Cyberark Software Ltd (CYBR) 2019 Q3 法說會逐字稿

Good morning.

My name is Scott, and I will be your conference operator today.

At this time, I would like to welcome everyone to the CyberArk Third Quarter 2019 Earnings Conference Call.

(Operator Instructions) Erica Smith, Vice President, Investor Relations.

You may begin your conference.

Thank you, Scott.

Good morning.

Thank you for joining us today to review CyberArk's Third Quarter 2019 Financial Results.

With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; and Josh Siegel, Chief Financial Officer.

After initial remarks, we will open the call up for a question-and-answer session.

Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management's best judgment based on currently available information, specifically our expectations and beliefs regarding our projected results of operations for the fourth quarter and the full year 2019.

Our actual results might differ materially from those projected in these forward-looking statements.

Please see the risk factors contained in the company's annual report on Form 20-F filed with the U.S. Securities and Exchange Commission and those referenced in today's press release.

CyberArk disclaims any obligation or undertaking to release publicly any updates or revisions to any forward-looking statements made today.

Additionally, non-GAAP financial measures will be discussed on this conference call.

A reconciliation to the most directly comparable GAAP financial measures is also available in our earnings press release, which can be found on www.cyberark.com in the Investor Relations section.

Also, please note that a webcast of today's call will be available on our website in the Investor Relations section as well.

With that, I'd like to turn the call over to Udi Mokady.

Udi?

Thanks, Erica, and good morning, everyone.

Thank you for joining the call today.

I'm excited to discuss our third quarter results with you.

We were pleased with our strong performance.

Our results exceeded expectations across all guided metrics.

Revenue grew by 28%, reaching $108 million and non-GAAP operating income increased by 40% to $29 million or a 27% operating margin.

During the quarter, we reached a record for revenue in the Americas, a record for EPM SaaS bookings and generated record business in the global government vertical.

We were also pleased to again deliver best-in-class growth and profitability, not only in the security industry, but also across technology companies.

Given our execution and the robust demand environment for the third time this year, we are raising our guidance for revenue growth and operating income for the full year, which Josh will talk about later.

Overall, we continue to benefit from strong secular trends.

It is estimated that 2/3 of Global 2000 CEOs are not only adopting digital transformation, they're centering their corporate strategies on building software-driven businesses.

At the same time, almost every enterprise customer is running on-premise, cloud or multi-cloud IT environments, migrating workloads to drive more efficiencies and productivity into their business.

This increased complexity and the rapid pace of change in business operations and IT is expanding the attack surface, exponentially increasing the risk from cyber attacks and driving the velocity of hacker innovation.

In today's IT paradigm, the adoption of zero-trust frameworks is accelerating.

Organizations are taking a never trust, always verify approach to managing and securing human, application and infrastructure identities.

Privileged Access Management is not only the foundation of zero-trust, but also of every strong security program, which is contributing to the rising demand for our solutions.

While mitigating risk for customers is a key driver of our business, we are also a core component of compliance in a growing list of requirements for GDPR, HIPPA, SOX, BCI, SWIFT, CCPA and others.

With that background, I will move into our results for the quarter.

We were thrilled to win 200 new logos in the third quarter, bringing our total customer count to over 5,000.

We are proud that the world's leading organizations across industries are trusting CyberArk to help protect their most valuable assets.

A few new business highlights include a rapidly growing financial services company had deployed a niche competitive offering that could no longer scale to meet its more demanding requirements.

In a rip and replace deal, they are moving to CyberArk because of the breadth of our solution across endpoints, applications and Core Privileged Access as well as our ability to secure containers and modern application development with Kubernetes at scale.

An information services and solutions company engaged with CyberArk to remove local admin rights on all desktops with Endpoint Privilege Manager to meet HIPPA and GDPR requirements.

During the sales process, the customer suffered a ransomware attack and the deal quickly shifted to risk reduction with both Endpoint Privilege Manager and Core Privileged Access for Tier 0 access.

A government agency in Southeast Asia is leveraging CyberArk to secure access to and enable auditing of all video recording devices across its physical locations in an interesting IoT use case.

Our leadership position in the PAM market as well as our commitment to innovation was key to winning this greenfield deal.

Given the exploitation of privilege access is at the root of almost all major attacks, existing customers are prioritizing CyberArk in their security budgets.

We have also accelerated time to value through product simplification as well as partner enablement.

We have made it easier for customers to extend privileged access protection to cloud and hybrid environments as well as digital transformation and DevOps initiatives.

In fact, more than half of our Fortune 500 customers are using CyberArk to secure cloud assets.

A couple of add-on examples include an energy company is securing privilege access enterprise-wide across its hybrid environment, including Azure.

The organization had landed with our endpoint solution, but was using a competitive offering for privilege access.

Over our long-tenured relationship, we demonstrated our strong cloud security capabilities, our long-term vision, and our high level of customer satisfaction.

And as a result, we won this strategic 7-figure rip and replace deal.

Lastly, I would call out a 7-figure expansion deal with a U.S. financial services company.

The company became a CyberArk customer in 2018 with Core Privileged Access Security for a segment of its privileged users.

The company is now expanding to protect workloads and detect anomalous behavior in its AWS environment, remove local admin rights in over 5,000 endpoints with Endpoint Privilege Manager as a service, secure its robotic process automation, or RPA, project with our Application Access Manager as well as protect privilege business users with PSM for web.

We also had a record quarter in global government, driven in part by U.S. federal.

The strength of our federal business was in large part the result of our continued investment in this important vertical.

Just last week, we announced that our solution, again achieved international Common Criteria certification by the National Information Association Partnership, or NIAP, which validates that our solution meets the stringent requirements for U.S. national security system procurement.

This certification is used not only by the U.S., but also globally by 31 member countries, which will contribute to our ongoing success in governments around the world.

In the third quarter, our U.S. federal business benefited from spending on our Core Privileged Access Security Solution under the Department of Homeland Security's CDM program.

The CDM program makes it easier for U.S. civilian agencies to strengthen their security by funding approved products like CyberArk's Core PAS.

We have been thrilled with our success under this strategic federal program.

Beyond CDM, civilian agencies are standardizing on CyberArk across our solutions, including key wins during the quarter for Endpoint Privilege Manager and Application Access Manager, including our largest AAM deal to a federal customer.

In addition, because of our high levels of customer satisfaction and our extensive product certifications, we also continue to gain traction in U.S. military and intelligence agencies in the third quarter.

Moving on to product diversification.

Application Access Manager was included in half of our top 10 largest deals in the third quarter.

Every organization today is a software company, using technology to automate human tasks, drive business operations and increased efficiencies.

These applications have identities that need to be secured, a key driver to our Application Access Manager solution.

We were thrilled with another record quarter for Endpoint Privilege Manager SaaS bookings.

There is increasing awareness that removing local administrative rights, running a least privilege and preventing credential theft is an important component of stopping attacks where they typically begin, at the endpoint.

Geographically, the Americas had a record quarter, and we were pleased with the growth in APJ.

In EMEA, revenue grew by 13% in the third quarter, off a very strong Q3 2018 when the EMEA region grew by over 40%.

Growth rates in certain countries in EMEA have been inconsistent from quarter to quarter in 2019.

EMEA's annual seasonality has typically been back-end loaded towards year-end.

Consistent with that trend, the fourth quarter is off to a strong start in EMEA.

While there have been macro headlines regarding Europe in recent quarters, we believe demand for our solutions remains healthy.

Our more than 400 channel partners and advisory firms are extending our go-to-market reach.

Today, we have over 4,000 certified trained professionals across delivery engineers, presales engineers and salespeople, which has more than doubled the trained professionals at the beginning of the year.

In the third quarter, the indirect channel represented about 65% of our revenue.

Our innovations have empowered customers to secure privileged access across on-premise, in public or private cloud and in hybrid environments.

Our newer SaaS solutions, CyberArk Privilege Cloud and Alero are gaining momentum.

Our early Privilege Cloud customers are up and running, and the pipeline of opportunities continues to build.

Alero has been met with overwhelmingly positive customer feedback.

Every enterprise needs to mitigate risk from third-party vendor access.

We are the only vendor to combine zero-trust access, biometric authentication and just-in-time provisioning without the use of VPNs, agents or passwords.

We are in a market rich with opportunity, driven by not only the complexity of IT, but also organizations embracing the cloud and executing digital transformation strategies.

Our investments in research and development, in sales and marketing have positioned us as the leader in privileged access management, and we are committed to investing in the business to drive profitable growth.

With that, let me turn it over to Josh to discuss more details about our results.

Thanks, Udi.

We again exceeded our outlook across all guided metrics.

Total revenue grew by 28% year-on-year, ahead of our guidance, reaching $108.1 million in the third quarter.

We generated $57.9 million in license revenue, increasing 25% over the third quarter last year and representing 54% of total revenue.

We also had strong diversification across our products with Application Access Manager representing about 11% of license revenue and Endpoint Privilege Manager, representing about 5%.

We are particularly pleased to see EPM have another record quarter of SaaS bookings, which lowered the EPM revenue recognized in the current period, but will increase our recurring revenue down the road.

Maintenance and professional services revenue was $50.2 million, increasing 30% over the prior year period and representing 46% of revenue similar to last year.

The professional services revenue associated with this line was $9.6 million or just under 9% of total revenue.

Geographically, the Americas reached a record $69.8 million in revenue, growing 34% over Q3 last year and representing 65% of total revenue.

EMEA grew total revenue by 13% to $29.8 million or 27% of total revenue.

As a reminder, in the third quarter of 2018, EMEA had a particularly strong quarter with revenue growing by 42%, which created a tough compare this year.

Year-to-date, EMEA revenue has grown 19% and as Udi mentioned, the overall opportunity in EMEA remains strong.

APJ recognized $8.5 million in revenue, growing 35% and representing 8% of total revenue.

As I move through the P&L, all line items will be discussed on a non-GAAP basis.

Please use the full GAAP to non-GAAP reconciliations in the tables of our press release.

Our third quarter gross profit was $94 million or an 86.9% gross margin.

That's compared to an 88.5% gross margin in the same period last year.

The decline in gross margin, which we anticipated at the beginning of the year, is due to increased investment in our cloud infrastructure and in higher utilization of subcontractors because of the strength of our license revenue in prior periods and the heavy demand for those related services.

As part of our ongoing strategy to drive growth, deliver innovation and scale the company, we continue to invest in the business.

R&D grew by 20% to $15.4 million or 14% of revenues.

Sales and marketing increased by 18% to $40.1 million or 37% of revenues as we expanded across all geographies to support direct and indirect sales.

This included our highest attended and most successful Americas customer event we held in Chicago that we talked about during the Q2 call.

G&A expense increased 27% year-on-year to $9.2 million or 8.5% of revenues, as we continue to scale the business infrastructure to support our growth.

In total, operating expenses for the third quarter increased 20% to $64.6 million compared with $53.9 million for the third quarter last year.

Revenue outperformance and disciplined investments, again, drove strong leverage in the third quarter.

Operating income came in solidly above our guidance at $29.4 million or 27% operating margin, which is also an increase from $21 million operating income and an increase from 25% operating margin generated a year ago.

The majority of our expenses are related to headcount, and we ended the third quarter with 1,326 employees worldwide, up from 1,106 at September 30, 2018.

We had 625 employees in sales and marketing on September 30, this year that's compared to 524 at the end of the third quarter last year.

CyberArk generated net income of $25.6 million with earnings per share ahead of guidance at $0.65 per diluted share for the third quarter of 2019, that's increasing 44% from the $17.8 million and improving earnings per diluted share by $0.17 from the $0.48 we reported for the third quarter of 2018.

We generated cash flow from operations for the first 9 months of $89 million.

This represents a 29% cash flow margin for the period.

As a result, we ended the quarter with $555 million of cash and investments.

This compares to $451 million in cash and investments at year-end.

We ended the third quarter with $177 million in total deferred revenue, a 30% growth from $136 million at September 30, 2018.

Turning to our guidance.

As a reminder, our guidance does not consider any potential impact to financial, other income and expenses associated with foreign exchange gains or losses, as we do not try to estimate future movements in foreign currency rates.

So for the fourth quarter of 2019, we expect total revenue of $125 million to $127 million or 16% growth year-on-year at the midpoint.

For the fourth quarter, we expect the mix of business to be approximately 57% from license revenue and 43% for maintenance and services.

We expect non-GAAP operating income to range between $38.5 million to $40 million or a non-GAAP margin of 31% at the midpoint.

We expect non-GAAP net income per diluted share up between $0.78 to $0.82.

Our guidance also assumes $39.2 million weighted average diluted shares and a tax rate of approximately 21% for the fourth quarter.

We are pleased to raise our full year guidance.

We expect total revenue to be in the range of $429.2 million to $431.2 million or a growth of approximately 25% at the midpoint.

We are also increasing our guidance for non-GAAP operating income to be in the range of $119.75 million to $121.25 million or an operating margin of 28% at the midpoint, which is an expansion from the 26% operating margin for the full year 2018.

We are increasing our guidance for non-GAAP net income per diluted share of $2.58 to $2.61.

This assumes $39.1 million weighted average diluted shares.

Our guidance for the full year assumes an effective tax rate of approximately 20% for 2019.

As we look ahead, driving growth through disciplined investments continues to be our top priority.

Our execution year-to-date reinforces our conviction that we have a long runway for growth and positions us well for the fourth quarter of 2019 and beyond.

I will now turn the call over to the operator for Q&A.

Operator?

(Operator Instructions) Your first question comes from the line of Saket Kalia with Barclays.

Udi, maybe just to start with you.

Can you just comment on the competitive environment at all?

And whether you're seeing any of the competitors that saw ownership changes in the last year or so, whether those competitors are merging at all?

The numbers certainly wouldn't seem to indicate that, but I'm curious if you're seeing anything on the ground just to add a little bit more color.

Sure.

I would say, Saket, that there is no major change in the competitive environment that we saw in the third quarter.

We still see the competition from the Francisco private equity roll up and so they're out there.

They've been kind of self-disrupted with the roll up, but I wouldn't say that they're gaining any resurgence, but deals are competitive and they show up in deals.

With regards to CA, we do see that they're working hard to try to maintain their relationship with existing customers, and I think they've alluded to that strategy.

We have seen displacements where we've displaced them and, of course, others.

As we noted a little bit in the prepared remarks, we have a lot of examples of rip and replace, including with the legacy Dell TPAM solution.

That's really helpful.

Josh, maybe just my follow-up for you.

Can you just talk a little bit about the overall SaaS mix of the business?

I know you mentioned in your prepared remarks a couple of times just around strong SaaS bookings for Endpoint Privilege Manager.

Udi, I think you talked about strong reception for Alero, Privilege Cloud.

I guess as we look back at Q3 or maybe year-to-date, however you'd like to look at them, what percentage of the business now at this point is coming from SaaS?

And how do you think about that mix going forward?

Saket, this is Josh.

So when we think about our SaaS business, our pure -- the majority -- the overwhelming majority of the business is still really coming from our Endpoint Privilege Manager.

Alero, as you know, we just released it.

I think Udi's enthusiasm about it was around customer reaction to the release and to the product itself.

And the general availability is happening only in Q4, and I think that we're optimistic there.

So when we think about the SaaS business, it's around the Endpoint Privilege Manager, it's around our initial tractions for Privilege Cloud.

And we saw in Q3 about 7% of license revenue going to our combination of SaaS and term-based licenses about which half of that was pure SaaS business.

And that was just under 5% of total revenues.

I think as we kind of look going forward, we are seeing -- it's still small numbers, but if we look at the growth rates of our contracts for SaaS, they're growing at a higher rate than the growth of the business.

And I'll just reiterate the 3 sources for our SaaS revenue: EPM SaaS is the majority; Privilege Cloud that we're very excited about, again, with early customers; and Alero, minor correction was, it was GA-ed at the end of Q3, but it's still an early product.

But we're seeing a lot of excitement, and it's a no-brainer issue of remote vendor access.

Your next question comes from the line of Melissa Franchi with Morgan Stanley.

Congrats on the quarter.

Udi, I wanted to follow up on your comments on the spending environment, particularly in EMEA.

You said it was uneven year-to-date.

I'm just wondering if it has gotten more uneven in Q3.

And you did note that the pipeline looks good for Q4, but how should we expect that business to track as we close out the year?

Melissa, I would say that the 9 months into it we were able to track our consistency a little bit better and to see that in Southern Europe and in France we've seen less.

I wouldn't say that Q3 was dramatically different, but we see more visibility.

And to the point where in this business you can't overlook the macro uncertainty, but then you measure -- we measure our own numbers, and we see healthy pipeline, and as I mentioned a -- off to a strong Q4 start.

We did have a tough compare there, as I mentioned, where Q3 '18 was 40% growth.

All right.

Helpful.

And then I just wanted to follow up on the sales organization.

So with Ron stepping down this quarter, realize that he is staying on Board.

But I'm just wondering if you can update us on the quest to find a new Chief Revenue Officer.

And then just given the transition, I'm just wondering how you saw sales productivity this quarter and if you've seen any change in sales attrition?

Yes.

No.

Absolutely, I think in the last call in August we talked about let's make this a best-in-class transition, and I think that's what we've been seeing on all fronts.

Just the sales leadership in the company across the theaters, across the various pieces of the sales organization just completely stepped up.

And I would say 0 to no issues with the transition on the opposite people really stepping up.

In this quarter, I'm taking a more active role, and I started that also towards the end of Q3.

In brackets I'll say that I'm enjoying that, but don't worry it's going to be a short term.

I think it's good for the business.

It gives me a closer handle to the sales, and in parallel, we're very advanced in our Chief Revenue Officer search with some, I would say, advanced candidates where we were looking for the combination of ability to further scale CyberArk towards our long-term plan, but also strong culture fit.

And I'm very optimistic that we'll be able to find the right candidate, in -- I would say, in the next couple of months.

Your next question comes from the line of Shaul Eyal with Oppenheimer.

Congrats on the strong set of results and an elevated outlook.

Udi, if -- or Josh, if we look at the 200 new logos you nailed down this quarter, how many of them are displacements?

How many of those are greenfield?

And probably it's a little lucky, but maybe any color that you could provide us will be extremely helpful.

Yes.

Sure.

I think we would still -- we give a lot of rip and replace examples in the script because of just some exciting examples, but the majority were greenfield.

And then there could be some light brown in the sense where a customer had a tactical solution more driven historically by compliance and when they took a security approach, CyberArk won the full strategic approach.

So the quick answer is primarily greenfield, a growing amount of rip and replace, but some of them are really of solutions that were brought into parts of the organization.

Got it.

This is helpful.

And as we think about the 65% coming from the indirect channels, partners, any number of VARs that stood out this quarter?

Or pretty much very consistent across the board?

Yes.

I would say that we saw, of course, the federal business was extraordinary in Q3, and so we saw our partners, they're really delivering.

And then across the U.S. and internationally, strong performance with the channel and the advisory firms.

I think we -- they don't always -- they don't certainly count in that 65% because they don't resell, but they influence a lot of the deals, especially in the Global 2000.

Your next question comes from the line of Sterling Auty with JPMorgan.

Josh, I wonder, if you could take a minute and talk a little bit about deferred revenue and billings?

And what I mean by that is, traditionally deferred revenue's been lumpy based on different factors, wonder if you could highlight those.

And then in particular, with the strength in EPM and SaaS, I would think that, that would actually have given the revenue recognition actually bolster the deferred revenue.

And how should we think about that as we look to the fourth quarter?

Yes.

Okay.

Thanks, Sterling.

First, we had deferred revenues grow by 30% year-on-year.

And I think one of the things that has impacted maybe have -- slowing a bit of the deferred revenue growth this year was that we were seeing more, and we've had a case in the last couple of quarters, some more multiyear deals, contracts, larger contracts that also include extended payment terms over the life of the contract, meaning annual payments.

And then that would certainly -- that certainly while it's -- the business is there, it will impact the overall deferred level.

But overall, I think that we feel good about the business.

One is that our maintenance renewal contracts are still tracking at 90% above of renewal rates.

Our -- there's no dramatic changes in how that business is operating.

And overall, I think as we kind of go in looking forward of going into Q4, Q4 is a big year, big quarter for maintenance renewals.

So that's when we start to see that come in, but I will remind you and the people on the call is that we recognize it and defer once it's collected, and then we recognize the PCS on that deferred after collection.

So some of it will depend upon the linearity within the quarter of when those renewals occur because we have to collect the cash before the year-end to be able to identify that.

With regards to the SaaS business, you're right.

We're happy about it, and we just talked about in the prior question our growth in the SaaS component, particularly in the Endpoint Privilege Manager growing.

It's more than -- in the last couple of quarters, it's been more than 60% of our bookings going to SaaS contracts, but we're still talking in small numbers.

So with regards to the very large deferred numbers that we have coming from the maintenance contracts, it's not -- there's still limited impact there.

All right.

Makes sense.

And I have one follow-up question.

There is a news report out there talking about you guys exploring a bond deal.

Just wondering to the extent you could comment around your current cash position, your capital structure, any capital needs and what additional capital might be used for in that type of situation.

Yes.

Sterling, Udi here.

So obviously, we don't comment on the market rumors, but I would say that part of our planning involves regularly evaluating our capital structure and capital allocation and how they align with our long-term strategy and goals, really thinking long term in every planning session we do.

The next question comes from the line of Gregg Moskowitz with Mizuho.

Very good quarter, guys.

Congrats on that.

So I guess first question is for Udi.

You mentioned that you have over 4,000 certified professionals and that, that's more than double where you were at the start of the year.

Can you elaborate on how you've been able to scale out the ecosystem so rapidly?

Yes, absolutely.

It's been strategic for us to -- with the growing demand to make sure that our ecosystem can support our customers out there internationally.

So we've been investing in trading and certification, and also the channel program has been updated to reward and incentivize enablement or enabled channels, especially on the technical front.

And it really drove attendance and demand for our certification courses in the customer event that Josh mentioned.

And then the prior one in -- that we did in Europe, we were just overly subscribed on the training sessions, but we also take it to the field regularly.

And so it's strategic for us and the demand is out there for these certifications.

And I have seen a lot of people [bolst] when they get the CyberArk certified result.

That's terrific.

And then just 1 for Josh here.

DSOs did go up fairly meaningfully quarter-over-quarter.

Can you talk about the linearity that you saw in Q3?

Yes.

Actually, around linearity we saw in Q3 and really kind of even in the first -- in Q1 and Q2.

It revert to kind of where we expect it to be.

Last year in 2018, we had -- and we talked about it on the call during the year that we had really favorable, to historical terms, linearity within the quarters.

And that kind of help boost our cash flow last year as well.

And this year, we're seeing it kind of revert back to our more historical norms.

Your next question comes from the line of Fatima Boolani with UBS.

I have one for Udi and one for Josh.

Udi, I'll start with you.

On the AAM proportion of license revenue this quarter, some of the highest we've seen in the recent past.

So I'm wondering if you can bifurcate that strength between sort of overall improved market awareness versus anything you're doing with the sales force internally to incentivize greater adoption.

And then my follow-up is for Josh.

Sure, Fatima.

And it's a great question because I think it is the combination, a combination of deeper into the integration of Conjur and a better integrated and robust product that we have out there, the driver of really playing to digital transformation.

And that strong driver where CyberArk can enable customers to move workloads to the cloud and into modern infrastructure.

But then also, like as you asked, changes in the sales organization that we did in the beginning of the year, where we really embedded some overlay efforts to help the field with the emerging technology.

So the -- it really supported the AAM business and it's showing up early in our largest of the deals and hence, 11% of the revenue.

It's really exciting part of our business.

That's helpful.

And Josh for you.

I know you price in local currency in geographies outside of the U.S. Could you just remind us any movements in FX and the impact to both revenue and operating expenses both in the quarter?

And what your expectations are baking in, in your full year guidance?

And that's it for me.

Yes.

We do, as you said, in Europe we sell in sterling and we sell in euro.

And if we kind of take a view of the FX impact on income, we had a headwind of about $300,000, and on expenses, we got a positive of around $900,000.

Sorry.

Let me just correct that.

It was $600,000 on expenses.

Your next question comes from the line of Gray Powell with Deutsche Bank.

I appreciate you're giving the insights on license revenue for Q4.

You guys do have some pretty tough comparisons on the license front from both Q4 '19 and Q1 of '20.

So how would you suggest we think about growth there on a normalized basis?

And then, I mean would it be fair to just look at the last 2 years and take an average?

Or just any insights you can give us on that metric going forward?

Yes.

I'm sorry, were you asking about 2020?

No.

Just like -- so you gave guidance on Q4 license revenue.

And I'm just trying think through you guys have tough comps.

So just how we should think about normalized growth on that metric looking forward?

Yes.

We're not at this point...

For 2020, that would be great.

No.

But we're not looking at '20.

We're not going to discuss 2020 today, but I think historically we've been pretty consistent on our mix between revenue and from licenses and from services and from maintenance.

And at this point, there's no new news I would give regarding how we would look at 2020.

Okay.

Fair enough.

I'd just try another if I can.

Just how do you feel about visibility on your pipeline and growth prospect today relative to this time last year?

Well, I mean about our pipeline, it's grown.

It's much bigger this year than it was last year at this time.

And I think as Udi also remarked in his remarks that we're seeing growth for across all of our different products across all of the different geographies.

So I don't think we -- I think we feel we're in a similar position to how we see the market today than how we saw it a year ago.

Your next question comes from the line of Ken Talanian with Evercore ISI.

I was wondering if you could give us some color on how customer expansions performed in the quarter.

And how you're thinking about the contribution from expansions in 4Q?

Yes.

Absolutely, so add-on business was more than 60% of total revenue.

And on a base of 5,000 customers now, it's become a super strategic to continue to grow that customer base from beyond the -- into forecast.

Of course, we're strategic, but also with the emerging technologies.

So there is a lot of add-on opportunity within the customer base, and we invest in that regularly while going after the greenfield opportunity.

So we have both engines turned on.

Your next question comes from the line of Gur Talpaz of Stifel.

Congrats on a good quarter.

Udi, you talked a bit about Alero on the call, and you gave us some insight and say initial feedback.

But I was more curious to see if you are encountering a different competitive sets here with the solution with the approach as you ultimately look to broaden the value prop of the company?

So right now we're really focused on the remote vendor access and high growth.

Very focused on the remote vendor access as a privilege to expansion opportunity and as a privilege use case.

It is kind of a no-brainer if you want to limit and put controls over how IT employees and developers of your company are accessing the IT infrastructure.

You definitely want to put those controls on third parties that are coming in and getting privilege access and the solutions today are punching holes with VPNs.

And so it's an expansion of the privilege use case.

And I would say that in the short term we're keeping it under the privilege umbrella.

Your next question comes from the line of Daniel Bartus with Bank of America.

So maybe for just either Udi or Josh.

I wanted to also ask about AAM a little bit differently.

Across some of your more mature customers, how does the split of their spending look between the application and the Core PAS side of things?

And then asked differently, just kind of how are you guys thinking about that TAM in your customer base between the application and Core PAS there?

So I would say that the majority of the customers, of course, start with Core PAS and start with securing human access.

And so it's still the smaller part of our customer base that has addressed the AAM use case.

And those that have done, usually start with some low-hanging fruit, like securing off-the-shelf third-party solutions through our extensive C3 Alliance program and partnerships.

And then more and more, where in the past, they used -- they would gravitate towards securing embedded credentials in code and the legacy applications more and more moving to securing dynamic applications per our Conjur acquisition.

So it's still very much open ground in the majority of our customers.

And I think in the past we've equated it where the deal size in a customer that went all in, in AAM can be equal to the potential opportunity on securing the humans, if not greater.

So it's part of the TAM we put out there when we discussed our overall TAM.

So we factored it in, but it's really 2 different things, securing humans and securing applications.

Yes, we can double the -- I would say, the value in a customer through this kind of expansion.

Your next question comes from the line of Nick Yako with Cowen and Company.

Can you just provide an update on the mid-market build-out?

Any key investments you still need to make?

And then maybe how that segment contributed to overall results in the quarter?

Well, absolutely.

Yes.

So like we said before, the more strategic part of our business is definitely the enterprise, but we've built out a team that's looking further into mid-market and proving the case that we can serve a low-touch, higher volume type of sale.

So we definitely see that as a component of the business, but it's still a small part of the revenue.

And so I would say we're growing that muscle.

It's an important long-term muscle for us, but the majority of the revenue comes from the enterprise opportunity and that's where the majority of focus and investment is for us.

Your next question comes from the line of Howard Smith with First Analysis.

In the past few years, we've talked about the driver moving from compliance to security focus.

So I was interested in your prepared remarks, you mentioned the growing list of standards requiring PAS.

And I'm curious is that opening up new verticals to you?

Or how is that affecting the business trends you're seeing?

Yes, I think -- Howard, I think it's the -- and one of the reasons we mentioned it again is it's popping up as a supporting driver in many of the deals.

So the main driver is still risk reduction.

But in these enterprises, they have these GDPR mandates or they have mandates to prepare for the new California regulation.

And it's coming up as a -- all right, this helps us also support this mandate and sometimes it's in the budget allocation and in others.

And so I think we're really multi-vertical already and very diversified, but we'll keep a close watch if this further expands, especially internationally.

And we'll come back with more data.

Perfect.

And just as a quick follow-up.

You called out the government, in particular, particularly strong this quarter.

Any other vertical strength you might highlight?

Yes.

Energy was a strong example, pharmaceutical is another one in the quarter.

But -- and I think the beauty is we also -- when we look at our year-to-date perspective, we actually see strong consistency of strong performance across almost all of verticals.

Your next question comes from the line of Taz Koujalgi with Guggenheim.

Can you comment on the duration for this quarter?

It looks like the long-term deferred mix went down a bit this quarter versus the last few quarters where it was going -- the mix was going up.

And how should we think about that for Q4?

Taz, it's Josh.

The duration is not really moving around all that much quarter-to-quarter.

It's really -- what you're looking at the deferred, I kind of spoke about earlier as well.

One of the things that we saw in Q2 and Q3 is that some larger multiyear contracts that had payment terms across each year as opposed to upfront for those multiple year contracts.

So you're not necessarily going to see then the deferred for those long-term pop up from those contracts.

And that reflects the several million of the -- maybe the increase that you are looking for in the deferred.

Your next question comes from the line of Erik Suppiger with JMP.

2 questions.

One, can you break out what the federal contribution is?

Or can you at least provide some context around the contribution you're getting there?

This is Josh.

Typically, we see global government be just around 10 -- just 10% to 11% of the business of which federal will be anywhere from just under half of it.

And this time we saw global government be close in the mid-teens with federal driving that extra growth.

Your next question comes from the line of Dan Ives with Wedbush Securities.

Just in my last question.

In terms of federal, I mean obviously there's a lot of cloud deals going on, especially on the federal side that seem like they could create opportunities for you guys in terms of the product positioning.

So maybe can you talk about that?

I mean is that something where we look out a year some of the opportunities that are much more significant than maybe what you've seen over the last year, just given what's happened in federal on the move to cloud?

Absolutely.

I can't say that we can connect ourselves to the recent headlines on some major federal cloud decisions, but if you -- we look in our world: a, where part of the deals have been securing application workloads and the ability to transition to modern workloads with our AAM.

And while the bigger driver are really securing infrastructure, it's very clear that we're extending, and we'll extend to the government's cloud infrastructure.

But right now, it's securing the infrastructure they have.

Some of it includes some early cloud adoption and a lot of it is the bread and butter infrastructure.

Your next question comes from the line of Shebly Seyrafi with FBN.

So you just had a rather steep decline in your services gross margin to like 70.7% from the mid-70s before.

I think you mentioned future cloud and subcontractors.

Going forward, do you see that services gross margin continuing to decline to like 65%?

Or do think it stabilizes around 70% or so?

This is Josh.

Yes, you're absolutely right.

We saw a decline mostly on the services side.

It was related to using subcontractors to fulfill the demand for providing the service, the increased demand that we're getting.

And overall, the function of using subcontractors is the lumpiness and the demand for how many days we need to deliver.

Overall, it could -- I don't anticipate that driving or moving the number that much more on the cloud side, the more we sell SaaS software and business then clearly the cloud is going to become a bigger and bigger component of that.

But still I think that it's going to be gradual, and we'll be able to give clarity on that when we talk about 2020.

Your next question comes from the line of Joshua Tilton with Berenberg.

Just a follow-up on the mid-market.

We've been seeing some of the identity governance players bundling in privilege access functionality with the IGA functionality.

Just curious, how should we think about the competitive landscape as you move into the mid-market?

Yes.

You're probably alluding to the recent SailPoint acquisition.

We actually have been looking at that closely and talking to them.

And it's primarily a cloud governance move with some of the tuck-ins they've done, and we continue to collaborate in the field strongly.

And so I would say that when we look at the mid-market opportunity, it's still the PAM vendors that are going after it.

For us it's an expansion, and there are some vendors that started from mid-market, and we meet there.

There are no further questions at this time.

I will turn the call back over to Udi Mokady, Chairman and Chief Executive Officer, for closing remarks.

Thank you, Scott.

In closing, we'd like to thank our customers, partners and employees around the world for contributing to our strong third quarter results.

Thank you very much.

Thank you.

This concludes today's conference call.

You may now disconnect.