Company: CyberArk Software Symbol: CYBR Share Price: $146.31 Market Cap: $5.

8B
Shares Out: 39.2m EV/Sales (FY21e): 10.4x EV/EBITDA (FY21e): 122.3 Date: 7/24/2021

Thesis
• CyberArk is the category leader in Privileged Access Management (PAM), with 50%+ of the Fortune 500 as
customers.
• The PAM market is growing as cyber threats intensify & companies move their critical infrastructure into the
cloud, creating a larger attack surface.
• CyberArk has a differentiated SaaS product in PAM, and is likely to gain market share.
• Upside optionality comes from potential of expanding into adjacent markets like Identity Governance and Access
Management.
• I think CyberArk is an interesting company which merits further research. I'd lean bullish.

Company Overview
• Product: CyberArk provides Privileged Access Management (PAM) software, which is a cybersecruity category
focused on which users can gain root access to critical systems; it is the highest security sub-segment within
identity management.
• Business Model: Historically CyberArk sold perpetual licenses, but is transitioning to a SaaS (subscription)
model. The company gets ~22% of revenue from subscriptions as of 1Q21.

Market Opportunity
Core PAM Market:
• Gartner projects the PAM market at ~$2B in 2021, growing to $3B by 2025 (11% CAGR).
• The PAM market is not new, but is becoming more important as cyber threats expand and more mission critical
systems are moved into the cloud.
• Covid was a tailwind for identity management as remote access makes identity the “keys to the kingdom”.
• PAM has historically been purchased by very large enterprises, but the heightened threat landscape is creating an
opportunity for TAM expansion down market.
• ~80% of PAM spending is in North America & Europe, suggesting substantial room for growth in other
geographies.

Expanded Identity Management TAM:

• Gartner projects the entire Identity Management at $15B in 2021, growing to $25B by 2025.
• CyberArk also has started offering products that assist with security operations & DevOps security- markets
which CyberArk claims are in excess of $50B. I am skeptical of CyberArk's ability to capture meaningful spend
in these areas.

Competitive Positioning
• CyberArk leads in the highly fragmented PAM market; CYBR revenue would imply ~25% market share. There is
no close second; vendors like Thycotic, BeyondTrust, & Centrify have less than 10% market share each.
• The fragmentation of the market suggests that CYBR has an opportunity to capture greater share by consolidating
spend from smaller vendors.
• CyberArk is differentiated because:
1. It was an early innovator in PAM, giving it a first mover advantage and share of mind.
2. CyberArk has a mature, heavily optimized product (features like just-in-time provisioning, key stroke
monitoring, etc.) which is difficult for competitors to replicate- PAM is a highly technical category that
must work perfectly; there is no room for iterative development.

1
 3. Barriers to entry are high because companies are rarely willing to take risks on new vendors with
mission critical security tools.
• In adjacent identity management markets, I think it will be difficult for CyberArk to gain material share.
▪ CyberArk is new to the market, only launching a full identity management product last year following the
Idaptive acquisition. Software products typically take years to mature- so catching up with others who
have a head start will be difficult..
▪ The market is highly competitive with large, established incumbents including Microsoft (Azure AD),
Okta, and Ping.
▪ CyberArk is most likely to gain traction around edge cases that fall in-between traditional SSO and PAM.

Financial Model/Valuation:
Growth
• CyberArk's growth is complicated by the ongoing transition from selling perpetual licenses (revenue recognized
upfront) to subscriptions (revenue recognized ratably over time). This creates a headwind to revenue.
• Management says that this transition is creating a $45M headwind to revenue in FY20 & a $39M headwind in
FY21- implying normalized growth rates of ~17% and ~14%, respectively (instead of 7% and 6% reported).
• Management guided to $1B ARR by 2025, so if we use as a proxy for revenue (assuming the business model
transition is largely completed by then), the implied growth of the business is a ~17% CAGR. Management
targets 20%+ growth exiting this transition.
• To sanity check this, I calculated CYBR's 2025 revenue is they gain 3 points of market share in core PAM per
year. This got me to an 18% CAGR. Upside could come from capturing adjacent spending in identity.
Profitability
• CyberArk's profitability has also taken a hit from this business model transition, with less cash collected upfront
creating a headwind to margins and cash flow.
• SaaS GM is slightly lower than on-premise GM because CyberArk must pay for hosting costs, but at scale
CyberArk has indicated that GM is likely to remain 80%+, which is not inconsistent with other SaaS vendors.
• Adj. OM dropped from 28% in FY19 to 20% in FY20; CyerArk says that normalized for the pricing changes it
would be 26% in FY20.
• I see no reason why CyberArk shouldn't have an operating margin in the mid-high 20's once the model transition
is complete, similar to other software companies (80% GM, 30% S&M, 20% R&D, 5% G&A).
• The business is asset light and doesn't require large capex/headcount growth to scale.
Valuation
• I use a DCF to value the business, with an 8% discount rate and a 3% terminal growth rate.
• I arrive at a share price of $178, or 22% upside to CYBR's current price.

Key Risks
• Other identity management vendors are trying to move into the PAM space- Okta announced a PAM product at
Oktane 21 and Microsoft announced the acquisition of CIEM provider CloudKnox last week (CIEM is part of
PAM functionality in the cloud).
• PAM market is fairly small and CYBR already has leading market share, which may make it difficult to continue
incrementally gaining share without heavier S&M investment.
• Transition from on-premise to cloud creates uncertainty and gives customers opportunities to churn.