CyberArk (CYBR +0.00%) posted better-than-expected third-quarter earnings last week. With its privileged access management (PAM) portfolio, the company delivered a rare result among its fast-growing cybersecurity peers: It generated growing profits under generally accepted accounting principles (GAAP). Yet despite its outstanding performance, the company remains a speculative investment.
Beating its own revenue guidance
CyberArk's privileged identity management market is poised to grow annually by 32% over the next several years, according to a study. With this tailwind, the company's revenue reached $108.1 million, up 28% year over year and above the top end of management's guidance range of $102 million to $104 million.
This strong performance in both of CyberArk's segments (licensing, and maintenance and professional services) was a result of the strong demand for its core privileged-access security product. In addition, the company's new solutions such as its endpoint privilege manager (which deals with privileged access on workstations) and application access manager (which handles non-human access) were early successes.
Image source: Getty Images.
Increasing profits
Since many cybersecurity companies, such as Palo Alto Networks and Zscaler, have been reporting similar or higher double-digit revenue growth over the last several quarters, CyberArk's revenue growth won't impress investors. But in contrast with these fast-growing companies' GAAP losses, CyberArk posted GAAP profits despite its modest scale (it forecast full-year revenue in the range of $429.2 million to $431.2 million).
Thanks to the nature of its business, its gross margin remains elevated and contributes to its positive bottom line. For instance, its license segment consists of distributing software, which involves minimal costs that don't increase with volume. That important segment -- accounting for 53.5% of the company's sales during the last quarter -- generated a sky-high gross margin of 96.1%. And taking into account its maintenance and professional services segment, the company's third-quarter gross margin of 84.3% remained impressive.
And since CyberArk reduced its research & development and sales & marketing expenses as a percentage of revenue compared with last year, its third-quarter GAAP operating income increased by 44.3% to reach $12.7 million.
A speculative investment
Given the strong third-quarter results, management raised its full-year guidance for the third time this year. Taking into account the midpoint of the forecasts, the full-year non-GAAP (adjusted) operating margin should increase to 28%. That means the company is already reaching its long-term goal of a non-GAAP operating margin in the range of 27% to 30% announced during its investor day in March 2018.
Yet despite these impressive results, investing in CyberArk still represents a speculative decision in light of the stock's pricey valuation. The market values the company at a forward P/E ratio of 41.5, which seems high even when taking into account CyberArk's expected strong growth.
There's another speculative aspect to the investment proposition: According to Gartner, CyberArk's three main competitors are BeyondTrust, Computer Associates, and Centrify. And these three were acquired one year ago by Bomgar, Broadcom, and Thoma Bravo, respectively. So CyberArk is one of the few relevant independent companies in the PAM market. And since its offering complements cybersecurity solutions based on firewalls, gateways, and endpoint security products, the company stands as a potential acquisition for many cybersecurity vendors looking to enhance their portfolio and develop cross-selling opportunities.
Yet even if CyberArk's potential acquisition represents an attractive catalyst, prudent investors shouldn't make their investment decisions based on such a hypothetical event. Besides, despite the company's strong recent results, investors should keep in mind the investment proposition remains speculative given the company's lofty valuation.
