CyberArk Software Ltd. (CYBR) Earnings Call Transcript & Summary

Good morning. Thanks very much for staying for the third day. It's always a lighter attendance and we keep the best companies for the third day, so we can have -- we can attract companies, attract investors. I'm very pleased to host CyberArk. We put so much attention in this conference on identity because it's such a big space, and it has so many aspects in so many areas, we're going to discuss right after that, I'm hosting a panel to speak about consumer identity and to speak about what's new in identity from like what -- where else could this market go, et cetera. It's part of Zero Trust and et cetera. And also CyberArk, you're here in the panel companies who have more limited scope and CyberArk is growing, right, to other areas. So that's what I'm trying to accomplish today. So do we need to start with anything like a safe harbor or something? No, we're good. Okay. So thank you very much for coming. Thanks very much for joining me.

I want to start with a strategic question. Josh and Erica, I want to start with a question of what's the reason that identity is becoming such a big space in a sense that it's becoming the center of the network, center of the network perimeter. It's so important for companies today. And if you can talk about the way you see how it evolves going forward? And that's going to actually take us to your strategy. What are the new areas you're going after? How is your -- what are your expansion plans, et cetera? And how do you see the company kind of 5 years from now, what new areas you're going to address?

Yes. And I'll try to unpack a very big question. But thanks, Tal, for having us here, and it's great to be live again at these conferences and always in San Francisco, Bank of America. So when we think about identity, first of all, identity security where CyberArk plays as we think is such a pivotal piece of the cybersecurity strategy because -- and not to overly use the buzzword of Zero Trust, but the environment today is you have to have Zero Trust in who is doing what, when and where and on what product. And what I mean by that is that you always -- you can't assume that it's -- that the credential of -- that's being used to do a certain piece of the network or moving around in the network is real. It's still the same person that actually was authenticated when they were first authenticated. So it's really the foundation of a Zero Trust cyber strategy. And if you think about looking at all the actual attacks that have happened, being breached in the network is happening all the time. Going from that breach point to an actual network takeover or the ultimate damage of stealing personal identifiable information or IP or bringing the network down and ransomware is -- 90-plus percent chance is because of credential theft and not properly managing the identities and the wrong people doing the wrong thing. So it's basically -- when we think about identity, it's going to be the key part of really locking down your network to go from avoiding a breach turning into a network takeover.

So maybe I'll try to break it down, how much juice do you think is left in the PAM market in your legacy or key addressable markets?

Yes. So PAM is, in the legacy side, there's even still there that's greenfield, but PAM is really looking forward as well because more credentials are becoming privilege within the network, whether -- and they could be human and they could be nonhuman as well. It could be machine identities and application credentials and secrets and DevOps and so forth. So if we think about our installed base of 7,500 enterprises, we're well less than 50% deployed within that installed base, and that's only 7,500 enterprises, and we're the leaders in this space. So there's still -- we -- you might -- I mean we pinch ourselves to still find thousands of mid-sized enterprises, even some large-sized enterprises and certainly what we call the commercial market being greenfield in privilege today. So I think the digital transformation has created a wave of really freshness in looking at privilege in a new light. And now that also you can consume and enterprises are willing to consume putting their keys in the kingdom in a third-party hosted environment, it's actually now refreshed because you're now seeing enterprises actually starting to want to consume PAM as a service.

So your ARR grew 48% last quarter, and you're talking about the growth within customers and growth of the market. Can you break down the 48% to us, not even numbers. So even just call it qualitative, how much of it is growth within customers? How much of it is growth with new customers, new products? Just give us more visibility into this growth.

Yes, sure. So I'll start. I think if you look at the growth of the overall ARR at 30%, you see -- or at 48%, you're seeing roughly 30% of that growth coming from new customer additions, right? So if you think about the last couple of quarters, we've had a great acceleration in new customer adds, and it's actually been at record levels. And so that's running at about 30% of the net new ARR. And about 70% of it is coming from a combination of both cross-sell and upsell. And to Josh's point around PAM, PAM has seen a great acceleration across the board. And so you are seeing a lot of that upsell for additional users within the installed base of PAM customers. And the cross-sell motion is getting much stronger. The move to SaaS really made a big difference to be able to help us extend and expand our relationship with those customers and move them into more of our SaaS products.

Got it. We'll touch on the SaaS migration in a second. I want to still understand kind of the scope and the growth. You also started looking at other markets. Can you take us through kind of what is the company or what's the company targeting now for the next few years beyond the cross-sell and upsell that you've just discussed and new customers within PAM?

So I think I'll start here, and it's really the big thing that we've gotten into, which we -- if we -- when we sat here 3 years ago, we're not able to talk about was our entree into the workforce. And being able to sell identity security to the entire workforce within an enterprise. Obviously, it covers kind of the basics of single sign-on and multifactor and the things that are the kind of the check the boxes on what an organization needs to have, but with a modern-day cloud architecture, but also going out to that workforce and bringing a security-first approach to managing those identities. And what I mean by that is that CyberArk views that privilege is really everywhere in the IT network and every credential becomes more privileged or less privileged during the course of the day. So it's not just about IT administrators who are privileged all the time. But even the Director of HR who might be accessing Success Factors or some other HR application, and they're adding new employees, they're adding new users. They're the factor, the administrator, even though they're not an IT person of that, they have become privileged during that moment. It might be the same with a Director of Marketing, who was accessing their Twitter account or obviously, financial people who are accessing their banks. And so what we've done around the identity for the workforce is layer on capabilities to add extra security while they're doing more privilege-defined events that every enterprise will define for themselves. And that extra security comes really in the form of similar things that we would do for an IT administrator, but in a light version, so it doesn't affect at all, the workforce doesn't feel it. It would include monitoring key stopes. What is that person doing while they're using that sensitive application, protect session protection ensuring that, that session is being used within the right policy framework, if not turned off. And those are the types of things that we're thinking about when we go into the identity side for the entire workforce.

Within European market, are there any new modules that you're going to address and grow? Or is it more about penetration and more about workforce security, identity security?

Yes. I mean we're constantly innovating. So if we think about on the PAM specifically, it's about dynamic access. So when enterprises are spinning up servers for temporary periods and you want to give access -- privilege access to administer those servers, but it's -- so it's dynamic, it's a femoral. And cloud councils, act proper and secure management of cloud councils is also going forward. If we think about cloud entitlement, it's something that we released only in the last year, understanding what entitlements do administrators and privileged users have within their credentials in their cloud operations.

So if I focus on the -- if I just -- I want to talk about a little bit on your entry into the workforce. The workforce identity market is a little bit of a commodity market in the sense that authentication, what Ping and Okta is doing is becoming more, especially with Microsoft announcement of bringing your own identities, it's becoming a little bit more commodity and now the market seems to be migrating to more verification and authorization of what you do with the identity. Where do you want to -- what do you want to focus on? Where do you want to go with it and make sure that you don't go into the commodity parts of it?

So I think one of the great areas that we've been able to leverage is that foundation in PAM. So coming from a privileged perspective, let us add really great differentiation on top of MFA, single sign-on. Things like Josh -- some of the things Josh mentioned with the session protection and being able to record the sessions, there was a (sic) [ were ] seamless experiences for the user. The user doesn't know that we are or the company is actually looking at what you're doing. But those are so critical if you weren't -- if you are your HR person. I think you have that information -- that social security numbers. You want to know what's happening within that session, and we're able to do that seamlessly. And also the integration of one of the areas that we've been really excited about is our Endpoint Privilege Manager solution, which is beautiful because it sits alongside of any of the EDR, the traditional vendors like CrowdStrike, it's a partnership opportunity, but we looked at it from a PAM perspective, and we're able to integrate some of that intelligence that comes out of our Endpoint Solution, work the single sign-on to make a really rich and robust offering for our customers that offers more of that protection that they really need. And so we think that really differentiates us. And that's the foundation of really our approach to identity security is leveraging our expertise from PAM and extending that into single sign-on and MFA.

And I would just add, what she said at the end, the differentiation because in that market, especially around identity for the workforce, that's what we're excited about is that we're able to differentiate our solutions versus what is out there today, kind of.

Another aspect is international, another aspect is mid-market growth. Can you talk about the verticals? What are you going -- not -- we spoke about the products. I want to talk about what markets are you going after, et cetera?

Yes. So the good news at CyberArk and you've been following us since day 1 almost and we're diversified across all the geographies. We do about 60% in the Americas, 30% roughly in EMEA and the balance in Asia Pacific, Japan and it's not new. We've -- like for 10 -- for 15 years, we've been selling almost in those same proportions. And no matter the geography we sell into, we're selling across all verticals. And actually, we got asked a lot this week about -- like, are there -- are you moving into new verticals? Or are you vertical-specific? And at CyberArk, we're realizing that every enterprise across all verticals, obviously, the highly regulated and the financials require it. But today, every vertical is a storefront. Every vertical has a personal identifiable information, which is subject to privacy laws and the like. And have -- and a lot of them act as a bank and so forth. So we have 8 verticals that are at least 5% of the pie. So I think financials is just over 20%. But then after that, we have another 7 verticals that range between 5% and 12% of the pie. And if we think about the market segmentation, CyberArk was founded really on the premises. How do we get software out there that really scales across the largest organizations in the world. And if you look at all those 8 verticals that I just talked about that are over 5% of the pie, we're in 15 to 18 of the top 20 of the enterprises in those verticals. What's been fun for us, particularly in the last 12 and 18 months, particularly, and I think COVID had a part to do with it. Our entree of a lot new SaaS products had a lot to do with it. Our kind of vision around identity, security had a lot to do with it, but we've also successfully really started to move down market. And when we think about down market, we think about commercial enterprise, what we call commercial enterprise. And we define that by about $500 million revenue to $1 billion, it could even creep up to over $1 billion of revenue. So we're not talking about small, medium business. We're talking about small enterprise. And we even saw -- I think we had a record quarter of new logos in the first quarter of 250, which was the largest amount of new logos we had outside of a Q4 ever. And we saw a nice portion of those coming from that commercial segment.

The other area that's really adding to that commercial segment is that we can land now with more products, right? We're not just landing with PAM. It's a key change in the way we've approached the market is that we're -- as Josh mentioned, we're expanding with SaaS, which is opening up a whole new segment but we're also able to land with Endpoint Privilege Manager and workforce identity. So we have more landing spots that we can expand from. And that's just been great for us.

What -- how did you need to -- what changes did you need to make to the channels in order to address -- to go downstream?

Yes. So channels has been a really important investment for us. So we've been really excited about the approach that we've taken. We globalized the channel a couple of years ago where we went and we put it under 1 global head. And then we've been making new investments in channel enablement as well as reaching into new channels like CDW. We've also put a lot of investment into AWS in the marketplace there, and we've seen wonderful traction there, where you're able to leverage or a customer is able to leverage their AWS credits and apply it to CyberArk, which has really created a frictionless experience for the customer and the sales force. And that's helped open up some of that mid-market for us and we're making more investments. So there's more to come there, and we really think that can extend the reach.

I think another area that we're getting more and more excited about is MSSPs, being a real channel for us getting also to those new market segments and verticals.

Got it. We spoke a lot about your migration to SaaS and can you take us -- there are some people here who don't know the company. So going to start with the basics. Can you take us through historical perspective, how did your business model change over the few -- the last few years? And then we'll go over kind of the current state.

Yes. So I mean, CyberArk has been a leader in the space of PAM for a long time. We were historically a perpetual software company with a maintenance stream of about 20% of the perpetual license really until I think even 2 -- or even 2 years ago, I think we -- of our license, it was less than 10% were subscription or SaaS licenses. During COVID, in 2020, we saw really, I mean, an upturn in a lot of things related to cyber, but also a lot of enterprises looking for more and more for SaaS and looking more and more for subscription-type arrangements. And on our own, we were already developing organically and bringing to market more SaaS solutions. And we had also acquired Idaptive, which was our entree into the workforce in the beginning of 2020. At the end of -- in the beginning of 2021, we actually made a declaration out to the Street that we were going to transform the financial model of the company and the whole -- and the operations of the company to go from a perpetual selling license company to a fully SaaS and on-premise or self-hosted, subscription-based company. And we set out our goal at that time to say that we would hit 85% or more. That was the threshold that we put out to kind of say we're through kind of the selling motion of becoming a recurring revenue company, by -- at that time in February of 2021, we said it could take 8 to 10 quarters because we did a lot of homework and research on how other large enterprises and medium enterprises did that transition and that was an expectation we set. Every quarter or every 2 quarters, we saw that we were actually succeeding a lot faster than our playbook. And I think it had to do with a couple of things. One is, as Erica mentioned before, we've really had a big boom on our Privilege Cloud. And I think it comes from the commercial market as well as even larger enterprises finally getting comfortable of putting their privileged keys in a hosted environment. Endpoint Privilege Manager, which has been always kind of our only SaaS product, prior has been taking off. And we did a lot of things internally within the organization, within CyberArk to proactively be successful in this transition. And the things that we weren't sure how effective we were going to be because you never know, you have a plan, but you don't know if it's going to work, really worked well and worked even better than our expectations. And coupled with beating out our own booking expectations, which -- and it all came from SaaS. It allowed us to really transform the company to -- in 5 quarters, which I think is certainly one of the better numbers, if not the best, kind of transition that I've seen out there to hit a number of over 85% of our bookings in that quarter were from SaaS or self-hosted subscription products and heavy on the SaaS. So if we think about the mix, it was 2/3 SaaS dollars, and we're seeing that now quarter in, quarter out and 1/3 self-hosted, which obviously down the road is even going to create a much healthier model for us as we look forward.

That's in terms of bookings. When does it -- so the impact on revenues is that perpetual licensing is going down, SaaS and recurring revenues going up, when do we stop having the negative impact of subscription potential?

Of the headwind. So yes, over the last 5 quarters, as we report out to the Street, we've been talking about, we call it headwind of -- the fact that we're doing ratable revenue now from the SaaS or from the SaaS and the subscription contracts versus getting the entire perpetual piece recognized upfront. So we did that in order so that if you kind of look through the transition, you're actually seeing that our growth -- the growth -- the underlying growth of the business is actually similar to how it was before the transition. And even the operating margins, while they took -- they had some reduction compared to prior to the transition, they were still -- we were still running at a Rule-of-40 company in 2021, if you look through the transition. Now that we're here, and if we think about moving forward, the revenue has already started to grow in growth rate. Last year, we had seen mid-single-digit growth rate on the revenue. That was -- this year, we're guiding towards mid-teens or 12%, 13% growth rate on the revenue. And what was -- and next year, it will grow faster, we believe, and even into -- we're going to see incremental growth rates going for the next couple of years on the revenue side. And on the OpEx side or on the operating margin side, we anticipated that there'll be a delay as we run through kind of the trough of this quarter and the next quarter and start to see improvement going into Q4, we're going to -- we expect 2023 to be a better operating margin company than 2022, and then it will start to go back even faster in 2024 and to kind of a pretty balanced Rule-of-40 in 2025 on the growth and on the operating margin, something pretty similar to what we saw prior to the transition. And the reason why it takes that time, I mean you understand the mechanics where there's -- we pushed in the transition to 5 quarters, which really created a much steeper line down to the trough. We'll have -- we ricocheted faster back certainly on the revenue line. But until we actually have a full kind of cycle of the underlying revenue coming from these renewable license contracts or SaaS contracts versus kind of the smaller maintenance contracts, we won't get -- we won't really be able to benefit from the full operating margin bang and as well -- cash flow as well. We expect cash flow will return as well into 2024 and 2025 above -- similar to how we were before the transition.

Right. So your operating margin went down -- I'm trying to find the number in my note, 10.3% to minus 9%, a big swing between 4Q and 1Q. Is it the trough? Or could it go down further and only then recover?

I think we -- do you want to take that?

Yes. So you're going to see it kind of [indiscernible] slightly go down and then come back up, but it's not going to -- you're not -- there's not going to be a big delta from where we are today on that negative 9%. Two quarters after the transition, you're going to start to see it improve, which would be the fourth quarter. So we've got the guidance that's out there for Q2 already and then you'll start to see it flat line and then improve in the fourth quarter. And then just to add, the real compare where it gets the mix, right, doesn't even begin to kind of work itself out until next year in Q1. We're still going to see headwind to revenue from a mix percentage that's going to impact the results all this year. But once you get into Q1 of next year, when we're closer to that 85% compare like where we are at now from a mix perspective, we'll work through that headwind a bit more.

We heard Uber today and they talked about foreign exchange. What's the impact of foreign exchange on CyberArk?

So I mean we have obviously -- we have a big R&D facility out in Israel. So we did -- we saw bigger OpEx in Israel on the shekel for 2022, if we think -- and we're -- if we think about it in Europe, the -- there was -- there's some small impact on the ARR basis for the euro and sterling, but it's within a couple of percentage points. So right now, we're -- there's not a big impact. It's all in the guidance. So our guidance already assumes whatever -- how the currencies have moved least recently. Doesn't assume what it might do tomorrow, but where it's moved too recently.

Another thing I noticed in your numbers is that the proportion of larger deals is going up. I think that deals with ACV over $100,000 grew 50%. What's driving it? And what can you tell us about the characteristics of these deals?

Yes. So we're really excited to see the larger deals, right, because it really demonstrates the benefits of our subscription transition. And it's the fact that we're seeing 2 great dynamics. We're seeing customers land actually with a bigger footprint because they're taking more of the product portfolio. And so those landing deals are getting bigger. But we're also adding on more and more customers that are adding on the broader portfolio. And so they're adding more users and they're broadening their penetration of the existing product base. And so -- and we're just -- we feel like we're just getting started, right? Like things like Endpoint Privilege Manager and identity, Workforce Identity are just really getting started. So that expansion opportunity, we think, is pretty strong.

Got it. I want to speak a little bit about products. But before that, I want to stay kind of at a high level and talk about competition. I'm hosting a panel right after you to discuss about this space. And I still see start-ups in your space. Do you see new innovation disruption that could come and threaten CyberArk? What do you think about competition? How do you -- actually, how do you define your competition?

Yes. So I mean, starting at the top, I mean, how we define competition. We obviously have some direct head-to-head competitors on the PAM front that are focused really on just Privileged Access Management and there's some private -- and they're private, all private equity based and owned. If we were sitting here 4 or 5 years ago, there were some public companies like CA and Quest and Dell EMC and the likes. But today, the PAM competitors are private equity owned, and we see them -- if we think about as we're moving out to the identity for the workforce, clearly, there are other players focused on identity and we're familiar with the Pings and the Oktas and the like. And when we think about the secrets manager credential -- application credentials and secrets management credential, secrets management DevSecOps, then obviously, we would see HashiCorp specifically in that area. So I mean, that's kind of the -- those are the main people that we'll see. And if we think about the start-up, the start-up world, obviously, we, by ourselves, by the way, have picked up a few of those [indiscernible] ones over the last several -- over the last 6, 7 years. And in fact, one of the things that we just announced recently is investing in some of these, not necessarily that are directly in our space, but staying in tune to startups that are in identity and maybe are things that are interesting for us to be partners or to see and to be aware of what's going on and just continue to help broaden out the entire technology base there. So we're very much in tune to what's going on. And so in terms of actually the next-generation stuff or we're actually innovating a lot ourselves. And we're excited. We actually have a whole lab. And if you come to Israel, would love for you to see it, but we have a whole...

[indiscernible].

And I can't even -- actually, I can't even get into it. It's locked under key and so secure. But basically, all they're doing all day long is thinking about where the next vulnerabilities are coming from and it's got signs around that says think like an attacker and the like. So we actually feel that we're in the strongest positive competitive environment for us that we've been in a long time because the other more mature players, we clearly have taken a leadership position on the PAM. And we're -- and if we think about the other ones, we're really the only vendor out there today who can do the entire spectrum of identity from the workforce to the privilege for human and for nonhuman end users for credentials that are dynamic and static, self-hosted in the cloud, private, multi-cloud and hybrid environment. So we like the competitive environment.

But we did hear, for example, Ping. I cover Ping, we did hear them -- they're talking about being a platform for identity going up to the privilege market. Do you think that the market it's -- how difficult do you think it is for a workforce identity company to actually go up and compete on the privilege side?

I think it's very difficult. And we've been doing it for 20 years and have spent a lot of money doing it for 20 years. And there's -- so there's 2 things that have come out of that 20 years, right? A lot of development and innovation, which has to be replicated by somebody else trying to get into that market. But also 20 years of experience in the field of working with every piece of IT infrastructure because when you think about the privilege side specifically, it's not just interfacing, it's not the people, that's the problem, it's the fact that, that person now has -- you are managing and securing the credentials across the entire IT network, which means interfacing with firewalls and telephones and databases in Microsoft and Munix and mainframes even for the larger enterprises and UNIX and IoT and every single device within a network that has CPU. And you get there by experience. And it's not just that you -- it's not just experience now that it works with it, but you have to now integrate with all the other hundreds or thousands of software applications out there that are all needing to interact there. So it's -- we like new competition because it's just another signature or another step that, yes, we're in a big marketplace. So we're okay with that. But it's -- it would be -- it's a tough one.

So what are the challenges that you see in running growth? What do you focus on in running the growth and making sure that you sustain the growth?

Yes. I think, obviously, we have the scaling of the organization. We need to hire. We need to onboard. We need to onboard quickly and efficiently. And as we innovate and bring -- today, the excitement around CyberArk is, well, we actually have to sell in a different way because we're selling recurring revenue now. We're selling a lot more SaaS. And we need to think about operating the company as a fully recurring revenue company, which means customer success in a completely different shape and form than customer success in a perpetual company because the renewals and the retention of customers and adding to those. So to basically have those customers adopt quickly, renew and expand becomes the lifeboat of a successful and a high-growth recurring revenue company. That's not the same lifeboat that you have in a perpetual company where you're going out there and finding a lot of new licenses to bring to the table so from anywhere -- so I think that's the area of growth that we're spending a lot of time and focused on within the organization.

Do you think your business is sensitive to economic cycle?

I think cyber, in general, is more resilient, and you probably have heard this all week. It's definitely more resilient because hackers aren't going away because there's an economic recession. And I've actually -- some investors and some analysts are saying actually the opposite. I mean you see them become more aggressive because people are down, bad actors go after them. And if defenses are down, they're going to go after them twice as much. So I think you can't -- we're not immune to fall-off-the-cliff macro environment. People stop buying, we stop selling. But we believe that cybersecurity is going to be a lot more resilient and particularly identity security because it's a fundamental piece of what we said in the very first question, like if you think about cybersecurity strategy, this is kind of out there as, okay, you need to have this. There's a lot of other things you need to have, but everybody knows you need to be able to ensure that you're not going to have a network takeover by in properly managing key credentials, whether they're -- of your privileged workforce or your applications.

Great. Any questions from the audience? No. Thanks, Josh. Thanks, Erica.

Tal, it's our pleasure. Always.

Thank you, Tal.

Excellent. Thank you.