Image source: The Motley Fool.
CyberArk Software Ltd (CYBR 0.47%)
Q3Â 2018 Earnings Conference Call
Nov. 07, 2018, 4:30 p.m. ET
Contents:
- Prepared Remarks
- Questions and Answers
- Call Participants
Prepared Remarks:
Operator
Good day, ladies and gentlemen, and welcome to the Third Quarter 2018 CyberArk Software Earnings Conference Call. At this time, all participants are in a listen-only mode. Later we will conduct a question-and-answer session and instructions will be given at that time. (Operator Instructions) As a reminder, this conference is being recorded.
I would now like to introduce your host for today's conference, Erica Smith, Vice President of Investor Relations, please begin, ma'am.
Erica E. Smith -- Vice President of Investors Relations
Thank you, Norma. Good afternoon. Thank you for joining us today to review CyberArk's third quarter 2018 financial results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open the call up to a question-and-answer session.
Before we begin, let me remind you that during the call today, certain statements may be considered forward-looking, which reflect management's best judgment based on currently available information, specifically, our expectations and beliefs regarding our projected results of operations for the fourth quarter and full-year 2018. Our actual results might differ materially from those projected in these forward-looking statements. Please see the risk factors contained in the Company's annual report on Form 20-F filed with the US Securities and Exchange Commission and those referenced in today's press release. CyberArk disclaims any obligation or undertaking to release publicly any updates or revisions to any forward-looking statements made today.
Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation to the most directly comparable GAAP financial measures is also available in our earnings press release, which can be found in the Investor Relations section of our website, where you will also be able to find a webcast of today's call.
With that, I would like to turn the call over to Udi.
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Thanks, Erica and good afternoon everyone. Thank you for joining the call today. The third quarter was another great quarter for CyberArk. Total revenue reached a record $84.7 million, increasing 31% year-over-year. We generated record non-GAAP operating income of $21 million and our net cash from operations was $89.2 million in the first nine months of the year, already exceeding the cash flow we generated in all of 2017. Given our strong results, we are raising our guidance for the full year, which Josh will discuss later in the call. Strong execution and robust market fundamentals drove our results again this quarter.
I wanted to highlight three major market trends. First, awareness and demand for privileged access security is stronger than ever and accelerating across all geographies. Second, securing privileged access is recognized as critical to the successful execution of digital transformation and cloud migration strategies. And third, Chief Information Security Officers are solving increasingly complex regulatory challenges by focusing on securing the environment and not merely checking a compliance box. Given our leadership position and the breadth of our solutions, we benefited from these macro trends in the third quarter.
In terms of our strategy, every team across the organization executed well and contributed to our strong performance this quarter and year-to-date. Innovation has been key to our success. The simplicity and enhanced functionality of Version 10 of our core privileged access security solutions combined with a dramatically simplified new pricing model is accelerating new customer acquisition.
We ended Q3 with over 4,200 customers, adding nearly 200 new logos again this quarter. Year-to-date new customer additions have grown by 37% over the first nine months of last year, accelerating from about 10% in the first nine months of 2017 and 28% in the first nine months of 2016. With the wins in the third quarter, we are honored to be helping secure the world's leading companies, including 50% of the Fortune 500.
A few key new customer wins include a Fortune 100 technology company. We will be leveraging our core privileged access solution to secure network security cameras. We won this greenfield Internet of Things project because of our investment in the technology integrations that securely extend our solution across the IT infrastructure on-premise and in the cloud. A major insurance company chose CyberArk not only for the breadth of our solutions across core privileged access, endpoint protection in DevOps, but also because we can secure multiple public clouds including Google cloud platform and AWS.
The Chief Information Security Officer wanted to consolidate on a comprehensive privileged access security platform to increase control and security over the organization's enterprise hybrid environment. In the new digital world, every organization is a technology company and retail certainly is no exception. In the third quarter, we signed over 20 new retail customers and the vertical grew by more than 75% compared to Q3 last year. To respond to increasing competition and higher consumer demand, retailers are securely implementing comprehensive cloud and DevOps strategies.
In a seven-figure new business deal, a large retailer in Northern Europe will be leveraging our technology to secure its privileged accounts globally. In a hybrid deployment, this retailer is running our solution on-premise in the Americas and in Azure to secure its EMEA environment. This customer understands that securing privilege is foundational to it's comprehensive security strategy. A large retailer in the US will be leveraging CyberArk, OKTA and SailPoint and a broad identity project to protect this environment, on-premise as well as privileged access to AWS and Azure.
Our security-first approach to privileged, our ability to protect the DevOps pipeline and our strong relationships with our technology and advisory partners contributed to this great win. An existing Fortune 100 retail customer who first purchased Enterprise Password Vault in 2012 is extending its CyberArk deployment to its next generation data center in GCP and Pivotal Cloud Foundry with Application Identity Manager, Conjur and Core PAS. This progressive customer wants full visibility and security of its privileged human users and machine identities.
Our strategic moves over the last 18 months, including the new pricing model, Version 10 and our technology partnerships with Puppet, Ansible and Chef will significantly speed the tentative value for this mission-critical project. Broad diversification is a foundational pillar of our business. Our top 10 deals in the third quarter represented five different verticals, but more importantly, they were balanced across the Americas and EMEA, new and add-on business, channel and direct and included a number of products. Banking, manufacturing and global government where our largest verticals in Q3, each representing over 10% of the business.
In the Government vertical, we won agencies in North America, EMEA and APJ and continue to see traction with US Federal closing over 40 deals with both new and existing customers. Geographically, we were thrilled with the performance in each region. The Americas delivered another record quarter, growing by more than 20% in Q3. The EMEA team has improved consistency across the region, resulting in revenue growing by more than 40% in the third quarter and in APJ, we have seen an acceleration in deals over $100,000, demonstrating that securing privileged access is moving up on the security priority list in the region.
Add-on business was another important contributor to our record results. During the quarter, we had multiple seven-figure add on deals, including a US financial services firm, is expanding its initial CyberArk deployment across the global organization.
We originally want a relatively small deal in a new data center to protect Tier 0 critical assets, the most valuable assets for a hacker. After proving we are a superior solution, they are now ripping and replacing a legacy technology to deploy CyberArk globally across all data centers. After a data breach last year, a UK transportation company has leveraged CyberArk to regain control over its network. The organization now has a board mandate to implement a cybersecurity program targeted to significantly reduce risk. Because our solution is measurable, privileged access security was the number one priority for this customer.
Our strong execution is generating synergies across our advisory, value-added reseller and technology partner ecosystem, which is contributing to our strong performance. We are putting the customer first, working with our partners to help better secure against cyber-attacks. Value-added resellers recognize that combining our privileged access solution with the C3 Alliance technology partners, will strengthen their customer security position.
In the third quarter, our indirect business represented approximately 67% of total revenue. Our advisory partners are expanding their CyberArk practices and providing customers with a valuable and scarce security talent, which can implement our solution and deliver ongoing services. In the third quarter about 20% of our business was again influenced by strategic partners like Deloitte, PwC, KPMG and Atos.
Our ecosystem is promoting a best of breed approach across a number of security projects, notably in mission critical digital transformation and cloud migration strategies. Conjur and AIM play a critical role in cloud migration as well as digital transformation with DevOps and robotic process automation or RPA both steadily gaining traction. By bringing together advisory firms, VARs and tech partners like Automation Anywhere, UiPath, Blue Prism, Red Hat OpenShift and Puppet and others were helping customers across industries, securely automate business processes and the DevOps pipeline.
Our innovation has empowered customers to deploy or access CyberArk anywhere, on-premise, in the cloud, as a service or through an MSSP. During the third quarter, a large system integrator partner purchased our multi-tenant cloud managed security service provider offering. This partner has signed its first customers and is in the process of building out its broader MSSP offering. Our MSSP solution is further extending our reach into the mid-market and we are looking forward to working closely with this partner and others as they roll out privileged access security solutions.
We recently introduced our first innovation based on the Vaultive acquisition. Privileged Session Manager for cloud. This solution expands our reach to protect cloud administrators and privileged business users. Through a transparent, easy to use experience, this new functionality extends session isolation, monitoring and control to the most common web applications, cloud and social media platforms. As part of our core PAS solution, Privileged Session Manager for cloud leverages our threat analytics and risk scoring capabilities to detect and alert on suspicious privilege related activity.
The market for privileged access security is rich with opportunity and we believe that demand has never been stronger. Technology and attacker innovation are continually changing the threat landscape. Recent industry disruption and consolidation are also creating near-term opportunities to capture market share. Our execution in the first nine months of this year, has established a strong foundation to continue to responsibly invest in the business and deliver growth in the fourth quarter and beyond.
With that, let me turn it over to Josh to discuss more details about our record results. Josh?
Josh Siegel -- Chief Financial Officer
Thanks, Udi. Before we begin reviewing the quarter, I wanted to remind everyone that our third quarter results reflect the modified retrospective approach to disclosure for accounting standard 606. So as Udi mentioned, we had a record quarter for total revenue and operating income. We were pleased to again exceed our outlook for all guided metrics.
Total revenue grew by 31% year-on-year, reaching a record $84.7 million in the third quarter. We generated $46.1 million in license revenue, increasing 29% over the third quarter of 2017, representing 54% of total revenue. We experienced strong growth across all geographies, as well as in our mix for both add-on business and new customers as well as channel contribution, which increased during the quarter.
Maintenance and professional services revenue was $38.5 million, increasing 33% over the prior year period and representing 46% of revenue. The professional services revenue associated with this line was $6.7 million or 8% of total revenue. All geographies performed well again in the third quarter. The Americas reached another record quarter generating $52.1 million in revenue, growing 23% over third quarter last year and representing 62% of total revenue.
EMEA generated another high growth quarter with $26.3 million in total revenue or 42% year-on-year growth and 31% of total revenue. APJ recognized $6.3 million in revenue, growing 52% and representing 7% of total revenue. Beyond geographic diversification, we experienced a broad-based demand across verticals with five verticals growing by 50% or faster. Those include manufacturing, insurance, retail, telco and professional services.
As I move through the P&L, all line items will be discussed on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release. Our third quarter gross profit was $74.9 million or an 88% gross margin. That's compared to 86% gross margin in the same period last year.
We continued to enjoy increased utilization of our professional services team, resulting in the improved gross margin for the quarter. To capitalize on our significant opportunity, we are also continuing to invest in growth and scale. Our innovation has been a cornerstone of our long-term success. R&D grew by 33% year-on-year to $12.7 million or 15% of revenues, that was primarily driven by headcount, increasing by 21%, which included the acquisition of Vaultive in March earlier this year and currency movements and hedging, which represented approximately $400,000 of the increase in R&D expenses or approximately 4% of the expense growth.
Sales and marketing increased by 12% to $33.9 million or 40% of revenue as we expanded across all geographies to support direct and indirect sales. Consistent with last year in the third quarter, we again hosted our annual Americas and EMEA customer events, this year in Boston and Berlin respectively. We also introduced during the third quarter, our new Defend event series which were conducted in 12 cities across the Americas and attended by approximately 1,000 customers and prospects.
In G&A, our expense increased 36% year-on-year to $7.2 million or 8.5% of revenues, as we continue to scale the business to support our growth. In total, operating expenses for the third quarter increased 20% to $53.9 million, compared with $45.1 million for the third quarter last year. As a result of our record revenues, powerful business model and disciplined investments, we experienced strong leverage in the third quarter, delivering operating income ahead of our guidance at $21 million or a 25% operating margin. This compared to an operating income of $10.7 million or 16% operating margin in the year ago period.
We ended the third quarter with 1,106 employees worldwide. That's up from 1,077 at June 30, and compared with 966 at the end of the third quarter of 2017. We had 524 employees in sales and marketing on September 30, compared to 513 at June 30, 2018, and 468 at the end of third quarter of last year.
Net income was $17.8 million, generating earnings per share, ahead of guidance at $0.48 per diluted share for the third quarter 2018, that's increasing from the $8.9 million or $0.25 per diluted share for the third quarter of 2017. We continued to generate cash flow from operations into the third quarter, increasing our total net cash provided by operating activities for the first nine months to $89.2 million, this represents a 38% cash flow margin and an increase of 100% over the first nine months of the prior year period.
As a result, we ended the quarter with a strong balance sheet with $410 million in cash and investments, this compares to $330 million in cash and investments at year-end. We ended the third quarter with $136 million in total deferred revenue, a 29% increase from $105 million at year-end and a 59% increase from the $86 million at September 30, 2017. As a reminder, our deferred revenue primarily consists of recurring revenue derived from the maintenance and support contracts.
Turning to our guidance. As a reminder, our guidance does not consider any potential impact to financials, other income and expenses associated with foreign exchange gains or losses as we do not try to estimate future movements in foreign currency rates.
So for the fourth quarter of 2018, we expect total revenue of $94.8 million to $96.3 million or 19% year-over-year growth at the midpoint. We expect non-GAAP operating income to range between $27.3 million to $28.5 million or non-GAAP margin of 29% at the midpoint. We expect non-GAAP net income per diluted share of between $0.58 to $0.60.
Our guidance assumes $37.9 million weighted average diluted shares and a tax rate of 21% for the fourth quarter. Given the strength of our execution and the strong demand in our business during the first nine months of the year, we are pleased to raise our full year guidance. We expect total revenue to be in the range of $328.9 million to $330.4 million or growth of approximately 26% at the midpoint. We are also increasing our guidance for non-GAAP operating income to be in the range of $78 million to $79.2 million or an operating margin of 24% at the midpoint.
We are also increasing our guidance for non-GAAP net income per diluted share of $1.75 to $1.77. This assumes 37.2 million weighted average diluted shares. Our guidance for the full year assumes an effective tax rate of approximately 21% for the 2018. We are also increasing our outlook for cash flow from operation margins to be between 8% and 13% higher than our non-GAAP net income margin for the full year. This compares to the prior guidance range of net income margin to 10 percentage points higher than our net income margin.
As a reminder, the cash flow margin can vary from quarter-to-quarter based on seasonality of the business, tax obligations, cash collection and duration of maintenance contract renewals. Our execution year-to-date positions us well for the fourth quarter of 2018.
And now I'll turn the call over to the operator for Q&A. Operator?
Questions and Answers:
Operator
(Operator Instructions) Our first question comes from Saket Kalia of Barclays. Your line is open.
Saket Kalia -- Barclays -- Analyst
Hi guys. Thanks for taking my questions here. Josh, maybe for you. You talked about sort of the strength in multiple verticals. I think, you talked about some verticals that grew 50% year-over-year. Can you talk a little bit about the Federal government contribution this quarter and in the last quarter, we had some deals close. I'm wondering if that's trend kind of continued here in Q3?
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Hey, Saket. It's Udi, I'll jump in first. I would say that Q3 was healthy in the Federal government. Q2 was the record quarter and we talked about some of the unique programs that we saw throughout the year, but we saw continued growth in the vertical year-to-date , it's up 25% and we had about 40 transaction of both new and add-on business within Q3 itself. There has been a lot of ceding that I'm excited about that happened throughout the year with opportunity for add-on business and I think as we mentioned, the global government space is now continue to be in our top three largest and has grown very nicely throughout the year.
Saket Kalia -- Barclays -- Analyst
Got it. That's really helpful. Udi, maybe for my follow-up for you, more of a product question, last quarter you talked about introducing the privileged cloud to really future proof CyberArk's leadership, I think some of the deal examples that you talked about in your prepared remarks, also talked about hybrid deployments and such, realizing it's early. Can you just remind us how the privileged cloud is different than your traditional EPV? And what some of the early feedback has been on privileged cloud?
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Sure, absolutely. So the examples we gave in our prepared remarks are absolutely our existing solutions that currently extends into cloud deployments either securing cloud assets are being deployed in the cloud and some of the examples that I mentioned. And those are customers that are taking existing CyberArk products and deploying them in the cloud or to Secure cloud asset. The Privileged cloud is really brand new, the CyberArk privileged cloud and very early, but we're making early progress with early customers and pipe.
The main difference there is that the customer will not deal with installation of the the infrastructure itself of CyberArk. They will-- they are able to consume it as a service and obviously it's more oriented toward smaller organizations. But it, like you said, it's future-proofing us to the world where more and more customers will trust the cloud as the place that they want to put the keys to the IT kingdom and so we see it as a very important long-term opportunity for us.
Operator
Thank you. Our next question comes from Melissa Franchi of Morgan Stanley, your line is open.
Melissa Franchi -- Morgan Stanley -- Analyst
Great, thanks for taking my question. I think I'll start with maybe an update on the simplified pricing model and new bundles. I know you've said in previous quarters that you've seen an easing of sales cycles with the new simplified pricing, but you weren't yet receiving the full benefit from that. So can you just maybe give us an update of the benefits that you saw in Q3. If you've seen any changes. And then also if you're seeing any impact to ASPs from the new bundle?
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Josh you want to?
Josh Siegel -- Chief Financial Officer
Yes, hi Melissa. So with regard to the new pricing, we obviously are seeing with our new business deals, a real shift up, we're already up over 90% of our new business deals in the third quarter. We are buying off of the new price list with the simplified pricing and if we kind of look at total all the add-on and the new combined, we're close to 70% in the third quarter, using the new pricing model.
So, we really got great traction. I think customers are getting it and we're using it. I think in terms of impact on ASP where we're not seeing a big change or impact on ASP at this point yet, but we are seeing like you called out early on is that a nice qualitative improvement on the sales cycle, since you know where it's accelerating new customers, acquisition and we think it's tied in as well to the success that we've had with new customers. And also in a quicker way and easier way brings us to conversations around our other products, in addition to Core PAS. So overall, we like the decision we made there and we're well on our way for being fully adopted.
Melissa Franchi -- Morgan Stanley -- Analyst
Okay, great. And then just one follow-up for you Josh on margins, and margins came in well ahead of expectations in Q3. Is that simply because revenue came in ahead and that fell through to operating margins or was there anything to think about in terms of the timing of investments or maybe the investment plan coming in a little bit lower than what you were expecting and the reason for that?
Josh Siegel -- Chief Financial Officer
Yes, so first of all, the revenue did flow through to the bottom line, which we really like to try to make happen. Also, we had a benefit that we also saw on Q2. We had a nice benefit on the gross margin with our strong 88% gross margin contributing at least another percent down to the bottom line, with the efficiencies that we're getting in our globalized services group that we started at the beginning of this year.
I think on terms of spending, we're pretty much on track. There were some, I would say we actually worked hard and we had a lot of marketing programs in Q3 and we looked at a lot of them and actually negotiated well and we were in line or under, on those programs spending that we did through, basically just good purchasing discipline.
Melissa Franchi -- Morgan Stanley -- Analyst
Great, well thank you very much.
Operator
Thank you. Our next question comes from Gabriela Borges, Goldman Sachs. Your lines is open.
Gabriela Borges -- Goldman Sachs -- Analyst
Good afternoon. Thanks for taking my question and congrats on the quarter. This is a medium term outlook question either for Udi or for Josh, I'm looking at some of the volatility that you've seen in license revenue over the last six, seven quarters, in part due to the European execution issue that you called out over a year ago now. My question is, how should we think about a normalized run rate or normalized growth rate for license revenue over the medium term, just given all of your positive comments on growth acceleration? Thanks.
Josh Siegel -- Chief Financial Officer
Yes, thanks Gabriela. I'll start here, I think that, we first of all, we're talking about obviously 2019 and beyond in terms of license growth. We are enterprise software and ours in the Q4 is an important quarter for us to really know and be an indicator for going into next year, let alone the next several years. But I think the way we look at it, and I think Udi might be able to add to this is, we look at, where the market is going, where the industry analysts are talking about, where Core PAS is and what the opportunity and we definitely see ourselves as a leader in the competitive space and to be able to take our piece of that.
So I think that we still -- as we talked about earlier in the year, see ourselves with an opportunity on the early stage of the game, to be a high grower, which requires growing in license as well as our support contracts and we're going to also invest to try to keep that momentum going.
Gabriela Borges -- Goldman Sachs -- Analyst
So, I got, the follow-up is on the earlier comment on your cloud products that one of the big differences between on-prem versus other services the customer want to have to deal with the installation of any of the back-end infrastructure themselves. I'm wondering if that maybe gives you an opportunity on the pricing front. In other words, can you expand your share of wallet at the customer while also allowing the customer that realize better TCO on the Pro services side or on the installation side. Does that, maybe, give you an opportunity to expand your tab or expand your pricing with you as a service offering? Thanks.
Josh Siegel -- Chief Financial Officer
Thanks Gabriela. Udi I'll take it. I think the big, the biggest opportunity, and again I like I said, it's the long term one, is the ability to reach out further down market with the customers who do not want to deal with the installation and really consume this as a service. The biggest benefit and back to pricing right now is the adjustment we've done and we're very pleased with how it's kicking in and for the enterprise customers and of course those on the mid-market that buy off of it where we are making it very easy for them to quantify their use and in a bigger and accelerated land for CyberArk.
That's how we see it today, but, obviously, the lower the installation phase -- the lower the installation cost, the easier it is for us to expand our reach.
Gabriela Borges -- Goldman Sachs -- Analyst
Great, thank you.
Operator
Our next question comes from Shaul Eyal of Oppenheimer. Your line is open.
Shaul Eyal -- Oppenheimer -- Analyst
Thank you, good afternoon guys, and congrats on a very healthy set of results and outlook. Udi, if I look at the 200 new logos you've discussed and disclosed, the number you've disclosed this quarter, you've indicated also to any new retail customer that makes it 10% out of the total for this quarter. Is it fair to assume the majority are mostly high-end and we had an enterprise customers and probably how many products on average have each of the new 200 logos acquired, is the typical Core PAS product or there is already an EPM and Condrey (ph) potential IAM bundled into those -- some of those new contracts?
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Thanks, Shaul. I would say that the majority of our enterprise customers in the, I would say, in our focused markets, but we do see a pickup in the higher-end side of the mid market as part of it, but the majority are our enterprise and as we alluded, we, for the first time put out our footprint in the Fortune 500 and we are happy to say that we are now sit in 50% of the Fortune 500.
With regards to the product mix, now that we really unified the enterprise Password Vault and PSM and the products that into Core PAS. I would say most of these customers would land with Core PAS and it also is aligned with how we recommend to go about in really securing their major and burning risks around the retaining control over their network and cloud, but in several of these did include AIM/Conjur and EPM. It's still really depending on the level of the customer. It's still -- those are still products that make it into seeding and if not, in the seeding they are part of our add-on sales motion.
Shaul Eyal -- Oppenheimer -- Analyst
Got it. And maybe one for Josh, given the strong result this quarter linearity anything out of the ordinary maybe there was some business that actually you guys have decided to push into the fourth quarter or it was pretty much steady as she go?
Josh Siegel -- Chief Financial Officer
I would say, we had good linearity in Q3. And it actually has tracked well from Q2 as well in terms of the linearity. And so we're -- and I think you also see it reflected in our cash flow as well and the lower DSO that we are able to achieve.
Shaul Eyal -- Oppenheimer -- Analyst
Understood. Thank you again and congrats.
Josh Siegel -- Chief Financial Officer
Thank you.
Operator
Thank you. Our next question comes from Sterling Auty of JP Morgan. Your line is open.
Sterling Auty -- J.P. Morgan -- Analyst
Yes, thanks, hi guys. I wonder if you could just go into little bit more detail around the EMEA region. You are seeing nice consistency out of the geography for several quarters now. Wondering if you can maybe highlight, whether it's marketing programs or other items that's been driving the consistency and what we should expect from here?
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Thanks, Sterling. I really think it's one of the items, I'm very pleased on the strategic moves we made and how they contributed to the overachieve and part of it is optimizing and globalizing the sales force and our theory that was hey, let's take the successful sales motion that we did in the Americas and expand it to EMEA while pushing consistently in that, and that's really what's been happening. The one true change out there is more and more information security officers in Europe and I personally have the opportunity to talk to them, are trying to combine the heavy regulatory requirements that they have with addressing risk becoming really much more oriented toward, OK, if I have to comply, I'll also raise the value I'm going to deliver to the organization by really solving true risk assets and privileged access has been really been elevating in the top priority as we've discussed in the Americas market.
So the combination of being consistent, being very focused on reducing risk for our customers and training our channel partners to sell through risk and the growing market awareness, a lot of it driven by our marketing programs over the years and in the year, have been contributing to that consistency.
Operator
Thank you. Our next question comes from Fatima Boolani of UBS, your line is open.
Fatima Boolani -- UBS -- Analyst
Good afternoon, thank you for taking the questions. Udi maybe to start with you, in your prepared remarks, it sounded more like you were having maybe more outsize success on the expansionary side and to that extent, I'm actually wondering on what sort of multiplier you're seeing on lifetime customer spend and to what extent are your sales cycles actually shifting and frankly benefiting from the bundled approach and then a follow-up if I may?
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Yes, so Fatima I would say that one big header in this quarter is diversification. But it was, so geographic diversification, vertical diversification that we talked about, but also in the mix of new and add on, it was about a 40% new, 60% add-on business so definitely healthy contribution from new end and from add-on. In that add-on business, I agree with you, it's customers that are becoming more strategic with CyberArk, we're excited also to see that we are part of their cloud journey, it's securing the ever-increasing footprint in the cloud, and again whether it's for human users or for the application users like Conjur and AIM, and and I would say, we're pleased with the focus we've been giving with our customer success team on generating more lifetime opportunity from these major accounts and of course, there is a lot more to be done on this journey.
Fatima Boolani -- UBS -- Analyst
Got it. Udi, you also mentioned sort of, on marquee when with MSSP customer, can you kind of walk us through the broader MSSP opportunity and how we should think about the potential for maybe cannibalization on the lower end of the customers as you increasingly partner with MSSPs and typical systems integrators and service providers? Thank you.
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Thanks. I would say, true to our strategy also in partnering, we really go for quality versus quantity. And so the MSSPs have been cherry picked and they have to qualify to be able to really deliver true service to our customers. So we really don't see a risk of over cannibalizing with too many MSSPs out there. It's still an early CyberArk offering with the first MSSPs out there.
And for us, strategically it's our way to reach further into mid-market, and allowing us to focus on the enterprise opportunities. I think there's going to be a healthy equilibrium of whether it's a partner making it easy for their existing customers to CyberArk by joining their MSSP offering or really extending our reach by going further mid market that we would, on our own organically. And again, doing that with qualified partners really ensures that we keep a healthy equilibrium.
Fatima Boolani -- UBS -- Analyst
Appreciate the color, thank you.
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Thank you.
Operator
Our next question comes from Andrew Nowinski of Piper Jaffray. Your line is open.
Andrew Nowinski -- Piper Jaffray -- Analyst
All right, thank you and congrats on a nice quarter. Just want to ask about the competitive environment, it's been getting a little noisier, there's been a number of acquisitions in the space. Can you just give us an update on the landscape and whether those acquisitions may have opened up some more opportunities for CyberArk?
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Yeah, absolutely. And thanks for the congrats. I would say, if we look over the last 12 months, CyberArk really strengthened its leadership position. And again, we see the execution and results. And a lot of it is the proactive measures that we've taken in our strategy Version 10, our simplification, our pricing and the strategic M&As that we have done, that really break us away from other vendors.
But definitely the changes in the competitive landscape with the M&As in the last few months add, I would say, to turmoil within our competitive landscape, we've had. We've seen Francisco Partners has a private equity firm pickup four distinct vendors in the market BeyondTrust, Bomgar, Lieberman, Avecto and expect disruption there. We've seen CA get acquired by Broadcom. And so, yeah, we do expect to see further opportunity from that disruption. And true to us, we are going after the leadership regardless of that and we will further capitalize on that opportunity.
Andrew Nowinski -- Piper Jaffray -- Analyst
That's great. Thank you. And then I just want to ask about the, some of your partnerships with OKTA and SailPoint. I'm wondering, have you seen any new customer wins as a result of those partnerships yet?
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Absolutely. I think we gave one example in the prepared remarks, but we've been doing joint events, referring each other. It's been a very healthy partnership out in the field that is adding, I would say to each of the company's pipeline.
Andrew Nowinski -- Piper Jaffray -- Analyst
Okay, great. Keep up the good work.
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Thank you.
Operator
Thank you. Our next question comes from Gur Talpaz of Stifel. Your line is open.
Gur Talpaz -- Stifel -- Analyst
Okay, great. Udi, I want to ask about the release of PAS v10.2 back in March. So how important has this been in driving some of the strength that you noted on the call. But more specifically, not just for the broader platform for products like Conjur, where you noted a bunch of pretty interesting wins?
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Absolutely. So I think one of the unique things that go with 10.2 and beyond is, is that the customers can integrate their Conjur environment into their on-premise environment, and have a unified way to manage credentials, if they choose to do that for their on-premise environment, and also for their cloud and native cloud architecture based applications.
We are now out there with 10.5. We've been continuously -- from Version 10 and beyond, it's all been about simplification, automation, making it easier for our customers to install, making it easier for customers to deploy, manage, introduce more and more automation. So we really think it's become a big differentiator, it's become a big piece, as Josh mentioned, of the acceleration in the new logos, and we've been really working closely with customers to make sure that every additional dot releases is continuing that thread of simplification, and in automation and we're excited about it.
Gur Talpaz -- Stifel -- Analyst
Okay. That's really helpful. Within the public cloud specifically, where do you think we are in terms of the customer life cycle process, meaning, do you think we're still pretty firmly in the evangelical phase? Are we starting to kind of push past that?
Udi Mokady -- Founder, Chairman & Chief Executive Officer
I would say we're really a true -- I would say, compass (ph) for that, because we touched so many different verticals in all over the world, and I would say there is no customer that's not doubling one way or another with cloud, and in one -- and anywhere on the scale of just being very early and trying to see what they can do because they are highly regulated to those, like the retail example I gave that just see it as a big differentiator, a way to lower cost and move workloads and -- into the cloud. So I think it's -- the journey is very much advanced. It really differs between the different companies, but in all of them we were able to latch in at whatever phase they are in and say OK. First of all, let's make sure you have control over your network, and that you have control over your cloud and enjoying that transformation journey.
Gur Talpaz -- Stifel -- Analyst
Yeah, thanks Udi and congrats on the strong quarter.
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Thank you very much.
Operator
Thank you. Our next question comes from Jonathan Ho of William Blair. Your line is open.
Jonathan Ho -- William Blair -- Analyst
Hi, good afternoon. I just wanted to maybe start with the resellers and channel leverage. I just want to understand a little bit better. What type of opportunity you see there, just given the pickup in terms of the third-party generation of leads? And then maybe what the size and influence service are doing on your behalf as well, that's maybe a little bit more than what they did in the past?
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Yeah, absolutely. I think Jonathan, just like we -- in the early years, we had to really evangelize why privileged access is such a critical security layer and over the past year, just like it came up to the top with customers. We're really seeing it come to the top with our channel partners, and to the top in terms of what they're seeing from their -- they're hearing back from their customers, but also in what they're seeing as an opportunity for their own revenue generation. And we team up with them, and we create business plans really depending on the strength of the VAR. Is it a company that's -- that is going after the services opportunity? Is it a company with a strong reach in new markets for us? Is it an advisory firm where they really influence the Fortune 500 vendor selection and have built practices around that.
So I would say, it's more and more elevating. We are measuring internally the -- those that are not just generate leads, but also are influencing like the advisory firms and it's really in the right trajectory. For specifically on system integrators, we've seen system integrators include the CyberArk offering in their responses when -- in RFP responses and others, when they're going after even larger transformation projects like new datacenters, and digital transformation. We've also seen them go after the services opportunity with CyberArk. Some of them are also on the -- are adopting our MSSP offering.
Jonathan Ho -- William Blair -- Analyst
Got it. Thank you for the color. I also noticed that you talked about IoT opportunities, particularly on the security camera market. I think this is one of the first time that you've talked about, and probably which within this context. Can you maybe talk about this in terms of the growth opportunity. Is this a large portion of your business today? And is it being able to target that on the pipeline side? And can you maybe give us a color around the opportunities that you see here?
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Yeah, no, it's a great one. We gave an example of a Fortune 100 company, well, that was the landing point, was they're concerned about their IoT devices, in this case, cameras and the ability to control and rotate credential on these devices. So that they won't be the landing spot for attacks. We view that as a very early opportunity for us, and I would say it's very nascent and it's out, there are more enterprises themselves have that IoT sprawl, the more we can go after it. One of our partnerships is with ForeScout who have the capability to detect and discover these devices and CyberArk can be the company to rotate credentials and secure administrative access to these devices. So it's early, but it's out there.
Jonathan Ho -- William Blair -- Analyst
Great, thank you.
Operator
Thank you. Our next question comes from Howard Smith of First Analysis. Your line is open.
Howard Smith -- First Analysis -- Analyst
Yes, thank you and I'll add my congratulations for the very strong results. My first question has to do going back to kind of a team question on new versus add-on, with the larger installed base and all the opportunity there, do you see a kind of medium-term trend toward more of your business, each quarter coming from the installed base versus new or or not?
Josh Siegel -- Chief Financial Officer
Yeah, Howard. This is Josh. We actually have been pretty consistent over the last, I think, a year almost or two years with being about a 60/40 mix, 60% of our license revenue coming from existing customers and 40% coming from new customers. We do see a little bit of shifting in there from quarter to quarter, but it's been pretty consistent and we saw that into Q3. And if you look at the first nine months of the year, it's also hovering around the close to the 60/40 mix.
So as you pointed out yourself, we actually have a huge market opportunity within our installed base and we view it as a big market opportunity. I think at this point, we also only 4,000, we have 4,200 plus customers, but we only have that much and we see that as a big greenfield opportunity as well. So I can't really predict exactly what the percentage will be going forward, but it's been pretty consistent over the last year or plus at this level. And given the greenfield opportunity on the new customers and on the existing installed base, we're really investing in the same tone going forward in both.
Operator
Thank you. Our next question comes from Gray Powell of Deutsche Bank. Your line is open.
Gray Powell -- Deutsche Bank -- Analyst
Great, thanks for taking the questions and congratulations on the good results.
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Thank you.
Gray Powell -- Deutsche Bank -- Analyst
So I just want to circle back on the license growth, I mean if I look year-to-date growth is coming in at about 27% in license as well above even the best quarters that you had last year and it's closer to the 2016 trend line. So I was wondering if you can just kind of high level talk about the top drivers of the improvement. And is it more, would you say it's more the execution and things that you're doing on your side like the new bundles or is it more just an improvement in the overall market?
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Absolutely. I would say that it's executing and really seeing the fruits of strategic moves we've made, coupled up with increased demand of the globalizing of the sales and optimizing of the sales and support organization. Everything I mentioned about Version 10 to simplify the pricing, the strategic M&As we've done particularly EPM, Conjur, Vaultive that gave us a strengthened our cloud play both on the human side and the applications, coupled with the market fundamentals with privilege really moving up in, in priority even in third-party recommendations, like I mentioned last time in some of the garden (ph) conferences and and others. Digital transformation initiatives really rising up and compliance as I would say rising, but being addressed more in a risk oriented fashion. So we're executing against that and the past investments have allowed us to, to really over-achieve here.
Operator
Thank you, our next question comes from Catharine Trebnick of Dougherty. Your line is open.
Catharine Trebnick -- Dougherty -- Analyst
Thanks for taking my question, really nice quarter. Can you discuss you've had such great, great following on Gray's question here, what are you doing in terms of training. It seems like this, even though you simplified the product and the pricing, it's still is pretty complicated and what steps are you going to implement training of your resellers and the people at the advisory firms et cetera that are helping you drive this growth? Thank you.
Udi Mokady -- Founder, Chairman & Chief Executive Officer
No, thank you. As I said I think training is an ongoing initiative. We set a goal to really increase the ecosystem of CyberArk certified engineers out there, we put up some numbers in previous quarters where we've significantly increased the footprint out there. We see it as a good sign that our training courses in when we do our customer events are always completely booked and oversold their strong demand for CyberArk talent out there and we're continuing to investing going after it also in train -- the trainer program, so that we can further bring our training programs to market.
And we are hearing consistent feedback from customers and partners that everything we've done on 10 from a product perspective and everything we've done on pricing simplification is really helping them.
Catharine Trebnick -- Dougherty -- Analyst
Fine, Thanks Udi.
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Thank you.
Operator
Thank you. Our next question comes from Erik Suppiger of JMP. Your line is open.
Erik Suppiger -- JMP -- Analyst
Yeah, thanks for taking the question. Your channel, I think you said, contributed too were influenced 67% of your deals. I think that's up from where it's been historically, can you give us a sense, do you think that will continue to elevate from that level? And then secondly, did you have much influence or much effect from GDPR here in the September quarter since at the first quarter, full quarter that's been in effect?
Udi Mokady -- Founder, Chairman & Chief Executive Officer
So I'll start with the last one and we'll come back to the channel. I think we see anecdotal connections to GDPR where customers have cited that it's been a driver. But I think the bigger overarching driver for our business has continued to be the risk-oriented approach and compliance is, I would say compliance is being consumed in a smarter way. Beyond GDPR, there's GDPR, NIS, PCI, SOX. There are continued strong compliance drivers and more customers are addressing them with things that we're really move the needle on reducing risk.
But in EMEA, they definitely bring it up, but it's more, anecdotal. I also want to note that we're hearing US organizations, and North America organizations looking at GDPR as something that they have to look at, but again in our conversations they then combine it with less reduced risk. We think that GDPR will be more of a steady drumbeat for business over a long period of time.
Josh Siegel -- Chief Financial Officer
Yeah. Hi, Eric and if we kind of return back to the channel question. Yeah, it was up in Q3, it was in the mid to, just above the mid '60s and clearly that's a level that's also driven by the advisory firms that are contributing healthy as well to this space and I think though the overall our strategy has been pretty much the same if we think about the year-to-date, it is still around the 60/40 level which is similar levels that we saw in 2017.
So I'm not going to jump the gun yet and say that we have a new level of channels, because we do get some lumpiness depending of certain deals may go through a channel. But overall, we're happy with the way channels executed with us and for us in the third quarter and we're keeping, we're sticking with it and investing heavily in this area.
Erik Suppiger -- JMP -- Analyst
Very good. Thank you.
Operator
Thank you. Our next question comes from Ken Talanian of Evercore ISI. Your line is open.
Ken Talanian -- Evercore ISI -- Analyst
Hi, thanks for taking the question. Could you give us a sense for how your large deals tracked in the quarter and how they're tracking in the pipeline?
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Yeah, we increase in large deals across the board. If you look at our over 100k deals, they increased dramatically. I think, faster than the rate of the business growth and if we look at also, if you go up into the next levels above $0.5 million, also increasing very nicely. I think every quarter, we have several seven figure deals and larger deals and overall we are pleased with the large deals are because it's not just happening in one area too, it's really happening the growth in our over 100k deals are happening across each of the regions. Also in Americas, also in EMEA, and also in APJ.
So that's really sending a strong statement about the footprint that our customers want to take with us. And if we think about the pipeline, absolutely, in order for us to keep growing the business and we look at the health of our pipeline, we see a continued traction in developing large deals in our pipeline as well. It's going to be -- it's part of the cornerstone of our growth. The good news is that we continue to really have a diversified group of deal sizes and overall we're -- our average deal size has been pretty stable, both on add-on and new customers. So, we think we're in a good place there.
Ken Talanian -- Evercore ISI -- Analyst
Great. And I guess not exclude specific to large deals, but could you give us a sense, which verticals you're seeing the greatest increased in interest or if you want to describe that as pipeline?
Udi Mokady -- Founder, Chairman & Chief Executive Officer
I think well if we talk about -- if we talk about the third quarter, the largest vertical growths were insurance, manufacturing, retail. We had three verticals, which are still -- which were over 10% of our pie -- banking as it usually is global government also manufacturing in the third quarter. And if we look at our -- if we look at our large deal split, we're going to see it in every vertical. There isn't -- I don't think there is one of our key verticals, one of our top 7 or 8 verticals that we're not doing large deals in -- on a regular basis.
Operator
Thank you. Our next question comes from Daniel Ives of Wedbush. Your line is open.
Daniel Ives -- Wedbush -- Analyst
Just a quick question. How penetrated, do you think your installed base is today? I mean, just given the success you are seeing if you would estimate?.
Udi Mokady -- Founder, Chairman & Chief Executive Officer
How penetrated is our installed base?
Daniel Ives -- Wedbush -- Analyst
Yes, on your solution side.
Udi Mokady -- Founder, Chairman & Chief Executive Officer
I think if we look across all of our customer base, we kind of we view it as still under a third in a deployment rate and that's, we were talking about earlier and one of the earlier questions, we're seeing consistently 60% of license revenue coming from our existing customers. We also are still very much on track and seeing a third of our customers coming back each year and that grows obviously as we keep acquiring new customers that third -- that number goes up each year and we see them coming back and buying either more of the same licenses or across over to new licenses. So where -- we still feel though that we're under the third mark.
Operator
Thank you. The next question comes from Gregg Moskowitz of Cowen & Co. Your line is open.
Gregg Moskowitz -- Cowen & Co. -- Analyst
Okay, thank you. And I'll echo the congratulations on a really strong quarter. Udi, I just had a follow-up on your success in retail. When you look at the deals that closed this quarter combined with the pipeline, would you say that you're now seeing an inflection in retail? Or is this something that was also significantly ramping in the first half of the year?
Udi Mokady -- Founder, Chairman & Chief Executive Officer
I think the biggest jump is in comparison to last year and I think the unique element is they embrace me -- that they are embracing cloud and digital transformation. I think the inflection point is more of these retailers obviously for all the reasons we understand that that's their way to really jump on the wagon and with increased competition and also to differentiate. But there are also a prime target of attackers as we know, and so the biggest change has been our ability to latch on their digital transformation, initiatives and I would say the -- it started throughout the year.
Gregg Moskowitz -- Cowen & Co. -- Analyst
Great, thank you.
Operator
Thank you. At this time, I like to turn the call back to Udi Mokady for closing remarks.
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Thank you. In closing, I would like to thank our customers, partners and our employees worldwide for contributing to our record third quarter results. Thank you everybody. And good night.
Operator
Ladies and gentlemen, thank you for your participation in today's conference. You may disconnect. Have a wonderful day.
Duration: 62 minutes
Call participants:
Erica E. Smith -- Vice President of Investors Relations
Udi Mokady -- Founder, Chairman & Chief Executive Officer
Josh Siegel -- Chief Financial Officer
Saket Kalia -- Barclays -- Analyst
Melissa Franchi -- Morgan Stanley -- Analyst
Gabriela Borges -- Goldman Sachs -- Analyst
Shaul Eyal -- Oppenheimer -- Analyst
Sterling Auty -- J.P. Morgan -- Analyst
Fatima Boolani -- UBS -- Analyst
Andrew Nowinski -- Piper Jaffray -- Analyst
Gur Talpaz -- Stifel -- Analyst
Jonathan Ho -- William Blair -- Analyst
Howard Smith -- First Analysis -- Analyst
Gray Powell -- Deutsche Bank -- Analyst
Catharine Trebnick -- Dougherty -- Analyst
Erik Suppiger -- JMP -- Analyst
Ken Talanian -- Evercore ISI -- Analyst
Daniel Ives -- Wedbush -- Analyst
Gregg Moskowitz -- Cowen & Co. -- Analyst
Transcript powered by AlphaStreet
This article is a transcript of this conference call produced for The Motley Fool. While we strive for our Foolish Best, there may be errors, omissions, or inaccuracies in this transcript. As with all our articles, The Motley Fool does not assume any responsibility for your use of this content, and we strongly encourage you to do your own research, including listening to the call yourself and reading the company's SEC filings. Please see our Terms and Conditions for additional details, including our Obligatory Capitalized Disclaimers of Liability.
