Many cybersecurity companies develop tools that fortify an organization's network against external threats and block those attacks as they occur. However, CyberArk (CYBR -1.01%) and Tenable (TENB 1.34%) are different because they focus on proactively stopping those attacks by cleaning up internal threats.
CyberArk's privileged access management (PAM) software secures a company's network against internal threats like corporate spies and disgruntled employees. Tenable's Nessus platform scans a company's entire software infrastructure for potential soft spots like misconfigured software, weak passwords, and network flaws.
Image source: Getty Images.
I compared these two stocks at the end of 2021, and claimed Tenable's stronger growth, tighter cost controls, and lower valuation made it a better buy than CyberArk.
But since I made that call, Tenable's stock has declined 23% as CyberArk's stock dropped 7%. Both stocks lost their luster in 2022 as rising interest rates rattled the tech sector, but was I wrong to pick Tenable as the better long-term play? Let's see.
Which company has been growing faster?
CyberArk currently serves over 8,000 customers across 110 countries, including over half of the Fortune 500 and more than 35% of the Global 2000. Its revenue rose 7% in 2020, 8% in 2021, and 18% to $592 million in 2022. Some of that growth was driven by its acquisitions of two smaller PAM players: Idaptive in 2020 and C3M in 2022.
CyberArk expects its revenue to rise 22%-24% in 2023. That acceleration is surprising, since many other cybersecurity companies have been struggling with slower growth in this tough macro environment. CyberArk admits it's facing some macro challenges, but it also believes the expansion of its newer cloud-based subscription services can offset that pressure.
Tenable serves more than 40,000 customers worldwide, including about 60% of the Fortune 500, 40% of the Global 2000, and several U.S. government agencies. Its revenue rose 24% in 2020, 23% in 2021, and 26% to $683 million in 2022. Some of its recent growth was also driven by acquisitions, which included its purchases of Alsid and Accurics in 2021, followed by Cymptom and Bit Discovery in 2022.
But for 2023, Tenable expects its revenue to only rise 13%-15% as the macro headwinds throttle its growth. That slowdown is disappointing, since Tenable previously told investors it could grow its revenue by at least 20% annually for at least the next few years. However, Tenable believes the expansion of its ecosystem with Tenable One -- which bundles together a lot of its services -- can still drive its long-term growth.
With an enterprise value of $6.2 billion, CyberArk trades at about nine times this year's sales. Tenable's enterprise value of $4.7 billion makes it a bit cheaper at six times this year's sales.
Which company is more profitable?
Neither CyberArk nor Tenable was profitable on a generally accepted accounting principles (GAAP) basis last year. CyberArk's net loss widened from $84 million in 2021 to $131 million in 2022, while Tenable's loss grew from $47 million to $92 million.
On a non-GAAP basis, which excludes stock-based compensation expenses and other one-time expenses, CyberArk posted a net loss of $18 million in 2022 -- compared to a net profit of $13 million in 2021 -- but it expects to turn profitable again in 2023. CyberArk's margins are being squeezed by the expansion of its subscription-based cloud services, which initially generate lower-margin revenue than single licenses but could lock in more customers over the long term.
Tenable's non-GAAP net income rose 14% to $44 million in 2022, and it expects 56%-67% growth this year as it reins in its spending. Based on these expectations, CyberArk trades at more than 600 times the midpoint of this year's adjusted EPS, while Tenable seems cheaper with a midpoint multiple of 73.
Both companies still have plenty of liquidity to pursue more investments and acquisitions. At the end of the first quarter, CyberArk and Tenable held $1.2 billion and $617 million, respectively, in cash, cash equivalents, marketable securities, and short-term deposits.
The better buy: Tenable
CyberArk's cloud-based expansion and accelerating sales growth are encouraging, but I don't believe those strengths fully justify its premium valuations -- especially when those strategies are still compressing its near-term margins. Tenable might face a tougher slowdown than CyberArk this year, but its profit growth is healthier, it isn't drastically altering its business model, and its stock is cheaper.
In other words, I still believe that Tenable is a better long-term cybersecurity play than CyberArk.
