CyberArk Software Ltd. (CYBR) Earnings Call Transcript & Summary

Okay. Hey, good morning, everyone. My name is Saket Kalia. Welcome to day 1 of the Barclays TMT Conference. Very happy to have with us the team from CyberArk. We've got Josh Siegel, Chief Financial Officer; as well as Erica Smith, Head of Investor Relations. We've got about 25 minutes or so together. So maybe what we'll do is we'll take the first 15 or 20 minutes to do some fireside chat and then let's take some e-mail Q&A. I would love to make this interactive. So any questions, just feel free to e-mail me at [email protected] and I'll try to get to as many questions as I can. So with maybe all of that as a framework, Josh, Erica, thanks so much for being with us here today.

Thank you, Saket. It's always good to be at the conference.

Well, it's our pleasure, Josh.

Josh, maybe just to level set for everyone. There's just so much happening at CyberArk right now, it's just -- it's a really exciting time. I guess, to the best that you can, can you maybe just remind us of some of the key highlights from your Q3 results? And maybe what you were most proud of?

Yes. Thanks, Saket. We made -- first, we made great progress on our transition to the recurring revenue model, which we set forth the path earlier in the year. We hit the percentage of bookings in the third quarter that went from SaaS subscription at 72% ahead of schedule. And I think second, I would really point to the keyword that we talked a lot about and really mentioned it in the earnings call, acceleration. Annual recurring revenue grew 38% year-on-year, subscription annual recurring revenue portion grew 131% year-on-year, and really -- and now it's representing 40% of the total ARR. We look at recurring revenue by itself. It grew 41% year-on-year. We had an acceleration in new logos with more than 230 signed in the quarter. And again, back to the transition, more than 85 -- I think it was 85% actually landed with a SaaS or subscription model of the new logos. So as a result, we were able to -- what's in it for everybody else and for the investors, we were able to pull in the guidance on the subscription transition from Q4 to Q3 of 2022. We also raised our full year ARR framework to a 37% growth rate. So Q3 was a great quarter. We had great progress on the transition, which is one of our key goals for the year. And overall, just the overall business is fundamentally continuing to grow with good production and execution from CyberArk's perspective. And of course, the environment, the demand environment is very healthy as well.

That's a really helpful foundation. And I actually want to pick up off that last point just around the healthy demand environment. I feel like you and Udi have been so consistent through the year talking about a better bookings backdrop. And we'll come back to the mechanics of that with subscription in a couple minutes. But maybe just zooming out a little bit, how much do you think -- because I know you're a CFO that understands -- you understand the business and the products really well. I mean, how much do you think that better performance is coming from that elevated breach environment that we've seen this year versus better execution or just other stuff? Does that make sense?

Yes, it does. And we get asked that question a lot, actually, Saket, how much does the threat environment increase orders or does a particular bridge increase orders. And it's difficult to really put a number on that. But there's no question that attacker innovation has always been a driver of our business. And today, it's really no different. It's part of the discussion. It's part of the discussion when our go-to-market teams go into the enterprise. It's part of the discussion of what's going on within the enterprise even if come to us and bring us a call, it's going on at their Board levels and the like. The threat landscape is really creating a sense of urgency across industries. And when they think about what that threat is about, it's about the identity really being the next frontier of attacks. And that's what's really driving business towards CyberArk's way. And of course, we have the concern of the supply chain attacks that came out of Q4 last year with SolarWinds and using weaponized software. Of course, ransomware has become a household world -- word and really driving cybersecurity budgets, and partially because it has to -- if they even think about wanting to get cybersecurity insurance, they have to go out now and do a lot of these preventative measures because that's going to be one of the first questions that they're asked on their application. But I will add that it's only part of the discussion, the threat environment, because even when we think about before the SolarWinds and before every breach has come out during 2021, even last year, we were seeing record pipeline build throughout all of last year. And you've been tracking us since the IPO and we -- there's always been a continuing build on the pipeline that's been driving the acceleration of the business. So we like -- there's no question the threat environment aids. But at the same time, the -- just overall understanding of where privilege is within the cybersecurity strategy has also just increased market advantage in CyberArk.

Got it. Got it. That makes a lot of sense. I'd love to double click into this a little bit deeper. The way that Udi speaks to the business or at least one of the ways that we spoke to the business around the Analyst Day, right, and Erica, maybe you could chime in on this as well, is really around sort of these 3 product, these 3 product areas, right? You've got core PAM, which of course is, of course, the largest part. And then 2 speedboats, right, with -- in DevSecOps and Access Manager or Access Management. I guess, maybe the question is, how do you think about the sizes here from an ARR perspective? And which ones are surprising you maybe from a growth perspective this year, again, connecting this back to the strong demand that we've seen?

Yes. So I'll just start and then I'll let Erica jump in on some of the numbers behind the speedboats. But for sure, introducing the speedboat structure has really been able to provide more subject experts within the sales cycle. So when our go-to-market teams are going to the enterprise, they're able to bring now the speedboat subject matter experts to the field with them. And we – it's really had a positive impact on our execution. This is year 1. I really think that this is the type of thing that as it starts to mature and really gets going and primed, it's going to be something that's really critical to us as we kind of look at the medium and long-term growth. But when we think about kind of the subscription ARR, Erica, why don't you jump in on kind of how we break that out.

Yes, sure, Josh. Happy to do that, and it's great to be here today, Saket. So I think the easiest frame right now as we're going through the transition to really think about the relative contribution of these solutions is to look at ARR, right? And so the subscription ARR is where we're anchoring folks on, so that just the subscription portion. And if you kind of were to unpack that a bit, PAM, both on-prem and Privilege Cloud represent just over half of that subscription ARR. Endpoint Privilege Manager is just over 20%, the Access solutions are just over 15% and then Secrets Management is just over 10% of that subscription ARR. So that would be kind of the relative contribution to the business. And then I think just to unpack, again, your second question around surprises this year in growth rates. Really, we've seen Privilege Cloud take off this year. And that's been a really great contributor to the overall growth. And that big driver has been on the -- really on the enterprise side. And so we're seeing Privilege Cloud push up higher into the enterprise a bit faster than we anticipated this year.

Got it. Got it. Very helpful. Josh, I'd love to jump into -- I mean, we've been talking about subscription so much. Let's just jump right into it because I think it's been a major part of the story this year. And so maybe just to start and step back, the question is, how has subscription pricing helped the sales force, I guess, compared to when they were selling perpetual, right? And I mean, this is still relatively recent. It was just last year that we were selling perpetual in a much more meaningful way. But I guess where I'm going with the question is, has the move to subscription pricing actually helped cast a wider net, maybe impact sales cycles positively, maybe sell more products? Any sort of commentary around that in terms of not just -- we're going to talk about the modeling impact of the transition. I just wonder from just a sales execution perspective, how subscription pricing has helped?

Yes. So I think that it's kind of a 2-way street. First of all, we've seen our sales teams and our go-to-market teams really embrace the subscription model. So just embracing it has been a contributor for them to want to sell more. They get it why this is really good for CyberArk over the long term. They also get it why it's good for the partners and for the customers. So they've embraced it, and they're -- when sales people embrace something, they tend to be more successful with it. And if we think about all the things that you mentioned as what could be some of the reasons, it's really all of the above. And we're seeing customers get faster time to value. So when -- first of all, when they're buying SaaS, they're able to bring it on to -- bring it on much faster because it's just bringing in the service and they don't have to on-prem set up all the network, the infrastructure on-premise. They're expanding faster when -- because it's like, oh, I need another 1,000 licenses and it's calling up CyberArk and it's a push of the button through the service platform. And it's still kind of early to roll out real metrics. But we're seeing customers buy more products and the cross-sell motion. When we think about PAM customers today and selling into an EPM cloud or selling for Alero or Remote Access or even selling Idaptive, it's an easier cross-sell motion with the SaaS model. And even on the on-prem subscription packages because with our core pass subscription packages today, it includes already some MFA and SSO SaaS functionality. So they're already getting kind of primed to where CyberArk is going with its other products, and they're already able to say, "Well, I'm already using MFA or SSO from my privilege users, now I can look to the full workforce or tie that into Endpoint Privilege Manager." So we like -- we do think that it's helpful. Overall, though, we still see kind of a 6- to 9-month sales cycle, but the sales cycle is probably more efficient. So we're not -- we're negotiating more around the project than around how do they become most functional and productive with the software as opposed to, okay, on a perpetual basis, what will be my peak? Do I buy a lot more today or maybe what's going to happen down the road? They could really focus on what their needs are today and know that it's really easy to upsell down the road. I guess one of the other things I'd point out is our transition has been very SaaS heavy. So for every kind of over $3 of subscription business, $2 of it is SaaS and $1 is kind of on-prem, is term-based license. And it allows us also to compete well in mid-market and down market because those are entities that are really looking for more SaaS solutions than on-prem. And compared to a couple years ago, we have a much more rich environment there, a much more rich offering to be able to track kind of the mid and down market. So overall, we really like what we're seeing on this transition. It's making it easier for the sales guys to sell. And it's because of the sales guys, and it's also because the customers like what we're offering them.

Yes. Absolutely. That was very helpful. Got it. And maybe that's a good segue just to mix, right? I mean, it feels like or it has, the subscription mix is progressing to your 85% goal faster than you expected. I think you said that on the last call. Can you just talk about that a little bit more, Josh? I mean, is this mostly because of new customers are adopting SaaS faster than you expected or existing customers sort of converting? You already touched on my -- part of my question was going to be the mix of SaaS versus term subscription, you hit that in the last question. So I'd just love to kind of hear what you feel like is driving that mix faster kind of new versus existing?

Yes. I think, first of all, for sure, the new is definitely driving the transition well because -- and we talked about in the third -- in the Q3 earnings call where 85% of our new logos bought on SaaS and subscription. So that's already the overwhelming majority. And if we look at our pipeline going forward for new business as well, it's very, very high percentage is being quoted SaaS and subscription, which is the intent. It's the program. It's the playbook. And it's working well. I think if we look at the upsells, we like the -- it's been working well for us. In fact, if we look at the incremental ARR growth, on a year-on-year basis, 70% is coming from upsell. So that means existing customers, most of them probably were on a perpetual basis model are now buying either more of the same licenses in subscription or maybe some -- in a handful of cases, they've actually moved from on-prem to Privilege Cloud and to SaaS offering or we cross-sell them into Endpoint Privilege Manager, which is all SaaS or Idaptive which on the access front. So again, we're seeing 70% of that ARR growth is coming from existing customers. We're seeing the majority -- overwhelming majority of new customers, so it's really coming from both. And Erica alluded to it before on Privilege Cloud, on our success there. And I think that, that has been something that we weren't sure. We knew it was going to be successful at the mid and down market, but the fact that it's also been successful at mid and upper market and some bigger deals happening there, even some Fortune 1000 companies already, including us in their digital transformation, to go from on-premise PAM to Cloud PAM has really helped that mix.

Maybe since you brought up ARR, maybe we'll shift to ARR because it's been, first of all, I mean, just a very helpful metric through the transition, right? I mean, I think we've put out the target of about $1 billion in ARR in 2025. And correct me if I'm wrong, but I think that's about a 30% CAGR. One of the questions that I've gotten from investors in the past has been, Saket, that's a little bit faster than what -- maybe what people think identity is growing, maybe what people think privilege is growing and so maybe a question for both of you is, what's embedded in that target? Is there a way that you sort of think about that target from a PAM perspective, a new product perspective or a new versus existing, really open ended, how do you get comfortable with sort of that 30% CAGR with [Technical Difficulty] margin portfolio.

[Technical Difficulty] and I'll actually let Erica jump on that.

Yes. So I think [Technical Difficulty] we'll get to the $1 billion at a 40% compounded annual growth rate over that time horizon. And I think if you kind of unpack where it's coming from, I think we feel really great about the dynamics happening within Privileged Access and Identity Security broadly, right? Like the proliferation of Privilege across the enterprise is really helping to increase we think the demand environment. And you're seeing it in our results this year, right? We're delivering 37%. That's the guidance we set for the full year for ARR. And that was an increase from the 35% we were kind of talking about earlier in the year or even 30% at the beginning of the year. So we really have seen an acceleration of the business. And so we feel like that, that gives us some sustainability of growth. We also have the really strong pipeline that we're seeing as we move into 2022, which is also supportive. And then we've done a ground-up analysis of kind of the opportunity at the customer level in terms of new opportunity of customers that we could further penetrate as well as our existing opportunity within our installed base. And so all of those factors combined give us confidence in our ability to hit those targets based on the portfolio we have of solutions today.

Got it. Got it. That's very helpful. And good to hear about a strong pipeline going into next year as well. Josh, maybe for you, kind of related to that, right? Of course, one part of ARR is maintenance. And that is expectedly not going to be growing nearly as fast as subscription. I guess the question is, how do you sort of see that maintenance ARR base kind of going forward? You're not going to have to disclose it every quarter, which we really appreciate, by the way, right, so we can sort of track how it's going. But these -- do these maintenance customers sort of stay as they are? Or do you think there will come a point where they can explore or maybe they can be offered a chance to explore converting to SaaS?

Yes. So first of all, Saket, let's -- I want to say, we actually really like the maintenance base. It's a visible number. It's recurring revenue. And as we continue to innovate and bring out more functionality and move to the cloud and it continues, we expect Privileged Cloud to be a great alternative. But in the meantime, that maintenance is an excellent source of recurring revenue. But I do think that what's going to happen is you're going to see -- of course, you're going to see some of those customers wanting to do a tech upgrade with -- and stay on-prem but they want to do a tech upgrade and adopt the new subscription packages we have and also go backwards on their deployment phase. So they're going to move from what they've deployed to now the new subscription packages, which include some of the things I had talked about earlier. And really, it's essentially an upsell to them and a -- and it will basically move -- some of those will move from maintenance then to subscription license. Others, over time as they're part of their digital transformation journey to only using SaaS and to cloud, they'll start to want to migrate to Privilege Cloud. And so we'll see some maintenance runoff there. And then, of course, as we are not selling any more perpetual business or selling a very small amount to kind of the tail customers, at some point, probably the churn off that maintenance, the natural churn that we experience anyway will be greater than the add-on of maintenance. So if you think about our ARR, you're going to see kind of a flat to down trend on the maintenance side and then you're going to see the hyper growth on the subscription and the SaaS side, which will bring it up. And over time, there'll be a long tail of maintenance, so it's not going to go away for a long time. But it's going to -- it will definitely start to flatten and even go down as we get into kind of 1, 2, 3 years into the future.

Got it. Got it. That's very helpful. Maybe in the time that we've got left, I'd love to shift to the rest of the income statement, maybe just hitting on margins a little bit. I think one of the things that we saw in 2021, which was surprising, but also great to see was an acceleration of the investment year because of the opportunity. Again, going back to that bookings comment that we started with earlier. I guess, Josh, the question for you – and you may or may not be able to answer this, but I guess the question is, have we hit the bottom yet in terms of the margins in this transition? I know we haven't talked about revenue and sort of how that lags here, right? But I'm kind of curious how you think about the margin profile from here?

So I mean, what I can talk about because it really goes hand-in-hand with the mechanics of the transition, right, is the way these transitions work is that you really kind of hit the bottom when you fully -- when you're fully on the other side of being a fully recurring revenue model. So -- and that we've targeted right now for Q3 of 2022 when 85% of our new bookings for licenses will be SaaS or subscription. And really only after that point, will we -- and that's kind of where you start to -- that's where you bottom out on the margin side. And then after that point, you can see margins gradually improve. But if we think about CyberArk's kind of overall approach to investment and profitability, first and foremost, I mean, again, you've been following us a long time, Saket, it really hasn't changed. Profitability is a core tenet of CyberArk. And basically, we've always chosen to really invest equal to the demand environment. And when we think about the demand environment, it's not just where we see it coming up in the next 6 to 12 months. But we actually really have to take a hardcore view on where we see the demand environment for the next 24 months because our sales cycles are 6 to 9 months, our ramp-up rate for go-to-market teams is 6 to 9 months, our developers ramp-up time is also several quarters. So we really want to think about not only are we ramped up for the current and next 12 months, but then when we leave that 12-month period, if we're thinking about a 2-year growth horizon that we're prepared to be able to hit it in the second year. So when we think about 2022, what I'll say today is it's really important that we continue to invest to keep up with the record of pipeline we're seeing. We're not really guiding, but our gross margin will have some pressure on it because the more business we do in SaaS, there's some lower gross margins there in the SaaS -- against the SaaS revenue. But given that we expect to be a 20-plus percent grower in the out years, we still are going to invest in the business on the go-to-market side, on the technology side and on the G&A side. Of course, you're probably hearing from a lot of your other companies. There are some interesting dynamics with the tight labor market as it impacts employees and salaries. And of course, we have the Israeli shekel you're talking to -- when you're thinking about us being -- having a big piece of our R&D in Israel. But I'll kind of end on this topic is that we're really excited about is because of the faster underlying growth rates now, you will see revenue be able to snap back when profitability lags because we haven't changed our methodology or approach to becoming a profitable company. And so we're really still confident that when we get through the transition, the business will be back to a more balanced Rule of 40 as you look further out several years ahead, and we know how to get back there and do that.

Got it. Got it. In the time that we've got left, maybe we could just talk a little bit about capital allocation. Obviously, CyberArk generating cash historically and also opportunistically strengthening the balance sheet last year, you were able to put a little bit of that to work with some tuck-in M&A. Josh, maybe the question for you is how do you think about sort of use of capital or uses of capital from here and the pipeline of potential M&A opportunities?

Yes. We have an active M&A program. I mean, since I think we bought 6 companies in the last 6, 7 years. We're always looking. It's been a difficult market in the last 12 months given the craziness going on in the capital market space. But we definitely are looking. We have -- we try to acquire companies that meet a real market -- a real emerging market need for CyberArk. And also, we try to focus on the return. And I think we've been very successful with our Endpoint -- with our acquisition that brought us Endpoint Privilege Manager, with our acquisition that brought us DevSecOps. We're still in the first 1.5 years of our movement to Access with Idaptive, but I think we're in a good place there and are looking forward to good growth there as we look into next year. But we want to make sure that we are focused, right? And that we don't get distracted from the really strong PAM opportunity and a broader identity security opportunity. I think if we think about where we would see acquisition targets, it's going to be deeper into some of our adjacencies, whether it's cloud security, access or the DevOps -- DevSecOps environment.

Got it. Got it. That makes a lot of sense. Well, guys, I've got a ton more questions, but of course, limited time, so maybe we'll end it there. Josh, Erica, it's always a pleasure having you at the conference, and really look forward to when we can do this in-person again next year.

Absolutely. Likewise.

Thanks, Saket.

Excellent. All right, folks. So enjoy the rest of your day. Thank you again.