Cyberark Software Ltd (CYBR) 2016 Q4 法說會逐字稿

Good day, ladies and gentlemen, and welcome to the Q4 2016 CyberArk Software Limited Earnings Conference Call. (Operator instructions) As a reminder, this call is being recorded. I would now like to turn the call over to Erica Smith. You may begin.

Thank you, Michelle. Good afternoon, everyone. Thank you for joining us today to review CyberArk's Fourth Quarter and Full Year 2016 financial results. With me on the call today are Udi Mokady, our Chairman and Chief Executive Officer, and Josh Siegel, Chief Financial Officer. After preliminary remarks, we will open the call up to a question and answer session.

Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management's best judgment based on currently-available situation. I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operations for the first quarter and full year 2017. Our actual results might differ materially from those projected in these forward-looking statements. I direct your attention to the risk factors contained in the Company's annual report on 20-F, filed with the United States Securities and Exchange Commission, and those referenced in today's press release. CyberArk expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made here today.

Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation to the most directly-comparable GAAP financial measures is also available in today's press release, which can be found at www.CyberArk.com in the Investor Relations section. Also, a webcast of today's call will be available on our website in the Investor Relations section.

With that, I'd like to turn the call over to our Chairman and Chief Executive Officer, Udi Mokady.

Thanks Erica, and good afternoon, everyone. Thank you for joining us to discuss our fourth quarter and year-end results. In early 2016, we outlined our strategy to grow our top line and deliver strong operating margins, successfully integrate our acquisitions, enhance our leadership position through innovation, and expand the reach of our partner ecosystem. I am pleased to announce that we executed successfully against all of these objectives.

Financially, we had a great fourth quarter, capping off another tremendous year. Revenue for the quarter was a record $64.4 million, and we generated 30% non-GAAP operating margins. For the year, revenue reached a record $216.6 million, growing 35%, and we recorded $58 million in non-GAAP operating income, a 27% operating margin, and $45.2 million in non-GAAP net income. We are thrilled with the outperformance, which reflects the power of our operating model and the ongoing execution of our land-and-expand strategy.

We closed over 200 new logos in the fourth quarter alone, ending the year with more than 3,075 customers, an increase from about 2,500 last year. With our customer additions, more than 25% of the Global 2000 and about half of the Fortune 100 are trusting CyberArk to help protect their most valuable assets. The vast majority of our new customer deals were again, greenfield engagements, illustrating that we have a long runway ahead of us.

New business highlights in the fourth quarter include: a large manufacturing company in EMEA chose CyberArk not only because of our flexible, modular platform but also because we can support its ongoing strategy, which includes AWS, Office 365, and DevOps processes; a mid-market SaaS application vendor running in AWS will leverage three of our products to lock down privileged accounts while it monitors and controls access into the cloud environment.

Our momentum in US Federal continued in the fourth quarter. In one six-figured win, a Federal agency will protect its infrastructure with five of our products, including Enterprise Password Vault, Privileged Session Manager, Application Identity Manager, SSH Key Manager and Privileged Threat Analytics. We began investing in US Federal a number of years ago, making our record results in 2016 very rewarding. Given our strong pipeline of activity, we continue to believe we are in the early stages of this market opportunity.

Our success with add-on business demonstrates the tremendous opportunity we have within our install base and the importance of our platform approach to privileged account security. I would like to highlight just a few of our seven-figure deals.

First, a large hosting and telecommunications company in the US, who is using five of our products, wanted to securely store, rotate and control access to more than 100,000 SSH keys as well as go deeper into the organization to monitor and manage all servers, firewalls and network devices across the enterprise with privileged session management. A longstanding financial services customer in EMEA is another great example of our land-and-expand strategy at work. This company became a customer in 2007, purchasing three of our products, and adding another in 2012. In the fourth quarter, we expanded the relationship further with Privileged Threat Analytics, SSH Key Manager, and Endpoint Privilege Manager.

Diversification is a cornerstone of our strategy. The Americas and EMEA delivered strong results, growing revenue 39% and 34% respectively. In APJ, our investments in broadening awareness and in building a stronger leadership team began to generate results in the back half of 2016. While revenue in the region grew about 5% for the full year, we were pleased with the team's strong finish, increasing revenue by 26% in the second half of 2016. We believe APJ is now well-positioned to capitalize on the greenfield opportunity across the region.

Given our rapid growth, we are focused on scaling the company and adding talent while maintaining the CyberArk culture that has been so critical to our success. Recently we announced the addition of Adam McCord as Vice President of Sales for Latin America. Adam brings extensive experience from leading security organizations like Palo Alto Networks, ForeScout and F5 Networks, and we believe he has the experience necessary to expand the initial base of business in the region.

One of our most important accomplishments in the year was integrating the two acquisitions we made in 2015. By all measures, our acquisitions strategy has been a success. We retained key employees, we incorporated both the on-premise and cloud offering of Viewfinity into our sales process. In fact, our Privileged Management Endpoint product was included in nearly 20% of all new business engagements, and was an important component of a number of strategic add-on wins. We exceeded our revenue expectations, and in the fourth quarter we integrated Cybertinel technology into the Viewfinity product to create a unique offering that now provides credential theft detection and blocking capabilities. This solution has been renamed Endpoint Provision Manager.

Earlier in 2016, we extended our leadership position with the introduction of Privileged Threat Analytics version 3.0. We became the only vendor to provide a comprehensive platform designed to proactively protect domain controllers and automatically respond to stolen credentials, helping to prevent the attackers from taking over the network.

As you probably saw this morning, we announced a certified integration with Amazon Inspector, to simplify the discovery and help prioritize the risks associated with privileged accounts in AWS. This is yet another step in our ongoing plan to further expand the value that CyberArk provides to our customers in cloud environments.

Industry analysts like Gardner have stated that while public clouds are secure, mismanaged credentials are among the greatest source of cloud security risk and that privileged accounts are often poorly managed. The cloud creates new challenges in securing and managing privileged accounts. The attack surface is larger. Cloud consoles have super-user capabilities, and dynamically scaling elastic production environments crates an enormous management challenge. So, it is no surprise that the cloud is a key topic in the majority of our sales engagements. In both new and add-on wins, customers are protecting privileged accounts across the enterprise including the data center, in public or private clouds, and in hybrid environments. We provide a single integrated solution that increases security and lowers the management cost in an effort to secure privileged across the organization. While our customers' cloud migration timelines vary significantly, we are ready to support their programs now.

In 2016, we successfully expanded our indirect channel. Relationships with leading organizations like PWC, KPMG, Atos, and Computacenter, are already contributing to our results through executive level influence and in closing sales engagements. Momentum in the channel continues to build with indirect business representing more than 60% of total revenue. We ended the year with over 300 active channel partners, and more than doubled the number of CyberArk certified privileged account security experts in the field.

And, an important part of our ecosystem is our technology partnerships. We launched the C3 Alliance in April with 14 partners, and by the end of the year we had more than 35 Alliance members supporting over 50 integrations. Our Alliance program is creating a lot of energy, and we are excited to see our strong field partnerships with Proofpoint, ServiceNow, SailPoint, and Tenable, among others, generate results.

The threat environment evolved throughout the year, but one thing remained constant: protecting privileged accounts is critical to mitigating the damage of cyber attacks. We have identified a proven framework to rapidly reduce the privileged credential risk within 30 days. Our framework is built on lessons learned from several large data breach recovery efforts, and has been validated by a panel of Chief Information Security Officers at Global 1000 enterprises, like ING, Lockheed Martin, Starbucks, CXX Corporation and NewsUK. These steps can help customers significantly reduce risk related to unprotected privilege accounts, and rapidly demonstrate the value of CyberArk to the organization.

2016 was an outstanding year for CyberArk. We outperformed our guidance and delivered against our operational objectives. The R&D team developed industry-leading innovation and we are well-positioned to help customers migrate to the cloud. We also strengthened the sales and marketing organization, broadened our go-to-market reach, and delivered meaningful returns on key long-term investments like US Federal and the Global channel. Today, we have a robust, rapidly-growing pipeline across all geographies and demand for our solutions continues to build.

Because of this success, we enter the new year an even stronger company. Our objectives for 2017 align with our long-term strategy to establish CyberArk as an enduring leader in cyber security. We plan to continue to innovate, to enhance our existing solutions and introduce new products, make it easier and more secure for our customers to migrate to the cloud, expand our sales and marketing engine around the globe including both the direct and indirect channels, and deliver strong growth while staying true to our operational discipline.

We are very excited about the future, and are looking forward to working together to deliver another great year.

With that, let me turn it over to Josh. Josh?

Thanks, Udi. Yes, we are pleased with our strong results, which again, exceeded guidance for revenue, operating income, and earnings per share. In the fourth quarter, CyberArk generated record revenue of $64.4 million, up 25% year-on-year. License revenue for the quarter reached $40.8 million, increasing 23% compared to 2015, and representing 63% of total revenue. License revenue was driven by strong growth from existing customers as well as new customer additions.

Maintenance and professional services revenue was $23.6 million, increasing 28% over the fourth quarter 2015, and representing 37% of total revenue consistent with past years. In the fourth quarter, the Americas revenue grew 12% to $37.1 million, representing 58% of total revenue. EMEA revenue grew 53% and reached $23.2 million in Q4, which was 36% of total revenue. APJ grew 30% to $4.1 million, representing 6% of total revenue in the fourth quarter.

As I move through the rest of the P&L, all financial results will be discussed on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release.

Gross profit for the quarter was $56.4 million, or an 88% gross margin compared to $45.2 million, also an 88% gross margin in the same period last year. Consistent with our strategy to drive growth and scale our operations, in the fourth quarter we continued to invest across the organization. R&D expense grew 20% year-on-year to $7.5 million as we continued to extend our leadership position by delivering innovation to the market.

Sales and marketing expenses for the fourth quarter increased 27% year-on-year to $24.6 million, as we further deepened our sales and marketing reach across all geographies.

G&A increased 12% to $4.9 million, to scale and support the organization as the Company continued to grow. In total, operating expenses increased 23% in the fourth quarter of 2016 to $37 million, compared with $30 million for the fourth quarter of last year. We ended the year with 823 employees worldwide, compared to 644 at the end of 2015. The 823 included 377 in our sales and marketing organization, up from 294 at the end of 2015. Our revenue outperformance flowed through to the bottom line, and we again delivered operating results ahead of our guidance.

Operating income was $19.4 million. This compares to $15.2 million in the fourth quarter of last year. Even with our increased level of investment, our operating margin hit 30% in the fourth quarter of 2016, similar to what we achieved fourth quarter of last year.

Net income was $14.7 million, or $0.41 per diluted share for the fourth quarter of this year, compared to $13.8 million or $0.39 per diluted share for the fourth quarter last year.

Now, let me summarize our results for the full year 2016. Total revenue increased 35%, reaching a record $216.6 million compared to $160.8 million in 2015. We were pleased with the Viewfinity acquisition, which contributed approximately $10 million in total revenue, which was above the range of $7 million to $9 million that we projected at the time of the acquisition. Our success also included better-than-anticipated traction from the Viewfinity cloud offering, which is recognized over time as recurring revenue.

As a reminder, we were reselling a product that was competitive to Viewfinity during 2015, so we encourage investors to look at Viewfinity revenue as organic. In addition, we do not plan to break out revenue by product going forward, but we did think it was important to help investors gauge the success of our acquisition.

License revenue in total was $131.5 million, increasing 31% year-on-year in 2016. 59% of license revenue was generated from existing customers, who purchased more licenses or bought new products. New business was also an important contributor to our growth in 2016.

Maintenance and professional services revenue increased 40% over last year, reaching $85.1 million, resulting from license growth in prior periods and our strong renewal rate, which was again, greater than 90% for the full year of 2016.

Looking at geographies, Americas had another strong year growing 39% to $135.1 million, and representing 62% of total revenue. EMEA grew 34% to $68.1 million, or approximately 32% of total revenue. Over the last three years, EMEA has experienced more pronounced seasonality towards the back half of the year, which proved true again in 2016 with the region generating 53% year-on-year revenue growth in the fourth quarter, as I mentioned earlier.

APJ revenue was $13.4 million, or 6% of total revenue. As Udi discussed, under new leadership the APJ region began to build momentum in the back half of 2016. Diversification across verticals has also been an important contributor to our success. In 2016, we experienced broad-based demand across industries. Banking, again was our largest segment, generated 31% of bookings in 2016 compared to 29% last year. Telecommunications and hosting providers represented 9% of the business. That's up from 6% in 2015. Global government was 9% of bookings, up from 7% last year. The record performance by the US Federal team was an important driver to the growth in this segment.

Rounding out the top five verticals were healthcare and manufacturing, which each represented 8% of the business in 2016. In all, eight verticals contributed 83% to our business, with the balance of our bookings coming from another seven verticals which we believe demonstrates the breadth of our opportunity and that we are executing well on our diversification strategy.

During the year, we signed 519 deals over $100,000, and we saw a bigger revenue contribution in 2016 from deals over $500,000 in size. We attribute this to existing customers proactively expanding their relationship with CyberArk to take a more strategic and broad-based approach to their privileged account security.

Our gross margin for the full year was 87.4%, up from 86.4% in 2015. Our margin expansion was driven in part by the higher margin contribution from our now in-house Privilege Endpoint product through the Viewfinity acquisition, compared to the third-party product we resold in 2015. In terms of expenses, we believe our operating model is especially efficient, given our rapid growth and scale. For the year, sales and marketing represented 40% of revenue. R&D was 13% and G&A represented 8% of total revenue. Our revenue outperformance, coupled with our disciplined approach to investing in growth, delivered stronger-than-anticipated operating income of $58 million in 2016, up from $43.6 million in 2015, generating consecutive operating margins of 27%.

Our net income was $45.2 million, or $1.26 per diluted share in 2016, up from $35.3 million, or $1 per diluted share in 2015. Our effective tax rate for the year was 22%, in line with the 22% to 24% range we previously forecasted.

Turning to the balance sheet, we ended the year with $295 million in cash deposits and marketable securities, up from $238 million at the end of 2015. We generated strong cash flow from operations of $56 million, resulting in 26% cash flow margin for 2016 compared with $59 million in the prior year. When looking at our cash flow from operations, it is important to note that in 2016 we paid approximately $10.6 million in taxes compared to $4.8 million in cash tax payments for the full year 2015.

Before I share guidance for the first quarter and full year 2017, let me remind you that our guidance does not consider any potential impact of financial income and expense associated with foreign exchange gains or losses.

For the first quarter of 2017, we expect total revenue of $57 million to $58 million, or 23% growth at the midpoint of the range. We expect non-GAAP operating income to range between $9.9 million to $10.7 million, and non-GAAP net income per diluted share of $0.21 to $0.23. This assumes 36.2 million weighted-average diluted shares.

For the full year 2017, we expect total revenue in the range of $267 million to $270 million, or growth of approximately 24% at the midpoint. We expect non-GAAP operating income to be in the range of $56 million to $58 million, and non-GAAP net income per diluted share of $1.20 to $1.24. This assumes 36.4 million weighted-average diluted shares. Our guidance assumes an effective tax rate of approximately 22% for 2017.

As a reminder, we typically experience a sequential revenue decline into the first quarter, moderate sequential growth in Q2 and Q3, and Q4 is our largest revenue quarter of the year.

We also wanted to provide you with a bit more color on some line items. In 2017 we expect capital expenditures to be approximately $4 million. During the year, we will also incur approximately $4 million in additional capital expenses for leasehold improvements, primarily related to the buildout of our new office space in Israel, which we expect to move into during the second half of 2017. As we look at the full year of 2017, we expect our annual cash flow from operations margin to run between our non-GAAP net income margin to 10 percentage points higher than our non-GAAP net income margin. Historically, we have operated the business at a cash flow margin between 5 and 15 percentage points higher than our non-GAAP net income margin. The higher end of that range was in large part due to perpetual license revenue and deferred, which we do not plan for, and we saw less of in the last year. We recommend analysts evaluate our cash flow on an annual basis, given that our cash flow from operations can vary quarterly based on seasonality of the business and taxes. We do not plan to provide quarterly updates on guidance for cash flow from operations.

In 2017, we plan to continue to invest in our cloud infrastructure to support the scale of Endpoint Privilege Manager, implementation and training service to help speed the deployment of our software, sales and marketing headcount to capture market share and grow our business, and R&D to continue to deliver innovative products to market. As our guidance demonstrates, even with these investments we remain committed to delivering strong operating margins. Given the scale of our business, our growth rates, demand for our solution and our market opportunity, we believe it is in the best long-term interest of the Company and our shareholders to continue to invest in capturing market share and extending our leadership position. We have a significant opportunity in front of us, and we are looking forward to a productive 2017.

I will now turn the call over to the operator for our Q&A. Operator?

(Operator instructions) Our first question comes from Jonathan Ho of William Blair, your line is open.

Congratulations on the strong quarter. Just wanted to maybe start out with some of your comments around the cloud opportunity and -- what are you hearing from customers? How is your product used by some of the customers that are looking at public cloud opportunities? And what do you think that can maybe contribute in terms of growth opportunity going forward?

Great, hi Jonathan, and thank you. I think what we're discovering is that our products basically have a new expansion frontier, and opportunity for great momentum. And it has various aspects. Many of our customers are talking about to -- capturing the migration to the cloud, and includes their -- they have a growing infrastructure as a service. The exponential growth of servers and applications, all of them come with privileged accounts or application credentials that need to be managed. And it's all exponential growth. So, they're looking to leverage the trusted CyberArk platform, but expanded to these cloud assets.

On top of that, the strongest attack vector and the biggest weakness in cloud infrastructure are the consoles that are used to manage the cloud infrastructure, and so, we see customers securing the AWS consoles, the Azure consoles, with CyberArk so that access to those super-powerful users can be monitored and controlled.

Another very exciting dimension is what we call the DevOps revolution, where the fast-flying way of rolling applications into the cloud requires a lot of API connectivity, and with components that are separated and the links between them are either SSH keys or credentials. And we found that the need to manage these secrets and be able to secure them and rotate them is a perfect fit for us to extend there.

And so, the critical advantage here is our experience with the scale of our organization in hybrid, and to do that with a single solution that they can do on-premise, in the cloud, and on the endpoint.

Got it, and then just as a follow up, as you start looking at the investments that you'd like to make, I know you guys are sort of balancing between showing more profitability and trying to pursue growth opportunities. Where do you see the most opportunity to leverage those investments? This is going to be more sort of new products, or is this going to be more investment in sales capacity? Can you just give us a little bit more color in terms of where that might fall, and maybe what gives you the confidence that growth can sustain?

Yes, I think what excites me the most is to see the diversity in everything we do. A greenfield opportunity, it means we're really going after the sales execution and bringing access to those field opportunities like the investments in Latin America or the increase in sales capacity across the world. The add-on business, which is phenomenal this year, and we're scratching the surface with the customer base. And so, definitely going and leveraging the customer success teams and expanding that footprint to go after that.

But in parallel, as a long-term player, we continue to invest in R&D, and in the innovation, to preserve and strengthen our market leadership in privileged account security. I would say those are, would be, the prime dimension and when we talk about go-to-market, definitely channel investments there. We think it's really going in the right direction. We feel great channel momentum from 2016.

Great, thank you.

Thank you, Jon.

Our next question comes from Gabriela Borges of Goldman Sachs, your line is open.

Hi, this is Chelsea Jurman on behalf of Gabriela, thanks for taking the question. Can you give an update on the Application Identity Manager product? It was one that came up a little bit last quarter, and how are you thinking about what the growth opportunities there and do you think that longer-term this could become a bigger part of the business than PSM?

So first of all, absolutely Application Identity Management is one of our very exciting products, and one where we have very strong leadership. The beauty with this product is that it relates to legacy applications that have embedded credentials and scripts, but really takes off as per the prior question, when as customers migrate to the cloud and need to automatically provision applications, and also tie in with the orchestrating systems and the tools they use in order to launch and manage their cloud infrastructure. It also is getting an additional lift from our C3 Alliance, where we manage the credentials that come in with off-the-shelf software products, and we gave some examples yet there.

So, I would say it's well-positioned, also because of our leadership and past investments in this product, but it is also taking a new dimension with the cloud migration and it had a great year. It had a great 2016 and in our camp it's labeled a growth engine.

Great, and then in terms of your investment philosophy, to the extent that there is any upside this year to what you are guiding, how are you thinking about reinvesting that upside versus letting it drop through to the bottom line?

Hi Gabriela, this is Josh. You know, I think we're -- just to reiterate where we're investing first, it's really three buckets. The first is in sales and marketing, which will have the lion's share of the increased investment related to headcount and really spreading on the channel development that Udi talked about. And second, on the R&D innovation, and also there's a piece within our operating costs for developing out further the infrastructure of our cloud environment, and related to services for training and so forth, our professional services group. So, we'll see a piece of that in the cost of goods.

Overall, I think as we see in our operating model we're able to really leverage increased revenue, given the fact that we run at over 85%, 86% gross margin. So, I think we'll look at it during the year, but for the most part we're already building into our guidance some investment in growth that we're already planning for.

Great, thank you.

Our next question comes from Rob Owens of Pacific Crest Securities. Your line is open.

Thank you, and good afternoon, everybody. Maybe you could talk at a higher level regarding kind of the broader conversation around identity, and where customers are. And as you look at new customer acquisition, what's coming from a greenfield standpoint, what's coming from a rip-and-replace? And in those rip-and-replace scenarios, how much larger are the deals now than say they were with technologies they've been running for a decade-plus? Thanks.

Hi, Rob. So, actually, it's a very interesting question. First of all, most of the new deals, we look at them closely and we found that most of them were greenfield opportunity. In the world of identity management, we have a theme that says privileged first, first put controls over the things that can take over the network. And we have great relationships with the identity management players that manage the regular users, so it's a very healthy ecosystem where we want to put the critical layer of security around the digital assets and infrastructure first.

In the displace situations, and you're right, actually when we do displace the older technologies, we find that it's because the customer is now moving from a compliance-driven approach that maybe let them take an inferior product several years ago, to a security-driven approach which is an opportunity, a great opportunity for us to talk to them about a privileged account security program and not just a project, and to go deeper and wider. So, in many of these replaces, you can label them strategic replaces, and lead to larger deals and larger implementations.

I guess along those lines, the identity space is rather large, but highly fragmented. And so, what's your appetite for M&A and to move outside privileged into some of the other functional areas of potential governance or other types of things?

I think that we found, as a security company, our core is really securing the -- our customers' infrastructure, is making sure that we help them understand the attacker mindset. What does the attacker try to go after, and the attacker is seeking control. The attacker is seeking privilege. It leads us to really stay focused on our market. We of course look at a lot of other type of adjacencies from an M&A perspective and continuously look for how we can better shore up the security posture of our customers, but we're primarily partnering when it comes to governance and using the C3 Alliance for that. And it's working very well in the field with great collaboration, I mentioned some of them earlier.

And just lastly, apologize, but to dovetail that -- so as you look at M&A what type of strategy would you deploy relative to size, scale, profitability? You know, you've done a couple deals at the end of 2015 and then the one in early 2016, with a flat margin on a year-over-year basis. So, would you do something that could be margin-dilutive, or would we expect things that would kind of keep margins on par with where they've been if it came to M&A? Thanks.

Yes, so the M&As we did were all within 2015, and 2016 was definitely very much about integrating, adjusting, and we're very pleased with that. What it did, it emboldened us that we made the right strategic moves and we're thinking correctly. It was strategically a smart move to buy and own Viewfinity, and own that space. We were previously reselling a solution in the space. So, we feel good about the decision we made and how we integrated and executed there. And it means, from an M&A pipeline, we will continue to look at adjacent opportunities. I would say that I wouldn't want to set the stage right now that we would be looking at super huge deals, because we have a very strong market opportunity in front of us, and would not want to distract from that. So, anything we do would stay aligned with -- our customers want to buy this from us, our partners want to resell this from us, and that our employees can execute on it. This is how we're seeing it in the near future.

Great, thank you so much.

Thanks, Rob.

Our next question comes from Fatima Boolani of UBS, your line is open.

Hi, thank you. Question for Udi. Udi, you talked a lot about the international opportunity, and it really sounds like at least in APJ and Latin America, there's still a lot of room to grow. In your mind, from a big picture perspective, what are the one or two things that you think you really need to unlock the opportunity there? And a quick follow-up for Josh.

To -- I couldn't hear, what are the things we need to further unlock the opportunities in those international markets?

In APJ and Latin America (multiple speakers).

Yes, I think as a company that always went after the globe, we actually have a strong blueprint plan in how we go after a new region, and so -- what we found is building critical mass of customers and teaming up with the right partners and expanding that. Countries like France, where a new market five, six years ago, and had a phenomenal year. And we replicate that into new markets, and Latin America is -- has a base foundation with customers and partners, and now we're putting more energy behind it. So, it's really down to, the products work internationally, our marketing is internationally-oriented, and so we know how to execute on it.

The difference with these two that you mentioned, is there's definitely more education on switching from compliance-driven to risk-based, but we've done it in other markets, is showing the customers that yes, you can take off the compliance reasons to buy privileged account security, but the most important thing is thinking risk and securing your organization. So, right now we're really looking at this as a great growth opportunity.

And if I may, is there a product localization initiative that you have to undertake in any way?

In the past, we had to make investments in some localization for -- to support characters in Asia, but most of that has already been done earlier when we first went into these markets, and right now it's ready to sell.

That's helpful. And my follow-up for Josh, in your prepared remarks you talked about your expectation toward deferred license coming down for calendar 2017. I know historically that's been more of a customer-pull versus you pushing. Why is it that this year, your expectations are indeed coming down? Are you doing something differently with the sales force? I just want to get a better sense of why that's the case this year. That's it for me, thank you.

Yes, sure, Fatima. Thanks for the question. Yes, well, first of all we saw it coming down in 2016 so we have some new kind of what's happening out in the field, is that -- and I think you guys have been tracking it, and we've been tracking it internally -- is that the amount of perpetual licenses that are being deferred certainly in 2016 was dramatically reduced. I don't think that there's -- we never really planned to have that in our business model, and so we can't really predict going forward exactly where it will fall out. But, we are seeing that the -- I think the types of transactions that we're doing, and the relationships that we have with our customers and with our channels are really just paving the way for the deals to not have the types of things that were required in the past.

You know, from time-to-time we may still run into those cases, but it's certainly in the last six to nine months we've seen a dramatic decrease of those types of transactions. I would point out not necessarily for 2017, but certainly into 2018 anyway, with the new revenue recognition also -- those types of things would also reduce deferred revenue because the new guidelines for revenue recognition would allow more recognition up front, even when there's different deliverable components along the way.

Our next question comes from Imtiaz Koujalgi of Deutsche Bank, your line is open.

Hey guys, thanks for taking my question. A couple of questions. One is, if I'm doing my math right on the headcount add this quarter, I believe you added 33 heads, which I think is kind of one of the lowest numbers that I've seen in the last couple of quarters. How should we think about headcount adds in 2017, what are your plans for adding heads going forward?

We are planning significant headcount adds. There will be, they're part of our investment in growth. As you know, 65% to 70% of our expenses are headcount-related expenses, and so when we talk about investment in growth, a large number of that is coming in, in heads around the world. And I would say that the majority of those increased investments will be coming in the sales and marketing organization.

Got it, and then did you say Americas grew 12% in the quarter, revenues?

Yes, on a year-on-year basis. Correct. And for the year they grew 39%.

It slowed down quite a bit from the previous quarters, anything unusual that happened in Americas in Q4? This quarter?

Actually, Americas had a great year, and again like Josh said, with 39% growth, there are metrics in the queue that we don't get into. But I can tell you it had a great quarter and has a great pipeline. I think it's one of the healthiest markets that we can talk about.

Got it, no change in buying behavior or demand from what you've seen in the past?

To the positive. I think this is a market where we're seeing privileged account security really rising up to the top in Chief Information Security Officer priorities, and I talked about the 30-day spread methodology that we have. It's really taking place in many of the accounts here, where they're taking a risk-based approach. It's a very healthy market. Had a record Federal year in there, and some great seven-figures, and add-on and new business. It was a strong year for Americas.

Got it, thanks. Can I sneak in one more if I may, or I can ask on a call back if you don't mind. Is there time for one more?

Yes, go ahead.

Josh, for you -- on the operating cash flow, if I'm doing my math, the operating cash flow margin was towards the lower end of your guide of 5% to 15% on top of the net income margin. I think it was like 5% this year. You're guiding to 10% next year. What's driving that, what's changing in 2017 that you're thinking the gap between net income margin and operating cash flow margin will go up in 2017 versus 2016?

Well, first of all we talked about in the past that our -- looking historically, our cash flow margin was running 5% to 15% above our net income margin on a non-GAAP basis. So, for 2016 we generated 26% cash flow margin, $56 million which was on the lower end. One of the other things, though, I pointed out in the prepared remarks, was actually we had about $4.8 million which was in tax payments, which were related to operations from 2014 and 2015. So really, the cash flow margin, if you adjusted for that, would be closer to 28%, or net income margin plus 7%.

And going forward, as we look at our modeling, we really wanted to take into consideration the main point that I just talked about earlier in the prior question, is that -- one is, when we went back and saw when cash flow margin was 15% or in that neighborhood it was typically because we had higher deferred license revenue amounts on our books. And, as I talked about with Fatima in the last question, we're seeing -- we're just seeing less of that. It's less of the deal transactions, and so we can't predict that it will go back up again in the forward and we don't plan for it. So, we decided that to be comfortable with looking forward, we do expect cash flow margin to be above our net income because we do collect maintenance contracts up-front, whether it's one-year or three-year. But, we feel like the right number probably is net income to plus 10%.

Got it. Very helpful, guys, thank you very much.

Our next question comes from Andrew Nowinski of Piper Jaffray. Your line is open.

All right, thanks. Just two questions here. Palo Alto just announced new partnerships with [Okta] and [Ping] and leveraging their firewall-as-a-platform to deliver identity management services. Do you see any long-term threats from partnerships like that, where the larger firewall vendors begin moving into your market?

Oh no, I think we've been asked about that before. There's a very big difference in securing, managing, rotating, credentials and the traffic and blocking and managing traffic into the network. These integrations with identity services make sense. They're basically more oriented toward the anti-phishing and making sure that the wrong users don't get in from a regular user perspective. So, we see that as a normal evolution.

All right, thanks, and then you guys talked about investing to drive growth throughout all of 2016, and you only had really one quarter where revenue growth actually outpaced OpEx growth. So based on the results, it would seem that you're in the late innings of the investment phase, yet your guidance for 2017 suggests that OpEx growth will largely outpace revenue growth again this year. So, I guess can you give us any color as to where you are in that investment phase, and when we should start to see the leverage in the model?

Well, first of all I think we're still really in the early game of the privileged account security market. As we've talked about, many of our deals are still greenfield opportunities when we book in new customers and we're still at a relatively large runway with our existing customer base. So, we actually still believe we're still in the early innings of our market opportunity.

In terms of leverage on the model, we've been generating significant leverage over the last several years, but as we guide towards 2017 we're actually proud about still being able to provide guidance of 24% growth with over 20% operating margins. It makes us a top performer in our space, and what we have seen is that we'll be able to frequently flow down overachievement on the revenue line. The guidance includes already considering the investment that we're making, particularly on the sales and marketing side of the business.

Okay, thanks.

Our next question comes from Catharine Trebnick of Dougherty, your line is open.

Thank you for taking my questions. What I wanted to ask is, you had talked a lot about the add-on business, and could you discuss any of the modulars that seem to be more popular than the other ones? Example, as you close one of these deals, six-figure, five-modules, but outside that if they're already like a traditional customer, which ones do you go in and really farm first? Thanks. Give us an idea or background on that?

Sure, Catherine. So, if the question is, which products lend themselves the most to add-on business, typically our customers land with our enterprise customers both and with PSM, we would see growth in those products. We're seeing more customers of course land with three products, as we've mentioned. But, the rest of the growth right now, it's really -- the add-on is really diversifying. We've seen application identity management stuff as a cross-sell growth, especially as I mentioned, in the cloud and DevOps dimension. Viewfinity, which we now call EPM, Endpoint Privilege Manager, is a great add-on product. And then the rest really, depending on the specific customer. I would say there's add-on of what they've bought in the initial purchase, and often a lot of that, and then cross-sell of the other five or so customers, products that they don't have.

All right, thank you very much. Nice quarter.

Thank you, Catherine.

Our next question comes from Greg Moskowitz of Cowen and Company. Your line is open.

Great, thanks. This is actually [Michael O'Malley] on for Greg. Just had one quick one, if I could. What was the mix of on-premise to cloud deployments for Viewfinity this quarter? Thanks.

Yes, hi, Mike. It was about 40% deployed off the cloud, and 60% on-premise.

Great, thanks.

No problem.

Our next question comes from Erik Suppiger of JMP Securities. Your line is open.

Yes, want to just apologize if I missed this, but did you give -- did you say that the number of certified engineers had doubled over last year?

Yes. Yes, this is one of the --

I thought you had said after the third quarter that year-to-date they were already double what they were the prior year. Was that not correct?

Yes, that was correct. I think what we're talking about is that it's more than double, so we continued to increase in Q4.

Okay, so it was double and now it's more than double, is what you're saying?

Exactly. It's a great phenomenon for us, because there was a big shortage for CyberArk certified personnel.

Did you give the percentage of sales that included three products in the quarter?

Yes, we said that for the year, more than 25% of new deals included three or more products.

Okay, but you didn't give it for the fourth quarter?

We did not give it for --

Yes, but it was just above 25%. It was close to 28%.

Okay. So that was on an upward trajectory during the course of the year, and ended the year at a high point. Is that fair to say?

Yes, it's fair to say, but we try to look at things when we get to the annual -- where we're focused on the 25% and if we compare that to the 2015 it was about 23%. So, and I think the year before it was closer to 21%. So, we are kind of up and to the right.

Okay. And then lastly, did you give the attach rate for Viewfinity or for the EPP for new deals?

Yes, 20% of new deals included EPM, Enterprise --

Was that consistent with last quarter at 20%?

Yes, we've been running like 15% to 20% of new customer business during the last year taking -- it's of the new customer business, not of all of the transactions.

Okay, any prospect for that to increase from 20%?

We're pleased with that, and like I answered on the previous one, we have a lot of products to attach and we really work with our customers based on their building a security program.

Very good. Okay, thank you.

Our next question comes from Ken Talanian of Evercore ISI. Your line is open.

Hi guys, thanks for taking my question and congrats on the quarter. So, first off I was wondering, could you just rank order the primary growth drivers that you're looking at for 2017?

Sure. So, first of all, thank you. The way we look at it, and we're back from a great sales kickoff with I would say the strongest team we've ever had, and the way we framed it is on the one hand there's just a greenfield opportunity that we prove every day. We're in 25% of the Global 2000 but we're scratching the surface on the top 30,000 enterprises out there. So, it's a greenfield opportunity, cross-geography and cross-vertical. And that -- it's something we're proving every day, the vertical diversity. Number two is the customer base. We're now working off of a growing, of a larger customer base with 3,075 customers up from 2,500 last year. And so, there's a huge opportunity for expansion there, and they need it. Many customers selected us for compliance reasons throughout the year, and they need to move into a program and take us deeper and wider for security reasons.

The third dimension, I'm really excited about, and again, one, includes a lot of the international which I'm excited about. But the third dimension is really what the cloud opportunity represents for us, almost an additional frontier that we can join our customers on that journey. So, we really geared the team and are now extending that to training our channel partners to go after them.

Okay, and then sort of as an add-on to that, as we think about your sales and marketing investments, are any of them being focused disproportionately to a specific geography or even a vertical like Federal, for example?

Obviously, the Americas is the largest team and the larger contributor to the pie, but we've been very diligent throughout the year to really spread our go-to-market investments, because we know that we want contribution from future countries. For example, Japan has seen investment in the team throughout 2016 with a regional director and a team built around that. Australia, similarly. So, I would say definitely based on the pie contribution, you can expect that we have bigger teams, but we're also investing in the newer markets. And in terms of verticals, the truly focused vertical team is the Federal, and they had a phenomenal year and we're continuing to invest in that. And continuing to replicate that on a global fashion.

Great. Thank you very much, and congrats on the results again.

Thank you very much.

Our next question comes from Srini Nandury of Summit Redstone. Your line is open.

All right, thank you for taking my question. Congratulations on a good quarter. You know, many of the enterprises we've been talking to, talk about having applications in multiple clouds. So my question to you is, can you provide us some color how you engage in such a situation? And I have a follow-up, please.

Yes, actually, back to I think the first question that I was asked, it's part of our advantage is to take a platform approach. And you hit it, because enterprises are not standardizing on just one provider, and our approach is, hey, it doesn't matter which provider you're working with. We'll manage your privileged accounts across those systems, including the on-premise. And we are finding the same thing, that they're looking to diversify with cloud providers, and then we're in a position to work with their provider of choice.

Okay. You might have mentioned this on the call, I'm sorry, I might have missed it -- you've referenced the C3 Alliance. Have you been referred to any new customers through your participation in the Alliance, and how do you see this opportunity evolving in the near term? Thank you.

Great. I think the C3 Alliance is, of course it creates market opportunities where we can collaborate with the partners in there, and I mentioned Proofpoint as an example and SailPoint as an example, and Tenable, where we can partner in the field and bring each other to customers. But, I think the biggest advantage is credibility and creating value for our enterprise customers, because they -- they're looking, they understand that security is a team sport and they appreciate that this is a tie-in to manage their privileged accounts, and connect between the variety of security systems that they put in place. And of course, once in a while it does lead to a deal, but it's a bigger game plan than that.

That's all the time we have for today. I'd like to turn the call back over to Udi Mokady for any closing remarks.

Thank you. I'm very proud of our team for again delivering such a strong year. I want to thank our partners, customers, and employees who work hard and contribute every day to the success of CyberArk. And, thank you all for joining us tonight. Thank you very much.

Ladies and gentlemen, thank you for participating in today's conference. This does conclude the program, and you may all disconnect. Everyone have a great evening.