CyberArk Software Ltd.

Hello, and welcome to the Q3 2021 CyberArk Software Limited Earnings Conference Call. All lines have been placed on mute to prevent any background noise. After the speaker's remarks, there will be a question and answer session. If you would like to ask a question during this time, simply press star, then the number one on your telephone keypad. If you would like to withdraw your question, press the pound key. Thank you. I would now like to turn the call over to Ms. Erica Smith. Please go ahead, ma'am.

Thank you, Lisa. Good morning. Thank you for joining us today to review CyberArk's third quarter 2021 financial results. With me on the call today are Udi Mokati, Chairman and Chief Executive Officer, and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open the call up for a question and answer session. Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management's best judgment based on currently available information. I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operations for the fourth quarter in the full year of 2021. Our actual results might differ materially from those projected in these forward-looking statements. I direct your attention to the risk factors contained in the company's annual report on Form 20F, filed with the U.S. Securities and Exchange Commission, and those referenced in today's press release that are posted to CyberArk's website, as well as risks regarding our ability to actively transition the business to a subscription model, the duration and scope of the COVID-19 pandemic, its related impact on global economies, and our ability to adjust in response to the COVID-19 pandemic. CIDARC expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements. Additionally, non-GAAP financial measures will be discussed on this conference call. Reconciliations to the most directly comparable GAAP financial measures are also available in today's press release, as well as in an updated investor presentation that outlines the financial discussion in today's call. We also want to remind you that we provide the calculated headwind calculation for additional color on the impact of our subscription bookings mix shift, but it should not be viewed as comparable to or a substitute for reported gap revenues or other gap metrics. A webcast of today's call is also available on our website in the IR section. With that, I'd like to turn the call over to our Chairman and Chief Executive Officer, Udi Mopati. Udi?

Thanks, Erica, and thanks everyone for joining the call. Q3 was another amazing quarter and we are thrilled with our results. If I could use only one word to characterize this quarter, it would be acceleration. Acceleration in the demand environment, in the underlying growth of the company, specifically bookings, and in the metrics that demonstrate the health of the business. As examples, subscription ARR growth accelerated to 131%, reaching $139 million. Total ARR growth accelerated to 38%, reaching $344 million. Recurring revenue growth accelerated to 41%, reaching $89 million, and new logos added during the quarter accelerated to over 230. Our standoff performance in Q3, following an incredible second quarter, was again driven by record SaaS bookings, record total bookings, the execution of our subscription transformation, and robust demand for our identity security platform centered on privilege access management. Customers are embracing the subscription model, as evidenced by 72% of new license bookings coming from SaaS and subscription in the third quarter, ahead of our guidance framework. Even with the revenue headwind from this mix, we generated total revenue of $122 million above our midpoint, demonstrating again that our bookings were considerably higher than anticipated in our guidance. One way to think about the growth of the business is to isolate the license line adjusted for the calculated revenue headwind. This would represent license growth of faster than 50% year-over-year, which is indicative of our overall growth. Simply put, it was a stellar quarter. As we have talked about throughout the year, our subscription myths, ARR, and recurring revenue demonstrate the progress in the subscription transition and the strong demand for our SaaS solutions in particular. The four pillars of growth, subscription transition, innovation, and profitability provide a great backdrop for today's discussion. Let me start with growth. I love starting here because our growth trajectory has never been stronger. Excellence in our execution and the strong secular tailwinds of digital transformation, cloud migration, and attacker innovation contributed to the acceleration in our business. With the acceleration in attacker innovation, our customers now contend with operator-driven ransomware, malware as a service, and attacks on automation and supply chains and the DevOps pipeline. It is no longer enough to have an assumed breach mindset. Instead, enterprises have to dig deeper and take an assumed identity posture. They recognize that every identity across viewing users, applications, and bots can be privileged under certain conditions. it is easy to see why customer and prospect interest in our solutions is at an all-time high. Looking at our geographies, we have another perfect game across our major territories. When you adjust for the calculated revenue headwind, every region grew total revenue by over 27%, with license revenue obviously growing even faster across the Americas, EMEA, and APJ, which Josh will talk about more. New business accelerated, and we added more than 230 marquee customers, as I mentioned, from law firms to software companies, oil and gas to retailers, to large government agencies. We want customers across the spectrum, demonstrating that every organization, regardless of size or vertical, needs our identity security platform. We typically land with PAM, and momentum for Privage Cloud continues to build, both in the mid-market and much deeper in the large enterprises. In fact, in the third quarter, a Fortune 30 company signed our largest annual contract for Privage Cloud ever, a great win that demonstrates the increased adoption we are seeing in our enterprise customer base. With our subscription model resonating and SaaS taking off, customers are adding both more users and more products faster. And for customers with large self-hosted footprints, they are expanding with Privage Cloud to secure new business units, the DevSecOps pipelines or applications, Endpoint Village Manager, or EPM, has another record quarter as the crippling effects of ransomware continue to drive demand. Not only is EPM an expansion opportunity within our customer base, but it is also proving to be a great landing spot for new logos like a large food retailer, a bar-in-the-cloud software company, and a large local school system, to just name a few of the Q3 wins. The increased focus and specialized resources from the Access and DevSecOps speedboats continue to pay off this quarter. Productivity levels increased in all regions, and our cross-sell activity has improved considerably. Access has another strong growth quarter in Q3, with both exciting enterprise wins in our base and a broader set of customer wins in our commercial and emerging markets. I will talk more about our innovations in a few minutes, but identity security, where Access is tightly aligned with PAM, is differentiating Cyborg with customers. I want to highlight a few more customer examples from the third quarter. In a highly competitive deal, an existing financial services customer wanted the benefits of our identity security platform and will be replacing a legacy access solution with CyberArk Identity. A new financial services customer will be using PrivX Cloud and Conjure to secure secrets. This organization recognized that securing both human and non-human access was critical, particularly as every company becomes a de facto software company. Our ability to secure applications anywhere is giving us a nice competitive edge in the DevSecOps space. A high-profile pharmaceutical company bought Privileged Cloud, but more importantly, is committed to implementing a comprehensive identity security program, and PAM is just the first step. A large insurance company expanded with every one of our solutions. They began their journey with Cybark in 2010, expanding their privilege access program along the way. In Q3, they went deep and broad with Cybark, embracing our identity security platform, buying secrets manager, privilege cloud, remote access, endpoint, workforce identity, and cloud intelligence manager. We pride ourselves on our culture, building strong, lasting relationships, and putting the customer at the center of everything we do. This win demonstrates the power of our portfolio, and it shows the criticality of our relationships with enterprise customers. Our partner ecosystem is further extending our reach and driving scale in our broader market. Our certification programs have been stepping up as we focus more and more on leveraging our partners to drive growth. Here today, through Q3, we certified close to 20% more professionals than we did in the full year 2020. This commitment to invest in comprehensive training programs is a testament to the opportunity and significant growth our channel partners expect. A number of our partners are going even deeper into identity security and acquiring companies, including the Herzog Group and CDW, making strategic acquisitions in our space. Next, I would like to focus on the subscription transition. We made strong progress and outperformed our expectations in the third quarter. Our transition continues to be driven by strong demand for our SaaS solutions, and we reached another new record for SaaS bookings with particular strength in Privileged Cloud and Endpoint Privileged Manager. We have completed three quarters of our active subscription transition, and the number of customers with over $100,000 in ARR is now more than 760, growing faster than 40% year over year. As we expected when we began the subscription journey, customers are getting faster types of value and prioritizing our platform, which will result in higher lifetime value over time. We are thrilled with the progress of our subscription transition and with our success year to date, we are confident we will exit the transition by the third quarter of 2022. Our innovation pillar is the foundation of our strategy. continues to put more distance between us and the competition, and further strengthens our leadership position. We announced earlier this week the general availability of Secure Web Sessions, a workforce and customer identity solution. Secure Web Sessions merges the worlds of Access and Pan. We are now the only vendor in the market that can empower customers with continuous authentication and session protection, including session recording for all types of web applications, from business apps to cloud consoles. We are pleased to see our innovation recognized by industry experts. We were named a Leader in the Forrester Wave Identity as a Service for Enterprise and an Overall Proven Access Management Leader by Kuperinger Co. And just yesterday, we announced that we were named the only visionary in the 2021 Magic Quadrant for Access Management. We believe we have the undisputed leader in town and are leveraging this position to extend our expertise into access. I will wrap up my discussion with some comments on the profitability pillar. As you have already seen from the acceleration in our business, our investments are paying off. The headwind on profitability from the subscription transition is obscuring the P&L. Given the strength of our bookings, which gives us more scale and our track record of delivering profitable growth, we are well positioned to return to strong profitability levels. To sum up Q3 quickly. Our business is accelerating on the back of record year-over-year bookings growth. SaaS is leading the way and reached a new record quarter this quarter. Privileged Cloud is pushing into the large enterprise, and EPM has moved into the mainstream security discussion. Our subscription transition is making strong progress. Our industry-leading identity security platform across PAM, Access, and DevSecOps has never been more relevant. I will now turn the call over to Josh who will discuss our financial results in more detail and provide you our outlook for the fourth quarter and full year 2021. Josh, over to you. Thanks, Udi. Before we discuss the details of the quarter, we would like to remind you that we posted slides to the website that will be helpful as we walk through our results. As Udi mentioned, we had a great third quarter. Our license bookings growth meaningfully accelerated even in comparison to a strong Q2 2021. We also made significant progress executing both our subscription transition and our identity security strategy. In terms of the headline P&L, we delivered total revenue of $121.6 million with a 72% mix of subscription bookings ahead of our guidance framework of our 70% mix. As you may remember from last quarter, revenue above the midpoint of our guidance and a higher subscription bookings mix demonstrates that our total bookings beat our expectations for the quarter. Subscription revenue, which includes our staff and on-premise subscription revenue, reached $35.3 million and represented 29% of total revenue in the third quarter, increasing in 143% 14% of total revenue in the third quarter of last year. Our maintenance and professional services revenue was $63.3 million, with $53.6 million from recurring maintenance and $9.6 million in professional services revenue. We continue to have strong renewal rates on our maintenance renewal business. Recurring revenue, which includes our subscription and maintenance related on perpetual license revenue, reached $88.9 million, or 73% of total revenue, growing 41% year-on-year from $62.9 million and 59% of total revenue in the third quarter last year. With a 72% mix of subscription bookings, it is clear the subscription transition is a Economically, the headwind created by the mix was approximately $16 million in the third quarter when we compared like-for-like to the mix in the third quarter of 2020. Normalizing for the mix shift, growth in the license portion of our business, our SaaS on-premise subscription, and perpetual accelerated again in the third quarter to over 50% and is illustrative of the underlying growth in the business. Taking the calculated revenue headwind into consideration, total revenue growth accelerated to 29% year-on-year. Moving on to the annual recurring revenue, we experienced our largest ever sequential increase in the subscription portion, adding about $29 million in the third quarter and reaching $139 million, representing over 40% of the total. Our total ARR was $344 million, at September 30th. We had another great new business quarter, both in terms of new logos and business trends. We signed more than 230 new customers, with 85% of them opting for a subscription compared to about 59% in the third quarter of last year. New business deal sizes also increased again in the third quarter. Geographically, the business continues to be well diversified. The Americas generated $68.2 million in revenue, representing 56% of total revenue. The Americas, again, had the strongest percentage of subscription bookings during the quarter. EMEA had $39.7 million in revenue, or 33% of total. APJ generated $13.7 million in revenue, or 11% of total revenue. If we look across the geographies adjusted for the calculated revenue headwind created by the mix, each region would have grown by over 27% in total revenue, with our license line growing even faster than 50% in the Americas in APJ and approximately 30% in EMEA. All line items of the P&L will now be discussed on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release. Our third quarter gross profit was $102.5 million, or an 84% gross margin, consistent with the 84% gross margin in the third quarter last year. We continued to make investments to drive innovation and growth, resulting in operating expenses of $102.4 million. That's a 34% increase year on year, and operating income was $130,000 in the quarter, which was better than the midpoint of our guidance. It is important to remember that our operating income is lowered by about $1.5 million from FX rates and approximately $16 million of headwinds. On a like-for-like basis, neutralizing the calculated revenue headwind and foreign exchange, our operating margin would have been approximately 12% in the third quarter of 2021. Over 70% of our operating expenses are related to headcount. So in the third quarter, we surpassed 2,000 cyber-market employees, ending the third quarter with 2,075 worldwide. Of our total employee count, 925 are in sales and marketing. Net loss for the third quarter was about $2.4 million, or $0.06 per basic and diluted change. In the first nine months of 2021, free cash flow was $47.1 million, or 13% free cash flow margin. This cash flow contributed to our strong balance sheet, and we ended the quarter with $1.2 billion in cash and investments. Turning to our guidance. Our guidance for the fourth quarter reflects the robust industry tailwinds, our record bookings, strong execution year-to-date, and improved productivity. For the fourth quarter of 2021, we expect total revenue of $140 million, to $148 million. We expect a non-GAAP operating income of about $5.5 million to $11.5 million for the fourth quarter. We expect our EPS to range from non-GAAP net income of $0.06 to $0.21 per diluted share. This guidance assumes about 68% of the subscription bookings mix and a calculated revenue and profitability headwind of approximately $28 million for the fourth quarter of 2021. So if you isolate our license lines of SaaS, on-premise subscription, and perpetual, the normalized growth rate taking into account the calculated revenue headwind for the quarter is about 24% year-on-year. Similarly, for the total revenue, the growth rate would be about 19% at the midpoint of the range, taking the headwind into account. Our guidance also assumes 41.7 million diluted shares. For the full year of 2021, we expect total revenue in the range of $491.6 million to $499.6 million. The mixed assumption underlying our guidance for the full year is 65% from subscription bookings, and our revenue headwind for the full year is now approximately $68 million. This represents an increase from our prior guidance, which assumed a mix of 64% from subscription bookings and a $63 million headwind to revenue. Taking the calculated revenue headwind into account, our revenue growth rate would be approximately 22% at the midpoint in the range. And if you isolate our license lines of SAF and subscription and perpetual, the normalized growth rate is over 30% for the full year, taking the calculated headwind into account. I want to emphasize that increasing both our total revenue guidance and our mix indicates that we are, again, increasing the bookings assumptions underlying our guidance for the full year. This raise is above and beyond the bookings fee in the third quarter. Now, moving down to P&L, we expect non-GAAP operating income to be between $13.1 to $19.1 million. We expect our non-GAAP net income per diluted share to be in the range of $0.11 to $0.25. For the full year, we expect about $40.9 million weighted average diluted shares and about $13.5 million in taxes. We wanted to briefly mention our current thoughts on the timing of the transition and on ARR growth. Given our success year-to-date, we expect to exit the transition earlier, and we now expect to complete the transition in the third quarter of 2022 versus the fourth quarter of 2022 as we outline in our August call. Also, given the acceleration of our growth and our record annual recurring revenue to grow about 37% year-on-year. That's an increase from our prior framework of 35%. The third quarter was a great quarter and another important step in the execution of our subscription transition and our identity security strategy. Our business is accelerating, which you see in our results, and recurring revenue growth rate. As we look ahead, we are in a great position to deliver long-term growth and profitability. I will now turn the call over to the operator for Q&A. Operator?

At this time, I would like to remind everyone, if you would like to ask a question, please press star, then the number one on your telephone keypad. Your first question comes from the line of Sackett Galea with Barclays.

Okay, great. Hey, good morning, guys, and thanks for taking my questions here. Hey, Saki, good morning. Hey, good morning, Udi. Udi, maybe just to start with you, it feels like you and the team have been talking about broader identity versus just privilege here a lot more recently. I was just wondering if you could just talk about how the non-privileged part of the business is doing. I know you touched on this in the prepared remarks, but maybe just go one level deeper. How is the non-privileged part of the business doing with access and and DevSecOps, for example. And to what extent do you think customers want to buy both of these parts of the portfolio? Does that make sense?

Yeah, absolutely. Sure thing. So I would say we're excited by the performance of all parts of the business and the fact that Privileged Cloud SaaS is leading the way. But as I mentioned, identity security and our message is really resonating with customers. If you look at the other elements, what you're calling the non-privileged, First of all, we had EPM have a record quarter this quarter, and it's proving to be also a new landing point, a landing spot for new customers, and really gets also the drivers that are related to Zero Trust and ransomware. And then when we look at the access to DevSecOps speedboats, they have the power of both appealing to our existing customer base and that is resonating with the identity security message, but also having that speedboat overlay effort that is getting them into new accounts and, again, into the upsell. More and more of our customers are buying the wide portfolio. I gave the example of the customer that bought all of our products. That is happening. And I would say that in every conversation and pipeline build, it's across the entire portfolio. I think with some of the bundling, they're actually getting a taste. of elements of access, for example, in early deals. And, again, I'm excited that, you know, the purpose access management piece is on fire and leads the way. And with the customer loyalty, we have the opportunity to upsell and get those new landing spots.

Got it. Got it. That's great. Josh, maybe for my follow-up for you, you know, it sounds like we're going to exit the transition process you know, a quarter earlier than what you'd originally expected. Can you just remind us sort of what that means from a mix or anything from a mix perspective or just anything we need to keep in mind from a modeling perspective, just kind of given that earlier exit?

Yeah, thanks, Zach. You know, I mean, the main thing is that when we talk about transitioning out of, you know, into a fully subscription company, we're talking kind of put the threshold at when we get into, you know, past 85% of our bookings coming from SaaS and subscription. So when we talk today about moving that quarter in from Q4 in the last call to now Q3, we're talking about kind of hitting that threshold of 85% or more of our bookings coming from SaaS. coming from SAS and subscription in the third quarter already. And what that means is that, you know, you'll continue to see, you know, the percentage going to perpetual, you know, decreasing, you know, particularly, you know, over next year. And then, of course, there will be, after that, kind of a tale of their amazing perpetual performance. It's really, you know, we set out a playbook at the beginning of the year, and we're really glad to be able to keep improving on that playbook quarter in, quarter out.

Absolutely.

Thanks very much, guys. Thank you.

Your next question comes from the line of Adam Borg with Stifel.

Hey, guys. Thanks so much for taking the questions. Maybe just on secure web sessions to start, it seems like an interesting product, and you talked about that in the prepared remarks I'm just curious, Pat, are there any particular users or verticals where you think something like this would be more demanded?

Well, absolutely. We're very excited about it. We see the proliferation of privilege, that you have more and more cases where a business user is actually privileged and the organization is worried about having no control over the session. So I would say one major part is IT-like functions in a business user, whether they're using HR applications or a business application like a Salesforce or a SuccessFactors and others. But then also the folks using web sessions for administrative-like functions like the web consoles and others. So there are elements that are IT-like and there are elements of business users. And in terms of verticals, we actually see it applying across verticals, all companies. Of course, the more regulated will tend to want to put those controls even faster. And the beauty of it is that it can run on any single sign-on solution. So it doesn't have to just attach to CyberArk, and it gives us the opportunity to sell the solution and apply these PAM-like controls to all companies that even have identity management in place.

That's really helpful. And maybe just as a quick follow-up, in the slide deck, you talk about the bookings by vertical. It's just interesting to see that over the last several quarters, banking and financials, it becomes a smaller part of the mix as other areas are growing faster and manufacturing stands out. So I'd love to hear more about what's leading to the success you're seeing in some of what I'll call your less traditional verticals. Thanks again.

No, absolutely. I think historically Cyborg saw the more regulated verticals jumping into the fray earlier. And the trend of the last couple of years is privilege access management and identity security considered best practice across all uh all verticals and and you see and you see a catch-up uh this quarter uh we saw energy uh uh the energy vertical global government uh manufacturing uh more more than uh more than doubled and and uh and so i i would say we're continuing to be applicable to all verticals there are some verticals that are that are in a faster uh catch-up uh catch-up mode And, of course, we have a very strong customer base in the financial sector, and that will continue.

Your next question comes from the line of Hansa Fadawala with Morgan Stanley.

Hey, guys. Thanks for taking my question. Udi, first question for you. I was wondering if you could comment a little bit about the growth and opportunity you're seeing in machine-to-machine identity in particular, just given the rise of open source tools. Any sort of comment there?

Yeah, and I wanted to add on my earlier answer before, where I talked a lot about the opportunity and our access to those people, that very much in the secrets management world, there's growing awareness definitely after SolarWinds, and like you mentioned, the proliferation of the DevOps pipeline as the place where attackers are going after people. And if you stole a human secret or if you stole a strong machine-to-machine type secret, you can get similar access or even deeper. And so it's definitely applicable to all companies, and we're seeing that grow. We see more and more customers also want to leverage the fact that they can buy our secrets management solution and leverage Privileged Cloud as a solution to attach to. And, of course, a lot of the self-hosted customers are expanding to the secrets management and will now consume this in the subscription model. So you're right. It's a growing trend where there's a proliferation of secrets. across applications and machines. And if we had these special glasses, we would see, yeah, a big proliferation of credentials on the human side, but an even faster and probably out of control on the development side and on the application side, and we're going after it.

Thanks a couple. Just a quick follow-up for Josh. Just on the ARR, How should we think about the puts and takes with subscription versus maintenance? And obviously, maintenance is going to be a bit of a drag just given the transition. So how should we think about kind of modeling that over the next few quarters?

Yeah, absolutely. We're going to see, you know, still a very high growth on the subscription piece of the ARR that we've been seeing. We saw it grow to 131% in the third quarter. And maintenance of the perpetual will kind of continue to trend kind of flat. And then at some point, you know, as we get to the transition quarter, we'll you know, go even could go potentially, uh, minus, uh, you know, uh, sequentially. So I think, uh, the way we kind of look at it is we can consider already the subscription piece of the AR business already crossing over the 50% in the, you know, in the first half of next year. Uh, today it's around 40% of the total AR, AR and growing to more than, uh, 50% of it in the first half of next year. And, uh, In terms of the exact timing of when the maintenance will start to go negative, it's later on in next year, and it really depends on the mix rate.

Super helpful. Thank you.

Your next question comes from the line of Rob Owens with Piper Sandler. Mr. Orange, your line is open, sir. Your next question comes from the line, Brian X with Goldman Sachs.

Hey, great. Thank you very much. Thank you for taking the question, and great to see the acceleration and results. I was wondering if I could follow up on Hamza's question, actually. You know, 4Q has historically been a relatively heavy perpetual license quarter, so maybe if you could gives a little bit more color around what the previous changes in incentive compensations to skew the efforts towards SAS, what the impact is with regard to what you typically see or have typically seen on the perpetual side, and then how do we think about progress with the install base with regard to kind of transitioning the SAS? What do you see in your pipeline and, you know, maybe any –

uh anything you can call out with with regard to potential volatility on a perpetual side in 4q so brian i'll start with your uh with your uh with your second piece i think the way we approach the way we approach this this transition was was always always do right by by the customer and uh and and follow the trend i think we were we were uh even surprised like i alluded to that the existing self-hosted customers are embracing and without us having to push them, they see that as part of their roadmap. So you see that in the right timing, they also consider and look for ways to adopt our Privileged Cloud solution. Some examples, and like I gave in the script, are some very large cyber customers that were self-hosted that bought our Privage Cloud for new business units or for M&A where they want to put these controls fast and up and running quickly. And others are excited to adopt other SaaS solutions like our EPN or Identity and look at Privage Cloud as the solution as they start to downsize their data center, but we will allow them to do it in the right time And, of course, every new solution out here has been SaaS, and we're seeing those adopted. In terms of the incentive, we, of course, put out the program at the beginning of the year, incentivizing the team to sell SaaS and subscription. With that, always do right by the customer. And so existing customers that... that have add-on business lined up for Q4, we're definitely expecting that. Yes, and I'll add, Brian, in addition, we set out, to what Rudy just said, we set out a clear playbook for transitioning and included the incentives to the sales teams, as Rudy just pointed out, but it also included a full-blown education package of how do we move through going from selling And for this year, we're really focused on incentivizing them to quote and to create new pipeline on the SAS and subscription, which, you know, has been definitely happening for us. We see the majority of our new pipeline coming out as SAS and subscription. And I think it's also indicative when we look at, you know, 85% of our new logos from the third quarter were Specifically around Q4, we do anticipate seeing more perpetual business in Q4. It's not really related to our compensation or incentive plans. It's just that Q4 is our largest quarter. And also we sell to enterprises, so there's typically budget flush and deals that are opening and closing in the fourth quarter, and those will be to us. to be more add-on deals with existing customers and adding on more licenses in their current install base, which is most likely going to be a perpetual install base. So we do expect to see in the fourth quarter a tick up in perpetual, but then again, as we go into next year, we'll start to see more and more in status of subscription And that hence our ability to move in our target to the third quarter of getting over 85%.

Got it. That's helpful. Maybe just real quick for a follow-up. Given the pull forward in expectation for completion of your transition, You know, thoughts on how you think about spending? I mean, you know, great innovation on the platform. We see the elevated R&D costs. Sales and marketing spend is, you know, also elevated relative to historical growth rates. But how do you think about, you know, when we might start to see an inflection back to kind of, you know, double-digit operating margins and better profitability given the shift in timeline forward?

Yeah, you know, I think, you know, it's basically a shift. I mean, you know, the way the mechanics work in a transition is going to be, you know, all the way through the transition quarter and the next one following is usually the drop of the operating margins and then one to two quarters after you're through the transition. So the faster we bring in the transition, then the faster we can get back there. But we can't control the fact that going through the transition to the you know, that quarter, it's still going to take one to two quarters afterwards before we start to see it rising from there. The rise is not going to be in a single quarter. It's going to be gradual over several quarters post that transition.

Okay. Very helpful. Thank you.

Your next question comes from the line of Jonathan Ho with William Blair.

Hi, good morning. I just wanted to, I guess, start with EPM. Just given the success that you're seeing there, is there any change to your thinking around how large EPM could be as a product area? I just want to get a sense for that.

Jonathan, it's one of the areas where, again, they're all our children, so we're excited about all of them. But EPM is one of those that has the best practice of reducing risk and removing least privilege, but it also is very effective against ransomware. So we think the opportunity is great. And we finally got to a point where the awareness is there for us to further step on the gas and and leverage this full attention. So I'm not going to refine the town numbers we put out there because we saw this opportunity, but it is maturing and, like I said, becoming a mainstream awareness of a strong and important control to put in place. both as part of a wider privilege access management program, but also standalone. We put things in place that also bring it more as a landing spot for us, both in how our sales team works, but also the type of channels that are expanding and taking us there, and even down to the mid-market with channels like CDW. that can bring this into the new market.

Your next question comes from the line of Jonathan Ruckhaver with Baird.

Yeah, good morning, and congrats on the strong performance. Udi, it's great to see the success you're seeing. I'm wondering if you could talk a little bit more detail about the adoption trends you're seeing in terms of new customer acquisition versus install-based expansion and what you're seeing in terms of those adoption trends across commercial versus large enterprise.

Yeah, I would say that we're very excited to see the acceleration in the new logos and And part of that is the solutions are more well than before. The attack surface is expanding, and we've built this record pipeline over the past 18 months that we're converting. I think we're seeing, in the lieu of the logos, more landing spots with EPM and, of course, with Access and with PAM. The speedboat structure really provides more subject matter experts to take the opportunity. And then, as I mentioned before, we have been investing in the channel and the channel programs, and those are paying off for those landings. So those include... CDW, but they also include doing more with AWS and others. Now, with regards to enterprise versus commercial, if I understood, it's really going after both. Enterprise has been our sweet spot, but with these expanded channels were able to go further down market. And it's moving from the highly regulated to the less regulated part of the mid-market, which is exciting.

And maybe you can talk about that push in the commercial. Where are you in terms of driving that enablement amongst your channel partners? Is this something that becomes more material as a driver to bookings as we look into 2022?

I think we want to excel in both. Enterprise is the holy grail for SideRock. It's where we're coming from, and we have the strongest customer base. But we saw that we can double down our efforts on the commercial without distracting the enterprise focus, again, because it's incremental types of channels and a focus team that – that is going after the commercial space. And so, yeah, you'll see it continue to be a major source of growth. But, of course, the larger deals and the larger ASP is coming from the enterprise part of the business, which is really embracing the identity security messaging and appreciating the innovation we put in place.

Your next question comes from the line of Roger Boyd with UBS.

Hi, thank you for taking my questions. I was wondering if you could talk a little more about the adaptive customer base and what you're seeing out of these customers in terms of their willingness to upsell to PAM and just general recognition of your strategy of a privileged access centered identity security strategy.

Yeah, absolutely. I think the biggest motion is upsetting the PAM customers on the access and our DevSecOps and secrets management. So that's, of course, the majority of our 7,000 customers and And we form those deep relationships where they're happy to explore covering that proliferation of privilege into workforce users, into their suppliers, into the third-party elements, and to secrets management. The motion of the pure adaptive customers from... From the acquisition, the most important piece over the last year was to make sure they're happy and growing, and then also introduce additional elements to them on the PAM side. But like I said, the bigger motion is expanding with our PAM customers across the portfolio.

Your next question comes from the line of Greg Moskowitz with Mizuho.

Okay, thank you for taking the question, and congratulations on a very good quarter. So, Udi, I know that existing customers have a loyalty incentive to move to SaaS, and with all the success that you're seeing with respect to the overall subscription transition, I'm wondering if you're also seeing more migrations from on-premise to SaaS. Thanks.

Okay, yeah, so we incentivize, obviously, our salespeople, but the number one thing is to follow and allow the customers to execute the strategy in their base. But, of course, they see the new bundled packages, and that's incentivizing them to look at our subscription, which really, even if they're an on-premise customer, to get more value with add-on business coming in the subscription packages. The move for an on-prem customer to move to SaaS is more gradual among the enterprise But we find ourselves pleasantly surprised, like some of the examples I gave in the Fortune 30, a customer that more and more enterprises are also migrating and taking on privilege cloud. We'll see that as a pathway over the coming years. And one of the strengths of CyberArk is really giving customers optionality on how to consume their data security portfolio.

Your next question comes from the line of Rob Goins with Piper Sandler.

Great. Thank you guys for taking my question, and I apologize for the technical difficulties earlier. I swear it wasn't user error. Rudy, in your prepared remarks, you talked about SaaS driving more users and driving more users faster. Is that a SaaS adoption comment, or is this democratization of privilege by SaaS and the fact that there's broader applicability now, especially given the attack surface?

I think we're seeing the classic benefits of SaaS where there's quicker time to value. A customer does not have to install and go through the process of taking care of the infrastructure, and we deliver success packages. And so they get up and running. They see it's working. They see that it alleviated a lot of – it gave them both security but also the ability to manage their infrastructure faster. And then you have a faster path to the upsell of more users of Privage Cloud or – or add-on business on other elements of the portfolio. So I would say that the benefit of faster time to value, faster time to innovation, and an overall quicker path to an add-on sale, but it's all very real inside. We put the customer in the center, and the entire organization is all about creating customer value.

Your next question comes from the line at the KT Tron with Oppenheimer.

Hey, guys. Great quarter. I guess now that you're getting close to the end of the transition, the big question is you're going to have a hard core of customers who are still stuck on perpetual and What is it that you're going to do about it? Meaning, are you going to terminate? What is the timeline by which you will stop offering perpetual? And what are the odds that midpoint or late next year you actually raise prices on your maintenance in order to push that last bastion of customers into the subscription model?

Yeah, I think our constitution puts the customer first, and that customer loyalty has really worked for us. I think it's going to be much more on the carrot side versus the stick. for them to see more value in the subscription packages, a taste of other elements of the portfolio as they pick up elements of the subscription packages. And overall, we're seeing that they are open to it, especially as they – They are on a maintenance renewal rate with CyberArk and are open to expand and take on the subscription packages. And of course, let's remember that maintenance is a great recurring revenue for us as well. And the opportunity is out there to gradually bring them on to the subscription journey and definitely to lead with SAS, to the SAS journey. And to the prior questions, that's where they're going to see even greater value in the transition. And I'm not sure if you want to add anything on that. Yeah, I think you covered the points, and the main issue is as they add on more and more sales, they're going to be really incented because of our great subscription packages to kind of move their current install base on add-on sales to be subscription-based. And it's also a form of a tech upgrade for them if they want to now reverse and get that same tech upgrade done. for their install based on perpetual. So, you know, we see it happening pretty naturally, but there will be a tail, you know, once, you know, for what is happening naturally as we see it today.

Your next question comes from the line of Catherine Trevnick with Collier Securities.

Oh, thanks for taking my question. Excellent quarter. Rudy, could you try to quantify the new business? How much is that really being driven by the acceleration for organizations to really undertake zero-trust architectures?

Yeah, sure, Erica. I couldn't give a number, but I would say that all the strong business drivers out there are business of zero-trust, and also the protection against ransomware are are strong drivers for our business. And even in the executive order and other elements, it's very clear that lease privilege and putting time controls is really a basic tenet to achieve zero trust. So I would say it's in every customer conversation, definitely at CIO and CISO level, they like the connection of how CyberArk with Pam at the center, but also the full identity security approach is part of them getting to a zero trust or executing on a zero trust framework. So it's a great driver on top of all the enablement we provide and, of course, the proactive protection they can get with With our solution. I always want us to be enabled inside because I think the beauty of this portfolio is that we both are a proactive security layer, but we're also really allowing them to get digital transformation going and connect to their suppliers, connect their remote workforce. allow their IT to transform and modernize. And so it's all part of the supporting tailwinds for us, but zero trust frameworks are right out there.

Your next question comes from the line of Joshua Tilton with Wolf Research.

Hey, guys, thanks for taking my question. For my first one, I was kind of hoping, when we think about the broader identity space, can you just comment on the demand environment, but specifically compare and contrast the demand for privilege access management versus the demand for access management? And maybe how does this compare to six months or even a year ago?

Yeah, so I would say a year ago, we didn't have this combined emotion of going after the existing customer base. I think we benefit from the two worlds right now. Where for a customer looking to put in that critical layer of privilege access management, Sidewalk is the market leader. Go to us. We have the go-to-market, the reach, and the opportunity to really capture that demand. And demand is as strong and the strongest I can recall. for privilege access management. Access is a new motion for us, but it's a huge growing market because of the need to enable digital transformation. And we can write it, and the way we're doing it is very much centered on our customer base. that trust us on PAM. So I would say they're both in strong demand. PAM is definitely the one that resonates the most with the CISO as a layer that they must have and need to present to the board. And I would say even a basic pillar of their cybersecurity strategy. So PAM is more of a cybersecurity to the rest of the portfolio, and Axis gets the driver of digital transformation and enablement, which is also here to stay.

Your next question comes from the line of task, Kuljaji, with Guggenheim Securities.

Yes, thanks for taking my question. Can you comment on your Fed performance in this quarter and any products that showed strengths in that vertical?

Absolutely. I would say the federal, for us, we didn't see the same levels of budget flush like in previous years. We mostly attribute that to the new administration and budget, but the awareness is stronger than ever. I mentioned the executive order that that touches elements of Zero Trust and these privilege and I would say a lot of engagement with various agencies and with our partners in the federal market. I can share that the global government vertical, if we look at it in a full bucket, grew more than 100% for us in Q3. And it's very much led by privilege access management as the major, I would say, grower in this segment, where many agencies, many governments still need to do the basics around privilege access management. I also mentioned that the SLED vertical, the state and local and education vertical, performed really well in the quarter.

Your next question comes from the line of Mike Sikos with Needham & Company.

Hey, guys. Thanks for squeezing me in here. First question, I just wanted to touch on the cross-sell motion. Obviously, we're talking about customers once they come to SaaS or subscription are incentivized to continue down that track with their add-on sales. Curious, do you guys have enough data at this point to give us a sense for that cross-sell motion where customers are typically going to next? What's the Where are they congregating to within CyberOrg's portfolio?

So it really varies. I would say that a PAM, a pure PAM customer would typically expand the EPM as kind of the next stage of a PAM program. You've secured servers, but you left your endpoints and exposed with overprivileged. So it's kind of the next step in a cross-sell and And I didn't mention earlier, but we're also partnering with the EBR and the XBR companies to actually make it so that the EPM lives together and nicely with our partners on that front. And then from that front, if they're executing on a PAM or an identity program, There's the expansion to secrets management because it's the other side of privilege, and then securing their applications, and then, of course, to access. And so I would say that if I had to generalize, that would be a course for a PAM customer. In a new account, we're actually seeing that we can land with multiple products as, again, the awareness of what's the best practice in PAM and the bundled elements of identity security we can land with more.

At this time, I would like to turn the call back over to Mr. Udi McCarty for closing remarks.

Thank you, Lisa. Thanks, everyone. I want to thank our customers, partners, and employees for contributing to our strong third quarter and supporting our transition to a modern subscription company. I'm confident that as we execute our strategy, we will build even deeper relationships with our customers and partners. Thanks, everyone.

This concludes today's conference. You may now disconnect.