CyberArk

Moat: 3/5

Understandability: 4/5

Balance Sheet Health: 5/5

CyberArk is a cybersecurity firm specializing in Identity Security, offering solutions that secure privileged access and identities across various IT environments.

Investor Relations Previous Earnings Calls

The moat, understandability, and balance sheet health scores reflect a conservative evaluation to ensure a margin of safety in any assessment.

Business Overview:

CyberArk is a leader in the Identity Security space, providing solutions focused on securing privileged access management (PAM) and broader identity management needs. Their offerings are critical for organizations looking to protect their most sensitive assets and data from cyber threats. Here’s a breakdown of the key aspects of their business:

  • Solutions: CyberArk’s core offerings revolve around PAM, which addresses the risks associated with privileged credentials (like admin accounts). Their solutions include privileged access management, secrets management, cloud security, workforce and customer identity, and endpoint privilege security. They are trying to unify all parts of identity access management into one unified security platform.
  • Customers: CyberArk serves a diverse customer base, including large enterprises and small to medium sized businesses across various industries like financial services, healthcare, retail, and manufacturing, governments, and non-profit sectors.
  • Geographic Presence: The company operates on a global scale, with the majority of its revenues (42% in 2023) derived from the Americas, 27% from the EMEA region, and 31% from the Asia Pacific. However, a majority of revenues originate from US customers with 45% of 2023 revenues.
  • Revenue Model: CyberArk primarily operates through subscription and SaaS licenses, with most of its income recurring. Services, such as implementation, training, support, and professional consulting, are also a growing part of their revenue stream. The subscription model ensures stable recurring revenue, while the mix of subscription and perpetual licenses are approximately 80/20, respectively.

Industry Trends:

The cybersecurity market is expanding rapidly, fueled by the increasing sophistication of cyberattacks and the heightened need for security solutions. Digital transformation and the migration to the cloud are increasing the complexity and scope of security challenges. Specifically, the identity management market is facing several key trends:

  • Proliferation of Identities: The number of human and non-human identities are expanding fast, including cloud applications, hybrid infrastructure, and IoT devices.
  • Growing Complexity and Sophistication of Attacks: The sophistication of attacks on identities has grown, with companies looking for holistic solutions to provide better protection.
  • Transition to Zero Trust Security: The move to a Zero Trust model is accelerating, which relies on the principle of verifying each user’s access as it’s needed in order to prevent unauthorized access and data breaches.
  • Focus on cloud-based security: The increased usage of cloud based infrastructure means cloud security is critical for companies to protect their data.
  • Need for integrated Identity Security platforms: Companies are looking for integrated platforms that can handle all of their security, rather than piecemeal point solutions.
  • Increasing regulatory oversight: The rise of data breaches has led to stricter legal and regulatory requirements for data security across the globe.

Competitive Landscape: CyberArk operates in a competitive environment with diverse competitors. Key competitors include:

  • Large cybersecurity vendors: Microsoft, Okta and Ping Identity, are some of the competitors which offer a wide range of cybersecurity services.
  • Niche cybersecurity firms: SailPoint, BeyondTrust, ThycoticCentrify, Saviynt, One Identity, etc which provide various identity access management solutions.
  • Traditional IT vendors: IBM and Oracle which also offer identity solutions as part of their wider offerings.

CyberArk differentiates itself with its focus on securing privileged access and its deep expertise in handling and preventing sophisticated attacks. Their specialization in enterprise-grade security, as opposed to focusing on consumer grade applications, also makes them stand out. They have made several acquisitions to expand the scope of their products and have been increasing focus on product innovation.

Financials (Emphasis on 2023 and 2024 Q1 Data):

Here’s an in-depth look at CyberArk’s financial health and performance with recent information:

  • Revenues: CyberArk’s total revenues for 2023 came in at $751.87 million, a 23.5% growth compared to 2022. Subscription revenues for 2023 accounted for $617.36 million and increased 39.2% from 2022. Maintenance and professional services came to $134.5 million and decreased by 12.4%. Q1 2024 revenues came in at $208.37 million, an increase of 23% compared to Q1 2023. The company expects 2024 annual revenue to be in the range of $840 to $848 million.

  • Profitability: In 2023, the company achieved a gross profit of $618.65 million. GAAP net loss came in at $195.3 million, compared to $222.67 million in 2022. Non-GAAP operating profit came in at $134.6 million in 2023, compared to $61.89 million in 2022. Q1 2024 operating margins also improved.

  • Operating Expenses: Operating Expenses for 2023 came to $802.6 million. Research and development accounted for $297.2 million, sales and marketing costs came to $353.6 and $151.8 million on general and administrative.

  • Balance Sheet: CyberArk maintains a strong financial position with very high cash balances. As of December 31, 2023, CyberArk had $1.213 billion in cash and cash equivalents. The company also has $500+ million in marketable securities. There is no long-term debt. The quick ratio is extremely high.
  • Cash Flow: Cyberark has had positive operating cash flow for the last three years. The company generates good cash flow from operations, which is in turn partly reinvested in the business.

Recent Concerns and Controversies: Cyberark has generally been growing at a fast rate and as such has not faced much controversies, but is facing the same problems that other tech companies are having now.

  • Macroeconomic Uncertainty: Like most tech companies, the company is facing potential headwinds from the macroeconomic environment which could influence its growth as the customers may reduce their IT expenditure.
  • Competition: The company faces tough competition from existing cybersecurity companies and new entrants.
  • Integration of acquired technologies: There is always execution risk related to integrating the technologies and employees of recently acquired companies.
  • Short-term fluctuations in revenue from subscription transition: As CyberArk is shifting its customers towards SaaS and subscription products, they will likely see some instability in their revenues.

Management has stressed that they are confident in their long term strategy, due to their strong product offerings, and focus on integrating new tech and clients.

Moat Rating and Justification: 3/5 (Narrow Moat with a tendency to Wide Moat)

CyberArk demonstrates some characteristics of a company with a narrow, and potentially wide moat: * Switching Costs: CyberArk’s solutions are deeply embedded in their client’s operations, creating high switching costs. Customers are unlikely to rip out their security infrastructure and then transition to another company unless it offers significantly lower costs and risk. * Network Effects: The network effects of cybersecurity data are very strong, and CyberArk leverages the data collected from its huge customer base to make better product offerings. * Intangible Assets: The company’s technology and brand name is well recognized in their domain of identity security. They also have patent protection in some of their technologies. They have invested years in building their security infrastructure and know how, which creates a sort of know-how and operational advantage.

  • Barriers to Entry: The company requires significant expertise to build its solutions, also the business is quite sticky. However, other companies are also investing in this sector, so this is a strong but not insurmountable barrier.

While they have strong switching costs, have created network effects, and a good brand image, there is still scope for technological disruption in their field. All in all, the moat here is not too bad, and can be labelled as narrow with a tendency to get wide.

Understandability: 4/5 CyberArk’s business is fairly easy to understand, as it provides a clear value proposition in the cybersecurity space. Investors may be a bit unfamiliar with the technical details of identity security, and the intricacies of financial reports, which is a problem faced by all tech companies. But given their strong focus on enterprise level security and a clearly defined revenue streams, their products are more predictable and easy to understand than other tech companies, that may have a more abstract or ambiguous revenue model.

Balance Sheet Health: 5/5 CyberArk has an outstandingly healthy balance sheet with a huge amount of cash, and no long term debt. They have positive cash flows and can easily handle any volatility in the near term, making them an extremely safe bet in terms of financial safety and solvency.

Risks to the Moat and Business Resilience

CyberArk, while having a decent moat and great financial health, is facing some risks, which can affect its future growth prospects. Here is a list of them:

  • Technological Disruption: New technology can render old solutions obsolete very fast, as is seen from the many examples throughout history. * Competition: Competitors may offer alternative or more innovative solutions that may reduce CyberArk’s competitive advantage. * Shifting priorities of customers: Companies may allocate more budget toward other IT expenses and away from identity security. * Execution Risk: Integration of recently bought companies with large tech companies is difficult, and can often impact the financials, if integration goes badly.
  • Macroeconomic volatility: Companies might reduce their IT spending, or they may have to scale down operations if the global economic slowdown takes longer to recover.
  • Negative effects of regulation: Government and regulator policies can change which might effect the industry landscape and create negative impacts for the business.

Overall, CyberArk exhibits strong financial health and a narrow to wide economic moat. They have solid profitability and a strong business model. However, they must still be wary of the competitive and regulatory landscape.