CyberArk Software Ltd.
Q4 2020 Earnings Call Transcript

Published: 11 Feb 2021

[Operator:]

Ladies and gentlemen, thank you for standing by, and welcome to the CyberArk Fourth Quarter and Year-End 2020 Earnings Conference Call. At this time, all participants are in a listen-only mode. After the speaker presentation, there will be question-and-answer session . Please be advised that today's conference is being recorded. I would now like to turn the conference over to your speaker today, Erica Smith, Vice President of Investor Relations. Thank you. Please go ahead.

[Erica Smith:]

Thank you, Erica. Good morning. Thank you for joining us today to review CyberArk's Fourth Quarter and Year-End 2020 Financial Results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open up the call to a question-and-answer session. Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management's best judgment based on currently available information. I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operations for the first quarter and for the full year 2021. Our actual results might differ materially from those projected in these forward-looking statements. I direct your attention to the risk factors contained in the company's annual report on Form 20-F filed with the U.S. Securities and Exchange Commission and those referenced in today's press release that are posted to CyberArk's website as well as risks regarding our ability to begin actively transitioning the business to a subscription model in 2021 as well as the duration and scope of the COVID-19 pandemic, its related impact on global economies in our ability to adjust in response to the COVID-19 pandemic. CyberArk expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made today. Additionally, non-GAAP financial measures will be discussed on this conference call. Reconciliations to the most directly comparable GAAP financial measures are also available in today's press release as well as in an updated investor presentation that outlines the financial discussion in today's call. This information can be found at www.cyberark.com in the quarterly results section under Investor Relations, also a webcast of today's call will be available on our website. With that, I'd like to turn the call over to our Chairman and Chief Executive Officer, Udi Mokady. Udi?

[Udi Mokady:]

Thanks, Erica, and thanks, everyone, for joining the call today. We hope you and your families are safe and healthy. We want to spend some time today discussing our record results for the quarter. Outlining the market dynamics and tailwinds; and lastly, detailing the formal launch of our subscription transition, just a few weeks ago, and how it aligns to our 2021 objectives. We have a lot of information to cover as we kick off 2021. So we will be also hosting a virtual Investor Event on March 10, where we can provide more detail on our growth strategy, innovation and on our subscription transition.

[Josh Siegel:]

Thanks, Udi. Before we discuss the details of the quarter, we wanted to remind you that we posted slides to the website this morning that will be helpful as we walk through our results. As Udi mentioned, we were pleased to beat our guidance for revenue, operating income and earnings per share, including record revenue in the fourth quarter of $145 million, that's up about 11% from $130 million in the fourth quarter of last year. Our best quarter ever was driven by increasing demand across our solutions, and we accomplished this despite the increasing revenue headwind from the subscription transition of $18 million for the fourth quarter and about $45 million for the full year. License revenue in the fourth quarter was $80.8 million compared with $76.5 million in the fourth quarter last year, and the recurring portion of license revenue was $17.4 million. That's 22% of our total license revenue. That's more than tripling from $5.7 million or 7% in the fourth quarter last year. SaaS revenue grew by over 300% year-on-year, reaching $9 million and subscription or term-based license revenue increased to $8 million in the fourth quarter from $3 million the prior year.

[Operator:]

Your first question comes from the line of Saket Kalia with Barclays.

[Saket Kalia:]

Udi, maybe just for you, just digging right into the subscription transition, understanding that it's still very early here. What are you sort of seeing from customers in terms of preference for term licenses versus SaaS? And how do you think about that mix sort of over time, if you will? Does that make sense?

[Udi Mokady:]

Yes. Absolutely. Thanks, Saket. First of all, we're really seeing strong reception to our transition across the board, like I said, customers, partners and employees. With regards to the mix, I would say it's about a 2

[Saket Kalia:]

Got it. That's helpful. Josh, maybe for you. Thanks for the guide on mix next year. I think you said it should be roughly a $39 million headwind. And if I remember correctly, I think the headwind here in 2020, I think, is about $45 million. So it's actually a smaller headwind next year. So I guess the question is, how are you thinking about that maybe given the increased sales focus on selling SaaS and subscription in 2021?

[Josh Siegel:]

Yes. Thanks, Saket. Well, basically, we are seeing -- we had a very big increase this year with that high headwind. And it jumped from, I think, 10% of our mix being SaaS and subscription to 35% for the year. And now we're talking about, in the guide, it jumping to high 40s in the first quarter, about 47% and a blended of about 55% for the full year. So I would focus on that mix, which then basically is really going to drive the AAR growth for the year, in 2021 as well. So when we look at the headwind, the headwind obviously will decrease a little bit compared to 2020 because we did almost a 2.5 times increase from 10% to 35% compared to the 35% to 55% this year. So we think we're very much right on the right track for our $8 million to $10 million quarter transition.

[Operator:]

Your next question comes from the line of Sterling Auty with JPMorgan.

[Sterling Auty:]

So with the imminent move to subscription. I'm wondering if you saw anything like what other companies like did where customers realize that subscription might be coming, perpetual might be going away, and maybe accelerated the purchase of perpetual in advance of that transition.

[Udi Mokady:]

Sterling, Udi here. I would actually say we looked at it carefully, and I think the overperformance in Q4 is very much execution on deals that were in the pipe. And so it wasn't a scramble. This is your last shot. Because I think the way we position it, again, they'll be able to buy perpetual going forward, but they'll be incentivized towards the SaaS and subscription. So it's really been execution on that strong pipeline we've been building.

[Sterling Auty:]

All right. Great. And then, Josh, one for you. Can you remind us under ASC-606, given the mix of the SaaS and subscription, how the revenue recognition treatment is for those 2 elements. And what I mean by that is, how much is still being recognized upfront because of certain amount being on-premise. And also, maybe what is the average duration of the maintenance contracts that you've had historically?

[Josh Siegel:]

Yes. Right. Thanks, Sterling. So with regard to 606, with regard to our ongoing subscription term-based license that we've been selling for the last 12 months. It's really around -- it's going to be 50% upfront in 2021 and 50% over the term of the contract. And as we move more and more into customers, buying our newer subscription packages, which are going to include SaaS components, integrated into the subscription, then it will be moving down from the 50% level. And it depends on really how much of the SaaS components they buy in the subscription. So 50% will be the most that we'll recognize on day 1. But it could go down into the 40s or into the 30s as they pick up SaaS subscription packages that have more and more SaaS components. With regard to the second -- with regard to duration, we're about 2 years on duration, average duration for the maintenance contracts.

[Operator:]

Your next question comes from Jonathan Ho with William Blair.

[Jonathan Ho:]

Congrats on the strong results. I just wanted to start out with some of your comments that you had on solar wins. Can you talk about maybe what you're seeing from the customers? And what the typical cadence or timing is for a breach like solar wins to maybe translate into revenue?

[Udi Mokady:]

Absolutely, Jonathan. I think as industry veterans, we can both agree that this is one of those pivotal major events. I think every 5 or 10 years, we have an event that shapes the industry, and this is one of them. We were leveraging the virtual environment, actually meeting more and more customers, CISOs and CIOs. And first of all, they all understand that this attack demonstrates that you need and assume breach mindset. The attacker will get that initial foothold and how do you protect deeply inside and that attackers want Privileged Access because they want to undermine all of the other controls like the attackers did here. and attack tier 0 assets and undermined and went after trying to be a regular identity in the environment. So I think we're very much part of that second wave, the first response was to run patches. And of course, those that were directly affected. Look, if they had the malware installed. But the second wave, which we believe is the longer tailwind. And what we're hearing from our -- the advisory firm partners and from instant responders is really how do we invest in trust systems in our environment. Let's make sure that we have the deep controls in our environment to protect identity in what we call identity security. So that would be on infrastructure -- on cloud infrastructure. And then additional attention now to securing the DevOps and the DevOps pipeline because of how this whole thing happens. So I think we'll see a longer tail to this. But CyberArk with identity security is really right at the heart of creating that flight to trust.

[Jonathan Ho:]

Excellent. And then just in terms of, I guess, the R&D investments that you intend to make in 2021. Where do you see the most opportunities there? Are there specific product groups that you want to dedicate more funds to or add more features to? Just want to get some additional color on where that's going to head.

[Udi Mokady:]

Absolutely. I think we'll provide even more color in the Investor Day. But I would say we're doing the following. First of all, as Josh alluded, we are continuing to support the many on-prem customers, so to investing across the board in our existing solutions. We need them happy, successful, and like I said, protecting our base. And then the bigger investment is going towards our identity security platform, continuing to provide additional capabilities in SaaS-delivered identity security. So it's really in our SaaS platform. A lot of things have -- are being integrated on to onto a single modern SaaS offering that will serve our customers for many years to come.

[Operator:]

Your next question comes from the line of Fatima Boolani with UBS.

[Fatima Boolani:]

Udi, maybe I'll start with you. The SaaS portfolio has obviously significantly in the last 12 to 18 months, especially with the addition of Idaptive. So I'm wondering if you can talk to us about which particular products and/or SKUs within the SaaS portfolio, you expect to drive the bulk of the momentum and activity for 2021? And then I have a follow-up for Josh, please.

[Udi Mokady:]

Sure. Absolutely. And sorry for that wait there on the call. I think we're really seeing -- I mean if you look at Q4 and this past year, we're seeing EPM, Endpoint Privilege Manager, and also in the context of the prior question on solar wins. It's become the no-brainer solution for ensuring that endpoints, including servers, which were attacked in this case. Are in lease privileged mode and that we're preventing credential steps. So I would say, Endpoint Privilege Manager. Our privileged cloud, for sure, we're seeing really strong adoption of customers wanting to consume this as a service. And of course, our Access portfolio, which is, like you said, Idaptive, but includes additional components like Alero, that was born organically. And so this is -- it's going to be a big differentiator for us to have such a wide portfolio as we think of the new subscription offerings.

[Fatima Boolani:]

Fair enough. Josh, maybe shifting to you. You did touch on some of the cash flow dynamics should expect to see in the business. But I'm wondering if we can unpack some of the puts and takes around cash flow and cash flow trajectory, especially over the next 8 to 10 quarters as you undertake this transition. And also considering the maintenance revenue trajectory is going to look a lot different now that you are going to be emphasizing recurring subscription and term license. And so wondering if you could just sort of reconcile and help us with the trajectory of cash flow dynamics in the next 8 to 10 quarters of transition horizon. And that's it for me.

[Josh Siegel:]

Great. Thanks, Fatima. So to start off with, just to remind on the call, what we're looking at for the year is going to be somewhere around -- our non-GAAP net income margin should be similar to the cash flow to the cash flow margin. I think in the near term, there'll be some pressure on cash flow as it relates to duration and annual payments on the more -- on the increasing mix going to SaaS and subscription business. So I do think, in the past, we've historically been running at higher than our net income margin. And now we're talking about going closer to our net income margin. And I think that's where you're going to see the -- that's where the pressure is coming in to reduce from less maintenance contracts, which are frequently paid all upfront on -- what if it's multiple years -- to multiple years a SaaS and subscription contracts, which will be now paid more likely to be paid annually. But overall, we feel good about the cash flow margin relative to where net income will be. But -- and the duration that we're seeing of our SaaS and maintenance -- and subscription contracts are fairly similar on average to our maintenance contracts. It's just that there'll be more of them being paid annually as opposed to upfront.

[Operator:]

Your next question comes from the line of Brian Essex with Goldman Sachs.

[Brian Essex:]

I was wondering maybe if I could start with the strength that you saw in the perpetual. I mean really nice results there. How -- and I think you noted that 74% of license revenue was from add-on bookings, how much of that strength was, I guess, customers that may not have pursued a complete end-to-end solution coming back and rightsizing their rightsizing their solution, given the macro and elevated threat environment that we saw over the past year.

[Udi Mokady:]

Brian, Udi here. Absolutely, that's exactly the trend we saw that if throughout the year, those customers were taking, and I would say, the small first bite because of the uncertainty macro, they were expanding as it came towards Q4 and really going for what they really needed. And so we saw that both with new logos that landed throughout the year and had faster add on, and we saw that with add-on business in Q4, consuming more again, both -- we saw that both in both sides of perpetual and on the subscription side, but definitely, that's part of the overachieved on the perpetual side.

[Brian Essex:]

Got it. That's helpful, Udi. and maybe just a follow-up on the transition. Maybe if I could get a better understanding of when Salesforce incentives went into place and what the trajectory of transition to SaaS and subscription as a percentage of total license bookings you might expect? And I'd imagine it would be back half weighted towards the end of 2021. But just to maybe help understand how those -- how that migration may roll forward through the next fiscal year?

[Udi Mokady:]

Yes. Absolutely. So we -- I think the timing of announcing it to the world in November and getting the organization ready, really worked well for us. The entire team had gone through training, leading up to the end of the year. But we kicked off the year with a full kickoff, and that's when the full incentives and training went into play. And it's really exciting to see, I think, how the sales team and the broad team really embrace this transition. So obviously, we have 6- to 9-month sales cycles. And so like you said, we believe that the bigger mix shift will occur towards the back half of the year. That's the way to think about the bigger impact. We did see, as we move through 2020, a natural increase in pipeline of SaaS and subscription. So it's already bearing fruit for the first half, but the bigger impact is in the second half.

[Operator:]

Your next question comes from Rob Owens with Piper Sandler.

[Rob Owens:]

You mentioned some wins that you had with regard to that. I think relative to restaurant change, car manufacturer. Just curious, I know it's still early, but where you're seeing success, how competitive these deals are? Are these pre-existing customers and why you're winning in these?

[Udi Mokady:]

Yes, absolutely. I think there are probably 2 dimensions to talk about. One is the existing CyberArk customers. That we're always saying, if you'd have it, we would buy it from you. And so that's a dynamic we would, of course, are seeing the early fruits of and will be bigger into 2021 now that we trained the full team and everyone on the team can sell the full portfolio. But those customers trust us for Privileged Access Management. And while you've expanded, you can actually put security on our workforce, we want to expand with you. The second one is really actually creating that as a landing force and Idaptive came with a commercial team that we're expanding. And so I would say in both mid-market, but also in the enterprise as another way to land new accounts. Of course, the bigger lever and the bigger flag we lease is the existing strong CyberArk customer base, but we're also seeing some healthy good examples of differentiated selection of Idaptive because of its security foundation and the fact that they can then expand to the full CyberArk portfolio.

[Rob Owens:]

Great. And then secondarily, while we've all started with our calendar for your Analyst Day in March, I'm sure we'll get a lot of commentary around AAR and the transition. Prior to that, as we said, our '21 models, any guardrails around AAR growth that we should be thinking about?

[Josh Siegel:]

Yes. Rob, this is Josh. I think that I would probably -- we want to think about the mix shift that we talked about, which is going to be towards 55% blended for the year. And if I were to think about AAR, I would kind of use 30% is the right way to look at it. 30% growth.

[Operator:]

Your next question comes from the line of Andrew Nowinski with D.A. Davidson.

[Andrew Nowinski:]

I just want to start off with any large deals that you may have had in the quarter, anything abnormal in Q4? And were any of those deals, did they perhaps maybe pull-in from Q1? And into Q4? Or are they all expected?

[Udi Mokady:]

Actually a very normal quarter in terms of diversity. And hi, Andrew. A very normal quarter in terms of diversity in deal sizes, geographic mix and all of those. And so no in. This was execution on that expanded pipeline we've been talking about in the last couple of quarters, and that led to the overperformance.

[Andrew Nowinski:]

Okay. Great. And then I just wanted to maybe touch on competition in the space. There's certainly some chat around, inside partners looking to sell psychotic. I'm just wondering if you could comments on any of the competition you're seeing if that's changed at all in your space.

[Udi Mokady:]

Yes. I would say that our leadership in PAM has never been stronger. We recently shared in our internal kickoff, the continued strong win rates, the -- of course, the leadership in -- with the industry analysts. I would say, no big change in that competitive environment. Really CyberArk continuing through doing all the right things, innovating, expanding organically and organically to that full portfolio. What you alluded to from the private equity holdings, I think that's one of the things that our customers and prospects look at. They view this as mission-critical, and they want to partner with a company that's going to be there for the long run and that consistently invests in innovation. We use the term today of hacker innovation. I really think it's something to pause and think about. There is hacker innovation. So our industry has to invest in innovation. Hence, our investment in -- which I was asked about earlier, continued investment in 2021. And it's a differentiator in this market. This is a nice -- it's not a nice to have layer. This is a mission-critical layer. And that's with regards to the PAM market. Obviously, with our expansion into identity security, we're now playing in the adjacent opportunity. And of course, we're early there. But focused on the customers that put a preference on security. And lastly, DevSecOps is just a huge opportunity where -- it's probably about 1 additional player out there as we go after the DevSecOps opportunity.

[Operator:]

Your next question comes from Hamza Fodderwala with Morgan Stanley.

[Hamza Fodderwala:]

Josh, just one question for you. I wanted to follow up on your comment around AAR growth, thinking about it, maybe in the 30s to start with. If I look at the AAR growth directory this year, right, it's been accelerating in the 40s now, right? You mentioned, I think around 50% of your bookings were recurring, this year. You're saying 55% for next year. And you really -- like you're just starting to basically incentivize the sales force towards selling SaaS. So I'm just curious, like do you think that initial outlook is just conservative? Or is there anything else that we should be mindful of?

[Josh Siegel:]

Yes. Great question. I think the other thing that we need to be mindful of, we anticipate -- if we hit our mix shift that we're talking about, of 55% of the new license bookings coming from SaaS and subscription. Then we're confident for very high AAR growth on the SaaS and subscription side of the business. The one thing that we need to keep in mind, though, is there will be a drag on the AAR growth as it relates to the maintenance, which will be flat. And depending on what the mix shift is, there could even be a minus drag. So I think that's the 1 piece that the model needs to consider is, is the mix shift of -- is the mix of the bookings because that's going to also play into how much does the AAR from the maintenance contracts related to the perpetual goes up. But I would say that overall, we're looking at great growth on the SaaS and subscription side of the AAR, much higher than the 30%.

[Operator:]

Your next question comes from Gregg Moskowitz with Mizuho.

[Gregg Moskowitz:]

All right. I guess just first question for Udi, just from an ecosystem standpoint, where do things stand with respect to the number of certified professionals on CyberArk? And about how fast would you say that's been growing?

[Udi Mokady:]

So Greg, I actually don't have an updated number for you, but we've continuously been investing in that ecosystem and made it more and more accessible for our partners. So I think it's been growing every quarter. And next time around, I'll make sure to share a number of certified professionals out there.

[Gregg Moskowitz:]

Perfect. And then just for Josh, what are your expectations of SaaS and subscription adoption by companies that are based in EMEA and Asia Pac? How do you sort of see that evolving from here?

[Josh Siegel:]

Yes. Clearly, and I pointed out in our call, Americas contributed to the largest percentage of the SaaS and subscription business in 2020. But we've started already in the back half of 2020, starting to see it come in, in EMEA and in APJ. We're set up on the SaaS side across all the regions with regard to our data centers to be able to sell all of our SaaS products with local data centers in the regions. And we expect it to pick up into 2021 as we start to, one, really roll out the subscription packages, and the account executives get comfortable there. And two, of course, the incentive plan is the same incentive plan for the EMEA and APJ regions as in the Americas. So they will be -- they're going to be well incented to learn how to sell subscription and SaaS in those regions as well.

[Operator:]

Your next question comes from the line of Joshua Tilton with Berenberg.

[Joshua Tilton:]

I just wanted to touch on. You mentioned incentivizing the sales force to sell SaaS and subscription. Are you also disincentivizing the sales of perpetual and then also when you just talk to customers who choose to pick term, what are the reasons for not wanting to go with the cloud offering?

[Udi Mokady:]

So by the way, great question. And no, we're not disincentivizing the perpetual. We're incentivizing -- so it's the technique. We're incentivizing the SaaS and subscription. I would say it's still early to have like a lot of examples of customers on the fence. But again, like I said, there's a 2

[Joshua Tilton:]

That's helpful. And if I missed this, I apologize. But if you look at the SaaS business from 2020, could you possibly break out how much of that was Idaptive, and maybe give us a sense of what that business is growing at. And then also, did you just see the lower pricing relative to some of your peers maybe play in your favor during this macro environment.

[Udi Mokady:]

So I wouldn't say that lower pricing was the dynamic in Idaptive wins. And I think the portfolio in general is really considered the robust security-minded portfolio. But it's for the security for the security oriented buyer were really differentiated. And Josh, I don't know if we can give anything on the mix.

[Operator:]

Thank you. At this time, I will turn the conference back to Udi Mokady.

[Udi Mokady:]

Thank you. Thank you, Erica. And of course, thank you, Erica Smith and Josh Siegel here. I want to thank our customers, partners and employees for contributing to our record fourth quarter, and supporting our transition to a modern subscription company. I'm confident that as we execute our strategy, we will build an even deeper relationship with our customers and partners. Thanks, everyone, for joining today. Thank you.

[Operator:]

Thank you for participating. You may disconnect at this time.