The mix-shift towards shorter SaaS bookings represent a temporary headwind to CyberArk's (NASDAQ:CYBR) growth and profitability factor. Regardless, CyberArk's improved capabilities in the IAM space will drive sustainable growth in the long term. Alongside Okta (OKTA), CyberArk has positioned itself as one of the top players with the resources to acquire market share in the IAM space. I expect revenue growth to rebound in 2021. The expense headwinds to CyberArk's margins from the acquisition of Idaptive is also expected to improve. I will be reiterating my bullish outlook as I find the current valuation attractive.
Source: Gulf Business
The importance of privileged access management solutions is critical towards designing a robust security strategy across enterprises. CyberArk has acquired the right on-prem and cloud security capabilities to continue to dominate beyond the PAM space. Cloud security products like Alero, Privilege Cloud, and the SaaS deployment option of EPM (endpoint privilege management) and AAM (application access manager) will help enterprises migrating more workloads to the cloud. The recent acquisition of Idaptive extends CyberArk’s security capabilities into the identity management space. This will ensure CyberArk positions itself as one of the top vendors offering the best of breed platform that keys into the future of security, which is about Zero Trust (least privilege).
"By 2022, SaaS-delivered identity and access management will be the chosen delivery model for more than 90% of new AM purchases globally, up from 70%." - Gartner
The mix shift of renewals and new deals towards SaaS deployments will continue to impact revenue growth. The advantage of this shift is the sticky, recurring, and predictable nature of SaaS deals. CyberArk provided Q3 '20 guidance of $107-$115m, which represented a growth of approx. 3% at the midpoint. The market's unwillingness to gaze beyond the temporary headwinds to revenue growth has impacted CyberArk's momentum in recent quarters. Going forward, investors with the patience to stomach the volatility that comes with the shift to cloud bookings will find CyberArk attractive. This assumes CyberArk will maintain its leadership in the access management space by ramping its pace of innovation.
CyberArk is expanding the capabilities of its platform to position itself for the future. Besides the growing demand for its SaaS solutions, Idaptive will significantly improve CYBR's positioning in the expanding IAM space. Idaptive was created from the divestiture of Centrify. Idaptive brings capabilities in AI-powered SSO, MFA, lifecycle management, and endpoint management. The added capabilities from Idaptive will help position CyberArk as a modern identity platform. This positioning is important as more customers migrate workloads to cloud platforms. Given that Idaptive is a SaaS platform, it will add to CyberArk’s recurring revenue.
Compliance and governance licensing deals are still deployed on-prem. However, the natural trend as CyberArk expands its capabilities in the mid-market is geared towards the adoption of its SaaS solutions. This means gross margin will be temporarily impacted due to growing cloud hosting costs. Sales incentives have also been geared towards selling more SaaS deals. CyberArk has plans to expand its sales capacity to drive more growth in light of its added capabilities. This is expected to impact its operating margin going forward. Due to COVID-19 and the mix shift towards smaller SaaS bookings, billings and cash collection growth might be volatile. This will be temporary as cross-sell and usage expansion drive the average deal size and revenue growth heading into 2021. This explains analysts' growth expectations of 6.5% in 2020 and 18% in 2021.
CyberArk is cash flow positive, and its recent debt issuance strengthens its balance sheet. Heading into the last quarter of the year, the major concern will be industry consolidation and competition.
The trend in the cybersecurity space points towards the consolidation of some security segments. The access management segment is broken into identity governance, privilege access management, and access management segments. Players in the AM space are acquiring capabilities beyond their niche to broaden their scope. This weakens the positioning of niche players. Going forward, there will be more consolidation as market participants rush to build robust identity management platforms. CyberArk continues to observe favorable competitive displacements, which is reassuring.
"A competitive rip and replace deal for end point manager, a major U.S. insurance company chose CyberArk to secure more than 130,000 end points with our SaaS solution because of our enterprise scale to support the new work-from-home or work-from-anywhere imperative, as well as our ability to block ransomware and prevent potential theft at the end point." - Source - Q2'20 conference call
CyberArk has diversified valuation factors. The weakness of its growth factor will be temporary due to the growing volume of SaaS deals. CYBR is profitable (non-GAAP) and cash-flow positive. Its valuation isn’t too frothy. It is acquiring new optionalities in access management to drive growth. In addition to these, CYBR recently extended the capabilities of its remote users solution (Alero) to mobile devices. This helped secure six new patents to protect its competitive positioning in the PAM space.
Data by YCharts
Overall, CyberArk has strengthened its competitive moat. To drive multiples expansion, it needs to cross-sell its acquired capabilities from Idaptive. Accelerating growth won't be hard given CyberArk's strong presence in the PAM space.
Risks
Demand-side risk factors are favorable in the long term. CyberArk has sufficient cloud security capabilities to navigate the identity as a service (IDaaS) space. Margins are expected to contract in the short term. This might impact its EPS factor if revenue growth isn't above expectations. Lastly, competitive pressure will be a major concern as cybersecurity companies race to build a leading Zero Trust platform.
Conclusion
CyberArk has improved its positioning and growth options via the acquisition of Idaptive. The trend towards more SaaS bookings is only a temporary headwind to revenue growth. CyebrArk has the facilities to manage the SaaS transition. I expect CYBR's valuation to rebound heading into 2021.
