Image source: The Motley Fool.
CyberArk Software Ltd (CYBR 0.41%)
Q3 2019 Earnings Call
Nov 6, 2019, 8:30 a.m. ET
Contents:
- Prepared Remarks
- Questions and Answers
- Call Participants
Prepared Remarks:
Operator
Good morning. My name is Scott and I will be your conference operator today. At this time, I would like to welcome everyone to the CyberArk Third Quarter 2019 Earnings Conference Call. [Operator Instructions]
Thank you. Erica Smith, Vice President, Investor Relations, you may begin your conference.
Erica E. Smith -- Vice President of Investors Relations
Thank you, Scott. Good morning. Thank you for joining us today to review CyberArk's third quarter 2019 financial results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; and Josh Siegel, Chief Financial Officer. After initial remarks, we will open the call up for a question-and-answer session. Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management's best judgement based on currently available information specifically, our expectations and beliefs regarding our projected results of operations for the fourth quarter and the full year 2019. Our actual results might differ materially from those projected in these forward-looking statements. Please see the risk factors contained in the company's Annual Report on Form 20-F filed with the US Securities and Exchange Commission and those referenced in today's press release.
CyberArk disclaims any obligation or undertaking to release publicly any updates or revisions to any forward-looking statements made today. Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation to the most directly comparable GAAP financial measures is also available in our earnings press release, which can be found on www.cyberark.com in the Investor Relations section. Also, please note that a webcast of today's call will be available on our website in the Investor Relations section as well.
With that, I'd like to turn the call over to Udi Mokady. Udi?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Thanks, Erica and good morning, everyone. Thank you for joining the call today. I'm excited to discuss our third quarter results with you. We were pleased with our strong performance. Our results exceeded expectations across all guided metrics. Revenue grew by 28%, reaching $108 million and non-GAAP operating income increased by 40% to $29 million or a 27% operating margin. During the quarter, we reached a record for revenue in the Americas, a record for EPM SaaS bookings and generated record business in the global government vertical. We are also pleased to again deliver best-in-class growth and profitability, not only in the security industry, but also across technology companies. Given our execution and the robust demand environment for the third time this year, we are raising our guidance for revenue growth and operating income for the full year, which Josh will talk about later.
Overall, we continue to benefit from strong secular trends. It is estimated that two-thirds of Global 2000 CEOs are not only adopting digital transformation, they're centering their corporate strategies on building software-driven businesses.
At the same time, almost every enterprise customer is running on-premise, cloud or multi-cloud IT environments, migrating workloads to drive more efficiencies and productivity into their business. This increased complexity and the rapid pace of change in business operations and IT is expanding the attack surface, exponentially increasing the risk from cyber attacks and driving the velocity of hacker innovation. In today's IT paradigm, the adoption of zero trust frameworks is accelerating. Organizations are taking a never trust always verify approach to managing and securing human, application and infrastructure identities. Privileged access management is not only the foundation of zero trust, but also of every strong security program which is contributing to the rising demand for our solutions. While mitigating risk for customers is a key driver of our business, we are also a core component of compliance in a growing list of requirements for GDPR, HIPAA, SOX, PCI, SWIFT, CCPA and others.
With that background, I will move into our results for the quarter. We were thrilled to win 200 new logos in the third quarter, bringing our total customer count to over 5,000. We are proud that the world's leading organizations across industries are trusting CyberArk to help protect their most valuable assets. A few new business highlights include; a rapidly growing financial services company had deployed a niche competitive offering that could no longer scale to meet its more demanding requirements. In a rip and replace deal, they are moving to CyberArk because of the breadth of our solution across endpoints, applications and core privileged access, as well as our ability to secure containers and modern application development with Kubernetes at scale, an information services and solutions company engaged with CyberArk to remove local admin rights on all desktops with Endpoint Privilege Manager to meet HIPAA and GDPR requirements. During the sales process, the customer suffered a ransomware attack and the deal quickly shifted to risk reduction with both Endpoint Privilege Manager and core privileged access for tier zero access.
A government agency in Southeast Asia is leveraging CyberArk to secure access to and enable auditing of all video recording devices across its physical locations in an interesting IoT use case. Our leadership position in the pan market as well as our commitment to innovation was key to winning this greenfield deal.
Given the exploitation of privileged access is at the root of almost all major attacks, existing customers are prioritizing CyberArk in their security budgets. We have also accelerated time to value through product simplification as well as partner enablement. We have made it easier for customers to extend Privileged Access Protection to cloud and hybrid environments as well as digital transformation and DevOps initiatives. In fact, more than half of our Fortune 500 customers are using CyberArk to secure cloud assets.
A couple of add-on examples include an energy company is securing privileged access enterprise-wide across its hybrid environment including Azure. The organization had landed with our endpoint solution, but was using a competitive offering for privileged access. Over our long tenured relationship, we demonstrated our strong cloud security capabilities, our long-term vision and our high level of customer satisfaction. And as a result, we won this strategic seven figure rip and replace deal.
Lastly, I would call out a seven figure expansion deal with the US financial services company. The company became a CyberArk customer in 2018 with core privileged access security for a segment of its privileged users. The company is now expanding to protect workloads and detect anomalous behavior in its AWS environment, remove local admin rights in over 5,000 endpoints with Endpoint Privilege Manager as a service, secure its Robotic Process Automation, or RPA project with our Application Access Manager as well as protect privileged business users with PSM for Web.
We also had a record quarter in global government, driven in part by US Federal. The strength of our Federal business was in large part the result of our continued investment in this important vertical. Just last week, we announced that our solution again achieved international common criteria certification by the National Information Association Partnership, or NIAP, which validates that our solution meets the stringent requirements for US National Security system procurement. This certification is used not only by the US, but also globally by 31 member countries which will contribute to our ongoing success in governments around the world. In the third quarter, our US Federal business benefited from spending on our core privileged access security solution under the Department of Homeland Security's CDM program. The CDM program makes it easier for US civilian agencies to strengthen their security by funding approved products like CyberArk's Core PAS. We have been thrilled with our success under this strategic Federal program.
Beyond CDM, civilian agencies are standardizing on CyberArk across our solutions, including key wins during the quarter for Endpoint Privilege Manager and Application Access Manager including our largest AAM deal to a Federal customer. In addition, because of our high levels of customer satisfaction and our extensive product certifications, we also continue to gain traction in US military and intelligence agencies in the third quarter.
Moving on to product diversification, Application Access Manager was included in half of our top 10 largest deals in the third quarter. Every organization today is a software company, using technology to automate human tests, drive business operations and increase efficiencies. These applications have identities that need to be secured, a key driver to our Application Access Manager solution. We are thrilled with another record quarter for Endpoint Privilege Manager SaaS bookings. There is increasing awareness that removing local administrative rights, running at least privilege and preventing credential theft is an important component of stopping attacks where they typically begin at the endpoints.
Geographically, the Americas had a record quarter and we were pleased with the growth in APJ. In EMEA, revenue grew by 13% in third quarter off a very strong Q3 2018, when the EMEA region grew by over 40%. Growth rates in certain countries in EMEA have been inconsistent from quarter-to-quarter in 2019. EMEA's annual seasonality has typically been back-end loaded towards year-end. Consistent with that trend, the fourth quarter is off to a strong start in EMEA. While there have been macro headlines regarding Europe, in recent quarters, we believe, demand for our solutions remains healthy.
Our more than 400 channel partners and advisory firms are extending our go-to-market reach. Today, we have over 4,000 certified trained professionals across delivery engineers, pre-sales engineers and sales people, which is more than double the trained professionals at the beginning of the year.
In the third quarter, the indirect channel represented about 65% of our revenue. Our innovations have empowered customers to secure privileged access across on-premise and public or private cloud and in hybrid environments. Our newer SaaS solutions, CyberArk Privilege Cloud and Alero are gaining momentum. Our early privileged cloud customers are up and running and the pipeline of opportunities continues to build. Alero has been met with overwhelmingly positive customer feedback. Every enterprise needs to mitigate risks from third-party vendor access. We are the only vendor to combine zero trust access, biometric authentication and just-in-time provisioning without the use of VPNs, agents or passwords. We are in a market rich with opportunity, driven by not only the complexity of IT, but also organizations embracing the cloud and executing digital transformation strategies. Our investments in research and development, in sales and marketing have positioned us as the leader in privileged access management and we are committed to investing in the business to drive profitable growth.
With that, let me turn it over to Josh to discuss more details about our results.
Josh Siegel -- Chief Financial Officer
Thanks, Udi. We again exceeded our outlook across all guided metrics. Total revenue grew by 28% year-on-year ahead of our guidance, reaching $108.1 million in the third quarter. We generated $57.9 million in license revenue, increasing 25% over the third quarter last year and representing 54% of total revenue. We also had strong diversification across our products with Application Access Manager representing about 11% of license revenue and Endpoint Privilege Manager representing about 5%. We are particularly pleased to see EPM have another record quarter of SaaS bookings, which lowered the EPM revenue recognized in the current period, but will increase our recurring revenue down the road. Maintenance and professional services revenue was $50.2 million, increasing 30% over the prior year period and representing 46% of revenue similar to last year. The professional services revenue associated with this line was $9.6 million or just under 9% of total revenue. Geographically, the Americas reached a record $69.8 million in revenue growing 34% over Q3 last year and representing 65% of total revenue. EMEA grew total revenue by 13% to $29.8 million or 27% of total revenue. As a reminder, in the third quarter of 2018, EMEA had a particularly strong quarter with revenue growing by 42%, which created a tough compare this year.
Year-to-date, EMEA revenue has grown 19%, and as Udi mentioned, the overall opportunity in EMEA remains strong. APJ recognized $8.5 million in revenue growing 35% and representing 8% of total revenue. As I move through the P&L, all line items will be discussed on a non-GAAP basis. Please use the full GAAP to non-GAAP reconciliations in the tables of our press release. Our third quarter gross profit was $94 million or an 86.9% gross margin. That's compared to an 88.5% gross margin in the same period last year. The decline in gross margin which we anticipated at the beginning of the year is due to increased investment in our cloud infrastructure and in higher utilization of subcontractors, because of the strength of our license revenue in prior periods and the heavy demand for those related services. As part of our ongoing strategy to drive growth, deliver innovation and scale the company, we continue to invest in the business.
R&D grew by 20% to $15.4 million or 14% of revenues. Sales and marketing increased by 18% to $40.1 million or 37% of revenues, as we expanded across all geographies to support direct and indirect sales. This included our highest attended and most successful Americas customer event we held in Chicago that we talked about during the Q2 call. G&A expense increased 27% year-on-year to $9.2 million or 8.5% of revenues as we continue to scale the business infrastructure to support our growth. In total, operating expenses for the third quarter increased 20% to $64.6 million compared with $53.9 million for the third quarter last year. Revenue outperformance and disciplined investments again drove strong leverage in the third quarter. Operating income came in solidly above our guidance at $29.4 million or 27% operating margin which is also an increase from $21 million operating income and an increase from 25% operating margin generated a year ago.
The majority of our expenses are related to head count and we ended the third quarter with 1,326 employees worldwide, up from 1,106 at September 30th, 2018. We had 625 employees in sales and marketing on September 30th this year. That's compared to 524 employees at the end of the third quarter last year. CyberArk generated net income of $25.6 million with earnings per share ahead of guidance at $0.65 per diluted share for the third quarter of 2019, that's increasing 44% from the $17.8 million and improving earnings per diluted share by $0.17 from the $0.48 we reported for the third quarter of 2018. We generated cash flow from operations for the first nine months of $89 million. This represents a 29% cash flow margin for the period. As a result, we ended the quarter with $555 million of cash and investments. This compares to $451 million in cash and investments at year-end. We ended the third quarter with $177 million in total deferred revenue, a 30% growth from $136 million at September 30th, 2018.
Turning to our guidance, as a reminder, our guidance does not consider any potential impact to financial, other income and expenses associated with foreign exchange gains or losses as we do not try to estimate future movements in foreign currency rates. So for the fourth quarter of 2019, we expect total revenue of $125 million to $127 million or 16% growth year-on-year at the midpoint. For the fourth quarter, we expect the mix of business to be approximately 57% from license revenue and 43% from maintenance and services. We expect non-GAAP operating income to range between $38.5 million to $40 million or a non-GAAP margin of 31% at the midpoint. We expect non-GAAP net income per diluted share of between $0.78 to $0.82. Our guidance also assumes 39.2 million weighted average diluted shares and a tax rate of approximately 21% for the fourth quarter.
We are pleased to raise our full year guidance. We expect total revenue to be in the range of $429.2 million to $431.2 million or a growth of approximately 25% at the midpoint. We are also increasing our guidance for non-GAAP operating income to be in the range of $119.75 million to $121.25 million or an operating margin of 28% at the midpoint, which is an expansion from the 26% operating margin for the full year 2018. We are increasing our guidance for non-GAAP net income per diluted share of $2.58 to $2.61. This assumes $39.1 million weighted average diluted shares, our guidance for the full year assumes an effective tax rate of approximately 20% for 2019.
As we look ahead, driving growth through disciplined investments continues to be our top priority. Our execution year-to-date reinforces our conviction that we have a long runway for growth and positions us well for the fourth quarter of 2019 and beyond.
I will now turn the call over to the operator for Q&A. Operator?
Questions and Answers:
Operator
[Operator Instructions] Your first question comes from the line of Saket Kalia with Barclays. Your line is open.
Saket Kalia -- Barclays -- Analyst
Hi guys. Thanks for taking my questions here. How are you?
Josh Siegel -- Chief Financial Officer
Good Saket. How are you?
Saket Kalia -- Barclays -- Analyst
Good, good. Udi, maybe just to start with you. Can you just comment on the competitive environment at all and whether you're seeing any of the competitors that saw ownership changes in the last year or so, whether those competitors are merging at all? The numbers certainly wouldn't seem to indicate that, but I'm curious if you're seeing anything on the ground, just to add a little bit more color.
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Sure. I would say Saket, that there's no major change in the competitive environment that we saw in the third quarter. We still see the competition from the Francisco private equity roll up and so they're out there. They've been kind of self-disrupted with the roll up, but I wouldn't say that they're gaining any resurgence, but deals are competitive and they show up in deals. With regards to CA, we do see that they're working hard to try to maintain their relationship with existing customers and I think they've alluded to that strategy. We have seen displacements where we’ve displaced them and of course, others. As we noted a little bit in the prepared remarks, we have a lot of examples of rip and replace including with the legacy Dell TPAM Solution.
Saket Kalia -- Barclays -- Analyst
That's really helpful. Josh, maybe just my follow-up for you. Can you just talk a little bit about the overall SaaS mix of the business? You mentioned in your prepared remarks couple of times just around strong SaaS bookings for Endpoint Privilege Manager. Udi, I think you talked about strong reception for Alero privilege cloud. I guess, as we look back at Q3 or maybe year-to-date, however you'd like to look at it, what percentage of the business now at this point is coming from SaaS and how do you think about that mix going forward?
Josh Siegel -- Chief Financial Officer
Yeah. Hi, Saket, it's Josh. So when we think about our SaaS business or pure -- the majority -- the overwhelming majority of the business is still really coming from our Endpoint Privilege Manager. Alero, as you know, we just -- we just released it, I think. Udi's enthusiasm about it was around customer reaction to the release and to the product itself and the general availability is happening only in Q4. And I think that we're optimistic there. So when we think about the SaaS business, it's around the Endpoint Privilege Manager, it's around our initial tractions for privilege cloud. And we saw in Q3, about 7% of license revenue going to our combination of SaaS and term based licenses about which half of that was pure SaaS business. And that's just under 5% of total revenues. I think as we kind of look going forward, we are seeing, it's still small numbers. But if we look at the growth rates of our contracts for SaaS, they're growing at a higher rate than the growth of the business.
Udi Mokady -- Founder, Chairman and Chief Executive Officer
And I'll just reiterate; the three sources for our SaaS revenue. EPM SaaS as the majority, privileged cloud that we're very excited about again with early customers and Alero, minor correction was, it was GA at the end of Q3 but it's still an early product, but we're seeing a lot of excitement and it's a no-brainer issue of remote vendor access.
Operator
Your next question comes from the line of Melissa Franchi with Morgan Stanley. Your line is open.
Melissa Franchi -- Morgan Stanley -- Analyst
Great. Thanks for taking my question and congrats on the quarter. Udi, I wanted to follow-up on your comments on the spending environment, particularly in EMEA. You said it was uneven year-to-date. I'm just wondering if it has gotten more uneven in Q3 and you didn't know the pipeline looks good for Q4, but how should we expect that business to track as we close out the year?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Sure. Hi, Melissa. I would say that nine months into it, we were able to track consistency a little bit better and to see that in Southern Europe and in France, we've seen less. So I wouldn't say that Q3 was dramatically different, but we see more visibility. And to the point where in this business, you can't overlook the macro uncertainty, but then we measure our own numbers and we see healthy pipeline. And as I mentioned, off to a strong Q4 start. We did have a tough compare there as I mentioned where Q3 2018 was 40% growth.
Melissa Franchi -- Morgan Stanley -- Analyst
All right, helpful. And then I just wanted to follow-up on the sales organization. So with Ron stepping down this quarter, realize that he is staying on Board. But I'm just wondering if you can update us on the quest to find a new Chief Revenue Officer. And then, just given the transition, I'm just wondering how you saw sales productivity this quarter? And if you've seen any change in sales attrition? Thanks.
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yeah. No, absolutely. I think in the last call in August, we talked about, let's make this a best-in-class transition and I think that's what we've been seeing on all fronts. Just the sales leadership in the company across the theaters, across the various pieces of the sales organization just completely stepped up. And I would say zero to no issues with the transition on the opposite people really stepping up. In this quarter, I'm taking a more active role and I started that also towards the end of Q3. In brackets, I'll say that I'm enjoying that but don't worry, it's going to be short-term. I think it's good for the business. It gives me a closer handle to the sales, and in parallel, we're very advanced in our Chief Revenue Officer search with some, I would say, advanced candidates where we were looking for the combination of ability to further scale CyberArk towards our long-term plan, but also a strong culture fit. And I'm very optimistic that we'll be able to find the right candidate, I would say, in the next couple of months.
Operator
Your next question comes from the line of Shaul Eyal with Oppenheimer. Your line is open.
Shaul Eyal -- Oppenheimer -- Analyst
Thank you. Good afternoon, guys. Congrats on the strong set of results and an elevated outlook. Udi or Josh, if we look at the 200 new logos you nailed down this quarter, how many of them are displacements, how many of those are greenfield? And probably it's a little tricky, but maybe any color that you could provide us will be extremely helpful.
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yeah, sure. I think we would still -- we give a lot of rip and replace examples in the script because of just some exciting examples, but the majority were greenfield. And then there could be some light brown in the sense where customer had a tactical solution more driven historically by compliance and when they took a security approach, CyberArk won the full strategic approach. So the quick answer is primarily greenfield, a growing amount of rip and replace, but some of them are really of solutions that were brought into parts of the organization.
Shaul Eyal -- Oppenheimer -- Analyst
Got it. This is helpful. And as we think about the 65% coming from the indirect channels partners, any number of VARs that stood out this quarter or pretty much very consistent across the Board?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yeah. I would say that we saw the, of course, the Federal business was extraordinary in Q3. And so we saw our partners, they're really delivering. And then across the US and internationally, strong performance with the channel and the advisory firms. I think they don't always -- they don't certainly count in that 65%, because they don't resell, but they influence a lot of the deals, especially in the Global 2000.
Operator
Your next question comes from the line of Sterling Auty with J.P. Morgan. Your line is open.
Sterling Auty -- JP Morgan -- Analyst
Yeah, thanks. Hi, guys. Josh, I wonder if you would take a minute and talk a little bit about deferred revenue and billings. And what I mean by that is traditionally deferred revenue has been lumpy based on different factors. Wonder if you could highlight those and in particular with the strength in EPM and SaaS, I would think that that would actually, given the revenue recognition, actually bolster the deferred revenue and how should we think about that as we look to the fourth quarter?
Josh Siegel -- Chief Financial Officer
Yeah. Okay. Thanks, Sterling. First, we had deferred revenues grow by 30% year-on-year. And I think one of the things that has impacted -- maybe have slowing a bit the deferred revenue growth this year, was that we're seeing more and we've had a case in the last couple of quarters to more multi-year deals, contracts, larger contracts that also include extended payment terms over the life of the contract meaning annual payments. And then that would certainly -- that's certainly while the business is there, it will impact the overall deferred level. But overall, I think that we feel good about the business. One is that our maintenance renewal contracts are still tracking at 90% above renewal rates. There's no dramatic changes in how that business is operating. And overall, I think as we kind of go -- going looking forward or going into Q4, Q4 is a big year, big quarter for our maintenance renewals. So that's when we start to see that come in, but if I will remind you and the people on the call is that we recognize it in deferred once it's collected. And then we recognize the PCS on that deferred after collection. So some of it will depend upon the linearity within the quarter of when those renewals occur because we have to collect the cash before the year-end to be able to identify that.
With regard to the SaaS business, you're right, we're happy about and we just talked about in the prior question, our growth in the SaaS component particularly in the Endpoint Privilege Manager growing, it's more than -- in the last couple of quarters, it's been more than 60% of our bookings going to SaaS contracts. But we're still talking small numbers. So with regard to the very large deferred numbers that we have coming from the maintenance contracts, it's not -- there is still limited impact there.
Sterling Auty -- JP Morgan -- Analyst
All right. Makes sense. And then one follow-up question. There was a news report out there talking about you guys exploring a bond deal. Just wondering, to the extent you could comment of rounds your current cash position, your capital structure, any capital needs and what additional capital might be used for in that type of situation?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yes. Hi, Sterling, Udi here. So obviously, we don't comment on the market rumors, but I would say the part of our planning involves regularly evaluating our capital structure and capital allocation and how they align with our long-term strategy and goals really thinking long-term in every planning session we do.
Operator
Your next question comes from the line of Gregg Moskowitz with Mizuho. Your line is open.
Gregg Moskowitz -- Mizuho -- Analyst
Okay. Thank you very much and very, very good quarter, guys. Congrats. Congrats on that. So I guess first question for Udi. You mentioned that you have over 4,000 certified professionals, and that that's more than double where you were at the start of the year. Can you elaborate on how you've been able to scale out the ecosystem so rapidly?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yeah, absolutely. It's been strategic for us with the growing demand to make sure that our ecosystem can support our customers out there internationally. So we've been investing in training and certification. And also the channel program has been updated to reward and incentivize enablement or enabled channels, especially on the technical front. And it really drove attendance and demand for our certification courses in the customer event that Josh mentioned, and then the prior one in -- that we did in Europe. We were just overly subscribed on the training sessions, but we also take it to the field regularly. And so it's strategic for us and the demand is out there for these certifications. And I've seen a lot of people boast when they get the CyberArk certified result.
Gregg Moskowitz -- Mizuho -- Analyst
Okay. That's terrific. Thanks Udi. And then just one for Josh here. DSOs did go up fairly meaningfully quarter-over-quarter. Can you talk about the linearity that you saw in Q3?
Josh Siegel -- Chief Financial Officer
Yeah. Actually around linearity, we saw in Q3 and really kind of even in the first -- in Q1 and Q2, it revert to kind of where we expect it to be. Last year in 2018, we had -- and we talked about it on the call during the year that we had really favorable, to historical terms, linearity within the quarters. And that kind of help boost our cash flow last year as well. And this year, we're seeing it kind of revert back to our more historical norms.
Operator
Your next question comes from the line of Fatima Boolani with UBS. Your line is open.
Fatima Boolani -- UBS -- Analyst
Good afternoon and thank you for taking the questions. I have one for Udi and one for Josh. Udi, I'll start with you on the AAM proportion of license revenue this quarter is some of the highest we've seen in the recent past. So I'm wondering if you can bifurcate that strength between sort of overall improved market awareness versus anything you're doing with the sales force internally to incentivize greater adoption? And then my follow-up is for Josh.
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Sure, Fatima. And it's a great question, because I think it is the combination. The combination of deeper into the integration of Conjur and a better integrated and robust product that we have out there. The driver of really playing to digital transformation. And that strong driver where CyberArk can enable customers to move workloads to the cloud and into modern infrastructure, but then also like -- as you asked, changes in the sales organization that we did in the beginning of the year where we really embedded some overlay efforts to help the field with the emerging technology. So the -- it really supported the AAM business and it's showing up really in our largest of the deals and hence 11% of the revenue. It's really exciting part of our business.
Fatima Boolani -- UBS -- Analyst
That's helpful and Josh, for you. I know you price in local currency in the geographies outside of the US. Could you just remind us any movements in FX and the impact to both revenue and operating expenses both in the quarter? And what your expectations are baking in in your full-year guidance? And that's it from me. Thank you.
Josh Siegel -- Chief Financial Officer
Yes. We do, as you said, in Europe we sell in Sterling and we sell in euro. And if we kind of take a view of the FX impact on income, we had a headwind of about $300,000 and on expenses we got positive of around $900,000.
Operator
Your next question comes from the line of...
Josh Siegel -- Chief Financial Officer
Let me just correct that. It was $600,000 on expenses.
Operator
Okay. Your next question comes from the line of Gray Powell with Deutsche Bank. Your line is open.
Gray Powell -- Deutsche Bank -- Analyst
Great. Thanks for taking the question. So, I appreciate you're giving the insights on license revenue for Q4. You guys do have some pretty tough comparisons on the license front for both Q4 '19 and Q1 of '20. So how would you suggest we think about growth there on a normalized basis? And then I mean would it be fair you just look at the last two years and take an average or just any insights you can give us on that metric going forward?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
I'm sorry. Were you asking about 2020?
Gray Powell -- Deutsche Bank -- Analyst
Well not just like -- so you gave guidance on Q4 license revenue. And I'm just trying to think through, you guys have tough comps. So just how we should think about normalized growth on that metric looking forward?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yes, we're not..
Gray Powell -- Deutsche Bank -- Analyst
If you want to give 2020 that'd be great.
Udi Mokady -- Founder, Chairman and Chief Executive Officer
No. We're not looking at '20. We're not going to discuss 2020 today. But I think historically we've been pretty consistent on our mix between revenue and from licenses and from services and from maintenance. And at this point, there is no new news I would give regarding how we would look at 2020.
Gray Powell -- Deutsche Bank -- Analyst
Okay, fair enough. I'll just try another one if I can. Just how do you feel about visibility on your pipeline and growth prospect today relative to this time last year?
Josh Siegel -- Chief Financial Officer
Well, I mean about our pipeline, it's much bigger this year than it was last year at this time. And I think as Udi also remarked in his remarks that we're seeing a growth for -- across all of our different products, across all of the different geographies. So I don't think we -- I think we feel we're in a similar position to how we’re seeing the market today than how we saw it a year ago.
Operator
Your next question comes from the line of Ken Talanian with Evercore ISI. Your line is open.
Ken Talanian -- Evercore ISI -- Analyst
Hey, thanks for taking the question. I was wondering if you could give us some color on how customer expansions performed in the quarter? And how you're thinking about the contribution from expansions in 4Q?
Josh Siegel -- Chief Financial Officer
Yeah, absolutely. So, add-on business was more than 60% of total revenue and on a base of 5,000 customers now it's become super strategic to continue to grow that customer base from beyond the -- into forecast of course, we're strategic, but also with the emerging technologies. So there is a lot of add-on opportunity within the customer base and we invest in that regularly while going after the greenfield opportunity. So we have both engines turned on.
Operator
Your next question comes from the line of Gur Talpaz with Stifel. Your line is open.
Gur Talpaz -- Stifel -- Analyst
Okay. Great. Thanks for taking my questions and congrats on a good quarter. Udi, you talked a bit about Alero on the call and you gave us some insight into initial feedback. But I was more curious to see if you're encountering a different competitive set here with the solution, with the approach as you ultimately look to broaden the value prop of the company.
Udi Mokady -- Founder, Chairman and Chief Executive Officer
So right now, we're really focused on the remote vendor access and high growth. Very focused on the remote vendor access as a privileged expansion opportunity and as a privileged use case. It's kind of a no-brainer. If you want to limit and put controls over how IT employees and developers of your company are accessing the IT infrastructure, you definitely want to put those controls on third parties that are coming in and getting privilege access and the solutions today are punching holes with VPNs. And so it's an expansion of the privilege use case and I would say that in the short-term, we're keeping it under the privilege umbrella.
Operator
Your next question comes from the line of Daniel Bartus with Bank of America. Your line is open.
Daniel Bartus -- Bank of America -- Analyst
Hey, guys, thanks for taking the question. So, maybe first rather to you Josh, wanted to also ask about AAM a little bit differently. Across some of your more mature customers, how does the split of their spending look between the application in the Core PAS side of things? And then ask differently, just kind of how are you guys thinking about the PAM in your customer base between the application and Core PAS there?
Josh Siegel -- Chief Financial Officer
So I would say that majority of the customers of course start with Core PAS and start with securing human access. And so it's still the smaller part of our customer base that has addressed the AAM use case. And those that have done usually start with some low-hanging fruit, like securing off-the-shelf third-party solutions through our extensive C3 Alliance program and partnerships. And then more and more, where in the past, they used – they would gravitate toward securing embedded credentials in code and legacy applications, more and more moving to securing dynamic applications per our Conjur acquisition. So it's still very much open ground in the majority of our customers. And I think in the past, we've equated it where the deal size in a customer that went all in AAM can be equal to the potential opportunity on securing the humans, if not greater. So it's part of the TAM we put out there when we discussed our overall TAM, so we factored it in, but it's really two different things securing humans and securing applications. Yes, we can double, I would say, the value in a customer through this kind of expansion.
Operator
Your next question comes from the line of Nick Yako with Cowen and Company. Your line is open.
Nick Yako -- Cowen and Company -- Analyst
Hey guys, thanks for taking my questions. Can you just provide an update on the mid-market build out? Any key investments you still need to make. And then maybe how that segment contributed to overall results in the quarter?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Well, absolutely. So, like we said before, the more strategic part of our business is definitely the enterprise. But we've built out a team that's looking further into mid-market and proving the case that we can serve a low touch higher volume type of type of sales. So we definitely see that as a component of the business, but it's still a small part of the revenue. And so I would say we're growing that muscle. It's an important long-term muscle for us, but the majority of the revenue comes from the enterprise opportunity and that's where the majority of focus on investment is for us.
Operator
Your next question comes from the line of Howard Smith with First Analysis. Your line is open.
Howard Smith -- First Analysis -- Analyst
Yes, thank you for taking my question. In the past few years, we've talked about the driver moving from compliance to security focus. So I was interested in your prepared remarks you mentioned the growing list of standards requiring PAS. And I'm curious is that opening up new verticals to you or how is that affecting the business trends you're seeing?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yeah. I think -- hi, Howard. I think it's the – and one of the reasons we mentioned it again is it's popping up as a supporting driver in many of the deals. So the main driver is still our risk reduction. But in these enterprises, they have these GDPR mandates or they have mandates to prepare for the new California regulation and it's coming up as a -- all right, this helps us also support this mandate and sometimes it's in the budget allocation and in others. And so, I think we're really multi-vertical already and very diversified, but we'll keep a close watch at this further expense especially internationally and we'll come back with more data.
Howard Smith -- First Analysis -- Analyst
Perfect. And just as a quick follow-up, you called out the government in particular, particularly strong this quarter. Any other vertical strength you might highlight?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yeah. Energy was a strong example. Pharmaceutical is another one in the quarter. But I think the beauty is we also when we look at a year-to-date perspective, we actually see strong consistency of strong performance across all verticals.
Operator
Your next question comes from the line of Taz Koujalgi with Guggenheim. Your line is open.
Imtiaz Koujalgi -- Guggenheim -- Analyst
Hey guys, thanks for taking my question. Can you comment on the duration for this quarter? Looks like the long-term deferred mix went down a bit this quarter versus the last few quarters, where it was going -- the mix was going up. And how should we think about that for Q4?
Josh Siegel -- Chief Financial Officer
Yeah. Hi, Taz, this is Josh. The duration is not really moving around all that much quarter-to-quarter. It's really what you're looking at on the deferred -- I kind of spoke about earlier as well. One of the things that we saw in Q2 and Q3 is that some larger multi-year contracts that had payment terms across each year as opposed to upfront for those multiple year contract. So you’re not necessarily going to see then the deferred for those long-term pop up from those contracts. And that reflects several million of the maybe the increase that you're looking for in the deferred.
Operator
Your next question comes from the line of Erik Suppiger with JMP. Your line is open.
Erik Suppiger -- JMP -- Analyst
Yeah. Thanks for taking the question. Two questions. One, can you break out what the Federal contribution is or can you at least provide some context around the contribution while you're getting there?
Josh Siegel -- Chief Financial Officer
Yeah, hi. This is Josh. Typically, we see global government be just around 10% -- just 10% to 11% of the business of which Federal will be anywhere from just under half of it. This time we saw global government be in the mid-teens with Federal driving that extra growth.
Operator
Your next question comes from the line of -- line of Dan Ives with Wedbush Securities. Your line is open.
Dan Ives -- Wedbush Securities -- Analyst
Yeah. Just on the last question, in terms of Federal. I mean obviously, there is a lot of cloud deals going on, especially on the Federal side, that seem like they could create opportunities for you guys in terms of the product positioning. So maybe can you talk about -- I mean is that something where we look out a year, some of the opportunities there much more significant than maybe we've seen over the last year just given what's happened in Federal on the move to cloud? Thanks.
Udi Mokady -- Founder, Chairman and Chief Executive Officer
No, absolutely. I can't say that we can connect ourselves to the recent headlines on some major Federal cloud decisions, but if we look in our world, a, where part of the deals have been securing application workloads and the ability to transition to modern workloads with our AAM, and while the bigger driver are really securing infrastructure, it's very clear that we're extending and we will extend to the government's cloud infrastructure. But right now it's securing the infrastructure they have. Some of it includes some early cloud adoption and a lot of it is the bread and butter infrastructure.
Operator
Your next question comes from the line of Shebly Seyrafi with FBN. Your line is open.
Shebly Seyrafi -- FBN -- Analyst
Yes. Thank you very much. So you just had a rather steep decline in your services gross margin to like 70.7% from the mid-70s before. I think you mentioned due to cloud and subcontractors. Going forward do you see that services gross margin continuing to decline to like 65% or do you think it stabilizes around 70% or so?
Josh Siegel -- Chief Financial Officer
Hi. This is Josh. Yeah, you're absolutely right. We saw a decline mostly on the services side. It was related to the using subcontractors to fulfill the demand for providing the service, the increased demand that we're getting. And overall, the function of using subcontractors is the lumpiness and the demand for how many days we need to deliver. Overall, it could, I don't anticipate that driving or moving the number that much more. On the cloud side, the more we sell SaaS, software and business and clearly, the cloud is going to become a bigger and bigger component of that. But still I think that it's going to be gradual and we'll be able to give clarity on that when we talk about 2020.
Operator
Your next question comes from the line of Josh Tilton with Berenberg. Your line is open.
Josh Tilton -- Berenberg -- Analyst
Hi. Thanks for taking my questions. Just a follow-up on the mid-market. We've been seeing some of the identity governance players bundling in privileged access functionality with the IGA functionality. Just curious, how should we think about the competitive landscape as you move into the mid-market?
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Yeah. You're probably alluding to the recent SailPoint acquisition. We actually have been looking at that closely and talking to them and it's primarily a cloud governance move with some of the tuck-ins they've done and we continue to collaborate in the field strongly. And so I would say that when we look at the mid-market opportunity, it's still the PAM vendors that are going after it. For us, it's an expansion and there are some vendors that started from mid-market and we meet there.
Operator
There are no further questions at this time. I will turn the call back over to Udi Mokady, Chairman and Chief Executive Officer for closing remarks.
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Thank you, Scott. In closing, we'd like to thank our customers, partners and employees around the world for contributing to our strong third quarter results. Thank you very much.
Josh Siegel -- Chief Financial Officer
Thank you.
Operator
[Operator Closing Remarks]
Duration: 53 minutes
Call participants:
Erica E. Smith -- Vice President of Investors Relations
Udi Mokady -- Founder, Chairman and Chief Executive Officer
Josh Siegel -- Chief Financial Officer
Saket Kalia -- Barclays -- Analyst
Melissa Franchi -- Morgan Stanley -- Analyst
Shaul Eyal -- Oppenheimer -- Analyst
Sterling Auty -- JP Morgan -- Analyst
Gregg Moskowitz -- Mizuho -- Analyst
Fatima Boolani -- UBS -- Analyst
Gray Powell -- Deutsche Bank -- Analyst
Ken Talanian -- Evercore ISI -- Analyst
Gur Talpaz -- Stifel -- Analyst
Daniel Bartus -- Bank of America -- Analyst
Nick Yako -- Cowen and Company -- Analyst
Howard Smith -- First Analysis -- Analyst
Imtiaz Koujalgi -- Guggenheim -- Analyst
Erik Suppiger -- JMP -- Analyst
Dan Ives -- Wedbush Securities -- Analyst
Shebly Seyrafi -- FBN -- Analyst
Josh Tilton -- Berenberg -- Analyst
