The cybersecurity industry has received a shot in the arm in the wake of the COVID-19 pandemic as organizations have been forced to adopt a work-from-home model in a bid to contain the spread of the disease.
According to a recent survey carried out by HFS Research, nearly 70% of the organizations surveyed expect to increase their cybersecurity spending thanks to the novel coronavirus. This should have been an ideal situation for CyberArk Software (CYBR +0.00%) to corner more business. But management's cautious approach has left investors wondering if the company could take advantage of the tailwinds.
Image Source: Getty Images
Uncertainty strikes CyberArk's business
CyberArk stock tanked last month after management withdrew its guidance for 2020. Though the company's fiscal first-quarter results topped Wall Street's revenue and earnings estimates, CFO Josh Siegel is concerned about near-term business visibility in the wake of the pandemic. He said:
Given the weakened economic environment due to Covid-19, we expect customers to make more cautious purchasing decisions which will impact our revenue and cash flow from operations in the near term. We believe deal close rates, particularly for new business and in certain verticals, will be less predictable and have therefore decided to withdraw our full year 2020 guidance.
That doesn't paint a good picture for a stock that's trading at a rich valuation. CyberArk has a trailing price-to-earnings (P/E) ratio of nearly 80, and the stock is trading at more than 9 times sales. Its forward P/E ratio of 56 isn't cheap either.
The worrying part is that CyberArk's growth has tapered off significantly in recent years. It clocked 26% top-line growth in 2019, but the first quarter of 2020 turned out to be relatively disappointing, with an increase of just 11%. And now that management has withdrawn full-year guidance, CyberArk's expensive valuation is hard to justify.
One of the reasons why CyberArk is taking a cautious approach is because it has a different business model compared to other mainstream cybersecurity companies. CyberArk plies its trade in the privileged access management (PAM) space, meaning it helps organizations deal with internal threats as opposed to external ones.
So while organizations are busy protecting their remote workforces from external threats and buying VPN (virtual private network) solutions so that work-from-home employees can securely log into company networks, they are probably giving spending on PAM solutions a miss. This is evident from Siegel's comments on the latest earnings conference call: "As the selling environment changed, we did see some deals canceled or pushed and certain deals were downsized late in the first quarter."
As such, going long on CyberArk may not be a good idea right now given its slowing growth and rich valuation. But at the same time, investors shouldn't discount the company's long-term prospects, as it operates in a lucrative market that's expected to become big in the long run.
Don't ignore the positives
There are quite a few things to like about CyberArk despite the near-term weakness that it might experience. The company has around 5,500 customers, and over 50% of them are Fortune 500 companies. What's more, the company's maintenance renewal rate stands at more than 90%. Not surprisingly, its revenue from the maintenance and professional services segment increased 23.5% year-over-year in the first quarter to $55.2 million, accounting for almost 52% of the total revenue.
This indicates that CyberArk's existing customers continue to spend more on the company's services. The increase in the company's add-on business also points in the same direction. CyberArk's revenue from add-on services jumped to 79% of license revenue in the previous quarter, compared to 63% in the prior-year period. All in all, CyberArk's add-on revenue from its existing customer base was up 25% annually in the first quarter.
CyberArk is clearly able to eke out more money from its current clients in these uncertain times. This is a positive sign from a long-term perspective, as demand for privileged access management is expected to grow at impressive rates. According to a third-party report, the market was valued at nearly $2 billion in 2018, but it is expected to produce annual growth of 30% in the coming years.
So CyberArk's business should be able to pick up the pace once again in the future as PAM spending returns. More importantly, the company is well-prepared to tackle any near-term weakness thanks to a solid cash position of over $1 billion and a relatively lower senior convertible note burden of $490 million.
In the end, CyberArk may be down right now, but it is not out of the cybersecurity game, and could turn out to be a top technology pick in the long run.
