CyberArk Software Ltd.

Thank you for standing by. My name is Jael and I will be your conference operator today. At this time, I would like to welcome everyone to the third quarter 2024 CyberArk Software Limited earnings conference call. All lines have been placed on mute to prevent any background noise. After the speaker's remarks, there will be a question and answer session. If you would like to ask a question during this time, simply press star followed by the number one on your telephone keypad. If you would like to withdraw your question, simply press star one again. I would now like to turn the conference over to Sri Anantha Vice President, Investor Relations. You may begin.

Thank you, operator. Good morning. Thank you for joining us today to review CyberArk's strong third quarter 2024 financial results. With me on the call today are Matt Cohen, our Chief Executive Officer, Josh Siegel, our Chief Financial Officer, and Erica Smith, our Deputy CFO. After prepared remarks, we will open up the call to a question and answer session. Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements which reflect management's best judgment based on currently available information. I refer specifically to the discussion of your expectations and beliefs regarding our projected results of operations for the fourth quarter, full year 2024 and beyond. I also refer to our expectations and beliefs regarding the integration of Vanify into our operations. Our actual results might differ materially from those projected in these forward-looking statements. I direct your attention to the risk factors contained in the company's annual report on Form 20-F, filed with the U.S. Securities and Exchange Commission, and those referenced in today's press release that are posted to CyberArk's website. expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. As a reminder, we closed the acquisition of Vanify on October 1st, so the results we discussed today are CyberArk on a standalone basis. We do not have any financial contribution from Vanify in the third quarter. Our guidance for the fourth quarter does include contributions from Vanify. Additionally, non-GAAP financial measures will be discussed on this conference call. Reconciliations to the most directly comparable GAAP financial measures are also available in today's press release, as well as in an updated investor presentation that outlines the financial discussion in today's call. A webcast of today's call is also available on our website in the IR section. With that, I would like to turn the call over to our CEO, Matt Cohen.

Thanks Sri, and thanks everyone for joining the call today. We are very pleased to post strong third quarter results, outperforming our guidance across all metrics. Our results continue to demonstrate that our ability to secure every identity, human and machine, with the right level of privilege controls is resonating with customers. This is a key motivator for customers to consolidate spend across the full breadth of our identity security platform. and create even more strategic relationships with CyberArk, which in turn is driving our ARR growth. A few financial highlights from the quarter. Subscription ARR was $735 million, growing 46% year over year. Net new subscription ARR was $59 million. That's a record outside of our seasonally strong fourth quarter. Total ARR was $926 million, growing 31% year over year. and we outperformed our guidance metrics across every variable. We delivered a record total revenue of $240.1 million, growing 26% year-over-year. Non-GAAP operating income came in at $35.4 million, or 15% margin. That's up from a 9% margin in the year-ago period, highlighting the operating leverage in our business model as we come out of the subscription transition. and we are pleased to report 51.6 million in free cash flow, or a 21 percent free cash flow margin for the quarter. Our results are driven by three main factors. First, the mission-critical nature of our solutions. In a world where more than 90 percent of organizations are victims of an identity-related cyberattack, customers recognize that merely managing identities is not enough. Identities, both human and machines, are the predominant threat factors in today's attacks. And the traditional way of securing identities in siloed, often commoditized point solutions is no longer sufficient. Second, the power of our platform. We offer the only integrated platform that can help enterprises discover with context, secure with intelligent privilege controls, and automate the lifecycle across all identities. from workforce to IT to developers and machines. We further strengthened our ability to deliver on this vision with the closing of the acquisition of Ventify on October 1st. And third, the strength of our execution. To us, execution means working hand in hand with our customers to ensure their businesses can move forward and take full advantage of a digital world without fear by delivering measurable risk reduction in every program. Our relentless focus on ensuring customers realize transformative value from our solutions and platform is the foundation of our excellence in execution. We are benefiting from the market shift to consolidation of trust. As you can see in the success we are having selling our platform. In the third quarter, we continue to see momentum build in full platform deals. In one example, a leading healthcare company was driven by a desire to consolidate human and machine identities with one vendor. They replaced the competing secrets vendor and landed with CyberArk everywhere across four of our solutions. This customer will leverage CyberArk's capabilities across SSO, MFA, PAM, endpoint privilege, and secrets management by protecting IT users, workforce endpoints, and machine identities from the get-go. Independently, This customer also closed a deal with Venify at the end of Q3. While the Venify team closed with them on their own, we are confident this deal is a strong indication of the top-line synergies we can achieve as a combined company. As customers look to modernize their approach to securing IT, they are expanding their PAM programs with our enterprise IT solution. This solution provides a unique way to protect a broad set of users, including IT administrators, shadow IT, database and cloud administrators. While the need for traditional PAM use cases of vaulting shared accounts, password rotation, and session management as foundational layers of security remains, today's PAM programs are so much more. Enterprises are looking for a quicker adoption and faster time to value. They need secure access to modern databases, workloads, and cloud services. This needs to be done with a just-in-time and zero standing privilege approach without inhibiting the user's workflow, combining for a healthy marriage of security and productivity. What makes CyberArk truly powerful? We deliver all of these comprehensive capabilities from one single seat, integrated into our platform and fully enabled with built-in core AI and threat detection and response. The modern PAM program powered by CyberArk delivered through our IT solution is setting the new standard in the industry. This is helping to win new logos, and we added nearly 230 in the third quarter. In addition, it's driving our expansion with existing customers as they protect more users across more use cases. Our innovation and leadership position was once again recognized by industry analysts in the quarter. We were pleased to be named a leader in the 2024 Gartner Magic Quadrant for Privileged Access Management, positioned as the leader for the sixth consecutive time and furthest in completeness of vision. We were also recognized as an overall leader in the 2024 Leadership Compass on Privileged Access Management by Kuppinger-Cole, scoring highest in all three categories of product, innovation, and market leadership. Modern PAM, though, goes beyond just securing IT users. The concept of zero standing privilege to access modern cloud infrastructure and cloud environments is the key to securing the most privileged human identity group in the enterprise, the developer. Often left unattended with always-on access, developer identities dramatically increase risk and expand the attack surface. By offering zero standing privilege, CyberArk secure cloud access is a game changer for securing this high-risk population. With native workflows and access and automated life cycles and controls, Our solution for securing developers offers the best of PAM without needing a behavior change. More importantly, with our solution, security is not an impediment to innovation. It is an enabler of the innovation machine within organizations. In the third quarter, a leading European bank who is a longtime CyberArk customer and has worked with us closely to protect privilege access for the IT and extended IT teams over many years now decided to tackle the high-risk developer population. We were excited to see the customer expand into this new identity group, buying our enterprise solution in a seven-figure ACV deal. In the untamed world of cloud security and developer access, where developers often have always-on and overprivileged entitlements, it is critical we approach security as a team sport. We were thrilled to announce our strategic partnership with Wiz, unifying the capabilities of our identity security platform with Wiz's cloud security platform to help enhance customers as they tackle their multi-cloud security posture. Wiz's best-in-class visibility over risky and misconfigured cloud access and CyberArk's control over privilege with zero standing privilege approach can measurably reduce the risk of unauthorized access. All without impacting the speed and scale of cloud development. Our customers are excited about this partnership and the immediate benefit it can have in getting control of their cloud environments and developer access points. Moving on to securing the workforce, we had another strong quarter with our workforce solutions, which crossed the threshold of 100 million in ARR this quarter. Workforce identity is transforming from an efficiency tool, where SSO and MFA were considered enough, to one where every employee needs the right level of privilege controls throughout their workday, from the moment they sit down at their endpoint. As a result, there is a substantial and growing cohort of both CIOs and CISOs that not only understand but prioritize security first across all their workforce identities. Our workforce solutions implement least privilege on managed and unmanaged devices, secure and streamline the browsing experience, substantiate more secure SSO with intelligent privilege controls, and even integrate the ability to protect everyday workforce users' passwords with the security of the CyberArk Vault. Our solutions enable a passwordless workflow, seamlessly authenticating into the environment, and reimagines the way enterprise secure their entire workforce. This is evidenced by a leading SaaS company who landed with a substantial six-figure workforce deal. As a de facto protection against ransomware, our solution was the tip of the spear and a great showcase of the multiple landing spots of our platform. Before I move on to Ventify and our machine identity security vision, I wanted to just highlight another very strong quarter of growth for secrets management. We have never been in a better competitive position. The value of secrets management at enterprise scale is resonating, and the combination of Condra Cloud and Secrets Hub means SAS is leading the way. I want to share a deal with a leading U.S. energy company who recognized the value of secrets and machine identities with CyberArk. Expanding with a mid-six-figure ACP deal this quarter, they are protecting more of their IT users and tackling secrets and machines for the first time with Conjure Cloud and Secrets Hub. We are thrilled to have closed the acquisition of Ventify on October 1st. I want to take this opportunity to formally welcome the tremendous Ventify team to CyberArk. From the onset of our discussions with Ventify, it was clear that this acquisition was more than just a strategic fit. It was a powerful convergence of vision, technology, and culture. The past months have only reinforced our belief that joining forces will reshape the landscape of machine identity security. The feedback from customers and partners further rose our confidence in the tremendous value Venify will bring to our platform. In explaining the machine identity security landscape and the problems we have to solve as an industry, I often use the three Vs, volume, variety, and velocity. Starting with volume, the sheer number of machines, whether they are devices or workloads, is exploding. We have talked about the ratio of 45 machine identities for every human identity. In a constantly accelerating world that is only increasing its reliance on cloud-native applications and workloads, IoT devices, and AI agents, This ratio will soon be obsolete. With a rapidly growing volume, the ability to discover, secure, and manage machines with an automated lifecycle is critical to keeping this new world secure. On to variety. Variety refers to not just the various machine types I have mentioned, but also the variety in the forms of identity. From certificates to secrets to keys to tokens, there is a large variety of identity types adding a level of complexity not seen on the human side of identity. Managing this complexity requires an integrated solution. Organizations cannot get away with siloed tools or manual processes anymore. Customers have a clear and urgent need to simplify, reduce complexity, and bring in an enterprise-grade solution to bear across a diverse landscape of machine and machine identity types. And finally, velocity. Machines themselves are no longer static devices and applications. They are constantly changing, and in some cases, like with ephemeral workloads, they exist only for a brief period of time and then disappear. When you put together the pace of change of these identities and the shorter lifespan, all of a sudden the velocity of issuance and management of these identities has also exploded. The combination of CyberArk Secrets management offerings with Venify's machine identity management offerings will provide organizations with a centralized solution to manage and protect all machine identity types. By automating and securing these identities will help prevent misuse and compromise, ultimately reducing risk and enhancing operational efficiency. With Eventify acquisition closed, I want to highlight our top priorities over the coming months. First, we will unleash our go-to-market organization around the world to tap into the more than 8,500 CyberArk customers who are not Venify customers yet. Second, we will rapidly integrate our secrets management capabilities and Venify's capabilities into a streamlined machine identity solution. And third, we will work with our partner ecosystem to get them both certified on Venify and ready to hit the ground running as they go after the 10 billion addressable market. In summary, I want to leave you with the following takeaways. Identity security is a clear and present need for CISOs, and our solution selling has further aligned how we sell to how the customer wants to buy, and this is resonating with customers. Our vision to deliver the right level of privilege controls to every identity, human and machine, is expanding our competitive moat and leadership position in identity security. With Vanify, we're setting a new standard for end-to-end machine identity security, and finally, with our strong execution and unique platform, We are well positioned to deliver a stellar next phase of durable, profitable growth and take CyberArk to the next level. Before I turn the call over to Josh, I'm sure you've seen the CFO transition we announced this morning. Josh will see us through the year end and will be stepping down from his CFO role in January as part of a planned succession. We are grateful he has agreed to stay on in an advisory role through 2025 to ensure a smooth transition. I want to take a moment to acknowledge Josh's countless contributions to CyberArk for more than 13 years. Josh is an amazing leader. In his time at CyberArk, he guided the finance organization from less than $40 million in revenue in 2011 when he joined, through our IPO, the transition from a perpetual to subscription model, and turned finance into a force multiplier enabling the scale and results you've seen us deliver. We have scaled the company and stayed true to our values of delivering strong growth and profitability. He has been my trusted partner since I joined the company and his contributions are immeasurable. I'm also though delighted to announce that Erica Smith will be our new CFO effective January 1st, 2025. Erica has been a core member of our finance leadership team and has worked closely with me on the subscription transition and our long-term strategy. She is a trusted partner to the board and our executive leadership team, and I couldn't think of anyone better suited to be our next CFO. So, Erica, congratulations on your new role. With that, I want to hand it over to Josh.