CyberArk Software: Promising Market Position But Valuation Remains High

Investment Thesis

CyberArk Software Ltd. (NASDAQ:CYBR) remains well-positioned, displaying an appealing growth profile with sustained subscription Annual Recurring Revenue (ARR) growth. I believe that there is still significant room for growth in the underpenetrated Privileged Access Management (PAM) market, offering CYBR a promising greenfield opportunity. Despite a softening macroeconomic environment affecting security companies, CYBR stands out by exceeding expectations and raising its Annual Recurring Revenue. Unlike previous downturns, CYBR is not experiencing deal cancellations and has not observed warning signs seen in previous recessions. However, the stock trades at a significant premium compared to peers. This, coupled with a lack of substantial free cash flow and challenging macroeconomic conditions, makes the stock less appealing at this stage, and hence I maintain a hold rating on the stock.

Q1 Review: Solid Quarter Despite Macro Headwinds

The revenue for Q1 fell slightly below expectations due to a higher proportion of SaaS bookings and some downsized deals. However, the growth in ARR of 41% was impressive. It's worth noting that the net new ARR remained flat compared to the previous year in Q1. CYBR is on track to achieve a 30% ARR growth in FY23 and still has a significant maintenance stream (~$250MM) that can be converted to SaaS with a 3x price increase.

The demand for CYBR's products remains robust, with strong interest across industries, driven by the prioritization of PAM and Identity solutions within budgets. Customers recognize the critical importance of PAM and the need to swiftly implement such technology to secure their systems against the evolving threat landscape, despite the challenging macroeconomic environment. Despite the banking crisis at the end of March, the financial services sector showed year-over-year growth. CYBR managed to secure deals with a range of banks, including regional and large enterprise institutions.

The growth in ARR and successful execution outweigh the lower billings and cash flow. CYBR achieved ARR results that were relatively in line with forecasts, which was better than the disappointing results reported by some other security software vendors due to macroeconomic challenges in the quarter. The additional macroeconomic pressure experienced by CYBR was evident through sales cycle difficulties, smaller deal sizes, and shorter contract durations, leading to weaker-than-expected billings and cash flow. However, the progression of ARR remains the key driver in this context. Moreover, the growth in the pipeline and win rates remains healthy due to the increasing volume and complexity of threats, the severity of breaches, and ongoing consolidation in the security vendor landscape. The pipeline growth improved both year-over-year and quarter-over-quarter. I consider CYBR as one of the stronger long-term investment opportunities in the security sector, but the stock continues to trade at a premium multiple compared to its peers, which is why I refrain from taking a position at this stage.

Points of Contention

The cash flow for the quarter was lower than expected. The free cash flow of $4.1 million was 2% below the Street's expectations and significantly lower than the free cash flow levels in Q1 2022. The decrease in cash flow was primarily due to shorter contract durations and smaller deal sizes, which put pressure on billings. While the total deferred revenue grew by 33% year-over-year, the long-term deferred revenue declined by 15.4% year-over-year. This decline in long-term deferred revenue is mainly attributed to a change in maintenance contract policy, as the company no longer allows multi-year maintenance contracts. I see this as a positive in the long run, as it gives the company the opportunity to improve pricing dynamics and have more frequent interactions with customers.

The weaker billings performance in the quarter can be attributed to longer sales cycles, duration, and phasing. The extended deal cycles, downsizing of select larger deals, and a reduction in the scope of initial engagements all contributed to this. However, the concerns regarding downsizing and phasing were mitigated by the strong growth in the pipeline and win rates. The management mentioned that many customers who downsized their deals are already back in the pipeline, and they expect expansion opportunities throughout 2023 due to the critical importance of Privileged Access Management.

Demand Environment for the Company Remains Healthy

The softening in the macroeconomic environment is starting to impact security companies, as evidenced by recent results and guidance. In this context, CYBR's ability to exceed expectations and raise its Annual Recurring Revenue stands out, indicating a healthier demand environment. Unlike previous downturns, it appears that CYBR is not experiencing deals being cancelled. While there is increased scrutiny, the warning signs that CYBR observed in previous recessions have not yet emerged. One possible explanation for this could be the shift towards Software-as-a-Service (SaaS). I believe leading with SaaS expands the Total Addressable Market (TAM) and shortens sales cycles, potentially helping to mitigate some of the macroeconomic impacts. Additionally, the competitive landscape in this market is favorable, with competitors undergoing ownership changes within the private equity sector and delays in introducing Privileged Access Management solutions by competitors such as OKTA. Overall, while CYBR acknowledges the weaker macroeconomic conditions, it seems that a combination of factors allows the company to defy the overall trend.

Valuation

The stock is currently trading at a forward EV/Sales of 8.9x, at a significant premium to the industry median, which is why I assign a hold rating to the stock. Although, I believe this premium is justified by the higher long-term growth projections for CYBR (mid-20s in CY24) compared to the peer group average of 20%. I prefer waiting for a better entry point on the stock.

Conclusion

I like CYBR for several reasons. I believe that CYBR has the ability to maintain its leadership position in core Privileged Access Management while successfully transitioning to a broader identity platform. CYBR stands out as a well-positioned vendor in the sector, displaying an appealing growth profile with sustained high ARR growth. The company's strong revenue growth makes it an attractive investment in a period of improved economic activity. However, the current premium valuation, coupled with a lack of substantial free cash flow and challenging macroeconomic conditions, keeps me waiting for a better entry point.