CyberArk Software Ltd.

Good morning. My name is Rob and I will be your conference operator today. At this time, I would like to welcome everyone to the CyberArk third quarter 2022 earnings conference call. All lines have been placed on mute to prevent any background noise. After the speaker's remarks, there will be a question and answer session. If you would like to ask a question during this time, simply press star followed by the number one on your telephone keypad. If you would like to withdraw your question, again, press the star one. Thank you. Erica Smith, SVP, Investor Relations and ESG, you may begin your conference.

Thank you, Rob. Good morning. Thank you for joining us today to review CYBORG's third quarter 2022 financial results. With me on the call today are Udi Mokadi, Chairman and Chief Executive Officer, and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open up the call to a question and answer session. Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management's best judgment based on currently available information. I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operation for the fourth quarter, fall year 2022, and beyond. Our actual results might differ materially from those projected in these forward-looking statements. I direct your attention to the risk factors contained in the company's annual report on Form 20F filed with the U.S. Securities and Exchange Commission and those referenced in today's press release that are posted to the CyberArk's website. CyberArk expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call. Reconciliations to the most directly comparable GAAP financial measures are also available in today's press release, as well as in an updated investor presentation that outlines the financial discussion in today's call. We also want to remind you that we provide the calculated headwind for additional color on the impact of our subscription bookings mix shift, but it should not be viewed as comparable to or a substitute for reported GAAP revenues or other GAAP metrics. A webcast of today's call is also available on our website in the IR section. With that, I'd like to turn the call over to our Chairman and Chief Executive Officer, Udi Mokadi. Udi?

Thanks, Erica, and thanks everyone for joining the call. We had a strong third quarter, demonstrating the durability of demand for our solutions and the momentum we continue to see in our business. A number of key metrics underscore the strength of our results. Subscription ARR reached $301 million, up from $255 million at the end of Q2, the largest sequential increase in our history. Total ARR reached $512 million, with growth accelerating for the third consecutive quarter to 49% year over year. While ARR remains the best metric to measure our success, the benefits of our subscription transition are kicking in on the top line, with total revenue growth accelerating again to 26% and reaching $153 million in Q3. It is important to remember that the subscription transition continues to impact our reported P&L. For the quarter, the mix was about 87%, significantly higher than the 72% in the third quarter last year, which created a revenue headwind of about $11 million. Normalizing the mix to the third quarter of last year, our total revenue line would have grown by 35% this quarter. With our strong execution year to date, the prioritization of our identity security platform, the demand for our SaaS solutions, and ongoing secular tailwinds, we are significantly raising our full-year ARR guidance to over 40% growth at the midpoint, which Josh will talk about later in the call. To frame our discussion today, we will focus on growth, innovation, and profitability. Starting with growth, strong secular tailwinds of digital transformation, the adoption of Zero Trust, and attacker innovation continue to push identity security to the top of chief information security officers' priority lists. With the heightened threat landscape, attacker innovation is front and center in our discussions, and privilege escalations continue to be a common denominator in the attack chain. Another growing challenge is the pickup of MFA fatigue, where attackers inundate a victim with prompts until the multi-factor authentication request is approved. The increased use of MFA bypass techniques has clearly demonstrated a need for a more robust defense strategy through an integrated access, PAM, and sequence management approach. This has been a strong pipeline generator for CYBARC and our identity security platform. Digging into our results, on the product side, momentum continued across our solution set. We were particularly pleased with the performance of CYBARC Identity, PAM, and the EPM in the third quarter. On the new business front, we had a strong new logo quarter, signing nearly 230 new customers. A few examples include, in a seven-figure rip-and-replace deal, a Fortune 100 retailer landed with PAM, Secrets Management, and EPM. This customer embraced the breadth of our identity security platform and will leverage CyberArk to scale its growing IT environment, help protect across human and machine identities, lock down thousands of endpoints, and protect against ransomware. The race to digitize is not just expanding the attack surface, but also accelerating the adoption of Zero Trust. And in Q3, we were chosen as the enterprise-wide foundation of a global manufacturer Zero Trust framework with Privileged Cloud and EPM, with plans to expand to Secrets Management. Based on a board-level mandate, a major born-in-the-cloud manufacturing company landed with Privileged Cloud and EPM, demonstrating that identity security is front and center in the highest-level strategic discussions. A European government agency landed with our workforce password manager to give all its employees increased security controls on their personal passwords from CyberArk with our deep expertise in PAM. This is just one example of the robust demand for workforce password management in recent months. Our subscription transformation is increasing the velocity of add-on business and cross-selling across the portfolio. This is contributing to the greater than 50% increase in the number of customers with more than $100,000 of annual recurring revenue to nearly 1,200 customers at the end of September. A few expansion examples include a leading energy company in APJ landed with PAM previously and is now expanding across the portfolio with EPM and Secrets Management as well as with additional Privileged Cloud users. In Q3, a large retailer became our second largest Privileged Cloud customer with a major expansion deal. bringing its ACV to well over a million dollars. A long-standing Fortune 500 PAM customer, who had expanded to secure Ansible with Secrets Management in 2021, further deepened its relationship with Cybark and Q3. As part of its Zero Trust initiative, this customer will lock down over 45,000 endpoints with EPM. We have spoken about it in the past. While the industry has been talking about Zero Trust for a few years, Enterprises today are increasingly executing zero trust strategies, which is contributing to our growth. Our channel program is key to our success, and partners continue to scale their identity security practices. We have added new routes to market, enhanced collaboration, and improved channel program efficiencies across our VARs, advisories, and MSPs. Moving on to innovation, the cornerstone of our strategy and leadership position in identity security. During the third quarter, we began taking our CYBARC Impact Customer Event on a world tour to 16 cities in 14 countries. In our discussions at these events, the new innovations we announced last quarter are gaining traction in the field. CYBARC Identity Compliance is now generally available and makes it easier for organizations to enforce and demonstrate compliance by continuously discovering access, streamlining certifications, and providing comprehensive identity analytics. In early October, we also rolled out a user-friendly way to help block the MFA fatigue technique from gaining unauthorized access to protected systems. Customers are also excited about Secrets Hub and Conjure Cloud, which strengthen our ability to secure both human and machine identity. Profitability is the final pillar I will discuss today. While our reported P&L continues to be impacted by the subscription transition, we haven't changed our investment approach. We are delivering excellent returns, including accelerated innovation, as well as a rapid revenue and booking growth. We continue to expect to be a Rule of 40 company as we move past the subscription transition dynamics. Before I turn it over to Josh, I wanted to update you on what we are seeing with regards to the macro environment. The broader macroeconomic uncertainty did not have a significant impact on our business in the third quarter, which you see in our nearly 50% growth in ARR, revenue acceleration, and the increase in our ARR guidance. Our solutions are mission critical and identity security is being prioritized. We have seen incremental FX headwinds and some large deals require incremental approvals, but this did not meaningfully slow down sales cycles in the third quarter. Our pipeline and demand are robust and we continue to watch the situation very closely and are analyzing the trends in our business more frequently. In closing, the top line benefits of our subscription transition are kicking in. and our identity security platform continues to gain momentum. Our performance, in particular our strong ARR growth, demonstrates that we are in the best competitive position we have ever been in. Given our experience and durability of our business, we are confident that we can execute against a multi-year durable growth opportunity and deliver best-in-class profitability and cash flow over the long term. I will now turn the call over to Josh, who will discuss our strong financial results in more detail and provide you with our outlook for the fourth quarter and full year 2022.

Off to you, Josh. Thanks, Udi. And as Udi just mentioned, we had a strong third quarter, which is reflected in our key metrics. Growth accelerated for the third consecutive quarter to 49% year-on-year, and ARR passed the milestone of over a half a billion dollars to $512 million. With our continued strong growth, we are on our way towards passing the billion-dollar ARR target. The subscription portion of annual recurring revenue reached $301 million. That's increasing 117% and now represents 59% of our total ARR. Just a year ago, the subscription portion was only $139 million and just 40% of total. The maintenance portion was $211 million at September 30th. Total revenue came in at the top of the range with $153 million. Total revenue growth again accelerated sequentially to 26% year on year. That's up 21% growth in the second quarter of 2022. Keep in mind that FX impacted our revenue and bookings growth this quarter about $2 million in total revenue and on ARR about $2.5 million. Moving into the details. Subscription revenue reached $74.2 million, growing 110% year-on-year, representing 49% of total revenue in the third quarter. Consistent with our move to a subscription business model, perpetual license revenue came in at $13.8 million. Our maintenance and professional services revenue was $64.6 million. That's $54.2 million coming from recurring maintenance and $10.4 million in professional services revenue. Recurring revenue reached $128.5 million. That's 84% of total revenue, growing 44% year-on-year from the $89 million in the third quarter last year. Subscription bookings mix came in at 87%. That's just above our expectations for the third quarter. Economically, the revenue headwind created by the mix was approximately $11 million in the third quarter when we compare it like for like to the third quarter 2021, when the mix was just 72%. Taking a calculated revenue headwind into consideration, total revenue would have grown by 35% year on year, validating that we continue to take market share in identity security. Geographically, the business is well diversified. The Americas revenue reached $94 million, representing 61% of total revenue. The Americas growth accelerated to 37%. EMEA grew by 10% year-on-year with $43 million, or 29% of total revenue. It's important to keep in mind that EMEA results were impacted by two factors. First, the higher subscription mix, and second, $2 million of currency headwinds. APJ grew by 13% to $15.5 million in revenue, or 10% of total. If we normalize for the mix, the Americas would have grown by 45% year-on-year, EMEA would have grown by approximately 21%, and APJ by approximately 25%. We are also pleased with the great progress APJ is making increasing its subscription mix, which now reached over 80% in the last quarter. All line items of the P&L will be discussed on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release. Our third quarter gross profit was $126 million. That's an 83% gross margin compared with 84% gross margin last year. We are pleased with our gross margin outperformance, in a large part because we have closely managed the expenses related to SAS. While we continue to make investments to drive innovation and growth, we are also demonstrating our ongoing operational rigor. Our investments resulted in operating expenses of $130 million, a 27% increase year on year, which resulted in a $4 million operating loss, still coming in significantly better than our guidance. One thing to point out, our headwind adjusted revenue growth rate of 35% is meaningfully outpacing our 27% operating expense growth rate. That's another proof point of the leverage underlying our business. We are still being impacted by the mix shift towards ratable revenue, which lowered our operating results. Normalizing for that mix, operating margin would have been positive 4% in the third quarter. As a reminder, this only level sets the mix to the prior year and not all the way back to the beginning of the transition. If you level set our mix to 2020, CyberArk is operating as a Rule 40 company today, which was part of our execution strategy. A guiding tenet of our subscription transition was to rigorously manage our business and expense level so that we continue to operate efficiently and invest productively. We are delivering on that. Net loss was about $2.3 million or six cents per diluted share for the third quarter, also significantly better than our guidance. We continue to attract and retain top talent. That's a testament to our culture, ending September with over 2,600 employees worldwide, including approximately 40 related to the acquisition of C3M, the majority of which are in R&D. We ended the quarter with about 1,100 people in sales and marketing. For the first nine months of 2022, free cash flow was $20.4 million, or a 5% free cash flow margin, which is meaningfully ahead of the free cash flow guardrails we set for the full year and demonstrates the strength of our subscription model. Now, turning to our guidance. Our guidance for the fourth quarter and the full year reflect robust industry tailwinds, strong execution, and our growing ARR base. For the fourth quarter of 2022, we expect total revenue of $169.9 million to $176.9 million, which represents about 15% year-on-year at the midpoint. And we expect a non-GAAP operating income of about $2 million to $8 million for the fourth quarter. We expect our non-GAAP EPS to range from $0.07 to $0.20 per diluted share. Our guidance assumes an increase in subscription bookings mix and that it still remains over 85%. The resulting calculated revenue and profitability headwind is expected to be between $17 and $18 million for the fourth quarter. If you normalize for the mix, our estimated revenue growth at the midpoint of the range is over 25%. Our guidance also assumes 45.8 million diluted shares and about $4.3 million in taxes. For the full year 2022, we expect total revenue in the range of $592.5 to $599.5 million. Our guidance assumes a revenue headwind of between $66 and $67 million, and the increase in the headwind reflects a higher mix and bookings assumption underlying our fourth quarter forecast. If you normalize for the mix, our estimated revenue growth at the midpoint is over 30%. We are very pleased to increase the midpoint of our headwind adjusted full year guidance range despite the increase in FX headwinds, which I will discuss in a minute. For the full year, the range for our non-GAAP operating loss to be between $24.5 million and $18.5 million. We expect our non-GAAP net loss per basic and diluted share to be in the range of $0.54 to $0.39. For the full year, we expect about 40.7 million basic and diluted shares and about $11 million in taxes. We are also increasing our full-year guidance for the annual recurring revenue, which we now expect to be between $552 and $558 million at December 31, or between 40 and 42% year-on-year growth, respectively. We are thrilled to raise our ARR guidance. It demonstrates the considerable strength we continue to see in our business. I did want to update you on our expectations for impact from FX. We can expect to see a full year estimated currency impact to ARR of about $7 million related to the pound and the euro, which is about $2 million higher than we discussed last quarter because of further currency movements. We also estimate the impact from currency moves will lower our recognized revenue by about $6 million, which is $1 million more than we discussed in August. These currency moves are already reflected in the guidance I provided a few moments ago. Moving to free cash flow. We anticipate that it will be about 6 to 10 percentage points above our non-GAAP net income margin over a 12-month period. Third quarter was another strong quarter. We are confident that demand for our identity security platform is highly durable. We remain focused on capitalizing on the massive opportunity in front of us that will deliver profitable growth and strong cash flow, creating long-term value for our shareholders. I'll now turn the call over to the operator for Q&A. Operator?

At this time, I would like to remind everyone, in order to ask a question, press star, then the number one on your telephone keypad. And your first question comes from a line of Seket Kalia from Barclays. Your line is open.

Okay, great. Good morning, guys. Thanks so much for taking my questions here and solid set of results.

Thank you, good to see you for a second.

Yeah, good to see you too, Udi. Maybe we'll just start with you. I was wondering if you could just talk a little bit about the performance of the business outside of traditional PAM. In several of your examples, I mean, there was EPM, there was Secrets, there was a little bit of Access as well. Maybe the question is, Udi, to what extent are these non-PAM products becoming landing points And how often are you able to cross-sell traditional PAM along with that? Does that make sense?

Absolutely. I think we talked about our excitement last time about having more landing points in our new logos, and we're increasingly landing with both Access and DPM, actually, as landing point for us, and then expanding back into PAM. which gives us a very strong durable growth opportunity. Of course, the majority of new logos are still landing with PAM, but then we see the huge opportunity in cross-selling them into Access and EPM. And, yes, we gave examples here also on the Access side, like the customer example with workforce password management and others, and the Speedbook is really working well.

Got it. Got it. That's great. Josh, maybe for my follow-up for you, I was wondering if we could just dig into maintenance ARR a little bit. You know, I think that's been up sequentially for a couple quarters. Can you just talk about sort of what's driving that, and how should we sort of think about when that realistically starts to decline sequentially?

Yeah, thanks, Seth. Thanks for joining the call. Yeah, we actually have done really well in the maintenance this year. Basically, it's because we're preserving still high renewal rates for those customers. But we do anticipate already, even in the fourth quarter, that we can see a small decline of a couple of million dollars in that maintenance AR. And we anticipate as we move into next year as well, we'll continue to see a decline on the AR pieces of the maintenance. As you can see from the transition that we're really reducing dramatically the bookings that are going towards perpetual business. And even across now, and I talked about it in my prepared remarks, even into APJ now area, we're well over 80% of the bookings going to SaaS and subscription.

Makes a lot of sense. Thanks a lot, guys. Thank you.

Your next question comes from the line of Hamas Fadarwala from Unknown. Please provide your company name, please.

Hi, this is Hamas Fadarwala from Morgan Stanley. Thank you for taking my question. So, Udi, just one question for you. It seems like the consistent theme in the last six or seven quarters has been the priority level of privilege access management is higher than it's ever been. And can you talk a little bit about how you are now able to attract customers that perhaps you weren't able to a couple years ago beyond the large enterprise in particular? You know, is it, you know, regulatory requirements? Is it, the fact that the SAS model is making it easier for you to go after those customers as new channels. Maybe just talk a little bit about how your, um, how the value proposition is now, uh, attracting a broader base today.

Sure thing. Good to speak to you today. So, so definitely if we were to plot the, uh, the demand drivers for cyber, we would, we would see them increase, uh, uh, over, over time and, and, uh, Privileged access management and identity security continuously rising to the top priority. I think the biggest drivers overall is the attackers and the attack landscape where almost any attack that you analyze

Ladies and gentlemen, we have lost connection with the speakers. Please stay on the line. We'll be back in a moment. Thank you. Thank you. © transcript Emily Beynon

All right, so sorry about that. Looks like there was a disconnect, and we're back in Hamsa. I'm happy to continue answering your question, Uri, here. So I talk about the growth drivers continuously growing over time and, of course, with attackers going after credentials and identities, the privilege access management and identity security really rising to the attack, the top of growth of priority list for our customers. And, of course, It became a cross-vertical opportunity where it's really across the board from that growth driver and, of course, additional growth drivers that we've been collecting over time, like regulations that you alluded to, like cyber insurance, and even answering insider threats. And then, like you mentioned, Hamza, the ability to deliver that in SaaS. is really making our offering accessible to a broad variety of customers out there. And of course, the global reach of our sales team and the channel enables that. We've been diversifying our channel, advisories, value-added resellers, and also MSPs to be able to answer that demand. So that combo is really working for us and puts us in that position of strength, both high priority in the CISO and the buyer list and execution strength. And again, sorry that we got disconnected for a second.

All good. Very clear. Thank you. Thank you.

And your next question comes from a line of Rob Owens from Piper Sandler. Your line is open.

Good early morning to you guys. Udi, I think you made the comments in and around the best competitive position you've been in some time. Can you talk a little bit about your win rates, I guess touching on where competition is, number one, and then number two, can you address size of land and if you're seeing that expand here versus what you've had historically given that you're bundling in or selling additional products? Thanks.

Yeah, I think we look across both PAM and across our offerings. We see that we're in a better position in terms of leadership and the acknowledgement by customers that any innovation is going to come from SideRack and, of course, the ability to consume and our delivery of everything in SaaS. So we're definitely seeing continued very strong win rates in PAM. CyberArk is the one invited to, of course, any PAM bake-off. And with the increased innovation and the broadening of our suite, we're just seeing that those continued win rates go up. So that's in PAM. In identity, we're just excited. Like for my prior answer, we saw ARR there double and we're continuously invited and being perceived as the differentiated security-driven identity solution. If you care about security and you want to address all identities, you go with CYBARC. And again, it's just a huge opportunity ahead of us in identity. And then with regards to deal sizes, I think over the last year, we've seen our deal sizes continuously walk up, particularly when we land with more products. I was asked earlier about how we land, our ability to land with identity and with EPM, but the most beautiful landing is when we land with multiple products.

Great. Thank you. Thank you.

And your next question comes from the line of Adam Borg from Stiefel. Your line is open.

Hey, guys. Thanks so much for taking the question. Maybe just for Udi on M&A, you made a few of these small talking deals with recently, you know, C3M that you referenced earlier. I was just thinking, just given all the changes happening in the broader identity landscape, your solid execution, potentially valuation dynamics, how you're thinking about M&A going forward and even appetite for larger M&A from here.

Yeah, I think we're a very strategy-first company. That's the approach that Clarence on our team is driving. And so we continuously map out the opportunities and look at build versus buy, and that's how we've been very prudent and very, I would say, deliberate in the acquisitions we've done so far. I think, as I alluded in the past, we think that in this environment, We're going to have even more opportunities of entry and things that will be applicable to us, but it would always have to be because it's dear to our strategy and it's dear to our customers. Right now, we really have a wide portfolio and our focus on delivering that to our customers. We'll always have that strong muscle of looking. for opportunities to exercise on those strategic opportunities.

Excellent. Thanks so much.

Thank you.

Your next question comes from the line of Shaul Al from Cowan & Company. Your line is open.

Thank you so much. Good afternoon, guys. Congrats on the strong execution and on guidance. Udi, one of the key takeaways you highlighted on your presentation under the key takeaways slide is, that kind of increased velocity of cross and upsells, customers coming back faster after the initial land. Can you put maybe some sort of a qualitative timeframe addressing that pace in between the initial land and then kind of the expand? And secondly, what's driving that accelerated pace? Is that the macro on the one hand or kind of strictly the model transition or both?

Yeah. In terms of what's driving it, it's really the ability for us to more of a platform selling and the fact that we have a platform that services the customer and of course in SaaS, their ability to realize quick time to value with us. an opportunity for both upsell and get faster into consuming our offering and then cross-sell with our solutions. And again, with an easier way for the customer to get to the value as they go with the cross-sell. And yes, like we mentioned, we saw it take 50% year-over-year, bringing us to now 1,200 customers with over 100K customers. in ARR, so we're excited about that. And, you know, it's our ability to address their needs that's driving them. We're much closer to them, and we have the telemetry to know how they're using the product and past investments in customer success. That's all been kicking in to increase that velocity.

Understood. And maybe, Josh, trends from a geographic perspective, U.S., EMEA, everything appears to be absolutely stable. Maybe just some additional color on what's going on, APEC aside.

Yeah. Thanks, Joel. Yeah, as I pointed out in my remarks, we had really good growth across all the regions. particularly when you consider kind of the mix shift changes that we saw in EMEA and APJ, where both of them now are selling well over 80% in SaaS and subscription and had kind of the largest headwinds. And even they are both at about 25%. In EMEA, we did have some FX hit, obviously, there in that region. So if you add the FX and if you add the mixed, the mix, then you would get to about 25% growth rate for EMEA on a quarter year-on-year basis. And overall, you know, I think the beauty of CyberArk, and you've been following us a long time, Shovel, is that we've been diversified along these same kind of lines of, you know, close to 60% in Americas and 30% in EMEA and the balance in APJ now for a long time. and we're seeing kind of all regions growing with the business.

Thank you. Well done. Thank you.

And your next question comes from the line of Eric Heath from KeyBank Capital Markets. Your line is open.

Hey, thanks, and congrats on an impressive set of results, Udi and Josh. I guess I'll ask on secrets management. Just curious what's been the customer response, particularly from maybe the developer crowd, if you will, on your recent announcements of your native integration with AWS's Secrets Management solution. And then if you could just kind of give us an updated view on the competitive landscape between yourselves and HashiCorp in the space, that'd be great.

Sure, and I love the question because we also had so much opportunity to see it on the road. I mentioned our impact on the road with customer events across cities. So we first announced our integration with AWS in July in our Boston event and then have been taking it on the road. And yes, we see, first of all, the relief on the security side where it relieves our security buyer from having to educate and force change on the developer and the developer is able to work natively. And similarly, we're hearing that from developers that Cyborg is now enabling them to adopt our secrets management without changing the way they work, and we've only just begun. We're going to take this to, we started with AWS, but we're going to take this to the other cloud platform, and we want to be that backbone that's central for the organization for both human and secrets. In terms of the competitive dynamic with Hashi, I think that's the prime competitor we see in that space, and we're coming in from those different motions. We come in through through security we come in from as the business driver is really we want to enable the developers but security want to secure the organization and we're having a great win rate and definitely within the strong customer base we have that opportunity for expansion we have some low hanging ways to land in the organization and deliver value and then we expand to their critical applications. But this will be continuously a competitive edge for us, the ability to be both trusted by security because of the strong platform that also serves humans, and then also be easy to adopt by the developer because they can work natively.

Your next question comes from the line of Jonathan Ho from William Blair. Your line is open.

Hi, let me echo my congratulations as well. One of the things that you talked about was MFA fatigue. Can you maybe give us a little bit more detail on how CyberArk helps solve that challenge for customers and maybe how often this is serving as a new driver for business? Thank you.

Oh, thanks Jonathan. It's actually brand new. I think for those who I would refer also anyone who wants to read, we put out a blog that analyzes the recent Uber breach and that's an example where, again, a A legitimate user was inundated by MFA and eventually ended up accepting the hacker challenge and that was the entry point. But beyond that, it was all about credential theft on the inside. So we see ourselves as really a big part of the solution both on the front end, and I'll talk about our solution for that, for the MFA fatigue. But even more importantly, being that backbone that even if you enter the organization, The CyberArk identity security platform will prevent the stealing of credentials, the lateral movement, the privilege escalation that, for example, was seen in that attack. And then because as a response to that, we actually were very agile and we rolled out functionality that Basically adds no friction to the user, but helps combat the MFA fatigue. It's a number recognition system where a user logging into CyberArk is shown a unique number on the login screen. And if you're not in front of the screen, if you're not a legitimate user, you're not going to be able to feed that and put the matching number into the CyberArk identity mobile authenticators. So it gives peace of mind to the security professionals that their end users can't just say accept. They have to be the right human in front of the machine to do that. So that specifically is our solution. Yes, we're seeing it as driving demand for we need a security approach to this identity challenge. It's not just managing identities. We need security companies to go after that. We're seeing that as part of the demand and it's a differentiator for the cyber brand. Thank you.

And your next question comes from the line of Jonathan Rookhaver from Cantor Fitzgerald. Your line is open.

Yeah, thank you. And congrats, guys. So, Udi, the question I have is around privilege controls like secure web session, dynamic privilege access. Just in terms of the opportunity, you might be seen to leverage those capabilities to drive new lands and then to potentially replace existing IAM solutions. And I realize that this motion is still early, and it's most likely a lot easier to just sell privileged cloud into greenfield opportunities. But what do you think that expansion opportunity led by those privileged controls?

That's a great question. It was part of our strategy to be the identity security company, to be differentiated on the fact that we come in and add security controls, even if you have an identity and access management solution. That's specifically to our secure web sessions. Like you said, it's early, but we're seeing that differentiated as a place for us to land and customers that have basic single sign-on in place. And then over time and upon renewal, we can expand with them to the broad identity suite and also the broad offering from CyberArk. Dynamic privilege access is a very lightweight way to add on to our PAM and the differentiator in the market where we give a very simple way to manage a modern environment. So it's in everything we do. It's in every, I would say, sales process today and gives us these offerings, gives us also a way to get a healthy premium over standard identity solutions and really push that strategy that this is the identity security vendor.

Yeah, that's helpful. A quick follow-up is related to channel. Could you just update us on the channel motion as it relates to your SaaS offerings and also what you see in terms of the opportunity to engage with SIs and public cloud providers beyond what you're doing with Secrets with the public cloud guys?

Okay, so it's been very strategic for us as we've moved through this whole transition in a SaaS first transition to bring our channel partners on board with us. It's in our training and in everything we do. It was central to our partner event around impact that our channels will be trained on the SaaS offering and that's what they expected. They also like the quick time to value that you get with SAS. And they're embracing the SAS solutions. And so I would say that that's across the full channel landscape, even all the way to the advisories. They get it. If the customer is consuming or adopting SAS, then there's a faster time to value. With regards to the SIs around the world, we're seeing them really vote with their seats, I would say, in our trainings and getting certified in the sense of, wow, Cyborg is really building a healthy long-term company here. and we can count on them to build a business practice. So they're building business practices around us, and they can see the same motion that we talked about here. The growth that we talked about today is also reflecting in their results, the ability to cross-sell, and all of that is reflecting. With regards to AWS, in addition to the Secrets Hub extending to the ability to work natively with AWS, we're active on the AWS platform. marketplace, like we mentioned in the past, and we continue to see that as a good way in expansion in deals complementary to our other partners, and we're seeing that marketplace momentum building up.

Your next question comes from the line of Joshua Tilton from Wolf Research. Your line is open.

Hey guys, thanks for taking my questions and congrats on the results. My first one is every vendor and identity seems to be scrambling to kind of replicate this complete identity platform that you guys have built. So maybe how is that helping you kind of evangelize the sale of a complete identity platform? And what specifically are you guys doing to capitalize on this lead that you have over the other vendors in the market?

Oh, great question. I think, and I mentioned it sometimes in my face-to-face meeting with investors, that I would not start differently with our journey. I mean, coming as the experts in PAM, tackling the most difficult problem in identity and the most sought-after attack vector for the attackers, and then expanding to identity and doing that all on the SaaS platform. is a unique CyberArk benefit. We really came into identity as a cybersecurity company versus coming to security as an identity management company. And we think that that's the credible and the right motion customers can tell when there's the cybersecurity expertise behind it. And of course, the leg up is there's a lot of disruption in our competitive base. All the private equity takedowns are causing a lot of distraction, both in patent vendors... Ladies and gentlemen, we have lost connection with the speakers.

Please remain on the line. Thank you. Thank you.

All right, so I think I pretty much wrapped up. Sorry about that. I think we pretty much wrapped up the question there, and we are definitely seeing that competitive opportunity and are stepping on the sales and marketing pedal, and again, in a prudent, smart way, like Josh was alluding to, to capture that opportunity. And a lot of it is also, I would say, in a flywheel effect with the customer base. We have a strong customer base. We have a strong... a channel base, and it gives us that flywheel effect to leverage.

That was great. I just have one follow-up if I could, and I apologize if it was already addressed, but how was your federal business in the quarter?

I wouldn't say that it was an – we didn't expect it to be an outstanding quarter. I would just say it wasn't outside, but the global government – continues to be about 10% of our business. I would say in general, we're seeing that the federal cycles can be a little slow.

Thank you very much, guys. Thank you.

Your next question comes from the line of Fatima Bouliani from Citigroup.

Your line is open. Fatima Bouliani, your line is open. And we'll move on to the next question from Atay Kidran from Oppenheimer.

Your line is open.

Hey, guys. This is Herschel on 3Ti. Thanks for taking the question, and congrats on the results. Thank you. I just wanted to ask about the cloud entitlements manager solution, which is still relatively new. How has early adoption fared here, and how large do you think this opportunity is relative to other solutions like EPM and Access?

Well, as we presented at our impact events, we actually view that as a component in a larger pillar that we call cloud-driven security, which we think is big. And that includes our solution for secure cloud access, everything that has to do with managing transparent and easy access to the cloud environments, the cloud consoles. With regards to CM, it's a component there. It's very much about about identifying over-privilege in cloud, and it's a lead-in to the rest of the solution in that pillar. So I would say, one, it's early, and two, it's going to be a component of a much larger pillar, which, yeah, definitely could be as big as EPM as we continue to evolve there on that pillar.

Got it. That's helpful. And then just on the product mix of METNU ARR for the quarter, were there any products that had a significant change in contribution when you compare it to 2Q?

No. I would say the subscription ARR split is like we discussed last time. They're all growing, which is the good news. I would say the FAM ARR is about 55%. EPM is probably about 20%, Identity is about 15%, and Secrets Management is about 10% of that subscription AR piece of the pie.

Got it. Thank you. Sure thing.

Your next question comes from the line of Andrew Nowinski from Wells Fargo. Your line is open.

Hi, this is Justin Donati on for Andy. Thanks for taking our questions. You talked a lot about your land and expand motion here on the call. So I'm just wondering if you could provide any update on either your closing rates or your pipeline between new versus existing customers.

Yeah, I don't know that I have kind of ready information there. I would say that we're building a robust pipeline on both fronts, and that's kind of our go-to-market approach. Our reps have a portfolio of both existing customers and new customers to go after, and, of course, leveraging the channel partnerships, the CQB lines that we have for for landing the new logos. I would just say it continues to be a robust, diversified pipeline.

Great. Thanks for the color.

And then maybe just as a quick follow-up, regarding your large customers, over 100,000 in ARR, can you just update us on how many solutions, on average, those customers are using? Thank you.

Again, I would say that you can easily have a PAM customer that exceeded that, but we value the most the landing and the growth that also includes a cross-sell. So the majority would have at least two products in the mix. And, of course, this is like the overall 100K ARR. We have some very significant ones and the large ones. we over time see them not just upsell, but also get cross-sell solutions in there.

All right, thank you. And your next question comes from a line of Fatima Boudani from Citigroup. Your line is open. There appears to be a problem with the line.

We'll go on to our next question from Trevor Walsh from JMP Securities. Your line is open.

Great. Hi, team. Thanks for taking my question this morning. Congrats on the quarter. Udi, you had a brief mention of Zero Trust as being an influencer and was wondering if you could maybe give a little color around how that influenced the strong performance, if at all, as far as new customer logos in 230 or so for the quarter, which was we thought was strong. So is there a dynamic there where that type of architecture around zero trust is actually driving those engagements on the identity piece? Or is that more maybe current PAM customers coming in and looking to support their zero trust plans with what they've already got going with you guys? I guess, how are those engagements happening on that zero trust front?

Oh, that's a great question. And I would say that it's happening in both. I see it in both Existing customers, when we do our executive briefing center with the customer base, they are replaying back to us that this is how they presented to their board and the management that PAM and identity security is part of their zero trust. How can you achieve zero trust with excess privileges? The least privilege motion is really critical to that. We hear that from the customer base, and yes, our field and channels are definitely seeing that it's part of the decision making in the land or in the pickup of the new logos. that they're looking for impactful solutions, again, to prevent breaches, prevent, in an assumed breach, prevent any lateral movement and massive impact of the breach, and as a way for them to show that they really reduced a massive amount of risk and executed on zero-trust strategy.

So, yes, it's definitely in both. Great. Thanks a lot.

And your next question comes from the line of Brian Cooley from Stevens. Your line is open.

Hey, guys. Thanks for taking my question here. So clearly you all have a lot of strong tailwinds driving momentum in the business right now. I kind of wanted to hone in on some and see if you could maybe just rank order what you see as kind of the three biggest growth drivers or tailwinds for the business right now and then kind of looking forward. maybe rank order, kind of what you see as Vegas growth drivers moving into 2023, if it's changed at all, you know, between, you know, whether it's multi-product adoption, new logos, or greenfield PAM wins with new customers?

Okay, so in terms of business drivers, I would really put up that it's considered, we're considered a must-have for achieving zero trust and preventing breaches. So you kind of love the zero trust and the attacker innovation and really having a meaningful impact there. That's in terms of business drivers and then definitely underneath that various areas where there's a compliance need, insider threat prevention. But attacker innovation and And I would say followed by digital transformation, like the attack surface is growing so much. And then how do we prevent breaches on that growing attack surface? That's from a business priority. I would say the result is go-to-market execution against this ever-growing demand. So we're a high priority, and we're executing, like I mentioned earlier, both on the channel front, our sales team in both new logos and add-on business, leveraging the speedboats that we put in place to upsell or cross-sell our speedboat solutions in secrets management and in identity, and we're continuously taking market share as we do this.

Got it. Thank you for that. It's helpful. And then just thinking about your efforts with the channel expansion, can you just help us frame up kind of what innings you think you're in on that front? I mean, it seems like it's clearly already driving an increase in new logo wins, an incremental business. I'm curious if you think we're kind of still in the early innings of that and whether it could potentially drive further acceleration from here. What percentage of new deals are the channel contributing to today?

I would say that in the past I talked about that we were like a notch one on really kicking off the channel opportunity. The team has really been executing well. I'm hearing from the CEO of our channel partners and I always love hearing that that we are in their top ten producers, the top five producers, and we want to continuously move up there. CEREC wants to be the top provider in terms of our business for our channel partners. And I think we continuously see that probably more than 70% of the business is with our channel partners. So it's a growing motion. Like I said earlier, it kind of has a flywheel effect. You see that as they succeed, they invest more, they invest more in training. We talked about the growth and the on the amount of CYBARC certified personnel. And so I would put something in the middle of the evening because we moved it along from our execution and really working with the best of the best across the world, but there's so much opportunity as we leverage this flywheel. And on top of everything I mentioned, we're in the early innings with the MSSPs, and that's a big opportunity.

Great. Thank you for the time. Absolutely.

And this concludes our question and answer session. Mr. Uri Mokati, I turn the call back over to you for some final closing remarks.

Great. Thank you very much. We had another strong quarter demonstrating durable demand for our solutions and momentum in our business. And as always, I want to thank our customers and partners and our dear global employees for being the cornerstone of of our success. Thank you very much. And again, I want to thank the team for the hard work and strong execution this quarter. Talk soon. Thank you.

This concludes today's conference call. Thank you for your participation. You may now disconnect.