Cyberark Software Ltd (CYBR) 2017 Q3 法說會逐字稿

Good day, ladies and gentlemen, and welcome to the CyberArk Software Third Quarter 2017 Earnings Conference Call.

(Operator Instructions) As a reminder, this conference call is being recorded.

I would now like to turn the conference over to Ms. Erica Smith, Vice President of Investors Relations.

Ma'am, you may begin.

Thank you.

Good morning.

Thank you for joining us today to review CyberArk's third quarter 2017 financial results.

With me on the call today are Udi Mokady, Chairman and Chief Executive Officer, and Josh Siegel, Chief Financial Officer.

After the preliminary remarks, we will open the call up to a question and answer session.

Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management's best judgment based currently available information.

I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operations for the fourth quarter and the full year 2017.

Our actual results might differ materially from those projected in these forward-looking statements.

I direct to your attention to the risk factors contained in the company's annual report on Form 20-F filed with the SEC and those referenced in today's press release.

CyberArk expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made during today's call.

Additionally, non-GAAP financial measures will be discussed on this conference call.

A reconciliation to the most directly comparable GAAP financial measures is also available in our earnings press release, which can be found at www.cyberark.com in the Investor Relations section.

Also please note that a webcast of today's call will be available on our website in the Investor Relations Section.

Now I'd like to turn the call over to Chairman and Chief Executive Officer, Udi Mokady.

Udi?

Thanks, Erica, and good morning everyone.

Thank you for joining our call today.

In the third quarter, we were pleased to exceed our guidance, with total revenues of $64.8 million, non-GAAP operating income of $10.7 million, and non-GAAP net income of $8.9 million.

In the first nine months of the year, we generated $44.6 million in cash flow from operations.

In the third quarter, our results were driven by both add-on business from existing customers and revenue from new customers.

We were also pleased that during the third quarter we closed a number of EMEA deals that we expected in Q2.

Security remains a top priority, as the threat landscape rapidly evolves and becomes increasingly complex.

How organizations secure the enterprise is also changing to keep pace with malicious actors, nation states, and rogue insiders, who are more persistent and sophisticated.

Today organizations increasingly understand that privileged accounts act as a highway to their most valuable assets that are exploited in successful cyber attacks.

This dynamic is contributing to our results.

On the new logo front, we ended the quarter with over 3,450 customers.

Customers are buying CyberArk based on risk as well as compliance, which drove an increase in the size of our new business deals in the third quarter.

In fact, we had the largest number of 7 figure new business customers in the company's history.

A few new business highlight in the third quarter; one of the world's largest pharmaceutical companies is leveraging 5 of our products to protect its IT infrastructure around the globe.

The driver of this project was security, and we won because of our expertise as a trusted advisor.

An important contributor was the streamlined integration between Privileged Session Manager and Privileged Site Analytics, which will save the customer significant time and money for its compliance and audit requirements.

A leading research hospital in the Americas views privileged account security as a critical pillar for its entire security strategy and is rolling out a multiphase CyberArk project.

The initial $500,000 deal includes 4 of our products to protect mission critical applications.

Over time, the hospital also plans to secure business applications like corporate social media accounts.

Hospital are a sub-segment of the broader healthcare vertical, and there are more than 5,000 registered hospitals in the U.S. alone.

We are just scratching the surface of the opportunity within this vertical market.

The WannaCry and NotPetya ransomware attacks disrupted organizations around the globe in the second quarter.

NotPetya was able to self-propagate by leveraging stolen credentials and then moved laterally across the network, ultimately paralyzing business operations in its wake.

During the third quarter, we helped an organization that was severely impacted by the ransomware attacks regain control over their environment.

Working with an influencer partner, in a matter of weeks the entire IT infrastructure, including CyberArk, was rebuilt and is now running in Microsoft Azure.

This mission critical project demonstrates the key role we play in security programs, including the cloud and cloud migration strategies.

Some of the pipeline created after the ransomware attacks in the second quarter converted into customers in Q3.

In one 7 figure example, a global transportation company chose CyberArk to scale and protect more than 300,000 workstations with Endpoint Privilege Manager.

This customer chose CyberArk for our unique combination of lease privilege, credential theft blocking, and application control, a powerful solution that hardens the endpoint to block or detect lateral movement where the majority of attacks begin.

The customer also recognized that our solution has been proven 100% effective in protecting against file encryption when tested against hundreds of thousands of ransomware samples.

In the third quarter, our momentum continued in global government, which represented more than 10% of the business.

We signed a 7 figure new business deal with an EU agency for 3 of our products, as well as add-on business with government organizations in Singapore and France.

We also had a record quarter in U.S. federal.

We signed new and add-on business across all three branches of federal government with more than 22 distinct departments or agencies.

Given our investments in U.S. federal, it is rewarding to gain critical mass across a number of agencies and increase reference selling.

As an example, CyberArk was protecting privileged accounts at a field agency while the main office had rolled out a competitive solution.

The experience of the field office demonstrated the superior security and performance of our solution.

In the third quarter, we won a rip and replace deal and will be implemented agency wide.

Add-on business continues to be an important contributor to our results.

Customers understand that privileged account security is critical to protecting the enterprise and are expanding their deployments of CyberArk.

We won 7 figure add-on business across verticals, including financial services, energy, pharma, and manufacturing.

During the quarter, our business was well-balanced across geographies, and we were pleased to see the organizational changes we made in August begin to take shape.

As CRO, Ron began to implement the strategy to drive consistency across the sales organization, strengthening our visibility and increased pipeline growth.

The teams around the world are working closely together, including the strategic rollout of the global sales engineering and customer success teams.

Our partners are an important component of our go-to-market strategy, and we continue to strengthen our relationships within our value-added resellers, service providers, and advisory firms around the world.

In the third quarter, about 60% of our business was through channel.

Through our training program, we have expanded the number of trained CyberArk security professionals in the field by more than 75% over last year.

Our C3 technology alliance program is a key differentiator in the field.

Today we have nearly 70 partners, and together we are significantly reducing the attack surface to strengthen customers' security posture.

We are very excited about all of the partners in the program such as Qualys, Proofpoint, ServiceNow, and Tenable, and newer partners like ForeScout and OKTA, who are already influencing deals.

Ongoing innovation has been important to our success, and we are excited about the September launch of the community edition of Conjur, an open source version of the software.

Just four months after closing the acquisition, the R&D teams came together and delivered an important milestone in our go-to-market strategy.

We are working to capture the DevOps market from both security professionals, who recognize CyberArk as the leader in privileged account security, and the developers, who use open sources software tools to regain agility and quickly deliver results.

We believe that the CyberArk-Conjur community edition is a strong entry point for customers to secure their DevOps pipeline.

We are pleased that the Conjur enterprise edition is already playing an important role in sales engagements as customers look for a unified solution to protect the enterprise.

The cloud and DevOps are disrupting software development, and enterprise IT and privileged account security is fundamental to a comprehensive security strategy.

We are the only solution that can protect privileged accounts seamlessly from the data center to the cloud and the DevOps pipeline.

As the leader in the market, we are continuing to invest in innovation and global sales and marketing.

We are confident that our robust pipeline combined with the recent globalization of the sale teams positions us well for the future.

Finally, culture has always been an important contributor to our long term success, and we were proud that our team was recently recognized as best workplace by Great Place to Work and Fortune magazine.

I will now turn the call over to Josh.

Josh?

Thanks, Udi.

We exceeded our guidance for revenue, operating income, and earnings per share.

During the quarter, total revenue increased 18% to $64.8 million.

License revenue increased 8% year-on-year to $35.8 million, representing 55% of total revenue.

As Udi mentioned, we had a solid mix of revenue from both new and existing customers.

Maintenance and professional services' revenue was $29 million, increasing 34% over the prior year period and representing 45% of revenue.

Geographically, the Americas grew 17% year-on-year to $42.2 million, or 65% of total revenue.

EMEA grew 23% from Q3 2016 to $18.5 million, or 29% of total revenue, while the Asia-Pacific/Japan region grew 13% year-on-year to $4.1 million, or 6% of total revenue in the third quarter.

Year-to-date, the Americas grew 21% to $118.9 million; EMEA grew 10% to $49.2 million, and for the nine months, APJ increased by 42% to $13.2 million.

Three verticals more than doubled in the third quarter, including energy, pharmaceuticals and transportation; and insurance, manufacturing and retail grew by more than 50%.

As I move through the P&L, all financials except revenues are presented on a non-GAAP adjusted basis.

Please see the press release for a reconciliation of our non-GAAP to GAAP results.

Our third quarter gross profit was $55.8 million, or an 86% gross margin.

The gross margin compared to 86.8% in the same period last year and an increase from 85.2% in the second quarter of this year.

Our R&D expenses grew 31% year-on-year to $9.6 million, or 15% of revenue.

The increase in R&D is a result of our planned investment in innovation, including enhancing our Privileged Account Security platform, expanding our cloud capabilities, and strengthening our DevOps solution.

As a reminder, in the third quarter we recognized a full run rate of expenses from the acquisition of Conjur in the prior quarter.

Sales and marketing increased 37% year-on-year to $30.2 million, or 47% of total revenue.

And we're continuing to make investments in our global sales and marketing teams.

G&A increased 29% year-on-year to $5.3 million, or 8% of total revenue.

For the third quarter of 2017, total operating expenses increased 35% year-on-year to $45.1 million compared with $33.4 million for the third quarter of last year.

We ended the third quarter with 966 employees worldwide, up from 921 at the end of Q2 and 790 at the end of third quarter of last year.

We generated operating income of $10.7 million in the third quarter.

This compared to an operating income of $14.3 million in the year-ago period.

Net income was $8.9 million, or $0.25 per diluted share, for the third quarter of this year compared to $11.8 million, or $0.33 per diluted share, for the third quarter of 2016.

Turning to our balance sheet, we had $297 million in cash, cash equivalents, short term deposits, and marketable securities, increasing from the $296 million at year-end.

We again generated strong cash flow from operations of $45 million for the first nine months of the year, including $15 million in the third quarter.

We are pleased that we fully funded our acquisition of Conjur from internally generated cash flow within the first nine months of the year.

Moving on to our guidance for the fourth quarter and full year 2017, for the fourth quarter we expect total revenue of $75 million to $76 million, or 17% growth year-on-year at the midpoint.

We expect non-GAAP operating income to range between $16.8 million to $17.6 million, and non-GAAP net income per diluted share of $0.35 to $0.36.

This assumes 36.4 million weighted average diluted shares.

For the year, we expect revenue to be in the range of $256.3 million to $257.3 million, or a growth of approximately 19% at the midpoint, non-GAAP operating in the range of $48.9 million to $49.7 million, and our non-GAAP net income per diluted share of $1.09 to $1.10 per share.

This assumes 36.3 million weighted average diluted shares and a tax rate of approximately 23% for the full year.

The market for privileged account security remains strong.

We believe we have the right strategy to deliver growth and long term value to our shareholders.

I will now turn the call back over to the operator for Q&A.

Operator?

(Operator Instructions) Our first question comes from Saket Kalia with Barclays.

Your line is now open.

Hey guys, morning.

Thanks for taking my questions here.

Hey Saket.

Hey Udi.

Hey Josh.

Hi Saket.

Udi, maybe just to start with you, can you just talk a little bit about the competitive landscape from a high level?

And maybe more specifically, how did your win/loss rates this quarter maybe compare to prior quarters qualitatively?

Sure.

So I would say we're playing in a rapidly growing market that CyberArk pioneered, and strong demand attracts attention from other vendors.

I think as the market expanded beyond the large enterprise and into the midmarket, we're seeing some vendors take more short term oriented decisions around pricing, which resulted in a more competitive environment in this segment.

But it's always been a competitive market, and we always have the largest market share and win rates.

We're maintaining our leadership position, and that's how we're seeing it.

Continued innovation, commitment to really thinking through security and protecting our customers, and strategic moves like Conjur really break us out and differentiates our work.

Sure.

That's really helpful.

Maybe just for my follow up for you, Josh, nice acceleration on the license revenue line.

Maybe just longer term, how do you think about license growth conceptually, especially as we get to more comparable growth rates, if you will, on a year-over-year basis?

Yes, I think -- thanks, Saket.

It's a great question.

We still remain very confident in the demand environment and the robust growth in our pipeline across all the geographies.

So it gives us a lot of confidence around the growth of the business and license particularly.

We do believe also that the market supports faster growth even than -- certainly than the numbers we've generated this year.

And I think as we kind of continue to look at how we are globalizing the sales teams, in the last quarter and as we go through this quarter and start off in 2018, we definitely think it positions us well to capitalize on this tremendous opportunity and more -- and take advantage more of the market opportunity for higher growth.

Got it.

Thanks very much, guys.

Thanks, Saket.

Our next question comes from Gabriela Borges with Goldman Sachs.

Your line is now open.

Great.

Good morning.

Thanks for taking my question; great to see the momentum improving again.

Udi, I know you've done a lot of work internally since the negative pre-announcement a couple quarters ago to understand the dynamics in the channel.

Maybe you could summarize for us some of the actions you're taking to better manage the channel deals and prevent slippage in the future.

And maybe you could also summarize for us some of the changes that Mr. Zoran will be making on the Chief Revenue Officer side with the efforts to globalize the sales force and how far along those changes are.

Thank you.

Sure.

Sure, Gabriela.

Hi and good morning.

Yes, definitely Ron, as Chief Revenue Officer, hit the ground running because -- and that was our strategy, because he was coming from within with strong acquaintance.

And as we indicated in the past, we believe the opportunity is there in EMEA, but we were not close enough to some of the major deals that led to the Q3 results.

As you recall, we decided to overcorrect in a good way and replicate the processes we were doing in the Americas.

As it comes to the channels, it means we definitely leverage.

We have the top channels out there.

We cherry picked them over the years, and we're very pleased with our channel coverage.

But it means also make sure that we help them be successful, and also stay closer to the deals so that -- to have better visibility and really help the customer make the right decisions.

Beyond that, I would say that Ron has been very focused on, again, every -- of doing the right things for the long term opportunities, so building pipeline, demand generation, globalizing the teams, as I mentioned, both the account teams and the presale teams and the customer success teams.

And it's still work in progress, but we were very quick to start it.

That's helpful.

And as a follow up, if I could, it would be great to get a little more detail on some of the 7 figure deal momentum that you're seeing, maybe just some color on whether that's more Privileged Session Manager, Application Identity Manager, maybe a little bit of both, maybe more users covered on the system administration side or more assets covered.

And then typically when we see larger deals, those deals take longer to close.

But Josh, you actually mentioned that you saw a couple of 7 figure deals that came into the pipeline only in 2Q that actually closed in 3Q, so maybe just a little bit of color on what you're seeing there and how quickly those 7 figure deals are going from pipeline to cash.

Thank you.

Sure, sure.

So I would say, in general, top performing -- first of all, it was a mix.

I think the beautiful thing for us is that the 7 figures were in the new business and also in the add-on business, and quite balanced in that mix.

If I look at top performing products that you would find in the larger one, I would say the bread and butter Enterprise Password Vault, Privileged Session Manager, but also EPM is proving to be very strategic for us.

And then I would add AIM and PTA, especially in the large ones.

And so some of them have the base -- expanded on the baseline that they have with the EPV-PSM and then expanded into our growth products, PTA and AIM.

EPM also shows up in standalone deals.

And I think the deal that we were referring to that was related to ransomware is an example of a shorter life in the pipe.

But I would say in general, we're still seeing the same kind of sales cycle of 6 to 9 months.

And definitely on the larger deals, some of them have been nurtured for a longer period of time.

The high level explanation for the 7 figures is that more and more customers are thinking strategically and moving from the basic early start to a program.

And sometimes it's in the -- that takes place in the add-on business, but also we can land bigger in those that are thinking strategically and are really risk oriented.

Sounds good.

Thank you.

Thank you.

Our next question comes from Rob Owens with KeyBanc Capital Markets.

Your line is now open.

Good morning and thanks for taking my question.

I'd love to drill down a little bit more on Conjur, and you mentioned the community launch and the open source capability, just what end customer response has been.

I think it's a little bit different selling motion into the DevOps market, so how you've sharpened the pencil around go-to-market there.

Thanks.

Sure, Rob.

I think it's a very exciting opportunity.

We alluded to it a bit in the past, that as we acquired Conjur it's a very strategic move for us to capture security cycles that right now security teams don't have a handle on because developers are running very fast.

What they're developing in DevOps supports the top line of their -- of the companies that they work in, and security are trying to keep up.

The beauty of Conjur is enabling the security of DevOps without interrupting the way they work.

And so the selling motion has doubled.

We've continued with how -- we expanded how we were selling our application identity management for, I would say, enterprise applications, and now extending that to the cloud and our selling motion with security teams.

But we launched the community edition to seed the developer side.

And so it's very early.

In that world, you actually want to make it very easy for the developer to get up to speed and start using the solution while the organization views the more enterprise edition in a -- I would say later on in the cycle.

And so we'll provide more details on that, but for us it's the first time ever we launched the ability to seed the developer community.

And now when security and developer will talk together, there'll be, I would say, more coming together and less convincing to do.

Great.

And then secondly, I guess back to the pipeline discussion.

And you mentioned how the ransomware event pulled EPM in in kind of rapid fashion.

But we've obviously seen some other pretty material breaches and hitting major headlines.

I'm just curious.

How does that impact pipeline?

How does that impact sales cycle?

Is there any chance of compressing sale cycles kind of around the headlines and around people taking more action in near term?

Yes, Rob.

We always take a very, very long term approach.

And with the recent years, there were always -- there have been different incidents, and they've always helped in different education cycles of the market.

I would still talk about a 6 to 9 month sales cycle.

But if we refer to some of the bigger breaches that you mentioned that were non-ransomware, they helped -- they're helping customers really think program.

We have other examples where it's not only our EPM, our Endpoint Privilege Manager, but the full scope of the solution because customers saw the extent of what a mega breach can do to an organization and don't settle for just a Band-Aid.

They want to think of a program.

Great.

Thank you.

Thank you.

Our next question comes from Sterling Auty with JP Morgan.

Your line is now open.

Hey, hi guys.

Good morning.

This is Ugam Kamat on for Sterling Auty.

So results in EMEA were really good.

It was a solid bounce back from the second quarter.

Just wanted to dwell deeper into how much of the revenue was driven by deals that were slipped from Q2 and getting closed in 3Q was signing new deals.

So first of all, on that front we were pleased to see the turnaround, but I also still define that as work in progress.

And as I answered earlier, we're globalizing the sales team, and we see a lot of continued opportunity there.

But yes, that was a healthy quarter in Europe.

And it was important for us to see that deals that slipped -- as we were saying on multiple calls, that the deals that slipped in Q2 were very much alive.

And so we were pleased to see them close, but we're not breaking out the division between how many were Q2 and how many are Q3.

Okay, that makes sense.

And you mentioned that EPV -- that the Enterprise Password Vault and the Privileged Session Manager have been the top products for your customers.

How are you seeing the deployment of these products beyond the admin workers and to the knowledge workers?

So the scope of our basic products is to anything that requires privileged access, so the built-in powerful accounts that are in every piece of the IT infrastructure.

And so one lens is how many humans actually have to go and access it, but the other lens is the scope of the IT infrastructure and how many servers they have, how many applications and so forth.

Usually these products, in terms of human users, they are mostly either IT or developer type roles or third party vendors.

But the minority of cases are also in business use cases like securing social media accounts and other shared accounts that are used by the business part of the organization.

That's with regards to EPV and PSM.

With our EPM, our Endpoint Privilege Manager, we're actually securing all endpoints.

And that very much correlates to the amount of employees that the company has.

So it's as many employees as they have with desktops and laptops, etc.

Thank you.

Our next question comes from Jonathan Ho with William Blair.

Your line is now open.

Good morning.

I just wanted to start out with a little bit of thought around 2018.

I know it's a little bit early for guidance, but is there any way that you can maybe give us some thoughts about the growth trajectory of the business, just given some of the moving parts around the sales reorganization?

Hey, Jonathan.

This is Josh.

You're right, it is too early to talk about 2018.

In our business, perpetual enterprise software, Q4 is a critical quarter for the pulse of the business and the pulse of the market.

And so for that, we don't really -- we're not talking about 2018 yet.

But I will say, similar to what I talked about earlier, is that in terms of the confidence we have in the demand environment, and also that we believe that the market -- and if you talked about what the market analysts are showing for growth in the privileged account security area and we look at our pipeline growth internally, we look at the deal openings that we're doing in Q3 and going into Q4, which will be hot for 2018, we do think that the growth is higher than what we're doing this year in license growth.

And certainly we anticipate improved license growth in 2018 compared to today.

And Jonathan, like Josh said earlier, that we made this globalization of sales.

We also have a global service department.

And we think we can really benefit from this globalization as you match it to the opportunity that Josh described.

Thank you.

Our next question comes from Melissa Franchi with Morgan Stanley.

Your line is now open.

Thank you for taking my question.

Udi, just to follow up on the sales force globalization, so you have been characterizing it as ongoing.

But just to put a finer point on it, where are we in the cycle in terms of undergoing those changes?

Is it still just largely the beginning, or is the hard work largely behind you?

I think it was very important for me to really make sure there's no unnecessary disruption.

And first of all, good morning, Melissa.

It was important for me to not have any unnecessary disruption by lack of clarity.

And I was very pleased with how we launched it internally, the acceptance of the team, how Ron was, as I mentioned before, respected.

And therefore it was perceived as a very smart move internally within CyberArk, but also within our partners.

And so we were able to start it fast.

And as I said, he knew the team.

He knows the business well.

But on the -- if I had to paraphrase it to innings, I would say it's still early innings, but the team is in the field and working and focused.

Okay, that's helpful.

And then you commented on the competitive landscape in the midmarket.

Wondering if you could just refresh our memory on what percent of the business the midmarket represents for you today.

And do you feel like that's an opportunity to put more investment behind, or do you feel like there's enough opportunity in the enterprise space where you're going to just continue to focus on that?

Oh, great, Melissa.

So first of all, as a pioneer in the market, we always led.

And we pioneered the entire market.

And we were focusing on enterprises for all these years, and we see a massive opportunity there.

I would say that the midmarket is still a small part of our customer base.

And we weren't directly marketing or focusing our marketing efforts there, but we're still finding pick up and accounts.

So the long term opportunity, we're definitely going to go after it.

And some of the initiatives we have to better serve our enterprise customers are going to serve the midmarket.

And everything that we're doing on extending to the cloud and really being -- with supporting hybrid environments and the ability to install CyberArk in the cloud, like the Amazon Machine Imagine that we described in the past, these are all things that will continuously make it easier for us to go down market.

I would say it's still in the longer term opportunity, and we will continue to fine-tune to go after that as well.

Got it.

Thank you.

Thank you.

Our next question comes from Gray Powell with Deutsche Bank.

Your line is now open.

Great.

Thank you.

Maybe just to follow up on one of the prior questions, so it looks like things have bounced back fairly nicely in Q3.

How quickly do you think Europe can get back to growing at the same pace as the rest of the world?

I think -- I would say in terms of the educational and the urgency, we're still seeing the Americas be as the market where it's the most well understood that you need this critical security layer.

And in Europe, we're still early, which I think is part of the opportunity, is how do you replicate and extend the fact that we have major enterprises in the top metropolitan areas in the Europe that you can then leverage as reference and go after it.

But it's still an earlier market of associating with risk and buying based on risk.

But we're making the right long term investments in education and demand generation and really doing what's right for the customers, explaining to them the -- where to start, how to really roll out a privileged account security program, the 30 day sprint elements that CyberArk has innovated in.

So I would mark it as a long term opportunity, but it's there.

Thank you.

Our next question comes from Fatima Boolani with UBS.

Your line is now open.

Good morning.

Thank you for taking the question, a question for Udi just along the lines of still evangelizing and educating the markets outside of the States.

Particularly in APAC, the business there continues to build but we're still looking at a small base.

So I'm wondering if you can talk to if there's something structurally different in the APAC region in terms of demand or spending patterns that's not allowing the growth to really inflect in that region.

And then I have a follow up for Josh, if I may.

Sure, sure.

Hi Fatima.

I'd actually say that if you take a year-to-date view on APJ, we will see that in the first 9 months of the year we grew 42%.

So it's actually a good market for us.

Last year we talked about rebuilding it.

We changed leadership with a new VP, who built up also the regional directors.

So we actually see it as a market with a great opportunity, very similar drivers, and again, that can also benefit from the globalization that we've done, just excellent channels that we partnered with early in the cycle and now can leverage for the long term.

Fair enough.

And Josh, for you, in the prepared remarks both you and Udi talked about the magnitude of the 7 figure you've been able to close.

I'm wondering if there is a deferred product component that we should think about in your deferred revenue, considering the size of these deals and presumably more complex and sophisticated deals.

And that's it for me.

Thank you.

Yes, Fatima.

Thanks a lot.

Actually, the deferred revenue balance is as it has been for the last several quarters.

Over 90% of it is our standard maintenance and support contracts.

And the amount that's related to SaaS subscription and really very, very little perpetual is kind of in the 7% of our total deferred.

So it hasn't -- even though you're right, we did a record number of 7 figure deals, but -- they were delivered and recognized, but they did have large maintenance components, obviously, which you will see in the deferred revenue.

Thank you.

Our next question comes from Shaul Eyal with Oppenheimer.

Your line is now open.

Hey guys, good morning.

This is Tanner Hoban for Shaul.

Just on the heels of some headlines, cyber attacks and with GDPR on the horizon, EMEA bounced back with some strong growth.

Outside some of the deals that leaked from 2Q, are you seeing any changes in the demand front there or any heightened interest as a result?

We keep a very close lookout on seeing how GDPR really translates, and I know that you are.

What we're hearing from the channel is that the right strategy is the long term one because there's still uncertainty for many customers as to what does serve as compliance.

It's not a prescriptive regulation.

What we are seeing is that it's an additional supporting tailwind for deals that are in place to go through in the process.

It's not a demand generator as a standalone.

But when you complement that with the -- controlling our destiny and the efforts we're making in generating demand, we think it overall is adding as a positive.

But it's not a prescriptive -- or at least not yet.

It's not a prescriptive regulation like PCI was and others, or NERC in the energy where it's very clear that privileged account security it what you need to do.

But we believe privileged account security is a pillar, a critical pillar, if you want to achieve data protection.

And we market it in a very credible way with our partners in the field.

Thank you.

Our next question comes from Gur Talpaz with Stifel.

Your line is now open.

Great.

Thanks for taking my questions.

So I wanted to ask a bit more about the public cloud solution set.

You talked about a few nice deals in the quarter.

But I was hoping you could elaborate a bit about how the technology is differentiated from the competition and, more importantly, whether you're starting to see solutions actually move the needle as far as pipeline.

Thank you.

Yes, absolutely.

We were early to -- and hi, Gur.

We were early to recognize that it is strategic for us to extend our solutions into cloud.

So we started with the ability for the on-premise enterprise to expand its deployment to secure cloud assets.

We added on that the ability to discover cloud credentials and keys, and then the ability to also deploy CyberArk in the cloud.

With the acquisition of Conjur in May, we really opened up a huge gap.

We're the only vendor that can talk about taking customers' applications all the way from their on-premise and more static applications and into DevOps.

I would say 70 -- there's industry reports that talk about 74% of enterprises are moving their application development to DevOps methodologies.

And it positions us very well to capture that, even for the customer that's just mapping out their cloud strategy to see, okay, we partner with CyberArk because they can take us on this journey even if they're solving more on-premise and more low hanging issues before moving into DevOps.

Thank you.

Our next question comes from Andrew Nowinski with Piper Jaffray.

Your line is now open.

All right, thanks.

I think you said your year-to-date revenue growth in the Americas was 21%, which is well above the market growth rate, and it's in line with what some of your competitors such as BeyondTrust and Centrify are growing at.

But are you concerned with the deceleration in growth in the Americas in Q3 down to 16% given the record contribution you had from the U.S. federal?

And do you think it can bounce back to the 20%'s going forward?

Yes.

Go ahead, Josh.

Sure.

First of all, I definitely think we can increase that growth rate going forward, also just in line with the fact that the market can support that.

I think when we look at the Americas, the deals are larger and it does create some lumpiness from quarter-to-quarter.

So I appreciate the fact that you looked at the 9 year, because it helps to really smooth out the true growth rate.

The 9 month.

The 9 month to truly smooth out the growth rate of the year.

And as Udi mentioned earlier, in Americas it's truly in terms of the market.

It's got the -- still the healthiest pipeline and overall the strongest demand environment.

And Andrew, I would add on the federal side, you're right.

It was a record quarter for us, and we're pleased with that.

But we're also pleased with another factor that we have on the federal side.

It's that some of our deals are not related to the Q3 fiscal year-end budget, but are on a different schedule that behaves more like we're seeing in the civilian industry.

And therefore, we also have federal deals that are in play for the rest of the year.

Thank you.

Our next question comes from Gregg Moskowitz with Cowen & Company.

Your line is now open.

Yes, hi.

This is Mike Romanelli on for Gregg this morning.

Thanks for taking the questions; I guess two quick ones from me.

Firstly, what percentage of deals had three or more products in the quarter?

I believe it was just -- it was over 20%.

Yes.

20%.

Yes, over 20%.

Okay, great.

And I guess just secondly, what was the mix of cloud to on-prem deployments of EPM this quarter?

Thanks.

Yes.

Actually, if we look at the on-prem, it was -- we've been seeing kind of a 50% to 60% mix kind of over the last year.

If we looked at it this quarter, actually there was a bit more on-prem.

But overall over the 9 months, it's still 60% on-prem, 40% SaaS mix for that product.

Thank you.

Our next question comes from Erik Suppiger with JMP Securities.

Yes, congrats on a good quarter.

On the EPM product line, can you give us a sense for what you're seeing in terms of growth or contribution?

I think when you bought Viewfinity, you had talked about $10 million annually, growing in the high teens.

It sounds as though you've seen some acceleration.

Can you provide some context around that?

Sure, Erik.

First of all, thank you.

We're very pleased with -- and looking back, it was a very -- we're very pleased with the acquisition and the team behind Viewfinity, and also in how we combined it with Cybertinel to create the EPM offering.

We don't break it down in terms of numbers.

But we see it having both deals where it's sold in line with other products, but also it lends itself to standalone new business deals, which is -- creates another landing point for us and truly delivers value to customers that are worried about infection.

And the attack cycle does start mostly on the endpoint.

And we're perceived as truly complementing other investments they have made more on the antivirus or next generation antivirus side.

And it's a hardening of the endpoint that's not connected to or doesn't have to know what is the malware that is landing with our application security and our credential theft blocking.

And in general, I would say we're proud to see contribution from investments we're making.

And EPM is a good example for that.

Thank you.

Our next question comes from Catharine Trebnick with Dougherty.

Your line is now open.

Oh, thanks for taking the call and the nice quarter.

Udi, could you clarify?

You said in your prepared remarks that the channel was 30% of total revenue.

Could you clarify that?

It was 30% or 60%.

Did I hear you wrong?

It was 60%.

Oh, okay.

Hey Catharine.

Good.

I was like, ah, I must have really -- okay.

And then as part of the globalization effort, where does new channels partners, or actually facilitating more efficiency through the channel partners fit in?

Thank you.

I think Ron is continuing the strategy that says it's quality over quantity in terms of the channel.

And as -- first of all, he had the biggest piece already with the Americas channel and the LATAM channel before, but now expanding into EMEA and APJ.

It's very much how do we further enable our channels to carry more of the weight, but combining that, as I said earlier, with visibility for CyberArk and the ability to make them successful.

And they view that as very beneficial, because we're -- by being with them in the field, there's a faster knowledge transfer to make them even more successful.

But in general, I really think we have the first mover advantage, going after international markets very early on and really cherry picking top channels, and now it's just about making them more successful.

And of course, in some regions we'll add more channels and beef it up, but we think we have the top channels to work with.

Thank you.

Our next question comes from Howard Smith with First Analysis.

Your line is now open.

Yes, thank you.

Good morning Josh, Udi.

My question…

Morning.

Has to do with kind of an intersection of the vertical success and some comments you've made around the geography stage of adoption, particularly a risk-based approach.

Are you seeing Europe and APAC kind of adopt by vertical and understand the risk-based approach behind the U.S. by vertical, or kind of once the geography starts to get it or a country, are they adopting in energy and pharma and stuff and you're able to translate that?

So I'm trying to understand a little bit how the vertical rollout is going internationally.

Sure.

Sure, Howard, and good morning.

I think in every new country, we always saw that the first adoption in general was financial services historically.

And it's close to scientific in any -- as we expanded.

Also when we expanded to new -- to LATAM, for example, as we -- you see that financial services is kind of on the first mover.

Beyond that, there are sometimes compliance drivers that are vertical and can lend itself.

So of course, financial services has them, but also in the retail space, as an example, where we can see that success breeds more success within that vertical.

And I would say we're doing the combination, really, I would say, educating on risk, which is a horizontal driver, and leveraging compliance, which is a vertical driver.

So you're right on that point.

Thank you.

Our next question comes from Alex Henderson with Needham & Company.

Your line is now open.

Thanks.

I was hoping you could talk a little bit about the tradeoff between accelerating growth as you focus on the globalization of your sales force and the leverage that you might be getting on your operating margins as you invest in front of that growth and productivity from new salespeople.

Should we be thinking about sales and marketing expenses moving up as a percentage over the next two or three quarters and then starting to get the leverage in the back half of next year?

How can you -- how do you think about those two trajectories playing against each other?

Yes, okay.

So we are continuing to invest in sales and marketing dollars.

So on a nominal dollar basis, we can expect continued increases in those areas.

We have done that consistently for the last couple years, and we've -- for the last many years, and it's really because of where we are and the opportunity in the -- and it's a greenfield opportunity, and we still feel like we're in the early stages of that opportunity.

And we believe that this is -- can provide a high growth environment.

So I think as we look -- we've given the guidance for Q4.

But I think certainly as we look forward, increasing the sales and marketing, I don't know how it's going to translate yet to leverage on Q1 or Q2.

But we can anticipate that there'll be an increase certainly in nominal dollar spending going over the next couple of quarters.

Thank you.

Our next question comes from Ken Talanian with Evercore ISI.

Your line is now open.

Hi guys.

Thanks for taking the question and congrats on the quarter.

So I wanted to follow up a bit on that vertical question.

Are you actually seeing accelerating demand in any particular verticals where you may have not historically seen strength?

It really varies by -- in different quarters we have highlighted the different verticals that popped up, so I wouldn't say that there's one.

But there are some new verticals that are jumping into the fray like manufacturing and pharma, where I would say were slower on the growth and really see the connection in privileged account security and protecting their IP and their enterprise.

We actually doubled in pharma, doubled in transportation and in energy.

But if you look historically, it's really just -- the opportunity is there for us to go cross vertical and I would say leverage the happy and growing customers in each one for the others.

We've been playing in all verticals for a long time, and some more in a seeding fashion and some in a dominating fashion.

And now it's about scaling it.

Thank you.

That concludes our Q&A session.

I would now like to turn the call back to Udi Mokady, Chairman and Chief Executive Officer, for any further remarks.

Thank you.

I want to thank you customers, partners, and our employees worldwide who all contributed to our successful results this quarter.

Thank you again all for joining the call today.

Thank you.

Ladies and gentlemen, thank you for participating in today's conference.

This concludes the program.

You may disconnect.

Everyone have a great day.