Shares of CyberArk (CYBR +0.00%) plunged 16% on July 14, after the cybersecurity firm reported preliminary second-quarter figures that missed its own guidance. CyberArk expects its revenue to rise just 13%-14% annually for the quarter, compared to its previous forecast for 21%-23% growth.
It expects flat to 5% growth in non-GAAP operating income, which also misses its forecast for 28%-38% growth. CyberArk mainly attributes those declines to a slowdown in the EMEA (Europe, Middle East, and Africa) region, where certain deals couldn't be closed on time.
Image source: Getty Images.
This represents CyberArk's slowest sales growth since its public debut in 2014, and marks its first-ever earnings miss. I recently highlighted CyberArk as a cybersecurity stock I'd consider buying, but the severity of its earnings miss raises red flags. Let's take a closer look at CyberArk's troubles, and see if its stock will sink or swim over the next few months.
Why CyberArk could sink...
CyberArk dominates the niche market of privileged account management (PAM) solutions, which protect companies from internal threats like disgruntled employees or corporate spies. However, CyberArk's top-line slowdown indicates that its addressable market might be getting saturated, since it already serves over half of the Fortune 100.
It also indicates that bundled PAM solutions, like Cisco's (CSCO +0.76%) Identity Services engine, are reducing demand for CyberArk's stand-alone solutions. Cisco is serious about expanding its cybersecurity business, and CyberArk may struggle to match its scale and pricing power.
Image source: Getty Images.
Microsoft, which is investing $1 billion in its cybersecurity business annually, also offers numerous PAM tools across its ecosystem of cloud services and operating systems. But that's not all -- Oracle's Identity Manager, CA's Identity Manager, and IBM's Tivoli Access Engine also pose similar "bundled" threats.
To widen its moat, CyberArk acquired PAM company Viewfinity in 2015, and DevOps security company Conjur earlier this year. But those purchases also throttled its cash flow and boosted its operating expenses (up 28% annually last quarter) -- which weighed down its earnings growth.
That's all bad news when we consider that CyberArk trades at 59 times earnings and eight times sales -- which is well above the industry average P/E of 30 and P/S of 6 for infrastructure software providers. If CyberArk's slowdown continues, its stock could easily be cut in half.
Why CyberArk could swim...
On the bright side, CyberArk remains one of the few cybersecurity players that are profitable by both non-GAAP and GAAP measures. That's mainly because the Israeli company spent just 9% of its revenue on stock-based compensation (SBC) expenses last quarter.
Many of its Silicon Valley peers -- like FireEye (FEYE +0.00%) and Palo Alto Networks (PANW 0.63%) -- can't generate GAAP profits due to high SBC expenses, which consume double-digit percentages of their revenues. To the bulls, that discipline makes CyberArk a responsible player in a market filled with spendthrifts.
However, CyberArk can still follow FireEye and Palo Alto's lead by developing a bigger "platform" of additional security services to lock in and generate more revenues per customer. That move could widen its moat against bigger tech companies. CyberArk also noted that its growth in the Americas and Asia remained robust, which could offset its declines in the EMEA region.
With a market cap of $1.5 billion and no debt, CyberArk is still a lucrative takeover target for any company that aspires to lead the PAM market. Check Point Software (CHKP 1.39%), which is also based in Israel and profitable on a GAAP basis, was reportedly interested in buying CyberArk last January, when the stock was still in the high $40s. Those talks eventually fizzled out, but CyberArk's recent problems could make a buyout look more appealing.
My verdict: Wait for a lower price
CyberArk remains the best-in-breed player in the PAM market, but growing competition and lofty valuations make it a risky play for a frothy market. As a result, this stock could fall much further before it can be considered a worthy buy.
I recommended CyberArk in the past, but its stunning earnings miss puts it in the penalty box for now. The company will report its full second-quarter earnings on Aug. 8.
