CyberArk Software Ltd. (CYBR) Earnings Call Transcript & Summary

All right. I think we're good to go. I'm Roger Boyd, I cover cybersecurity here at UBS, and we're happy to have CyberArk here, Matt Cohen, its Chief Operating Officer. So Matt, thanks for being here.

Great. Great. Great. Thanks for having me.

So maybe just to start things off, maybe a recap of the third quarter. I think everybody has seen the macro impacts creep in the security space. And I don't want to call CyberArk immune, but it feels like the reaction has been maybe a little less pronounced and 49% ARR growth on harder comps was a clear highlight. But just in your perspective, what were the key points takeaways for the third quarter, how are you continuing to continue to grow at such a rapid pace?

Yes, sure, sure. And no, I don't think anyone is immune. And I think we walk into the customers all the time, and we're talking with them about their struggles trying to navigate this macro environment. So it's a part of every conversation that we have with our customers regardless. What we've seen is that traditionally, Cyber has always been above the fray a little bit on budget, maybe not so much lately, but certain Cyber is still above the fray. And when we think about what we do at CyberArk, which is really this identity management space or identity security space, it's about implementing primary Cyber controls. And controls really are about making sure that if somebody gets in or when somebody gets in, you can actually block them from getting to the most critical assets, the most critical data, the most critical infrastructure. And for our customers, that continues to be top of mind. Now with the attacker innovation that's going on out there, the ability to be able to really secure identities, not just manage identities is board level thinking for them. We saw it in Q3, and we saw, again, a continued acceleration on our overall business and our ARR growth. And we continue to see that looking forward into next year as we think about, again, the place we play within the cybersecurity landscape.

Got it. And just in terms of like actual macro effects, I think Udi and Josh, and yourself have talked about longer sales cycles, back-end weighted deals. Is that kind of how you track things throughout through the third quarter? How are you thinking about fourth quarter? And just any assumptions you've made that's kind of layered into Josh guidance?

Yes, sure. The Josh guidance is always a good term. I think when we think about it -- again, we've said that like we see additional scrutiny. We see additional approvers show up. Sometimes it's a shock. We've been doing business with the company for 10 years and all of a sudden something going to the CFO that wasn't going to them before. But those are things that can be anticipated with good execution. You can get ahead of it. You can understand who are the approvers, you can understand what is the new process, and you can still go out there and execute. And I think when we look back at Q3, what we've seen so far in Q4, is that those things don't need to stop a deal from coming through. And again, as long as there is a good compelling event, which is these products or these solutions need to be implemented and they need to be implemented in order to put in place these controls, we can overcome any of those obstacles and still deliver an overall good quarter and ultimately deliver a good guide.

Yes. So just -- I want to talk about PAM before jumping to the broader platform, but I think you're on pace at add another 1,000 customers this year. Clearly, it feels like the market for Privileged Access Management is expanding. There's some clear drivers there. You've talked about Zero Trust, the fact that Cyber insurance is a good driver. Can you just talk about how this has played out over the last year and how you're thinking about those tailwinds extending? Like how far penetrated are we in the PAM market?

I think the thing that people are waking up to within the PAM market as a core before we get into identity security as a whole, is that the notion of what a privileged user is has changed and altered dramatically over the last several years. And so where it used to be, it was a very specific user within IT that was considered the privileged user or the domain accounts, the domain admins, those type of users. We're now seeing that any user can be a privileged user at a moment in time. Developers are increasingly privileged users with the access they're given throughout the DevOps pipeline and 2 applications. We see business users actually, as they access SaaS solutions becoming privileged users. Obviously, outside of the PAM, we see nonhuman identity start to proliferate as well. All of that then increases the ability to actually be able to upsell within our existing accounts more and more PAM seats, which is driving a component of our overall growth. And then the greenfield opportunity of going out and finding companies both in the enterprise and especially down into the corporate or commercial space that don't have a PAM footprint at all continues to be a pretty strong tailwind behind the overall PAM growth for the company. And frankly, it's even surprised us in terms of how strong it continues to be even as we try to go into these other areas.

Yes. Makes sense. And then within PAM, I feel like for the longest time, it was considered an off-prem technology, it's maybe been slower to move to the cloud. And a few years ago, it felt like there was this narrative that CyberArk maybe wasn't moving into the cloud as fast as they could have. And I think now that's faded away in terms of feature parity between Privilege Cloud and the on-premise product is fairly comparable and you've seen very strong adoption of Privilege Cloud. So I guess the question is, one, where do you think the SaaS PAM adoption is? And just having that -- to what extent is adding Privilege Cloud helps you get into more deals, expand that narrative even further?

Yes. So I think that -- I think we even underestimated the appetite for SaaS delivered or cloud-delivered PAM when we first came out with it. We're far past the 1,000 customers on our Privilege Cloud solution, which is an important and strong milestone for us. We've seen it adopted not just down market, but in some of the biggest enterprise Fortune 500 companies who have moved to the cloud. And I think what we see is, yes, it's differentiated now. It actually has more capabilities than the on-prem offering. Plus, it's integrated into our overall identity security platform, which allows us to partake of some of the shared services so customers can see that they can use Privilege Cloud and then integrate in a common UI and a common platform with our other solutions. So it's a good road map or a good on-ramp, if you will, for them as they move forward. And I think that, that adoption is just going to continue to accelerate into next year and beyond. There's a few industries that still are a little hesitant, for example, the big financial institutions. But outside of that, most customers we talk to have a plan for how they're going to move to the SaaS delivered Privilege Cloud.

Very clear. On the transition, investors have seen a lot of these, and I think CyberArk stands out as being one of the more successful ones moving from primarily perpetual sales to predominantly SaaS and as you even pointed out, a SaaS heavy mix of subscription. Having had the experience of going through these transitions to other companies, can you just talk about what you think CyberArk has done that's done really well?

First of all, thanks, and it's been something we're really proud of getting through the selling transition in 5 quarters. Originally put out an 8- to 10-quarter goal, we got through it in Q1 of this year in a 5-quarter performance. And the way we were able to do it, and part of it was the learnings, to be honest, of having done this before at a prior company was to put in place just really strong rigor and program management. So we took the entire company, and we formed a 100-person task force with the PMO and different work streams to make sure that the entire company was shifting, not just the sales organization, finance, HR, marketing. And then we made sure we had, as we just talked about, differentiated offerings on the subscription side, so that there would be a pull happening where the customers wanted to go there versus us having to push them over the line. And then obviously, one big piece of a transition is the sales execution. And we learned pretty early and obviously had experience with how you create incentive plans that make the sales professionals want to do this and push the customers there. So we're really happy with the transition. We have a little bit more to go. We'll get we're upper 80s percent right now. We'll get into a low 90% before it will kind of plateau for the future. But it certainly is how we operate now as a company. We're a subscription company, and it's a much better motion now with our ability to do land and expand that drive quicker deal cycles than we were able to do as a perpetual company.

Yes. I think to that last point, I mean, you're at 80% mix of bookings coming from subscription. I think there's room to grow on top of that. But I think to this point you've been fairly light handed in how you've been moving customers over and at this point as you move into calendar '23, is there room to kind of change that, maybe get more -- to influence demand through incentives or other ways you could change the kind of mix between perpetual and SaaS? Or is it a continuation of what you've done so far?

Yes. I mean I think for new customers, it will just continue and it will drive up into the 90s, as I talked about. When we think about the existing maintenance-paying base, we have a general philosophy, which is we're going to take a carrot approach, not a stick approach. And the reason why is because when a customer converts from perpetual to SaaS, we're getting a very decent multiplier of their ARR. Why is that? Because they see value. They see value in the SaaS offering. They see value in upgrading their seats to the latest features, and generally speaking, they're also adding in new modules of our new features. So I don't want to force a bunch of customers to move and get, let's say, 1.5x multiplier while they move. I'd rather wait until they are ready to move, give them the incentive to move and get a significantly more multiplier. So it's actually a transition, I think, for the base that we'll see play out over the next 3 years. I don't think it's going to be some hockey stick that happens next year. It will be a gradual approach over the next 3 years of moving that base over, and when they move, us getting a nice upside.

Got it. Okay. Maybe a financial question that would be more of a Josh question, but we'll try to add anyway. As you think about the impact of the transition on the income statement, I mean, Josh laid out that vision of 8 to 10 quarters, and you've done it in 5. And clearly, that's pulled forward some of the income statement impact and also moving to SaaS a little bit faster than you had thought as well as had a similar effect. But thinking about that rev growth acceleration you saw in the quarter, 26%, it feels like operating margin might be towards the bottom. How should we think about the trajectory of those line items in the income statement as we go here.

Yes, yes. So I think from a revenue perspective we're clearly out of the trough. We're back to revenue growth. As you said, upper 20% growth, headwind adjusted in the 30% growth. We see that really starting to accelerate. And all these transitions, revenue accelerates much faster than the operating margin. I also just want to reiterate what you said, which is we did it so fast that the bottom, the trough of the operating margin happened a little quicker and deeper than we would have expected. What we'll see it play out right now is in '23, there will be a slow emergence from the operating margin perspective. And then it will really start to snowball and accelerate in 2024, leading to our 2025 model that we've put out there. Now we're committed. Everyone seems to be talking about this these days, but we're committed to being a Rule of 40 company on the other side of the transition, anchored a little bit more on growth than on profit, but we'll adjust as needed as we go forward. That being said, when we think about how we operate today behind the scenes of the transition, we believe we're pretty close to operating that as a Rule of 40 company as it is when you look through the transition itself.

Right. Okay. Shifting to the broader platform, it feels like we've seen the CyberArk identity strategy really start to take shape and expand from here. You debuted the single sign-on MFA capability earlier this year, it looked pretty good. Right now, I think Access is, call it, 15% of subscription ARR. But you're the only company that's a leader in both the Access Management and PAM Magic Quadrants for Gartner. So can you just talk about what you've done from an integration perspective, bundling perspective to kind of push forward this vision of Access plus PAM identity -- security focused identity.

Yes. No, no. And it's an exciting development for us, and it just happens the movement up into the leadership position on the Access Magic Quadrant. And I think it makes a big statement both as a standalone access provider competing in the market. And then as you said, is the only provider that's both PAM and Access, which really supports the Identity Security Division as a whole. We believe kind of as a fundamental thing that you have to take a security-first mindset to how you do access. It's great to connect everybody to every application, but you have to do it in a secure way. And so we've taken this concept, which is transplanted from PAM, Privileged Access Management, to privilege controls, which is the essence of PAM. And we said, how can you apply privileged controls against any type of access. So if you're doing single sign-on for instance, how can you make single sign on more secure, oh, well you can add privilege controls to single sign-on. And then you can differentiate in what's largely a commoditized market with the security first mindset. For all of our solutions, we've taken that same approach, integrated across the platform and said, how can we take the best of PAM and apply it for identity management and apply it for secret management and in that way, create one single platform that embraces the principles of privileged controls.

Yes. Makes sense. From a go-to-market point there, I mean, I guess this just happened a couple of months ago. You've been at it for a couple of quarters trying to build that platform out. But what can you do from a marketing, a demand generation perspective to educate customers. And I would say most customers think about CyberArk as a privileged access management company, and it's been kind of this ongoing story to bridge it out. But what initiatives do you have in place to kind of expand that mind share with customers?

Yes, sure. So we've had a wonderful new CMO who's on board. He's been on board now for 6 months, and he's got a whole plan of really getting this CyberArk, the identity security company out into the mindset. We did a roadshow of impact events, every kind of [indiscernible] around the world and [indiscernible] when we were traveling around. We went from country to country and told this story, met with existing customers, met with prospects. And I think what it's really starting to resonate in the consolidating market that they can trust one company and a company that's really focused on security, to really bring total identity management and identify security. So I think you'll see that more and more from us, a broader and bigger [indiscernible] around that. And we certainly feel it with our customers today.

So going back to Adaptive, I mean that was the company that was maybe the core of your acquisitions. In fact at one point was actually part of the broader solution of PAMs plus Identity Access Management for whatever reason, it didn't work out quite right. But what has been the reception from that customer base on this integrated offering? Is it right to think about customers being exposed to the idea or the strategy and then we can learn from that customer base as you kind of expand the strategy out to other customers.

Yes. So first of all, you're right. And one of the reasons we chose Adaptive is it had a PAM mindset embedded in. It had a security-first mindset embedded in and we're really happy with that acquisition, and what we've been able to develop organically around it and bring forth as part of the overall platform. I think when you think about those customers, they're incredibly open to the full story. But when you look across the entire base, we had 7,000 customers and growing, you can find some of the biggest enterprises of the world, and most of them are leveraging PAM and Access or PAM and EPM, Endpoint Privilege Management, or PAM or Secrets Management, our Conjur offering. So we find that our customers are embracing us much more beyond PAM than maybe some of the other people out here know. And it's certainly a big component of driving our growth is not being just a PAM provider today.

Yes. [Operator Instructions]. From a channel perspective, let's talk about last couple of quarters, CyberArk has talked more about diversifying channel strategy, and you talked a little bit about AWS Marketplace and other areas. But can you just talk about how you think about the broad categories within channel and where you might see the most opportunity as we end the New Year?

Yes. For me, personally, channels are the way that you become bigger than who you are. We're a company on a way to $1 billion. We've got 2,700 employees around the world. We're a stalwart now in the Cyber space, but our solution deserves more. And the way you get to more is through channels. Channels amplify your effect. And whether it be our SI programs where most of the major SIs have dedicated large dedicated SI practices, where they push CyberArk as the solution in identity security, whether it be our reselling channels, which are out there really pushing the further platform and going beyond PAM. The distributors of the world, who really have embraced the lower market for us and kind of helped us get new logo acquisition. And then as you mentioned, 2 newer areas, 1 being the hyperscalers or AWS and Microsoft, the AWS Marketplace where it kind of lubricates or makes the sales cycle a little quicker because you're paying with dollars that are already purchased, are already committed. And then MSPs where the MSP market is no longer just a down market. The MSPs are serving all markets, enterprise and corporate or commercial. And so what we see with the MSPs is building their backbone on the back of the CyberArk solution and then you're able to use them really on new logo acquisition to drive growth. So yes, we're really excited by our overall partner strategy. We've invested a lot of dollars and attention cycles there. Also just in our DNA, a partner-friendly company. So these partners like working with us, and we have good mutual relationships.

Yes. Maybe just on MSSP, I think that's more recent kind of focal point for you. And you had a couple of larger MSSPs show up to impact in July and talk about the opportunity, like is that resonating more with those partners? And does Privilege Cloud help you kind of get into that market a little further? Or how are they thinking about the platform?

Yes. For sure, Privilege Cloud becomes the backbone of the offering. The ability to be over offering the shared services and the identity security platform makes it easier for them to do tenant management, makes them easier for them to be able to scale up and scale down, we see them really embracing the solution. I think the other thing that's happening is in this job market, in this labor market, a lot of our customers, despite what we were talking about macros, are struggling to hire cybersecurity professionals. And they need to hire more and more cyber professionals to service this market. The MSP as an outsourced model allows them to be able to subsidize a little bit some of those gaps they have in cyber talent. And so you see big companies, like even the big SIs putting together MSP offerings that they're bringing down market to help with the skill gap that exists in the cyberspace.

Totally. And then on AWS, I mean, you talked about the idea that people are using dollars, repurchase and there's benefits, time to close, being able to use the same paper from those hyperscalers. Does that become more strategic of a channel as you get further into Secrets Hub and some of the DevOps pieces? Just curious about how that channel expands a little more.

Yes, I think that's a fabulous lead in there. So at a core level, AWS Marketplace, again, it's "free" dollar is committed dollars that can make a sales cycle go faster. But when you start to actually be driving not just cloud consumption, for example, for AWS, but actual products that enhance the AWS offerings. That's when the partnership takes off and the AWS sellers are actually out in the market pushing your offering. And Secret Hub is a great example of a new offering that we launched actually this quarter, where it allows for native development of services by developers in AWS. And so they don't have to leave the AWS environment to actually build their applications and embed credential management and secrets management. But on the back end, we've integrated back to the CyberArk Vault and the CyberArk solution, so the security team can get the best of both worlds, quick developer productivity, but the Security First mindset, the Security First Trust of the CyberArk Vault and the CyberArk offering. And that allows AWS then to run faster. They can say, use our services, and you don't have to sacrifice security at all. And we'll do that with the other hyperscalers with the other cloud providers that are out there. I think it's a really good opportunity for us to actually lean in, in that partnership.

Makes sense. In addition to Secret sub, you announced a number of new features in July, your customer event. Can you just talk about like what are the -- I mean I'm sure you're excited about all of them, but what are the 1 or 2 that you're most excited about as you bridge kind of further into access, not quite the governance but some pieces of governance. And just any other highlights on how you see that identity platform expanding.

Yes, sure. Sure. So I mean, secret sub would have been my #1 that I'm most excited about. We're building the fastest amount of pipe there, and it's really taking off. But on the identity management side, so we define identity management as Think about it as modern IGA or IGA light, which is the idea of bringing the core principles of IGA around workflows, around compliance, around life cycle management, and making sure that they integrate in with our overall platform so that you can make a PAM program more effective or you can make an access program more productive. And so we've taken some of those core elements, not to full on compete with SailPoint or a big IGA, but to make our integrated story of identity security more effective. And we're launching -- we launched identity flows and identity compliance this quarter here as well. announced earlier in the summer. And again, as you said, they round out that identity management vision, and they help this consolidating world of identity where access, PAM and IGA are coming together, and we're the only ones who going to offer one integrated platform against it.

Got it. I'll read one from the iPad. From the localization efforts in China, where do the local vendors stand. So I don't know if that's particularly the country or just internationally, how do you view the competition?

Yes, sure. I can talk internationally. I would say we have a very small exposure in China. It's not a place where you want to be -- you don't want to be going into China as an outside security firm. It's just not an effective long-term strategy. So I think China will always be, frankly, a pretty small element. We have a decent business in Hong Kong and Taiwan. We have great business in the rest of APJ. We've got an emerging business in Japan. We've got a very strong business in Singapore and Southeast Asia. We've got a nice business over in Australia. Our EMEA business is 30% of our overall business, and it's growing really effectively, again, even in this environment. And so I think internationally, outside of the U.S., we see that as a growth opportunity. We're already in all the countries we want to be in, which is really nice. So it's just about putting a little bit more fuel in the fire in those countries.

I'll expand that question to the broader competition in PAM, and we've obviously seen a lot of kind of turnover in terms of M&A and companies going private. But how do you -- I mean I think CyberArk has always been the leader in PAM as things move to the cloud, maybe that conversation got a little more confusing. But today, how are you feeling about the competitive environment in the privilege side of the world?

So on the privileged side of the world, I mean, we've never been in a better place. We believe we're taking share -- we know we're taking share based upon the growth rates that the analysts put out there versus where we're growing. We think we can win every deal we're in. Being the only public PAM provider is a nice place to be. There's a lot of confusion around the PE-owned companies. There's still a lot of worry about what it means for their platform for their technology stack. So I think we're competing from the strongest place we've ever been on a PAM perspective. And we're happy in a PAM growth market to be #1. I think when you go outside of PAM to the other areas, of course, we're competing more from the back. In access, we're competing behind Microsoft and Okta. They have a [indiscernible] who's very prevalent in the enterprise space, but also is just taking private would be that causes confusion. Now we're a leader in the Magic Quadrant, and we can kind of compete more effectively against those incumbents as we go and take out legacy technology, which is really what we're doing out in the enterprise space as it relates to access. So we feel we've never been in a better competitive position as demonstrated by our results.

What about on the Secret Hub and DevSecOps side of the world. I think there's a competitor people know about and think about you relative in that space. But I think Conjur was an acquisition, I think 2015, so it has been on the platform for a while. It feels like it's finally kind of hitting a momentum stride. Would just love to get your impression on like how you penetrate that market, the competitive environment?

Sure. And yes. And listen, I think the competitor you're referring to is HashiCorp. Hashi is very strong. They're very strong in their ability to be embedded within the developer life cycle to get their open source vault into development projects. I think we have 2 differentiators that we're pushing. One is any application, anywhere, anytime, meaning we don't just do cloud-native development and cloud native applications, we can do off-the-shelf applications, vulnerability scanners, SaaS applications. We also can do legacy applications that are sitting in the on-prem data center, and we can do it all with one enterprise suite of solutions tied back into our platform. And so that allows us at the enterprise level to not make someone have to compromise between their modern development and their legacy or infrastructure. Secondly is, we have the backing of security. And so we can come in with security and broker with the development organization, a path to developers, you develop at your own speed, develop as fast as you want. But let's have security actually endorse this so that you know when you've done developing, you're done. If you're not endorsed by security, you never know what's going to be swapped in later. And so that's our ability to be able to go compete effectively with Hashi. Again, we love the secrets management market overall. We say this stat a lot, but I can't get into a meeting without saying it, which is for every human identity, there's 40 machine or nonhuman identities. Just think about that level of proliferation. All of those identities need to be managed. They need to be secured. And we have to make sure that none of these breaches happen where hard-coded credentials are driving, basically easy attack vectors for the bad actors that are out there.

Got it. Maybe a margin question, but just on headcount and hiring, I think CyberArk had a pretty good string of quarters in the hiring space. But how are we thinking about that over the next 4 quarters, obviously except for macro environment. At the same time, maybe the labor market is softening a little bit. You guys are at a point where you want to expand the platform a little more aggressively. So where does hiring and investment in the sales force and R&D kind of fit into that equation?

Yes. I mean I think it's a two-pronged story. One story is we're watching the macros every day. We want to make sure we don't get ahead of ourselves. And if anything changes in our performance, in our environment, we will turn down the hiring and we'll turn it down instantaneously. We did it in COVID successfully on a dime, and we can do it here if we need to. That being said, at the moment, we see such a big opportunity ahead of us into 2023, we don't want hiring to be something that impacts our ability to grow. And so we'll continue to hire and look for talent in the sales and marketing space. We continue to look for ability for technology hires that are necessary for our future of our platform. And we'll do it smartly, as you said, like we've always done. I think when we think about the overall opportunity to go find talent today, it is a richer environment to find talent. And so we want to press our foot on the gas and bring that talent in, especially those who can help us really capitalize on this growth market.

Got it. Thinking about pipeline in the fourth quarter, I know last year, you had a bigger budget flush quarter, and so maybe perpetual will come back. I think broadly across the space, we're hearing more companies kind of talk down impact of budget flush in the next quarter. But just curious to get your perspective or what are you kind of planning on in terms of the typical budget flush and any sense how that would impact the mix of perpetual subscription and SaaS? Or are things just kind of moving towards the subscription?

Yes. So I think when we set our guidance, we anticipated there wouldn't be a huge budget flush, not zero, but not a huge budget flush. I think we still think there will not be a huge budget flush. I think we see -- last year, we had a really nice Q4, sets up for a difficult compare. We're not going to be anywhere near there from a budget flush perspective. But again, that's what we knew going into the quarter, nothing's changed. We don't -- we definitely don't see a huge influx of perpetual. Maybe that's a little surprising. But I think our customers have become conditioned to buying subscription and SaaS. Most of them are buying their new products in subscription and SaaS, even if they're staying with their PAM on-prem. And so I think that's what we see going forward, it's pretty much consistent with probably where we were when we were -- when we were talking to the markets.

Got it. From a product perspective, I mean, you have maybe 6-or-so different solutions on the platform. You've talked about, I think, access being around 15%, EPM being maybe not -- a little north of there. What does the pipeline look like from that perspective? Are you seeing more customers looking at the broader platform? Or is it still heavily dominated by Privileged Cloud and other areas?

Yes. I mean I think when you add it all together, from a performance perspective, ARR, we are 25% EPM, 15% Access and 10% Secrets Management, right? And so if you add that together, it's 50-50. So in looking backwards, it's 50-50 PAM, 50-50 everything else. When you look forward, the mix of everything else is more than 50%. And so I think we see that being a very healthy dynamic for us. Now again, PAM continues to grow, which will impact maybe the shift. If you have one anchor tenant that's still growing very healthy, it takes a while for the others to overcome them. But we continue to see nice growth in the pipeline around all 3 areas. And we're hoping that we'll get even more acceleration here on the access front on the backs of Magic Quadrant and some of the other moves that we've made.

Some of the tailwind benefited from over the last year. I mean, we talked about Zero Trust and the evolution of privileged users becoming more prevalent throughout the organization as you get into DevSecOps, the number of machines go up. But how do you think about tailwinds heading into next year? And I think one that's been called out by Udi quite a bit is cyber insurance market. So just curious like how you thinking about the tailwinds that you've seen this year maintained into calendar '23.

Yes. And that's what gives us optimism as we look towards 2023. And frankly, beyond 2023 to 2024 and 2025, the key trends around Zero Trust software supply chain ransomware are trends that play their way into identity security and into identity. When you analyze any major breach that has happened over the last several years. Ultimately, what have they been trying to do. They've been trying to find their way to a privilege identity. And once they have access to that privileged identity, things go bad very quickly. So we believe that all of those trends support the notion that we're front and center in anyone's cybersecurity strategy. If you go over to cyber insurance, why would it matter to cyber insurance? Well, because they've recognized that they're paying out tons of money on breaches that ultimately, people were trying to get to privilege controls. Again, that's how you effectively implement a ransomware attack. And so I think those are the trends that will sustain our business not just in 2023, but for the long term. Now as a company, what we need to do is we need to get the word out about who we are. We need to actually get the identity security vision out into the marketplace. We need to amp up our ability to go out to new logos, to use the partners to get into new markets. All of those things are about execution and even better execution, but that's what sets up a long-term durable growth strategy for us as a cybersecurity leader.

Yes. EPM, I think, has been -- I don't want to call it unsung hero because it's been pretty...

We've sung a few times.

You sung a few times, yes. I think you've talked about maybe 1/5 of customers having that solution. And I would love to get your perspective on -- from a competitive standpoint, I don't think anybody else is offering that. It actually works, I mean if you think about like where people want to spend money and actually defend anything against the ransomware, it's a solution that is proven to work there. How do you think about adoption of that within your customer base and beyond? Like should that be a bigger percentage of users using that?

Yes. I mean if you're in one of my internal meetings, you'd hear me say all the time, why isn't it more? Why isn't more? Why isn't it more? And the reason I say that is because, like you said, it is quick to value and it locks down control. So just so everyone understands, EPM or endpoint privilege management is about taking any endpoint, let's say, a desktop or a laptop. It can be a Windows or Mac machine, [indiscernible] box and basically locking down the rights at that endpoint to remove local admin rights, and you implement a workflow that allows someone to ask for the ability to be able to install or download and put anything on to the workstation. That act of being able to do that locks that endpoint down, so even if someone gets in, they can't do anything. So even if they get by, they can't actually get into the network, they can't actually start to download any of these files that actually ultimately lead to the breach or lead to the harvesting of all the data and information. So given that fact, everybody needs it. It needs to be on every endpoint. It needs to be on every workstation. And when customers realize that, they realize it fast. They're actually a little bit quicker deal cycles, they're big deals. Sometimes, they're just a little slow in slotting it into their phases, and they want to get PAM done first, rather than doing it at the same time or doing it quickly. And so every one of our customers has it on their road map to talk to them, but we need to actually push it a little faster. It is a huge growth vector. It's our fastest-growing product. And again, it's probably one of my favorites to talk about.

And competitively, there's not that much out there that can compete.

No. I mean I think the other PAM providers, they have dilution, some of them have been invested and some haven't. We feel like we're differentiated in our ability. In addition, Microsoft has an offering out there, but we believe that it's, again, like we're able to successfully compete against Microsoft in that front. And so no, we feel like it's a market ripe for us to go capture.

And relative to the EDR players that are talking more about identity is completely complementary.

Complementary plays right next door, any of them, we see it as a co-sell not as a competitive sell.

Got it. I've got 2 more minutes. I'll wait for other questions. But maybe one other one. Post-quantum cryptography is maybe getting out there. But in the secrets management space, there's been a lot of talk of steal now and decrypt later. And is that something that CyberArk can kind of help with in terms of companies understanding their exposure to those kinds of attacks and the fact that encryption certificates could be at risk in the future.

I mean I think it's an area -- so people who know CyberArk knows we have a heavy investment in our CyberArk labs. It sits over in our headquarters over in Israel. It has its own floor. Some of us are allowed out in the floor. Some of us are not allowed on the floor. And they're off really analyzing and researching a lot of these next-generation problems, and they're looking and trying to make sure that our solutions do have a way to play, or we understand the partners that we should be playing with to be able to solve those solutions. So whether it's that or another hot one is decentralized identity, all of these areas are areas where we're -- our labs are free, like unfettered to research, understand and then get feedback back to our R&D organizations on either partnerships or where we want to modify the product, that's a good asset to have in the family here.

All right. Well, I think we'll wrap it there unless any last one, but I just want to thank Matt for being here, a great conversation. So thanks.

Thanks for the questions.

Thanks, everyone, for attending.