CyberArk Software Ltd. (NASDAQ:CYBR) Q4 2022 Earnings Call Transcript

CyberArk Software Ltd. (NASDAQ:CYBR) Q4 2022 Earnings Call Transcript February 9, 2023

Operator: Thank you for standing by. At this time, I would like to welcome everyone to the Q4 2022 CyberArk Software Earnings Conference Call. All lines have been placed on mute to prevent any background noise. After the speakers remarks there will be a question and answer session. . Erica Smith, SVP, Investor Relations and ESG. You may begin your conference.

Erica Smith: Thank you, Chantal. Good morning. Thank you for joining us today to review CyberArk’s fourth quarter and full year 2022 financial results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; Matt Cohen, our Chief Operating Officer; and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open the call up to a question-and-answer session. Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management’s best judgment based on currently available information. I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operations for the first quarter full year 2023 and beyond.

Our actual results might differ materially from those projected in these forward-looking statements. I direct your attention to the risk factors contained in the company’s annual report on Form 20-F filed with the U.S. Securities and Exchange Commission and those referenced in today’s press release that are posted to the website. CyberArk expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made today. Additionally, non-GAAP financial measures will be discussed on this conference call. Reconciliations to the most directly comparable GAAP financial measures are also available in today’s press release as well as an updated investor presentation that outlines the financial discussion in today’s call.

We also want to remind you that we provide the calculated revenue headwind for additional color on the impact of our subscription mix shift, but it should not be viewed as comparable to or a substitute for reported GAAP revenues or other GAAP metrics. A webcast of today’s call is also available on our website in the IR section. With that, I’d like to turn the call over to our Chairman and Chief Executive Officer, Udi Mokady. Udi?

Udi Mokady: Thanks, Erica, and thanks, everyone, for joining the call. We had another strong quarter to cap off an amazing year, where we outperformed, executed and delivered against each of our key strategic initiatives in 2022. We optimized our go-to-market engine, expanded our channel partnerships and enhanced our platform selling motion. Our breakaway innovation extended our solutions well beyond PAM and resulted in CyberArk being recognized as the leader in Identity Security. We are in a great competitive position, and we are taking market share, not only in PAM, but across our product portfolio. We entered 2023 with a more durable, more resilient and highly visible business model. CyberArk is in a position of strength well on our way to our $1 billion ARR target, and we have already reset our sights well beyond that.

Because of this execution, as we are gearing up for 2023, we recognized that CyberArk was in the best possible position to make the executive changes we announced this morning. In early April, I will move into the Executive Chair role and Matt Cohen, our Chief Operating Officer, will become our CEO. Matt is an incredible leader, and I can’t imagine a better person to be the next CEO of CyberArk. Since joining the company, he had a tremendous value and has been instrumental to our success. He experimented the subscription transition, transformed our go-to-market engine and has inspired people across the organization to deliver well ahead of expectations. With his support and leadership, we have delivered tremendous results and the company is set up for long-term success.

While my role with CyberArk is changing as Executive Chair, I’ll stay very active, working with Matt and the management team, I will focus on shaping our future by aligning our long-term strategy to our mission, preserving CyberArk’s unique culture and brand and fostering relationships with key customers and partners. It is very important to me that we get this right and that we have a smooth transition, continuity of leadership and that we don’t skip a beat in our execution. I believe that our plan accomplishes these objectives. Personally, Matt and I have formed a strong partnership based on shared values, a commitment to our mission and friendship. We will continue to work together closely to ensure CyberArk executes and that we deliver our vision.

Matt has joined us today, and I’m going to hand it over to him for a few comments. Matt?

Matt Cohen: Thank you, Udi. It is the honor of a lifetime to be named the next CEO of CyberArk. Udi, along with Josh, the leadership team and every site of our employees have worked hard to build an amazing company. Udi has been a mentor and become a dear friend over the last 3 years. He is a special leader with genuine empathy and measurable energy and deep passion for our mission, our culture and our people. I am looking so forward to working with him to scale CyberArk, drive profitable growth and deliver shareholder value. I will also focus on preserving the company’s culture, which has been so critical to CyberArk’s success. Our leadership team is completely aligned on our plan for 2023 and our long-term vision and our massive opportunity. Our future has never been brighter, and I am humbled to lead CyberArk’s next chapter. I will now turn the call back to Udi to talk about the quarter in more detail.

Udi Mokady: Thank you, Matt. Moving into the quarter. Our performance demonstrates a few key points: First, the power of our business model; second, the durability of demand for our Identity Security platform; and lastly, the strength of our execution. The financial highlights include: subscription ARR reached $364 million, growing 99% year-over-year. We also added a record $63 million in net new subscription ARR from the end of Q3. Total ARR reached $570 million, growing 45% year-over-year, well ahead of our November guidance. ARR is still the best metric to measure our success. We ended the year with more than 1,300 customers, with over $100,000 in annual recurring revenue, growing more than 40% year-over-year. Total revenue came in at $169 million for the fourth quarter, with a subscription booking mix of 90% in Q4, well ahead of our guidance framework.

The mix created a revenue headwind of about $24 million. Normalizing the mix for the fourth quarter of last year, our revenue would have grown by 27% this quarter. The license portion of our business, our SaaS subscription and would have grown about 42%. As we talk about the quarter, I will frame today’s discussion around growth, innovation and profitability. Persistent secular tailwinds are contributing to our growth. I’ve spoken to dozens of customers and partners in the last few months, and they all face similar challenges. Digital transformation is leading to an explosion of identities, both human and machine. Implementing Zero Trust strategies remains complex and time consuming. And attacker innovation is only accelerated with the emergence of new technology and new attack vectors.

Take ChatGPT, our lab team posted breakthrough research on ChatGPT, which can dynamically mutate malware, making it incredibly hard to detect and stop. With examples like this, there is a little debate that identity is the attack surface and taking an assumed breach mindset is the best way to protect the enterprise. In the fourth quarter, we landed with more than 380 new customers. And for the full year, we added more than 1,100 new logos, an all-time record for CyberArk. We continue to see strong diversity in our business and are signing customers from health care and biotech, hotel, fashion brands, hospitals, manufacturing, banking and insurance companies. A few examples include: a multinational health care company couldn’t scale with its existing PAM point solution, particularly given the increasing number of machine identities within the organization.

In a 7-figure rip and replace deal, the customer will protect human and machine identities with our modern Privilege Cloud and Secrets Management solutions. A large hotel chain is building its enterprise-wide Identity Security program on our platform. During the quarter, this cloud-first organization landed with Privilege Cloud, Workforce Password Management and Dynamic Privileged Access as its first steps with plans to expand to MFA and single sign-on in 2023. We Cyber insurance was once again a driver in Q4 across many examples, including a prominent clothing brand buying Privilege Cloud to meet the insurance requirements and lower premiums. Our subscription transition is increasing the velocity of add-on business, particularly with our SaaS solutions.

A few examples. A major hotel chain is accelerating its cloud-first strategy with CyberArk expanding coverage from PAM, CyberArk Identity and Secrets Management to Endpoint Privilege Manager. A Global 2000 financial services company was our first Conjur Cloud customer and also Secret Hub. As customers implement Zero Trust strategies, they want the peace of mind with a single pane of glass into all privileged activity, visibility that only CyberArk can provide today. A Fortune 500 health care company expanded its Identity Security program and decided Cloud Entitlements Manager, Endpoint Privilege Manager and Dynamic Privileged Access as game changers for securing its cloud-first environment. We are seeing returns from strengthening our partner program in 2022.

The new routes to market, enhance collaboration and improve efficiency across the ecosystem increased our momentum and significantly expanded our reach. As an example, the number of unique CyberArk certified partners grew by over 90%, and the certifications across our platform continue to grow, a great indication for future growth in our Access and Secrets Management solutions. Before moving into innovation, we wanted to comment on the macro environment. While Identity Security remains top priority, more approvals continue to be required in deals, consistent with what we saw in prior quarters. The demand trends, deal progression, win rates, renewal rates and sales cycles remain healthy across the board, which we see in our strong ARR growth.

On the innovation side, we were thrilled to be named a leader in the 2022 Gartner Magic Quadrant for Access Management in early Q4, making us the only company to be named a leader by Gartner for both PAM and Access Management. We are already benefiting from the Magic Quadrant with the pipeline for our CyberArk Identity reaching new record. We believe this is another important validation of our strategy to deliver the most complete Identity Security platform in the market. The enhancements of CyberArk Identity, like flows and our innovations in PAM, including broader threat detection and response on VMs and self-hosted machines differentiate us in the field. Innovation continues to be the cornerstone of our success. In addition, we won our first deals for AWS Secret Hub and Conjur Cloud during the fourth quarter.

Josh will cover profitability in more detail. But as we look into 2023, we will continue to invest with discipline and expect to leverage each of our operating expense lines. Most importantly, we plan to be agile in our investment plans and have the flexibility to make adjustments as we move through the year. When looking through the transition dynamics, we are operating CyberArk as a Rule of 40 company today and remain committed to delivering profitable growth. To ensure we capitalize on our growth opportunity, we expanded our management team adding Chris Kelly as CRO. Chris joined us from Adobe, where he scaled the Global Customer Solutions business. Chris is already making an impact. He hit the ground running and participated in our global kickoff last month.

He fit seamlessly into the cyber culture and is fully supported by each of our 3 theater heads. As we look into the coming year, our top priorities for 2023 include accelerate our Identity Security platform sales motion across PAM, EPM, Access and Secrets Management, further leverage the channel and marketing alignment to extend our reach, enhance our customer success organization at scale to ensure we protect and expand our base of ARR and deliver cutting edge innovation and extend our leadership position in Identity Security. With our execution over the years, CyberArk is in a position of strength. We have a strong experienced management team focused on executing our strategy. We have a massive market opportunity and are taking market share.

Our Identity Security platform is mission-critical, and our solutions are being prioritized even in today’s challenging macro environment. I have never been more energized or enthusiastic about CyberArk, our leadership position, our team, our culture, and our future. We have put in place a best-in-class transition that will help ensure that we deliver against this massive opportunity. I’m looking forward to working closely with Matt, the Board and the entire CyberArk team as we build CyberArk to a $1 billion ARR company and beyond. I will now turn the call over to Josh, who will discuss our strong financial results in more detail and provide you with our outlook for the first quarter and full year 2023. Josh up to you.

Josh Siegel: Thanks, Udi. As Udi mentioned, we were pleased with the durable demand for our solutions. Customers are embracing our Identity Security platform and our subscription model is delivered, resulting in annual recurring revenue growing 45% and reaching $570 million. That’s well ahead of our guidance. The subscription portion reached $364 million, increasing 99% and now represents 64% of our total. We had another record quarter for net new subscriptions and total ARR driven by the strong demand for our solutions, particularly for SaaS. Our progress is clear when you compare today to a year ago when the subscription portion was only $183 million, then just 46% of total and half of our year-end 2022 amount. Our guidance in February of last year estimated just 35% to 36% growth in total ARR to outperform and grow nearly 10 percentage points faster showcases the strength of our execution throughout the year.

We have convincingly flipped our business to a fully recurring model, a key multiyear goal we set just under 2 years ago in our March 2021 Investor Day. The maintenance portion was $206 million at year-end. The year-over-year and sequential decline in maintenance ARR was due to the decline in the perpetual license sales expected and included in our guidance. We continue to see very strong renewal rates of more than 90% for our perpetual maintenance business. In addition, our visibility continues to increase with the remaining performance obligations now at $730 million at year-end. That’s increasing 38% from December 2021. Total revenue of $169 million, grew 12% year-on-year and was impacted by our subscription bookings mix, which hit a record 90% for the fourth quarter.

That’s well above the guidance framework we provided. Economically, the revenue headwind created by the mix and duration was approximately $24 million in the fourth quarter. That’s when we compare like-for-like to the fourth quarter 2021 when the mix was just 71%, taking the calculated revenue headwind into consideration, total revenue would have grown by 27% year-on-year. And if you include the $1.5 million in currency impact as well, we would have grown by 28%. If you isolate just the license portion of revenue adjusted for headwinds, our license revenue grew by 42% in the fourth quarter. On the macro environment, during the quarter, we continue to experience more approval of deal cycles. And in addition, some existing customers also wanted shorter commitments, opting for 1-year versus 3-year deals related to self-hosted subscription or our term-based license contracts, which impacted our duration, recognized revenue and long-term deferred in the quarter.

Overall, we continue to be very pleased with our bookings and to see Identity Security programs being prioritized. Momentum in our business continued, and the demand environment is resilient with budgets being allocated as evidenced by the significant ARR outperformance and the strength of our new logos. Moving into the details of the revenue line for the fourth quarter. Subscription revenue reached $88.5 million, growing 86% year-on-year, representing 52% of total revenue in the fourth quarter. Consistent with our move to a subscription business model, perpetual license revenue came in at about $14.6 million. Our maintenance and professional services revenue was $66.1 million, that’s $54.1 million coming from recurring maintenance and the balance of $12 million in professional services revenue.

Recurring revenue reached $142.6 million or 84% of total revenue, growing 39% year-on-year from $102.9 million in the fourth quarter last year. Geographically, the business continues to be well diversified. The Americas revenue reached $99.5 million, growing 15% year-on-year. EMEA grew by 5% year-on-year to $51.8 million and APJ grew by 13% to $17.8 million of revenue. Normalizing for the mix and the duration, the Americas would have grown by 31% year-over-year and APJ by 30%. Normalizing the headwind and FX, EMEA would have grown by about 24% in the fourth quarter. All line items of the P&L that I’ll discuss now are on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release. Our fourth quarter gross profit was $140.2 million or 83% gross margin compared with 86% in fourth quarter last year.

The lower year-on-year gross margin is in large part due to the significantly increased portion of SaaS revenues and the result of the declining of the perpetual license sales in the fourth quarter of 2022. While we continue to make disciplined investments to drive innovation and growth, our results demonstrate our operational rigor as evidenced by our operating expenses increasing 20% to $136.1 million, resulting in income of $4.1 million, and that compared to our headwinds adjusted revenue growth of 27% in the fourth quarter. We are still being impacted by the mix shift towards ratable revenue, which lowered our operating results. Normalizing for the headwinds, our operating margin would have been positive 14% in the fourth quarter. As a reminder, this only level set to the mix to the prior year, not all the way back to the beginning of the transition.

Net income was $7.2 million or $0.16 per diluted share, beating our guide for the fourth quarter. For the full year, revenue was $591.7 million, accelerated to 18% year-on-year growth versus the 8% last year. For the full year, subscription bookings mix was 88%, which was higher than we were expecting and which resulted in approximately a $72 million headwind for the full year. This compared to a 66% subscription bookings mix for the full year 2021. Normalizing for the headwind, the total revenue would have grown 32% year-on-year. And for the full years — for the full year, Americas would have grown by 23%, EMEA by 9% and APJ by 12%. Normalizing for the headwind for Americas — normalizing for that headwind, though, the Americas grew by 38%, EMEA by 23% and APJ by 28% year-on-year.

Moving down the P&L for the full year. Our gross margin for the year was better than we expected at 82% as we closely manage the expenses related to SaaS. Operating loss was $22.4 million. Normalizing for the headwind, operating margin would have been a positive 7% for the full year. Our net loss was $0.44 per basic and diluted share, which was also impacted by the same revenue headwind of $72 million for the full year. We also observed an FX impact for the full year of approximately $6 million on revenue, $7 million on ARR and $2 million on operating income. We continue to attract and retain top talent ending December with over 2,750 employees worldwide, including nearly 1, 160 in sales and marketing. For the full year, free cash flow was $37.2 million or 6% free cash flow margin, which came in nicely ahead of the free cash flow guardrails we set for the full year and demonstrates the strength of our subscription model.

Turning to our guidance. Our guidance for the first year — for the first quarter and the full year 2023, balances, the strong competitive position and the durable demand for our platform against the uncertainty in the macro environment. For the first quarter of 2023, we expect total revenue of $160 million to $164 million, which represents 27% year-on-year growth at the midpoint. We expect a non-GAAP operating loss of about $15.5 million to $12.5 million for the first quarter, and we expect our non-GAAP EPS to range from a net loss of $0.30 to $0.23 per basic and diluted share. Our guidance also assumes 41.3 million weighted average basic and diluted shares and about $4 million in taxes. For the full year 2023, we expect total revenue in the range of $724 million to $736 million.

that’s representing growth of between 22% and 24%, an acceleration from our 18% growth rate in 2022 and consistent with the playbook we outlined when we kicked off our subscription transition. For the full year, we expect our operating results to range between an operating loss of $5 million and an operating income of $5 million. We expect a range of net income per share of $0. 07 to $0. 28. And for the full year, we expect about 46.1 million weighted average diluted shares. We also expect about $20 million in taxes. For the full year, we expect annual recurring revenue to be between $730 million and $740 million at December 31, 2023, or between 28% and 30% year-over-year growth. To help model the expenses for the year, we expect to see an increase in marketing expenses in the second quarter related to our Global Impact Customer event and its World Tour, leading to a seasonally lower operating income in the second quarter.

For the full year, we plan to leverage our P&L with each operating expense line growing at a slower rate in 2023 compared to 2022. The increase in our expenses fall into 3 main categories: increasing investments in our cloud infrastructure to support our record SaaS bookings in 2022, which we expect to — which we expect will lower our gross margin for the full year to between 80% and 81%; second, making critical investments in R&D, including our SaaS and self-hosted solutions; and lastly, the investments in sales and marketing, we have deep conviction in the opportunity and our incredibly strong competitive position. As we think about our guidance for the year, we plan to be agile on our investments. If we see the demand environment change, we will adjust our hiring and investment plans for 2023.

Moving to free cash flow margin. We anticipate that it will be approximately equal to our non-GAAP net income margin over a 12-month period. We remain focused on capitalizing on the massive opportunity in front of us that will deliver profitable growth and strong cash flow, creating long-term value for shareholders. If we sum up 2022, we were pleased to complete our subscription transition ahead of schedule already in the first quarter. The benefits of our subscription engine are already starting to kick in. Revenue growth accelerated to 18% in 2022, and there is further acceleration expected in 2023. As you saw from the guidance I just provided, we expect operating margins to have bottomed out in 2022 and to modestly improve in 2023. And what’s even more exciting is that we expect even more meaningful improvement once we get beyond 2023 and the flywheel effect fully kicks in.

Before I turn the call over for QA, I’d also like to congratulate Matt, we are aligned on our vision for execution and strategy and very much look forward to continue working closely with him in his new role. I will now turn the call over to the operator for QA. Operator?

See also 25 Biggest Colorado Companies and 25 Biggest New Jersey Companies.

Q&A Session

Operator: Our first question comes from Saket Kalia with Barclays Capital. Your line is open.

Saket Kalia: Let me just start by saying, Udi, it’s been a pleasure working with you. Wish you best of luck as Executive Chair, very happy you’re still staying with the company. And Matt, very much look forward to working with you as well after all the work that you’ve done through this transition.

Udi Mokady: Thank you so much, Saket.

Matt Cohen: Thank you, Saket.

Saket Kalia: Maybe — yes, absolutely. Maybe shifting to the business, Udi, maybe starting with you. I was wondering if you could just zoom out and talk about why you think Privileged Account Management seems to be bucking the trend in this macro. There are more headcount reductions happening in certain areas of the economy, not all security companies are seeing this type of ARR. I’m curious why you think PAM or just maybe even just the broader identity as a category seems to be doing better?

Udi Mokady: Obviously, we’re very excited that we continue to outperform and the 45% growth in ARR. Privileged Access Management is one of the few critical security layers that really make a difference in enterprise security. I would categorize it in one of the few that are on the must have side of enterprise buying decisions. And no matter how you dissect every attack that’s in the news, there’s — that point of no return is when they elevated privileges, moved laterally, captured identities. And CyberArk captures both the human and machine identities in our PAM platform and in our Identity Security platform. And today, it’s become clear that Identity is not just the new perimeter. Identity is the attack surface. And so it’s one of the few things that enterprises do today.

And of course, we pioneered the space. We’re a market leader in the space. And the flip side of it is also executing on that opportunity that we created through our best-in-class go-to-market team, our channels and of course, delivering great solutions, all of these years. And I would say that the team is executing and firing all cylinders against a growing opportunity.

Saket Kalia: That makes a lot of sense. Josh, maybe for my follow-up for you. Great to see the ARR guide for next year. I was wondering if you could just go one little deeper into some of your assumptions in terms of macro in terms of close rates, in terms of maintenance ARR, there’s obviously a lot that goes into that ARR forecast. Is there anything you just want us to know given the — what is still arguably an uncertain macro?

Josh Siegel: Yes. Thanks, Saket. And you’re right, there are a couple of dynamics that play for ARR. First of all, as we’ve been kind of talking about over the last year, we do expect maintenance ARR to decrease. It started to last year in 2022, and we can see it’s decreasing of a couple of million dollars a quarter into 2023. And so effectively, you’re seeing that we’re guiding generally to a flat net new subscription ARR for 2023. The other dynamic is, if all things are held equal, if we look at our win rates, our pipeline and in the macro, we actually believe we can grow faster than that. But given the current macro and where we are in the year, I think we believe this is really the right starting point as we guide for 2023. But if I were to end, I’d say we’re actually really confident in the underlying demand environment, and we have the pipeline to actually support a faster growth than in the ARR side.

Operator: Your next question is from the line of Hamza Fodderwala with Morgan Stanley. Please go ahead.

Hamza Fodderwala: Congratulations, Udi, and look forward to working with you, Matt. Just for Udi, it seems like CyberArk is really separating itself from the pack from a lot of your competitors, which have been acquired and others that may be facing their own execution challenges. CyberArk has been a profitable company in the past. But just given that the opportunity that you’re seeing and the success that you’re seeing in multiple Identity categories, how do you think about just doubling down investment and continuing to just accelerate your share gain versus getting back to those very high margins that you saw prior to the transition?

Udi Mokady: Yes. So thanks, Hamza. I think we’ve been very prudent in leveraging our market leadership in the space and in pioneering. I think as both Josh and I said, we’re creating a plan that’s very agile. We’re going after this opportunity. We do want to return back to the beautiful profitability we had before the transition. And then — and of course, coming to it with that position of strong — of fully ratable revenue. But we are investing where we see the strong ROI coming, and we have a plan that’s going to keep us agile on this front, and that includes PAM that includes going after the Access opportunity now that we’re a leader in the Magic Quadrant there and includes going after the Secrets Management angle as well and of course, EPM. So we do have those great growth engines. SaaS delivered, and we’ll invest, we’ll do it like the CyberArk, agile but prudent.

Hamza Fodderwala: Got it. Josh, on that front, can you give any color around the percentage of ARR that’s coming from some of the different categories like Access Management, PAM, et cetera? I think you’ve done that in the past as well.

Josh Siegel: Yes. If we kind of look at the ARR pie, it’s been pretty consistent. PAM is still around 55% of that subscription ARR, with EPM coming in a second at 2 0%, Access at 15% and Secrets around 10%.

Operator: Your next question is from the line of Rob Owens from Piper Sandler. Please go ahead.