Cyberark Software Ltd

NASDAQ:CYBR

Earnings Call Transcript 2022-Q3

[Operator]

Good morning. My name is Rob and I will be your conference operator today. At this time, I would like to welcome everyone to the CyberArk Third Quarter 2022 Earnings Conference Call. [Operator Instructions] Thank you.

Erica Smith, SVP, Investor Relations and ESG; you may begin your conference.

[Erica Smith]

Thank you, Rob. Good morning. Thank you for joining us today to review CyberArk's third quarter 2022 financial results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open up the call to a question-and-answer session.

Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements which reflect management's best judgment based on currently available information. I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operations for the fourth quarter, full year 2022 and beyond. Our actual results might differ materially from those projected in these forward-looking statements. I direct your attention to the risk factors contained in the company's annual report on Form 20-F filed with the U.S. Securities and Exchange Commission and those referenced in today's press release that are posted to the CyberArk's website. CyberArk expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein.

Additionally, non-GAAP financial measures will be discussed on this conference call. Reconciliations to the most directly comparable GAAP financial measures are also available in today's press release as well as in an updated investor presentation that outlines the financial discussion in today's call. We also want to remind you that we provide the calculated headwind for additional color on the impact of our subscription bookings mix shift but it should not be viewed as comparable to or a substitute for reported GAAP revenues or other GAAP metrics. A webcast of today's call is also available on our website in the IR section.

With that, I'd like to turn the call over to our Chairman and Chief Executive Officer, Udi Mokady. Udi?

[Udi Mokady, Chairman & Chief Executive Officer]

Thanks, Erica and thanks, everyone, for joining the call. We had a strong third quarter, demonstrating the durability of demand for our solutions and the momentum we continue to see in our business. A number of key metrics underscore the strength of our results. Subscription ARR reached $301 million, up from $255 million at the end of Q2, the largest sequential increase in our history.

Total ARR reached $512 million with growth accelerating for the third consecutive quarter to 49% year-over-year. While ARR remains the best metric to measure our success, the benefits of our subscription transition are kicking in on the top line with total revenue growth accelerating again to 26% and reaching $153 million in Q3. It is important to remember that the subscription transition continues to impact our reported P&L. For the quarter, the mix was about 87%, significantly higher than the 72% in the third quarter last year which created a revenue headwind of about $11 million. Normalizing the mix of the third quarter of last year, our total revenue line would have grown by 35% this quarter. With our strong execution year-to-date, the prioritization of our identity security platform, the demand for our SaaS solutions and ongoing secular tailwinds, we are significantly raising our full year ARR guidance to over 40% growth at the midpoint which Josh will talk about later in the call.

To frame our discussion today, we will focus on growth, innovation and profitability. Starting with growth. Strong secular tailwinds of digital transformation, the adoption of Zero Trust and attacker innovation continue to push Identity Security to the top of Chief Information Security Officers priority list. With the heightened threat landscape, attacker renovation is front and center in our discussions. And privileged escalations continue to be a common denominator in the attack chain. Another growing challenge is the pickup of MFA fatigue, where attackers in an data victim with prompts until the multifactor authentication request is approved. The increased use of MFA bypass techniques has clearly demonstrated the need for a more robust defense strategy through an integrated access, PAM and secrets management approach. This has been a strong pipeline generator for CyberArk and our Identity Security platform.

Digging into our results; on the product side, momentum continued across our solution set. We were particularly pleased with the performance of CyberArk Identity, PAM and the EPM in the third quarter. On the new business front, we had a strong new logo quarter signing nearly 230 new customers. A few examples include: in a 7-figure rip and replace deal, a Fortune 100 retailer landed with PAM, Secrets Management and EPM. This customer embraced the breadth of our Identity Security platform and will leverage CyberArk to scale its growing IT environment, help protect across human and machine identities, lock down thousands of endpoints and protect against ransomware. The race to digitize is not just expanding the attack surface but also accelerating the adoption of Zero Trust. And in Q3, we were chosen as the enterprise-wide foundation of a global manufacturer Zero Trust framework with Privilege Cloud and EPM, with plans to expand to Secrets management.

Based on a Board level mandate, a major born in the cloud manufacturing company landed with Privilege Cloud and EPM demonstrating that Identity Security is front and center in the highest level of strategic discussions. A European government agency landed with our workforce password manager to give all its employees increased security controls on their personal passwords from CyberArk with our deep expertise in PAM. This is just 1 example of the robust demand for workforce password management in recent months. Our subscription transformation is increasing the velocity of add-on business and cross-selling across the portfolio. This is contributing to the greater than 50% increase in the number of customers with more than $100,000 of annual recurring revenue to nearly 1,200 customers at the end of September. A few expansion examples include: a leading energy company in APJ, landed with PAM previously and is now expanding across the portfolio with EPM and sequence management as well as with additional Privilege Cloud users.

In Q3, a large retailer became our second largest privileged cloud customer with a major expansion deal, bringing its ACV to well over $1 million. A long-standing Fortune 500 PAM customer, who had expanded to secure Secrets management in 2021, further deepened its relationship with CyberArk in Q3. As part of its Zero Trust initiative, this customer will lock down over 45,000 endpoints with EPM. We have spoken about it in the past. While the industry has been talking about Zero Trust for a few years, enterprises today increasingly are increasingly executing Zero Trust strategies which is contributing to our growth. Our channel program is key to our success and partners continue to scale their identity security practices. We have added new routes to market, enhance collaboration and improved channel program efficiencies across our VARs, advisories and MSPs.

Moving on to innovation, the cornerstone of our strategy and leadership position in identity security. During the third quarter, we began taking our CyberArk Impact customer event on a world tour to 16 cities in 14 countries. In our discussions at these events, the new innovations we announced last quarter are gaining traction in the field. CyberArk Identity Compliance is now generally available and makes it easier for organizations to enforce and demonstrate compliance by continuously discovering access, streamlining certifications and providing comprehensive identity analytics.

In early October, we also rolled out a user-friendly way to help lock the MFA fatigue technique from gaining unauthorized access to protective systems. Customers are also excited about Secret Hub and Conjur Cloud which strengthen our ability to secure both human and machinery daily. Profitability is the final pillar I will discuss today. While our reported P&L continues to be impacted by the subscription transition, we haven't changed our investment approach. We are delivering excellent returns, including accelerated innovation as well as a rapid revenue and booking growth. We continue to expect to be a Rule of 40 company as we move past the subscription transition dynamics.

Before I turn it over to Josh, I wanted to update you on what we are seeing with regards to the macro environment. The broader macroeconomic uncertainty did not have a significant impact on our business in the third quarter which you see in our nearly 50% growth in ARR, revenue acceleration and the increase in our ARR guidance. Our solutions are mission-critical and identity security is being prioritized. We have seen incremental FX headwinds and some large deals require incremental approvals but this did not meaningfully slow down sales cycles in the third quarter. Our pipeline and demand are robust and we continue to watch the situation very closely and are analyzing the trends in our business more frequently.

In closing, the top line benefits of our subscription transition are kicking in and our identity security platform continues to gain momentum. Our performance, in particular, our strong ARR growth demonstrates that we are in the best competitive position we have ever been in. Given our experience and durability of our business, we are confident that we can execute against a multiyear durable growth opportunity and deliver best-in-class profitability and cash flow over the long term.

I will now turn the call over to Josh, who will discuss our strong financial results in more detail and provide you with our outlook for the fourth quarter and full year 2022. Off to you, Josh.

[Josh Siegel, Chief Financial Officer]

Thanks, Udi. And as Udi just mentioned, we had a strong third quarter which is reflected in our key metrics.

Growth accelerated for the third consecutive quarter to 49% year-on-year and ARR passed the milestone of over $0.5 billion to $512 million. With our continued strong growth, we are on our way towards passing the $1 billion ARR target. The subscription portion of annual recurring revenue reached $301 million, that's increasing 117% and now represents 59% of our total ARR. Just a year ago, the subscription portion was only $139 million and just 40% of total. The maintenance portion was $211 million at September 30. Total revenue came in at the top of the range with $153 million. Total revenue growth again accelerated sequentially to 26% year-on-year. That's up 21% growth in the second quarter of 2022. Keep in mind that FX impacted our revenue and bookings growth this quarter, about $2 million in total revenue and on ARR of about $2.5 million.

Moving into the details. Subscription revenue reached $74.2 million, growing 110% year-on-year, representing 49% of total revenue in the third quarter. Consistent with our move to a subscription business model, perpetual license revenue came in at $13.8 million. Our maintenance and professional services revenue was $64.6 million. That's $54.2 million coming from recurring maintenance and $10.4 million in professional services revenue. Recurring revenue reached $128.5 million, that's 84% of total revenue, growing 44% year-on-year from the $89 million in the third quarter last year. Subscription bookings mix came in at 87%. That's just above our expectations for the third quarter. Economically, the revenue headwind created by the mix was approximately $11 million in the third quarter when we compare it like-for-like to the third quarter of 2021 when the mix was just 72%.

Taking the calculated revenue headwind into consideration, total revenue would have grown by 35% year-on-year, validating that we continue to take market share in Identity Security. Geographically, the business is well diversified. The Americas revenue reached $94 million, representing 61% of total revenue. The Americas growth accelerated to 37%, EMEA grew by 10% year-on-year with $43 million or 29% of total revenue. It's important to keep in mind that EMEA results were impacted by 2 factors: first, the higher subscription mix; and second, $2 million of currency headwind. APJ grew by 13% to $15.5 million in revenue or 10% of total. If we normalize for the mix, the Americas would have grown by 45% year-on-year, EMEA would have grown by approximately 21% and APJ by approximately 25%. We are also pleased with the great progress APJ is making increasing its subscription mix which now reached over 80% in the last quarter.

All line items of the P&L will be discussed on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release. Our third quarter gross profit was $126 million. That's an 83% gross margin compared with 84% gross margin last year. We are pleased with our gross margin outperformance in a large part because we have closely managed the expenses related to SaaS. While we continue to make investments to drive innovation and growth, we are also demonstrating our ongoing operational rigor. Our investments resulted in operating expenses of $130 million, a 27% increase year-on-year which resulted in a $4 million operating loss still coming in significantly better than our guidance.

One thing to point out, our headwind adjusted revenue growth rate of 35% is meaningfully outpacing our 27% operating expense growth rate. That's another proof point of the leverage underlying our business. We are still being impacted by the mix shift towards ratable revenue which lowered our operating results. Normalizing for that mix, operating margin would have been positive 4% in the third quarter. As a reminder, this only level sets the mix to the prior year and not all the way back to the beginning of the transition. If you level set our mix to 2020, CyberArk is operating as a Rule of 40 company today which was part of our execution strategy.

A guiding tenet of our subscription transition was to rigorously manage our business and expense levels that we continue to operate efficiently and invest productively. We are delivering on that. Net loss was about $2.3 million or $0.06 per diluted share for the third quarter, also significantly better than our guidance. We continue to attract and retain top talent. That's a testament to our culture, ending September with over 2,600 employees worldwide, including approximately 40 related to the acquisition of C3M, the majority of which are in R&D. We ended the quarter with about 1,100 people in sales and marketing. For the first 9 months of 2022, free cash flow was $20.4 million or a 5% free cash flow margin which is meaningfully ahead of the free cash flow guardrails we set for the full year and demonstrates the strength of our subscription model.

Now turning to our guidance. Our guidance for the fourth quarter and the full year reflect robust industry tailwinds, strong execution and our growing ARR base. For the fourth quarter of 2022, we expect total revenue of $169.9 million to $176.9 million which represents about 15% year-on-year at the midpoint. And we expect non-GAAP operating income of about $2 million to $8 million for the fourth quarter. We expect our non-GAAP EPS to range from $0.07 to $0.20 per diluted share. Our guidance assumes an increase in subscription bookings mix and that it still remains over 85%. The resulting calculated revenue and profitability headwind is expected to be between $17 million and $18 million for the fourth quarter. If you normalize for the mix, our estimated revenue growth at the midpoint of the range is over 25%. Our guidance also assumes 45.8 million diluted shares and about $4.3 million in taxes.

For the full year 2022, we expect total revenue in the range of $592.5 million to $599.5 million. Our guidance assumes a revenue headwind of between $66 million and $67 million and the increase in the headwind reflects a higher mix and bookings assumption underlying our fourth quarter forecast. If you normalize for the mix, our estimated revenue growth at the midpoint is over 30%. We are very pleased to increase the midpoint of our headwind adjusted full year guidance range despite the increase in FX headwinds which I will discuss in a minute.

For the full year, the range for our non-GAAP operating loss to be between $24.5 million and $18.5 million, we expect our non-GAAP net loss per basic and diluted share to be in the range of $0.54 to $0.39. For the full year, we expect about $40.7 million basic and diluted shares and about $11 million in taxes. We are also increasing our full year guidance for the annual recurring revenue which we now expect to be between $552 million and $558 million at December 31 or between 40% and 42% year-on-year growth, respectively. We are thrilled to raise our ARR guidance. It demonstrates the considerable strength we continue to see in our business.

I did want to update you on our expectations for impact from FX. We can expect to see a full year estimated currency impact to ARR of about $7 million related to the pound and the euro which is about $2 million higher than we discussed last quarter because of further currency movements. We also estimate the impact from currency moves will lower our recognized revenue by about $6 million which is $1 million more than we discussed in August. These currency moves are already reflected in the guidance I provided a few moments ago.

Moving to free cash flow; we anticipate that it will be about 6 to 10 percentage points above our non-GAAP net income margin over a 12-month period. Third quarter was another strong quarter. We are confident that demand for our Identity Security platform is highly durable. We remain focused on capitalizing on the massive opportunity in front of us that will deliver profitable growth and strong cash flow, creating long-term value for our shareholders.

I'll now turn the call over to the operator for Q&A. Operator?

[Operator]

[Operator Instructions] And your first question comes from the line of Saket Kalia from Barclays.

[Saket Kalia, Barclays]

Okay, great. Solid set of results. Yes, I see you too, Udi, maybe we'll just start with you. I was wondering if you could just talk a little bit about the performance of the business outside of traditional PAM. In several of your examples, I mean, there was EPM, there were secrets. There was a little bit of access as well. Maybe the question is, Udi, to what extent are these non-PAM products becoming landing points? And how often are you able to cross-sell traditional PAM along with that? Does that make sense?

[Udi Mokady, Chairman & Chief Executive Officer]

Absolutely. I think we talked about that our excitement last time about having more landing points in our new logos and we're increasingly landing with both access and EPM actually as landing point for us and then expanding back into PAM which gives us a very strong durable growth opportunity. Of course, the majority of new logos are still landing with PAM but then we see the huge opportunity in cross-selling them into access and EPM. And yes, we gave examples here also on the access side, like the customer example with workforce password management and others and the speed bolts really working well.

[Saket Kalia, Barclays]

Got it. Got it. That's great. Josh, maybe for my follow-up for you. Maybe just dig into maintenance ARR a little bit. I think that's been up sequentially for a couple of quarters. Can you just talk about sort of what's driving that? And how should we sort of think about when that realistically starts to decline sequentially.

[Josh Siegel, Chief Financial Officer]

Yes. Thanks, Saket. Thanks for joining the call. Yes, we actually have done really well on the maintenance this year. Basically, it's because we're preserving still higher renewal rates for those customers. But we do anticipate already even in the fourth quarter that we can see a small decline of a couple of million dollars in that maintenance ARR. And we anticipate as we move into next year as well, we'll continue to see a decline on the ARR piece of the maintenance. As you can see from the transition that we're really reducing dramatically the bookings that are going towards a perpetual business. And even across now, I talked about it in my prepared remarks, even into APJ now area, we're well over 80% of the bookings going to SaaS and subscription.

[Operator]

Your next question comes from the line of Hamza Fodderwala. Please provide your company name, please.

[Hamza Fodderwala, Morgan Stanley]

This is Hamza Fodderwala from Morgan Stanley. So just 1 question for you. It seems like the consistent theme in the last 6 or 7 quarters has been the priority level of privilege access management is higher than it's ever been. And can you talk a little bit about how you are now able to attract customers that perhaps you weren't able to a couple of years ago, beyond the large enterprise in particular. Is it regulatory requirements? Is it the fact that the SaaS model is making it easier for you to go after those customers as new channels? Maybe just talk a little bit about how the value proposition is now attracting a broader base today?

[Udi Mokady, Chairman & Chief Executive Officer]

Sure thing, as good to speak to you today. So definitely, if we were to block the demand drivers for CyberArk, we would see them increase over time and privileged access management and identity security continuously rising to the top priority. I think the biggest drivers overall is the attackers and the attack landscape where almost any attack that you analysts [Technical Difficulty].

[Operator]

Ladies and gentlemen, we have lost connection with the speaker. Please stay on the line. We'll be back in a moment.

[Udi Mokady, Chairman & Chief Executive Officer]

All right. So sorry about that. It looks like there was a disconnect and we're back in, happy to continue answering your question, Udi here. So I talked about the growth drivers continuously growing over time. And of course, with attackers going after credentials and identities, privileged access management and identity security are really rising to the -- at the top of growth a priority list for our customers. And of course, it became a cross-vertical opportunity where it's really across the board from that growth driver and, of course, additional growth drivers that we've been collecting over time, like regulations that you alluded to, like cyber insurance and even answering insider threat.

And then like you mentioned, Hamza, the ability to deliver that in SaaS is really making our offering accessible to a broad variety of customers out there. And of course, the global reach of our sales team and the channel enables that. We've been diversifying our channel advisories, value-added sellers and also MSPs to be able to answer that demand. So that combo is really working for us and puts us in that strength, both high priority in the CISO and the buyer list and execution strength. And again, sorry, that we got disconnected for a second.

[Operator]

And your next question comes from the line of Rob Owens from Piper Sandler.

[Rob Owens, Piper Sandler]

Udi, I think you made the comments in and around the best competitive position you've been in some time. Can you talk a little bit about your win rates, I guess, touching on where competition is, number one? And then number two, can you address size of land and if you're seeing that expand here versus what you've had historically given that you're bundling in or selling additional products?

[Udi Mokady, Chairman & Chief Executive Officer]

Yes. I think we look across both PAM and across our offerings where we see that we're in a better position in terms of leadership and the acknowledgment by customers that any innovation is going to come from CyberArk. And of course, the ability to consume and our delivery of everything in SaaS. So we're definitely seeing continued very strong win rates in PAM. CyberArk is the 1 invited to, of course, any PAM makeup. And with the increased innovation and the broadening of our suite, we're just seeing that -- those continued win rates go up. So that's in PAM. In Identity, we're just excited, like for my prior answer, we saw ARR there double and we're continuously invited and being perceived as the differentiated security-driven identity solution.

If you care about security and you want to address all identities, you go with CyberArk. And again, this is just a huge opportunity ahead of us in identity. And then with regards to the deal sizes, I think over the last year, we've seen our deal sizes continuously walk up, particularly when we land with more products. I was asked earlier about how we land our ability to land with identity and with EPM but the most beautiful landing is when we land with multiple products.

[Operator]

And your next question comes from the line of Adam Borg from Stifel.

[Adam Borg, Stifel]

Maybe just for Udi on M&A. You made a few of these small tuck-in deals with recently 3PM that you referenced earlier. I was thinking just given all the changes happening in the broader identity landscape, your solid execution, potentially valuation dynamics, how you're thinking about M&A going forward and even appetite for larger M&A from here?

[Udi Mokady, Chairman & Chief Executive Officer]

Yes. I think we're a very strategy first company that's the approach that Clarence on our team is driving. And so we continuously map out the opportunities and look at build versus buy and that's how we've been very prudent and very, I would say, deliberate in the acquisitions we've done so far. I think as I alluded in the past, we think that in this environment, we're going to have even more opportunities of entry and things that will be applicable to us but it will always have to be because it's dear to our strategy and it's near to our customers. And right now, we really have a wide portfolio and are focused on delivering that to our customers. We'll always have that strong muscle of looking for opportunities to exercise on that -- on those strategic opportunities.

[Operator]

Your next question comes from the line of Shaul Eyal from Cowen & Company.

[Shaul Eyal, Cowen & Company]

Congrats on the strong execution and on guidance. Udi, 1 of the key takeaways you highlighted on your presentation under the key takeaways applied is that it kind of increased velocity of cross and upsell customers coming back faster after the initial land. Maybe can you put maybe some sort of a qualitative time frame addressing the pace in between the initial land and then kind of the expand? And secondly, what's driving that accelerated pace? Is that the macro on the 1 hand or kind of strictly the model transition or both?

[Udi Mokady, Chairman & Chief Executive Officer]

Yes. In terms of what's driving it, it's really the ability for us to the more of a platform selling and the fact that we have a platform that services the customer and of course, in SaaS, their ability to realize quick time to value with us, an opportunity for both upsell and get better -- faster into to consuming our offering and then cross-sell with our solutions. And again, with an easier way for the customer to get the value as they go with the cross-sell. And yes, like we mentioned, we saw it -- it take 50% year-over-year, bringing us to now 1,200 customers with over 100,000 in ARR. So we're excited about that. And it's our ability to address their needs that's driving that. We're much closer to them. And we have the telemetry to know how they're using the product and past investments in customer success, that's all been kicking in to increase that velocity.

[Shaul Eyal, Cowen & Company]

Understood. And maybe, Josh, trends from a geographic perspective, U.S., EMEA, everything appears to be absolutely stable. Maybe just some additional color on what's going on APAC?

[Josh Siegel, Chief Financial Officer]

Yes. Thanks, Shaul. Yes, as I pointed out in my remarks, we had really good growth across all the regions. And particularly when you consider kind of the mix shift changes that we saw in EMEA and APJ, where both of them now are selling well over 80% in SaaS and subscription and had the kind of the largest headwinds. And even they are both at about 25%. In EMEA, we did have some FX hit, obviously, there in that region. So if you add the FX and if you add the mix, then you would get to about a 25% growth rate for EMEA on a quarter or year-on-year basis. And overall, I think the beauty of CyberArk and you've been following us a long time, so is that we've been diversified along the same kind of lines of close to 60% in Americas and 30% in EMEA and the balance in APJ now for a long time and we're seeing kind of all regions growing with the business.

[Operator]

And your next question comes from the line of Eric Heath from KeyBanc Capital Markets.

[Eric Heath, KeyBanc Capital Markets]

Congrats on an impressive set of results, Udi and Josh. I guess I'll ask on secrets management. Just curious what's been the customer response, particularly from maybe the developer crowd, if you will, following your recent announcements of your native integration with AWS secret management solution? And then if you could just kind of give us an updated view on the competitive landscape between yourselves and HashiCorp in the space, that would be great.

[Udi Mokady, Chairman & Chief Executive Officer]

Sure. And I love the question because we also had so much opportunity to see it on the road. I mentioned our impact on the road with customer events across city. So we first announced our integration with AWS in July and our Boston event and then have been taking on the road. And yes, we see, first of all, the relief on the security side where they -- it relieves our security buyer from having to educate and force change on the developer and the developer is able to work natively. And similarly, we're hearing that from developers that CyberArk is now enabling them to adopt our secrets management without changing the way they work. And we've only just begun. We're going to take this to -- we started with AWS but we're going to take this to the other cloud platform and we want to be that backbone that central for the organization for both human and secrets.

In terms of the competitive dynamic with Hashi, I think that's the prime competitor we see in that space and we're coming in from those different motions. We come in through security, we come in from -- as the business driver is really -- we want to enable the developers but security want to secure the organization and we're having a great win rate and definitely within the strong customer base. It's -- we have that opportunity for expansion. We have some low-hanging ways to land in the organization and deliver value and then we expand to their critical applications. But this will be continuously a competitive edge for us, the ability to be both trusted by security because of the strong platform that also serves humans and then also be easy to adopt by the developer because they can work natively.

[Operator]

Your next question comes from the line of Jonathan Ho from William Blair.

[Jonathan Ho, William Blair]

Let me echo my congratulations as well. One of the things that you talked about was MFA fatigue. Can you maybe give us a little bit more detail on how CyberArk helps solve that challenge for customers -- and maybe how often this is serving as a new driver for business.

[Udi Mokady, Chairman & Chief Executive Officer]

Thanks, Jonathan. And it's actually brand new. I think for those who -- I would refer also anyone who wants to read, we put out a blog that analyzes the recent Uber reach. And that's an example where, again, legitimate user was inundated by MFA and eventually ended up accepting the hacker challenge and that was the entry point. But beyond that, it was all about credential theft on the inside. So we see ourselves as really a big part of the solution, both on the front end and I'll talk about our solution for that. But then I say if I think. But even more importantly, being that backbone that even if you enter the organization, the CyberArk Identity Security platform will prevent the ceiling of credential, the lateral movement, the privilege escalation that, for example, was seen in that attack.

And then because as a response to that, we actually were very agile and we rolled out functionality that basically adds no friction to the user but helps combat the MFA fatigue. It's a number recognition system where a user logging into CyberArk is shown a unique number on the log-in screen. And if you're not in front of the screen, if you're not a legitimate user, you're not going to be able to feed that and put the matching number into the CyberArk identity, mobile authenticator. So it gives peace of mind to the security professionals that their end users can't just say accept, they have to be the right human in front of the machine to do that. So that specifically is our solution.

Yes, we're seeing it is driving demand for -- we need a security approach to this identity challenge. It's not just managing identities, we need security companies to go after that. So it's -- we're seeing that as part of the demand and it's a differentiator for the CyberArk brand.

[Operator]

And your next question comes from the line of Jonathan Ruykhaver from Cantor Fitzgerald.

[Jonathan Ruykhaver, Cantor Fitzgerald]

Congrats, guys. So Udi, the question I have is around Privilege controls like secure web session, dynamic privilege access just in terms of the opportunity you might be seeing to leverage those capabilities to drive new lands and then to potentially replace existing IAM solutions. And I realize that this motion is still early and most likely a lot easier to just sell Privilege Cloud into greenfield opportunities. But what do you think of that expansion opportunity led by those privileged controls?

[Udi Mokady, Chairman & Chief Executive Officer]

That's a great question. It was part of our strategy to be the identity security company can be differentiated on the fact that we come in and add security controls. Even if you have and Identity and Access Management solution, that's specifically to our secure web sessions. Like you said, it's early but we're seeing that differentiated and as a place for us to land and customers that have basic single sign-on in place. And then over time and upon renewal, we can expand with them to the broad identity suite and also the broad offering from CyberArk. Dynamic Privileged Access is a very light way to add on to our PAM and the differentiator in the market where we give a very simple way to manage a modern environment. So it's in everything we do. It's in every I would say, sales process today and gives us -- these offerings gives us also a way to get a healthy premium over standard identity solutions and really push that strategy that this is the identity security vendor.

[Jonathan Ruykhaver, Cantor Fitzgerald]

Yes. That's helpful. A quick follow-up is related to channel. Could you just update us on the channel motion as it relates to your SaaS offerings. And it also see in terms of the opportunity to engage with SIs in public cloud providers beyond what you're doing with secrets with the public cloud guys?

[Udi Mokady, Chairman & Chief Executive Officer]

Okay. So it's been very strategic for us. As we move through this whole transition in a SaaS first transition to bring our channel partners on board with us. It's in our training and in everything we do, it was central to our partner event around impact that our channels will be trained on the SaaS offering and that's what they expected. They also like the quick time to value that you get with SaaS and they're embracing the SaaS solutions. And so I would say that that's across the full channel landscape, even all the way to the advisories. They get it. If the customer is consuming or adopting SaaS then there's a faster time to value. With regards to the SIs around the world, we're seeing them really both with their seats, I would say, in our trainings and getting certified in the sense of, well, CyberArk is really building a healthy long-term company here. And we can count on them to build a business practice. So they're building business practices around us. And they can see the same motion that we talked about here and the growth that we talked about today, is also reflecting in their results, the ability to cross-sell and all of that is reflecting.

On -- with regards to AWS in addition to the Secrets Hub, extending to the ability to work natively with AWS we're active on the AWS marketplace, like we mentioned in the past and we continue to see that as a good way an expansion in deals complementary to our other partners and we're seeing that marketplace momentum building up.

[Operator]

Your next question comes from the line of Joshua Tilton from Wolfe Research.

[Joshua Tilton, Wolfe Research]

Congrats on the results. My first 1 is, every vendor in identity seems to be scrambling to kind of replicate this complete identity platform that you guys have built. So maybe how is that helping you kind of evangelize the sale of a complete identity platform? And what specifically are you guys doing to capitalize on this lead that you have over the other vendors in the market?

[Udi Mokady, Chairman & Chief Executive Officer]

No. Great question. I think -- and I mentioned it sometimes in my face-to-face meeting with investment that I would not start differently with our journey. I mean, coming as the experts in PAM, tackling the most difficult problem in identity and the most sought after attack vector for the attackers and then expanding to identity and doing that all on the SaaS platform is a unique CyberArk benefit. We really came into identity as a cybersecurity company versus coming to security as an identity management company. And we think that, that's the credible and the right motion customers can tell when there's the cybersecurity expertise behind it. And of course, the leg up is there's a lot of disruption in our competitive base, all the private equity takedowns are causing a lot of distraction, both in PAM vendors [Technical Difficulty].

[Operator]

Ladies and gentlemen, we have lost connection with the speakers. Please remain on the line.

[Udi Mokady, Chairman & Chief Executive Officer]

All right. So I think I pretty much wrapped up. Sorry about that. I think we're pretty much wrapped up the question there and we are definitely seeing that competitive opportunity and our stepping on the sales and marketing panel. And again, in a prudent, smart way, like Josh was alluding to capture that opportunity. And a lot of it is also I would say, in a flywheel effect with the customer base. We have a strong customer base. We have a strong channel base and it gives us that flywheel affect to leverage.

[Joshua Tilton, Wolfe Research]

That was great. I just have 1 follow-up, if I could and I apologize if it was already addressed but how was your federal business in the quarter?

[Udi Mokady, Chairman & Chief Executive Officer]

I wouldn't say that it was -- we didn't expect it to be an outstanding quarter. I would just say it wasn't outside. But the global government continues to be about 10% of our business. I would say, in general, we're seeing that the federal cycles can be a little slow.

[Operator]

Your next question comes from the line of Tim Bulian from Citigroup. And we'll move on to the next question from Ittai Kidron from Oppenheimer.

[Unidentified Analyst]

This is Hersha [ph] on for Ittai. Congrats on the results. I just wanted to ask about the Cloud Entitlements Manager solution which is still relatively new. How has early adoption fared here? And how large do you think this opportunity is relative to other solutions like EPM and access?

[Udi Mokady, Chairman & Chief Executive Officer]

Well, we -- as we presented at our impact events, we actually view that as a component in a larger pillar that we call cloud private security which we think is big. And that that includes our solution for secure cloud access. Everything that has to do with managing transparent and easy access to the cloud environment, the cloud consoles. With regards to CM, it's a component there. It's very much about identifying over privilege in cloud and it's a leading the rest of the solution in that pillar. So I would say, one, it's early. And two, it's going to be a component of a much larger pillar which yes, definitely could be as big as EPM and as we continue to evolve there on that pillar.

[Unidentified Analyst]

Got it. That's helpful. And then just on the product mix of net new ARR for the quarter, were there any products that had a significant change in contribution when you compare it to 2Q?

[Udi Mokady, Chairman & Chief Executive Officer]

No, I would say the subscription ARR split is like we discussed last time, they're all growing which is the good news. I would say the PAM ARR is about 55%. EPM is probably about 20%, identity is about 15%, secrets management is about 10% of that subscription ARR piece of the pie.

[Operator]

Next question comes from the line of Andrew Nowinski from Wells Fargo.

[Justin Donati, Wells Fargo]

This is Justin Donati on for Andy. You talked a lot about your land and expand motion here on the call. So I'm just wondering if you could provide any update on either your closing rates or your pipeline between new versus existing customers?

[Udi Mokady, Chairman & Chief Executive Officer]

Yes. I don't know that I have kind of a ready information there. I would say that we're building a robust pipeline on both fronts and that's kind of our go-to-market approach. Our reps have a portfolio of both existing customers and new customers to go after and of course, leveraging the channel partnerships, the TQ lines that we have for landing the new logos. I would just say that it's continued to be a robust diversified pipeline.

[Justin Donati, Wells Fargo]

Great. And then maybe just as a quick follow-up. Regarding your large customers over $100,000 in ARR. Can you just update us on how many solutions on average those customers are using?

[Udi Mokady, Chairman & Chief Executive Officer]

Again, I probably don't have -- I would say that you can have easily have a PAM customer that exceeded that. But we value the most, the landing and the growth and also includes a cross-sell. So the majority would have at least 2 products in the mix. And of course, this is like the over 100,000 ARR we have some very significant ones and the large ones, we, over time, see them not just upsell but also get cross-sell solutions in there.

[Operator]

And your next question comes from the line of Tima Bolani from Citigroup. We'll go on to our next question from Trevor Walsh from JMP Securities.

[Trevor Walsh, JMP Securities]

Udi, you had a brief mention of Zero Trust as being an influencer. And I was wondering if you could maybe give a little color around how that influenced the strong performance, if at all, as far as new customer logos 230 or so for the quarter which was we thought was strong. So is there a dynamic there where that type of architecture around Zero Trust is actually driving that -- those engagements on the identity piece? Or is that more maybe current PAM customers coming in and looking to support their Zero Trust plans with what they've already got going with you guys? How is that -- I guess, how are those engagements happening on the cost?

[Udi Mokady, Chairman & Chief Executive Officer]

That's a great question. And I would say that it's happening in both. I see it in both existing customers. When we do our executive briefing center with the customer base, they are replaying back to us but this is how they presented to their Board and the management that PAM and identity security part of their Zero Trust, how can you achieve 0 trust with excess privileges. So everything the least privileged motion is really critical to that. And so we hear that from the customer base. And yes, our field and channels are definitely seeing that it's part of the decision-making in the land or in the pickup of the new logos that it's -- they're looking for impactful solutions, again, to prevent breaches, prevent in an assumed breach prevent any lateral movement and massive impact of the breach and as a way for them to show that they really reduced the massive amount of risk and executing on Zero Trust strategy. So yes, it's definitely in both.

[Operator]

And Your next question comes from the line of Brian Colley from Stephens.

[Brian Colley, Stephens]

So clearly, you all have a lot of strong tailwinds driving momentum in the business right now. I kind of wanted to hone in on some and see if you could maybe just rank order what you see as kind of the 3 biggest growth drivers or tailwinds for the business right now? And then kind of looking forward, maybe rank order kind of what you see as various growth drivers moving into 2023, if it's changed at all between whether it's multiproduct adoption, new logos, or greenfield PAM wins with new customers?

[Udi Mokady, Chairman & Chief Executive Officer]

Okay. So in terms of business drivers, I would really put up that it's considered -- we're considered a must-have for achieving Zero Trust and preventing breaches. So we kind of love the Zero Trust and attacker innovation and really having a meaningful impact there. That's in terms of business -- business drivers and then definitely add underneath that various areas where there's a compliance need insider threat prevention but attacker innovation and, I would say, followed by digital transformation, like the attack surface is growing so much. And then how do we prevent breaches on that growing attack surface. That's from a business driver.

I would say the result, it's go-to-market execution against this ever-growing demand. So we're a high priority and we're executing, like I mentioned, both on the channel front, our sales team in both new logos and add-on business. Leveraging the speed builds that we put in place to upsell or cross-sell our speed builds solutions in secrets management and identity and we're continuously taking market share as we do this.

[Brian Colley, Stephens]

Got it. That's helpful. And then just thinking about your efforts with the channel expansion, can you just help us frame up kind of what innings you think you're in on that front? I mean it seems like it's clearly already driving an increase in new logo wins and incremental business. I'm curious if you think we're kind of still in the early innings of that and whether it could potentially drive further acceleration from here kind of what percentage of new deals are the channel contributing to today?

[Udi Mokady, Chairman & Chief Executive Officer]

Yes. I would say that in the past, I talked about that we were like a notch one on really kicking off the channel opportunity. The team has really been executing well. I'm hearing from the CEO of our channel partners that -- and I would love hearing that we are in their top 10, 10 producers, the top 5 producers and we want to continuously move up there. CyberArk wants to be the top winner for -- and again, the top provider in terms of our -- the business for our general partners. And I think we continuously see that probably more than 70% of the business is with our channel partners. So it's a growing motion. You -- like I said earlier, it's kind of as a flywheel effect, you see that as they succeed, they invest more, they invest more in training. We talked about the growth in the -- on the amount of CyberArk certified personnel.

And so I wouldn't give it -- I would put something in the middle of the inning, because we moved it along from our execution and really working with the best of the best across the world but there's so much opportunity as we leverage this flywheel. And on top of everything I mentioned, we're in the early innings with the MSSPs and that's a big opportunity.

[Operator]

And this concludes our question-and-answer session. Mr. Udi Mokady. I turn the call back over to you for some final closing remarks.

[Udi Mokady, Chairman & Chief Executive Officer]

Great. Thank you very much. We had another strong quarter, demonstrating durable demand for our solutions and momentum in our business. And as always, I want to thank our customers and partners and our dear global employees for being the cornerstone of our success. Thank you very much. And again, I want to thank the team for the hard work and strong execution this quarter. Talk soon. Thank you.

[Operator]

This concludes today's conference call. Thank you for your participation. You may now disconnect.