Cybercrime, state-backed attacks, and corporate espionage have all become increasingly sophisticated in recent years. 37 billion records were exposed in data breaches last year, representing a whopping 141% increase from 2019, and that figure could keep climbing for the foreseeable future.
That's why Grand View Research expects the global cybersecurity market to grow at a compound annual growth rate (CAGR) of 10% between 2020 and 2027. Those bullish expectations have caused many leading cybersecurity stocks -- such as CrowdStrike (CRWD 7.46%), Palo Alto Networks (PANW 3.91%), and Cloudflare (NET 8.88%) -- to rally over the past year.
Yet CyberArk (CYBR +0.00%), a leader in the PAM (privileged access management) market, is often overlooked and overshadowed by those three cybersecurity giants. It's significantly smaller and it's growing at a slower rate, but it still deserves a closer look for three simple reasons.
Image source: Getty Images.
1. A leader in a valuable niche market
Most cybersecurity companies focus on blocking external threats. CrowdStrike counters attacks with cloud-native cybersecurity services, Palo Alto's ecosystem is built atop its next-gen firewall, and Cloudflare protects websites from attacks and their visitors from malware.
However, CyberArk, focuses on internal threats like corporate spies and disgruntled employees. It sets different access levels for employees, and locks down the network upon detecting an internal breach.
Gartner has consistently named CyberArk a market leader in the global PAM market, which Market Research Future expects to expand at a CAGR of nearly 33% between 2020 and 2026.
This niche market could grow faster than the broader cybersecurity market -- many companies could soon realize they bolted up the doors and windows when the intruder is already inside the house.
CyberArk currently serves more than half of the Fortune 500 and over a third of the Global 2000, so it still has room to grow. It's also been expanding its customer base by acquiring smaller companies like Viewfinity, Conjur, Vaultive, and Idaptive over the past six years.
2. Pivoting toward cloud-based services
Many cybersecurity companies, including CyberArk, Palo Alto, and FireEye, install on-site appliances. However, younger companies like CrowdStrike are skipping appliances altogether and providing cloud-based security services, which are stickier, easier to scale, and generate predictable recurring revenue.
Image source: Getty Images.
That's why CyberArk has been gradually pivoting from its on-premise licenses toward newer cloud-based services.
That strategic shift boosted its annual recurring revenue (ARR) 43% to $274 million, or 59% of its top line, in fiscal 2020. It expects cloud-based bookings to account for 55% of its new license bookings in fiscal 2021, compared to 50% in 2020.
That ongoing evolution, which CyberArk is supporting with higher cloud infrastructure investments, ensures that it can keep pace with the industry as on-site appliances gradually disappear.
3. Its slowdown should be temporary
CyberArk's revenue rose 7% to $464 million in 2020, but its adjusted net income fell 25% to $81 million. Analysts expect its revenue to rise 6% this year, but for its adjusted earnings to drop another 72%.
Based on those expectations, CyberArk's stock trades at nearly 230 times forward earnings and ten times this year's sales. Many investors might look at CyberArk's sluggish growth and high valuations and stick with another company like Palo Alto, which generates stronger growth and trades at lower valuations.
However, CyberArk's near-term growth is throttled by two main factors. First, its shift to cloud-based services reduces its revenue because on-site appliances initially generate higher sales than cloud-based subscriptions. But over time, its cloud-based subscriptions should generate more recurring revenue.
Second, CyberArk's aggressive cloud infrastructure expansion and its elevated R&D and marketing expenses are weighing down its gross and operating margins. After it clears this investment phase, its earnings growth should normalize again.
That's why analysts expect CyberArk's revenue and earnings to rise 12% and 4%, respectively, next year. CyberArk's stock still might look pricey relative to those estimates, but its low enterprise value of $4.9 billion still makes it a compelling takeover target for bigger cybersecurity companies.
The bottom line
CyberArk isn't my favorite cybersecurity stock right now, but I wouldn't underestimate its long-term growth potential. It dominates an essential niche market, it's expanding its businesses in all the right directions, and it will probably fully transition to cloud-based services in the near future.
