CyberArk Software Ltd (CYBR) Q4 2022 Earnings Call Transcript

CyberArk Software Ltd (NASDAQ:CYBR) Q4 2022 Results Conference Call February 9, 2023 8:00 AM ET

Company Participants

Erica Smith – Head of IR

Udi Mokady – CEO

Matt Cohen – COO

Josh Siegel – CFO

Conference Call Participants

Saket Kalia – Barclays Capital

Hamza Fodderwala – Morgan Stanley

Rob Owens – Piper Sandler

Fatima Boolani – Citi

Eric Heath – KeyBanc Capital Markets

Shaul Eyal – Cowen & Company

Brian Essex – JPMorgan

Adam Borg – Stifel

Roger Boyd – UBS Securities

Tal Liani – Bank of America

Jonathan Ho – William Blair

Josh Wood Tilton – Wolf Research

Gregg Moskowitz – Mizuho

Operator

Thank you for standing by. At this time, I would like to welcome everyone to the Q4 2022 CyberArk Software Earnings Conference Call. All lines have been placed on mute to prevent any background noise. After the speakers remarks there will be a question and answer session. [Operator Instructions].

Erica Smith, SVP, Investor Relations and ESG. You may begin your conference.

Erica Smith

Thank you, Chantal. Good morning. Thank you for joining us today to review CyberArk’s fourth quarter and full year 2022 financial results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; Matt Cohen, our Chief Operating Officer; and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open the call up to a question-and-answer session.

Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management’s best judgment based on currently available information.

I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operations for the first quarter full year 2023 and beyond. Our actual results might differ materially from those projected in these forward-looking statements. I direct your attention to the risk factors contained in the company’s annual report on Form 20-F filed with the U.S. Securities and Exchange Commission and those referenced in today’s press release that are posted to the website.

CyberArk expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made today. Additionally, non-GAAP financial measures will be discussed on this conference call. Reconciliations to the most directly comparable GAAP financial measures are also available in today’s press release as well as an updated investor presentation that outlines the financial discussion in today’s call.

We also want to remind you that we provide the calculated revenue headwind for additional color on the impact of our subscription mix shift, but it should not be viewed as comparable to or a substitute for reported GAAP revenues or other GAAP metrics. A webcast of today’s call is also available on our website in the IR section.

With that, I’d like to turn the call over to our Chairman and Chief Executive Officer, Udi Mokady. Udi?

Udi Mokady

Thanks, Erica, and thanks, everyone, for joining the call. We had another strong quarter to cap off an amazing year, where we outperformed, executed and delivered against each of our key strategic initiatives in 2022. We optimized our go-to-market engine, expanded our channel partnerships and enhanced our platform selling motion. Our breakaway innovation extended our solutions well beyond PAM and resulted in CyberArk being recognized as the leader in Identity Security. We are in a great competitive position, and we are taking market share, not only in PAM, but across our product portfolio.

We entered 2023 with a more durable, more resilient and highly visible business model. CyberArk is in a position of strength well on our way to our $1 billion ARR target, and we have already reset our sights well beyond that. Because of this execution, as we are gearing up for 2023, we recognized that CyberArk was in the best possible position to make the executive changes we announced this morning. In early April, I will move into the Executive Chair role and Matt Cohen, our Chief Operating Officer, will become our CEO. Matt is an incredible leader, and I can’t imagine a better person to be the next CEO of CyberArk.

Since joining the company, he had a tremendous value and has been instrumental to our success. He experimented the subscription transition, transformed our go-to-market engine and has inspired people across the organization to deliver well ahead of expectations. With his support and leadership, we have delivered tremendous results and the company is set up for long-term success. While my role with CyberArk is changing as Executive Chair, I’ll stay very active, working with Matt and the management team, I will focus on shaping our future by aligning our long-term strategy to our mission, preserving CyberArk’s unique culture and brand and fostering relationships with key customers and partners. It is very important to me that we get this right and that we have a smooth transition, continuity of leadership and that we don’t skip a beat in our execution.

I believe that our plan accomplishes these objectives. Personally, Matt and I have formed a strong partnership based on shared values, a commitment to our mission and friendship. We will continue to work together closely to ensure CyberArk executes and that we deliver our vision. Matt has joined us today, and I’m going to hand it over to him for a few comments.

Matt?

Matt Cohen

Thank you, Udi. It is the honor of a lifetime to be named the next CEO of CyberArk. Udi, along with Josh, the leadership team and every site of our employees have worked hard to build an amazing company. Udi has been a mentor and become a dear friend over the last 3 years. He is a special leader with genuine empathy and measurable energy and deep passion for our mission, our culture and our people. I am looking so forward to working with him to scale CyberArk, drive profitable growth and deliver shareholder value. I will also focus on preserving the company’s culture, which has been so critical to CyberArk’s success. Our leadership team is completely aligned on our plan for 2023 and our long-term vision and our massive opportunity. Our future has never been brighter, and I am humbled to lead CyberArk’s next chapter.

I will now turn the call back to Udi to talk about the quarter in more detail.

Udi Mokady

Thank you, Matt. Moving into the quarter. Our performance demonstrates a few key points: First, the power of our business model; second, the durability of demand for our Identity Security platform; and lastly, the strength of our execution. The financial highlights include: subscription ARR reached $364 million, growing 99% year-over-year. We also added a record $63 million in net new subscription ARR from the end of Q3. Total ARR reached $570 million, growing 45% year-over-year, well ahead of our November guidance.

ARR is still the best metric to measure our success. We ended the year with more than 1,300 customers, with over $100,000 in annual recurring revenue, growing more than 40% year-over-year. Total revenue came in at $169 million for the fourth quarter, with a subscription booking mix of 90% in Q4, well ahead of our guidance framework. The mix created a revenue headwind of about $24 million. Normalizing the mix for the fourth quarter of last year, our revenue would have grown by 27% this quarter.

The license portion of our business, our SaaS subscription and would have grown about 42%. As we talk about the quarter, I will frame today’s discussion around growth, innovation and profitability. Persistent secular tailwinds are contributing to our growth. I’ve spoken to dozens of customers and partners in the last few months, and they all face similar challenges. Digital transformation is leading to an explosion of identities, both human and machine.

Implementing Zero Trust strategies remains complex and time consuming. And attacker innovation is only accelerated with the emergence of new technology and new attack vectors. Take ChatGPT, our lab team posted breakthrough research on ChatGPT, which can dynamically mutate malware, making it incredibly hard to detect and stop. With examples like this, there is a little debate that identity is the attack surface and taking an assumed breach mindset is the best way to protect the enterprise.

In the fourth quarter, we landed with more than 380 new customers. And for the full year, we added more than 1,100 new logos, an all-time record for CyberArk. We continue to see strong diversity in our business and are signing customers from health care and biotech, hotel, fashion brands, hospitals, manufacturing, banking and insurance companies. A few examples include: a multinational health care company couldn’t scale with its existing PAM point solution, particularly given the increasing number of machine identities within the organization.

In a 7-figure rip and replace deal, the customer will protect human and machine identities with our modern Privilege Cloud and Secrets Management solutions. A large hotel chain is building its enterprise-wide Identity Security program on our platform. During the quarter, this cloud-first organization landed with Privilege Cloud, Workforce Password Management and Dynamic Privileged Access as its first steps with plans to expand to MFA and single sign-on in 2023. We Cyber insurance was once again a driver in Q4 across many examples, including a prominent clothing brand buying Privilege Cloud to meet the insurance requirements and lower premiums.

Our subscription transition is increasing the velocity of add-on business, particularly with our SaaS solutions. A few examples. A major hotel chain is accelerating its cloud-first strategy with CyberArk expanding coverage from PAM, CyberArk Identity and Secrets Management to Endpoint Privilege Manager. A Global 2000 financial services company was our first Conjur Cloud customer and also Secret Hub. As customers implement Zero Trust strategies, they want the peace of mind with a single pane of glass into all privileged activity, visibility that only CyberArk can provide today.

A Fortune 500 health care company expanded its Identity Security program and decided Cloud Entitlements Manager, Endpoint Privilege Manager and Dynamic Privileged Access as game changers for securing its cloud-first environment. We are seeing returns from strengthening our partner program in 2022. The new routes to market, enhance collaboration and improve efficiency across the ecosystem increased our momentum and significantly expanded our reach. As an example, the number of unique CyberArk certified partners grew by over 90%, and the certifications across our platform continue to grow, a great indication for future growth in our Access and Secrets Management solutions.

Before moving into innovation, we wanted to comment on the macro environment. While Identity Security remains top priority, more approvals continue to be required in deals, consistent with what we saw in prior quarters. The demand trends, deal progression, win rates, renewal rates and sales cycles remain healthy across the board, which we see in our strong ARR growth.

On the innovation side, we were thrilled to be named a leader in the 2022 Gartner Magic Quadrant for Access Management in early Q4, making us the only company to be named a leader by Gartner for both PAM and Access Management. We are already benefiting from the Magic Quadrant with the pipeline for our CyberArk Identity reaching new record. We believe this is another important validation of our strategy to deliver the most complete Identity Security platform in the market.

The enhancements of CyberArk Identity, like flows and our innovations in PAM, including broader threat detection and response on VMs and self-hosted machines differentiate us in the field. Innovation continues to be the cornerstone of our success. In addition, we won our first deals for AWS Secret Hub and Conjur Cloud during the fourth quarter.

Josh will cover profitability in more detail. But as we look into 2023, we will continue to invest with discipline and expect to leverage each of our operating expense lines. Most importantly, we plan to be agile in our investment plans and have the flexibility to make adjustments as we move through the year. When looking through the transition dynamics, we are operating CyberArk as a Rule of 40 company today and remain committed to delivering profitable growth.

To ensure we capitalize on our growth opportunity, we expanded our management team adding Chris Kelly as CRO. Chris joined us from Adobe, where he scaled the Global Customer Solutions business. Chris is already making an impact. He hit the ground running and participated in our global kickoff last month. He fit seamlessly into the cyber culture and is fully supported by each of our 3 theater heads.

As we look into the coming year, our top priorities for 2023 include accelerate our Identity Security platform sales motion across PAM, EPM, Access and Secrets Management, further leverage the channel and marketing alignment to extend our reach, enhance our customer success organization at scale to ensure we protect and expand our base of ARR and deliver cutting edge innovation and extend our leadership position in Identity Security.

With our execution over the years, CyberArk is in a position of strength. We have a strong experienced management team focused on executing our strategy. We have a massive market opportunity and are taking market share. Our Identity Security platform is mission-critical, and our solutions are being prioritized even in today’s challenging macro environment. I have never been more energized or enthusiastic about CyberArk, our leadership position, our team, our culture, and our future.

We have put in place a best-in-class transition that will help ensure that we deliver against this massive opportunity. I’m looking forward to working closely with Matt, the Board and the entire CyberArk team as we build CyberArk to a $1 billion ARR company and beyond.

I will now turn the call over to Josh, who will discuss our strong financial results in more detail and provide you with our outlook for the first quarter and full year 2023.

Josh up to you.

Josh Siegel

Thanks, Udi. As Udi mentioned, we were pleased with the durable demand for our solutions. Customers are embracing our Identity Security platform and our subscription model is delivered, resulting in annual recurring revenue growing 45% and reaching $570 million. That’s well ahead of our guidance. The subscription portion reached $364 million, increasing 99% and now represents 64% of our total. We had another record quarter for net new subscriptions and total ARR driven by the strong demand for our solutions, particularly for SaaS.

Our progress is clear when you compare today to a year ago when the subscription portion was only $183 million, then just 46% of total and half of our year-end 2022 amount. Our guidance in February of last year estimated just 35% to 36% growth in total ARR to outperform and grow nearly 10 percentage points faster showcases the strength of our execution throughout the year. We have convincingly flipped our business to a fully recurring model, a key multiyear goal we set just under 2 years ago in our March 2021 Investor Day.

The maintenance portion was $206 million at year-end. The year-over-year and sequential decline in maintenance ARR was due to the decline in the perpetual license sales expected and included in our guidance. We continue to see very strong renewal rates of more than 90% for our perpetual maintenance business. In addition, our visibility continues to increase with the remaining performance obligations now at $730 million at year-end. That’s increasing 38% from December 2021. Total revenue of $169 million, grew 12% year-on-year and was impacted by our subscription bookings mix, which hit a record 90% for the fourth quarter. That’s well above the guidance framework we provided.

Economically, the revenue headwind created by the mix and duration was approximately $24 million in the fourth quarter. That’s when we compare like-for-like to the fourth quarter 2021 when the mix was just 71%, taking the calculated revenue headwind into consideration, total revenue would have grown by 27% year-on-year. And if you include the $1.5 million in currency impact as well, we would have grown by 28%. If you isolate just the license portion of revenue adjusted for headwinds, our license revenue grew by 42% in the fourth quarter.

On the macro environment, during the quarter, we continue to experience more approval of deal cycles. And in addition, some existing customers also wanted shorter commitments, opting for 1-year versus 3-year deals related to self-hosted subscription or our term-based license contracts, which impacted our duration, recognized revenue and long-term deferred in the quarter. Overall, we continue to be very pleased with our bookings and to see Identity Security programs being prioritized.

Momentum in our business continued, and the demand environment is resilient with budgets being allocated as evidenced by the significant ARR outperformance and the strength of our new logos.

Moving into the details of the revenue line for the fourth quarter. Subscription revenue reached $88.5 million, growing 86% year-on-year, representing 52% of total revenue in the fourth quarter. Consistent with our move to a subscription business model, perpetual license revenue came in at about $14.6 million.

Our maintenance and professional services revenue was $66.1 million, that’s $54.1 million coming from recurring maintenance and the balance of $12 million in professional services revenue. Recurring revenue reached $142.6 million or 84% of total revenue, growing 39% year-on-year from $102.9 million in the fourth quarter last year. Geographically, the business continues to be well diversified. The Americas revenue reached $99.5 million, growing 15% year-on-year. EMEA grew by 5% year-on-year to $51.8 million and APJ grew by 13% to $17.8 million of revenue.

Normalizing for the mix and the duration, the Americas would have grown by 31% year-over-year and APJ by 30%. Normalizing the headwind and FX, EMEA would have grown by about 24% in the fourth quarter. All line items of the P&L that I’ll discuss now are on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release.

Our fourth quarter gross profit was $140.2 million or 83% gross margin compared with 86% in fourth quarter last year. The lower year-on-year gross margin is in large part due to the significantly increased portion of SaaS revenues and the result of the declining of the perpetual license sales in the fourth quarter of 2022. While we continue to make disciplined investments to drive innovation and growth, our results demonstrate our operational rigor as evidenced by our operating expenses increasing 20% to $136.1 million, resulting in income of $4.1 million, and that compared to our headwinds adjusted revenue growth of 27% in the fourth quarter. We are still being impacted by the mix shift towards ratable revenue, which lowered our operating results.

Normalizing for the headwinds, our operating margin would have been positive 14% in the fourth quarter. As a reminder, this only level set to the mix to the prior year, not all the way back to the beginning of the transition. Net income was $7.2 million or $0.16 per diluted share, beating our guide for the fourth quarter. For the full year, revenue was $591.7 million, accelerated to 18% year-on-year growth versus the 8% last year.

For the full year, subscription bookings mix was 88%, which was higher than we were expecting and which resulted in approximately a $72 million headwind for the full year. This compared to a 66% subscription bookings mix for the full year 2021. Normalizing for the headwind, the total revenue would have grown 32% year-on-year. And for the full years — for the full year, Americas would have grown by 23%, EMEA by 9% and APJ by 12%. Normalizing for the headwind for Americas — normalizing for that headwind, though, the Americas grew by 38%, EMEA by 23% and APJ by 28% year-on-year.

Moving down the P&L for the full year. Our gross margin for the year was better than we expected at 82% as we closely manage the expenses related to SaaS. Operating loss was $22.4 million. Normalizing for the headwind, operating margin would have been a positive 7% for the full year. Our net loss was $0.44 per basic and diluted share, which was also impacted by the same revenue headwind of $72 million for the full year.

We also observed an FX impact for the full year of approximately $6 million on revenue, $7 million on ARR and $2 million on operating income. We continue to attract and retain top talent ending December with over 2,750 employees worldwide, including nearly 1, 160 in sales and marketing. For the full year, free cash flow was $37.2 million or 6% free cash flow margin, which came in nicely ahead of the free cash flow guardrails we set for the full year and demonstrates the strength of our subscription model.

Turning to our guidance. Our guidance for the first year — for the first quarter and the full year 2023, balances, the strong competitive position and the durable demand for our platform against the uncertainty in the macro environment. For the first quarter of 2023, we expect total revenue of $160 million to $164 million, which represents 27% year-on-year growth at the midpoint. We expect a non-GAAP operating loss of about $15.5 million to $12.5 million for the first quarter, and we expect our non-GAAP EPS to range from a net loss of $0.30 to $0.23 per basic and diluted share.

Our guidance also assumes 41.3 million weighted average basic and diluted shares and about $4 million in taxes. For the full year 2023, we expect total revenue in the range of $724 million to $736 million. that’s representing growth of between 22% and 24%, an acceleration from our 18% growth rate in 2022 and consistent with the playbook we outlined when we kicked off our subscription transition. For the full year, we expect our operating results to range between an operating loss of $5 million and an operating income of $5 million. We expect a range of net income per share of $0. 07 to $0. 28. And for the full year, we expect about 46.1 million weighted average diluted shares. We also expect about $20 million in taxes.

For the full year, we expect annual recurring revenue to be between $730 million and $740 million at December 31, 2023, or between 28% and 30% year-over-year growth. To help model the expenses for the year, we expect to see an increase in marketing expenses in the second quarter related to our Global Impact Customer event and its World Tour, leading to a seasonally lower operating income in the second quarter. For the full year, we plan to leverage our P&L with each operating expense line growing at a slower rate in 2023 compared to 2022.

The increase in our expenses fall into 3 main categories: increasing investments in our cloud infrastructure to support our record SaaS bookings in 2022, which we expect to — which we expect will lower our gross margin for the full year to between 80% and 81%; second, making critical investments in R&D, including our SaaS and self-hosted solutions; and lastly, the investments in sales and marketing, we have deep conviction in the opportunity and our incredibly strong competitive position.

As we think about our guidance for the year, we plan to be agile on our investments. If we see the demand environment change, we will adjust our hiring and investment plans for 2023.

Moving to free cash flow margin. We anticipate that it will be approximately equal to our non-GAAP net income margin over a 12-month period. We remain focused on capitalizing on the massive opportunity in front of us that will deliver profitable growth and strong cash flow, creating long-term value for shareholders.

If we sum up 2022, we were pleased to complete our subscription transition ahead of schedule already in the first quarter. The benefits of our subscription engine are already starting to kick in. Revenue growth accelerated to 18% in 2022, and there is further acceleration expected in 2023. As you saw from the guidance I just provided, we expect operating margins to have bottomed out in 2022 and to modestly improve in 2023. And what’s even more exciting is that we expect even more meaningful improvement once we get beyond 2023 and the flywheel effect fully kicks in.

Before I turn the call over for QA, I’d also like to congratulate Matt, we are aligned on our vision for execution and strategy and very much look forward to continue working closely with him in his new role.

I will now turn the call over to the operator for QA. Operator?

Question-and-Answer Session

Operator

[Operator Instructions] Our first question comes from Saket Kalia with Barclays Capital. Your line is open.

Saket Kalia

Let me just start by saying, Udi, it’s been a pleasure working with you. Wish you best of luck as Executive Chair, very happy you’re still staying with the company. And Matt, very much look forward to working with you as well after all the work that you’ve done through this transition.

Udi Mokady

Thank you so much, Saket.

Matt Cohen

Thank you, Saket.

Saket Kalia

Maybe — yes, absolutely. Maybe shifting to the business, Udi, maybe starting with you. I was wondering if you could just zoom out and talk about why you think Privileged Account Management seems to be bucking the trend in this macro. There are more headcount reductions happening in certain areas of the economy, not all security companies are seeing this type of ARR. I’m curious why you think PAM or just maybe even just the broader identity as a category seems to be doing better?

Udi Mokady

Obviously, we’re very excited that we continue to outperform and the 45% growth in ARR. Privileged Access Management is one of the few critical security layers that really make a difference in enterprise security. I would categorize it in one of the few that are on the must have side of enterprise buying decisions. And no matter how you dissect every attack that’s in the news, there’s — that point of no return is when they elevated privileges, moved laterally, captured identities. And CyberArk captures both the human and machine identities in our PAM platform and in our Identity Security platform.

And today, it’s become clear that Identity is not just the new perimeter. Identity is the attack surface. And so it’s one of the few things that enterprises do today. And of course, we pioneered the space. We’re a market leader in the space. And the flip side of it is also executing on that opportunity that we created through our best-in-class go-to-market team, our channels and of course, delivering great solutions, all of these years. And I would say that the team is executing and firing all cylinders against a growing opportunity.

Saket Kalia

That makes a lot of sense. Josh, maybe for my follow-up for you. Great to see the ARR guide for next year. I was wondering if you could just go one little deeper into some of your assumptions in terms of macro in terms of close rates, in terms of maintenance ARR, there’s obviously a lot that goes into that ARR forecast. Is there anything you just want us to know given the — what is still arguably an uncertain macro?

Josh Siegel

Yes. Thanks, Saket. And you’re right, there are a couple of dynamics that play for ARR. First of all, as we’ve been kind of talking about over the last year, we do expect maintenance ARR to decrease. It started to last year in 2022, and we can see it’s decreasing of a couple of million dollars a quarter into 2023. And so effectively, you’re seeing that we’re guiding generally to a flat net new subscription ARR for 2023.

The other dynamic is, if all things are held equal, if we look at our win rates, our pipeline and in the macro, we actually believe we can grow faster than that. But given the current macro and where we are in the year, I think we believe this is really the right starting point as we guide for 2023. But if I were to end, I’d say we’re actually really confident in the underlying demand environment, and we have the pipeline to actually support a faster growth than in the ARR side.

Operator

Your next question is from the line of Hamza Fodderwala with Morgan Stanley. Please go ahead.

Hamza Fodderwala

Congratulations, Udi, and look forward to working with you, Matt. Just for Udi, it seems like CyberArk is really separating itself from the pack from a lot of your competitors, which have been acquired and others that may be facing their own execution challenges. CyberArk has been a profitable company in the past. But just given that the opportunity that you’re seeing and the success that you’re seeing in multiple Identity categories, how do you think about just doubling down investment and continuing to just accelerate your share gain versus getting back to those very high margins that you saw prior to the transition?

Udi Mokady

Yes. So thanks, Hamza. I think we’ve been very prudent in leveraging our market leadership in the space and in pioneering. I think as both Josh and I said, we’re creating a plan that’s very agile. We’re going after this opportunity. We do want to return back to the beautiful profitability we had before the transition. And then — and of course, coming to it with that position of strong — of fully ratable revenue. But we are investing where we see the strong ROI coming, and we have a plan that’s going to keep us agile on this front, and that includes PAM that includes going after the Access opportunity now that we’re a leader in the Magic Quadrant there and includes going after the Secrets Management angle as well and of course, EPM. So we do have those great growth engines. SaaS delivered, and we’ll invest, we’ll do it like the CyberArk, agile but prudent.

Hamza Fodderwala

Got it. Josh, on that front, can you give any color around the percentage of ARR that’s coming from some of the different categories like Access Management, PAM, et cetera? I think you’ve done that in the past as well.

Josh Siegel

Yes. If we kind of look at the ARR pie, it’s been pretty consistent. PAM is still around 55% of that subscription ARR, with EPM coming in a second at 2 0%, Access at 15% and Secrets around 10%.

Operator

Your next question is from the line of Rob Owens from Piper Sandler. Please go ahead.

Rob Owens

In the prepared remarks, you did talk about the record new logo additions that you had during the year and talked about optimized go-to-market extended channel partnerships. Maybe focus a little bit on the channel front with the new partners, what is their contribution to net new ARR at this point? And how do you expect that to ramp throughout ’23 and into the future?

Udi Mokady

Yes. I would say definitely strong contributors to the growth and in capturing the new logos. And especially as we expanded and have more and more channels trained on the new solutions also helping us land with Access and other fronts. I don’t have the metric handy of how much do we attribute. But again, the majority of our sales involve channels. And probably 70%, 80% of our business, we attribute through direct work with channels. So there are definitely strong contributors to this net ARR.

And I think, like I mentioned in the remarks, it’s strategic for us to have them embracing our broad portfolio, and we see that through their certifications and training and through sales that they’re continuously expanding beyond PAM with us also to Access and Secretes Management.

Rob Owens

And quickly for Josh, as you contemplate the profitable growth and the return of margin moving forward, having gone through the transition, how should we think about free cash flow and any hints there in terms of modeling it?

Josh Siegel

Yes. Thanks, Rob. And as I talked about earlier in the remarks, we’re — I would look at over a 12-month period because we get a lot of seasonality and fluctuations from quarter-to-quarter. But on a 12-month period for 2023, we’re looking at free cash flow at non-GAAP net income margin level.

And then I think if I would add to that, because you also talked about kind of post transition as we kind of continue on through the transition, we certainly would expect to see that as expansion of free cash flow in the out years as our — as we get to already back into ’24 and ’25, and we’re post now roundtripping our full ARR base.

Operator

Your next question is from the line of Fatima Boolani with Citi. Please go ahead.

Fatima Boolani

And Udi, sad to see you go, but I’m looking forward to getting Matt hard times from here. So maybe I’ll start with you. Just with respect to the model transition, as you essentially move it into Phase 2 of the transition with continued ARR growth, I’m curious what sort of changes if at all, that you’re thinking about making by way of go-to-market bundling pricing strategy? So any of those inputs potentially changing the way you scale the ARR base from here? And would love to hear Matt chime in too, if relevant. And a follow-up for Josh, please.

Udi Mokady

So it’s Udi, first of all, thanks, Fatima. I’m staying, but I’m looking forward to giving Matt a hard time. And let’s start with that. Maybe Matt, you take this.

Matt Cohen

Sure, Udi. Thanks. I think as we look at 2023, we kind of just see continued momentum in the go-to-market channels that we’ve already put into place. We’ve started to rely and kind of build a much stronger engine in the marketing organization to help us with the kind of demand generation, and we continue to put more focus and frankly, more resources on that ability to be able to drive pipe that way. Certainly, our bundles have been a piece of the success over the last couple of years where we have our core PAM-C come with a little bit of identity and a little bit of other areas that help to drive and see those products in.

We’re certainly instituting a price increase in 2023 here, kind of matched to the inflationary environment that we’ve seen, and that will help us kind of get a little bit of uptick. And then as we were just talking about, we push on the channel partner program and making sure that these — what we keep referring to is new routes to market, the focus with the MSP program, the distributors, even the marketplaces that are out there and leveraging them to help us drive demand.

But I look at 2023 kind of as a continuation of what we’ve been doing because we’ve been seeing such success with that.

Operator

Your next question is from the line of Eric Heath with KeyBanc Capital Markets. Please go ahead.

Eric Heath

Matt, congratulations on the new appointment there. Udi, I guess both a question for you and Matt. Looking forward, I mean, I guess, how do you think of CyberArk success? How much is predicated on successful moving into Access Management beyond, call it, Broader Privilege Access? And how meaningful do you push into that market over the next few years, given it is a more competitive market, and there’s really a couple of large vendors that kind of already are large incumbents in the space. So how do you think about that initiative over the next couple of years? .

Udi Mokady

Yes, absolutely. I think the beauty of the CyberArk chart right now is that we have such a great opportunity in PAM itself as such a critical layer of security and then this growth engine in Access, in Access, our business almost doubled in ARR. We’re seeing a record pipeline or improving win rates. I mentioned that now with the Magic Quadrant, we’re also invited to more and more RFPs. So the way we look at it is great upside for us in expanding into access. We are and we will and that we’re doing it differentiated.

You mentioned competition. We’re coming to it as from the makers of PAM, those who really pioneered the hardest layer of security in identity, the hardest part of identity coming into securing all types of identities, the human workforce users, the third-party supplier, the machine identities and coming to it from that position of strength and trust as the security vendor. So we are going after it. And — but we’re going after it in a differentiated way. We have a great customer base to leverage. We have new lending — new ways to land and so it is an upside along with, of course, the other growth entrants like Secrets Management.

Matt Cohen

And I would just add here that I think increasingly, it’s an Identity Security story with our customers, and we’re able to talk to them about our platform, we’re able to talk to them about all the solutions working together to drive value and to protect their environments. And so when we think about our recent Global kickoff that we just had where we had all our sellers together, the main story that we were training on is how to position the full Identity Security story. And that brings us then obviously with the foundation in PAM, but outside into these other areas in our conversations with our customers.

Operator

Your next question is from the line of Shaul Eyal with Cowen & Company. Please go ahead.

Shaul Eyal

Congrats, Udi. Congrats, Matt. Best wishes to you looking forward to working with Matt. Udi, what a ride. I actually had a question about machine identity, I think you just mentioned that you and Matt. At a recent conference, you made some, I would even say, both statement about machine identity the opportunity and CyberArk taking pretty much a nice share longer term within this market.

Can you talk to us about what you see within the machine identity now you guys are doing absolutely great on the human side. But what should we be expecting out of CyberArk going forward within the machine identity arena?

Udi Mokady

Yes, absolutely, Shaul. And again, thanks for the warm words. I think what we discovered in our surveys and also in the field is that with digital transformation and with cloud adoption, organizations are creating a multitude more machine identities than they have human identities even to the factor of 45 times more machines than you and that’s what I mentioned in the conference.

And as Matt mentioned earlier, we’re going after this with a platform sale that covers both the human and machine under identity Security. And it’s becoming this gaming hall. By the way, in some of the recent breaches the point of no return is — was when the attacker achieved privileged access through credentials that were identities, and we’re able to get into systems that way. And so our strategy is to do that with our platform and to make it easier and easier for the developers to adopt our solutions as we announced that at our last Big Impact event. And as we mentioned, we’re seeing our first customers adopted. We announced Secrets Hub, which make it very completely transparent to the developer to work natively in the cloud environment.

The first announcement was with AWS Secret Store, where CyberArk is the backbone securing Secrets for all types of applications, both on-premise cloud environments and it’s transparent to the developers. So that’s going to be our strategy going forward. Make it easy for the developer, but provide the security professionals, the single pane of glass, the — and be the backbone to securing all types of credentials and identities.

Operator

Your next question is from the line of Brian Essex with JPMorgan. Please go ahead.

Brian Essex

And Matt, congratulations from me as well. Hopefully, Udi, we still get to engage with you on a regularly frequent basis. So nice to see that you’re sticking with the company, and we’ll remain engaged. I guess for me, I’d like to maybe see if we can like dig into ARR a little bit. It looks like you had some nice new logo adds. It’s almost like the new customer cadence didn’t flinch in this macro and then net new ARR or the ARR contribution from those new adds.

It seems like you’re landing at a greater pace or at a greater amount for new logos. But I know you also mentioned some — I think, Udi, you mentioned some shorter duration incidents in with revenue. Maybe could you dig in there a little bit and offset where are you seeing the headwinds outside of shorter duration? And what do you attribute the larger, I guess, land rates with new logos, too?

Udi Mokady

So I’ll start, Josh, and maybe you want to what to step in. And thank you, Brian. I would say from the new logos, we see that half of them land with PAM and additional solutions. So the platform sale is working. So we see that contribution of the wider portfolio to a growing deal size in our landing spot. And of course, it’s a great for us as we work on the renewals and expansion in our ARR model. And again, that was something we’ve been proving throughout the years. Matt mentioned some of the bundling that we’ve done and that’s all contributing to a better land.

And I think like I’ve mentioned in other calls, we have more landing points. And of course, PAM is still the majority. And back to the first question for the day, PAM being so critical, but we’re able to land with PAM plus additional solutions. And you asked about the duration. So Josh off to you.

Josh Siegel

Yes. So Brian, when we think about the duration, it actually doesn’t impact at all the ARR. The duration is we refer to as part of the headwind because it’s part of our self-hosted term-based license contracts. And as you know, as duration goes down, you would recognize less in the end period. So we saw duration come in during the fourth quarter on those term-based license contracts, which had some headwind on our recognized revenue for the fourth quarter, but it’s just a matter of when we’ll recognize it and we’ll just recognize more of it down the road upon renewals.

So we think that certainly the shorter duration was kind of attributed to customers looking at their budgets and their intent for buying and deciding that they were going for 1 year instead of longer term. But from our perspective, given our very high renewal rates, particularly on all of our products that we’re good with that because it’s not an impact on the business. It’s just purely creating more ratability.

Operator

Your next question is from the line of Adam Borg with Stifel. Please go ahead.

Adam Borg

And congrats to both Udi and Matt. Maybe for Josh, you’ve talked in the past about a single-digit growth rate from ARR coming from converting the existing maintenance base to subscription and SaaS. And I was just curious kind of was that true for all of fiscal ’22? And how should we think about the conversion mix in the context of fiscal ’23 guidance?

Josh Siegel

Yes, Adam. It actually was pretty consistent all through 2022. And if we look at it from an annual basis, it was exactly that kind of a single-digit percentage of the AR growth rate coming from conversions. And we’re really happy with that because it really shows, first of all that we’re getting a lot of new customers. And we’re also getting a lot of add-ons coming in off of their existing installed base. And it continues to provide a lot of engagement with our existing customers going forward. So yes, it remains around just the single digits.

Adam Borg

Great. Any expectations for that to change in fiscal ’23?

Josh Siegel

No, at this point, we don’t see signals for that. But clearly, we’re monitoring it. And I think — and our guide obviously contemplates our estimates for that.

Operator

Your next question is from the line of Roger Boyd with UBS Securities. Please go ahead.

Roger Boyd

Udi and Matt, I want to echo my congrats on your respective moves. and congrats on what overall looks like a very smooth transition. Maybe for Udi or for Matt, you’ve consistently talked about a SaaS heavy transition. And it looks like that was even more so the case in 4Q with SaaS growing nicely above 100%. Any high-level thoughts on the expectations of Privilege Cloud versus term-based license ’23?

And specifically, what are you hearing from customers around demand for self-hosted versus SaaS and the feature there?

Matt Cohen

Yes, sure. This is Matt here. So I think that we continue to be really enthused by the momentum in Privilege Cloud. We see, obviously, most of our new logos that are choosing to land with PAM, they land with Privilege Cloud. It’s definitely the default option the customers get to value significantly quicker. They’re able to get to an expand motion for us in a faster rate, which is good for the lifetime value coming out of the customer. So we continue to see that kind of happen. There’s pockets where there’s holdouts certain geographies or regions around the world or maybe the access to the data center isn’t as normalized or some government accounts.

But we definitely see Privilege Cloud as kind of the leading entity for us moving forward. And mainly the self-based subscription — or sorry, on-prem subscription is generally to existing customers who are buying more seats who aren’t quite ready yet to lift and shift over to the SaaS environment. And I think that trend will continue to play out and accelerate over the next couple of years. At this point, to your last kind of point of your question, we are seeing not only full parity with our Privileged Cloud offering but we’re actually seeing differentiation in our Privilege Cloud offering, where the kind of integration of our Dynamic Privilege Access into the Privilege Cloud offering, the ability to be able to actually offer even better threat analytics that really starts to set the stage for, I think, that being the premium offering that we have out in the market.

Operator

Your next question is from the line of Tal Liani with Bank of America. Please go ahead.

Tal Liani

Udi, if you need a partner for your next fishing trip, you know who to call. I have two questions. The first one is pricing. You mentioned that there is a pricing increase in 2023. What’s the impact on your revenues on your ARR? How long does it take to translate the pricing increase to revenue growth and ARR? And the second question is — let’s do it one by one. That’s right.

Josh Siegel

Okay. So Tal, on that, it’s going to be really a small amount during 2023. Any price increase impacting ARR and revenue, especially because we have more and more being ratable. So it’s not a significant piece of the raise in the guide.

Tal Liani

Got it. The second question is to Matt. And Matt, every CEO brings new spirit and new kind of changes. What is your agenda? What do you see as your main focus areas for 2023 and beyond?

Matt Cohen

Yes, I appreciate the question. I think that when you look at what has worked so well for Udi and I is that we do share a similar view on the market, on the importance of culture and the importance of the teams that we’ve built here. And we’ve been so kind of intricately linked from a standpoint of coming up with the strategy that we have today. So I think what I promise to the team and to Udi really is a continuation of the great momentum that we have. We feel like we’ve never been in a better position in a better place. .

And we have a special opportunity here in the market and a group of special people here at the company. And so I’m kind of excited to continue the spirit, as you said, of where we’ve been and to bring it forward for the years ahead.

Tal Liani

And are there any areas where you’re going to focus on more to try and even accelerate the growth? Or any things that you’re going to focus in — focus on especially to kind of try and bring either new revenues, new areas? Or is it going to be more of the same, basically?

Matt Cohen

Yes. I mean, we believe that this kind of shift up into the Identity Security vision, the Identity Security platform and our ability to be able to go out there and help our customers across the entire identity landscape, human and nonhuman machine into access, into all the new areas we’ve been that the market opportunity for us remains huge. And we can go and tap into that over the next couple of years. We don’t need to pivot to a new strategy. We need to go and execute or continue to execute against the current strategy to go get that opportunity.

Operator

Your next question is from the line of Jonathan Ho with William Blair. Please go ahead.

Jonathan Ho

Udi, let me echo my congratulations as well. It’s been a pleasure for all of these years. And Matt, congrats on the new opportunity. Just wanted to maybe dig a little bit more into sort of the new Secrets Management products that you guys referenced. Just — what’s been the initial reception from customers there? How do you think about sort of the total market opportunity? And how does this maybe augment your existing Secrets Management strategy?

Udi Mokady

Absolutely, Jonathan. And thank you for those warm words, and thank you for getting to know me when we were an unknown category as we were pioneering time as a private company.

Jonathan Ho

Yes. I still remember the days of $20 million in ARR. So it’s good to see the growth.

Udi Mokady

Great. So to your question, I think the two that I would highlight is that we released Conjur Cloud. So the ability to consume Secrets Management as a service, where our customer can hit the ground running and they don’t have to set of infrastructure, we have our first customers on that and the reception. That optionality is really well received by customers. They can still decide to have it on-premise or they can now have Conjur as a service, which really breakthrough innovation in the market.

And the second one that I mentioned earlier, and it’s very strategic process to is Secrets Hub. We’re on top of our solution for, I would say, native applications And for dynamic applications, we allow organizations that decide to use the native cloud Secret Store and CyberArk as the backbone. That was announced that had impact and is very well received. The first the cloud supported is AWS, and we will follow with Azure and GCP. And again, customers are eager. And again, have started with the AWS aspect it also further strengthens our partnership with AWS.

And so those are being well accepted. And in terms of the opportunity, it’s really — we’ve highlighted the multibillion opportunity in Identity Security and the machine identity is a big part of that. And we have a unique angle to take after it because we are coming as the trusted security provider, but understanding the unique needs of the developer. So bridging between security and developers is a very large opportunity.

Operator

Your next question is from the line of Josh Wood Tilton with Wolf Research. Please go ahead.

Josh Tilton

And Udi, it has been an absolute privilege. No intended. And Matt, congrats on the appointment. Just a quick one for me. I think in the prepared remarks, you guys touched on this tailwind from cyber insurance. Is there any way you can dive one level deeper on that? And just maybe how long do you think this tailwind could last?

Udi Mokady

I think it’s going to — so thanks for the question and onwards. I think it’s going to last because we’re seeing just the early parts of it. It’s mostly in North America. We believe similar drivers will show up in Europe and in the rest of the world. The insurers are — they found themselves like every company in the world, every organization is being attacked. It’s a given — and we’ve recently showed in a conference that companies are being attacked multiple times, even after they recover.

So the insurance providers had to step up and take an approach of we’re going to enforce important layers that make a difference before we ensure your to lower the premium. So I think it’s going to be another of those drivers that will last as long as that cyber insurance will exist and it’s going to exist, it’s becoming kind of table stakes at companies. And it gives an opportunity for CyberArk and companies like us, they also further partner with the insurance companies to educate their customers and make it very seamless for them to get on board.

And the fact that we now have the SaaS optionality really serves that well that they — when they need to meet the requirement, they can join CyberArk and be up and running fast and get that insurance set up.

Operator

Your next question is from the line of Gregg Moskowitz with Mizuho. Please go ahead.

Gregg Moskowitz

And congratulations, Udi, on everything you’ve achieved thus far in building such a terrific company. Congrats to Matt as well in an extremely well-deserved promotion. Udi, as you know, CyberArk is one of a select few software vendors that was able to execute at a very high level throughout all of 2022. Many investors wonder if you can continue to defy gravity in this environment. So it might be helpful just to hear a bit more from you on your confidence level and repeating this in 2023, even if we were to assume that the macro gets a little tougher from here?

Udi Mokady

Yes. I would say that we’re extremely confident. I think we’ve built a plan and like we mentioned, Matt and Josh and I and the executive team, we built a plan that factored the macro. Macro was in the room as we worked on the plan and really also very data-driven, analyzing our pipeline, analyzing our continued contribution from channels. And so we’re very confident in the opportunity we have into this year. And for our ability to push those levers that we put in place.

I mean, a lot of the components in CyberArk are actually behaving like growth engines, also like start-ups within the company, like the way the access business is growing. So we have the growth edge, we have the PAM market become — it’s a no greater security layer, and we’re taking it all over the world. And so yes, I would answer that. And Josh, do you have a numerical answer for that?

Josh Siegel

No. I think you said it well in terms of how we built our expectations for the year. I would also add that in our 2023 guide, it actually even includes a $20 million headwind when we think about the kind of the last a bit of the transition as we go from kind of the high 80% mix in 2022 to well over 90% mix into 2023. And so I think when you combine all that, I think that we’re confident about where we’re headed. And if our business trends remain as they are, well, we have the durability of demand and pipeline to support possibly even faster growth.

Operator

This concludes the Q&A session. I will now turn the call over to Udi Mokady for closing remarks.

Udi Mokady

All right. Udi Mokady for the record, but it’s all good. So I really want to thank everyone for the warm congrats that we saw throughout the call, we all really appreciate and the support of , as you saw in journey. We’re just getting started. We’re very excited about the year ahead. And again, we had another strong quarter, demonstrating that durable demand that we talked about and our platform selling momentum in the market positioning us very well for 2023. So thank you to our customers, first and foremost, and partners that are the cornerstone of our success. And I want to extend special appreciation to the entire CyberArk crew around the world. for the hard work and strong execution, very mission-driven team. So thank you very much.

Operator

Thank you for joining today’s call. You may now disconnect.