CyberArk Software Ltd. (CYBR) Earnings Call Transcript & Summary

Good day. Thank you for standing by. Welcome to the CyberArk Software Q2 2021 Earnings Conference Call. [Operator Instructions] I would now like to hand the conference over to your speaker today, Erica Smith, Vice President, Investor Relations. Please go ahead.

Thanks, Vie. Good morning. Thank you for joining us today to review CyberArk's second quarter 2021 financial results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open up the call to a question-and-answer session. Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management's best judgment based on currently available information. I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operations for the third quarter and full year 2021. Our actual results might differ materially from those projected in these forward-looking statements. I direct your attention to the risk factors contained in the company's annual report on Form 20-F filed with the U.S. Securities and Exchange Commission and those referenced in today's press release that are posted to CyberArk's website as well as risks regarding our ability to actively transition the business to a subscription model, the duration and scope of the COVID-19 pandemic, its related impact on global economies and our ability to adjust in response to the COVID-19 pandemic. CyberArk expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call. Reconciliations to the most directly comparable GAAP financial measures are also available in today's press release as well as an updated investor presentation that outlines the financial discussion in today's call. A webcast can also be found on our website in the Investor Relations section. With that, I'd like to turn the call over to our Chairman and Chief Executive Officer, Udi Mokady. Udi?

Thanks, Erica, and thanks, everyone, for joining the call today. We hope you and your families are all well. We had an amazing second quarter, one of the best in the company's history. Our subscription transition rate out of the gate in the second quarter, with the mix of subscription bookings reaching 65%. Despite the headwind created by the mix, we achieved total revenue of $117 million. This revenue level, paired with the mix overachievement, demonstrates that our bookings were considerably higher than anticipated in our guidance. In fact, the underlying business significantly accelerated in the second quarter, driven by record SaaS bookings and robust subscription demand. Due to our strong bookings, ARR grew by 35% to $350 million as of June 30. Even more importantly, our subscription ARR grew faster than 125% year-over-year. Recurring revenue reached $81 million, an increase of 32% compared to Q2 2020. Subscription mix, ARR and recurring revenue demonstrate the progress in the subscription transition, momentum in the business and the incredible demand trends we are seeing for our Identity Security platform, which is centered on PAM. I plan to frame our discussion on the quarter around the pillars of growth, subscription transition, innovation and profitability. So firstly, on growth. Positive secular tailwinds and the execution of our land-and-expand strategy are contributing to the acceleration in our business. Identity Security is at the center of digital transformation, Zero Trust and hacker innovation. Here are the most important and intertwined trends in cybersecurity. With digital transformation and the move to the cloud, privileged access is everywhere. And every identity across human users, applications and bots can be privileged under certain conditions. If you think about Zero Trust, organizations around the world are no longer just strategizing about frameworks. They are implementing programs and allocating budgets, taking an assumed breach mindset that trusts nothing and verifies everything. Attackers are exploiting the changing IT landscape. In the landmark breaches like SolarWinds, Microsoft Exchange, [ Foxconn ] and Colonial Pipeline, identity compromise and the abuse of privileged access is the common denominator. Weaponized software targeting supply chains and sophisticated ransomware attacks are examples of the severity of the threat landscape and are pushing identity securities at the top of CIO and CISO priorities. Our ability to deliver industrial-strength security and power business agility and growth and provide fast time to value is a unique and in-demand combination. This creates a strong market backdrop. Our go-to-market teams are executing and taking full advantage of these tailwinds to drive growth. They have quickly learned the land-and-expand approach, focused on the value of subscription delivery, the ability to leverage a robust and growing partner network and the selling process more aligned with our customers' needs that comes with our industry-leading SaaS solutions and focus on subscription sales. One of the most important of the market focus areas was expanding our sales motion to include our Identity Security vision. In January, we organized our sales team across the Identity Security pillars of PAM and our 2 speedboats, Access and DevSecOps. As evidenced by the acceleration in our business, the increased focus and specialized resources are working. Productivity levels have increased in all regions, and our cross-sell activity has improved considerably. At the heart of our business is our robust PAM portfolio. And in Q2, PAM, and particularly Privilege Cloud, was the biggest driver of growth. The majority of our customers land with PAM. We added more than 185 new logos across verticals, geographies and customer size. In fact, Fortune 500 and Global 2000 companies in manufacturing, professional services and critical infrastructure landed with Privilege Cloud in the second quarter, a clear demonstration that large enterprise customers are increasingly protecting the keys to the kingdom, leveraging the cloud, our cloud. In fact, the success of PAM extended across all portfolio areas as we look across -- as we look at strong close rates and a meaningful increase in deal sizes as new customers made longer-term strategic purchasing decisions with a broader set of our solutions. Customers are implementing comprehensive Identity Security programs, including CyberArk everywhere initiatives, relying on CyberArk across our portfolio of solutions. This is in part because of the maturity of our solutions, but also the flight to trust. In today's threat environment, customers increasingly want to work with partners who have real-world experience solving critical cybersecurity challenges. While there are multiple examples from Q2, what I will highlight demonstrates the increased velocity of our business and our improved expand motion. A financial services company who went deep with privileged access in the first quarter expanded quickly in Q2 to secure servers with Endpoint Privilege Manager in a high 6-figure ACV deal. The increase in ransomware attacks, like Colonial Pipeline, is accelerating demand for Endpoint Privilege Manager, which has been proven in our lab to be 100% effective in blocking more than 3 million types of ransomware and counting. I want to highlight a few more customer examples from the second quarter that demonstrate the power of our Identity Security strategy. An existing hospital customer, who have been locking with -- locking down endpoints with CyberArk since 2019, is now displacing their legacy PAM vendor to modernize their environment with Privilege Cloud. They are further expanding their CyberArk footprint by implementing Conjur to secure the DevOps pipeline as well as our access solutions, including vendor access. Our secret integrations, such as SailPoint and ServiceNow, as well as our ability to secure a broad set of cloud use cases were key contributors to this great expansion deal. One of our parent financial services customers in Europe was modernizing its identity stack in big CyberArk MFA and SSO identity solutions in a highly competitive situation. They recognize the criticality of identities and wanted identity access from a trusted partner who will empower the business, provide strong security controls and deliver value quickly. In their 7-figure annual view, a European professional services company embraced our Identity Security platform, buying nearly all of our SaaS solutions across the portfolio. This new logo will benefit from increased security and ease of use across all identities, protecting humans and non-humans across privilege, access and DevSecOps. The breadth of our portfolio and our ability to secure modern and traditional applications were key to winning this new logo. In a highly competitive win against a well-recognized DevOps solution, an existing Endpoint Privilege Manager customer is trusting Conjur Secrets Manager to secure its CI/CD pipeline. With CyberArk, this Fortune 500 transportation company not only wanted the scalability and agility of Conjur, but also the peace of mind from knowing that the mission-critical applications running its business are truly secured. Attackers are increasingly targeting applications and developers, which is contributing to the strong momentum for Conjur Secrets Manager. We are typically the second call after an incident response plan in a post-breach situation. And there are a number of examples for every quarter. In Q2, a leading company, who had just been hit by ransomware, purchased Privilege Cloud through AWS and was up and running in a matter of hours, quickly getting their business operational. Our partner ecosystem of advisory firms, VARs and C3 technology partners, is further extending our reach and driving scale in our go-to-market. Our advisory firm partners are investing in CyberArk practices for training and dedicated resources, another demonstration of the strong market demand trends in the industry. C3 partners, like Red Hat, we collaborate with on automation and DevOps; as well as AWS, CloudBees and UiPath, differentiate our solution in the field and allow our customers to maximize their IT investments. Moving on to the second strategic pillar, which is our subscription transition. We performed ahead of our expectations. Our transition strategy was set in motion in January. And since then, customers, partners and employees have to break the new selling strategy. In just the second quarter of our active transition, we reached 65% subscription booking mix, much faster than we anticipated. Our transition continues to be SaaS-heavy, and we were thrilled to reach a new record for SaaS bookings across every one of our SaaS products, with particular strength in Privilege Cloud and Endpoint Privilege Manager. In fact, every geography and every SaaS product saw an increase in subscription mix compared to the first quarter of 2021, giving us confidence that the subscription pricing will be adopted across verticals and regions. While the active subscription transition is relatively new, we already have more than 675 customers with over $100,000 in ARR, an increase of 39% from June of last year. We also continue to see great progress in our customer success program, and we are well on our way towards delivering transformative value to our customers. We are thrilled with the progression of our subscription transition. And after analyzing the path forward, we are confident we will reach our goal of 85% of bookings from subscription and exit the transition by the end of 2022. Said another way, instead of an 8- to 10-quarter transition, we now expect to complete the transition in 8 quarters. Moving on to our innovation pillar, which is the foundation of our strategy and strengthens our leadership position in the market. We were pleased to be named a leader in the July 2021 Gartner Magic Quadrant for Privileged Access Management, positioned both highest in ability to execute and furthest in completeness of vision for the third time in a row. The power and differentiation of our data security strategy is demonstrated by Dynamic Privileged Access and Secure Web Sessions, which we introduced at our Impact event in June. The response from our customers has been overwhelmingly positive. Dynamic Privileged Access extends our existing just-in-time capabilities to multi-cloud and hybrid workloads. Every enterprise IT environment has both standing and dynamic privileged access, and customers require a solution that secures both. Secure Web Sessions is part of our Access speedboat and delivers continuous authentication and session protection, including session recording for all types of web applications, from business apps to cloud [ contents ]. This solution was described as a game-changer for Identity Security by customers who attended our event. We are the only vendor offering this essential capability required to achieve Zero Trust. I will wrap up with some comments on the profitability pillar. Our go-to-market engine is firing on all cylinders, and our innovation machine is extending our leadership position. As we look into the strong market fundamentals, acceleration of our business and improved close rates and productivity, we made the decision to increase our investments in the second half of 2021, particularly in go-to-market to drive growth in 2022 and beyond. We have not changed our philosophy around investments. We critically evaluate our investments to ensure they deliver a strong return and long-term value. And as a result, we expect to return to the profitability levels that we were on before we entered the transition period. To recap, before looking ahead, we had an incredible second quarter, one of the best in the company's history. The underlying business accelerated. Each of our SaaS solutions reached record bookings. Identity Security across PAM, Access and DevSecOps is becoming a security requirement, pushed forward by major industry tailwinds, digital transformation, Zero Trust and hacker innovation. And our subscription transition strategy is delivering results. Our outperformance in the first half of the year gives us incredible confidence in our ability to execute, and the strong demand environment supports our growth. As a result, we are raising the full year booking assumptions underlying our guidance, above and beyond our beat in Q2, which Josh will discuss in more detail. We are well on our way towards transforming the business into a fast-growing, durable subscription company, with our cloud solutions leading the way, which will unlock tremendous value for our company, our shareholders, our customers and our partners. I will now turn the call over to Josh, who will discuss our results and outlook for the third quarter and full year. Josh?

Thanks, Udi. So before we discuss the details of the quarter, we wanted to remind you that we posted slides to the website that will be helpful as we walk through our results. As Udi mentioned, we had a great second quarter, with an acceleration in the underlying business, particularly for PAM, and all of our subscription transition metrics came in better than we expected. In terms of the headline P&L, we delivered total revenue of $117 million, with a 65% mix of subscription bookings. That's well ahead of our guidance framework of a 55% mix. As Udi also mentioned, revenue above the midpoint with a higher subscription bookings mix was because of the stronger-than-anticipated total bookings for the quarter, above what we guided for in May. Subscription revenue reached $27.1 million and represented 23% of total revenue in the second quarter. That's increasing 101% from $13.4 million in subscription revenue and only 13% of total revenue in the second quarter last year. Our combined maintenance and professional services revenue was $62.9 million, with $53.5 million coming from recurring maintenance and $9.3 million in services revenue. Total recurring revenue in the second quarter reached $80.6 million or 69% of total revenue, growing 32% from $60.8 million, and only 57% of total revenue in the second quarter of last year. The mix of subscription bookings as a percentage of new license bookings really demonstrates the pace and success of the transition. We are moving faster than we planned through the transition, as you can see by our 65% subscription booking mix. Economically, the headwind created by the mix was approximately $13 million in the second quarter when we compare it like-for-like to the mix in the second quarter last year. Normalizing for the mix shift, the license portion of our business, our SaaS, on-prem, subscription and perpetual would have grown over 35% in the second quarter, which really supports the growth we are seeing in our business. Taking the headwind into consideration, total revenue growth would have grown 22% year-on-year. At June 30, 2021, our ARR was $315 million, growing 35% year-on-year and representing an acceleration from the organic growth rate in the first quarter of 2021. We closely monitor the subscription portion, which grew 128% year-on-year to approximately $109 million and represented over 35% of total ARR at the end of June. Sequentially, we added nearly $22 million of SaaS and subscription ARR in the second quarter compared to the first quarter this year. On an organic basis, this was the strongest sequential increase in subscription ARR in the company's history. The maintenance ARR was $206 million at June 30, 2021. So we're thrilled with the new business momentum in terms of number of new logos added and a healthy increase in new business deal sizes. A bit more detail, about 83% of our more than 185 new logos were subscription. That's compared to about 50% in the second quarter of last year. Geographically, the business continues to be well diversified. The Americas generated $69.5 million in revenue, representing 59% of total revenue. The Americas, again, has the strongest percentage of subscription bookings during the quarter. EMEA had $36 million in revenue or 31% of total. APJ generated $12 million in revenue or 10% of total revenue, with an increasing mix of SaaS and subscription. All line items of the P&L will be discussed now on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release. Our second quarter gross profit was $97.9 million or an 84% gross margin compared to 85% gross margin in the second quarter last year. We continued to make disciplined investments in the business, resulting in operating expenses of $95.9 million, a 30% year-on-year growth, and operating income was $2 million in the quarter. Three main items that impacted our operating income. First, the $13 million headwind lowered our operating margin by about 9 percentage points; second, higher expenses from foreign exchange rates lowered our operating income by about 2%; and third, a full quarter of expenses from Idaptive this year versus last year. On a like-for-like basis, neutralizing the headwind, FX and Idaptive, our operating margin would have been approximately 15% in the second quarter of 2021. Over 78% of our operating expenses are related to headcount. We executed even better than we expected against our aggressive hiring plan to invest in the business, ending the second quarter with 1,969 employees worldwide. And of our total employee count, 881 employees are in sales and marketing. Net income was $250,000 or $0.01 per diluted share for the second quarter. In the first half of 2021, free cash flow was $45.2 million or a 20% free cash flow margin. This cash flow contributed to our strong balance sheet, and we now ended the quarter with $1.2 billion in cash and investments. We also increased deferred revenue by 22% year-on-year to $275 million at June 30. Our SaaS deferred revenue grew by 136% to $63.6 million, and that's compared to only $27 million at June 30, 2020. Now turning to our guidance. For the third quarter of 2021, we expect total revenue of $116 million to $124 million. We expect a non-GAAP operating loss of about $6 million to non-GAAP operating income of $1 million for the third quarter. We expect our EPS to range for non-GAAP net loss of $0.19 to a loss of $0.02 per basic share. This guidance assumes about a 70% of subscription bookings and a revenue and profitability headwind of approximately $14 million for the third quarter of 2021. Our normalized total revenue growth for the third quarter, taking the calculated headwind into account, is over 25% at the midpoint of the range. And if you isolated our license lines of SaaS, on-prem, subscription and perpetual, the normalized growth rate for the third quarter calculates to be 40% year-on-year. Our guidance also assumes 40.2 million weighted average basic and diluted shares. Our guidance for the full year 2021 reflects the robust industry tailwinds and strong close rates. We expect total revenue in the range of $484 million to $496 million. And the mix assumption underlying our guidance for the full year is 64% from subscription bookings, and our revenue headwind for the full year is now approximately $63 million. This represents a significant increase from our prior guidance, which assumed a mix of 57% from subscription bookings and a $45 million headwind. Given the transition, we wanted to provide more color on our growth rate, taking the calculated headwind into account, which were approximately 19% at the midpoint of the range for total revenue. And if you isolate our license lines of SaaS, subscription and perpetual, the normalized growth rate would be over 25% for the full year. I want to emphasize that the combination of higher bookings mix and revenue headwind represents a significant increase in the booking assumptions underlying our guidance for the full year. Now moving down the P&L. We expect the non-GAAP operating income to be between $7 million to $17 million. We expect our non-GAAP net income per diluted share to be in the range of $0.01 to $0.26. And for the full year, we expect 40.8 million weighted average diluted shares and about $12 million in taxes. We are increasing our investments in the second half of the year to ensure that we can capitalize on the growth opportunity, our leadership position and fundamental strength of the business. We also want to provide a few updates on the timing of the transition and free cash flow guardrails for the full year. As Udi mentioned, on the timing of the transition, we now expect to complete the subscription transition in 8 quarters, meaning we should cross over our targeted 85% threshold of bookings from subscription already by the fourth quarter of 2022. Lastly, on cash flow. While we do not intend to guide for cash flow, we did want to provide more granularity given that we're already halfway through the year. Currently, we expect our free cash flow to be between 5% and 10% of the non-GAAP net income margin for the full year, with third quarter free cash flow lower than the expected quarter of '20 -- lower than the second quarter of 2021 because of typical seasonality. Second quarter was great. Growth is accelerating, and our subscription transition is well underway. We are confident that our investments will drive growth and innovation in 2022 and beyond. With that, I'll now turn the call over to the operator for Q&A. Operator?

[Operator Instructions] Your first question comes from the line of Saket Kalia of Barclays.

Okay. Great. Udi, maybe just to start with you. It's great to see the overall revenue upside in the quarter. But I think what was really interesting was to see the revenue guide unchanged for the year despite the higher subscription mix and sort of all the commentary on better bookings. So I was wondering if you could just maybe double-click into what you feel like is driving that underlying better bookings backdrop? Because I think we heard that last quarter as well. So could you just go a little deeper into whether this is coming from a change in the competitive environment? Or whether this is related to maybe some of the breach activity that we've seen? Curious what you feel like is driving that better bookings activity.

Absolutely, Saket, and good to talk to you here today. We talked in the past a lot about building a record pipeline. I would say we're executing against this record pipeline. So it's a combination of the demand environment, the market leadership and favorable competitive environment and strong execution in how we organize to execute around it. The transition is really happening strongly, and the sales team really embraced that with the SaaS and subscription. And with the increased demand environment, we're working on it and executing great. I mentioned the steeples really complementing our PAM core business. And very pleased to see the demand for Privilege Cloud move up to upmarket, like the examples I've given, where large enterprises are also adopting Privilege Cloud. It gives us the opportunity also for quick time to value for them. So I would say all of the above, the execution against the growing demand environment. And I'd probably add that EPM, specifically, is getting strong demand, driven by ransomware. But I would also say that the rest of the solutions are considered critical in this kind of threat environment and a strong pillar of Zero Trust.

Got it. Got it. That's super helpful. Josh, maybe for my follow-up for you. I think we understand sort of the revised profitability. It feels like you're investing, really, to -- for continued growth, if you will, I think, going into future years. Can you just go a little bit deeper into -- will all those investments sort of be in go-to-market? Is there anything in that sort of revised operating income guide that maybe has to do with the changing mix? Or just maybe one level deeper into sort of the revised operating income guide. Because, maybe for me, that was a little unexpected given the unchanged revenue guide. So just maybe one level deeper, if you can?

Yes. Thanks, and I'll certainly go into that. So first of all, we did extra hires in Q2. We were able to even overachieve on our internal targets for hiring because we were considering the very tight and competitive job market out there. And with over 160 net additions, we started -- we're starting into the H2 in a strong position from the hiring perspective, and we'll continue to be doing that as we go into the second half. And it's going to be some really stepping on the gas on the go-to-market hires in the second half. And it's coming from -- and the other part that I would dive into is that we overachieved in Q2 bookings. Our guidance, as you pointed out as well, and as we pointed out several times this morning, that is already -- we believe we're beating out our original internal forecast on bookings for H2. And that's really going to drive up our variable amounts as well into H2. So when we consider where we are on our position for hires,going into the second half, when we consider our targets for our go-to-market hires going into the second half and increased expenses related to the fact that we actually are booking more business in Q2 and are expected to do some more in the second half, we're seeing a rise. And that's what's contributing to the kind of under the hood to that change in the operating expenses.

And I will just add that nothing changed in our approach to run a highly efficient, profitable business. But as Josh mentioned, exiting Q2 with such growth and a faster transition to subscription and adoption across SaaS by the enterprise and a favorable competitive landscape and market fundamentals, we believe that they really justify increased investment in go-to-market and scaling of the company to support the acceleration of the business and build with the momentum that we've been talking about today.

Your next question comes from the line of Sterling Auty of JPMorgan.

So I want to ask the subscription transition question this way. Obviously, the mix is much better than you originally expected. But who is not choosing subscription, especially when you talk about the new customers coming on? Who -- what's the profile of the company that says, "You know what, subscription is just not for me."

Yes. Sterling, I'll start. I would say that we're primarily very pleasantly surprised by the adoption across regions and across verticals. And as I mentioned in my prepared remarks, we even have critical infrastructure companies and large Global 2000 and Fortune 500 adopting it. And it's happening across the board and across geographies. And as Josh mentioned, 83% of the new logos were SaaS and subscription. So it's really happening. If I could -- were to point to verticals that we expect them to be laggards in the adoption, it's probably the global government verticals, where we expect them to be the -- later on the adoption and want to still kick off more in perpetual. And again, under government, you can also put some highly regulated verticals, but it's happening. And within the regions, APJ is adopting it, but will be slower in adopting SaaS and subscription.

Makes sense. And then, Josh, one follow-up for you. I missed it, if you said it, but you've given us kind of a great view on what revenue would have been if you didn't do the transition. But what about free cash flow? I think first half year-to-date, you're down about $5 million. But in the perpetual maintenance, I would imagine you collect just a much bigger portion of the value than you do under subscription. Even if you don't have an exact number, can you just give us a framework of how to think about that?

Yes. I mean you're right on the SaaS and subscription model, there's much more annual payments than in a classic perpetual maintenance model. And also, let's remember that the perpetual piece is getting more money for the licensed portion as compared to a typical annual contract. It's usually an annual -- the contract, so it could be 2 to 3 years breakeven before you get to kind of the perpetual size. So I know -- the other piece then, obviously, as it correlates to that, I can't give you necessarily a framework. I mean -- but there is some impact on cash flow relative to the mix of SaaS and subscription. I would probably -- when we think about it, correlated to -- on the -- we've always been talking about kind of cash flow being around 0 to 10% above net operating margin. But what we're seeing is still the same percentage over net operating margin, but a lower net operating margin. So -- and that's where I would correlate the difference.

Your next question comes from the line of Jonathan Ho.

Let me echo my congratulations as well. Can you give us a little bit more color on the multiproduct deals that you're seeing or platform purchases? And here, does SaaS make it easier for customers either to buy upfront or to add on sort of additional products over time?

Yes, absolutely, Jonathan. I think we gave some examples on the call. A customer that starts with Privilege Cloud adds EPM faster. And we've seen it with the examples of customers going broad in the advanced security solutions. So with both the combined packages, we see everyone -- every customer can land with third-party access, MFA and SSO. So they get a good bite on the offering depending on how they land. And then from there, we can show value and expand. So it's definitely the power of the Identity Security platform and -- taking place.

Got it. Got it. And are you seeing any evidence of potentially pent-up demand from COVID-19? Or maybe companies that are taking a little bit more of a strategic review of their portfolio and then now looking for either your SaaS solutions or the add-ons of some of these other solutions on the Privilege Cloud side?

Absolutely the latter. I would say it's -- these companies are being more strategic. They're in the new normal, and it's time for them -- and they're -- even with regards to SolarWinds and events of that type, the first was kind of reactionary, "What do we do to patch and solve?" And we're seeing customers across the board be very strategic across how they're going to secure their future and looking to be more programmatic and definitely faster in adopting cloud. And we can see that also in the new logos, where deal sizes have increased as they take a larger bite because they're being more and more strategic. They want to start a PAM or an Identity Security program.

Your next question comes from the line of Hamza Fodderwala of Morgan Stanley.

So just one for my end, for Josh as well as Udi. So a lot of great color on the demand environment, larger deal sizes. It seems like there's a lot more strategic conversations around the product portfolio. If I triangulate that to ARR, right, so this quarter, you added $27 million new ARR. That was like almost double versus last year in Q1. If we think about the back half, given everything that you're saying about demand environment, should we expect -- if demand is improving that, that net new ARR should be growing into Q2 and Q3 and Q4? Does that make sense?

Yes. Hamza, I'll start. Definitely -- I mean, overall, for the year, we see ARR growing 35%. And so we had -- we liked our accelerating organic ARR from -- to 35% level Q2, and we see for the year to continue growing ARR and having an annual growth of about 35%.

And Josh, if I can just follow up on that. So it's definitely growing 35%. That seems like to be a bit of an uptick versus what you guys were saying before of 30% plus growth. Is that a fair assessment?

Yes, that's correct. And we're doing -- we're seeing that uptick because of the acceleration that we had on an organic basis in Q2, and we're glad to do that.

Your next question comes from the line of Rob Owens of Piper Sandler.

I think Hamza beat me to it. I was going to try and pin Josh on the number for the year on ARR. So 35% looks like a good number. I guess, at a high level, Udi, what's the transition mean either for a customer acquisition? Is it -- is subscription getting you into new areas or new segments of the market? And then how do you think, longer term, about customer wallet share? And what the shift to SaaS is doing from that perspective? And any quantification would be great.

Rob, I would say, the subscription removes resistance and procurement cycles, again, for those -- for the majority of the verticals that are adopting subscription. And we're really playing in broad markets, both verticals and geography already. I would say that the SaaS element, the SaaS, particularly, takes us further into mid-market, what we call the commercial segment, as an easy landing point. And of course, it is in line with the strategy we're seeing across enterprise, where a lot of them want a SaaS-first solution for security. So I would say, it's having the right solutions and the right timing right now, where the market is ready to adopt PAM and Identity Security. And of course, the motion, as I mentioned earlier, really allows us to show quick time to value much. We honed a lot for the customer success, and also that I talked about, and get quicker into that add-on business with SaaS customers.

And I guess, secondarily, for Josh. You did see strong acceleration in that subscription ARR, especially on a sequential basis. If we kind of unpack the different elements, though, term was up just modestly on a quarter-over-quarter basis, especially relative to the growth in subscription ARR. Was there anything to do with duration? And I realize there's a lot of moving parts on these numbers as we get 2 and 3 layers, too. But was there a duration issue or anything else we might be aware of there?

Yes, Rob. It's not about duration, just doing more bookings of SaaS and subscription deals. And also, I think we mentioned this before, we're SaaS-heavy on that. So more of the ARRs coming on the SaaS side. And -- but it's just doing more bookings.

Your next question comes from the line of Adam Borg of Stifel.

Udi, maybe just for you, just obviously, with the U.S. federal government taking cybersecurity a lot more seriously with the EO and other actions. But I was just curious kind of what you're seeing more in this vertical. And as you think about the fiscal year ended 3Q, are we expecting to see some -- excuse me, some type of acceleration in 3Q? Or do we think that any tailwind from the federal sector would be more of a '22 event?

Absolutely. So I think there's -- we have a great long-term opportunity in global government, including U.S. federal. We see -- and we are excited to see principles of PAM, principles of least privilege, of Zero Trust, in both the executive order and the proposed legislation. So we believe there'll be long-term returns on that. We're not expecting outsized returns in Q3 because of the time it takes for these initiatives to sit in. But again, certainly a long-term opportunity for global government.

Great. That's really helpful. And maybe just a quick follow-up. Just on Endpoint Privilege Manager. It's nice to hear the continued traction there. Can you just remind us of the mix that, that represents, the total ARR?

I think I have the total on the -- I have the mix of revenue. About 20% of total ARR -- of the annual recurring revenue.

Your next question comes from the line of Brian Essex of Goldman Sachs.

Maybe, Udi, if we can dig in a little bit. I think there's some commentary about the federal -- favorable competitive landscape. What is driving that favorable shift? And I think, in your prepared remarks, you noted a nice win against a DevOps peer. Maybe if you could dig into that a little bit as well and give us a better insight into what was the approach of the peer. How -- what did that competitive environment look like? And what drove the win there?

Sure. So I'll take a broader brush on the competitive environment, and then we can dive into DevOps. I think CyberArk has been consistently extending our market leadership position with the innovation arm and coupled closely with the extending and growing go-to-market arm. And you can see that in our results for the third year in a row, in the Gartner Magic Quadrant, really, having the top leader position. I think at the same time, we've seen the traditional PAM vendors kind of switch hands on private equity, and we're seeing disruption there. And so we're not waiting and pushing ahead on PAM. And then with our expansion into Identity Security, we have the broad offering with PAM at the center, but the ability to push the full identity management cloud suite and DevOps. And in that realm, we obviously can counter the access players and the DevOps players. But we win on having a security-first mindset with the customer and the fact that they trust us with PAM at the center. The example that I alluded to and our win on the DevOps front is exactly where customers no longer -- especially after SolarWinds and the increased threat environment, is a, I would say, more control kind of shifting back to a security-first mindset for the customer. And here, they wanted a security vendor to be the one securing and have the ability to secure all types of applications. And it really differentiates us in the market with our secrets management that needed to be agnostic to what would be the chosen developer platform, our partnership with Red Hat and the ability to integrate all of that into their PAM. And so having the PAM platform and being able to secure broad -- all types of applications has led us to this win and many wins on this front.

Okay. That's helpful. And I was going to ask you about Centrify. So I think you hit that. And then maybe just a quick follow-up. The deal you announced, or I guess the transaction you announced, AWS purchase of Privilege Cloud or Privilege Cloud being purchased through AWS, how significant is AWS as a channel? Is that more downmarket? And how does that kind of lead to follow-ons? Do you have a lot of visibility to increase the cash after Privilege Cloud is purchased through that channel?

Well, that's a great question. And I would say that AWS is a new channel for us, but we're very excited about it because it complements -- it's actually an inclusive channel that works on top of our other channel partners, especially where our customers have existing AWS relationships and are able to buy through the marketplace. So that was a great example we put out there, where the demand was for CyberArk. We helped the customer recover from ransomware into our Privilege Cloud, and the ability for them to buy that through AWS really accelerated the whole cycle. And I would say, we have multiple integrations with AWS. We're moving up in the partnership with them. And we're going to invest more in this go-to market to be able to replicate those sort of wins, again, in complement to our existing channels.

Your next question comes from the line of Jonathan Ruykhaver of Baird.

Congrats on the strong performance. So it's really great to hear how well Privilege Cloud is doing. But Udi, I'm curious if you can give us some color on Idaptive. Just -- it's been about a year since the acquisition. It seems like you've had some early traction there. But just curious how you feel about the positioning there, especially with the security-first messaging?

Yes. I think it's -- we're very excited about this speedboat and how they're performing. And I would say, it's just really kind of a breakout -- it was a breakout quarter for them in the muscle of both landing new logos and also creating add-on opportunities within our customer base. So I would say it's a newer part of the business, but the speedboat is well on its way, with strong progress in the market. But we invested a lot with integrating our solutions and our ability for our customers to really see success from leveraging the connectivity to PAM, to vendor access and the other things that we brought to the table. And the customers are very excited about what we announced at our Impact event with Secure Web Sessions and our ability to give them PAM life controls for all types of users. And so this will be available in the second half of the year, and we expect that to give us an increased competitive advantage and a good why -- on why adopt Identity Security as a strategy.

Yes. No, that's great to hear, Udi. And then, Josh, I think you touched on some of these dynamics earlier. But when you look at net new ARR in the quarter, peeling back the layers, any seasonal impacts on the average maintenance that we should be aware of in the quarter that have some legs into 3Q?

Jonathan, actually, I think there was nothing seasonal that I would point to. Everything on the maintenance side behaved according to plan, and just we exceeded plan on in terms of the business coming from SaaS and subscription. I want to take this one opportunity, though, to the question earlier around the percentage of ARR for EPM. I said it was about 20%. It's about 20% of the subscription ARR component that we have. So I just wanted to clarify that. Thanks.

Your next question comes from the line of Roger Boyd of UBS.

Just a quick question on perpetual and your expectations for the back half year relative to the strong booking mix and 35% ARR growth. Can you talk about if there's anything changing from an incentive standpoint from the first half to the second half? Or is it just more the go-to-market, seeing it stride, bundles are coming online, and customer demand is just organically going that way?

So I think, like we talked about, we were expecting, again, a growing mix in Q3, with a 70% mix. And then, in Q4, we're expecting more add-on business coming with perpetual. In terms of the team, they're all incented to sell SaaS and subscription. We kicked that off in January. They're all trained. All regions are running and pushing that. So the only nuance, which is a positive one, is we expect to add on business from existing customers in Q4, which will be an increase in perpetual into that mix.

So that would be add-on business, not any sort of conversion of maintenance revenue?

It will be mostly add-on. There will be still even some new business because let's remember that the pipeline is still rolling out from a historical old pipeline going into the back half of this year. But it will be a combination, but mostly probably add-on with some new business.

Your next question comes from the line of Gregg Moskowitz of Mizuho.

Guys, I know you introduced some new subscription packages at the beginning of the year, and I would love to hear some more about how that's tracking so far.

Yes. I would say that all new pipeline is basically containing -- and, of course, deals that closed within the cycle is on the new packages that combine, for this threat analytics, multifactor authentication and an open vendor access into the mix of higher value, for our customer to adopt the new package of what they get from the get-go. And we're seeing it both in pipeline and also in -- and, of course, deals that were closed within newly created pipeline.

All right. That's very helpful. And then for Josh, so the acceleration of go-to-market investments in the second half, is this primarily greater sales capacity? Or will there be other aspects of go-to-market such as channel enablement, marketing, et cetera, that you might be significantly ramping as well?

Yes. Well, when we think about the incremental piece, it's really across all of the functions in go-to-market. It's heads, it's quota carriers, but definitely also related to overlays and channel managers and the likes, but really around the go-to-market engine.

Your next question comes from the line of Catharine Trebnick of Colliers.

Good quarter. Could you just pull apart for me maybe the top 5 C3 players on your alliance that really helped you drive revenue or cross-sell, upsell within some of your accounts?

Sure. So I mentioned a few. I would put up Red Hat and SailPoint and UiPath and CloudBees, I'd probably add Proofpoint in there as well, if I go for a top 5. And with all of them, there's this really great collaboration in the field and also integration. And on top of that, the C3 -- the power of the C3 Alliance is really strong because there's variety. There are deals where customers want integration with their IoT devices, and we have partners to support that, like Forescout. And so it's also the power of the variety and also the focus on the top. And like I mentioned earlier, we should add AWS in there as a thought partner. And I gave an example on the call with ServiceNow. So I'm beyond the 5, right, because that's the multiple partners there.

Your next question comes from the line of Alex Henderson of Needham.

So your transition here has resulted in a pretty steep reduction in operating margins year-over-year, from about 20% down to about 1%. Obviously, that process continues out into '22. And I know you don't give guidance for '22, but -- the Street has a significant increase in EPS model for '22, yet I think your slide deck from your Analyst Day showed a decline in operating margins from '21 to '22. Is a decline in operating margins still in order, given the accelerated pace that you've already achieved? Or alternatively, will that moderate a little bit more because you're already further into the process? If you could give us some directionality to margins for '22 based on your expectations around the transition achieving $85 -- excuse me, the 85% by the end of the year, fourth quarter, that would be very helpful.

So thanks, Alex. I think nothing has changed in terms of the fundamental economics behind the transition or the transition of the model transition and the context that operating margin takes a hit as you transition through the model and get to the other side of 85% to 90% coming from bookings. And it continues that way until you get to that point. So what we talked about today is that we're excited that we're able to move that point up to more certainty to being by the fourth quarter of 2022. So we do anticipate the operating margin to follow through a transition model to potentially go down through the transition into 2022. What we like, though, in terms of moving the transition table up is that we'll be able to now come out of the transition faster. And typically, you'll then see the rebound of operating margin going up post the last transition quarter. So when we get to the end of '22, the way the model works on these transitions is then -- would then be able to rebound and go and return to the profitability earlier rather than later. And I would add, we're still fundamentally -- we're still fundamentally sound on being able to achieve, again, coming out of the transition a couple of quarters on the other side of the transition to return to our Rule of 40 targets after that. And so basically, moving it up to 8 quarters is basically moving -- is moving where we're going to come out back to profitability sooner.

Super. And the accelerated hiring, I think, also adds to that pressure in '22, though, right?

Yes. But it's all part of -- if we think about even the guidance for this year economically, right, our guide is still talking about -- if you consider the headwind coming into 20% revenue growth with 13% operating margin. And obviously, whatever we hire in this year is going to go into next year. But fundamentally, we're still focused on being able to hit the transition and then, afterwards, be able to rebound to a Rule of 40 company going into the following year.

This concludes the Q&A session. I will now turn the call back over to CEO, Udi Mokady, for closing remarks.

Great. Thank you very much, everyone. I want to thank our customers, partners and employees for contributing to our strong second quarter and supporting our fast transition to a subscription company. I'm confident that, as we execute our strategy, we will build even deeper relationships with our customers and partners. Again, thanks, everyone.

This concludes today's conference call. Thank you for participating. You may now disconnect.