It’s a rough world out there, and companies are increasingly responding to IT threats with a “Zero Trust” approach that doesn’t rely upon location to establish access. That’s good news for a host of companies, including CyberArk (NASDAQ:CYBR), Okta (OKTA), and Microsoft (MSFT), and I like CyberArk’s decision to embrace SaaS in a bigger way, as well as buy its way into Identity Management as a complement to its Privileged Access Management core.
While I’ve long liked CyberArk, I’ve had issues with the valuation. When I last wrote about the company in June of 2019, I thought the valuation was “stretched”, and the shares have since fallen about 12% - significantly underperforming not only the NASDAQ, but both large security companies (Check Point (CHKP) and Palo Alto (PANW)) and small (Okta and Zscaler (ZS)). Even with concerns about COVID-19, the move toward SaaS, and competition, CyberArk still isn’t exactly cheap, but it’s at least cheap enough to be worth consideration.
A Beat Against Lowered Expectations
While CyberArk did beat expectations in the second quarter, it’s worth remembering that expectations have definitely come down this year (acceleration of the SaaS model, which hurts short-term reported revenue, COVID-19, and Idaptive’s impact on margins), and that management has a pattern of setting beatable bars with quarterly guidance. Even so, a 5% beat on revenue, with an 8% beat on license revenue, a 43% beat on operating income (over four points on margin), and a strong beat on billings are all positive relative to the alternatives.
Revenue rose 6% year over year in the quarter and was basically flat with the March quarter. License revenue declined 8% yoy and 7% qoq, hurt by both the SaaS transition and weaker new customer adds tied to COVID-19 (and, perhaps, competitors making inroads). Maintenance revenue rose about 22%.
Gross margin declined 230bp yoy and 140bp qoq, while operating income fell 36% yoy and 21% qoq, with operating margins down 1,050bp yoy and 430bp qoq. Margins were hurt at least in part by the revenue transition, as well as the Idaptive deal.
With the switch toward a more SaaS-based model, billings are growing in importance. Billings rose 18% this quarter (against a Street expectation of a 2% decline) and declined 4% qoq, while deferred revenue rose 30% yoy and 7% qoq.
The Move To SaaS Creating Headwinds, And Idaptive Will Pressure Margins
Given the difference in accounting between SaaS business models and perpetual licenses, CyberArk’s move to accelerate SaaS has come at the cost of meaningful revenue headwinds – faster than expected progress in the transition created about $9 million of revenue headwinds this quarter, with SaaS plus Term now at 25% of revenue after really only three quarters of concerted effort.
Recognizing that at least some enterprise customers in its core PAM market like perpetual licenses, they’re maintaining that option, but the core PAM offering for mid-market customers is SaaS and newer products like Alero and Endpoint Privilege Manager (and future new products) are SaaS-based.
CyberArk is also going to take a margin hit from the decision to acquire Idaptive and invest R&D resources in the business. CyberArk acquired Idaptive earlier this year for $70 million, marking its first sizable acquisition since Conjur in 2017, and bought its way into the Identity Management space where Idaptive competes with companies like Okta and Microsoft with an Identity-as-a-Service offering.
Idaptive is a small player (around $16M to $18M in ARR) in an addressable market worth approximately $7B, and I don’t believe CyberArk really intends to go head to head with Okta, or at least not right away. With the move toward Zero Trust architectures, there’s a growing convergence between offerings like Privileged Access Management and Identity Management, and it makes sense to me for CyberArk to broaden its capabilities in view of that convergence. Still, investing in the Idaptive platform is going to come with literal costs, and that has negative near-term implications for margins.
PAM Remains A Core Space
Nothing I’ve seen lately has meaningfully altered my enthusiasm for CyberArk’s core market and product portfolio. Security remains a very high priority with corporate CIOs, and third-party CIO surveys have likewise indicated that Identity/Access Management and Privileged Access Management remain high priorities for spending – which makes a lot of sense in the context of similar surveys that indicate that the large majority of enterprises who aren’t operating Zero Trust architectures are intending to deploy/build them within the next two or three years.
Sure, CyberArk faces competition, and I’m sure I’ll hear in the comments again about this or that small player who is going to “destroy” CyberArk; I’ve been hearing those comments for several years now, and last I checked, CyberArk is far from destroyed. And it certainly doesn’t help the bear argument that CyberArk’s license revenue shifted more towards existing customers signing up for add-on products (around 75%) than the typical norm (around 60%). Still, I think that dynamic had a lot more to do with the restraints created by COVID-19 in terms of sales and marketing efforts, and I believe new customer growth will re-accelerate as the COVID-19 burdens ease over the next year or so (hopefully…).
The Outlook
Although COVID-19 and the conversion toward SaaS both disrupted my model on a short-term basis, not much has otherwise changed (2019 revenue and adjusted FCF were both about 5% ahead of my expectations), and I’m still looking for long-term revenue growth in the mid-teens, with improving scale eventually driving adjusted FCF margin into the 20%’s, which in turn should drive high-teens long-term annualized adjusted FCF growth.
The Bottom Line
CyberArk still isn’t exactly cheap. I do believe the shares are priced for a high single-digit to low double-digit annualized return on the basis of discounted cash flow, while I think the company’s growth and margins merit a forward revenue multiple of around 8x. While the shares have absolutely lagged over the past year or so, I’m tempted to buy in – no, the valuation isn’t great, but you don’t often get a great buy-in price for good secular growth stories. CyberArk would definitely be vulnerable to a broader correction in tech, but with the shares having already underperformed, perhaps they’d be less vulnerable. In any case, while this is a borderline call, it’s a company I’ve liked for a long time and am tempted to buy relatively soon.
