CyberArk Software Ltd. (NASDAQ:CYBR) Q3 2023 Earnings Call Transcript

CyberArk Software Ltd. (NASDAQ:CYBR) Q3 2023 Earnings Call Transcript November 2, 2023

Operator: Hello and welcome to the CyberArk Earnings Conference Call. All lines have been placed on mute to prevent any background noise. After the speakers’ remarks, there will be a question-and-answer session. [Operator Instructions] I will now turn the conference over to Erica Smith, SVP, Investor Relations and ESG. Please go ahead.

Erica Smith: Thank you, [indiscernible]. Good morning. Thank you for joining us today to review CyberArk’s Third Quarter 2023 Financial Results. With me on the call today are Matt Cohen, our Chief Executive Officer; and Josh Siegel, our Chief Financial Officer. After prepared remarks, we will open up the call to a question-and-answer session. Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management’s best judgment based on currently available information. I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operations for the fourth quarter, full year 2023 and beyond. Our actual results might differ materially from those projected in these forward-looking statements.

I direct your attention to the risk factors contained in the company’s annual report on Form 20-F filed with the U.S. Securities and Exchange Commission and those referenced in today’s press release that are posted to CyberArk’s website. CyberArk expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made today. Additionally, non-GAAP financial measures will be discussed on this conference call. Reconciliations to the most directly comparable GAAP financial measures are also available in today’s press release, as well as in an updated investor presentation that outlines the financial discussion in today’s call. A webcast of today’s call is available on our website in the Investor Relations section.

With that, I’d like to turn the call over to our CEO, Matt Cohen. Matt?

Matt Cohen: Thanks, Erica, and thanks, everyone for joining the call today. I want to start off by saying our hearts go out to Israel and the global Israeli community as they navigate through this incredibly difficult time. The atrocities committed by Hamas and Israel are horrific and as an organization we condemn these barbaric acts. The health and safety of our team continues to be our top priority. We are providing all of our employees with the flexibility required to care for their wellbeing, for their families and for their communities. The resiliency and spirit of our team has been nothing short of remarkable. The outreach and support from our customers, our partners and the Wall street community has helped us all through the last few weeks, and we greatly appreciate it.

Moving into the quarter, we had one of the best quarters in the company’s history. We saw a significant step up in demand for our platform, our go-to-market teams continue to deliver and Identity Security remains a top priority for global CISOs. In the third quarter, our bookings growth accelerated and total bookings significantly outpaced our guidance framework. Demand surged across our platform, resulting in stellar results that beat our guidance across the board. Subscription ARR reached $504 million growing 68% year-over-year. Total ARR reached $705 million growing 38%. We added a robust $52 million in net new ARR and we exceeded our guidance range across revenue, operating income and EPS with total revenue accelerating to 25% growth, reaching $191 million.

Non-GAAP operating income came in at approximately $17 million, and we generated non-GAAP earnings per share of $0.42. Throughout the year, our team has personified excellence in execution, and we have navigated the macroeconomic landscape exceptionally well. While uncertainty persisted in the third quarter, we experienced a firming of the macro environment compared to the last few quarters. Our execution was even stronger in Q3, as seen in our meaningful top and bottom line outperformance, and the significant step up in our ARR guidance for the full year 2023. Our close rates improved, and we had strong conversion of our record pipeline. While we didn’t see any outsized deals in the third quarter, there was a healthy increase in seven figure ACB contracts as customers are more than willing to allocate significant portions of their cybersecurity budgets to our mission-critical solutions.

In addition to strong execution across our go-to-market and product development teams, we continue to benefit from robust secular tailwinds that are becoming even stronger. The exponential growth of identities, cloud migration and the elevated threat landscape are all contributing to the momentum in our business. One thing remains constant in cybersecurity incidents. All roads in the attack chain lead to identity. The MGM incident is one of the most recent examples of identity and privilege access being leveraged to move laterally regardless of environment, and how attackers can inflict devastating damage including a complete shutdown of an organization. As identities across the enterprise become more powerful, cybersecurity leaders recognize that to be secure all identities need the right level of privilege controls.

Organizations are also grappling with how to assign privileges and provision access to provide each identity with the right level of security at the right time. We are the only company with an Identity Security platform that can offer our customers the flexibility to provide standing access, just in time access or zero standing privileges, depending on the type of identity and the nature of the target they need to access. What differentiates our platform even further is that we can do this across hybrid and cloud native environments. Based on our truly differentiated capabilities, our platform selling motion continues to gain traction and all our solutions are being adopted by customers at an accelerated pace driving strong growth. This includes PAM, which despite having a much bigger base is still one of our fastest growing areas.

Equally exciting, customers today understand that EDR is not enough and they need endpoint privilege manager to lock down every endpoint with the least privileged approach. Our access solutions remain both an expansion and landing opportunity. Conjur Cloud and Secrets Hub are leading a SaaS first strategy for our Secrets Management Business, and equally exciting the early momentum we are seeing with secure cloud access remains very strong, and opens up an entirely new group of identities for CyberArk within the developer community. We have an all star lineup making up our portfolio. We are empowering our customers throughout their digital transformation journeys by securing access to their cloud environments, and protecting their developer communities and the applications they are building, all without getting in the way of innovation.

Ensuring every identity across the workforce is truly secure, sets us apart and is helping us achieve these strong results. Digging into some of the key deals in the quarter. The threat landscape is driving customers to adopt our robust Identity Security platform and has pushed CyberArk into the top competitive position. We had a strong new business quarter and signed about 230 new logos, with customers increasingly landing with two or more solutions. A few great wins from the quarter included [indiscernible], an international government agency recognizing the mission-critical nature of Identity Security, and went deep with CyberArk from the start, landing with PAM, EPM, Access and Secrets in a seven figure deal. A manufacturing company landed with PAM, Vendor PAM and Access.

Our platform capabilities were a key differentiator over competing identity vendors. Influenced from both an advisory firm and a channel partner demonstrates the powerful combination of our platform and partner network in this great new logo win. Glasgow Caledonian University was looking for a modernization and upgrade of their identity stack, driven by a need for stronger security controls. Recognizing the need to look at identities holistically, they brought CyberArk security first mindset onboard broadly adopting privilege cloud, identity, workforce password manager and secure web sessions. The velocity of our business is picking up as customers achieve faster time to value with our SaaS solutions. One thing I want to drive home is that our expansion business is coming both from our new solutions as well as expanding PAM within our existing customers.

The land-and-expand motion is built into our model, and its success is represented by the 33% increase in customers with more than 100,000 in annual recurring revenue to 1,585 customers at the end of Q3 We’re seeing even faster growth in the larger cohort of customers with over 500,000 ARR. A few examples of expansion deals include a long-term CyberArk PAM customer in financial services, needed an additional layer of security for its broader workforce. This quarter, they added CyberArk identity secure web sessions and workforce password manager taking the first step into our SaaS capabilities with discussions already underway to go deeper across the platform. We had a great quarter for our Secrets Management business. In seven — in a seven figure ACV deal, a Fortune 500 financial services company who added secrets management for the first time for a subsidiary in the end of 2022 is now deploying CyberArk as the de facto provider for all its data centers globally.

This is another example of CyberArk serving as the secrets backbone for the enterprise. With the recent uptick and high profile breach activity, EPM remains a must have. Adding to its existing CyberArk portfolio and a seven figure ACV add on deal, this Fortune 100 retailer was looking to deploy EPM across all its workstations and servers, allowing consistent policy adoption. Removing local admin rights and running in least privilege at the endpoints, delivered measurable risk reduction across the enterprise. We continue to see great alignment and momentum in the channel partners and partnerships providing new valuable routes to market that allow us to extend our footprint even more effectively and reach new customer segments. The number of certifications and unique certified partners continue to show healthy growth across PAM, access and secrets management.

The partner community is a big part of our growth and we are thrilled with the depth of our relationships. And while MSPs are still a small percentage of our business today, momentum is continuing to pick up. Our MSPs deals are on average about 50% larger in size than traditional channel deals with a faster sales cycle. In the third quarter, a Nordic MSP doubled the number of PAM, and workforce password manager users after initial purchase in March. Their managed service operations have expanded significantly as they build out their Identity Security offering. Results like this are becoming commonplace, and our MSP pipeline continues to see strong growth. Moving on to innovation. In early September, we launched our Artificial Intelligence Center of Excellence.

The center builds on our long track record of using artificial intelligence and machine learning to fortify and expand generative AI and ML capabilities across our Identity Security platform. We are harnessing these capabilities to drive risk analysis and risk reduction, threat detection to simplify the user experience through automation and optimize policy to be more effective and boost productivity. AI is also being viewed is — AI is also being weaponized by attackers, which is increasing the severity of the threat landscape. The CyberArk labs team was founded on the principle of thinking like an attacker, and is providing ongoing research in how generative AI is driving attacker innovation. The labs team is working closely with the Center of Excellence and together they are fighting attacker innovation with innovation of our own to more effectively secure our global customers.

In early October, we announced new risk-based controls for identities in the cloud, strengthening our secure cloud access solution. These enhanced capabilities enable just in time access with zero standing privilege to a diverse set of cloud services that sit behind the cloud management consoles for all cloud service providers. These services run in multi cloud environments with no added friction to the user experience. While many other vendors focus on visibility in the cloud. No other vendor can bring privilege controls to the cloud like CyberArk can. We were excited once again to be named a leader for PAM by two major industry analysts, including in the Forrester Wave for Privileged Identity Management. Our Identity Security platform received a top score in the current offering category and the highest possible score in 16 criteria, including least privileged access, just in time access, development and DevOps support, threat detection and response, innovation and partner ecosystem.

As you’ve heard from us for a while now, the investment in our Identity Security platform has dramatically increased our ability to innovate and bring new integrated services to market at an even faster rate, while driving down our overall cost of development. The threat landscape is evolving quickly, but we are well-positioned to live our mission of securing our customers around the world against cyber threats, with constant innovation and security for solutions. Switching gears to profitability. The effects of our subscription transition are entering its final phase. Our top line growth is accelerating and our outperformance in Q3 shows the inherent operating leverage in our business. We are marching towards our goal of returning to a rule of 40 company or even beyond.

We are striking the right balance between investing in growth and innovation and driving profitability. In addition, the final piece of the transition is cash flow, which we expect to expand in 2024. With our stellar performance in the quarter, I remain very confident in the long-term targets we outlined earlier in the year. To sum up my discussion today, we posted a stellar quarter with our business accelerating. Our industry leading platform drove strong new and add on business. We offer a must have layer of security that is truly differentiated in the market. Our competitive position has never been stronger and you are seeing the momentum in our business. We are the only vendor in the market today who has a full Identity Security platform, one that can apply the right level of controls over any identity regardless of environment.

I’ll now turn the call over to Josh who will discuss our outperformance in more detail and how the significant increase in our full year revenue, operating income and ARR guidance demonstrates the confidence in our execution and the durability of the demand environment. Josh?

Joshua Siegel: Thanks, Matt. We posted outstanding results in the third quarter and beat our guidance across all metrics. Our bookings outperformance compared to our guidance framework for the third quarter resulted in top line revenue growth accelerating to 25%, coming in at a record $191.2 million. We were particularly pleased with our results because of our subscription bookings mix in the third quarter was 97%. That’s higher than our guidance framework of 95% evidence that the booking strength was even more impressive than the top line outperformance. Our business continues to be driven by upsell, cross-sell and new logos landing with a bigger piece of our Identity Security platform. ARR demonstrates the momentum in our business and reach $705 million as September 30 growing 38% The subscription portion increased 68% and reached $504 million.

The strong $53 million in net new subscription ARR shows the step up in demand for Identity Security platform as customers increasingly move to protect all identities with intelligent privilege controls. The maintenance portion of ARR was just over $200 million at September 30. Strong renewal rates persisted in the third quarter, and we were able to capture price increases resulting in a relatively flat maintenance ARR compared to the second quarter. Like-for-like conversion activity still only represents a single-digit percent of our year-on-year ARR growth. Moving into the details of the revenue lines for the third quarter, subscription revenue reached $122.9 million with growth accelerating to 65% year-on-year and representing 64% of total revenue in the third quarter.

Perpetual license revenue came in at $4.1 million. Our maintenance and professional services revenue was $64.3 million, of that $51.5 million came from recurring maintenance. The consistent maintenance revenue is because of our strong renewal rates and the uplift in prices we are capturing for our mission-critical software, professional services, and professional services revenue was $12.8 million in the third quarter. Recurring revenue reached $174.4 million and is now 91% of total revenue, compared to 84% in the third quarter last year, demonstrating the subscription engine we have built. Recurring revenue growth accelerated to 36% year-on-year. Geographically, the business continues to be well diversified. The Americas revenue reached $112.4 million growing 20% year-on-year, APJ grew by 21% to $18.7 million, and EMEA grew by 38% year-on-year to $60.1 million in revenue.

One thing to know is that every one of our major territories had a subscription mix of over 94%. All line items in the P&L will be discussed on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release. Our third quarter gross profit was $158.2 million or 83% gross margin consistent with the third quarter last year. Our operating income of $16.9 million far exceeded the top end of our guidance. We are pleased that our commitment to the profitability and leverage is now paying off. Sequentially, our operating expenses declined for the second quarter of 2023 primarily because of our Impact Customer Conference. As a reminder, in 2022, we hosted our Impact Customer event in the third quarter and it fell in the second quarter this year.

That’s affecting the year-on-year comparison, in addition to the sequential. Net income came in at $19.6 million, or $0.42 per diluted share, also significantly outperforming our guidance. For the first 9 months of 2023, free cash flow was $5.1 million or 1% free cash flow margin. We ended September with approximately 3,000 employees worldwide, including 1,320 in sales and marketing. Turning to our guidance. For the fourth quarter and the full year 2023, our guidance reflects our strong execution and durable demand while still balanced against the continued uncertainty in the broader environment. For the fourth quarter of 2023, we expect total revenue of $206.5 million to $211.5 million, which represents 24% year-on-year growth at the midpoint.

We expect the subscription mix to be about 95% and we expect non-GAAP operating income in the range of $19 million to $23 million for the for the quarter and we expect our non-GAAP EPS to range from $0.41 to $0.50 per diluted share. Our guidance also assumes 47.1 million weighted average diluted shares and about $11.6 million in taxes. For the full year of 2023, we are raising our guidance for total revenue to be in the range of $735 million to $740 million. That’s representing 25% growth year-on-year at the midpoint of the range and an acceleration from the 18% in 2022. We are significantly raising our profitability outlook and now expect our full year operating income to be in the range of $17.7 million to $21.7 million. We expect our EPS range to be $0.72 to $0.82 — $0.80 per diluted share, and we expect about 46.5 million weighted average diluted shares and about $32 million in taxes for the full year of 2023.

Now that we are in the fourth quarter, we wanted to frame up the cash flow guardrails [ph], which translate to a range of $33 million to $38 million for the full year 2023. We are also significantly raising our guidance for the annual recurring revenue by about $15 million to now be between $758 million and $768 million at December 31, 2023, or about 34% year-on-year growth at the midpoint of the range. Overall, we were thrilled with another quarter of strong execution and see a step up in momentum and demand for our solutions and platform. Recurring revenue is now the lion share of our business and its acceleration this quarter demonstrates that demand for our platform is building. At the same time, we are driving leverage in our model, resulting in our significantly improved profitability and cash flow.

Now I want to take a moment and echo Matt sentiment, and that we are fully supporting everyone affected by the horrific attacks on Israel. We are grateful for those bravely serving Israel, and our thoughts and prayers are with them. Before moving on to the QA, I also wanted to address some of the questions we had been getting about our operations in Israel and the employees who are being called to military duty. Organizationally, about 1,000 employees or 30% of our total team is based in Israel, with the biggest group being in R&D and product management, and then HR, finance, IT and legal teams. At this time, just under 3% of our global employees have been called up into the reserves. As a global company, business continuity has always been foundational to our strategy and we are moving the business forward even in these unprecedented times.

We remain confident in our ability to hit our short and long-term goals. Our team has been incredible. And I’m proud of what they are accomplishing together as we navigate this challenging time. We all stand united in support of our Israeli employees around the world, and we will emerge stronger as an organization and a community. I will now turn the call over to the operator for Q&A. Operator?

See also 25 Highest Paying Customer Service Jobs in the US and Top 20 Franchises for Beginners.

Q&A Session

Operator: [Operator Instructions] Your first question comes from the line of Saket Kalia of Barclays. Your line is open.

Saket Kalia: Okay, great. Hey, Matt. Hey, Josh. Thanks for taking my questions here. Great to see the momentum and also wanted to echo those thoughts there, Josh to all your employees in Israel as well.

Joshua Siegel: Thank you, Saket. Thank you.

Matt Cohen: Thank you.

Saket Kalia: For sure. Matt, maybe just to start with you a lot of great stuff to talk about, but maybe we can touch on maybe some of the recent events in the identity space broadly. Specifically, I’d love to touch on whether you think the MGM, Caesars breach is driving maybe additional interest in PAM broadly? And what do you think some of the vulnerabilities for other identity players are maybe driving interest in CyberArk’s broader identity platform. Does that make sense?

Matt Cohen: It does. And I think it’s a key element actually of our continued performance and our continued results. Like when we think about kind of the threat landscape today, and we’ll talk generally to begin with, we said it in the prepared remarks, all roads lead towards identity. When you start to digest or dissect some of these breaches themselves, you start to see that they all start kind of with a profiling and understanding a phishing attack that goes out after weakness in an employee, maybe it’s MFA fatigue, maybe it’s tricking a help desk. And ultimately, organizations see quite quickly that MFA, multifactor authentication is not enough. When you track the pathways that then are occurring in these breaches, ultimately, you see the lateral movement to a privileged account and then the privileged account being exploited, which allows the data infiltration and the ability to be able to recap it within an organization.

And this is actually not new news. When you track any major breach of the last decade, it comes back to the need to be able to protect every identity within an organization, human or nonhuman and apply the right level of privilege controls and organizations that just stop at basic security controls are not really secure in this day and age. And so I think when you look at our results, you see CISOs who have understood this not because of a recent breach, but understood it for years, getting more support from their C-suite from their Boards, as they understand the dire consequences of not implementing a broader identity security strategy. Now we see it obviously in customer breaches. We see it in breaches that have occurred throughout the industry, the identity industry, they all actually have the similar foundation, which is we need to make sure that the privilege controls are placed against all identities.

And I think our customers understand that we are the only company out there that’s able to bring a security-first identity security story that they can trust and trust to be able to consolidate their offerings on to the CyberArk platform.

Saket Kalia: Got it. That makes a lot of sense. Josh, maybe for my follow-up for you. It’s great to see the maintenance error hold in with — I mean you called out strong retention and price increases as well. The question is, how do you think about maintenance ARR going forward, just tactically, but also strategically, when do you think these customers maybe start to convert to subscription or SaaS in a bigger way?

Joshua Siegel: Yes. Thanks, Saket. So when we think about Q4, I mean, we think about a decline in the maintenance ARR, probably in the mid single digits — going — and that would kind of give us about just over a $10 million type of a decline in the last — for the 12-month period. And I think as we see it kind of playing out into 2024, I think that we’ll probably see as — right now, we are above the — already Q3 or 98%, we are looking at kind of just in the 95% plus range for the full year this year in terms of SaaS and subscription. So already next year, it will be above that. So really, the perpetual business is really evaporating for next year. So we should expect to see, I would call, a larger decline compared to the low double digits this year, but not a falloff just kind of continuing to increase the number.

And I think the strategy is we are really focused on doing what’s right for the customer and what’s right and best for the customer. And so clearly, as customers are part of the cloud journey for moving their PAM and their identity security to the cloud, we are absolutely part of that program. And then we also are — as the customer wants to upgrade and update their current hosted environment, we are there, but we are not necessarily forcing a change to move it. But we do anticipate it growing because the perpetual business is evaporating. And over time, more and more customers will be moving to the SaaS environment, and we’ll be there for that.

Operator: Thank you. Your next question comes from the line of Rob Owens of Piper Sandler. Your line is open.

Robbie Owens: Thank you guys and we’d like to echo our thoughts relative to your employees and the people of Israel, tough situation. Wanted to drill down, Josh, a little bit and just one question from me into the free cash flow guide. I realize that there was puts and takes with previous guide around duration of maintenance contracts. But it looks like some of that previous guidance of that net income margin spread relative to free cash flow aren’t necessarily going to hold. So can you unpack that for us and help us get to an understanding of a free cash flow for this year and where it’s coming in? And then any thoughts relative to how that might accelerate next year in terms of that spread?

Joshua Siegel: Yes. Thanks, Rob. So actually, I think when we looked at the — at the third quarter, free cash flow was in line with our expectations. And we basically — and Matt alluded to it in his prepared remarks, when we think about cash flow, it’s kind of the last piece of the transition coming out going from perpetual SaaS and subscription. We really hit first on the revenue acceleration in the transition. And then it moved, as you started to see during this year into the operating income, and we’ll see more of that expansion going into next year. And when we think about cash flow, it’s the third piece of the puzzle and it’s really because when we are thinking about that transition, we are dropping down from a perpetual sale, which also comes with a maintenance, one or multiple year contract that’s all paid upfront, now going to either a SaaS or a subscription contract, which is being typically paid in a 1-year contract upfront.

So we are starting to — we started to see the beginning pieces of it this year, but we see the real inflection as we go through the full renewals, and we are able to enjoy the SaaS subscription play instead of without the perpetual, we’ll start to see the compare really go strong in next year and ’24 and ’25 and confident about the numbers that we’ve set out in our long-term targets.

Matt Cohen: And then just to add — just to emphasize, I think we set out guardrails that came in and basically our guidance, which is cash flow in line with our net income margin is where we see it kind of playing out. So on the lower end of the guardrails, but within those guardrails for the rest of this year. And then I just want to reiterate what Josh said, which is we see an inflection point going into next year, and we are extremely confident in the cash flow targets that we put out there for the long range model for 2025 and 2027. Nothing’s changed there.