Image source: The Motley Fool.
CyberArk Software Ltd (CYBR 0.47%)
Q2Â 2019 Earnings Call
Aug 7, 2019, 8:30 a.m. ET
Contents:
- Prepared Remarks
- Questions and Answers
- Call Participants
Prepared Remarks:
Operator
Good morning. My name is Julie and I will be your conference operator today. At this time, I would like to welcome everyone to the CyberArk Second Quarter 2019 Earnings Conference Call. [Operator Instructions] After the speakers' remarks, there will be a question-and-answer session. [Operator Instructions]
Thank you. Ms. Erica Smith, Investor Relations, CyberArk, you may begin your conference.
Erica E. Smith -- Investor Relations Contact
Thank you, Julie. Good morning. Thank you for joining us today to review CyberArk Second Quarter 2019 Financial Results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer, and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open the call up to a question-and-answer session.
Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management's best judgment based on currently available information. Specifically, our expectations and beliefs regarding our projected results of operations for the third quarter and the full year 2019.
Our actual results might differ materially from those projected in these forward-looking statements. Please see the risk factors contained in the company's annual report on Form 20-F filed with the US Securities and Exchange Commission and those referenced in today's press release. CyberArk disclaims any obligation or undertaking to release publicly any updates or revisions to any forward-looking statements made today.
Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation to the most directly comparable GAAP financial measures is also available in our earnings press release, which can be found on www.cyberark.com in the Investor Relations section.
Also, please note that a webcast of today's call will be available on our website in the Investor Relations section.
With that, I'd like to turn the call over to Udi Mokady. Udi?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Thanks, Erica. And good morning, everyone. Thank you for joining the call today. We were pleased to exceed expectations across all guided metrics. Revenue reached $100 million, growing 29%. Our revenue outperformance, disciplined investments and strong business model resulted in $26 million of operating income for the quarter. And in the first six months of the year, we generated $67 million in cash flow from operations.
Given the strength of our business in the first half, we are raising our guidance for the full year, which Josh will talk about later in this call.
Demand for our solution remains strong across the Americas, EMEA and APJ, and we continue to see broad market tailwinds. While digital transformation and cloud migration strategies are accelerating business operations, they are also exponentially increasing the complexity of enterprise IT, creating opportunities for CyberArk with new and existing customers.
In addition, regulators are flexing their muscles, making headlines in the last few weeks by imposing staggering fines of $700 million, $250 million and $125 million related to breaches. The stakes have never been higher in security. And in almost every successful breach, a hacker infiltrates the network or cloud environment and exploits privileged access, putting our solution at the top of chief information security officers' priority lists.
In today's environment, organizations are prioritizing proven and measurable solutions that deliver value. They recognize that securing privilege identities, human and non-human, is the foundation of a strong cybersecurity strategy. In fact, industry analysts again listed protecting privilege as one of the top 10 most impactful security projects for 2019.
privileged access extends across all enterprise IT and the breadth of our solutions simplifies the customer journey. A customer typically secures the most critical assets and applications first and then expands, increasing the number of users, adding our application and endpoint solution and ultimately extending protection. enterprisewide, across on-premise, cloud and hybrid environments. This is driving add-on business, which again represented just over 60% of licensed revenue in the second quarter.
On the new business front, we won more than 200 new logos in the second quarter, and are now helping secure over 4,800 organizations around the world. The majority of our new business continues to be greenfield and we are often surprised to see large enterprises managing privilege accounts manually.
Overall, in both new and add-on deals, our results were well diversified across industries, customer size as well as geography, demonstrating that every organization needs to secure privileged access.
In the second quarter, six verticals grew by 40% or more, including insurance, manufacturing, media, pharmaceuticals, retail and transportation.
We continue to see strong traction with our newer solutions. We were thrilled with our record quarter for Endpoint Privilege Manager, including record SaaS bookings. Most breaches begin at the endpoint. Removing local administrative rights, running at least privilege is recognized as a foundational pillar of security best practices from institutions like the Center for Internet Security, CIS, and the National Institute of Standards and Technology, or NIST. Our platform provides customers with end-to-end visibility into privilege activity from endpoint through on-premise and cloud environments.
In addition, application access manager continues to gain momentum and was included in half of our top ten largest deals in the second quarter, with an increasing number of customers also landing with this solution. As organizations migrate workloads to the cloud and implement digital transformation strategies, securing applications is increasingly important to reduce the attack surface.
Our more than 200 integrations are a major competitive differentiator in the market, reducing the friction of securing mission-critical applications and making it easier for customers to strengthen their overall security posture.
Securing a robotic process automation, or RPA, projects was a trend again in the second quarter to successfully automate and standardize As human processes, RPA robots need access to multiple essential applications and systems. Customers are increasingly turning to CyberArk to secure leading RPA vendors like Automation Anywhere, Blue Prism and UiPath.
I want to highlight a few powerful new and add-on customer examples. In a great field of opportunity, a large global manufacturing company landed with Endpoint Privilege Manager and Core Privileged Access Security. The firm's new chief information security officer quickly identified securing privileged access as the top priority. They chose CyberArk because of our leadership position, ongoing investment in innovation and ability to provide visibility into privileged activity enterprisewide.
A government agency in EMEA had a specific GDPR use case which was extended to also secure its applications in IT environment with a comprehensive PAS program.
A European media company expanded its deployment of CyberArk. The customer wanted to mitigate the risk of cyber attacks across its European operations. The simplification of our solution and licensing, as well as our ability to secure its digital transformation strategy and AWS environment were meaningful contributors to this seven figure add-on deal.
A US federal agency extended its coverage with Core PAS and added Application Access Manager and Endpoint Privilege Manager. The agency wanted a single view into its privileged activity enterprisewide including its AWS environment.
In our largest deal in the second quarter, a financial services firm in the Americas is expanding with Core Privileged Access and Application Access Manager for its mission-critical, customer-facing applications. They have a multi-cloud environment and will leverage CyberArk to secure both AWS and Azure.
Our unwavering focus on innovation is critical to extending our leadership position. We continue to set the standard and define the market for privileged access security with the early July introduction of CyberArk Alero, our latest SaaS solution. Alero helps customers mitigate the risk of third-party vendor access to critical systems.
We are the only vendor to combine zero trust access, biometric authentication and just-in-time provisioning without the use of VPNs, agents or passwords. Our new solution makes it simple and easy for customers to manage remote vendor access.
We also enhanced Endpoint Privilege Manager to provide just-in-time administrative access to Windows and Mac endpoints on-demand. Given our security-first approach, we are also providing customers with a full audit log and the ability to revoke access as needed.
The combination of Alero, CyberArk Privilege Cloud and Endpoint Privilege Manager is the most comprehensive SaaS portfolio for privileged access in the market. Customers can deploy or access CyberArk anywhere, on-premise, in the cloud or as a service.
Our latest innovations were introduced at our recent CyberArk Impact events for customers and partners in Amsterdam and in Chicago. These events were our most successful yet, and mark the largest gathering of privileged access security professionals in the world, with more than 2,500 attendees.
Partners also had an opportunity to dive into the the new CyberArk Partner Network. This partner enablement program connects our ecosystem of advisory firms, global system integrators and regional solution providers and introduces enhanced competency-based tiering and certifications. The indirect channel represented about 65% of our revenue in the second quarter. We believe this new partner program provides us with an opportunity to accelerate momentum with our channel and advisory partners.
As part of our ongoing commitment to helping customers secure their cloud environments, we expanded our relationship with Microsoft, by joining the Microsoft Intelligence Security Association. We are working with Microsoft to deliver joint customers greater flexibility and efficiency for securing privileged access. Our enterprise customers can more easily deploy our solutions in Azure and consistently enforce security and compliance across hybrid environments.
As you saw in our release today, we also announced that Ron Zoran will be transitioning out of CyberArk to help grow in scale early stage organizations as a board member. Ron was one of the very first employees at CyberArk and played an important role in defining privileged access as a critical layer of security and in establishing CyberArk as the de facto leader in the space. Like all strong leaders, Ron has built an exceptional sales organization with strong leadership across all regions.
We have initiated a search for a new global head of sales. Ron will continue to serve as chief revenue officer through September 30th. To help ensure a smooth transition, he will continue as an advisor into the first quarter of 2020. We appreciate his ongoing commitment to the company.
Our financial performance continues to demonstrate our significant market opportunity, the increasing awareness of privileged access security as a critical layer and our ongoing commitment to delivering profitable growth.
With that, let me turn it over to Josh to discuss more details about our strong Q2 results. Josh?
Josh Siegel -- Chief Financial Officer
Thanks, Udi. As Udi mentioned, we had a strong second quarter with total revenue growing by 29% year-on-year to $100.2 million. License revenue reached $52.2 million, increasing 27% over the second quarter last year and representing 52% of total revenue. We showed growth across all geographies and for both new and add-on business.
On the product side, Application Access Manager represented about 9% of license revenue and Endpoint Privilege Manager represented about 7%. In the second quarter, we were again pleased to see the strong growth in EPM bookings derived from SaaS deals.
Maintenance and professional services revenue was $48 million, increasing 31% year-on-year and representing 48% of revenue. The professional services revenue associated with this line was $9.2 million or 9% of total revenue.
The business was well diversified across geographies. The Americas revenue grew 28% to $61.8 million and represented 62% of total revenue. EMEA revenue also increased 28% to $28.7 million or 28% of total revenue. APJ which achieved a record $9.7 million in revenue, growing 41% and representing 10% of total revenue.
As I move through the P&L, all line items will be discussed on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release.
Our second quarter gross profit was $87.7 million or 88% gross margin, consistent with last year's 88%. We are continuing to invest in the business to deliver innovation, drive growth and scale the operations. R&D grew by 24% year-on-year to $14.6 million. Sales and marketing increased 19% to $38.6 million as we expanded our sales organization across all geographies to support direct and indirect sales.
G&A expense increased 16% year-on-year to $8.1 million as we continue to scale the business to support our growth.
In total, operating expenses for the second quarter increased 20% to $61.2 million compared with $51.2 million for the second quarter of last year.
With our disciplined investments and revenue outperformance, we again delivered operating income ahead of our guidance at $26.5 million or a 26% operating margin compared with $17 million or 22% operating margin in the year-ago period.
Our overall expense growth is primarily related to headcount and we ended the second quarter with 1,254 employees worldwide compared with 1,077 at the end of second quarter last year. We ended the quarter with 588 employees in sales and marketing compared to 513 at the end of the second quarter last year.
Net income was $23 million or $0.59 per diluted share for the second quarter of 2019 compared to $13.5 million or $0.36 per diluted share for the second quarter of last year. We were pleased to generate $67.3 million in cash flow or 34% margin for the first half of 2019. That represents an increase of 20% over the first six months of last year. The strong cash flow continues to be driven by strong collections as well as our high maintenance renewal rates.
As a result, we ended the quarter with $538 million in cash and investments. This compares to $451 million in cash and investments at year-end and we ended the second quarter with $174 million in total deferred revenue, a 34% increase from $130 million at June 30, 2018.
Turning to our guidance. As a reminder, our guidance does not consider any potential impact to financial or other income and expenses associated with foreign exchange gains or losses as we do not try to estimate future movements in foreign currency rates.
So, for the third quarter of 2019, we expect total revenue of $102 million to $104 million or 22% year-on-year growth at the midpoint. We expect non-GAAP operating income to range between $21.8 million to $23.3 million and non-GAAP net income per diluted share of $0.45 to $0.48 . The increase in our expenses in the third quarter is primarily related to seasonal employee expenses and our major third quarter marketing programs. Our guidance also assumes 39.4 million weighted average diluted shares and a tax rate of 21% for the third quarter.
Because of our first half execution and demand for our solution, we are increasing our guidance for the full year of 2019. We expect total revenue now to be in the range of $419 million to $423 million or a growth of approximately 23% at the midpoint. We are also increasing our guidance for non-GAAP operating income to be in the range of $106 million to $109 million and non-GAAP net income per diluted share of $2.24 to $2.30. This is assuming 39.1 million weighted average diluted shares. And our guidance for the full year assumes an effective tax rate of approximately 21% for 2019.
We are pleased with our execution and our results in the first half of 2019. And it positions us very well for the remainder of the year.
I will now turn the call over to the operator for Q&A. Operator?
Questions and Answers:
Operator
And at this time, your first question comes from the Saket Kalia, Barclays Capital.
Saket Kalia -- Barclays Capital -- Analyst
Hi, guys. Thanks for taking my questions here.
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Absolutely. Hi, Saket.
Saket Kalia -- Barclays Capital -- Analyst
Hey. Morning. Maybe, Udi, just to start with you, from a product perspective, it seems like the momentum for Application Identity Manager, and I'm guessing Conjur as well, continues to be strong. Can you just dig into that a little more? Why do you feel like we're seeing that demand for AIM currently? And maybe related to that, how do the economics for AIM compare to Core PAS if that's comparable at all?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Sure. So, like we highlighted, it was a record quarter for Endpoint Privilege Manager which really has its drivers around the fact that attacks begin at the endpoint and it's becoming a nobrainer. Let's not let users run with full privileges on the endpoint and make it easy for an attacker to exploit and land there. That's our Endpoint Privilege Manager.
And with regards to AIM, super strategic as part of digital transformation strategies of our customers. And so,whenever we come to an existing account or a new prospect, they are somewhere on that journey to moving their applications to modern infrastructure, running on containers and, again, securing those keys and credentials is key. It's still a smaller -- obviously, it's still a smaller part compared to our Core PAS. Core PAS is the prime growth of this ship. But it's behaving like a growth engine and is super strategic for us.
Josh Siegel -- Chief Financial Officer
And, Saket, when we think about the economics behind the AIM versus our Core PAS, well, first of all, it's again -- it's pure software. So, on a margin basis, it's very, very high margins related. It probably drives also equal amount of services as well. It's priced a bit differently in the context of -- because it's both dynamic and for non-dynamic application environments. But, overall, we think about organizations that would require it across the entire organization. The value of it would certainly be very close to the value of a Core PAS for that organization.
Analyst
Got it. That's helpful. Josh, maybe for you. Just in terms of revenue, nice beat on license, but also an even bigger beat versus [Indecipherable] maintenance and services. Can you just talk a little bit about the breakout there within maintenance and services? What the split was between the two? And sort of, how you think about that going into the second half?
Josh Siegel -- Chief Financial Officer
Yes, I think when we look at the support and maintenance, that number included -- I think I talked about it, was $9 million. 9% of the total revenue was professional services.
Saket Kalia -- Barclays Capital -- Analyst
Got it. Very helpful. Thanks, guys.
Josh Siegel -- Chief Financial Officer
Thanks, Saket. Yes.
Operator
Your next question comes from the line of Sterling Auty with J.P. Morgan.
Sterling Auty -- J.P. Morgan -- Analyst
Hey, guys. Just to clarify that. So, I think we get to the same number, but I think in the prepared remarks, you said $9.2 million of services.
Josh Siegel -- Chief Financial Officer
Yes, exactly. And that's 9% of total revenue.
Sterling Auty -- J.P. Morgan -- Analyst
All right, perfect. Just wanted to make sure. So, Udi, in terms of your Chief Revenue Officer deciding to work with smaller companies, any additional insight as to why now?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yes, absolutely. First of all, I want it to be down in the book as the best possible and most amicable transition in recorded history because he's both -- it's a longtime and strong relationship and friendship. And he's been with us basically from the beginning of time. And so, the timing is his decision. But in everything he says and articulates, he's just very proud of where we are as a company and the opportunity for us.
And after so many years in a demanding operational role, wants to contribute from his experience to start-ups and early stage companies, mostly as a board member and investor. And so, it's really, I would say, a good timing for him. And for us, the best possible transition because he's leading the charge for Q3. He's staying with the company all the way into Q1 and allowing us to really make this the best transition, take our time. And like we said, we launched a search for -- and we'll be very selective to make this a great fit and leverage the strong leadership we already have in place across the regions.
Sterling Auty -- J.P. Morgan -- Analyst
That makes sense. And then, you mentioned the new partner program. Is that rolled out globally? And when was that in effect? So, in other words, is everybody trained and up and running on the same page in all three theaters?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yes, absolutely. So, we had the opportunity to launch it at the -- at our major events in Europe, in Amsterdam, and Chicago for the Americas, but also earlier in several of the APJ regions. And we did it very thoroughly where we gave partners a heads-up about it coming into effect, where essentially it's taking CyberArk to the next step. The demand is there. It's top priority now across geographies. We really want to leverage our partners to be more capable, more enabled as they go to market. So, it's basically more rewarding the more they invest in getting up and running and trained. And launching it within these big events is just a great platform because they have the opportunity to see full road map, everything that -- the upside for them and hear more about the program and get up to speed.
Sterling Auty -- J.P. Morgan -- Analyst
Makes sense. Thank you.
Josh Siegel -- Chief Financial Officer
Thanks, Sterling.
Operator
Your next question comes from Gur Talpaz with Stifel.
Gur Talpaz -- Stifel Nicolaus -- Analyst
Great. Thanks for taking my question and congrats on the quarter. Udi, I wanted to ask if you would classify what you're seeing as a sort of inflection in terms of demand for cloud solutions, and that's whether because of the launch of new solutions like Alero or because of just general increased market awareness? But we talked a lot about it on the call and I was just kind of curious to see if you would sort of classify it in that kind of terminology?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yeah. I think that in every customer -- and the beauty is that, no matter where we are in the region, we find that they are somewhere in their journey. By the way, you still have those that are just tiptoeing and you have those that have moved all in and somewhere in the middle. And we want it -- just like we're diverse from a geography and a vertical perspective, we always want to be diverse on where they are on their cloud journey. And for many of them, it's the ability to deploy CyberArk in the cloud or CyberArk to secure their cloud infrastructure, but also new offerings. If we can deliver them as as a service, we're definitely playing to their modern appetite.
And, for example, Alero, which we're very excited about, was -- we saw increasing demand from customers to expand privileged access to also those third parties that need privileged access and need to get into their infrastructure. And the decision was rightfully, OK, we'll build this and launch this as a service and expand our SaaS portfolio. The CyberArk Privilege Cloud is more intended toward mid-market and we launched it for that, for the customers with an appetite to consume privilege as a service, so that they'll have that. And of course, EPM, which had a record quarter, most of it, like the majority of EPM was consumed in SaaS.
When we look at Core PAS, we still see that enterprises want to own and put the keys to the kingdom mostly on premise. But they have a variety of options and we cater to them.
Operator
And your next question comes from Rob Owens with KeyBanc Capital Markets.
Rob Owens -- KeyBanc Capital Markets -- Analyst
Great. And thanks for taking my question. Udi, at high levels, we're hearing about some disruption in Europe. Maybe you could -- you had, obviously, a successful quarter there, but just give us some color in general relative to what you guys are seeing at this point and any potential economic warning signs.
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Absolutely, Hi, Rob, I think -- I'm fresh to actually a deep dive on the European business where we were very pleased with 28% growth this quarter. We ask about macro. Obviously, they're waking up in the morning and they're reading the news, but they're not seeing it translate directly into the pipe or the opportunity. And so, I would say that, right now, it has not translated. And again, perhaps it's a matter of privilege being really in the high priority and not nice to have, privileged access being foundational. But, of course, we stay very close to it and stay tuned. Diversity is really a big part of our strength. So, it's also diversity within the region.
Rob Owens -- KeyBanc Capital Markets -- Analyst
And follow-up for Josh relative to a couple of balance sheet items. The deferred revenue, I don't think you met Street expectations, but it was in line with where you guys have been historically, Q1 to Q2, if I look back a couple years. So, maybe some of the puts and takes around deferred. And then, number two, your DSOs did spike quite a bit sequentially. Did that speak to the linearity of the quarter? Thanks.
Josh Siegel -- Chief Financial Officer
Yes. Thanks, Rob. On the deferred revenue, I think you kind of nailed it in terms of where we are and the seasonality. This was where we thought we'd end up around on deferred revenues. Let's not forget, it is a 34% year-on-year increase. Nevertheless, still a nice growth rate.
Deferred revenue for CyberArk is predominantly the support and maintenance contracts which have their seasonality and ebbs and flows for when we book them. And they're allied with the licenses. So, with the Q3 and with Q4 being the heaviest license period of the year and then it starts -- and then it dips down in the first half of the year, which is why you see lower on deferred revenue growth. But we're aligned with where the deferred revenue growth is. And I think you pointed it out, it's in line with the seasonality that we've seen in the past.
With regard to DSO, actually, the linearity was fairly close when we look at it from a month-by-month and weekly perspective into the last month of the quarter. It's 41 days. It's a bit -- I think spiking is a bit of a tough word when it only jumps -- when it's only 41 days compared to mid-30s as it was in Q1. But, overall, it's very much in our range of comfort zone for DSO.
Operator
Next question comes from Daniel Bartus with Bank of America.
Daniel Bartus -- Bank of America Merrill Lynch -- Analyst
Hey. Thanks, guys. I wanted to ask first about just recurring revenue in general. So, imagine most of the maintenance lines is recurring and then you have a decent amount of SaaS now in the business. I remember from the Analyst Day in the past, you guys showed that pretty steady repeat selling to existing customers every quarter too. So, you add all those up, I was wondering how much of your revenue would you now classify as recurring or recurring like? And how do you expect this trend going forward?
Josh Siegel -- Chief Financial Officer
Yes. So, still the majority of our deferred revenue and recurring revenue is coming out of maintenance. We do have some SaaS which is building certainly with the growth of the business and term-based licensing which is growing in the course of the business. So, I would put the number roughly 40% in terms of recurring that we have today. And then, on top of that, as you've kind of pointed out, is that we have a pretty consistent stream of recurring revenue. In fact, about just over 60% of our revenue -- when I talk about recurring customers, just over 60% of our existing customers came back also in Q1 and also in Q2 this year and purchased additional licenses. So, it's something that we've seen consistently over the last few years. And while we don't know exactly and always who will be coming back and for how much, we have consistency for recurring -- for customers coming back and purchasing more each quarter. On top of the 40% of contractual recurrence.
Operator
Your next question comes from Jonathan Ho with William Blair.
Jonathan Ho -- William Blair -- Analyst
Hi. Good morning and congratulations on the strong results. I just wanted to start out with version 11 of your product. And do some of the new features like geographic distribution maybe open up some new opportunities with your customers?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yeah. So, this was, I would say, a version 11. Really was a major enhancement for us. A lot of it has to do with customers who really deploy CyberArk at scale. And a big part was what we call the active vault where it really allows them to trust the infrastructure, to always be up and support their critical systems. It's been long in work and launched in version 11.
We also continue to invest the items around simplicity, which we started back in when we first rolled out 10. And we've been rolling that out consistently and showed it in our two Impact events. One of the exciting new introductions in version 11 were our Secretless Broker, which adds on to the strength of our AAM solution, allowing in certain use cases, developers to really be totally seamless in dealing with credentials and where the management is all behind the scenes for them. We view that as another informed enhancement for that adoption. And on top of that, like I said earlier, we made major enhancements to our CyberArk Privilege Cloud.
So, yeah, all of these contribute to our ability to continue to expand globally.
Jonathan Ho -- William Blair -- Analyst
Great. And then, just with regards to Alero, how quickly do you think this could potentially ramp? And does this start to maybe crossover a little bit into the traditional SSO space? Can you maybe help clarify where there's this overlap and where there's sort of uniqueness.
Erica E. Smith -- Investor Relations Contact
It's very much privileged access. It's answering demand for our customers. They say, CyberArk is our solution for employee strong users and their access to our IT infrastructure. But we also have a lot of third parties who need to come in. And it could be that they're administering a router, a database or they could be an IT service provider. And so, it's a big pain. But it's very much in the privileged access world. So, we give them a VPN-less, password-less and agent-less way to get very strong -- strongly controlled privilege access and do what they need to do. And so, I would say, its adjacency to the other IAM parts.
In terms of the opportunity, the opportunity is very large. We see it really as a great new, but also very much an add-on business to our existing customers. But it is a new solution. So, we're going to take our time as we roll it. And it's not baked into a big impact into 2019 itself, but definitely is going to be part of every sales process to new and existing customers.
Operator
Next question comes from Gray Powell with Deutsche Bank.
Gray Powell -- Deutsche Bank -- Analyst
Great. Thanks for taking the questions. Yeah. Maybe we can -- can we talk about the competitive environment? Have you seen any benefit from customers looking to churn off from CA yet? And has that been a material driver to growth in the first half of this year?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yeah. Hey, Gray. I would say no major change since we updated last quarter. I would say primarily seeing the PE [Phonetic] roll-up companies in the competition mix. With regards to CA, yeah, we see them trying to cling on to existing customers, less or zero involvement in new business. And you're right. We have seen displacements in CA. Some of them have been ones that we've been eyeing for a while in important enterprises, but it wasn't meaningful in terms of the overall impact on the number, but important for us strategically, especially since customers really appreciate that we have the experience of also migrating from CA infrastructure. And so, the more we have added, the more we can do more in the future.
Operator
Thank you. The next question comes from Catharine Trebnick with Dougherty.
Catharine Trebnick -- Dougherty & Company -- Analyst
Thank you for taking my question. An awesome quarter. Mine has to do just with the advisory firm. Udi, could you dig into a little bit how that process works and how much are they really feeling? Could you give us maybe a idea of what percentage of revenue comes from the advisory firm? Thank you.
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yes. So, I don't think we've provided it in this quarterly snapshot, but we will in the future continue to talk about influenced deals. They influence revenue. They usually do not resell. I would say that the partnership and their level of competency is the best ever. And it's the numbers. It's the amount of trained professionals that they have and also really creating a business around us. One way to see it was their presence in our Impact events. You really see the big four. You see Accenture really investing and partnering with us. And it's really a win-win, especially with their footprint in Fortune 500 and Global 2000 and their ability to influence there.
You're right. It's one of the things I'm really most excited about in the past one or two years.
Operator
And next question comes from Andrew Nowinski with Piper Jaffray.
Andrew Nowinski -- Piper Jaffray -- Analyst
All right, thanks. Thanks for taking the question. So, I understand your comments on seasonality with regard to deferred revenue, but it does seem like, for the last few years, and particularly in Q2, billings growth has generally outpaced revenue growth. So, it looks like this quarter it slowed pretty materially relative to your revenue growth rate. So, can you provide any more color as to what might be driving that and how we should think about it going forward?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yeah, Andrew, basically, again, in terms of -- this company is predominantly selling perpetual software licenses. So, when we look at billings, it's predominantly the impact of deferred revenues. And then -- and that's really driven by the seasonality of our maintenance renewals. And I think that, overall, when we look at the maintenance renewals, we're still above our 90-plus-percent threshold. And I think it's just a matter of the ebbs and flows of our renewal contracts of how it ties into the billings. But we're happy with our 34% increase on deferred revenues and the license growth revenue year-on-year, which is going to keep driving those maintenance contracts going forward.
Andrew Nowinski -- Piper Jaffray -- Analyst
Okay. That makes sense. And then, I know you implemented some pricing changes last year at this time. And so, I'd assume all the new customers are on their new pricing model, but can you give us any color as to maybe what percentage of your existing customers have moved to the new pricing model? And should we view that transition to the new model as a growth driver? Thanks.
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yes. So, as you said, any new quote going out the door today is on the new pricing model, has been for a year now. And then, basically, our existing customers, when they come back and buy more licenses, as I said before, about 60% of our revenue -- of our license revenue is coming from existing customers. They'll either choose to convert to the new prices or continue buying a la carte in the old price list. And we're roughly about -- 30% of our customer base is on the new price list.
Operator
And your next question comes from Gregg Moskowitz with Mizuho.
Gregg Moskowitz -- Mizuho Securities -- Analyst
Okay. Thank you. Udi, you spoke a little about the enhanced partner program, but can you update us on your mid-market initiative, more specifically just in terms of how that's progressing?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yes, absolutely. Hey, Gregg. I would say it's still early days from us. The biggest growth still comes from enterprise. But two quarters into it, we're really seeing processes definitely improve and it -- really, the fruits of our investment in a different sales motion, our ability to touch the mid-market with less presence in the field. So, I would say it's in the right direction. It's still a smaller part of the business. But we view that as long-term strategic for us.
Gregg Moskowitz -- Mizuho Securities -- Analyst
Hey, that's great. And then, just a quick one for Josh. So, your gross margins again were very good this quarter. I think you had previously guided to 87% to 88% for the year. But you're already at the high end. And historically speaking, your second half margins are typically higher than first half. So, just kind of wondering how you're thinking about gross margins over the rest of the year? Thanks.
Josh Siegel -- Chief Financial Officer
Yes, I think -- we think that we're still sticking with the original range, but, as you said, we're hovering toward the high end of it. Some of it will depend upon the level of services in the fourth quarter in terms of how much if we need to extend out to subcontractors to help us provide that level or not. But I think we feel comfortable with the 87% to 88%.
Operator
The next question comes from Alex Henderson with Needham.
Alex Henderson -- Needham & Company -- Analyst
Great. Thank you very much. I wanted to ask a question on the verticals. You cited six verticals that specifically grew in excess of 40%, which is great news and I'm glad to see it. But the question is, is that a function of the need in those verticals or is that a function of you targeting those verticals? And if so, how do we think about the targeting efforts going forward? Are there other verticals where you haven't targeted that you might be able to add in to provide that extra kit growth?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yeah, absolutely. I think we we want to show color about where -- the beauty is, we sell the same software to every vertical and across the world. And so, except for the federal team, we don't have dedicated teams for a vertical, which really allows us to be diverse and scale. And so, the results of this growth are results of growing demand in a vertical. And, of course, execution against that demand and just that beautiful pie of diversity that we have continues. And the growth levers are definitely just to go after the next 30,000, 40,000 customers that don't have privileged access and do that across geography, across verticals because every vertical needs this.q
Operator
Next question comes from Ken Talanian with Evercore ISI.
Kenneth Talanian -- Evercore ISI -- Analyst
Hi, thanks for taking the question. First off, have you made any changes to your 2019 hiring plans relative to what you were thinking last quarter?
Josh Siegel -- Chief Financial Officer
Hi, Ken. This is Josh. No, I think we're very much on track for this in accordance with the plan that we had set out at the beginning of the year. I think if anything, as we look into H2, we start to think about whether or not we want to do early hirings for next year. But we're very much on the same strategy that we had set out at the beginning of the year.
Operator
Okay. Next question comes from Fatima Boolani with UBS.
Fatima Boolani -- UBS -- Analyst
Good morning. Thank you for taking the questions. I wanted to drill in on some of the sales hiring comments you just made. Last year, we saw a significant improvement in productivity from your sales force, and that certainly translated into upside into your license performance. And relative to last year, I think that's moderated. So, I wanted to better understand what type of productivity trends you're seeing as you've ramped up on sales capacity hiring and you expect to ramp on sales capacity hiring.
And secondarily, if you can give us any color on retention and/or attrition trends within the sales organization, especially as we think about Ron transitioning out of the organization? Thanks.
Udi Mokady -- Founder, Chairman and Chief Executive Officer
So, with regard to productivity, we've had good productivity this year, I think, as you can see from our nice growth year-on-year in each of the first two quarters. We continue to grow headcount across the entire organization. across sales and marketing, I believe, is in the mid-teens. But if we were to look at the quota carriers, actually, we've increased them significantly more than that. So, that's a big -- that's the lion's share of what we've grown there, sales and marketing organization, is coming in quota carriers across both the commercial targets and also enterprise.
And that's really in anticipation of the fact that we see -- we have to -- we seek basically a sales ramp up of the quota carriers of six to nine months. And so, that's why we're always ahead of the game for bringing quota carriers on. And we're seeing good productivity from them this year. And as you said, it's kind of a continuation of what we saw last year.
With regard to the question on Ron, whether or not you expect to see a change in the organization.
No. I think, like I said earlier, we're managing it as a best-in-class transition. And he's with us through all the way into Q1. And so, we're going to minimize any distraction here. And I think we put a good plan in place to do that.
Operator
Next question comes from Dan Ives with Wedbush Securities.
Dan Ives -- Wedbush Securities -- Analyst
Yes, thanks. So, my question is about some of the mid-market teams in both the US and Europe, maybe just talk about some of the progress you're seeing there in terms of the mining that install base? Thanks.
Josh Siegel -- Chief Financial Officer
Yes. It is a new a new process for us to have dedicated teams. One of the prime benefits is allowing the enterprise reps to really focus on the enterprise and I think we're seeing good process and progress. Like you said, it's primarily in the Americas and in Western Europe where we've done that differentiation of dedicated teams. And we'll report more on it. But there's opportunity there to continue to see low touch sales and reach out to the mid market where we were more sporadically reaching out to and do it more methodical. In our book, right now, it's on the right track, but still early.
Operator
Your next question comes from Taz Koujalgi with Guggenheim Partners.
Imtiaz Koujalgi -- Guggenheim Partners -- Analyst
Hey, guys. Thanks for taking my question. If I do my -- if I'm doing my math right, it looks like revenues in Americas were flat sequentially. Usually, they go up by quite a bit from Q1 to Q2. Can you comment on that?
Josh Siegel -- Chief Financial Officer
Yes. Well, first of all, Americas revenue grew up 28% year-on-year. So, we're happy with that type of growth rate. And also happy with the fact that, if you look at all of the regions, we build -- as Udi said earlier, we really build the organization to be diversified and seeing EMEA growing 28% and APJ growing 41%. That really helps us be able to operate the business over the long term. Typically, the sequential growth between the first and second quarter is not as strong, but the region is our most mature. It's consistently delivered strong growth. And, overall, when we also look at kind of deep down under the hood of the Americas sales, one of the things that we kind of alluded to it briefly in the call is that we had a very strong EPM SaaS bookings, and the majority of those bookings were in America. So, actually, kind of if we were to have neutralized out selling a lot more SaaS in that quarter in the Americas relative to what we had seen a year ago, we probably would have seen more sequential growth.
Imtiaz Koujalgi -- Guggenheim Partners -- Analyst
Got it. Thanks. And then, just one follow-up. Last year, you had a strong growth in Q4. I think you had one of the highest sequential growth from Q3 to Q4 last year. And given that majority of your business comes from add-on sales, do you think that reflects in this year's seasonality from Q3 to Q4? Do you get a benefit from the fact that you had such a big Q4 in 2018, those guys come back for renewals this year in Q4? Do we see that seasonality that we saw from Q3 to Q4 in 2018? Also, be a tailwind for your seasonality this year from Q3 to Q4?
Josh Siegel -- Chief Financial Officer
Well, certainly, we do expect sequential growth between Q3 and Q4, which we typically have seen in years past. And we do get certainly -- from a bookings perspective, we get a lot more -- we get growth on the maintenance renewal contracts that -- from licenses that were booked in prior Q4s as well. But, overall, at this point, we feel good about the rest of the year. Hence our guidance for Q3 and for the full year. And I think part of Q4 is also what's going on with regard to the budget flush environment as well, and especially in our space of enterprise software. But we feel like we're in a good position to meet our goals there.
Operator
Next question comes from Shebly Seyrafi with FBN Securities.
Shebly Seyrafi -- FBN Securities -- Analyst
Yes. So, you're maintenance gross margin appears to have declined sequentially and year-to-year. I haven't seen that in a while. You did grow that metric by 5 percentage points in 2018 to 75%, but now it's down to 74.4%. I realize in the past you said that as SaaS grows that line item will decline. Is the ramp up of Alero impacting this? Or do you expect that to continue to decline?
Josh Siegel -- Chief Financial Officer
Actually, I would say the kind of the small step down that you saw in this quarter would be more related to the professional services side. You saw we actually had a nice growth in professional services, which also meant that we used some more subcontractors in that in order to provide those professional services. And that's what could move the needle there by that 0.5% that you noted. So, that's where -- on the support and maintenance piece specifically. It would not be related to Alero. Certainly, not at this point. And that would be related more to -- when we think right now about the cost of goods on the licenses line as opposed to the services line.
Operator
Next question comes from Yi Fu Lee with Oppenheimer.
Yi Fu Lee -- Oppenheimer & Co. -- Analyst
Hi. Congrats on the quarter, gents. Just one quick question on the security breaches that you mentioned on the back of fines. Have you seen that translate into, I guess, better sales tailwind in the pipeline due to the [Indecipherable] fine you've seen at Capital One, etc.?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Hello, Yi. I think it's been very recent. The publications [Phonetic] around the fines in Equifax and British Airways and Marriott and others have been recent. But it did come out when we had a lot of interaction with a lot of customers at our Chicago Impact event. And you can see that it's becoming another factor in their thought process. So, I wouldn't say it supported sales and retro look, and I wouldn't say that it's like a mega tailwind, but it's adding additional teeth to the regulatory element, which has always been another driver for our business.
So, our biggest one is, of course, reducing risk. Digital transformation is a big driver. And compliance was always a driver, but now compliance comes with hefty fines and has teeth to it. And so, it's going to be top of mind of CSOs. And that has been our first impression from customer interaction since those publications.
Yi Fu Lee -- Oppenheimer & Co. -- Analyst
And just one follow-up, Udi. In terms of like the CCPA regulation, have customers been asking about CyberArk's products in relation to that? I know it's still not enacted until next year, but have you seen things through the channel from the angle...?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yeah, yeah. That's a good point. Customers speak about it as a given, as something they have to deal with. Just like we -- just like GDPR has become a given. They are talking about it as something that they will have to live with. Some take an approach that, if they comply with GDPR, they will -- or they aim for GDPR and, therefore, comply with the California regulations. But back to the previous point, that's going to be another tailwind. And we believe privilege is just foundational to ever looking anybody in the eye and saying we're securing our critical assets and private information.
Operator
Your next question comes from Joshua Tilton with Berenberg.
Joshua Tilton -- Berenberg Capital -- Analyst
Hi, guys. Thanks for taking my questions. So, I appreciate the digital transformation driver. Could you possibly just speak directionally maybe on how much of the success in the quarter was due to customers actually using the solutions to secure more of those modern IT infrastructure uses you've been speaking to relative to maybe just continuing to spend on securing credentials associated with more of the traditional assets that's been driving growth in the past?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
It continues to be both, I think one data point is the adoption of our Application Access Manager, which, as I mentioned, was more than half of the top 10 deals, and that's usually a direct connection to digital transformation. But as we talk to our teams, and our deployment teams basically in every single account, in part of what they're trying to do in their Privilege Access Security program, there is a connection to digital information. So, it could be their RPA, the robotic process automation. It could be we need to secure these administrators of our cloud servers. So, it's becoming hard to actually disconnect it. It's in every sale motion. And the customer then prioritizes. Very often, they do want to prioritize with locking down domain controllers and critical infrastructure and user access to that. But in other phases of the program, we tie into their digital transformation. Sometimes it is the landing point of, OK, now is the opportunity, we want to get this infrastructure right because we're doing a lift and shift or moving applications.
Unidentified Participant
That's very helpful. Thanks. And then, just a quick follow-up, of the existing customer revenue in the quarter, would you classify it more as customers moving toward that enterprisewide strategy? Or are we still seeing tactical deployments whenever it's necessary?
Josh Siegel -- Chief Financial Officer
Of the new deals in the quarter or you're asking...?
Joshua Tilton -- Berenberg Capital -- Analyst
Of the existing customer revenue.
Udi Mokady -- Founder, Chairman and Chief Executive Officer
The existing customers, It's been now more years of us pushing what we call the CyberArk hygiene program where we take a programmatic approach. So, you can attach most of the add-on business to -- most to customers going through and ticking off pieces that they want to take or accomplish on the program. You still have, of course, customers that take a more tactical approach. But I think it's really working. And we had a chance to really test that and touch that in the customer events.
Operator
There are no more questions at this time. And I'll turn the call back over to Udi Mokady.
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Thank you. Thank you, everyone. In closing, I would like to thank our customers, partners and employees -- our dear employees for contributing to strong second quarter results. Thank you. Thanks, everyone.
Operator
[Operator Closing Remarks]
Duration: 58 minutes
Call participants:
Erica E. Smith -- Investor Relations Contact
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Josh Siegel -- Chief Financial Officer
Saket Kalia -- Barclays Capital -- Analyst
Analyst
Sterling Auty -- J.P. Morgan -- Analyst
Gur Talpaz -- Stifel Nicolaus -- Analyst
Rob Owens -- KeyBanc Capital Markets -- Analyst
Daniel Bartus -- Bank of America Merrill Lynch -- Analyst
Jonathan Ho -- William Blair -- Analyst
Gray Powell -- Deutsche Bank -- Analyst
Catharine Trebnick -- Dougherty & Company -- Analyst
Andrew Nowinski -- Piper Jaffray -- Analyst
Gregg Moskowitz -- Mizuho Securities -- Analyst
Alex Henderson -- Needham & Company -- Analyst
Kenneth Talanian -- Evercore ISI -- Analyst
Fatima Boolani -- UBS -- Analyst
Dan Ives -- Wedbush Securities -- Analyst
Imtiaz Koujalgi -- Guggenheim Partners -- Analyst
Shebly Seyrafi -- FBN Securities -- Analyst
Yi Fu Lee -- Oppenheimer & Co. -- Analyst
Joshua Tilton -- Berenberg Capital -- Analyst
Unidentified Participant
