CyberArk Stock Pops 9% After 36% ARR Growth Forecast

Just because a company has been successful inventing a new market, it does not mean it will continue to grow.

That’s because the company’s initial success will draw in rivals seeking a piece of that pie. Soon enough, industry growth will slow as the innovator and its followers satisfy customer demand.

This presents a challenge to the innovator — can it create a new market with sufficient growth potential to make up for the slow down in its original market?

This comes to mind in considering shares of CyberArk, a Newton, Mass.-based provider of identity management software, whose stock ended last week 23% below its all-time high — reached in November 2021 — of $202.

After reporting expectations-beating revenue and profit growth on February 10, its shares rose 9%. Will CyberArk shares rise further? If it continues growing faster than its industry and it invents a new growth curve, I see significant upward potential for its shares.

Strong Fourth Quarter Report

CyberArk’s fourth quarter 2021 earnings report exceeded investor expectations. According to SiliconANGLE, CyberArk’s fourth quarter revenue was up 6% to $151.3 million — $5.8 million above estimates while earnings per share of 28 cents were 65% more than the consensus.

What matters to investors is not CyberArk’s revenue — but its annual recurring revenue. That’s because CyberArk has been moving from a perpetual license — in which, say, a $100,000 sale would be mostly (80%) booked in the quarter in which the sale took place — to an annual subscription in which the revenue is counted in 12 installments — say, $8,333 per month — over the life of the contract.

CyberArk’s total annual recurring revenue (ARR) was up 44% to $393 million in the fourth quarter of 2021, according to its Q4 2021 earnings call transcript. For 2022, the company expects 36% ARR growth — the midpoint of a range between $530 million and $536 million.

Wall Street liked what CyberArk said about its progress in this transition. In a February 11 interview, cofounder and CEO, Udi Mokady, said, “When we presented to investors yesterday, we were happy that all 22 analysts on the call supported the story of our transition to subscription. Our customers were slow to accept the subscription model because they wanted to own our technology on premises.”

CyberArk’s earnings forecast for the current quarter fell short while its revenue estimate was in-line with analyst expectations. The company predicts revenues for the March-ending quarter in the range of $125 million and $133 million — the midpoint of which is 14% above the year before — while its forecast of a loss per share between 25 and 42 cents is much higher than the nine cents that analysts anticipated.

CyberArk expects more of its revenue to come from subscriptions. “Given our performance in 2021, we are confident we will hit our subscription transition target goal of reaching about 85% bookings mix in the second quarter of 2022,” said Mokady.

Modestly-Growing Privileged Access Management Market

CyberArk competes in the so-called privileged access management (PAM) market. Its services protect companies from internal threats and hackers seeking access to their data. Gartner deems CyberArk to the PAM market leader with over 6,600 corporate customers.

As I wrote about six years ago, CyberArk was born in Jerusalem in 1999. “After my service in the 8200 unit, I got together with a Jerusalem friend of mine who had been working at Mamram, Jerusalem’s central data center. We wanted to start a company that combined my knowledge of information security with his deep insights into how large enterprise data centers work,” Mokady told me.

CyberArk was introduced through the “Startup Nation network” to angel funding from Israeli investors who “loved the business,” said Mokady. In late 2000, CyberArk received a Series A funding and decided to move to the Boston area to be close to its customers — it was selling to East Coast banks; to be closer than Silicon Valley to its engineers in Israel; and to get access to talent from EMC /RSA and local universities.

In 2002, CyberArk raised more funding from Jerusalem Venture Partners and other Israeli venture capitalists and in 2011 got a final pre-IPO capital infusion from Goldman Sachs, JVP and others. The company went public in September 2014 and its stock has since increased at a 24.8% compound annual rate.

CyberArk’s industry is modest and growing at low double-digit rates. Gartner estimated that the PAM market revenue for the vendors in its most recent Magic Quadrant report was $1.5 billion at the end of 2020 — up 12% from 2019. Gartner expects that revenue to grow at a 12.5% compound annual rate to $2.7 billion by 2025. (Gartner cautions that this does not count all PAM revenue).

Gaining Market Share

While its revenue guidance is for 14% growth, CyberArk says it is gaining market share. “The PAM market in which we compete is growing at 10% to 15%. We are growing [more than] twice as fast as our space with our ARR up 44%. When we complete the transition to subscription-based revenue, our revenue growth rate will catch up,” he told me.

CyberArk is gaining market share because its product can grow with the needs of its customers, as a public company customers know it will be around, and it is supplying new solutions to new problems that face customers. As Mokady said, “Our product is in the strategic and change management layer. It helps secure how people are accessing the company’s mission critical systems. [Rivals] that are owned by private equity firms don’t invest in innovation.”

His comment about PE firms milking companies — rather than investing in future growth — strikes me as particularly relevant to customers who want security vendors to keep up with changes — such as new methods of hacking into their computer systems.

Investing in Future Growth

CyberArk is investing in future growth by inventing new products through R&D and by acquiring companies. “We have a productive paranoia. The more we succeed, the more we must innovate. In Petach Tikva, Israel we have the CyberArk Labs where our people work on impactful cyber layer needs in identity security. One of our projects resulted in the Cloud Entitlements Manager (CEM),” according to Mokady.

While the company would not disclose how much revenue CEM generated, he told investors that it helped CyberArk bring in new revenue. “As part of its digital transformation, a large broadcaster bought our Identity Security Platform because of its foundation in PAM — including Privilege Cloud, Endpoint Privilege Manager, Secrets Manager, Remote Access and Cloud Entitlements Manager.“

CyberArk does not feel compelled to invent all its new products. As he said, “We also have zero tolerance for the Not Invented Here (NIH) syndrome — we do look at acquisitions, particularly if we find a company that has made more progress on a problem than our R&D people have.”

CyberArk works with early-adopter customers who help it develop products that meet new customer needs. “We have only 2,100 employees. We are still nimble. And we work with a group of [early adopter] chief information security officers at pharmaceutical companies and banks. We can test the product early and see if they find it valuable. We are also looking at what hackers are trying to do next. Our R&D people love to play remote chess with smart people,” he said.

CyberArk does not see demand for its services as being driven by waves — such as work from home or a specific attack such as Solar Winds. “Demand for our services is driven by digital transformation. New technologies — such as Internet of Things and AI — are the new frontier for attack vectors and we are working on solutions,” noted Mokady.

The average price target for CyberArk is $204, according to the Wall Street Journal — 32% above its current price.

If its investments in innovation position CyberArk at the beginning of a new growth curve, I expect the shares to rise even further.