Cyberark Software Ltd

NASDAQ:CYBR

Earnings Call Transcript 2019-Q3

[Operator]

Good morning. My name is Scott, and I will be your conference operator today. At this time, I would like to welcome everyone to the CyberArk Third Quarter 2019 Earnings Conference Call. All lines have been placed on mute to prevent any background noise. After the speakers’ remarks, there will be a question-and-answer session. [Operator Instructions] Thank you.

Erica Smith, Vice President, Investor Relations, you may begin your conference.

[Erica Smith, Investor Relations]

Thank you, Scott. Good morning. Thank you for joining us today to review CyberArk's third quarter 2019 financial results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; and Josh Siegel, Chief Financial Officer. After initial remarks, we will open the call up for a question-and-answer session.

Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management's best judgment based on currently available information, specifically, our expectations and beliefs regarding our projected results of operations for the third quarter and the full-year 2019. Our actual results might differ materially from those projected in these forward-looking statements.

Please see the risk factors contained in the Company's Annual Report on Form 20-F filed with the U.S. Securities and Exchange Commission and those referenced in today's press release. CyberArk disclaims any obligation or undertaking to release publicly any updates or revisions to any forward-looking statements made today.

Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation to the most directly comparable GAAP financial measures is also available in our earnings press release, which can be found on www.cyberark.com in the Investor Relations section. Also, please note that a webcast of today's call will be available on our website in the Investor Relations section, as well.

With that, I'd like to turn the call over to our Udi Mokady. Udi?

[Udi Mokady, Chairman and Chief Executive Officer]

Thanks, Erica, and good morning everyone. Thank you for joining the call today. I am excited to discuss our third quarter results with you. We were pleased with our strong performance. Our results exceeded expectations across all guided metrics. Revenue grew by 28%, reaching a $108 million and non-GAAP operating income increased by 40% to $29 million or a 27% operating margin.

During the quarter, we reached a record for revenue in the Americas, a record for EPM SaaS bookings and generated record business in the global government vertical. We’re also pleased to again deliver best-in-class growth and profitability, not only in the security industry, but also across technology companies.

Given our execution and the robust demand environment for the third time this year, we are raising our guidance for revenue growth and operating income for the full year which Josh will talk about later.

Overall, we continue to benefit from strong secular trends. It is estimated that two-thirds of Global 2000 CEOs are not only adopting digital transformation, they are centering their corporate strategies on building software-driven businesses.

At the same time, almost every enterprise customer is running on-premise, cloud or multi-cloud IT environments migrating workloads that drive more efficiencies and productivity into their business. This increased complexity and the rapid pace of change in business operations and IT is expanding the attack surface, exponentially increasing the risk from cyber attacks and driving the velocity of hacker innovation.

In today’s IT paradigm, the adoption of Zero Trust frameworks is accelerating. Organizations are taking a never trust, always verify approach to managing and securing human, application and infrastructure identities.

Privileged Access management is not only the foundation of Zero Trust, but also of every strong security program, which is contributing to the rising demand for our solutions. While mitigating risk for customers is a key driver of our business, we are also a core component of compliance in a growing list of requirements for GDPR, HIPAA, SOX, PCI, SWIFT, CCPA and others.

With that background I will move into our results for the quarter. We were thrilled to win 200 new logos in the third quarter, bringing our total customer count to over 5,000. We are proud that the world’s leading organizations across industries are trusting CyberArk to help protect their most valuable assets.

A few new business highlights include; a rapidly growing financial services company had deployed a niche competitive offering that could no longer scale to meet its more demanding requirements. In a rip-and-replace deal, they are moving to CyberArk, because of the breadth of our solution across endpoints, applications and core Privilege Access, as well as our ability to secure containers and modern application development with Kubernetes at scale; An information services and solutions company engaged with CyberArk to remove local admin rights on all desktops with Endpoint Privilege Manager to meet HIPAA and GDPR requirements. During the sales process, the customer suffered a ransomware attack and the deal quickly shifted to risk reduction with both Endpoint Privilege Manager and Core Privilege Access for Tier Zero access; a government agency in Southeast Asia is leveraging CyberArk to secure Access to and enable auditing of all video recording devices across its physical locations in an interesting IoT use case.

Our leadership position in the PAM market, as well as our commitment to innovation was key to winning this Greenfield deal. Given the exploitation of Privilege Access is at the root of almost all major attacks existing customers are prioritizing CyberArk in their security budgets. We have also accelerated time to value through product simplification, as well as partner enablement.

We have made it easier for customers to extend Privilege Access protection to cloud and hybrid environments, as well as digital transformation and DevOps initiatives. In fact, more than half of our Fortune 500 customers are using CyberArk to secure cloud assets.

A couple of add-on examples include, an energy company is securing Privilege Access enterprise-wide across its hybrid environment including Azure, the organization had landed with our endpoint solution, but was using a competitive offering for Privilege Access.

Over our long tenured relationship, we demonstrated our strong cloud security capabilities, our long-term vision and our high-level of customer satisfaction and as a result, we won this strategic seven figure rip-and-replace deal.

Lastly, I would call out a seven figure expansion deal with a U.S. financial services company. The company became a CyberArk customer in 2018 with core Privilege Access security for a segment of its Privilege users.

The company is now expanding to protect workloads and detect anomalous behavior in its AWS environment, remove local admin rights in over 5,000 endpoints with Endpoint Privilege Manager as a service, secure its Robotic Process Automation or RPA project with our Application Access Manager, as well as protect Privilege business users with PSM for Web.

We also had a record quarter in global government, driven in part by U.S. Federal. The strength of our federal business was in large part the result of our continued investment in this important vertical.

Just last week, we announced that our solution again achieved International Common Criteria Certification by the National Information Association Partnership or NIAP, which validates that our solution meets the stringent requirements for U.S. National Security System procurement.

This certification is used not only by the U.S., but also globally by 31 member countries, which will contribute to our ongoing success in governments around the world.

In the third quarter, our U.S. Federal business benefited from spending on our core Privilege Access Security Solution under the Department of Homeland Security’s CDM program. The CDM program makes it easier for U.S. Civilian Agencies to strengthen their security by funding approved products like CyberArk’s Core Pass. We have been thrilled with our success under this strategic federal program.

Beyond CDM, civilian agencies are standardizing on CyberArk across our solutions including key wins during the quarter for Endpoint Privilege Manager and Application Access Manager including our largest AAM deal to a federal customer.

In addition, because of our high-levels of customer satisfaction and our extensive product certifications, we also continue to gain traction in U.S. military and intelligence agencies in the third quarter.

Moving on to product diversification, Application Access Manager was included in half of our top ten largest deals in the third quarter. Every organization today is a software company using technology to automate human tasks, drive business operations, and increase efficiencies. These applications have identities that need to be secured a key driver to our Application Access Manager Solution.

We were thrilled with another record quarter for Endpoint Privilege Manager SaaS bookings. There was increasing awareness that removing local administrative rights, running a least privilege and preventing credential set is an important component of stopping attacks where they typically begin at the endpoints.

Geographically, the Americas had a record quarter and we were pleased with the growth in APJ. In EMEA, revenue grew by 13% in the third quarter, off a very strong Q3 2018 when the EMEA region grew by over 40%. Growth rates in certain countries in EMEA has been inconsistent from quarter-to-quarter in 2019.

EMEA’s annual seasonality has typically been back-end loaded towards yearend. Consistent with that trend, the fourth quarter is off to a strong start in EMEA, while there are been macro headlines regarding Europe in recent quarters, we believe demand for our solutions remains healthy.

Our more than 400 channel partners and advisory firms are extending our go to market reach. Today, we have over 4,000 certified trained professionals across delivery engineers, presales engineers and sales people, which is more than double the trained professionals at the beginning of the year.

In the third quarter, the indirect channel represented about 65% of our revenue. Our innovations have empowered customers to secure Privilege Access across on-premise in public or private cloud and in hybrid environments. Our newer SaaS solutions CyberArk Privilege Cloud and Alero are gaining momentum.

Our early Privilege Cloud customers are up and running and the pipeline of opportunities continues to build. Alero has been met with overwhelmingly positive customer feedback. Every enterprise needs to mitigate risk from third-party vendor access. We are the only vendor to combine Zero Trust access, biometric authentication and just in time provisioning without the use of VPNs, agents or passwords.

We are in a market rich with opportunity, driven by not only the complexity of IT, but also organizations embracing the cloud and executing digital transformation strategies. Our investments in research and development, in sales and marketing have positioned us as the leader in Privilege Access management and we are committed to investing in the business to drive profitable growth.

With that, let me turn it over to Josh to discuss more details about our results.

[Josh Siegel, Chief Financial Officer]

Thanks Udi. We again exceeded our outlook across all guided metrics. Total revenue grew by 28% year-on-year, ahead of our guidance reaching a $108.1 million in the third quarter. We generated $57.9 million in license revenue, increasing 25% over the third quarter last year and representing 54% of total revenue.

We also had strong diversification across our products with Application Access Manager representing about 11% of license revenue and Endpoint Privilege Manager representing about 5%.

We were particularly pleased to see EPM have another record quarter of SaaS bookings, which lowered the EPM revenue recognizing the current period, but will increase our current revenue down the road.

Maintenance and professional services revenue was $50.2 million increasing 30% over the prior year period and representing 46% of revenue similar to the last year. The professional services revenue associated with this line was $9.6 million or just under 9% of total revenue.

Geographically, the Americas reached a record $69.8 million in revenue, growing 34% over Q3 last year and representing 65% of total revenue. EMEA grew total revenue by 13% to $29.8 million or 27% of total revenue. As a reminder, in the third quarter of 2018, EMEA had a particularly strong quarter with revenue growing by 42%, which created a tough compare this year.

Year-to-date, EMEA revenue has grown 19% and as Udi mentioned, the overall opportunity in EMEA remains strong. APJ recognized $8.5 million in revenue growing 35% and representing 8% of total revenue.

As I move through the P&L, all line items will be discussed on a non-GAAP basis. Please use the full GAAP to non-GAAP reconciliations in the tables of our press release. Our third quarter gross profit was $94 million or 86.9% gross margin.

That’s compared to an 88.5% gross margin in the same period last year. The decline in gross margin which we anticipated at the beginning of the year is due to increased investment in our cloud infrastructure and in higher utilization of subcontractors, because of the strength of our license revenue in prior periods and the heavy demand for those related services.

As part of our ongoing strategy to drive growth, deliver innovation and scale the company, we continue to invest in the business. R&D grew by 20% to $15.4 million or 14% of revenues, sales and marketing increased by 18% to $40.1 million or 37% of revenues, as we expanded across all geographies to support direct and indirect sales.

This included our highest attendance and most successful Americas customer event we held in Chicago that we talked about during the Q2 call.

G&A expense increased 27% year-on-year to $9.2 million or 8.5% of revenues as we continue to scale the business infrastructure to support our growth. In total, operating expenses for the third quarter increased 20% to $64.6 million, compared with $53.9 million for the third quarter last year. Revenue outperformance and disciplined investments again drove strong leverage in the third quarter.

Operating income came in solidly above our guidance at $29.4 million or a 27% operating margin, which is also an increase from $21 million operating income and an increase from 25% operating margin generated a year ago. The majority of our expenses are related to headcount and we ended the third quarter with 1,326 employees worldwide, up from 1,106 at September 30, 2018.

We had 625 employees in sales and marketing on September 30 this year, that’s compared to 524 at the end of the third quarter last year.

CyberArk generated net income of $25.6 million with earnings per share ahead of guidance at $0.65 per diluted share for the third quarter of 2019, that’s increasing 44% from the 17.8 million and improving earnings per diluted share by $0.17 from the $0.48 we reported for the third quarter of 2018.

We generated cash flow from operations for the first nine months of $89 million. This represents a 29% cash flow margin for the period. As a result, we ended the quarter with $555 million of cash and investments.

This compares to $451 million in cash and investments at yearend. We ended the third quarter with $177 million in total deferred revenue, a 30% growth from a $136 million at September 30, 2018.

Turning to our guidance. As a reminder, our guidance does not consider any potential impact to financial, other income and expenses associated with foreign exchange gains and losses as we do not try to estimate future movements in foreign currency rates. So, for the fourth quarter of 2019, we expect total revenue of $125 million to $127 million or a 16% growth year-on-year at the midpoint.

For the fourth quarter, we expect the mix of business to be approximately 57% from license revenue and 43% from maintenance and services.

We expect non-GAAP operating income to range between $38.5 million to $40 million or a non-GAAP margin of 31% at the midpoint. We expect non-GAAP net income per diluted share of between $0.78 to $0.82. Our guidance also assumes 39.2 million weighted average diluted shares and a tax rate of approximately 21% for the fourth quarter.

We are pleased to raise our full year guidance. We expect total revenue to be in the range of $429.2 million to $431.2 million or a growth of approximately 25% at the midpoint. We are also increasing our guidance for non-GAAP operating income to be in the range of a $119.75 million to $121.25 million or an operating margin of 28% at the midpoint, which is an expansion from the 26% operating margin for the full year of 2018.

We are increasing our guidance for non-GAAP net income per diluted share of $2.58 to $2.61. This assumes 39.1 million weighted average dilute shares. Our guidance for the full year assumes an effective tax rate of approximately 20% for 2019.

As we look ahead, driving growth through disciplined investments continues to be our top priority. Our execution year-to-date reinforces our conviction that we have a long runway for growth and positions us well for the fourth quarter of 2019 and beyond.

I will now turn the call over to the operator for Q&A. Operator?

[Operator]

[Operator Instructions] Your first question comes from the line of Saket Kalia with Barclays. Your line is open.

[Saket Kalia, Barclays Capital]

Hey guys. Thanks for taking my question here. How are you?

[Udi Mokady, Chairman and Chief Executive Officer]

Good, Saket. How are you?

[Saket Kalia, Barclays Capital]

Good, good. Udi, maybe just to start with you. Can you just comment on the competitive environment, at all? And whether you are seeing any of the competitors that ownership changes in the last year or so, whether those competitors are merging at all? The numbers certainly wouldn’t seem to indicate that, but I am curious if you are seeing anything on the ground, just to add a little bit more color.

[Udi Mokady, Chairman and Chief Executive Officer]

Sure. I would say, Saket, that there is no major changes in the competitive environment that we saw in the third quarter. We still see the competition from the Francisco Private Equity rollup and so they are out there. They’ve been kind of self-disrupted with the rollup. But I wouldn’t say that they are gaining any resurgence, but deals are competitive and they show up in deals.

With regards to CA, we do see that they are working hard to try to maintain their relationship with existing customers. And I think they’ve alluded to that strategy. We have seen displacements where we’ve displaced them and of course others. As we noted a little bit in the prepared remarks, we have lot of examples of rip-and-replace including with the legacy Dell - solution.

[Saket Kalia, Barclays Capital]

That’s really helpful. Josh, maybe just one follow-up for you. Can you just talk a little bit about the overall SaaS mix of the business? You mentioned in your prepared remarks, couple times just around strong SaaS bookings for Endpoint Privilege Manager. Udi, I think you talked about strong reception for Alero Privilege Cloud.

I guess, as we look back at Q3, or maybe year-to-date, however you’d like to look it on, what percentage of the business now at this point is coming from SaaS? And how do you think about that mix going forward?

[Josh Siegel, Chief Financial Officer]

Yes, hi, Saket. It’s Josh. So, when we think about our SaaS business, the majority, the overwhelming majority of the business is still really coming from our Endpoint Privilege Manager. Alero, as you know, we just released it. I think, Udi’s enthusiasm about it was around customer reaction to the release and to the product itself and the general availability is happening only in Q4 and I think that we are optimistic there.

So, when we think about the SaaS business, it’s around the Endpoint Privilege Manager. It’s around our initial tractions for Privilege Cloud and we saw in Q3 about 7% of license revenue going to our combination of SaaS and term-based licenses about which half of that was pure SaaS business. And that was just – that’s just under 5% of total revenues.

I think as we kind of look going forward, we are seeing, it’s still small numbers, but if we look at the growth rates of our contracts for SaaS they are growing at a higher rate than the growth of the business.

[Udi Mokady, Chairman and Chief Executive Officer]

And I’ll just reiterate three sources for our SaaS revenue, EPM SaaS as the majority, Privilege Cloud that we are very excited about, again with early customers and Alero, minor correction was GA at the end of Q3, but it’s still an early product. But we are seeing a lot of excitement and it’s a no brainer issue of our remote vendor access.

[Operator]

Your next question comes from the line of Melissa Franchi with Morgan Stanley. Your line is open.

[Melissa Franchi, Morgan Stanley]

Great. Thanks for taking my question and congrats on the quarter. Udi, I wanted to follow-up on your comments on the funding environment, particularly in EMEA, you said it was uneven year-to-date. I am just wondering if it has gotten more uneven in Q3 and you did know the pipeline looks good for Q4. But how should we expect that business to track as we close out the year?

[Udi Mokady, Chairman and Chief Executive Officer]

Sure. Hi, Melissa. I would say that, the nine months it to we were able to track consistency a little bit better and to see that that in Southern Europe and in France, we’ve seen less. I wouldn’t say that Q3 was dramatically different. But we see more visibility and to the point we are in this business, you can’t overlook the macro uncertainty.

But then, you measure – we measure our own numbers and we see healthy pipeline and as I mentioned off to a strong Q4 start. We did have a tough compare there as I mentioned where Q3 2018 was 40% growth.

[Melissa Franchi, Morgan Stanley]

Right, helpful. And then, I just wanted to follow-up on the sales organization. So with Ron stepping down this quarter, I realize that he is staying on Board. But I am just wondering if you can update us on the quest to find a new Chief Revenue Officer and then, just given the transition, I am just wondering how you saw sales productivity this quarter and if you’ve seen any change in sales attrition? Thanks.

[Udi Mokady, Chairman and Chief Executive Officer]

Yes, no, absolutely, I think in the last call in August, we talked about let’s make this a best-in-class transition and I think that’s what we have been seeing on all fronts. Just the sales leadership in the company across the theaters, across the various pieces of the sales organization just completely stepped up and I would say, zero to no issues with the transition on the opposite people really stepping up.

In this quarter, I am taking a more active role and I’ve started that also in the – towards the end of Q3. In brackets, I’ll say that I am enjoying that, but don’t worry, it’s going to be short-term. I think it’s good for the business. It gives me a closer handle to the sales.

And in parallel, we are very advanced in our Chief Revenue Officer search with some – I would say, advanced candidates where we were looking for the combination of ability to further scale CyberArk towards our long-term plan, but also strong culture fit and I am very optimistic that we’ll be able to find the right candidate in the – I would say, in the next couple of months.

[Operator]

Your next question comes from the line of Shaul Eyal with Oppenheimer. Your line is open.

[Shaul Eyal, Oppenheimer]

Thank you. Good afternoon guys. Congrats on the strong set of results and elevated outlook. Udi, if - or Josh, if we look at the 200 new logos you nailed down this quarter, how many of them are displacements? How of those are Greenfield and probably, it’s a little tricky, but maybe any color that you could provide us will be extremely helpful.

[Udi Mokady, Chairman and Chief Executive Officer]

Yes, sure. I think, we would still – we gave a lot of rip-and-replace examples in the script because of just some exciting examples, but the majority were Greenfield. And then, there could be some light brown in the sense where our customer had a tactical solution more driven historically by compliance and when they took a security approach CyberArk won the full strategic approach.

So, the quick answer is primarily Greenfield. A growing amount of rip-and-replace, but some of them are really of solutions that were brought into parts of the organization.

[Shaul Eyal, Oppenheimer]

Got it. This is helpful. And as we think about the 65% coming from the indirect channels or partners, any number of VARs that stood out this quarter or pretty much very consistent across the board?

[Udi Mokady, Chairman and Chief Executive Officer]

Yes, I would say that, we saw the – of course the Federal business was extraordinary in Q3. And so, we saw our partners there really delivering. And then, across the U.S. and internationally, strong performance with the channel and the advisory fronts. I think, they don’t always – they don’t certainly count in that 65%, because they don’t resell, but they influence a lot of the deals, especially in the Global 2000.

[Operator]

Your next question comes from the line of Sterling Auty with JPMorgan. Your line is open.

[Sterling Auty, JPMorgan]

Yes, thanks. Hi guys. Josh, I wonder if you take a minute and talk a little bit about deferred revenue and billings. And what I mean by that is, traditionally, deferred revenue has gotten lumpy based on different factors.

I wonder if you could highlight those and in particular, with the strength in EPM and SaaS, I would think that that would actually given the revenue recognition actually bolstered the deferred revenue and how should we think about that as we move to the fourth quarter?

[Josh Siegel, Chief Financial Officer]

Yes, okay. Thanks, Sterling. First, we had deferred revenues grow by 30% year-on-year and I think one of the things that has impacted, maybe have slowing a bit the deferred revenue growth this year was that we are seeing more and we’ve had a case in the last couple of quarters to more multi-year deals, contracts, larger contracts that also include extended payment terms over the life of the contract meaning annual payments.

And then, that would certainly – that certainly – while it’s the business is there, it will impact the overall deferred level. But overall, I think that we feel good about the business, one is that our maintenance renewal contracts are still tracking at 90% above our renewal rates. There is no dramatic changes in how that business is operating.

And overall, I think as we kind of go – going looking forward, or going into Q4, Q4 is a big year, big quarter for maintenance renewals. So that’s when we start to see that come in. But if I will remind you and the people on the cloud that we recognize that in deferred once it’s collected and then, we recognize the PCS on that deferred after collection.

So, some of it will depend upon the linearity within the quarter of when those renewals occur, because we have to collect the cash before the yearend to be able to identify that. With regard to the SaaS, you are right, we are happy about it and we just talked about in the prior question our growth in the SaaS component, particularly in the Endpoint Privilege Manager growing.

It’s more than in the last couple of quarters it’s been more than 60% of our bookings going to SaaS contracts. But we are still talking in small numbers. So, with regard to the very large deferred numbers that we have coming from the maintenance contracts, it’s not – there is still a limited impact there.

[Sterling Auty, JPMorgan]

All right. It makes sense. And then, one follow-up question. There is a news report out there talking about you guys exploring a bond deal. Just wondering to the extent you could comment of rounds your current cash position, your capital structure and capital needs and what additional capital might be used for in that type of situation?

[Udi Mokady, Chairman and Chief Executive Officer]

Yes. Hi, Sterling, Udi here. So, obviously, we don’t comment on the market rumors. But I would say that, part of our planning involves regularly evaluating out capital structure and capital allocation and how they align with our long-term strategy and goals, really thinking long-term in every planning session we do.

[Operator]

Your next question comes from the line of Gregg Moskowitz with Mizuho. Your line is open.

[Gregg Moskowitz, Mizuho]

Okay. Thank you very much. And very good quarter guys. Congrats on that. So, I guess, first question for Udi, you mentioned that you have over 4,000 certified professionals and then that’s more than double where you were at the start of the year. Can you elaborate on how you’ve been able to scale out the ecosystem still rapidly?

[Udi Mokady, Chairman and Chief Executive Officer]

Yes, absolutely. It’s been strategic for us to – with the growing demand to make sure that our ecosystem can support our customers out there internationally. So, we’ve been investing in trading and certification and also the channel program has been updated to reward and incentivize enablement or enabled channels especially on the technical front and it really drove attendance and demand for our certification courses.

And in the customer event that Josh mentioned and then the prior one that we did in Europe, we were just overly subscribed on the training sessions. But we also take it to the field regularly. And so it’s strategic for us and the demand is out there for these certifications and I’ve seen a lot of people boast when they get the CyberArk certified result.

[Gregg Moskowitz, Mizuho]

Okay. It’s great. Thanks, Udi and then, just one for Josh. Your TSOs did go up fairly meaningfully quarter-over-quarter. If you can talk about the linearity that you saw in Q3?

[Josh Siegel, Chief Financial Officer]

Yes, actually around linearity, we saw in Q3 and really kind of – even in the first Q1 and Q2, it revert to kind of where we expect it to be. Last year in 2018, we had – and we talked about it on the call, during the year that we had really favorable to historical terms, linearity within the quarters.

And that kind of help boost our cash flow last year, as well. And this year, we are seeing it kind of revert back to a more historical norms.

[Operator]

Your next question comes from the line of Fatima Boolani with UBS. Your line is open.

[Fatima Boolani, UBS]

Good afternoon. Thank you for taking the questions. I have one for Udi and one for Josh. Udi, I’ll start with you. On the AAM and proportion of license revenue this quarter, some of the highest we’ve seen in the recent past.

So, I am wondering if you can bifurcate that strength between sort of overall improved market awareness versus anything you are doing with the sales force internally to incentivize greater adoption and then, my follow-up is for Josh.

[Udi Mokady, Chairman and Chief Executive Officer]

Sure, Fatima and it’s a great question, because I think it is the combination. The combination of deeper into the integration of Conjour and a better integrated in robust product that we have out there. The driver of really playing to digital transformation and that strong driver where CyberArk can enable customers to move workloads to the cloud into modern infrastructure.

But then also, like – as you asked, changes in the sales organization that we did in the beginning of the year, where we really embedded some overlay efforts to help the field with the emerging technologies. So the – it really supported the AAM business and it’s showing up really in our largest of the deals and hence the 11% of the revenue. It’s a really exciting part of our business.

[Fatima Boolani, UBS]

That’s helpful. And Josh, for you, I know you price in local currency in geographies outside of the U.S. Could you just remind us any movements in FX, any impact to both revenue and operating expenses, both in the quarter? And what your expectations are baking in, in your full year guidance? And that’s it for me. Thank you.

[Josh Siegel, Chief Financial Officer]

Yes. We do, as you said in Europe, we sell in sterling and we sell in euro. And if we kind of take a view of the FX impact on income, we had a headwind of about $300,000 and on expenses, we got a positive of around $900,000.

[Operator]

Your next question comes from the line of …

[Josh Siegel, Chief Financial Officer]

Sorry. Let me just correct that, it was $600,000 on expenses.

[Operator]

Your next question comes from the line of Gray Powell with Deutsche Bank. Your line is open.

[Gray Powell, Deutsche Bank]

Great. Thanks for taking the question. So, I appreciate you giving the insights on license revenue for Q4. You guys do have some pretty tough comparisons on the license front for both Q4 2019 and Q1 of 2020.

So, how would you suggest as we think about growth there on a normalized basis? And then, I mean, would it be fair to just look at the last two years and take an average or just any insights you can give us on that metric going forward?

[Josh Siegel, Chief Financial Officer]

I am sorry, you are asking about 2020?

[Gray Powell, Deutsche Bank]

Not, just like, you gave guidance on Q4 license revenue and I am just trying to think through, you guys have tough comps. So just how we should think about normalized growth on that metric looking forward?

[Josh Siegel, Chief Financial Officer]

Yes, we are not at this point…

[Gray Powell, Deutsche Bank]

If you want to give 2020, that’d be great.

[Josh Siegel, Chief Financial Officer]

No – but we are not looking at 2020. We are not going to discuss 2020 today. But I think, historically, we’ve been pretty consistent on our mix between revenue and from licenses and from services and from maintenance and at this point, there is no new news I would give regarding how we would look at 2020.

[Gray Powell, Deutsche Bank]

Okay. Fair enough. I just try another one if I can. Just how do you feel about visibility on your pipeline and growth prospects today relative to this time last year?

[Josh Siegel, Chief Financial Officer]

Well, I mean, about our pipeline, it’s grown, it’s much bigger this year than it was last year at this time and I think as Udi also remarked in his remarks that we are seeing a growth across all of our different products, across all of the different geographies. So, I don’t think we – I think we feel we are in a similar position to how we see the market today than how we saw it a year ago.

[Operator]

Your next question comes from the line of Ken Talanian - Evercore ISI. Your line is open.

[Ken Talanian, Evercore ISI]

Hey, thanks for taking the question. I was wondering if you could give us some color on how customer expansions performed in the quarter and how you are thinking about the contribution from expansions in 4Q?

[Udi Mokady, Chairman and Chief Executive Officer]

Yes, absolutely. So, add-on business was more than 60% of total revenue and on a base of 5,000 customers now, it’s become a super strategic fit to continue to grow that customer base from beyond the into Core Pass of course, where it’s strategic, but also with the emerging technologies.

So there is a lot of add-on opportunity within the customer base and we invest in that regularly while going after the Greenfield opportunities. So, we have both engines turned on.

[Operator]

Our next question comes from the line of Gur Talpaz with Stifel. Your line is open.

[Gur Talpaz, Stifel]

Okay, great. Thanks for taking my questions and congrats on a good quarter. Udi, you talked a bit about Alero on the call and you gave us some exciting initial feedback. But I was more curious to see if you are encountering a different competitive set here with the solution, with the approach as you ultimately look to broaden the value prop of the company.

[Udi Mokady, Chairman and Chief Executive Officer]

So, right now, we are really focused on the remote vendor access in high growth. Very focused on the remote vendor access as a privileged expansion opportunity and as a privilege use case. I mean, it’s kind of a no brainer if you want to limit and put controls over how IT employees and developers of your company are accessing the IT infrastructure.

You definitely want to put those controls on third parties that are coming in and getting Privilege Access and the solutions today are punching holes with VPN. And so, it’s an expansion of the Privilege use case and I would say that in the short-term, we are keeping it under the Privilege umbrella.

[Operator]

Your next question comes from the line of Daniel Bartus with Bank of America. Your line is open.

[Daniel Bartus, Bank of America]

Hey guys. Thanks for taken the question. So, maybe first for either Udi or Josh, I wanted to also ask about AAM a little bit differently. Across some of your more mature customers, how does the split of their spending look between the application and the Core Pass side of things? And then, ask differently, just kind of how are you guys thinking about the TAM in your customer base between the application and Core Pass there?

[Udi Mokady, Chairman and Chief Executive Officer]

So, I would say that the majority of the customers of course start with Core Pass and start with securing human access. And so, it’s still the smaller part of our customer base that has addressed the AAM use case and those that have done, usually start with some low hanging fruit, like securing off-the-shelf third-party solutions through our extensive C3 Alliance program and partnerships.

And then, more and more we are in the path to use they would gravitate or securing embedded credentials and code and legacy applications and more and more moving to securing dynamic applications from our Conjour acquisition. So, it’s still very much open ground in the majority of our customers.

And I think, in the past, we’ve equated it where the deal size in a customer that went all in, in AAM can be equal to the potential opportunity on securing the humans is not greater. So it’s part of the TAM. We put out there when we discussed our overall TAM.

So we factored it in. But it’s really two different things. Securing humans and securing applications, yes, we can double the – I would say, the value in a customer through this kind of expansion.

[Operator]

Your next question comes from the line of Nick Yako with Cowen and Company. Your line is open.

[Nick Yako, Cowen and Company]

Hey guys. Thanks for taking my questions. Can you just provide an update on the mid-market build out? Any key investments you still need to make? And then, maybe how that segment contributed to overall results in the quarter?

[Udi Mokady, Chairman and Chief Executive Officer]

Absolutely. So, like we said before, the more strategic part of our business is definitely the enterprise. But we’ve built out a team that’s looking further into mid-market and proving the case that that we can serve a low touch, higher volume type of sales. So we definitely see that as a component of the business.

But it’s still a small part of the revenue. And so, I would say, we are growing that muscle. It’s an important long-term muscle for us. But the majority of the revenue comes from the enterprise opportunity and that’s where the majority of focus on investment is for us.

[Operator]

The next question comes from the line of Howard Smith with First Analysis. Your line is open.

[Howard Smith, First Analysis]

Yes, thank you for taking my question. In the past few years, we’ve talked about the driver moving from compliance to security focus. So I was interested in your prepared remarks you mentioned the growing list of standards requiring has and I am curious is that opening up new verticals to you? Or how was that affecting the business trends you are seeing?

[Udi Mokady, Chairman and Chief Executive Officer]

Yes, I think – hi, Howard. I think it’s – the – one of the reasons we mentioned it again is it’s popping up as a supporting driver in many of the deals. So the main driver is still our risk reduction. But in these enterprises, they have these DPR mandates or they have mandates prepared for the new California regulation and it’s coming up as a – all right, this helps us also support this mandate and sometimes it’s in the budget allocation and in others.

And so, I think we are really multi-vertical already and very diversified. But we’ll keep a close watch at this further expense especially internationally and we’ll come back with more data.

[Howard Smith, First Analysis]

Perfect. And just as a quick follow-up. You called out the government in particular, particularly strong this quarter. Any other vertical strength you might highlight?

[Udi Mokady, Chairman and Chief Executive Officer]

Yes, energy was a stronger example. Pharmaceutical is another one in the quarter. But, I think the beauty is we also – when we look at a year-to-date perspective, we actually see strong consistency of the strong performance across all verticals.

[Operator]

Your next question comes from the line of Taz Koujalgi with Guggenheim. Your line is open.

[Taz Koujalgi, Guggenheim Partners]

Hey guys. Thanks for taking my question. Can you comment on the duration for this quarter? List out the long-term deferred mix went down a bit this quarter versus the last few quarters it was going – the mix was going up and how should we think about that for Q4?

[Josh Siegel, Chief Financial Officer]

Yes. Hi, Taz. This is Josh. The duration is not really moving around all that much quarter-to-quarter. It’s really what you are looking at on the deferred, I kind of spoke about earlier as well. One of the things that we saw in Q2 and Q3 is that some larger multi-year contracts that had payment terms across each year as opposed to upfront for those multiple year contracts.

So, you are not necessarily going to see then the deferred for those long-term pop up from those contracts. And that reflects several million of the maybe the increase that you’re looking for in the deferred.

[Operator]

Your next question comes from the line of Erik Suppiger with JMP. Your line is open.

[Erik Suppiger, JMP Securities]

Yes, thanks for taking the question. Two questions, one, can you break out what the federal contribution is? Or can you at least provide some context around the contribution and how are you getting there?

[Josh Siegel, Chief Financial Officer]

Yes. Hi. This is Josh. Typically, we see global government be just around 10% - just 10% to 11% of the business, of which, Federal will be anywhere from just under a half of it. And this time, we saw global government be in close – in the mid-teens with federal driving that extra growth.

[Operator]

Your next question comes from the line of Dan Ives with Wedbush Securities. Your line is open.

[Dan Ives, Wedbush Securities]

Yes, just on the last question, in terms the Federal, I mean there is a lot of cloud deals going on, especially on the Federal side, that seem like they could create opportunities for you guys in terms of the product positioning.

So maybe, can you talk about it? I mean, is that something where we look out a year, some of the opportunities there is much more significant than what you’ve seen over the last year just given what’s happened, Federal on the move to cloud? Thanks.

[Udi Mokady, Chairman and Chief Executive Officer]

No, absolutely. I can’t say yet that we can connect ourselves to the recent headlines on some major Federal cloud decisions. But if you – we look in our world, A, where part of the deals have been securing application workloads and the ability to transition to modern workloads with our AAM.

And while the bigger drivers are really securing infrastructure, it’s very clear that we are extending and will extend to the government’s cloud infrastructure. But right now, it’s securing the infrastructure they have. Some of it includes some early cloud adoption and a lot of it is the bread and butter infrastructure.

[Operator]

Your next question comes from the line of Shebly Seyrafi with FBN. Your line is open.

[Shebly Seyrafi, FBN]

Thank you very much. So, you just had a rather steep decline in your services gross margin to like, 70.7% from the mid-70s before. I think you mentioned, future cloud and subcontractors, going forward, do you see that services gross margin continuing to decline to like 65% or do you think it stabilizes around 70% or so?

[Josh Siegel, Chief Financial Officer]

Yes. Hi. This is Josh. Yes, you are absolutely right. We saw decline mostly on the services side it was related to the using subcontractors to fulfill the demand for providing the service – the increased demand that we are getting. And overall, it’s – the function of using subcontractors is the lumpiness and the demand for how many days we need to deliver.

Overall, we could – I don’t anticipate that driving or moving the number that much more. On the cloud side, the more we sell SaaS, software and business and clearly, the cloud is going to become a bigger and bigger component of that. But still, I think that it’s going to be gradual and we’ll be able to give clarity on that when we talk about 2020.

[Operator]

Your next question comes from the line of Joshua Tilton with Berenberg. Your line is open.

[Joshua Tilton, Berenberg]

Hi, thanks for taking my questions. Just a follow-up on the mid-market. We’ve been seeing some of the identity governance players bundling in Privilege Access functionality, with the IGA functionality, I was just curious how should we think about the competitive landscape as you move into the mid-markets?

[Udi Mokady, Chairman and Chief Executive Officer]

Yes, you are probably alluding to the recent SailPoint acquisition. We actually have been looking at that closely and talking to them and it’s primarily a cloud governance move with some of the tuck-ins they’ve done and we continue to collaborate in the field strongly.

And so, I would say that when we look at the mid-market opportunity, it’s still the PAM vendors that are going after it. For us, it’s an expansion and there are some vendors that started from mid-market and we meet there.

[Operator]

There are no further questions at this time. I will turn the call back over to Udi Mokady, Chairman and Chief Executive Officer for closing remarks.

[Udi Mokady, Chairman and Chief Executive Officer]

Thank you, Scott. In closing, we would like to thank our customers, partners, and employees around the world for contributing to our strong third quarter results. Thank you very much.

[Josh Siegel, Chief Financial Officer]

Thank you.

[Operator]

This concludes today's conference call. You may now disconnect.