Cyberark Software Ltd (CYBR) 2019 Q2 法說會逐字稿

Good morning.

My name is Julie, and I will be your conference operator today.

At this time, I would like to welcome, everyone, to the CyberArk Second Quarter 2019 Earnings Conference Call.

(Operator Instructions)

Thank you.

Ms. Erica Smith, Investor Relations, CyberArk, you may begin your conference.

Thank you, Julie.

Good morning.

Thank you for joining us today to review CyberArk Second Quarter 2019 Financial Results.

With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; and Josh Siegel, Chief Financial Officer.

After prepared remarks, we will open the call up to a question-and-answer session.

Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management's best judgment based on currently available information, specifically our expectations and beliefs regarding our projected results of operations for the third quarter and the full year 2019.

Our results -- our actual results might differ materially from those projected in these forward-looking statements.

Please see the risk factors contained in the company's annual report on Form 20-F filed with the U.S. Securities and Exchange Commission and those referenced in today's press release.

CyberArk disclaims any obligation or undertaking to release publicly any updates or revisions to any forward-looking statements made today.

Additionally, non-GAAP financial measures will be discussed on this conference call.

A reconciliation to the most directly comparable GAAP financial measures is also available in our earnings press release, which could be found on www.cyberark.com in the Investor Relations section.

Also please note that a webcast of today's call will be available on our website in the Investor Relations section.

With that, I'd like to turn the call over to Udi Mokady.

Udi?

Thanks, Erica, and good morning, everyone.

Thank you for joining the call today.

We're pleased to exceed expectations across all guided metrics.

Revenue reached $100 million, growing 29%.

Our revenue outperformance, disciplined investments and strong business model resulted in $26 million of operating income for the quarter and in the first 6 months of the year, we generated a $67 million in cash flow from operations.

Given the strength of our business in the first half, we are raising our guidance for the full year, which Josh will talk about later in this call.

Demand for our solution remains strong across the Americas, EMEA and APJ, and we continue to see broad market tailwinds.

While digital transformation and cloud migration strategies are accelerating business operations, they are also exponentially increasing the complexity of enterprise IT, creating opportunities for CyberArk with new and existing customers.

In addition, regulators are flexing their muscles making headlines in the last few weeks by imposing staggering fines of $700 million, $250 million and $125 million related to breaches.

The stakes have never been higher in security, and in almost every successful breach, a hacker infiltrates the network or cloud environment and exploits privileged access, putting our solution at the top of Chief Information Security officers' priority lists.

In today's environment, organizations are prioritizing proven and measurable solutions that deliver value.

They recognize the securing privileged identities, human and non-human, is the foundation of the strong cybersecurity strategy.

In fact, industry analysts, again, listed protecting privilege as one of the top 10 most impactful security projects for 2019.

Privileged access extends across all enterprise IT and the breadth of our solutions simplifies the customer journey.

A customer typically secures the most critical assets in the applications first and then expands, increasing the number of users, adding our application and endpoint solution and ultimately extending protection enterprise-wide across on-premise, cloud and hybrid environments.

This is driving add-on business, which, again, represented just over 60% of license revenue in the second quarter.

On the new business front, we won more than 200 new logos in the second quarter and are now helping secure over 4,800 organizations around the world.

The majority of our new business continues to be greenfield, and we are often surprised to see large enterprises managing privileged accounts manually.

Overall, in both new and add-on deals, our results were well diversified across industries, customer size as well as geography, demonstrating that every organization needs to secure privileged access.

In the second quarter, 6 verticals grew by 40% or more including insurance, manufacturing, media, pharmaceuticals, retail and transportation.

We continue to see strong traction with our newer solutions.

We were thrilled with our record quarter for Endpoint Privilege Manager including record SaaS bookings.

Most breaches begin at the endpoint, removing local administrative rights, running a least privilege is recognized as a foundational pillar of security best practices from institutions like the Center for Internet Security, CIS, and the National Institute of Standards And technology or NIST.

Our platform provides customers with end-to-end visibility into privileged activity from endpoint through on-premise and cloud environments.

In addition, Application Access Manager continues to gain momentum and was included in half of our top 10 largest deals in the second quarter with an increasing number of customers also landing with this solution.

As organizations migrate workloads to the cloud and implement digital transformation strategies securing applications is increasingly important to reduce the attack surface.

Our more than 200 integrations are a major competitive differentiator in the market, reducing the friction of securing mission-critical applications and making it easier for customers to strengthen their overall security posture.

Securing Robotic Process Automation, or RPA projects, was a trend, again, in the second quarter.

To successfully automate and standardize human processes, RPA robots need access to multiple essential applications and systems.

Customers are increasingly turning to CyberArk to secure leading RPA vendors, like Automation Anywhere, Blue Prism and UiPath.

I want to highlight a few powerful new and add-on customer examples.

In the greenfield opportunity, a large global manufacturing company landed with Endpoint Privilege Manager and Core Privileged Access Security.

The firm's new Chief Information Security Officer quickly identified securing privileged access as a top priority.

They chose CyberArk because of our leadership position, ongoing investment and innovation and ability to provide visibility into privileged activity enterprise-wide.

A government agency, in EMEA, had a specific GDPR use case, which was to -- which was extended to also secure its applications and IT environment with a comprehensive PAS program.

A European media company expanded its deployment of CyberArk.

The customer wanted to mitigate the risks of cyberattacks across its European operations.

The simplification of our solution and licensing as well as our ability to secure its digital transformation strategy and AWS environment were meaningful contributors to this seven-figure add-on deal.

A U.S. federal agency extended its coverage with Core PAS and added Application Access Manager and Endpoint Privilege Manager.

The agency wanted a single view into its privileged activity enterprise-wide including its AWS environment.

And our largest deal in the second quarter, a financial services firm in the Americas is expanding with Core Privilege Access and Application Access Manager for its mission-critical, customer-facing applications.

They have a multi-cloud environment and will leverage CyberArk to secure both AWS and Azure.

Our unwavering focus on innovation is critical to extending our leadership position.

We continue to set the standard and defined the market for Privileged Access Security with the early July introduction of CyberArk Alero, our latest SaaS solution.

Alero helps customers mitigate the risk of third-party vendor access to critical systems.

We are the only vendor to combined zero-trust access, biometric authentication and just-in-time provisioning without the use of VPNs, agents or passwords.

Our new solution makes it simple and easy for customers to manage remote vendor access.

We also enhanced Endpoint Privilege Manager to provide just-in-time administrative access to windows and Mac endpoints on demand.

Given our security-first approach, we're also providing customers with a full audit log and the ability to revoke access as needed.

The combination of Alero, CyberArk Privilege Cloud and Endpoint Privilege Manager is the most comprehensive SaaS portfolio for privileged access in the market.

Customers can deploy or access CyberArk anywhere, on-premise, in the cloud or as a service.

Our latest innovations were introduced at our recent CyberArk Impact event for customers and partners in Amsterdam and in Chicago.

These events were our most successful yet and marked the largest gathering of Privileged Access Security professionals in the world with more than 2,500 attendees.

Partners also had an opportunity to dive into the new CyberArk partner network.

This Partner Enablement Program connects our ecosystem of advisory firms, global system integrators and regional solution providers and introduces enhanced competences-based tiering and certifications.

The indirect channel represented about 65% of our revenue in the second quarter.

We believe, this new partner program provides us with an opportunity to accelerate momentum with our channel and advisory partners.

As part of our ongoing commitment to helping customers secure the cloud environments, we expanded our relationship with Microsoft by joining the Microsoft Intelligent Security Association.

We are working with Microsoft to deliver joint customers, greater flexibility and efficiency for securing privileged access.

Our enterprise customers can more easily deploy our solutions in Azure and consistently enforce security and compliance across hybrid environments.

As you saw in our release today, we also announced that Ron Zoran will be transitioning out of CyberArk to help grow and scale early-stage organizations as a board member.

Ron was one of the very first employees at CyberArk and played an important role in defining privileged access as a critical layer of security and in establishing CyberArk as The de facto leader in the space.

Like all strong leaders, Ron has built an exceptional sales organization with strong leadership across all regions.

We have initiated a search for a new Global Head of Sales.

Ron will continue to serve as Chief Revenue Officer through September 30.

To help ensure a smooth transition, he will continue as an adviser into the first quarter of 2020.

We appreciate his ongoing commitment to the company.

Our financial performance continues to demonstrate our significant market opportunity.

The increasing awareness of Privileged Access Security as a critical layer and our ongoing commitment to delivering profitable growth.

With that, let me turn it over to Josh, to discuss more details about our strong Q2 results.

Josh?

Thanks, Udi.

As Udi mentioned, we had a strong second quarter with total revenue growing by 29% year-on-year to $100.2 million.

License revenue reached $52.2 million, increasing 27% over the second quarter last year and representing 52% of total revenue.

We showed growth across all geographies and for both new and add-on business.

On the product side, Application Access Manager represented about 9% of license revenue and Endpoint Privilege Manager represented about 7%.

In the second quarter, we were again pleased to see the strong growth in EPM bookings derived from SaaS deals.

Maintenance and professional services revenue was $48 million, increasing 31% year-on-year and representing 48% of revenue.

The professional services revenue associated with this line was $9.2 million or 9% of total revenue.

The business was well diversified across geographies.

The Americas revenue grew 28% to $61.8 million and represented 62% of total revenue.

EMEA revenue also increased 28% to $28.7 million or 28% of total revenue.

APJ achieved a record $9.7 million of revenue growing 41% and representing 10% of total revenue.

As I move through the P&L, all line items will be discussed on a non-GAAP basis.

Please see the full GAAP to non-GAAP reconciliation in the tables of our press release.

Our second quarter gross profit was $87.7 million or 88% gross margin, consistent with last year's 88%.

We are continuing to invest in the business to deliver innovation, drive growth and scale the operations.

R&D grew by 24% year-on-year to $14.6 million.

Sales and marketing increased 19% to $38.6 million, as we expanded our sales organization across all geographies to support direct and indirect sales.

G&A expense increased 16% year-on-year to $8.1 million, as we continue to scale the business to support our growth.

In total, operating expenses for the second quarter increased 20% to $61.2 million compared with $51.2 million for the second quarter last year.

With our disciplined investments and revenue outperformance, we, again, delivered operating income ahead of our guidance at $26.5 million or 26% operating margin compared with the $17 million or 22% operating margin in the year ago period.

Our overall expense growth is primarily related to headcount, and we ended the second quarter with 1,254 employees worldwide compared with 1,077 at the end of the second quarter last year.

We ended the quarter with 588 employees in sales and marketing compared to 513 at the end of the second quarter last year.

Net income was up $23 million or $0.59 per diluted share for the second quarter of 2019 compared to $13.5 million or $0.36 per diluted share for the second quarter last year.

We are pleased to generate $67.3 million in cash flow or 34% margin for the first half of 2019.

That represents an increase of 20% over the first 6 months of last year.

The strong cash flow continues to be driven by strong collections as well as our high maintenance renewal rates.

As a result, we ended the quarter with $538 million in cash and investments.

This compares to $451 million in cash and investments at year-end, and we ended the second quarter with $174 million in total deferred revenue, a 34% increase from $130 million at June 30, 2018.

Turning to our guidance.

As a reminder, our guidance does not consider any potential impact of financial, other income and expenses associated with foreign exchange gains or losses, as we do not try to estimate future movements in foreign currency rates.

So for the third quarter of 2019, we expect total revenue of $102 million to $104 million or 22% year-on-year growth at the midpoint.

We expect non-GAAP operating income to range between $21.8 million to $23.3 million, and non-GAAP net income per diluted share of $0.45 to $0.48.

The increase in our expenses in the third quarter is primarily related to seasonal employee expenses and our major third quarter marketing programs.

Our guidance also assumes 39.4 million weighted average diluted shares at the tax rate of 21% for the third quarter.

Because of our first half execution and demand for our solution, we are increasing our guidance for the full year of 2019.

We expect total revenue now to be in the range of $419 million to $423 million or a growth of approximately 23% at the midpoint.

We are also increasing our guidance for non-GAAP operating income to be in the range of $106 million to $109 million and non-GAAP net income per diluted share of $2.24 to $2.30.

This is assuming $39.1 million weighted average diluted shares and our guidance for the full year assumes an effective tax rate of approximately 21% for 2019.

We are pleased with our execution and our results in the first half of 2019 and it positions us very well for the remainder of the year.

I will now turn the call over to the operator for Q&A.

Operator?

(Operator Instructions) And at this time your first question comes from Saket Kalia with Barclays Capital.

Maybe, Udi, just to start with you.

From a product perspective, it seems like the momentum for Application Identity Manager, and I'm guessing, Conjur as well, continues to be strong.

Can you just dig into that a little more?

Why do you feel like we're seeing that demand for AIM currently?

And maybe related to that, how do the economics for AIM compared to Core PAS, if that's comparable at all?

Sure, sure.

So like we highlighted, there was a record quarter for Endpoint Privilege Manager, which really has its drivers around the fact that the tax began at the endpoint and it's becoming a no-brainer or let's not let users run with full privileges on the endpoint and make it easy for an attacker to exploit a lender, that's our Endpoint Privilege Manager.

And with regards to AAM, it's super-strategic as part of digital transformation strategies of our customers.

And so whenever we come to an existing account or a new prospect, they are somewhere on that journey to moving their applications to modern infrastructure running on containers.

And again, securing those keys and credentials is key.

It's still a smaller -- obviously, it's still smaller part compared to our Core PAS.

Core PAS is the prime growth of the ship, but it's behaving like a growth engine and is super-strategic for us.

And Saket, when we think about the economics behind the AAM versus our Core PAS.

Well, first of all, it's -- again, it's pure software.

So on a margin basis, it's a very, very high margins related.

It probably drives also equal amount of services as well.

It's priced a bit differently in the context of -- because it's both dynamic and for non-dynamic application environments.

But overall, we think about organizations that, that would require it across the entire organization, the value of it would certainly be very close to the value of a Core PAS for that organization.

Got it.

That's helpful.

Josh, maybe for you.

Just in terms of revenue, nice beat on license, but also an even bigger beat versus $9 million on maintenance and services.

Can you just talk a little bit about the breakout there within maintenance and services?

What the split was between the two?

And sort of how you think about that going into the second half?

Yes.

I think when we look at the support and maintenance, that number included -- I think I talked about, it was $9 million?

9%.

9% of total revenue was professional services.

The next question comes from the line of Sterling Auty with JPMorgan.

Just to clarify that, I think we get to the same number.

But I think in the prepared remarks you said $9.2 million of services?

Yes.

Exactly, and that's 9% of total revenue.

Perfect.

Just wanted to make sure.

So Udi, in terms of your Chief Revenue Officer deciding to work with smaller companies, any additional insight as to why now?

Yes.

Absolutely.

First of all, I wanted to be down in the book as the best possible and most amicable transition in recorded history because it's both -- it's a long time and strong relationship and friendship, and he's been with us basically from the beginning of time.

And so the timing is his decision, but -- and everything he says and articulates, he's just very proud of where we are as a company and the opportunity for us.

And after so many years in a demanding operational role, he wants to contribute, from his experience, to startups and early-stage companies, mostly as a board member and an investor.

And so it's really, I would say, a good timing for him and for us the best possible transition because he's leading the charge for Q3.

He's staying with the company all the way into Q1 and allowing us to really make this the best transition, take our time.

And like we said, we launched a search for -- and we'll be very selective to make this a great fit and leverage the strong leadership we already have in place across the regions.

That makes sense.

And then you mentioned a new partner program.

Is that rolled out globally?

And when was that in effect?

So in other words, is everybody trained and up and running and on the same page in all 3 theaters?

Yes.

Absolutely.

We had the opportunity to launch it at the -- at our major events in Europe, in Amsterdam and Chicago for the Americas, but also earlier in several of the APJ regions.

And we did it very thoroughly where we gave partners a heads up about it coming into effect.

Where essentially it's taking CyberArk to the next step.

The demand is there.

It's top priority now across geographies.

We really want to leverage our partners to be more capable, more enabled, as they go to market.

So it's basically more rewarding, the more they invest in getting up and running and trained.

And launching it within these big events is just a great platform because they have the opportunity to see full road map, everything that -- the upside for them and hear more about the program and get up to speed.

Your next question comes from Gur Talpaz with Stifel.

Udi, I wanted to ask if you would classify what you're seeing as a sort of infection in terms of demand for cloud solutions.

And that's whether because of the launch of new solutions like Alero or because of just general increased market awareness.

But you talked a lot about it on the call.

And I'm just kind of curious to see if you would sort of classify that kind of terminology?

Yes.

I think that in every customer and the beauty is that no matter where we are in the region, we find that they're somewhere in their journey.

By the way, you still have those that are just tiptoeing and you have those that have moved all-in and somewhere in the middle.

And we wanted just like more diverse from a geography and a vertical perspective.

We always want to be diverse on where they are on their cloud journey.

And for many of them, it's the ability to deploy CyberArk in the cloud or for CyberArk to secure their cloud infrastructure.

But also new offerings, if we can deliver them as a service, we're definitely playing to their modern appetite.

And for example, Alero, which we're very excited about was -- we saw increasing demand for customers to expand privileged access to also those third parties that need privileged access and need to get into their infrastructure.

And the decision was rightfully, okay, we'll build this and launch this as a service and expand our SaaS portfolio.

The CyberArk Privilege Cloud is more intended towards mid-market, and we launched it for that, for the customers with an appetite to consume privilege as a service so that they'll have that.

And of course, EPM, which had a record quarter, most of it, like the majority of the EPM was consumed in SaaS.

When it -- when we go -- when we look at Core PAS, we still see that enterprises want to own and put the keys to the kingdom mostly on-premise, but they have a variety of options and we cater to that.

And you're next question comes from Rob Owens with KeyBanc Capital Markets.

Udi, at the high levels, we're hearing about some disruption in Europe.

Maybe you could -- you had obviously a successful quarter there.

But just give us some color, in general, relative to what you guys are seeing at this point?

And any potential economic warning signs?

Absolutely, Rob.

I think I'm fresh to actually a deep dive on the European business.

We were very pleased with 28% growth this quarter.

We asked about macro.

Obviously, they're waking up in the morning and they're reading the news and -- but they're not seeing it translate directly into the pipe or the opportunity.

And so I would say that, right now, it has not translated and, again, perhaps it's a matter of privilege being really in the high priority and not a nice-to-have privileged access being foundational.

But of course, we stay very close to it and stay tuned.

Diversity is really a big part of our strength, so it's also diversity within the region.

And a follow-up for Josh, relatively a couple of the balance sheet items.

The deferred revenue, I don't think, met The Street expectations, but was in line with where you guys have been historically Q1 to Q2, if I look back a couple of years.

So maybe some of the puts and takes around deferred.

And then number two, your DSOs did spike quite a bit sequentially.

Did that speak to the linearity of the quarter?

Yes.

So thanks, Rob.

On the deferred revenue, I think you kind of nailed it in terms of the where we are and the seasonality.

This was where we thought we'd end up around on deferred revenues.

Let's not forget it is a 34% year-on-year increase, so nevertheless, still a nice growth rate.

Deferred revenue for CyberArk is predominantly the support maintenance contracts, which have their seasonality and ebbs and flows for when we book them and they're aligned with the licenses.

So with the Q3 and with Q4 being the heaviest license period of the year, and then it starts -- then it dips down in the first half of the year, which is why you see lower deferred revenue growth.

But we're aligned with where the deferred revenue growth is, and I think you've pointed it out, it's in line with the seasonality that we've seen in the past.

With regard to DSO, actually the linearity was fairly close when we look at it from a month-by-month and weekly perspective into the last month of the quarter.

It's 41 days.

It's a bit of, I think spiking is a bit of a tough word when it only jumps -- when it's only 41 days compared to mid-30s, as it was in Q1.

But overall, it's very much in our range of comfort zone for DSO.

Next question comes from Daniel Bartus with Bank of America.

I wanted to ask first about just recurring revenue, in general.

So imagine most of the maintenance line is recurring and then you have a decent amount of SaaS now in the business.

I remember from the Analyst Day in the past, you guys showed that pretty steady repeat selling to existing customers every quarter too.

So you add all those up, I was just wondering, how much of your revenue would you now classify as recurring or recurring like?

And how do you expect this trend going forward?

Yes.

So still the majority of our deferred revenue and recurring revenue is coming out of maintenance.

We do have some SaaS, which is building certainly with the growth of the business and term-based licensing, which is growing in the course of business.

So I would put the number roughly 40% in terms of recurring that we have today.

And then on top of that, as you've kind of pointed out is that we have a pretty consistent stream of recurring revenue.

In fact, about just over 60% of our license revenue -- I mean, I want to talk about recurring customers, just over 60% of our existing customers came back also in Q1 and also in Q2 this year and purchased additional licenses.

So it's something that we've seen consistently over the last few years, and while we don't know exactly and always who will be coming back and for how much, we have consistency for recurring -- for customers coming back and purchasing more each quarter on top of the 40% of contractual recurrence.

Your next question comes from Jonathan Ho with William Blair.

Congratulations on the strong results.

I just wanted to start out with Version 11 of your product.

And do some of the new features like geographic distribution, maybe open up some new opportunities with your customers.

Yes.

So this was, I would say, Version 11 really was a major enhancement for us.

And a lot of it has to do with customers who really deploy CyberArk at scale and a big part was what we call the active/active vault where it really allows them to trust the infrastructure to always be up and support their critical systems.

It's been long in work and launched in Version 11.

We also continue to invest the items around simplicity, which we started back in when we first rolled out 10 and we've been rolling that out consistently and showed it in our 2 Impact events.

One of the exciting new introductions in Version 11 were our secret list broker, which adds on to the strength of our AAM solution, allowing in certain use cases developers to really be totally seamless in dealing with credentials and where the management is all behind the scenes for them.

We view that as another important enhancement for that adoption.

And on top of that, like I said earlier, we've made major enhancements to our CyberArk Privilege Cloud.

So yes, all of these contribute to our ability to continue to expand globally.

Great.

And then just with regards to Alero, how quickly do you think this could potentially ramp?

And does this start to maybe cross over a little bit into the traditional SSO space?

Can you maybe help clarify whether there's overlap and where there's sort of uniqueness?

Yes.

It's very much privileged access.

It's answering demand for our customers.

They say CyberArk is our solution for employee and strong users and their access to our IT infrastructure.

But we also have a lot of third parties who need to come in and it could be that they are administering rather a database or they could be an IT service provider.

And so it's a big pain, but it's very much in the privileged access world.

So we give them a VPN list, password list and agent list, a way to get very strong and strongly controlled privileged access and do what they need to do.

And so I would say it's adjacency to the other AAM parts.

In terms of the opportunity, the opportunity is very large.

We see it really as great new, but also very much add-on business to our existing customers, but it is a new solution.

So we're going to take our time as we roll it, and it's not baked into a big impact into 2019 itself.

But definitely, is going to be part of every sales process to new and existing customers.

Next question comes from Gray Powell with Deutsche Bank.

Maybe we can -- can we talk about the competitive environment?

Have you seen any benefit from customers looking to turn off from CA yet?

And has that been a material driver to growth in the first half of this year?

Yes.

Gray, I would say no major change since we updated last quarter.

I would say primarily seeing the PE role-up companies in the competition and the mix.

We -- with regards to the CA, yes, we see them trying to cling onto existing customers less or 0 involvement in new business.

And you're right, we have seen displacements in CA.

Some of them have been ones that we've been eyeing for a while and in important enterprises.

But it wasn't meaningful in terms of the overall impact on the number.

But important for us strategically, especially since the customers really appreciate that we have the experience of also migrating from CA infrastructure.

And so the more we have added, the more -- we can do more in the future.

And the next question comes from Catharine Trebnick with Dougherty.

Awesome quarter.

Mine has to do just with the advisory curve.

Udi, could you, please, dig into a little bit how that process works and know how much are they really feeling?

Could you give us maybe an idea what percent of revenue comes from the advisory firms?

Yes.

So I don't think we've provided it in this quarterly snapshot, but we will, in the future, continue to talk about influenced deals.

They influence our revenue.

They usually do not resell.

I would say that the partnership and their level of competency is the best ever and it's in numbers.

It's the amount of trained professionals that they have and also really creating a business around us.

One way to see it was their presence in our impact events.

You really see the big 4. You see Accenture really investing in partnering with us, and it's really a win-win, especially with their footprint in Fortune 500 and Global 2000 at their ability to influence there.

You're right, it's one of the things I'm really most excited about in the past 1 or 2 years.

And our next question comes from Andrew Nowinski Piper Jaffray.

So I understand your comments on seasonality with regard to deferred revenue.

But it does seem like for the last few year, and particularly in Q2, billings growth has generally outpaced revenue growth.

But it looks like this quarter it slowed pretty materially relative to your revenue growth rate.

So can you provide any more color as to what might be driving that and how we should think about it going forward?

Yes.

Andrew, basically, again, in terms of this company is predominantly selling perpetual software licenses, so when we look at billings, it's predominantly the impact of deferred revenues and then -- and that's really driven by the seasonality of our maintenance renewals.

And I think that, overall, when we look at the maintenance renewals, we're still at -- above our 90-plus percent threshold.

And I think it's just a matter of the ebbs and flows of our renewal contracts of how it ties into the billings.

But we're happy with our 34% increase on deferred revenues and the license growth revenue year-on-year, which is going to keep driving those maintenance contracts going forward.

Okay.

That makes sense.

And then I know you implemented some pricing changes last year at this time, and so I'd assume all the new customers are on that new pricing model.

But can you give us any color as to maybe what percentage of your existing customers have moved to the new pricing model?

And should we view that transition to the new model as a growth driver?

Yes.

So as you said, all of any new quote going out the door today is on the new pricing model, has been for a year now.

And then basically, our existing customers, when they come back and buy more licenses, as I said before, about 60% of our revenue -- of our license revenue is coming from existing customers, though, either choose to convert and -- to new -- to the new prices or continue buying à la carte in the old price list, and we're roughly about 30% of our customer base is on the new price list.

And then you're next question comes from Gregg Moskowitz with Mizuho.

Udi, you spoke a little bit about the enhanced partner program, but can you update us on your mid-market initiative more specifically just in terms of how that's progressing?

Yes, absolutely, Greg.

I would say it's still early days from us.

The biggest growth still comes from enterprise, but 2 quarters into it, we're really seeing processes definitely improve and it -- really -- the fruits of our investment in a different sales motion, our ability to touch the mid-market with less presence in the field.

So I would say, it's in the right direction, it's still a smaller part of the business, but we view that as long-term strategic for us.

That's great.

And then just a quick one for Josh.

So your gross margins, again, were very good this quarter.

I think you had previously guided to 87% to 88% for the year.

But you're already at the high end and, historically speaking, your second-half margins are typically higher than first half.

So just kind of wondering how you're thinking about gross margins over the rest of the year?

Yes.

I think we're -- we think that we're still sticking with original range.

But as you said, we're hovering towards the high end to it -- high end of it.

Some of it will depend upon the level of services in the fourth quarter in terms of how much, if we need to extend out to subcontractors to help us provide the -- that level or not.

But I think we feel comfortable with the 87% to 88%.

Next question comes from Alex Henderson with Needham.

I wanted to ask a question on the verticals.

You've cited the 6 verticals that specifically grew in excess of 40%, which is great news, and I'm glad to see it.

But the question is, is that a function of the need in those verticals?

Or is that a function of you targeting those verticals.

And if so, how do we think about the targeting efforts going forward?

Are there other verticals where you haven't targeted that you might be able to add in to provide that extra kick to growth?

Yes.

No.

Absolutely, I think we want to show color about where -- the beauty is we sell the same software to every vertical and across the world.

And so except for the federal team, we don't have dedicated teams per vertical, which really allows us to be diverse and scale.

And so the results of these growth are results of growing demand in a vertical and, of course, execution against that demand and just that beautiful pie of diversity that we have continues.

And the growth levers are definitely just to go after the next 30,000, 40,000 customers that don't have privileged access and do that cross-geography, cross-vertical because every vertical needs this.

Our next question comes from Ken Talanian with Evercore ISI.

First off, have you made any changes to your 2019 hiring plans relative to what you're thinking last quarter?

Ken, it's Josh.

No, I think we're very much on track for this -- in accordance with the plan that we had set out at the beginning of the year.

I think if anything, as we look into H2, we start to think about whether or not we want to do early hirings for next year.

But we're very much on the same strategy that we had set out at the beginning of the year.

Next question comes from Fatima Boolani with UBS.

I wanted to drill in on some of the sales hiring comments you just made.

Last year, we saw a significant improvement in productivity from your sales force and that certainly translated into upside into your license performance.

And relative to last year, I think that's moderated.

So I wanted to better understand what type of productivity trends you're seeing, as you've ramped up on sales capacity hiring and you expect to ramp on sales capacity hiring?

And secondarily, if you can give us any color on retention and/or attrition trends within the sales organization, especially, as we think about Ron transitioning out of the organization?

So with regard to productivity, we've had good productivity this year.

I think as you can see, from our nice growth year-on-year in each of the first 2 quarters, we continue to grow headcount across the entire organization, across sales and marketing, I believe, is in the mid-teens.

But if we were to look at the quota carriers, actually, we've increased them significantly more than that.

So that's a big -- that's a lion share of what we've grown the sales and marketing organization, is coming in quota carriers across both the commercial targets and also enterprise.

So and that's really in anticipation of the fact that we see -- we have to -- we see basically a sales ramp-up of the quota carriers of 6 to 9 months.

And so that's why we are always ahead of the game for bringing quota carriers on.

And we're seeing good productivity from them this year.

And as you said, it's kind of a continuation of what we saw last year.

With regard to the question on Ron, whether or not you expect to see any change in the organization.

No.

I mean I think, like I said earlier, we're managing this as best-in-class transition and he's with us through all the way into Q1.

And so we're going to minimize any distraction here.

And I think we've put a good plan in place to do that.

Next question comes from Dan Ives with Wedbush Securities.

So my question is about some of the mid-market teams in both the U.S. and Europe.

Can you just talk about some the progress you're seeing there in terms of your minor install base?

Yes.

Like it is a new process for us to have dedicated teams.

One of the prime benefits is allowing the enterprise reps to really focus on the enterprise.

And I think we're seeing good process and progress.

Like you said, it's primarily in the Americas and in Western Europe, where we've done that differentiation of dedicated teams and we'll report more on it.

But there's opportunity there to continue to see low-touch sales and reach out to the mid-market where we were more sporadically reaching out to and do it more methodical.

In our book right now, it's on the right track, but still early.

Your next question comes from Imtiaz Koujalgi with Guggenheim Partners.

If I'm doing my math right, it looks like revenues in Americas were flat sequentially.

Usually, they go up by quite a bit from Q1 to Q2.

Can you comment on that?

Yes.

Well, overall, first of all, Americas revenues grew up 28% year-on-year.

So we're happy with that type of growth rate and also happy with the fact that if you look at all the regions, we've built, as Udi said earlier, we've really built the organization to be diversified and seeing EMEA growing 28% and APJ growing 41%.

That really helps us be able to operate the business over the long term.

Typically, the sequential growth during the first and second quarter is not as strong, but the region is most mature.

It's consistently delivered strong growth.

And overall, when we also look at, kind of, dig down under the hood of Americas sales, one of the things that I -- we kind of alluded to it briefly in the call, is that we had a very strong EPM SaaS bookings, and the majority of the SaaS -- of those bookings were in Americas.

So actually, kind of, if we were to have neutralized out selling a lot more SaaS in that quarter in the Americas relative to what we had seen a year ago.

We probably would have seen more sequential growth.

Got it.

And then just one follow-up.

Last year, you had a strong growth in Q4.

I think you had one of the highest sequential growth from Q3 to Q4 last year.

And given that majority of your business comes from add-on sales, do you think that reflects in this year's seasonality from Q3 to Q4?

Do you get a benefit from the fact that you had such a big Q4 in 2018?

Those guys come back for renewals this year in Q4.

Do we see that seasonality that we saw in Q3 and Q4 -- from Q3 to Q4 in '18 also be a tailwind for your seasonality this year from Q3 to Q4?

Well, I mean certainly, we do expect that sequential growth between Q3 and Q4, which we typically have seen in years past.

And we do get certainly, from a booking's perspective, we get a lot more -- we get growth on the maintenance renewal contracts that -- from licenses that were booked in the prior Q4s as well.

But overall, right at this point, we're -- we feel good about the rest of the year, hence our guidance for Q3 and for the full year.

And I think part of Q4 is also what's going on with regard to the budget flush environment as well and especially in our space of enterprise software.

So we're -- but we feel like we're in a good position to meet our goals there.

The next question comes from Shebly Seyrafi with FBN Securities.

Yes.

So your maintenance gross margin appears to have declined sequentially and year-to-year.

I haven't seen that in a while.

You did grow that metric by 5 percentage points in 2018 to 75%, but now it's down to 74.4%.

I realize in the past you said that as SaaS grows, that line item will decline.

Is the ramp of Alero impacting this?

Or do you expect that to continue to decline?

Actually, I would say the kind of the small step down that you saw in this quarter would be more related to the professional services side.

You saw we actually had a nice growth in professional services, which also meant that we used some more subcontractors in that -- in order to provide those professional services.

And that's what could move the needle there by that 0.5% that you noted.

So that's where -- on the support and maintenance piece, specifically.

They -- it would not be related to Alero, certainly not at this point and that would be related more to when we think right now about the cost of goods on the licenses line as opposed to the services line.

Next question comes from Yi Fu Lee with Oppenheimer.

Congrats on the quarter gents.

Just one quick question on the security breaches that you mentioned on the back of fines.

Have you seen that translate into I guess better sales tailwind in the pipeline due to the rapid fines you've seen at Capital One, et cetera?

Yi, I think it's been very recent.

I mean the publications around the fines in Equifax and British Airways and Marriott and others have been recent.

But it did come out when we had a lot of interaction with a lot of customers at our Chicago Impact event.

And you can see that it is becoming another factor in their thought process.

So I wouldn't say it supported the sales in retro look and I wouldn't say that it's like a mega tailwind, but it's adding additional teeth to the regulatory element, which has always been another driver for our business.

So our biggest one is, of course, reducing risk, digital transformation is a big driver and compliance was always a driver, but now compliance comes with hefty fines and has teeth to it.

And so it's going to be top of mind of CISOs and that has been our first impression from customer interaction since those publications.

And just one follow-up, Udi.

In terms of like the CCPA regulation, has customers been asking about CyberArk's products in relation to that?

I know it's still not enacted until next year, but have you seen things through the channel from that angle?

Yes.

That's a good point.

It's -- customer speak about it as a given, as something they have to deal with just like we -- just like GDPR is -- has become a given.

They are talking about it as something that they'll have to live with.

Some take an approach that if they comply with GDPR, they will -- or they aim for GDPR and therefore comply with the California regulations, but back to the previous point, that's going to be another tailwind.

And we believe privilege is just foundational to ever looking anybody in the eye and saying we're securing our critical assets and private information.

Your next question comes from Joshua Tilton with Berenberg.

So I appreciate the digital transformation driver.

Could you possibly just speak directionally, maybe on how much of the success in the quarter was due to customers actually using a solution to secure more of those modern IT infrastructure uses you've been speaking to relative to maybe just continuing to spend on securing credentials associated with more of the traditional assets that have been driving growth in the past?

Yes.

It continues to be both.

I think one data point is the adoption of our Application Access Manager, which, as I mentioned, was in more than half of the top 10 deals and that's usually a direct connection to digital transformation.

But as we talk to our teams and our deployment teams, basically, in every single account and in part of what they're trying to do in their Privileged Access Security program, there is a connection to digital transformation.

So it could be their RPA, the Robotic Process Automation, it could be -- we need to secure these administrators of our cloud server.

So it's becoming hard to actually disconnect it.

It's in every sale motion and the customer then prioritizes.

Very often, they do want to prioritize with locking down domain controllers and critical infrastructure and user access to that.

But in other phases of the program, we tie into their digital transformation, sometimes it is the landing point of, okay, now is opportunity we want to get this infrastructure right because we're doing a lift and shift or moving applications.

That's very helpful.

And then just a quick follow-up of the existing customer revenue in the quarter.

Would you classify it more, as customers moving towards that enterprise-wide strategy?

Or are we still seeing tactical deployments whenever it's necessary?

Of the new deals in the quarter or you're asking...

Of the existing customer revenue.

The existing customers, it's been now more years of us pushing what we call the CyberArk hygiene program, where we take a programmatic approach.

So you can attach most of the add-on business to -- most -- to customers going through and taking off pieces that they want to take or accomplish on the program.

You still have, of course, customers that take a more tactical approach.

But I think it's really working, and we had a chance to really test that and tough that in the customer events.

There are no more questions at this time.

I will now turn the call back over to Ehud Mokady.

Thank you.

Thank you, everyone.

In closing, I would like to thank our customers, partners and employees, our dear employees, for contributing to our strong second quarter results.

Thank you.

Thanks, everyone.

Thank you, again, for your participation.

This concludes today's conference call.

You may now disconnect.