CyberArk Announces Strong Third Quarter 2021 Results

Total Revenue of $121.6 Million

Subscription Bookings Mix Reaches 72%

Subscription Portion of Annual Recurring Revenue (ARR) of $139 Million with Growth Accelerating to 131%

Total ARR of $344 million with Growth Accelerating to 38%

Newton, Mass. and Petach Tikva, Israel – November 4, 2021–  CyberArk (NASDAQ: CYBR), the global leader in Identity Security, today announced strong financial results for the third quarter ended September 30, 2021.

“We had another amazing quarter as the momentum in our business continued to accelerate,” said Udi Mokady, CyberArk Chairman and CEO. “Great execution of our identity security strategy and subscription transformation, a robust demand environment, and strong industry tailwinds drove our results. We landed more than 230 marquee logos as enterprises move to secure all identities across human users, applications, containers and bots with our identity security platform. SaaS bookings led the way, reaching an all-time high and contributing to the largest ever sequential increase in the subscription portion of Annual Recurring Revenue (ARR). Total revenue above the midpoint of our guidance range, even with the higher subscription mix, demonstrates that our bookings were ahead of our expectations for the third consecutive quarter, with Q3 bookings overperformance the best so far in 2021. Our tremendous results in the first nine months of 2021 give us confidence in the durability of our growth and as a result, we are increasing the bookings assumption underlying our guidance framework for the full year 2021.”

Financial Summary for the Third Quarter Ended September 30, 2021

• Subscription revenue was $35.3 million in the third quarter of 2021, an increase of 143 percent from $14.5 million in the third quarter of 2020.
• Maintenance and professional services revenue was $63.3 million in the third quarter of 2021, an increase of 7 percent from $58.9 million in the third quarter of 2020.
• Total revenue was $121.6 million in the third quarter of 2021, up 14 percent from $106.6 million in the third quarter of 2020.
• GAAP operating loss was $(27.7) million and non-GAAP operating income was $0.1 million in the third quarter of 2021.
• GAAP net loss was $(29.1) million, or $(0.73) per basic and diluted share, in the third quarter of 2021. Non-GAAP net loss was $(2.4) million, or $(0.06) per basic and diluted share, in the third quarter of 2021.

Balance Sheet and Net Cash Provided by Operating Activities

• As of September 30, 2021, CyberArk had $1.2 billion in cash, cash equivalents, marketable securities, and short-term deposits.
• During the nine months ended September 30, 2021, the Company generated $54.3 million in net cash provided by operating activities, compared to $67.8 million in the first nine months of 2020.
• As of September 30, 2021, total deferred revenue was $280.9 million, a 23 percent increase from $227.6 million at September 30, 2020.

Key Performance Indicators

• Annual Recurring Revenue (ARR) was $344 million, an increase of 38 percent from $250 million at September 30, 2020.
  • The subscription portion of ARR was $139 million, representing 40 percent of total ARR at September 30, 2021. This represents an increase of 131 percent from $60 million, or 24 percent of total ARR at September 30, 2020.
  • The Maintenance portion of ARR was $206 million at September 30, 2021, compared to $189 million at September 30, 2020.
• Recurring revenue was $88.9 million, an increase of 41 percent from $62.9 million for the third quarter of 2020.
• 72 percent of total license bookings were related to subscription bookings, compared with 45 percent in the third quarter of 2020.
• Added more than 230 new customers during the third quarter of 2021.

Recent Developments

• CyberArk was named a Leader in “The Forrester Wave^™: Identity-as-a-Service (IDaaS) For Enterprise, Q3 2021”⁽¹⁾ CyberArk received the highest possible scores in eight evaluation criteria recognizing, in our opinion, our market leading approach to Identity and Access Management.

Business Outlook

Based on information available as of November 4, 2021, CyberArk is issuing guidance for the fourth quarter 2021 as indicated below.

Fourth Quarter 2021:

• Total revenue between $140.0 million and $148.0 million.
• Non-GAAP operating income is expected to be in the range of $5.5 million to $11.5 million.
• Non-GAAP net income per share is expected to be in the range of $0.06 to $0.21 per diluted share.
  • Assumes 41.7 million weighted average diluted shares.

Full Year 2021:

• Total revenue is expected to be in the range of $491.6 million to $499.6 million.
• Non-GAAP operating income is expected to be in the range of $13.1 million to $19.1 million.
• Non-GAAP net income per share is expected to be in the range of $0.11 to $0.25 per diluted share.
  • Assumes 40.9 million weighted average diluted shares.

• The Forrester Wave™: Identity-As-A-Service For Enterprise, Q3 2021 by Sean Ryan with Merritt Maxim, Elsa Pikulik and Peggy Dostie, August 31, 2021

Conference Call Information

In conjunction with this announcement, CyberArk will host a conference call on Thursday, November 4, 2021 at 8:30 a.m. Eastern Time (ET) to discuss the Company’s third quarter financial results and its business outlook. To access this call, dial +1 (833) 968-2251 (U.S.) or +1 (778) 560-2670 (international). The conference ID is 5978753. Additionally, a live webcast of the conference call will be available via the “Investor Relations” section of the company’s website at www.cyberark.com.

Following the conference call, a replay will be available for one week at +1 (800) 585-8367 (U.S.) or +1 (416) 621-4642 (international). The replay pass code is 5978753. An archived webcast of the conference call will also be available in the “Investor Relations” section of the company’s website at www.cyberark.com.

About CyberArk                                                                                                       

CyberArk (NASDAQ: CYBR) is the global leader in Identity Security. Centered on privileged access management, CyberArk provides the most comprehensive security offering for any identity – human or machine – across business applications, distributed workforces, hybrid cloud workloads and throughout the DevOps lifecycle. The world’s leading organizations trust CyberArk to help secure their most critical assets. To learn more about CyberArk, visit https://www.cyberark.com, read the CyberArk blogs or follow on Twitter via @CyberArk, LinkedIn or Facebook.

Copyright © 2021 CyberArk Software. All Rights Reserved. All other brand names, product names, or trademarks belong to their respective holders.

Financial Presentation

Beginning in the first quarter of 2021, CyberArk revised the presentation of its lines of revenue and cost of revenue. The Company believes that the revised categories for revenue and cost of revenue as presented on the income statement align with how management evaluates the business. In addition, this disclosure will increase transparency into the Company’s business and shift toward recurring revenues, providing investors with more visibility into the subscription transition program. Historical information by quarter for fiscal years 2020 and 2019, which has been retroactively reclassified to reflect the new lines of revenue and cost of revenue, can be found in the PowerPoint presentation posted to CyberArk’s investor relations website. The new revenue lines consist of (a) Subscription revenue, which represents SaaS and on-premises subscription revenue including the license portion of on-premises subscription revenue and the ratable maintenance component of on-premises subscription revenue, (b) Perpetual license revenue and (c) Maintenance and professional services revenue, which represents the maintenance component related to perpetual license sales and professional services revenue.

Key Performance Indicators and Non-GAAP Financial Measures

Annual Recurring Revenue (ARR)

• Annual Recurring Revenue (ARR) is defined as the annualized value of active SaaS, subscription or term-based license and maintenance contracts related to perpetual licenses in effect at the end of the reported period.

Subscription Portion of Annual Recurring Revenue

• Subscription portion of ARR is defined as the annualized value of active SaaS and subscription or term-based license contracts in effect at the end of the reported period. The subscription portion of ARR excludes maintenance contracts related to perpetual licenses.

Maintenance Portion of Annual Recurring Revenue

• Maintenance portion of ARR is defined as the annualized value of active maintenance contracts related to perpetual licenses. The Maintenance portion of ARR excludes SaaS and subscription or term-based license contracts in effect at the end of the reported period.

Recurring Revenue

• Recurring Revenue is defined as revenue derived from SaaS and subscription or term-based license contracts, and maintenance contracts related to perpetual licenses during the reported period.

Non-GAAP Financial Measures

CyberArk believes that the use of non-GAAP gross profit, non-GAAP operating expense, non-GAAP operating income, non-GAAP net income (loss) and free cash flow is helpful to our investors. These financial measures are not measures of the Company’s financial performance under U.S. GAAP and should not be considered as alternatives to gross profit, operating loss, net loss or net cash provided by operating activities or any other performance measures derived in accordance with GAAP.

• Non-GAAP gross profit is calculated as GAAP gross profit excluding share-based compensation expense, amortization of intangible assets related to acquisitions and acquisition related expenses.
• Non-GAAP operating expense is calculated as GAAP operating expenses excluding share-based compensation expense, facility exit and transition costs, acquisition related expenses and amortization of intangible assets related to acquisitions.
• Non-GAAP operating income is calculated as GAAP operating loss excluding share-based compensation expense, facility exit and transition costs, acquisition related expenses and amortization of intangible assets related to acquisitions.
• Non-GAAP net income (loss) is calculated as GAAP net loss excluding share-based compensation expense, facility exit and transition costs, acquisition related expenses, amortization of intangible assets related to acquisitions, amortization of debt discount and issuance costs, and the tax effect of non-GAAP adjustments and IP transfer.
• Free cash flow is calculated as net cash provided by operating activities less purchase of property and equipment.

The Company believes that providing non-GAAP financial measures that are adjusted by, as applicable, share-based compensation expense, facility exit and transition costs, acquisition related expenses, amortization of intangible assets related to acquisitions, non-cash interest expense related to the amortization of debt discount and issuance cost, the tax effect of the non-GAAP adjustments and IP transfer, and purchase of property and equipment allows for more meaningful comparisons of its period to period operating results. Share-based compensation expense has been, and will continue to be for the foreseeable future, a significant recurring expense in the Company’s business and an important part of the compensation provided to its employees. Share based compensation expense has varying available valuation methodologies, subjective assumptions and a variety of equity instruments that can impact a company’s non-cash expense. The Company believes that expenses related to its facility exits, acquisitions, amortization of intangible assets related to acquisitions and non-cash interest expense related to the amortization of debt discount and issuance costs do not reflect the performance of its core business and impact period-to-period comparability. The Company believes free cash flow is a liquidity measure that, after the purchase of property and equipment, provides useful information about the amount of cash generated by the business.

Non-GAAP financial measures may not provide information that is directly comparable to that provided by other companies in the Company’s industry, as other companies in the industry may calculate non-GAAP financial results differently, particularly related to non-recurring, unusual items. In addition, there are limitations in using non-GAAP financial measures as they exclude expenses that may have a material impact on the Company’s reported financial results. The presentation of non-GAAP financial information is not meant to be considered in isolation or as a substitute for the directly comparable financial measures prepared in accordance with U.S. GAAP. CyberArk urges investors to review the reconciliation of its non-GAAP financial measures to the comparable U.S. GAAP financial measures included below, and not to rely on any single financial measure to evaluate its business.

Guidance for non-GAAP financial measures excludes, as applicable, share-based compensation expense, facility exit costs, acquisition related expenses, amortization of intangible assets related to acquisitions, non-cash interest expense related to the amortization of debt discount and issuance costs and the tax effect of the non-GAAP adjustments and IP transfer. A reconciliation of the non-GAAP financial measures guidance to the corresponding GAAP measures is not available on a forward-looking basis due to the uncertainty regarding, and the potential variability and significance of, the amounts of share-based compensation expense, amortization of intangible assets related to acquisitions, and the non-recurring expenses that are excluded from the guidance. Accordingly, a reconciliation of the non-GAAP financial measures guidance to the corresponding GAAP measures for future periods is not available without unreasonable effort.

Cautionary Language Concerning Forward-Looking Statements

This release contains forward-looking statements, which express the current beliefs and expectations of CyberArk’s (the “Company”) management. In some cases, forward-looking statements may be identified by terminology such as “believe,” “may,” “estimate,” “continue,” “anticipate,” “intend,” “should,” “plan,” “expect,” “predict,” “potential” or the negative of these terms or other similar expressions.  Such statements involve a number of known and unknown risks and uncertainties that could cause the Company’s future results, performance or achievements to differ significantly from the results, performance or achievements expressed or implied by such forward-looking statements. Important factors that could cause or contribute to such differences include risks relating to: the duration and scope of the COVID-19 pandemic and the impact of the pandemic and actions taken in response, on global and regional economies and economic activity and the resulting impact on the demand for the Company’s solutions and on its expected revenue growth rates and costs; the Company’s ability to adjust its operations in response to impacts from the COVID-19 pandemic; difficulties predicting future financial results, including due to impacts from the COVID-19 pandemic; the Company’s plan to begin actively transitioning its business to a recurring revenue model in 2021; and the Company’s ability to complete the transition in the time frame expected; the Company’s ability to meet financial and operating targets during the transition period and after the transition is complete; changes to the drivers of the Company’s growth and our ability to adapt our solutions to IT security market demands; the Company’s ability to sell into existing and new industry verticals; the Company’s sales cycles and multiple licensing models may cause results to fluctuate; the Company’s ability to sell into existing customers; potential changes in the Company’s operating and net profit margins and the Company’s revenue growth rate; the Company’s ability to successfully find, complete, fully integrate and achieve the expected benefits of future acquisitions, including the Company’s ability to integrate and achieve the expected benefits of Idaptive; real or perceived shortcomings, defects or vulnerabilities in the Company’s solutions or internal network systems; the Company’s ability to hire, retain and motivate qualified personnel; the Company’s ability to expand its channel partnerships across existing and new geographies; the Company’s ability to further diversify its product deployments and licensing options; and other factors discussed under the heading “Risk Factors” in the Company’s most recent annual report on Form 20-F filed with the Securities and Exchange Commission. Forward-looking statements in this release are made pursuant to the safe harbor provisions contained in the Private Securities Litigation Reform Act of 1995. These forward-looking statements are made only as of the date hereof, and the Company undertakes no obligation to update or revise the forward-looking statements, whether as a result of new information, future events or otherwise.