CyberArk: True Growth Rate Comes Into Focus (NASDAQ:CYBR)

CyberArk (NASDAQ:CYBR) is a leader in cybersecurity providing a comprehensive set of identity solutions. They have taken a strong position in the market over the past year, due to strong execution and issues with competition like Okta (OKTA). It is continuing its perpetual license wind down process, which has put a hamper on revenue and earnings power for the past few years. However, the process is nearly done with recent Q2 earnings up to 95% subscription bookings. The company is seeing great momentum in new customers and continuing R&D improvements throughout the business. The focus on credentials is key because many adversaries are using credentials to get access to a layer and move laterally to cause maximum damage. The company has been executing well with increasing traction in cloud security and workforce access. New products like conjure cloud and secrets hub are starting to gain good traction among enterprises. The question on whether to buy CYBR in the current weak macroeconomic environment is what is the true growth rate and what valuation should a business with strong momentum have?

What is CyberArk’s normalized growth rate

Annual recurring revenue, which is completely made up of subscription bookings was up 40% y/y in Q2 with $49m in net new ARR. The chart below shows the ARR, growth rate and net new ARR in each quarter. As you can see the company has done a good job increasing net new ARR throughout the past year and a half. Keep in mind many of the other biggest companies in the security space have had a relatively flat year of new ARR growth, with many seeing decreases in new business bookings. However, you can see the solid results in Q1 and great results in Q2 of 2023 compared to the prior year. Q1 new ARR was flat against the prior year but still a strong result considering the macro environment. Q2 new ARR was up 29% even as many cybersecurity firms have seen increasing large deal scrutiny and pushouts of new deployments. This has allowed CYBR to hold a strong 40% ARR growth rate even as comparisons are continuing to get harder. However, part of the reason growth here is so strong are perpetual licenses are running off and choosing to move to subscription, boosting these numbers. Perpetual license revenue was only $5.1 million in Q2, with that winding to near zero by year end making judging growth easier once we are in 2024.

Click to enlarge

Other metrics may help determine what a more reasonable estimated growth rate would be. Deferred revenue was up 20% y/y and may indicate that a growth rate somewhere between ARR growth and deferred revenue growth is reasonable. This follows the guidance by management of 29-31% ARR growth for the year, with the revenue number of 22-24% showing continued headwinds as perpetual maintenance rolls off the revenue line. These headwinds should be nearly gone by 2024 but will continue to impact revenue and profit short term. The market continues to give credit to CYBR for strong underlying growth and operating margin improvement to come. If you assume a 25% growth rate, CYBR trades at a reasonable valuation compared to peers. This seems like a good estimate with 30% ARR growth but a smaller deferred revenue growth pointing to likely a mid 20% growth rate in 2024. Other peers such as Zscaler (ZS) and CrowdStrike (CRWD) trade at higher valuation but also have higher growth rates as you can see below in the 40-45% range, with likely mid 30% for 2024. Palo Alto Networks (PANW) has a better position in its end markets and much higher cash flow per share but only trades at a slight premium to CYBR. CYBR does have the advantage of a significant pile of cash at $1.2 Billion which helps negate the $569m in convertible notes owing. Still it shows they have a large net cash position for any potential future acquisitions and won’t need to raise funds to fuel the next few years of growth. They have been fairly quiet of late on the acquisition front, so look for them to make a splash and improve capabilities over the next 12 months. That could be a thesis changer, but they have been fairly conservative with their cash over the past few years.

Full profitability will be clear in 2024 once revenue numbers have increased back to baseline. CyberArk is only just now starting to regain profitability without stock based compensation taken into account. This is below some of the other top cybersecurity names but CYBR did have over 12% operating margin prior to its transition to its subscription model. Valuation right now is below its peak before the pandemic, but still relatively high at 9.1x EV to revenues. This puts the stock in a hold or neutral area at the moment with the buy zone to me below 8x EV to revenue. This is especially true when you compare it to its highest quality peers which trade only slightly more expensive than it, but with stronger fundamentals.

As you see above, its closest peers are growing faster and have come down more from high valuations making them a bit more palatable now. They also have actually slowed expense growth more than CYBR in recent quarters, with CYBR actually increasing its losses y/y in Q2 from $35 million to $38 million. Efficiency will come with scale, as its peers are now focusing heavily on reducing operating losses which will likely be a 2025-2027 story for CyberArk as it ramps up cash flow generated. Price to cash flow is a popular metric for SAAS companies as it backs out stock based compensation, with additional shares added to the float not taken into account in free cash coming into the business. As you see above, the biggest cybersecurity peers trade at 30-70x trailing cash flow, with those numbers shrinking quickly. CYBR did generate $5.8 million in cash in the quarter, and cash flow should increase over the next year but will vastly trail the peers above. They are guiding to $200 million of FCF in 2025, making the stock currently trading at 33 times 2025 cash flow, a number still worse than peers for 2023. I see cash generation fueling acquisitions and further buybacks in the coming years with CYBR trailing its closest peers in this area. My current assessment is CYBR would be my 4th pick among these peers, due to their stronger cash flow short term, and bigger lead on competition for long term earnings potential.

Conclusion? Neutral rated

While the momentum in the identity and privileged access area has been called out by many companies, CyberArk trades at a valuation that makes it a hold at this time. The company has performed extremely well over the past year, which only partially reflected in its performance with an 8% gain. However, it did vastly outperform peers during the drawdown from the top heights of 2021 which explains its more stable range. Risks continue to be from a weaker macro environment causing more pushed out deals for identity products, but CYBR is offsetting this beautifully with strong sales execution. Those that want a pure play identity security option will do well with CYBR long term, knowing that they may have less upside over time than some of its bigger peers. Those companies have more medium term leverage and earnings growth potential even as CYBR continues to outperform on revenue growth.