CyberArk Q4: Emerging Cybersecurity Leader (NASDAQ:CYBR)

CyberArk (NASDAQ:CYBR) is a Privileged Access Management focused identity security vendor. The company has had a difficult multi-year period due to its transition to a subscription business model but is now beginning to flourish. Identity continues to be central to modern cybersecurity and CyberArk’s position as a leading PAM vendor positions it to capitalize on this.

The market has been slow to recognize the quality of CyberArk’s business, leading to chronic undervaluation. I fall into this camp as I have wanted exposure to the identity management market for a while and have always felt that Okta (OKTA) was the best opportunity. I never invested in Okta though because I have never felt comfortable with the issues the company has been having (sales and security). I have previously written about CyberArk, and while I have recognized that it is a solid company, I wasn’t sure about the threat from Okta expanding into PAM. It increasingly feels like CyberArk is more than equipped to thrive as unified identity platforms become the norm though.

Even with the recent price run up, CyberArk’s revenue multiple has room to increase further, supported by improving margins and accelerating growth. The combination of solid growth and a stable/increasing revenue multiple should see CyberArk’s stock continue to perform well going forward.

Market

Macro conditions remain difficult for CyberArk, but this is something that the company isn’t really talking about, as it doesn’t need to try and excuse its performance. Cybersecurity is a priority for customers, and within cybersecurity, identity is being given precedence. As a result, CyberArk witnessed increased demand for its platform in 2023. CyberArk’s business is also potentially being supported by its end market exposure.

Identity remains a critical attack vector and the proliferation of new identities, new environments and new attack methods is supporting demand. For example, CrowdStrike (CRWD) has suggested that approximately 80% of attacks exploit identity-based vectors.

CyberArk believes that different levels of control are needed to manage the risk of identities with varying levels of risk and complexity. To the extent that this is true, the importance of PAM is likely to rise overtime, enabling CyberArk to capitalize on its estimated 50 billion USD addressable market.

CyberArk

Within identity security, there is a trend towards the creation of unified platforms that provide IAM, PAM and IGA. CyberArk is primarily a PAM vendor, meaning that it tries to ensure that every identity (human and machine) is secured with the right level of privilege controls.

CyberArk believes that a siloed approach to IAM, PAM and IGA is suboptimal from a security perspective and as a result is adding to its identity management solutions. CyberArk wants all of its solutions to have components of governance, access and privileged control. While CyberArk plans on continuing to invest in IGA, it doesn’t appear to be fully pursuing the IGA opportunity in the near-term. The company has stated that if customers need to do a large-scale IGA deployment across environments, its partnership with SailPoint is a viable solution.

While MFA and SSO are important, CyberArk believes that they are no longer sufficient. As a result, CyberArk is trying to reinvent workforce identity by leveraging privileged controls and adding features like Secure Web Sessions, Workforce Password Manager, and CyberArk Secure Browser on top of MFA and SSO.

• Secure Web Sessions provide protection by enabling continuous authentication and delivering visibility into the actions taken by users within web applications.
• Workforce Password Manager helps customers to securely store, manage and share business application credentials.
• CyberArk’s Secure Browser helps customers protect against cookie harvesting and browser-based attacks. It is built with native integrations to CyberArk’s workforce capabilities and provides a gateway to all of CyberArk’s solutions.

CyberArk’s Endpoint Privilege Manager solution removes local admin rights and enforces least privilege on endpoints. This helps to defend against ransomware and stop credential theft. While EPM has seen solid growth over the past few years, CyberArk believes that there is still a large opportunity to cross-sell EPM across its installed base.

CyberArk believes that the rapid shift to the cloud has led to insufficient access control. CyberArk’s Secure Cloud Access solution brings privileged controls to the cloud, helping CyberArk to address developers, data scientists and engineering teams. SCA is one of CyberArk’s newest offerings, but it is reportedly performing well.

In terms of identities, developers are a high growth area and are also driving the increase in machine identities. CyberArk’s Conjur Cloud Secrets Manager helps to protect these machines while avoiding vault sprawl. Secrets Manager was a part of six of CyberArk’s top ten deals during the fourth quarter.

CyberArk thinks managing all users in the same way as highly privileged users provides it with differentiation. As a result, the company believes that its competitive positioning has never been better. Competition varies across products though. For example, there is generally existing competition in access management, whereas EPM is more of a greenfield opportunity. In the secrets space, CyberArk is competing with a range of tools, including open-source and hyperscaler native secret stores.

Financial Analysis

CyberArk’s revenue increased 32% YoY to 223 million USD in the fourth quarter. Growth was solid across regions, with the Americas growing 31% YoY, EMEA growing 33% and APJ growing 35%.

As a result of CyberArk’s business model transition, ARR and subscription ARR growth are both outpacing revenue growth. Perpetual license revenue has largely been eliminated over the past few years, leading to rapid subscription growth (self-hosted and SaaS). This process is largely complete now as over 95% of CyberArk’s bookings are coming from subscriptions.

CyberArk is guiding 209-215 million USD revenue in the first quarter, an increase of 29-33% YoY. For the full year 2024, CyberArk is guiding 920-930 million USD revenue, representing 22-24% growth.

The number of job openings mentioning CyberArk in the job requirements eased in the second half of 2023. This could be indicative of reduced demand, but there has been no impact on CyberArk’s business so far.

CyberArk signed around 340 new logos in the fourth quarter, with new logos increasingly landing with two or more solutions. CyberArk also now has over 1,700 customers with ARR in excess of 100,000 USD, an increase of 30% YoY. The cohort of customers with more than 500,000 USD ARR increased by more than 45%, to around 300.

This strong growth in larger customers is being driven by cross-selling and up-selling. The platform approach helps to secure CyberArk’s competitive position and should lead to reduced churn and greater revenue per customer over time, which will ultimately lead to improved margins.

The number of CyberArk job openings has increased rapidly in recent months, which suggests that the company expects demand to remain robust in 2024.

CyberArk’s margins are improving rapidly as its business model transition matures, and this process is likely to continue going forward. Customers adopting more products is supportive of margins and CyberArk is yet to reach the point where it has a large base of renewing subscription customers. This should reduce the burden of sales and marketing expenses, leading to further improvement in profitability.

Conclusion

While CyberArk’s revenue multiple has moved higher in recent months, I believe this is justified by a number of factors:

• CyberArk’s expanding portfolio of solutions
• Accelerating growth as the business model transition matures
• An imminent return to GAAP profitability
• Greater proportion of recurring revenue
• Strengthening competitive position

I would not necessarily rely on CyberArk’s revenue multiple expanding further, but the stock should continue to perform well with a stable multiple and continued strong revenue growth.