CyberArk Software Ltd. (NASDAQ: CYBR) Q4 2020 earnings call dated Feb. 11, 2021
Ladies and gentlemen, thank you for standing by, and welcome to CyberArk Fourth Quarter and Year End 2020 Earnings Conference Call. [Operator Instructions]. After the speakers’ presentation, there will be a question-and-answer session. [Operator Instructions]. I would now like to hand the conference over to your speaker today, Erica Smith, Vice President of Investor Relations. Thank you. Please go ahead.
Thank you, Erica. Good morning. Thank you for joining us today to review CyberArk’s Fourth Quarter and year end 2020 financial results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open the call up to a question and answer session. Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflects management’s best judgment based on currently available information.
I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operations for the first quarter and for the full year 2021. Our actual results might differ materially from those projected in these forward-looking statements. I direct your attention to the risk factors contained in the Company’s annual report on Form 20-F filed with the U.S. SEC and those referenced in today’s press release that are posted to CyberArk’s website, as well as the risks regarding and our ability to begin actively transitioning the business to a subscription model in 2021 as well as the duration and scope of the COVID-19 pandemic, its related impact on global economies and our ability to adjust in response to the COVID-19 pandemic. CyberArk expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made today. Additionally, non-GAAP financial measures will be discussed on this conference call. Reconciliations to the most directly comparable GAAP financial measures are also available in today’s press release as well as in an updated investor presentation that outlines the financial discussion in today’s call.
This information can be found at www.cyberark.com in the Quarterly Results section under Investor Relations. Also a webcast of today’s call will be available on our website. With that, I’d like to turn the call over to our Chairman and Chief Executive Officer, Udi Mokady. Udi?
Udi Mokady — Founder, Chairman and Chief Executive Officer
Thanks, Erica, and thanks everyone for joining the call today. We hope you and your families are safe and healthy. We want to spend some time today discussing our record results for the quarter, outlining the market dynamics and tailwinds. And lastly, detailing the formal launch of our subscription transition just a few weeks ago, and how it aligns to our 2021 objectives.
We have a lot of information to cover as we kick off 2021. So we will be also hosting a virtual investor event on March 10th, where we can provide more detail on our growth strategy, innovation and on our subscription transition. 2020 was not what any of us expected, but, I’m incredibly proud of what CyberArk accomplished as a team. Because of our focus and agility, we are a much stronger Company today.
We executed against our strategic imperatives from early in the year to drive cross-sell and up-sell, strengthen our channel program, build new ways of targeting prospects and enhance our customer success organization. We also responded to COVID-19 and successfully adjusted our entire operation and processes to work from home, including not missing a beat for remote deployments, support and the full range of customer engagements.
We quickly responded to the more abrupt change in customers buying preferences of our products toward SaaS and subscription. Early in the year, we acquired Idaptive, positioning us to deliver, our identity security strategy. And, in every quarter of 2020 we created record new pipeline across our solutions.
When coupled with our strong execution in Q4, we delivered our best quarter ever. Total revenue reached an all time high over $145 million in the fourth quarter with record SaaS and subscription bookings, which also created increasing headwinds to our recognized revenue. In addition, we generated non-GAAP operating income of $40 million, well ahead of our guidance. For the full year, revenue reached $464 million.
This included over $50 million of recurring license revenue, which grew faster than 200% in 2020 compared with $16 million in 2019. Our non-GAAP operating income for the year was $91 million. It is important to remember that even with the record quarter, during our transition to a recurring revenue model, the headline P&L is a lagging indicator and understates the stronger momentum that we are experiencing — we experienced in the business as we exited the year.
Annual recurring revenue or ARR better demonstrates this success. ARR reached $274 million at year-end with growth accelerating to 43%. In any event, you will hear from Josh later that when we adjust for the mix shift, our sales grew about 25% in the fourth quarter. The four main takeaways from our record results. First, we experienced broad-based demand across PAM including on premise and cloud, Endpoint Privilege Manager and DevSecOps or Application Access Manager.
Second, the — level of engagement with existing customer — existing customers is at an all time high with room to accelerate. Identity security is increasingly recognized not only as foundational to comprehensive security strategies, but also as a business enabler of digital transformation and cloud.
Third, we saw a healthy increase in new business signing about 280 marquee logos across industries. We also have a record new business pipeline where we are seeing an acceleration of progress through the pipeline ahead into 2021. And lastly, we are formally beginning our subscription transition with strong momentum, with a large, rapidly growing base of recurring revenue and importantly after a record fourth quarter.
PAM remains a top priority. But we did see macro uncertainty drive customers to buy for immediate need in 2020. Digging into the fourth quarter, we saw this actually lead to even faster velocity in some of our add-on business, including these following great examples. A European retailer began implementing a privileged access management program based on our blueprint methodology in Q2. This customer quickly added on another $750,000 of — licenses in the fourth quarter and is still in phase one of its program.
Like many organizations, this U.S. consumer manufacturing customers is shifting left, embracing DevSecOps to move faster and grow its business. They were leveraging Conjur to secure secrets and drive their mission critical digital transformation program forward. In the fourth quarter, they enhanced the security posture buying privileged access management and significantly broadening their Conjur deployment.
A financial services customer, APJ was rolling out a multi-cloud strategy with Azure and Google Cloud and wanted a scalable, enterprise class, secrets management solution. This existing CyberArk customer for PAM was using a competitive DevSecOps solution. But in the fourth quarter, decided to move to CyberArk to secure secrets across all applications because of our increased security and visibility enterprise-wide. On the new business front, a number of key wins include a top 50 retailer, a regional European airline, an Asia Pacific cloud services company and two major car manufacturers.
We ended the year with about 6,600 customers, up from about 5,300 last year. We are proud to be helping secure nearly 40% of the Global 2000 today. Of the 280 new logos, we signed, about 57% of the business included our SaaS or subscription solutions, up from about 23% in 2019. Two examples are, a top ten energy provider in Europe with a cloud first strategy selected CyberArk as their trusted partner to help secure critical infrastructure. They will be consolidating tools and standardizing on CyberArk for privilege endpoint security, enabling the team to have increased visibility and control with our SaaS solutions.
In a competitive win, a major car manufacturer picked Idaptive for its cloud-based single sign on and MFA. We also won a leading U.S. restaurant chain with Idaptive, which we believe will provide us with a new landing point for our sales team. Our identity security strategy with PAM as the foundation is at the center of the major industry tailwinds of digital transformation, cloud migration, hacker innovation and compliance. The SolarWinds breach is clearly hacker innovation. Supply chain attacks are far from new, but this effect was unprecedented in its scope. While SolarWinds was not a driver of our results in the fourth quarter, it was a wakeup call for organizations, an important reminder that privilege exploitation is at the center of every major attack.
There has been significant — a significant uptick in interest in our identity security offerings. The response to this attack has clearly been a slight [Phonetic] to trust. Companies are now adopting and — breach mentality and are turning to trusted security partners who not only have comprehensive solutions, but also deep experience remediating post breach situations. We expect this event to be a tailwind for our business over the long term. Moving on to the transition. We officially kicked off our subscription program in early January and based on feedback from partners, customers and employees, we are confident that the timing is right. Customers and partners want the benefit of a subscription model. And we have the mature SaaS portfolio, the differentiated subscription offering that will contribute to our success.
Some of the main components of our program include incentivizing our sales team to grow ARR by selling subscription and SaaS, introducing new on-prem PAM packages to pull purchases towards our subscription offering. These offerings are feature rich with our Alero remote access, with SaaS functionality including adaptive multi-factor authentication, single sign on and mostly connected devices or LCD functionality. Focusing the entire organization around faster time to value and adoption with our customer success team and established customer care lifecycle and rolling out a Company-wide enabling program to all of our employees to deliver a best-in-class transition.
As we look into 2021, our priorities are growth, innovation, the subscription transition and scaling within the large identity security market. To drive growth, the team has organized around three pillars: Access, DevSecOps and PAM which together form our identity security portfolio. We believe this optimized structure will provide the right level of attention and resources and our Access and DevSecOps speed — while also driving growth of our core PAM business.
In addition, in 2021, we will extend our reach by strengthening our partner program across VARs, advisories and MSPs. Fueling our innovation engine is critical to staying a step ahead of attackers and also strengthening our leadership position in the market. In 2021, we are stepping up our R&D investments to build our SaaS identity security platform and at the same time continue to enhance our solutions.
We believe, delivering new functionality and solving complex security challenges will also be key to completing the virtuous cycle of success in our subscription model. We are well on our way to transforming CyberArk into a high-growing recurring revenue company with significant contribution from our SaaS solutions. We continue to expect the transition to take eight to ten quarters beginning from the first quarter of 2021. This year, we are laser focused on increasing our subscription mix, growing ARR and protecting our base of customers.
We believe we will reduce friction in the sales process, increase cross sell activity and build enduring relationships with our customers by delivering deeper value and stronger security. Ultimately, the tighter relationships forged by subscription sales will generate higher lifetime customer value. We are in a growing market and our solutions are aligned to the broader industry. We are making the right investments in our go-to-market and innovation engines to drive growth, but are also focused on profitability and returning the Company to the Rule of 40 after we exit the subscription transition.
We are heading into 2021 off a record quarter with strong momentum, and I’m excited about the year ahead. I will now turn the call over to Josh, who will discuss our record results in more detail, our subscription transition and outlook for the first quarter and the full year. Off to you, Josh.
Josh Siegel — Chief Financial Officer
Thanks, Udi. Before we discuss the details of the quarter, we wanted to remind you that we posted slides to the website this morning, that will be helpful as we walk through our results. As Udi mentioned, we were pleased to beat our guidance for revenue, operating income and earnings per share including record revenue in the fourth quarter of $145 million, that’s up about 11% from $130 million in the fourth quarter of last year.
Our best quarter ever was driven by increasing demand across our solutions and we accomplished this despite the increase in revenue headwind from the subscription transition of $18 million for the fourth quarter and are $45 million for the full year. License revenue in the fourth quarter was $80.8 million compared with $76.5 million in the fourth quarter last year and the recurring portion of the license revenue was $17.4 million and that’s 22% of our total license revenue, that’s more than tripling from $5.7 million or 7% in the fourth quarter last year.
SaaS revenue grew by over 300% year-on-year, reaching $9 million, and subscription or term based license revenue increased to $8 million in the fourth quarter from $3 million in the prior year. Our combined Maintenance and Professional Services revenue was $64 million, increasing 20% over the prior year period. The breakdown of this line is approximately $52 million from recurring maintenance contracts and $11.5 million in professional services revenue.
As Udi mentioned, we are on track with kicking off our subscription transition formally in the first quarter. With the known transition effect of increasing revenue recognized ratably, we will emphasize total recurring revenue, the percentage mix of bookings from SaaS and subscription and annual recurring revenue or ARR as the key metrics to provide visibility into the health of our business.
Looking back in the fourth quarter. Total recurring revenue grew to $70 million or 48% of total revenue. That grew 41% from the $50 million of recurring revenue, which was only 38% of total revenue in the fourth quarter last year. Our recurring revenue growth is being driven by the record bookings for subscription based licenses throughout 2020 as well as our continued strong maintenance renewal rates for our software.
As a reminder, total return revenue includes SaaS, subscription and the recurring maintenance revenue associated with our perpetual license contracts. The mix of new SaaS and subscription bookings as a percent of total license bookings is an indicator of the pace and success of the transition. In total, SaaS and subscription bookings represented about 35% of our new license bookings increasing from the 10% in the fourth quarter of 2019.
Our strong execution at year-end, including robust, perpetual license sales as customers move forward with their mission critical identity security programs added to our top line while we still remained on track with our mix expectations related to our transition timeline goals. The headwind created by the mix of bookings was about $18 million, that’s in line with what we discussed in November, demonstrating yet another record quarter for our SaaS and subscription business.
Taking the headwind into consideration, our revenue in the fourth quarter for the comparable mix of bookings would have grown by about 25%. For the full year of 2020, significant shift in our new license bookings towards more recurring and ratable business effectively lowered our reported revenue by approximately $45 million.
The metric we are also excited about is our AAR growth as it indicates the path towards becoming a high growth subscription business. At December 31 our AAR was $274 million with growth accelerating to 43% year-on-year from $192 million at year-end 2019.
Now, I’ll provide some further color on the business. The level of engagement with our 6,600 customers continues to be an all-time high and we saw about 74% of license revenue coming from add-on business during the fourth quarter. We are pleased as well with the momentum in our new business, with improved close rates and strong pipeline growth in the fourth quarter, we also continue to see an increasing percentage of new customers aligned with our SaaS Access Manager solution.
Our expectation is that our new SaaS customers will start smaller, recognize faster time to value and quickly expand their overall CyberArk program following the blueprint methodology. In terms of solution areas, our Application or DevSecOps solution had a record quarter representing about 68% of license revenue with more customer securing the digital transformation programs with CyberArk.
Endpoint Privilege Manager was about 6% of license revenue and that’s with about 90% of the EPM bookings being SaaS. The business remain well diversified across geographies for the quarter. Americas revenue in the quarter was $82 million representing 57% of total revenue. I would also note that the Americas again had the strongest percentage of SaaS and subscription bookings during the quarter which naturally impacts the recognized revenue.
EMEA revenue was $50 million or 35% of total revenue in the fourth quarter. APJ generated $12 million in revenue, representing 8% of total revenue for the fourth quarter. As I move through the P&L, all line items will be discussed on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release and posted to our website. Our fourth quarter gross profit was $127 million or 88% gross margin.
As we demonstrated throughout the pandemic, we believe it is in the best long-term interest of our business and our shareholders to continue to make strategic, but disciplined investments to drive long-term growth. R&D expense grew by 28% year-on-year to $23 million to enhance our solutions. Sales and marketing increased 16% to $54 million to expand the reach of our global sales team with the increase, a bit offset by the reduced travel spending.
G&A expense grew single digits to about $10 million. In total, operating expenses for the fourth quarter increased 18% to $87 million and that includes about $6 million of incremental expenses associated with the Idaptive operations. Our operating income was significantly ahead of our guidance of $40 million or 28% operating margin. As a reminder, the approximately $18 million revenue headwind had a corresponding impact on our operating income. Net income was $33 million or $0.82 per diluted share for the fourth quarter also beating our guidance.
Now, let me summarize our results for the full year 2020. Total revenue for the year reached $464 million with $226 million in license revenue, $197 million from recurring maintenance contracts and $41 million in professional services revenue. Total recurring revenue accounted for 53% or $247 million that’s growing 41% from $176 million and equalling only 40% of total revenue for all 2019. You can see the details of our revenue breakdown in the PowerPoint presentation on our website.
Our gross margin for the full year was 86% compared with 88% in 2019 as we continue to invest in our cloud platform. Looking at the full year, R&D represented 17% of total revenue, up from 14% last year, driven by the acquisition of Idaptive, increasing investments in our cloud and on-premise’s offering as well as our identity security platform. Sales and marketing represented 41% of total revenue, that’s up from 37% last year and G&A represented 8% of total revenue, in line with 8% in 2019.
Our operating income was $91 million or 20% operating margin and in total, Idaptive lowered our annual operating margin by about 2%. As a reminder, the approximate $45 million headwind also had a corresponding impact on our operating income. Normalizing for the headwind impact on the P&L, our operating margin would have been approximately 26% for the full year. Over 70% of our operating expenses are related to headcount. We ended the fourth quarter with 1,689 employees worldwide. We ended the year with about 772 employees in sales and marketing, it grew about 18% year-on-year.
Our net income for the year was $81 million with our earnings per diluted share of $2.05. We generated $100 million in free cash flow for the year or 22% margin for 2020. This cash flow contributed to our strong balance sheet and we ended the year with $1.2 billion in cash and investments.
We also ended the year with $243 million in total deferred revenue, that’s up 27% from $190 million at the year end 2019. Our SaaS deferred, it grew by over 400% again this quarter, reaching $46 million compared to $9 million at December 31, 2019. Turning to our guidance. As a reminder, our guidance does not consider any potential impact to financial, other income and expenses associated with foreign exchange gains or losses as we do not try to estimate future movements in foreign currency rates.
So for the first quarter of 2021, we expect total revenue of $106 million to $112 million. We expect a non-GAAP operating loss of about $2.5 million to non-GAAP operating income of $2.5 million for the first quarter. We expect our EPS to range from non-GAAP net loss of $0.03 per basic and diluted share to net income of $0.07 per diluted share.
Our guidance also assumes 39.2 million weighted average basic and diluted shares and 40.7 million weighted average diluted shares and we are assuming a tax rate of approximately 23% for the first quarter. This guidance assumes about 47% of new license bookings from SaaS and subscription, which result in a revenue and profitability headwind of about $10 million for the first quarter of 2021. We are also initiating our guidance for the full year 2021, which reflects the strength of our pipeline. Our overall opportunity and an assumption for the mix of our bookings. We expect total revenue in the range of $484 million to $496 million which assumes approximately 55% of new license bookings from SaaS and subscription, resulting in a revenue headwind to our guidance of approximately $39 million for the year.
We expect non-GAAP operating income to be in the range of $20 million to $30 million, we expect our non-GAAP net income per diluted share to be in the range of $0.45 to $0.64. For the full year, we expect our 40 — expect about 40.8 million weighted average diluted shares and an effective tax rate of approximately 23%.
For the full year, the increase in our expenses are related to four major areas. Our increasing investments in cloud infrastructure is impacting our gross margin for the full year. We expect it to now be between 80% and 82%. Changes in exchange rates are increasing our expenses by about $10 million over 2020, in particular will hit R&D and G&A. As Udi mentioned, 2021 is a year of R&D investment across our offerings and our identity security platform.
Lastly, we are investing in sales and marketing. Our record results in the fourth quarter and record pipeline throughout 2020 give us continued confidence in our market opportunity. It’s critical that we invest today to drive long-term growth and get back to the rule 40 after we exit the transition. As additional color, our guidance assumes that we resumed travel at a lower level in the third quarter at a more normalized rate in the fourth quarter.
In terms of free cash flow, we anticipate that will be aligned [Phonetic] with our non-GAAP net income margin over a 12-month period. We also expect our annual capex to be in the range of $8 million to $10 million, representing just under 2% of revenue at the midpoint. We had a record fourth quarter and are thrilled with our momentum as we entered 2021. We are confident that our strategy to begin actively transitioning to a recurring revenue model will make growth more durable and profitable, which will drive value for CyberArk, our customers, partners and shareholders. We want to wish you and your families health and safety. I will now turn the call over to the operator for Q&A. Operator?