Cyberark Software Ltd

NASDAQ:CYBR

Earnings Call Transcript 2018-Q3

[Operator]

Good day, ladies and gentlemen and welcome to the Third Quarter 2018 CyberArk Software Earnings Conference Call. At this time, all participants are in a listen-only mode. Later, we will conduct a question-and-answer session and instructions will be given at that time. [Operator Instructions] As a reminder, this conference is being recorded.

I would now like to introduce your host for today’s conference, Erica Smith, Vice President of Investor Relations. Please begin ma’am.

[Erica Smith, VP, IR]

Thank you, Nourma. Good afternoon. Thank you for joining us today to review CyberArk’s third quarter 2018 financial results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open the call up to a question-and-answer session.

Before we begin, let me remind you that during the call today certain statements may be considered forward-looking, which reflect management’s best judgment based on currently available information, specifically our expectations and beliefs regarding our projected results of operations for the fourth quarter and the full-year 2018.

Our actual results might differ materially from those projected in these forward-looking statements. Please see the risk factors contained in the company’s annual report on Form 20-F filed with the U.S. Securities and Exchange Commission and those referenced in today’s press release. CyberArk disclaims any obligation or undertaking to release publicly any updates or revisions to any forward-looking statements made today.

Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation to the most directly comparable GAAP financial measures is also available in our earnings press release, which can be found in the Investor Relations section of our website, where you will also be able to find a webcast of today’s call.

With that, I’d like to turn the call over to Udi.

[Udi Mokady, Chairman and CEO]

Thanks, Erica, and good afternoon, everyone. Thank you for joining the call today.

The third quarter was another great quarter for CyberArk. Total revenue reached a record $84.7 million, increasing 31% year-over-year. We generated record non-GAAP operating income of $21 million. And our net cash from operations was $89.2 million in the first nine months of the year, already exceeding the cash flow we generated in all of 2017.

Given our strong results, we are raising our guidance for the full-year, which Josh will discuss later in the call.

Strong execution and robust market fundamentals drove our results again this quarter. I want to highlight three major market trends. First, awareness and demand for privileged access security is stronger than ever, and accelerating generating across all geographies. Second, securing privileged access is recognized as critical for the successful execution of digital transformation and cloud migration strategies. And third, chief information security officers are solving increasingly complex regulatory challenges by focusing on securing the environment and not merely checking a compliance loss.

Given our leadership position and the breadth of our solutions, we’ve benefited from these macro trends in the third quarter.

In terms of our strategy, every team across the organization executed well, and contributed to our strong performance this quarter and year-to-date. Innovation has been key to our success. The simplicity and enhanced functionality of Version 10 of our core privileged access security solutions combined with the dramatically simplified new pricing model is accelerating new customer acquisition.

We ended Q3 with over 4,200 customers, adding nearly 200 new logos again this quarter. Year-to-date, new customer additions have grown by 37% over the first nine months of last year, accelerating from about 10% in the first nine months of 2017 and 28% in the first nine months of 2016. With the wins in the third quarter, we are honored to be helping secure the world’s leading companies including 50% of the Fortune 500.

A few key new customer wins include a Fortune 100 technology company will be leveraging our core privileged access solution to secure network security cameras. We won this greenfield Internet of Things project because of our investment in the technology integrations that securely extend our solution across the IT infrastructure on-premise and in the cloud. A major insurance company chose CyberArk, not only for the breadth of our solutions across core privileged access and for protection in DevOps, but also because we can secure multiple public clouds including Google Cloud Platform and AWS. The Chief Information Security Officer wanted to consolidate on a comprehensive privileged access security platform to increase control and security over the organization’s enterprise hybrid environment.

In the new digital world, every organization is a technology company, and retail certainly is no exception. In the third quarter, we signed over 20 new retail customers and the vertical grew by more than 75% compared to Q3 last year. To respond to increasing competition and higher consumer demand, retailers are securely implementing comprehensive cloud and DevOps strategies. In a seven-figure new business deal, a large retailer in Northern Europe will be leveraging our technology to secure its privileged accounts globally. In the hybrid deployment, this retailer is running our solution on-premise in the Americas and Azure to secure its EMEA the environment. This customer understands that securing privileged is foundational to its comprehensive security strategy. A large retailer in the U.S. will be leveraging CyberArk, Okta and SailPoint in a broad identity project to protect its environment on-premise as well as privileged access to AWS and Azure. Our security first approach to privileged, our ability to protect the DevOps pipeline and our strong relationships with our technology and advisory partners contributed to this great win.

An existing Fortune 100 retail customer who first purchased Enterprise Password Vault in 2012, is extending is CyberArk deployment to its next generation data center in GCP and Pivotal Cloud Foundry with Application Identity Manager and Conjur and Core PAS. This progressive customer wants full visibility and security of its privileged human users and machine identities. Our strategic moves over the last 18 months, including the new pricing model, Version 10 and our technology partnerships with Puppet, Ansible and Chef will significantly speed the tighter value for this mission-critical project.

Broad diversification is the foundational pillar of our business. Our top 10 deals in the third quarter represented five different verticals, but more importantly, they were balanced across the Americas and EMEA, new and add-on business, channel and direct, and included a number of products. Banking, manufacturing and global government were our largest verticals in Q3, each representing over 10% of the business. In the government vertical, we won agencies in North America, EMEA and APJ and continue to see traction with U.S. federal closing over 40 deals with both new and existing customers.

Geographically, we were thrilled with the performance in each region. The Americas delivered another record quarter, growing by more than 20% in Q3. The EMEA team has improved consistency across the region, resulting in revenue growing by more than 40% in the third quarter. And in APJ, we have seen an acceleration in deals over $100,000, demonstrating that securing privileged access is moving up on the security priority list in the region.

Add-on business was another important contributor to our record results. During the quarter, we had multiple seven-figure add-on deals including a U.S. financial services firm is expanding its initial CyberArk deployment across the global organization. We originally won a relatively small deal in a new data center to protect Tier 0 critical assets, the most valuable assets for a hacker. After proving, we are a superior solution, they are now ripping and replacing a legacy technology to deploy CyberArk globally across all data centers.

After data breach last year, a UK transportation company has leveraged CyberArk to regain control over its network. The organization now has a board mandate to implement a cybersecurity program targeted to significantly reduce risk. Because our solution is measurable, privileged access security was the number one priority for this customer.

Our strong exclusion is generating synergies across our advisory, value-added reseller, and technology partner ecosystem, which is contributing to our strong performance. We are putting the customer first, working with our partners to help better secure against cyber attacks. Value-added resellers recognize that combining our privileged access solution with the C3 Alliance Technology Partners will strengthen their customer security position.

In the third quarter, our indirect business represented approximately 67% of total revenue. Our advisory partners are expanding their CyberArk practices and providing customers with valuable and scarce security talent which can implement our solution and deliver ongoing services. In the third quarter, about 20% of our business was again influenced by strategic partners like the Deloitte, PwC, KPMG and others. Our ecosystem is promoting a best-of-breed approach across a number of security projects, notably in mission-critical digital transformation and cloud migration strategies.

Conjur and AIM play a critical role in cloud migration as well as digital transformation with DevOps and Robotic Process Automation or RPA, both steadily gaining traction. By bringing together advisory firms, VARs and tech partners like Automation Anywhere, UiPath, Blue Prism, Red Hat OpenShift, and Puppet and others, we’re helping customers across industries securely automate business processes and the DevOps pipeline.

Our innovation has empowered customers to deploy or access CyberArk anywhere, on-premise, in the cloud, as a service or through an MSSP. During the third quarter, a large system integrator partner purchased our multitenant cloud managed security service provider offering. This partner has signed its first customers and is in the process of building out its broader MSSP offering. Our MSSP solution is further extending our reach into the midmarket and we are looking forward to working closely with this partner and others as they rollout privileged access security solutions.

We recently introduced our first innovation based on the Vaultive acquisition, Privileged Session Manager for Cloud. This solution extends our reach to protect cloud administrators and privileged business users. Through a transparent, easy to use experience, this new functionality extends session isolation, monitoring and control to the most common web applications cloud and social media platforms. As part of our Core PAS solution, Privileged Session Manager for Cloud leverages our threat analytics and risk scoring capabilities to detect and alert on suspicious privileged related activity. The market for privileged access security is rich with opportunity, and we believe that demand has never been stronger.

Technology and attacker innovation are continually changing the threat landscape. Recent industry disruption and consolidations are also creating near-term opportunities to capture market share. Our execution in the first nine months of this year has established a strong foundation to continue to responsibly invest in the business and deliver growth in the fourth quarter and beyond.

With that, let me turn it over to Josh to discuss more details about our record results. Josh?

[Josh Siegel, CFO]

Thanks, Udi.

Before we begin reviewing the quarter, I wanted to remind everyone that our third quarter results reflect the modified retrospective approach to disclosure for accounting standard 606.

So, as Udi mentioned, we had a record quarter for total revenue and operating income. We were pleased to again exceed our outlook for all guided metrics.

Total revenue through by 31% year on year, reaching a record $84.7 million in third-quarter. We generated $46.1 million in license revenue, increasing 29% over the third quarter of 2017, representing 54% of total revenue. We experienced strong growth across all geographies, as well as in our mix for both add-on business and new customers, as well as channel contribution, which increased during the quarter.

Maintenance and professional services revenue was $38.5 million, increasing 33% over the prior year period and representing 46% of revenue. The professional services revenue associated with this line was $6.7 million or 8% of total revenue. All geographies performed well, again, in the third quarter. The Americas reached another record quarter, generating $52.1 million in revenue, growing 23% over third quarter last year and representing 62% of total revenue. EMEA generated another high growth quarter with $26.3 million in total revenue, or 42% year-on-year growth and 31% of total revenue. APJ recognized $6.3 million in revenue, growing 52% and representing 7% of total revenue.

Beyond geographic diversification, we experienced a broad-based demand across verticals with five verticals growing by 50% or faster. Those include manufacturing, insurance, retail, telco and professional services.

As I move through the P&L, all line items will be discussed on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release.

Our third quarter gross profit was $74.9 million or an 88% gross margin. That’s compared to 86% gross margin in the same period last year. We continued to enjoy increased utilization of our professional services team, resulting in the improved gross margin for the quarter.

To capitalize on our significant opportunity, we are also continuing to invest in growth and scale. Our innovation has been a corner stone of our long-term success. R&D grew by 33% year on year to $12.7 million or 15% of revenues. That was primarily driven by headcount increasing by 21%, which included the acquisition of Vaultive in March earlier this year, and currency movements and hedging, which represented approximately $400,000 of the increase in R&D expenses or approximately 4% of the expense growth.

Sales and marketing increased by 12% to $33.9 million, or 40% of revenue as we expanded across all geographies to support direct and indirect sales. Consistent with last year in the third quarter, we again hosted our annual Americas and EMEA customer events this year in Boston and Berlin, respectively. We also introduced during the third quarter our new Defend events series, which were conducted in 12 cities across the Americas and attended by approximately 1,000 customers and prospects.

In G&A, our expense increased 36% year on year to $7.2 million or 8.5% of revenues as we continue to scale the business to support our growth. In total, operating expenses for the third quarter increased 20% to $53.9 million compared with $45.1 million for the third quarter last year. As a result of our record revenues, powerful business model and disciplined investments, we experienced strong leverage in the third quarter, delivering operating income ahead of our guidance at $21 million or a 25% operating margin. This compared to an operating income of $10.7 million, or 16% operating margin in the year-ago period.

We ended the third quarter with 1,106 employees worldwide, that’s up from 1,077 at June 30, and compared with 966 at the end of the third quarter of 2017. We had 524 employees in sales and marketing on September 30th, compared to 513 at June 30, 2018 and 468 at the end of third quarter of last year.

Net income was $17.8 million, generating earnings per share ahead of guidance at $0.48 per diluted share for the third quarter of 2018, that’s increasing from the $8.9 million or $0.25 per diluted share for the third quarter of 2017.

We continued to generate cash flow from operations into the third quarter, increasing our total net cash provided by operating activities for the first nine months to $89.2 million. This represents a 38% cash flow margin and an increase of 100% over the first nine months of the prior year period.

As a result, we ended the quarter with a strong balance sheet with $410 million in cash and investments. This compares to $330 million in cash and investments at year-end. We ended the third quarter with $136 million in total deferred revenue, a 29% increase from $105 million at year-end and a 59% increase from the $86 million at September 30, 2017. As a reminder, our deferred revenue primarily consists of return revenue derived from the maintenance and support contracts.

Turning to our guidance. As a reminder, our guidance does not consider any potential impact to financial, other income and expenses associated with foreign exchange gains or losses as we do not try to estimate future movements in foreign currency rates.

So, for the fourth quarter of 2018, we expect total revenue of $94.8 million to $96.3 million or 19% year-over-year growth at the midpoint. We expect non-GAAP operating income to range between $27.3 million to $28.5 million or a non-GAAP margin of 29% at the midpoint. We expect non-GAAP net income per diluted share of between $0.58 to $0.60. Our guidance assumes 37.9 million weighted average diluted shares and a tax rate of 21% for the fourth quarter.

Given the strength of our execution and the strong demand in our business during the first nine months of the year, we are pleased to raise our full year guidance. We expect total revenue to be in the range of $328.9 million to $330.4 million or growth of approximately 26% at the midpoint.

We are also increasing our guidance for non-GAAP operating income to be in the range of $78 to $79.2 million, or an operating margin 24% at the midpoint. We are also increasing our guidance for non-GAAP net income for diluted share of $1.75 to $1.77. This assumes 37.2 million weighted average diluted shares. Our guidance for the full-year assumes an effective tax rate of approximately 21% for the 2018.

We are also increasing our outlook for cash flow from operations -- from operation margins to be between 8% and 13% higher than our non-GAAP net income margin for the full year. This compares to the prior year guidance range of net income margin to 10 percentage points higher than our net income margin. As a reminder, the cash flow margin can vary from quarter-to-quarter, based on seasonality of the business, tax obligations, cash collection and duration of maintenance contract renewals. Our execution year-to-date positions us well for the fourth quarter of 2018.

And now, I’ll turn the call over to the operator for Q&A. Operator?

[Operator]

[Operator Instructions] Our first question comes from Saket Kalia of Barclays. Your line is open.

[Saket Kalia, Barclays]

Hi, guys. Thanks for taking my questions here. Josh, maybe for you. You talked about sort of the strength in multiple verticals. I think you talked about some verticals that grew 50% year-over-year. Can you talk a little bit about the federal government contribution this quarter? I know that last year we had some deals closed, I’m wondering if that strength kind of continued here in Q3.

[Udi Mokady, Chairman and CEO]

Hey, Saket. It’s Udi. I’ll jump in first. I would say that Q3 was healthy in the federal government. Q2 was the record quarter, and we talked about some of the unique programs that we saw throughout the year. We saw continued growth in the vertical. Year-to-date, it’s up 25%, and we had 40 transactions of both new and add-on business within Q3 itself. There has been a lot of ceding that I’m excited about that happened throughout the year with opportunity for add-on business. And I think as we mention, the global government space is now -- continues to be in our top three largest and has grown very nicely throughout the year.

[Saket Kalia, Barclays]

Udi, maybe for my follow-up for you, more of a product question. Last quarter, you talked about introducing the Privilege Cloud to really future proof CyberArk’s leadership. I think, some of the deal examples that you talked about in your prepared remarks, also talked about hybrid deployments and such. Realizing it’s early, can you just remind us how the Privilege Cloud is different than your traditional EPV? And what some of the early feedback has been on Privilege Cloud?

[Udi Mokady, Chairman and CEO]

Sure, absolutely. So, the examples we gave in our prepared remarks are absolutely existing -- are existing solutions that currently extends into cloud deployments, either securing cloud assets or being deployed in the cloud, and some of the examples that I mentioned. And those are customers that are taking existing CyberArk products and deploying them in the cloud or to secure cloud assets. The Privilege Cloud is really brand new, the CyberArk Privilege Cloud and very early, but we are making early progress with early customers and pipes. The main difference there is that the customer will not deal with installation of the infrastructure itself with CyberArk. They are able to consume it as a service. And obviously, it’s more oriented towards smaller organizations, but like you said, it’s future proofing us to the world where more and more customers will trust the cloud as the place that they want to the keys of the IT kingdom. And so, we see it as a very important long-term opportunity for us.

[Operator]

Our next question comes from Melissa Franchi of Morgan Stanley. Your line is open.

[Melissa Franchi, Morgan Stanley]

I think, I’ll start with maybe an update on the simplified pricing model and new bundles. I know you said in previous quarters that you’ve seen an easing of sales cycles within new simplified pricing, but you weren’t yet receiving the full benefit from that. So, can you just maybe give us an update of the benefits that you saw in Q3, if you’ve seen any changes? And then, also, if you are seeing any impact to ASPs from the new bundles?

[Udi Mokady, Chairman and CEO]

Josh, do you want to…?

[Josh Siegel, CFO]

Yes. Hi, Melissa. So, with regard to the new pricing, we obviously are seeing with our new business deals, a real shift. We are already up over 90% of our new business deals in the third quarter. We are buying off of the new price list with the simplified pricing. And if we kind of look at total, all the add-on and the new combined, we are close to 70% in the third quarter, using the new pricing model. So, we’ve really got great traction. I think customers are getting it. And we are using it. I think in terms of impact on ASP, we are not seeing a big change or an impact on ASP at this point yet. But, we are seeing, like you called out early on is that a nice qualitative improvement on the sales cycle since it’s accelerating new customers, acquisition and we think it’s exciting as well to the success that we’ve had with the new customers. And it also in quicker way and easier way brings us to conversations around our other products in addition to Core PAS. So, overall, we like the decision we made there, and we are well on our way for being a fully adopted.

[Melissa Franchi, Morgan Stanley]

And then, just one follow-up for you Josh on margins and margins came in well ahead of expectations in Q3. Is that simply because revenue came in ahead and that fell through to operating margins or was there anything to think about in terms of the timing of investments or maybe the investment plan coming in a little bit lower than what you were expecting and the reason for that?

[Josh Siegel, CFO]

So, first of all, the revenue did flow through to the bottom line, which we really like to try to make happen. Also, we had a benefit that we also saw in Q2, which we had a nice benefit on the gross margin with our strong 88% gross margin contributing, at least another percent down to the bottom line with the efficiencies that we’re getting in our globalized services group that we started at the beginning of this year. I think in terms of spending, we’re pretty much on track. There were some I would say actually -- we actually worked hard and we had a lot of marketing programs in Q3. And we looked at a lot of them and actually negotiated well and we were in line or under on those program spending that we did through basically just good purchasing discipline.

[Operator]

Our next question comes from Gabriela Borges of Goldman Sachs. Your line is open.

[Gabriela Borges, Goldman Sachs]

Just as a medium term outlook question either for Udi or for Josh. Looking at some of the volatility that you’ve seen in license revenue over the last 6, 7 quarters in part due to the European execution issue that you called out over a year now. The question is, how should think about a normalized run rate or normalized growth rates for license revenue over the medium terms, just given all of your positive comments on growth acceleration?

[Josh Siegel, CFO]

I’ll start here. I think that we -- first of all, we are talking them about obviously 2019 and beyond in terms of license growth. We are enterprise software and Q4 is important quarter for us to really know and be an indicator for going into next year, the next several years. But, I think the way we look at it and I think Udi might be able to add to this is, we look at where the market is going, where the industry analysts are talking about where Core PAS is and what the opportunity. And we definitely see ourselves as a leader in the competitive space and to be able to take our piece of that. So, I think that we still, as we talked about earlier in the year, see ourselves with an opportunity in the early stage of the game to be a higher grower, which requires growing in licenses well as our support contracts, and we’re going to invest to try to keep that momentum going.

[Gabriela Borges, Goldman Sachs]

The follow-up is on the earlier comment on your cloud products that one of the big differences between on-perm versus other service, the customer won’t have to deal with the installation of any of the backend infrastructure themselves. I’m wondering if that maybe gets gives an opportunity on the pricing front. In other words, can you expand your share of wallet at the customer while also allowing the customer to realized better TCO on the service side on the installation side? Does that maybe give you an opportunity to expand your TAM or expand your pricing with your other service offerings?

[Josh Siegel, CFO]

Udi, I’ll take it. I think, the biggest opportunity, and again, like I said, it’s the long-term one, is the ability to reach out further down market with the customers who do not want to deal with the installation and really consume this as a service. The biggest benefit and back to pricing right now is the adjustment we’ve done, and we are very pleased with how it’s kicking in for the enterprise customers and of course those on the mid-market that by off of it where we are making it very easy for them to quantify their use. And a bigger and an accelerated land for CyberArk. That’s how we see it today. But obviously, the lower the installation phase, the lower the installation cost, the easier it is for us to expand our reach.

[Operator]

Our next question comes from Shaul Eyal of Oppenheimer. Your line is open.

[Shaul Eyal, Oppenheimer]

Udi, if I look at the 200 new logos you’ve discussed and disclosed -- the number you’ve disclosed this quarter, you’ve indicated also 20 new retail customers that makes it 10% out of the total for this quarter. Is it fair to assume the majority are mostly high-end and mid-end enterprise customers? And probably how many products on average have each of the new 200 logos acquired? Is it typical Core PAS product or there is already an EPM and Conjur potential IAM bundles into some of those new contracts?

[Udi Mokady, Chairman and CEO]

Thanks, Shaul. I would say that the majority are enterprise customers I would say in our focused markets, but we do see a pickup in the higher end side of the mid market as part of it, but the majority are our enterprise. And as we alluded, we for the first time put out our footprint in the Fortune 500 and we are happy to say that we are now sit in 50% of the Fortune 500. With regards to the product mix, now that we really unified the enterprise Password Vault and PSM and the products that into Core PAS. I would say most of these customers would land with Core PAS and it also is aligned with how we recommend to go about in really securing their major and burning risks around the retaining control over their network and cloud, but in several of these did include AIM-Conjur and EPM. It’s still really depending on the level of the customer. It’s still -- those are still products that make it into seeding and if not, in the seeding they are part of our add-on sales motion.

[Shaul Eyal, Oppenheimer]

Got it. And maybe one for Josh, given the strong result this quarter linearity anything out of the ordinary maybe there was some business that actually you guys have decided to push into the fourth quarter or it was pretty much steady as she go?

[Josh Siegel, CFO]

I would say, we had good linearity in Q3. And it actually has tracked well from Q2 as well in terms of the linearity. And so we’re -- and I think you also see it reflected in our cash flow as well and the lower DSO that we are able to achieve.

[Operator]

Thank you. Our next question comes from Sterling Auty of J.P. Morgan. Your line is open.

[Sterling Auty, J.P. Morgan]

I wonder if you could just go into little bit more detail around the EMEA region. You are seeing nice consistency out of the geography for several quarters now. Wondering if you can maybe highlight, whether it’s marketing programs or other items that’s been driving the consistency and what we should expect from here?

[Udi Mokady, Chairman and CEO]

Thanks, Sterling. I really think it’s one of the items, I’m very pleased on the strategic moves we made and how they contributed to the overachieve and part of it is optimizing and globalizing the sales force and our theory that was hey, let’s take the successful sales motion that we did in the Americas and expand it to EMEA while pushing consistently in that, and that’s really what’s been happening. The one true change out there is more and more information security officers in Europe and I personally have the opportunity to talk to them, are trying to combine the heavy regulatory requirements that they have with addressing risk becoming really much more oriented toward, OK, if I have to comply, I’ll also raise the value I’m going to deliver to the organization by really solving true risk assets and privileged access has been really been elevating in the top priority as we’ve discussed in the Americas market. So the combination of being consistent, being very focused on reducing risk for our customers and training our channel partners to sell through risk and the growing market awareness, a lot of it driven by our marketing programs over the years and in the year, have been contributing to that consistency.

[Operator]

Thank you. Our next question comes from Fatima Boolani of UBS. Your line is open.

[Fatima Boolani, UBS]

Good afternoon, thank you for taking the questions. Udi maybe to start with you, in your prepared remarks, it sounded more like you were having maybe more outsize success on the expansionary side and to that extent, I’m actually wondering on what sort of multiplier you’re seeing on lifetime customer spend and to what extent are your sales cycles actually shifting and frankly benefiting from the bundled approach and then a follow-up if I may?

[Udi Mokady, Chairman and CEO]

Yes, so Fatima I would say that one big header in this quarter is diversification. But it was, so geographic diversification, vertical diversification that we talked about, but also in the mix of new and add on, it was about a 40% new, 60% add-on business so definitely healthy contribution from new end and from add-on. In that add-on business, I agree with you, it’s customers that are becoming more strategic with CyberArk, we’re excited also to see that we are part of their cloud journey, it’s securing the ever-increasing footprint in the cloud, and again whether it’s for human users or for the application users like Conjur and AIM, and I would say, we’re pleased with the focus we’ve been giving with our customer success team on generating more lifetime opportunity from these major accounts and of course, there is a lot more to be done on this journey.

[Fatima Boolani, UBS]

Udi, you also mentioned sort of, on marquee when with MSSP customer, can you kind of walk us through the broader MSSP opportunity and how we should think about the potential for maybe cannibalization on the lower end of the customers as you increasingly partner with MSSPs and typical systems integrators and service providers? Thank you.

[Udi Mokady, Chairman and CEO]

I would say, true to our strategy also in partnering, we really go for quality versus quantity. And so the MSSPs have been cherry picked and they have to qualify to be able to really deliver true service to our customers. So we really don’t see a risk of over cannibalizing with too many MSSPs out there. It’s still an early CyberArk offering with the first MSSPs out there. And for us, strategically it’s our way to reach further into mid-market, and allowing us to focus on the enterprise opportunities. I think there’s going to be a healthy equilibrium of whether it’s a partner making it easy for their existing customers to CyberArk by joining their MSSP offering or really extending our reach by going further mid market that we would, on our own organically. And again, doing that with qualified partners really ensures that we keep a healthy equilibrium.

[Operator]

Our next question comes from Andrew Nowinski of Piper Jaffray. Your line is open.

[Andrew Nowinski, Piper Jaffray]

Thank you. And congrats on a nice quarter. Just want to ask about the competitive environment, it’s been getting a little noisier, there’s been a number of acquisitions in the space. Can you just give us an update on the landscape and whether those acquisitions may have opened up some more opportunities for CyberArk?

[Udi Mokady, Chairman and CEO]

Yes, absolutely. And thanks for the congrats. I would say, if we look over the last 12 months, CyberArk really strengthened its leadership position. And again, we see the execution and results. And a lot of it is the proactive measures that we’ve taken in our strategy Version 10, our simplification, our pricing and the strategic M&As that we have done, that really break us away from other vendors. But definitely the changes in the competitive landscape with the M&As in the last few months add, I would say, to turmoil within our competitive landscape, we’ve had. We’ve seen Francisco Partners has a private equity firm pickup four distinct vendors in the market BeyondTrust, Bomgar, Lieberman, Avecto and expect disruption there. We’ve seen CA get acquired by Broadcom. And so, yes, we do expect to see further opportunity from that disruption. And true to us, we are going after the leadership regardless of that and we will further capitalize on that opportunity.

[Andrew Nowinski, Piper Jaffray]

And then, I just want to ask about the, some of your partnerships with OKTA and SailPoint. I’m wondering, have you seen any new customer wins as a result of those partnerships yet?

[Udi Mokady, Chairman and CEO]

Absolutely. I think we gave one example in the prepared remarks, but we’ve been doing joint events, referring each other. It’s been a very healthy partnership out in the field that is adding, I would say to each of the company’s pipeline.

[Operator]

Thank you. Our next question comes from Gur Talpaz of Stifel. Your line is open.

[Gur Talpaz, Stifel]

Okay, great. Udi, I want to ask about the release of PAS v10.2 back in March. So how important has this been in driving some of the strength that you noted on the call. But more specifically, not just for the broader platform for products like Conjur, where you noted a bunch of pretty interesting wins?

[Udi Mokady, Chairman and CEO]

Absolutely. So, I think one of the unique things that go with 10.2 and beyond is, is that the customers can integrate their Conjur environment into their on-premise environment, and have a unified way to manage credentials, if they choose to do that for their on-premise environment, and also for their cloud and native cloud architecture based applications. We are now out there with 10.5. We’ve been continuously -- from Version 10 and beyond, it’s all been about simplification, automation, making it easier for our customers to install, making it easier for customers to deploy, manage, introduce more and more automation. So we really think it’s become a big differentiator, it’s become a big piece, as Josh mentioned, of the acceleration in the new logos, and we’ve been really working closely with customers to make sure that every additional dot releases is continuing that thread of simplification, and in automation and we’re excited about it.

[Gur Talpaz, Stifel]

Within the public cloud specifically, where do you think we are in terms of the customer life cycle process, meaning, do you think we’re still pretty firmly in the evangelical phase? Are we starting to kind of push past that?

[Udi Mokady, Chairman and CEO]

I would say, we’re really a true I would say, compass for that, because we touched so many different verticals in all over the world, and I would say there is no customer that’s not doubling one way or another with cloud, and in one -- and anywhere on the scale of just being very early and trying to see what they can do because they are highly regulated to those, like the retail example I gave that just see it as a big differentiator, a way to lower cost and move workloads and -- into the cloud. So I think it’s -- the journey is very much advanced. It really differs between the different companies, but in all of them we were able to latch in at whatever phase they are in and say, okay, first of all, let’s make sure you have control over your network, and that you have control over your cloud and enjoying that transformation journey.

[Operator]

Thank you. Our next question comes from Jonathan Ho of William Blair. Your line is open.

[Jonathan Ho, William Blair]

Hi, good afternoon. I just wanted to maybe start with the resellers and channel leverage. I just want to understand a little bit better. What type of opportunity you see there, just given the pickup in terms of the third-party generation of leads? And then maybe what the size and influence service are doing on your behalf as well, that’s maybe a little bit more than what they did in the past?

[Udi Mokady, Chairman and CEO]

Yes, absolutely. I think Jonathan, just like we -- in the early years, we had to really evangelize why privileged access is such a critical security layer and over the past year, just like it came up to the top with customers. We’re really seeing it come to the top with our channel partners, and to the top in terms of what they’re seeing from their -- they’re hearing back from their customers, but also in what they’re seeing as an opportunity for their own revenue generation. And we team up with them, and we create business plans really depending on the strength of the VAR. Is it a company that’s -- that is going after the services opportunity? Is it a company with a strong reach in new markets for us? Is it an advisory firm where they really influence the Fortune 500 vendor selection and have built practices around that. So I would say, it’s more and more elevating. We are measuring internally the -- those that are not just generate leads, but also are influencing like the advisory firms and it’s really in the right trajectory. For specifically on system integrators, we’ve seen system integrators include the CyberArk offering in their responses when -- in RFP responses and others, when they’re going after even larger transformation projects like new datacenters, and digital transformation. We’ve also seen them go after the services opportunity with CyberArk. Some of them are also on the -- are adopting our MSSP offering.

[Jonathan Ho, William Blair]

Got it. Thank you for the color. I also noticed that you talked about IoT opportunities, particularly on the security camera market. I think this is one of the first time that you’ve talked about, and probably which within this context. Can you maybe talk about this in terms of the growth opportunity. Is this a large portion of your business today? And is it being able to target that on the pipeline side? And can you maybe give us a color around the opportunities that you see here?

[Udi Mokady, Chairman and CEO]

No, it’s a great one. We gave an example of a Fortune 100 company, well, that was the landing point, was they’re concerned about their IoT devices, in this case, cameras and the ability to control and rotate credential on these devices. So that they won’t be the landing spot for attacks. We view that as a very early opportunity for us, and I would say it’s very nascent and it’s out, there are more enterprises themselves have that IoT sprawl, the more we can go after it. One of our partnerships is with ForeScout who have the capability to detect and discover these devices and CyberArk can be the company to rotate credentials and secure administrative access to these devices. So it’s early, but it’s out there.

[Operator]

Thank you. Our next question comes from Howard Smith of First Analysis. Your line is open.

[Howard Smith, First Analysis]

Yes. Thank you, and I’ll add my congratulations for the very strong results. My first question has to do going back to kind of a team question on new versus add-on, with the larger installed base and all the opportunity there, do you see a kind of medium-term trend toward more of your business, each quarter coming from the installed base versus new or not?

[Josh Siegel, CFO]

We actually have been pretty consistent over the last, I think, a year almost or two years with being about a 60-40 mix, 60% of our license revenue coming from existing customers and 40% coming from new customers. We do see a little bit of shifting in there from quarter to quarter, but it’s been pretty consistent and we saw that into Q3. And if you look at the first nine months of the year, it’s also hovering around the close to the 60-40 mix. So as you pointed out yourself, we actually have a huge market opportunity within our installed base and we view it as a big market opportunity. I think at this point, we also only 4,000, we have 4,200 plus customers, but we only have that much and we see that as a big greenfield opportunity as well. So I can’t really predict exactly what the percentage will be going forward, but it’s been pretty consistent over the last year or plus at this level. And given the greenfield opportunity on the new customers and on the existing installed base, we’re really investing in the same tone going forward in both.

[Operator]

Thank you. Our next question comes from Gray Powell of Deutsche Bank. Your line is open.

[Gray Powell, Deutsche Bank]

So, I just want to circle back on the license growth, I mean if I look year-to-date growth is coming in at about 27% in license as well above even the best quarters that you had last year and it’s closer to the 2016 trend line. So I was wondering if you can just kind of high level talk about the top drivers of the improvement. And is it more, would you say it’s more the execution and things that you’re doing on your side like the new bundles or is it more just an improvement in the overall market?

[Udi Mokady, Chairman and CEO]

I would say that it’s executing and really seeing the fruits of strategic moves we’ve made, coupled up with increased demand of the globalizing of the sales and optimizing of the sales and support organization. Everything I mentioned about Version 10 to simplify the pricing, the strategic M&As we’ve done particularly EPM, Conjur, Vaultive that gave us a strengthened our cloud play both on the human side and the applications, coupled with the market fundamentals with privilege really moving up in, in priority even in third-party recommendations, like I mentioned last time in some of the government conferences and others. Digital transformation initiatives really rising up and compliance as I would say rising, but being addressed more in a risk oriented fashion. So we’re executing against that and the past investments have allowed us to, to really over-achieve here.

[Operator]

Thank you. Our next question comes from Catharine Trebnick of Dougherty. Your line is open.

[Catharine Trebnick, Dougherty]

Thanks for taking my question, really nice quarter. Can you discuss you’ve had such great, great following on Gray’s question here, what are you doing in terms of training. It seems like this, even though you simplified the product and the pricing, it’s still is pretty complicated and what steps are you going to implement training of your resellers and the people at the advisory firms et cetera that are helping you drive this growth?

[Udi Mokady, Chairman and CEO]

No. Thank you. As I said I think training is an ongoing initiative. We set a goal to really increase the ecosystem of CyberArk certified engineers out there, we put up some numbers in previous quarters where we’ve significantly increased the footprint out there. We see it as a good sign that our training courses in when we do our customer events are always completely booked and oversold their strong demand for CyberArk talent out there and we’re continuing to investing going after it also in train -- the trainer program, so that we can further bring our training programs to market. And we are hearing consistent feedback from customers and partners that everything we’ve done on 10 from a product perspective and everything we’ve done on pricing simplification is really helping them.

[Operator]

Thank you. Our next question comes from Erik Suppiger of JMP. Your line is open.

[Erik Suppiger, JMP]

Your channel, I think you said, contributed too were influenced 67% of your deals. I think that’s up from where it’s been historically, can you give us a sense, do you think that will continue to elevate from that level? And then secondly, did you have much influence or much effect from GDPR here in the September quarter since at the first quarter, full quarter that’s been in effect?

[Udi Mokady, Chairman and CEO]

So, I’ll start with the last one and we’ll come back to the channel. I think we see anecdotal connections to GDPR where customers have cited that it’s been a driver. But I think the bigger overarching driver for our business has continued to be the risk-oriented approach and compliance is, I would say compliance is being consumed in a smarter way. Beyond GDPR, there’s GDPR, NIS, PCI, SOX. There are continued strong compliance drivers and more customers are addressing them with things that we’re really move the needle on reducing risk.

But in EMEA, they definitely bring it up, but it’s more, anecdotal. I also want to note that we’re hearing US organizations, and North America organizations looking at GDPR as something that they have to look at, but again in our conversations they then combine it with less reduced risk. We think that GDPR will be more of a steady drumbeat for business over a long period of time.

[Josh Siegel, CFO]

Hi, Eric. And if we kind of return back to the channel question. Yes, it was up in Q3, it was in the mid to -- just above the mid-60s and clearly that’s a level that’s also driven by the advisory firms that are contributing healthy as well to this space and I think though the overall our strategy has been pretty much the same if we think about the year-to-date, it is still around the 60-40 level which is similar levels that we saw in 2017. So I’m not going to jump the gun yet and say that we have a new level of channels, because we do get some lumpiness depending of certain deals may go through a channel. But overall, we’re happy with the way channels executed with us and for us in the third quarter and we’re keeping, we’re sticking with it and investing heavily in this area.

[Operator]

Thank you. Our next question comes from Ken Talanian of Evercore ISI. Your line is open.

[Ken Talanian, Evercore ISI]

Could you give us a sense for how your large deals tracked in the quarter and how they’re tracking in the pipeline?

[Udi Mokady, Chairman and CEO]

Yes. We increased in large deals across the board. If you look at our over 100k deals, they increased dramatically. I think, faster than the rate of the business growth and if we look at also, if you go up into the next levels above $0.5 million, also increasing very nicely. I think every quarter, we have several seven figure deals and larger deals and overall we are pleased with the large deals are because it’s not just happening in one area too, it’s really happening the growth in our over 100k deals are happening across each of the regions. Also in Americas, also in EMEA, and also in APJ. So, that’s really sending a strong statement about the footprint that our customers want to take with us. And if we think about the pipeline, absolutely, in order for us to keep growing the business and we look at the health of our pipeline, we see a continued traction in developing large deals in our pipeline as well. It’s going to be -- it’s part of the cornerstone of our growth. The good news is that we continue to really have a diversified group of deal sizes and overall we’re -- our average deal size has been pretty stable, both on add-on and new customers. So, we think we’re in a good place there.

[Ken Talanian, Evercore ISI]

And I guess not exclude specific to large deals, but could you give us a sense, which verticals you’re seeing the greatest increased in interest or if you want to describe that as pipeline?

[Udi Mokady, Chairman and CEO]

I think well if we talk about -- if we talk about the third quarter, the largest vertical growths were insurance, manufacturing, retail. We had three verticals, which are still -- which were over 10% of our pie -- banking as it usually is global government also manufacturing in the third quarter. And if we look at our -- if we look at our large deal split, we’re going to see it in every vertical. There isn’t -- I don’t think there is one of our key verticals, one of our top 7 or 8 verticals that we’re not doing large deals in -- on a regular basis.

[Operator]

Thank you. Our next question comes from Daniel Ives of Wedbush. Your line is open.

[Daniel Ives, Wedbush]

Just a quick question. How penetrated, do you think your installed base is today? I mean, just given the success you are seeing if you would estimate?

[Udi Mokady, Chairman and CEO]

How penetrated is our installed base?

[Daniel Ives, Wedbush]

Yes, on your solution side.

[Udi Mokady, Chairman and CEO]

I think, if we look across all of our customer base, we kind of we view it as still under a third in a deployment rate and that’s, we were talking about earlier and one of the earlier questions, we’re seeing consistently 60% of license revenue coming from our existing customers. We also are still very much on track and seeing a third of our customers coming back each year and that grows obviously as we keep acquiring new customers that third -- that number goes up each year and we see them coming back and buying either more of the same licenses or across over to new licenses. So where -- we still feel though that we’re under the third mark.

[Operator]

Thank you. The next question comes from Gregg Moskowitz of Cowen & Company. Your line is open.

[Gregg Moskowitz, Cowen & Company]

Okay. Thank you. And I’ll echo the congratulations on a really strong quarter. Udi, I just had a follow-up on your success in retail. When you look at the deals that closed this quarter combined with the pipeline, would you say that you’re now seeing an inflection in retail? Or is this something that was also significantly ramping in the first half of the year?

[Udi Mokady, Chairman and CEO]

I think the biggest jump is in comparison to last year and I think the unique element is they embrace me -- that they are embracing cloud and digital transformation. I think the inflection point is more of these retailers obviously for all the reasons we understand that that’s their way to really jump on the wagon and with increased competition and also to differentiate. But there are also a prime target of attackers as we know, and so the biggest change has been our ability to latch on their digital transformation, initiatives and I would say the -- it started throughout the year.

[Operator]

Thank you. At this time, I like to turn the call back to Udi Mokady for closing remarks.

[Udi Mokady, Chairman and CEO]

Thank you. In closing, I would like to thank our customers, partners and our employees worldwide for contributing to our record third quarter results. Thank you everybody, and good night.

[Operator]

Ladies and gentlemen, thank you for your participation in today’s conference. You may disconnect. Have a wonderful day.