cash flow margins? And how do you think about the perpetual SaaS model in the future? I know you haven't guided specifically to the breakdown, but how do you think about it from a high level?

I will start.

So I think...

So I'll start with your second part and Josh -- I think we talked about a strategy of infusion, and it's really been working, where the growth engines, almost every growth -- new growth engine that we either acquire or develop out of our labs is a subscription-first approach, so infuse our revenues with subscription, and of course, nonorganically now with Idaptive. So we feel like we've accelerated, but we found that balance because many, many enterprise customers want to own Privileged Access Management. That's a platform that integrates with the systems that run their business. And so to be able to give them that optionality with perpetual and -- while accelerating the infusion of subscription. And Josh?

Yes. So with regard to kind of how it's going to impact the P&L. So yes, it will impact the gross margin. We all know that SaaS, as a perpetual on-prem, the gross margins are 90-plus percent. And when you move to a SaaS platform, there are -- there is a large entity in the middle who likes to benefit from it. So with the additional SaaS, right now, we're looking kind of, for this year, 1% to 2% on the gross margin, being reduced from the gross margin. And from the revenue perspective, again, it's still small this year. We saw, in the first quarter, together, if you combine our SaaS and our term-based license subscription that we do for Core PAS. Some customers buy our Core PAS on a subscription basis already, more this year than last year as well as our Application Access Manager, we saw about a $5 million headwind for the first quarter, and we expect that certainly each of the -- certainly in Q2, it probably is worth also a $3 million to $4 million headwind compared to a pure perpetual model. But at the same time, we're seeing our ARR grow. And if we look at our annual recurring revenue just from SaaS, not including our subscription and not including our maintenance and support contracts, that more than doubled to about $13 million at the end of March. And clearly, as we move forward with more SaaS, we expect to see that to grow. And -- but it will have the kind of the -- some of that revenue impact and a couple of points on the gross margin.

Great. So moving on to what you're talking about on the on-premise side. What percentage of your business, or your products, are geared for cloud versus on-prem?

I would say that all of our products are geared because we've been in -- are geared towards cloud and -- but many of our customers are in hybrid mode. So even if you take our on-prem delivered products, the customers can secure cloud assets. So they have privilege access through CyberArk to their cloud assets, even if they installed CyberArk on-prem, they can install CyberArk in their private clouds in their instances in the public clouds, and of course, the SaaS delivered products. So the #1 thing in our constitution is to support our customers' journey. And to do that, and when you play in the enterprise is to do it all, to support the hybrid and the cloud, and of course, the DevOps movement, which is huge, in our minds, the ability for us to be part of that initiative where applications are being modernized with our solution for DevOps. So while it's not all priced in a subscription mode, we cater both to their on-prem environment and their cloud environment.

So one of the newer products that you've launched, Alero, you talked about making that free trial given the current situation, could you just give investors a little insight into what is Alero? What's the opportunity there?

Yes. I'll start and maybe Josh can give some highlights on the pipeline effect, although we didn't give quantity of that. So Alero was -- basically, this Q1 was its first full quarter out there. We introduced it at the end of last year. Provides a remote vendor access solutions streamlined to CyberArk, where our customers can enable their vendors to achieve privileged access without plugging in a VPN into their environments, without downloading agents and without using passwords. So it's agent-less, VPN-less and password-less, so very slick solution for that connectivity. We extended that, and especially in COVID times, where also customers can use that same platform for their access to their CyberArk infrastructure and therefore, to do what they need to do to manage IT through Alero. And we did the right thing. We saw that it's part of the notion of moving to a work-from-home environment. Our customers are deployed and maybe they don't have the ability to have direct access. And so we provided a free trial that we extended, was initially until the end of May, we extended it until the end of June to allow them to onboard and use Alero for that quick and easy access for what they need. And it turned, we gave one example in the call yesterday, but it also translated into pipeline for Alero, obviously, customer satisfaction. And there are some examples of deals already generated from it. But it's -- in the long-term scheme of things, it was doing the right thing, allowing more customers to test a new product and enabling this connectivity. And now with Idaptive, we can even do more of that.

Great. Great. And with that, Udi and Josh, thank you so much for joining us. We've run out of time here, but thank you so much for speaking with us and hope to speak in the not-so-distant future again.

Yes. Maybe even in person.

Yes, that would be great. All right. Thank you so much.

Thank you.

Okay. Thank you. Take care.

Stay safe. Bye.