CyberArk Software Ltd. (CYBR) Earnings Call Transcript & Summary

Well, good afternoon, everybody. Thank you for being here. My name is Hamza Fodderwala. I'm the U.S. Cybersecurity Analyst here at Morgan Stanley. And with me, I have the pleasure of having the team from CyberArk. We have Josh Siegel, CFO; as well as Erica Smith, SVP of IR and ESG at CyberArk. Before I begin, just reprogramming now for important disclosures, please see the Morgan Stanley research disclosure website at www.morganstanley.com disclosures. With that, we'll kick it off. Josh, Erica, thank you so much for being here and Josh thank you so much for coming all the way from Israel.

Thank you, Hamza. It's always great to be at the Morgan Stanley Conference. So thanks for hosting us.

Excellent. Maybe we just level set. You guys reported earnings about a month ago. CyberArk has been, their growth has been quite resilient despite macro challenges overall for security. Just talk a little bit about how you're feeling about the pipeline, your ability to close that pipeline as you're working through the SaaS transition?

Yes. I think you're right. I mean, CyberArk had a great year in 2022. Our ARR grew 45%. Our revenue accelerated. And I really think it's about not just '22's pipeline growth, but actually, we've been having enjoying really great pipeline growth for the last several years. And when you think about CyberArk, where we're selling into the enterprise and you have sales cycles of 6 to 9 months, you really want to look at kind of pipeline growth over a couple of year period. The other thing that we liked about 2022, as we think about the being resilient, even in the tough macro environment is that the engagement level with customers was high. Our win rates remain very solid through the year. We even from quarter-to-quarter, we're kind of beating out our own internal expectations on bookings that were reflected in the results. I think that the one part that it kind of did rear its head in terms of on not being as resilient as in the fourth quarter maybe related to budget flush, that we typically would see in the fourth quarter, and I think macro muted that. But overall, yes, we're real happy with the demand environment, with the pipeline growth, with our win rates. And overall, the fact that identity security remains really at the forefront of where enterprises are looking at for their security strategy.

Got it. Got it. You also had announced a CEO transition recently. So CyberArk's longtime CEO and Founder, Udi Mokady, transitioning to a Chairman role. And now you've got incoming CEO, former COO, Matt Cohen coming in. Just Talk a little bit about that transition. What was the reason behind it? And what do you think Matt brings to the table to CyberArk after being COO for the last couple of years?

Yes. I think it's actually an exciting time for CyberArk because Udi, as you mentioned, was CEO. First of all, he's Founder and he's been with CyberArk for 24 years since the beginning of founding CyberArk, and he's been CEO during that 24-year period, 18 of those years. And I think for Udi Mokady, it's always been one of his passions to figure out how does he build a great company, a built to last company as CEO. But then how does he remain engaged even for much, much longer after that. And I think he's kind of always had his eyes on eventually moving to an Executive Chairman role position. And at that point, it's a matter of what is the right timing to do that, what's going to be right for CyberArk, what's going to be also right for making his successor a success in the CEO role. So we've known Matt now at CyberArk for 3.5 years. We recruited them in as the Chief Revenue Officer. He was an executive and the leadership team before that. Another tech company, very, very, very successful. After a short time, he actually became our COO.  And some of the major points that Matt has done for CyberArk in the last since he joined was, one, really build a go-to-market engine, structured around data and really pushing on infrastructure around channel development and the likes. But the other piece that he was really kind of ran the transition that we've all been hearing, that we've been talking about for the last 2 years on moving to a fully SaaS and subscription company, and he had that experience in his prior home and brought that leadership capability to CyberArk. Also in '22, he was intimately involved with our design plan for what we're going to try to do this year as well as from an operating perspective. I think what he brings to the table is really structured, deep structure of cross-departmental leadership. Strong on the go-to-market side, where he spent many, many years in his life, but also strong on the operational side and is very data-centric. So a lot of the things that we've done now at CyberArk under Udi's leadership and Matt took it forward was how do you create a very powerful revenue operations team, for example? And how do you move, how do you make decisions around data. And I think that's something that we're going to see a lot of with Matt going forward. And I think it's particularly timely when you think about the fact that now we're a fully recurring revenue company SaaS-led and I think that becomes a lot more critical in growing that type of company being much more data-centric.

All right. Let's talk about identity security. So identity security is still a top 3 priority among CISO out there and big market, $15 billion plus based on industry estimates out there. CyberArk is coming at it from the angle of inside out. So you're securing the crown jewels. You're doing the privilege access and now you're building out authentication capabilities with some of the players out there. Why do you think that gives you the strategic high ground, if you will, versus other players in the market?

So when you think about where all the breaches are happening, they're all anchored on identity. That's the one constant theme about where breaches are happening. And I think the other piece of the puzzle is that once they're happening, what is the process and the attack chain for those breaches and it's basically lateral movement, accelerating, taking out more and more privileges and control points. And so really what CyberArk does is be able to lock down that lateral movement and break that attack chain. So when you think about an enterprise security strategy, you're thinking about, okay, the breaches occur, but now how do we ensure that we prevent to get against network takeover? And then how -- and by doing that, you have to block the attack chain. It really gives kind of every CISO. That's why we have -- that's why we're always -- we think we're viewed as a must-have on the cyber portfolio front because you want to avoid the big expense of that network takeover, where personal identifiable information gets exfiltrated or ransomware or you can't run an identity becomes the one constant theme for all the breaches.

And then one other thing to add is that when you think about the migration to the cloud and digital transformation, nearly every user, human user on within an organization can become a privileged user depending on what they're doing. And so from our perspective, when more and more workloads migrate to the cloud, what's really going to be critical is taking those intelligent privilege controls and layering it on top of that access in a seamless way. And so from our perspective, we think that you have to come from a PAM point of view to be able to deliver that solution in a way that will really secure the enterprise. And so that's why from a position of strength, we think it's really important that you come from PAM.

Got it. Got it. Makes sense. Let's talk a little bit about some of the catalysts that have been driving growth. And there have been a lot, right, just the tailwind around identity security as more and more organizations are moving to the cloud and more heterogeneous IT environments. Another one you talked about has been cyber insurance. What's been some of the dynamics there, either for Josh or Erica?

Yes. So I think the cyber insurance opportunity is really just another tailwind of putting a stamp of why is, and why is identity security so important to prevent cost to the enterprise. And the insurance companies have understood that they need now to manage the risk of all the policies as they're sold and they're trying to understand from the enterprises, what are you doing about, okay, there's going to be a breach, but what are you also doing about to ensure that there's not going to be a cost to that breach. And so when you think about what they're looking for, it's obviously identifying the, protecting the identities through Endpoint Privilege Manager, through Privileged Access Management of those controls, again, to stop the attack chain, which prevents the real expense building up that's going to be covered by the insurance policies. And these are all products that CyberArk sells. And so we view it as another key tailwind together with other regulations, it could be GDPR, it could be California privacy. It could be SOC. It could be all sorts of financial controls, PCI. And it's going to be a long tail for CyberArk.

Got it. Got it. The multiproduct momentum in CyberArk has also been quite strong. So I think if we think about it, there's the core PAM, there's the DevOps, EPM and then access management. Can you remind us roughly how that breaks down? And where do you see most of the growth opportunity?

Yes. So Hamza, when you think about the subscription ARR, you're looking at about 55% of that ARR coming from published access management, whether or not that's cloud or the self-hosted. It's heavily weighted toward our Privilege Cloud offering. And then when you look at the remainder, it's about 20% coming from Endpoint Privilege Manager, about 15% coming from our access management solutions, and about 10% coming from secrets management. And I think the wonderful thing that we've seen over the last couple of years is that actually everything is grown in step, meaning that the opportunity for us to grow across all of those areas has nearly been equal. We've seen incredible growth rates across PAM, EPM, access and secrets management. And as we look forward, we don't -- we continue to expect to see that all of those opportunities be significant for CyberArk. I think if you look at our target to get to $1 billion of ARR by 2025, I think we expect that that complexion will look pretty similar when we get to that $1 billion target because we have a land and expand motion. And so even with PAM, we actually land with a smaller number of actual users and the customer needs. The definition of a privileged user has changed dramatically in the last couple of years. So there's an even more significant opportunity to expand. And then the our other solutions, we actually do have an expand motion as well. So we think that, that will be consistent, pretty consistent, plus or minus a couple of percentage points as we look ahead in the next couple of years.

Got It. I mean speaking of the land and expand motion, the SaaS transition has help aid in that. I know it's pretty early days on the renewal front, but what do those net retention rates look like these days?

Yes. It's a question we get frequently. So the net retention rates do look great, right? It hasn't been a metric that we've disclosed yet. And the reason we're not disclosing the metric at this point is that we typically have one and 3 year contracts. So what we've seen, we kicked up the subscription transition in 2021. We've gone through one cycle of renewals, but we believe that in order for that metric to be more meaningful, we'd like to get through another cycle or 2 of the renewal base to be able to give a real indication of what the business and the renewals look like. As probably everyone in the room knows that it's been through a subscription transition, sometimes those numbers can be higher. And we want to make sure that we set the benchmark in a way that looks really indicative of the business. Now all of our solutions are incredibly sticky. And with that expand motion, that's why we're very confident that our net retention rates will be healthy when we look forward.

SaaS high level, so now you're , I would say, through most of the subscription transition as far as your net new ARR is concerned, there's obviously to support base. We've seen a lot of cloud transitions in software not go particularly well. What would you say are the one or 2 things that has helped CyberArk execute this transition well.

Yes. So thanks for raising that because we're really proud about what we did at CyberArk in the transition. We thought it would take from all the homework that we did 8 even more quarters from the time that we kicked it off. And as we talked about last year, we actually were able to get it done in 5 quarters. And we were able to get over that threshold of where we said more than 85% of our bookings was coming from SaaS and subscription. So we're proud of that. I think some of the key points of success for us was one, obviously, you really need to make it a full company initiative. So and I talked about Matt before leading this initiative, and he really created this whole cross-functional organizational team that was then broken out into over I think 100 employees that were involved in all different aspects of how do we transition this company and meet our goal of how many quarters to transition. And we kind of divided it into there's obviously, the compensation is critical, and you have to really get that right to be able to drive the right incentivization. But it's also around the right packaging of the products that you're doing.  And one of the things that we're really focused on is how do we create more value for the customer so that they were aligned with us for this transition of CyberArk and it wasn't just what's good for CyberArk. It's also and what's good for the partners as well. And I think that was really critical how we thought through the technology and the products and the packaging around that. And I think the third piece is, and I talked a little bit about it before is the more that you are a full SaaS and recurring revenue company data becomes that much more critical. And understanding what are the mechanics, what are the data behind, what customers are buying, what are they using and rates and things like that. And from a perpetual company, we looked at different types of data, and we had to really kind of make a move of how everybody's mindset was within the organization for how they were, what kind of data they needed to be focused on and then how to use that data to be able to get to our mission on the transition.

Got it. Speaking of data, maybe I'll go to Erica. AI has been a big topic, and I think CyberArk had some research recently about how these new AI techniques are being used to mutate and create new malware. Talk a little bit about how CyberArk sees the threat landscape evolving as a result of AI and what you guys are doing to help with that?

Yes. It's a great question. We're really excited about the ChatGPT research as the team did. We have this entire organization within the company that actually focuses on essentially threat hunting. And they look at the latest and greatest technologies and see how that can be impacted or will impact the threat landscape. And with ChatGPT already you mentioned that it was constantly or continually evolving from a malware perspective, which has massive ramifications for our company, right? It really does emphasize the fact that organizations have to think like an attacker and actually take an assumed breach mindset. And that's exactly what CyberArk does from a solution perspective. We can help our customers come in and lock down that environment through heightened privilege controls, whether or not that be time-based access or it's putting the credentials in a vault depending on how you're working. And that type of solution will really does reinforce the fact that you have to take -- or enable our customers to take that assumed breach. And so this is one of the areas that we expect to continue to evolve and only accelerate now that AI is really in the mainstream.

Josh, so you've got the majority of your new bookings, the vast majority of those are subscription now. You still have a couple of hundred million or so on maintenance and support. To the extent that you have data on this so far, what is the uplift from a support customer moving to the SaaS product?

Yes. I mean we're basically seeing about 2 to 4x move on the increase from when companies are saying, you know what, we have our existing installed base, we want to know particularly if we want to go to a cloud environment, and we want to move to privilege cloud and move to the SaaS environment, we'll see that type of an uplift. And we're excited about it. What's been good is that it's actually it's been happening gradually and over the last couple of years. So it's not like -- if we look at our 45% ARR growth rate last year, only single digits percent was coming from actually customers converting or migrating from their maintenance piece over to either SaaS or subscription piece. But, so the good news is that there's still this huge tail left for us to continue to work with those customers, and we were still able to grow on expanding our installed base and bringing new customers. So we like the uplift from and the impact that we're able to get when they move because in some of the things that Erica was talking about, we're able to really expand them across our entire end-to-end platform.

Are there any incremental levers that you're looking to pull to move that support base perhaps faster?

Not exactly. We're really in favor of moving at the customer's tempo. One of the things that CyberArk is that we're very customer centric. It's one of the reasons why we only now did this transition in the last couple of years because we thought it was only now the right timing where we could be aligned with our interest so aligned with the customer. And I think what I said earlier is that we think that if we do it naturally with the customer, we'll be -- there's enough growth from our existing installed base that's already doing SaaS and subscription. There's enough greenfield and new enterprises out there, new logos to go after that we think kind of the gradual trend is fine. We also are we enjoy the maintenance base. It's a lucrative and a strong financial base for us, but we're willing to go with the pace of customers' journey.

One of the things that you saw with the SaaS transition was a reduction in the sales cycle. I think you mentioned that. What does the sales cycle look like now for the SaaS product versus the on-prem?

Yes. So we still typically see a 6-to-9-month sales cycle. I think the area that we continue to see a more efficient sales cycle is with the add-on, the fact that, that velocity of that add-on business is coming quicker. And so when a customer lands with a SaaS solution, they're typically adding on new users faster than what they would have done in the perpetual license model. So we're seeing that flywheel effect kick in. We also see the opportunity to expand into the other solution sets, really take advantage of that identity security platform and the shared services to be able to more quickly evolve into the other solution areas. So we're excited about that as well.

Got it. Last question, I'll open up to the audience. Profitability. So CyberArk priority transition had best-in-class margins close to 30%, and that was at a much smaller scale as well. Do you see a path to get back to that? And any color you could give us on sort of the time frame around that?

Yes. So we definitely see a path back to profitability. I mean, as we know, through the transition, the P&L from a profitability perspective got turned on its head. But actually, and we gave color on this all along through the transition, if you really kind of think through and kind of equate on an apples-to-apples basis, the perpetual or SaaS and the subscription business to perpetual, we were actually profitable and still profitable today through the transition, maybe not at the 30% levels that we had in the year that you're talking about, but definitely well into the double digits and in some cases, north of 20%. When -- if you were to look all the way back from the beginning of the transition and compare it to 5%, where is 95% perpetual, we would actually be very attractive on the profitability side. So but where we are now as we finish the transition, we hit our trough on profitability in 2022, where we're expecting to see improvement this year in our guidance we provided. And then we expect to see even accelerated profitability when we in 2024 and then again into 2025, and we're very focused on this profitable growth to give us, get us back to the Rule of 40 in 2025.

And the reason why it ramps in '24 and '25 because that's when the base comes up for renewal?

It's the, exactly when we have the more -- in '24 more of the full flywheel, I mean, it's partial this year. It will be more so in '24, and it should in '25, already be a full round trip.

Got it. Anyone in the audience have a question? We've got one over here.

How do you view your competitor, Delinea as they're trying to expand from the small SMB into mid-market towards the enterprise segment? And do you foresee going to a pricing competition with them?

Yes. So we've competed with Delinea is now a combination of 2 distinct companies merged into one. And we've competed with them over for quite a long time. And I think from our perspective, we think that we are more of an enterprise solution. They haven't really made as many inroads upmarket as -- well they have a strategy to move that way, we do think we've got a great competitive position from our perspective. We also think that the oftentimes what we've seen when an organization goes through a merger or move hands within the private equity world, there tends to be a bit of disruption in the near term. And I think the Delinea is in the first phase of that merger of those 2 organizations. So to a certain extent, we see it as an opportunity for us to continue to strengthen our leadership position in the enterprise. And as we move down market a bit into that kind of mid-market segment where we traditionally haven't played, we do think there's an opportunity for us given that the changes that have happened within that organization.

Any other questions. Okay. I can continue. Going back to growth versus profitability. So when I think about CyberArk, you're still very underpenetrated in your market opportunity. I think you're the only identity vendor that hasn't had to meaningfully slow hiring or do a riff and it seems like execution is quite strong. How does that factor in, in terms of your thoughts on growth versus profitability? Do you think this is the time to invest? Or are you going to maybe pull back a little bit?

Yes. We're definitely in investment mode for growth because of what you said that we're underpenetrated in the opportunity. We're in a leadership position. We've recently really expanded our position of strength to now cover the entire identity security market. We are the only company in the world that is a leader in the Magic Quadrant for both privileged access and for identity security. And as we said also earlier, where CISOs and enterprises and even going down market, they're understanding that they need to look at much more holistically, all identities within the organization as privileged, as Erica was talking about before and also not just for human users, but also for machine identities. I mean there's 40x the number of machine identity as our human users in any organization. So we're investing for that growth opportunity, not to leave money on the table.  At the same time, though, we're also focused on profitable growth and leveraging our model to be able to get back to that Rule of 40 that we talked about. When we think about what's going to weigh on that Rule of 40 on the balance, on margin and on growth at this point, it looks like it's going to be on the revenue growth side. But we think that -- and when we think about revenue growth, we think about it in multiple years because everything is a long cycle for us. Sales cycles are 6 to 9 months, bringing AEs up to speed of 6 to 9 months. Development cycles are one to 2 years. So you really kind of need to invest ahead of the game. So all the time that we see the next several years in our favor, and our position is coming from one of leadership, will be in investing mode but still always improving the profitability.

Got it. Got it. Any other questions? By the way, I just want to pause a little quick. Okay. The channel, I mean one of the things that we heard a lot was CyberArk going through a lot of these marketplaces. Curious how that's been an additional lever of growth for you guys in the last couple of years?

Yes. So our channel investments generally have really been a great driver of growth. And we -- the really important thing for everyone to know is that we still think that there's a lot more room to drive efficiency across the channel. And when you think about the marketplaces, we made a significant investment in the AWS marketplace last year. We've seen the business going through AWS more than double. I think that, that really reduces the friction within the sales process, right? Because you're able to get a faster sales cycle because you're leveraging the paperwork from AWS as well as some of the credits they may have within the organization to really speed up the efficiency within the sales process. So we believe that there's a lot more growth to get through the AWS channel, and we're really looking forward to seeing what -- how we can drive more of that in 2023.

Got it. Last question, just on capital allocation. So you do have a considerable amount of cash on the balance sheet. How are you thinking about M&A build versus buy as you plan to get to a multibillion-dollar ARR company?

Yes. We've been acquisitive. Most of them have been either -- they've been a combination of tuck-ins or actually kind of a make or buy decision, as you pointed out, like adaptive where we decided to buy on the access front in order to bring us closer to market and buy us a couple of years on time to market. Conjur was another example where we acquired to bring us closer to market faster. And when we look going forward, it's going to be those 2 levers. One is, okay, do we just want kind of a tuck-in for more technology or features? Or is it going to be -- are we working on something on our road map of vulnerabilities that we know are going to be critical to the enterprise. But this particular opportunity now is there for us to be able to bring that faster to us in market. And to your point, to then be able to even move our needle on the ARR, we'll be looking at those things as well.

Got it. Well, with that, Josh, Erica, thank you so much for your time, and thank you for joining.

Thank you, Hamza.

Thanks.