CyberArk Software Ltd. (NASDAQ:CYBR) Q1 2022 Earnings Conference Call May 12, 2022 8:00 AM ET

Company Participants

Erica Smith - Vice President, Investor Relations
Udi Mokady - Chairman & Chief Executive Officer
Josh Siegel - Chief Financial Officer

Conference Call Participants

Saket Kalia - Barclays
Adam Borg - Stifel
Rob Owens - Piper Sandler
Brian Essex - Goldman Sachs
Fatima Boolani - Citi
Gregg Moskowitz - Mizuho
Hamza Fodderwala - Morgan Stanley
Joshua Tilton - Wolfe Research
Roger Boyd - UBS Securities
Ittai Kidron - Oppenheimer
Eric Heath - KeyBanc Capital
Trevor Walsh - JMP Securities
Justin Donati - Wells Fargo

Operator

Ladies and gentlemen, thank you for standing by, and welcome to CyberArk First Quarter 2022 Earnings Call. At this time, all attendees are in a listen-only mode. After the speakers' presentation, there will be a question-and-answer session. [Operator Instructions] Please be advised that today’s conference is being recorded. [Operator Instructions] Thank you.

Now, I would like to welcome Ms. Erica Smith. Ma'am, please go ahead.

Erica Smith

Thank you. Good morning. Thank you for joining us today to review CyberArk's first quarter 2022 financial results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open the call up to a question-and-answer session.

Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management’s best judgment based on currently available information.

I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operations for the second quarter and the full year 2022. Our results might differ materially from those projected in these forward-looking statements.

I direct your attention to the risk factors contained in the company’s Annual Report on Form 20-F filed with the US Securities and Exchange Commission, and those referenced in today’s press release that are posted to CyberArk’s website, as well as the duration and scope of the COVID-19 pandemic, its related impact on global economies and our ability to adjust in response to the pandemic. CyberArk expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made here in.

Additionally, non-GAAP financial measures will be discussed on this conference call. Reconciliations to the most directly comparable GAAP financial measures are also available in today’s press release, as well as in an updated investor presentation that outlines the financial discussion in today’s call.

We also want to remind you that we provide the calculated revenue headwind for additional color on the impact of our subscription bookings mix, but it should not be viewed as comparable to or a substitute for reported GAAP revenues or other GAAP metrics. A webcast of today’s call is also available on our website in the IR section.

With that, I’d like to turn the call over to our Chairman and Chief Executive Officer, Udi Mokady. Udi?

Udi Mokady

Thanks, Erica, and thanks to everyone, for joining the call. We had a fantastic start to 2022. The business once again accelerated, momentum picked up additional speed, with our bookings growth rate accelerating off the record fourth quarter, a testament to our execution and the strong market fundamentals.

ARR continues to be the best metric to evaluate the health of the business. In Q1, subscription ARR reached $219 million and growth accelerated to 149% year-over-year. Total ARR reached $427 million and growth accelerated once again to 48%, and we have the best sequential increase in subscription ARR and total ARR outside of fourth quarter, outpacing our record-setting third quarter 2021 performance.

Josh will talk about it later, but given our incredible results we are raising our ARR guidance for the full year. We also achieved an important milestone, with the subscription booking mix reaching 86%, surpassing the transition target of 85%.

That achievement, paired with our great bookings in the quarter, demonstrate that our go-to-market organization has transformed into a subscription engine. We were thrilled to complete the transition in just five quarters, well ahead of our initial plan for an eight to 10-quarter transition.

Our strong bookings in the first quarter exceeded our guidance framework, so even with our significantly higher subscription mix, total revenue came in at $128 million creating a revenue headwind of about $21 million in the first quarter. Normalizing the mix of bookings to the first quarter of last year our total revenue line would have grown by about 32% in the first quarter with the license lines growing much faster.

Our results clearly demonstrate. First and foremost, Identity Security is more critical than ever, particularly given the significantly heightened threat landscape and geopolitical tensions. Second, demand for our Identity Security platform centered on privileged access continues to accelerate. And third, we are well positioned to execute against a multiyear durable growth opportunity.

I will frame today around the pillars of growth, subscription transition and innovation, starting with growth. Secular tailwinds of digital transformation, the adoption of zero trust and attacker innovation continue to push Identity Security to the center of every customer discussion. Geopolitical tensions, and Russia's invasion into Ukraine, have further heightened the incredibly severe threat landscape.

Our recent Identity Security threat landscape survey identified that the race to digitize created an explosion of human and machine identities and an acute cybersecurity debt. Unmanaged and unprotected identities are exposing organizations to significant risk, which could have crippling effects. Less than half of our respondents have Identity Security controls in place to protect their business-critical applications.

Another key statistic, over 70% of organizations surveyed experienced ransomware attacks in the past year, two each on average. Our survey results reinforce the durability of demand for Identity Security.

All of these factors came into play with customers and prospects in the first quarter. Privileged Cloud, Endpoint Privilege Manager and Access, all SaaS solutions more than doubled again. Momentum continued to build for CyberArk Identity with even more pickup in new logos, cross-sell and add-on deals in the first quarter.

In sequence management, we are increasingly securing across customers' application estates from DevOps, commercial off-the-shelf, self-hosted as well as Kubernetes and large-scale container environments. Geographically, we had strong contributions from all our regions with each exceeding our transition expectations.

New business doubled year-over-year. It was a great quarter. We signed nearly 250 new logos across customer sizes and verticals from airlines, cruise ships, schools and hospitals to board in the cloud software. Identity Security is becoming a universal requirement.

There were many great new business wins, but I want to highlight a few. In a 7-figure ACV deal, a major local government landed with Privilege Cloud and Endpoint Privilege Manager as part of its digital transformation to secure its Azure consoles Office 365, all network devices and much more. Scalability and protecting against ransomware attacks were key in this deal.

A travel and leisure company still grappling from the impact from the global pandemic picked up CyberArk because of our multiple deployment options, including remote access for both Sophos to Pen and Privilege Cloud. After trying to secure privilege with a homegrown solution, a board in the cloud cryptocurrency company landed with CyberArk to meet the increased compliance requirements in its industry. Superior security, customer integration and scalability were the deciding factors.

Cyber insurance continues to be a driver for our business. In one highly competitive access deal, a leading retail technology vendor picked CyberArk identity to meet its stringent cyber insurance requirements and aggressive Office 365 migration timeline.

We saw concrete examples of the heightened threat landscape and geopolitical tensions increasing the sense of urgency with some customers, including a major state transportation division that bought Privilege Cloud in response to the potential threat against critical infrastructure. We are also seeing increased velocity in our add-on business, customers adding more users and expanding to new solutions faster. As examples, a major health plan company is implementing a CyberArk Everywhere strategy to standardize on PAM, securing more privileged users and is also expanding into Secrets Manager for DevOps.

A Fortune 100 transportation company landed with PAM in 2018. The customer success team has built an amazing relationship with this customer and they will now leverage Endpoint Privilege Manager to secure across more than 75,000 endpoints, including 15,000 employees and 60,000 customer touch points. A state government expanded from Privilege Cloud to secure web sessions in the quarter to provide more visibility and protection across applications and users.

Our land and expand strategy is at work, and this customer is now evaluating a broad workforce identity rollout for our single sign-on and MFA. VARs global system integrators, advisories and manage security service providers are building CyberArk identity security practices across PAM, Access and DevSecOps. Enablement picked up significantly in the first quarter with both the number of CyberArk certified partners and the average number of certifications trending up.

Josh will get into the specifics of the transition dynamics, but I wanted to reiterate that we were thrilled to exceed our 85% booking target well ahead of our transition timeline and are now focused on operating and scaling as a subscription company. We are already seeing the flywheel effect in action. We now have more than 960 customers with over $100,000 in annual recurring revenue, up over 50% from Q1 2021. We're even more thrilled that our transition is based on a strong SaaS foundation where we continue to see SaaS first in almost all regions.

On innovation, I want to highlight that while we have been transforming CyberArk into a subscription company, we have also been building the industry's most comprehensive, scalable identity security platform in the market. Our platform is centered on PAM to provide customers with the highest levels of security, but it extends well beyond to secure all human and machine identities. Along with the increasing demand for Privileged Cloud, our growth engines like Endpoint Privilege Manager, CyberArk Identity and Secrets Manager are making meaningful contributions to the business. Most visible is the strength of our subscription ARR.

We recently announced that CyberArk Identity achieved four lines of availability, which enhances security and risk mitigation and drive productivity gains. CyberArk Identity protects against the leading point of attack used in data breaches, compromised credentials. Our solution unifies SSO, adaptive MFA, user behavior analytics, life cycle management and directory services into one integrated solution.

CyberArk Identity, and Endpoint Privilege Manager also reached in-process status for FedRAMP high authorization. The government's most sensitive status for unclassified data in cloud environments, putting us in a great position to extend further into US Federal with new solutions.

In April, we rolled out EPM for Linux, significantly expanding our opportunity and building on the incredible growth in EPM. We are very excited to announce that we added Idaptive, a provider of advanced and modern no-code application integration and workflow automation to CyberArk. We acquired the company late in the first quarter and are looking forward to sharing more details about how we integrate their technology for access capabilities into our solution at Impact Life, our customer event in July.

With our roots in cybersecurity and our identity security platform centered on Privileged Access Management, we are in the best position of any vendor to help customers navigate the heightened threat landscape. We have an incredible opportunity to execute against this massive multiyear growth opportunity.

Before I hand over to Josh, I want to welcome to CyberArk a strong addition to the team in Simon Mouyal, who joins us as our Chief Marketing Officer. Simon brings 25 years of experience in driving strong growth, transformational change and leadership in SaaS companies. I'm excited to see how he and his team further improve our leadership position and continue to increase demand for our identity security platform.

I will now turn the call over to Josh, who will discuss our great financial results in more detail, and provide you with our outlook for the second quarter and full year 2022, including raising our ARR guidance for the year. Over to you, Josh.

Josh Siegel

Thanks, Udi. And we'd like to remind you first that we posted slides to the website that walk through our results. As Udi mentioned, we had a stellar first quarter to kick off the year. Momentum continues to build in our business, fueled by amazing execution and a strong demand environment.

In terms of the headline P&L, we generated total revenue of $127.6 million in the first quarter with an 86% mix of subscription bookings. We'll come back to the mix in a moment, but as a reminder, the combination of revenue in line with guidance and a mix higher than we anticipated demonstrates that total bookings again outperformed our guidance framework for the quarter.

Perhaps the best example of the momentum and the health of the business is the acceleration of our annual recurring revenue growth. Starting with the subscription portion, which reached $219 million and grew 149% year-on-year. The subscription portion now represents over 50% of total annual recurring revenue. And just a year ago, the subscription portion was only $88 million or just 30% of total.

We were thrilled with the sequential increase in the subscription portion of $36 million off the strong seasonality in enterprise software we saw in the fourth quarter. Total annual recurring revenue was $427 million as of March 31, with growth accelerating to 48% and year-on-year. The acceleration of the business in our first quarter off an incredible fourth quarter 2021 results when ARR grew also 44% really underscores that the business is firing on all cylinders.

Moving to revenue, subscription revenue generated from SaaS and self-hosted subscription contracts reached $51.9 million and represented 41% of total revenue in the first quarter. That's increasing 110% year-on-year. Consistent with the progression of our subscription transition, perpetual license revenue declined to $10.6 million. Our maintenance and services professional services revenue was $65.1 million with $54.9 million from recurring maintenance and $10.1 million in professional services revenue.

Recurring revenue, defined as our total subscription plus our maintenance related to the perpetual license revenue reached $106.9 million or 84% of total revenue, that's growing 40% year-on-year. With the strength of our execution, we are quickly approaching our target of more than 90% of revenue from recurring.

Our subscription bookings mix increased to 86% in the first quarter that's significantly ahead of our guidance of 79% bookings mix and now surpassing the subscription transition target of 85% we set. We reached our mix target in just five quarters, as Udi mentioned, well ahead of the 8 to 10 quarter subscription transition timeline that we outlined in the early 2021, substantially now completing the transition from a sales perspective.

Economically, the headwind created by the mix was approximately $21 million in the first quarter and when we compare it like-for-like to the first quarter of 2021 when the mix was only 51%.

Normalizing our growth for the mix shift in the subscription transition, the license portion of our business, our SaaS, self-hosted subscription and perpetual would have grown about 62%. Taking the calculated revenue headwind into consideration, total revenue growth would have accelerated to a strong 32% year-on-year.

Geographically, the business is well diversified. The Americas, in particular, had a standout quarter, generating $75 million in revenue, representing 59% of total revenue. The Americas, again, had the strongest percentage of SaaS bookings during the quarter.

EMEA had $39 million in revenue or 31% of total revenue, with SaaS bookings more than tripling over last year. APJ is also executing well with SaaS and subscription representing now nearly 75% of bookings, a great accomplishment for that region.

If we look across the geographies, adjusted for the calculated revenue headwind created by the mix, the Americas license revenue would have grown by over 100%, EMEA by over 30%, and APJ by about 10%.

All line items of the P&L will be discussed on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release. Our first quarter gross profit was $104.1 million or an 82% gross margin. That's compared with 85% gross margin in the first quarter last year, primarily the result of the increase in our SaaS business.

We continued to make investments to drive innovation and growth, resulting in operating expenses of $115.9 million, a 29% increase year-on-year and generating an operating loss of $11.8 million in the quarter.

Our operating results were lowered by $1.5 million from foreign exchange rates and the approximate $21 million calculated revenue headwind we discussed. Adjusting for the headwind and FX, operating margin would have been positive 6% in the first quarter.

Net loss was $11.9 million or $0.30 per diluted share for the first quarter. We continue to attract and retain top talent, a testament to our culture, and our success in the market, and we ended March with over 2,300 employees worldwide, that's including more than 1,000 employees in sales and marketing.

For the first quarter, free cash flow was $23 million or an 18% free cash flow margin. The strong cash flow is a result of our seasonally strong fourth quarter bookings, renewals, as well as just great collections. This cash flow contributed to our strong balance sheet and we ended the quarter with $1.2 billion in cash and investments.

Now, turning to our guidance, our guidance for the second quarter of 2022 and the full year reflects the robust industry tailwinds, execution and our growing ARR base.

For the second quarter 2022, we expect total revenue of $135 million to $141 million. We expect a non-GAAP operating loss of about $14.5 million to $9.5 million for the second quarter. We expect our earnings per share to range from non-GAAP net loss of $0.37 to $0.25 per basic and diluted share. This guidance assumes about 87% of subscription bookings mix and a calculated revenue and profitability headwind of approximately $15 million for the second quarter. Our guidance also assumes 40.6 million basic and diluted shares and about $2 million in taxes.

For the full year of 2022, we are raising the midpoint of our full year guidance and now expect total revenue in the range of $583.5 million to $598.5 million. We are also increasing the mix assumption underlying our guidance to 88% from subscription bookings, and our revenue headwind is also increasing now to approximately $61 million for the year. So for the full year, we expect non-GAAP operating loss to be between $33.5 million and $20.5 million. We expect our non-GAAP net loss per basic and diluted share to be in the range of $0.92 to $0.60. For the full year, we expect about 40.7 million basic and diluted shares and about $10 million in taxes.

Given that we surpassed our subscription transition bookings mix of 85%, we want to reiterate the impact on the business for 2022. As we talked about last quarter, the faster SaaS-heavy transition is having an impact on the slope of revenue growth and profitability exiting the transition. For the next few quarters, we will continue to face a headwind to our revenue and profitability given last year's booking mix. Annual recurring revenue and the subscription portion of ARR are the best metrics to evaluate the health of the business.

As you saw from our guidance, revenue is rebounding already in 2022 with 18% growth at the midpoint of the guidance. We also want to reiterate that our approach to investment hasn't changed. The profitability of our operations is masked by the subscription transition, and we expect to return to the Rule of 40 once the transition dynamics play out. Given the acceleration of our business, we are increasing our full year guidance for annual recurring revenue, which we now expect to be between $535 million and $541 million at December 31, 2022. That's a 37% growth year-over-year at the midpoint.

We continue to expect maintenance ARR to decline, which impacts the total ARR growth rate. When you think about our guidance, it is important to note. First, the combination of higher mix headwind and revenue midpoint means we are increasing the booking assumptions underlying our guidance. And second, raising our full year ARR guidance after just the first quarter of the year demonstrates our confidence in the business and the strong demand we are seeing.

In terms of cash flow, while we had a seasonally very strong first quarter, we still anticipate that it will be in line with our non-GAAP net income margin over a 12-month period. The first quarter was a standout quarter to kick off what I'm confident will be another stellar year for CyberArk. Our bookings mix target for the subscription transition is now behind us. We are focused on capitalizing on the massive opportunity in front of us.

I will now turn the call over to the operator for Q&A.

Question-and-Answer Session

Operator

[Operator Instructions] Your first question is from the line of Saket Kalia from Barclays. Your line is open.

Saket Kalia

Okay. Great. Hey, good morning, guys. Thanks for taking my questions here.

Udi Mokady

Absolutely.

Saket Kalia

Hey, Udi, maybe for you. Great to see the results, first of all, maybe you could just zoom out a little bit and just talk to us a little bit about the competitive environment, and to what extent you feel like the broader identity platform that CyberArk has is helping you competitively.

Udi Mokady

Sure, thanks Saket, and great to hear from you. So I would say that honestly, this is one of the best, if not the best competitive positions we've ever been with in. On the PAM front, some of the traditional PAM vendors are, I would say, are still working through changing hands from private equity and the disruption there is long lasting. And particularly because they haven't been investing in R&D, and that starts to show up in sales cycles and in renewal opportunities.

And in this environment, in this threat landscape environment, it's just critical to make those investments and we're making sure that our identity security platform is -- we're investing in it, it's secure and we keep up with the pace of change in enterprise IT. So that's on the PAM front.

For Access, we see the IDaaS vendor, so Okta and Microsoft, in DevOps, we see Hashi. But our approach is fundamentally different. I think creating the speedboats or those business units we created in 2021 really made a difference. We're better at selling our platform to your question. And customers buy in on our security expertise with PAM, but they want to take the full journey for all identities, human and machine, with us across the platform.

And based on that expertise and the center of excellence we're selected, and I think we're also seeing it in the analyst reports out there, whether it's the Gartner Magic Quadrant for PAM and Forrester wafer for IDaaS. So I would say bottom line, the foundation in PAM really puts us in the best position to go after the full identity security opportunity.

Saket Kalia

Got it, got it. Very clear. Josh, maybe for you for my follow-up. Great to see the full year go up, particularly the ARR. Just to make sure the question's asked, was there anything to note just on timing of deals? It felt like the beat in the quarter was stronger than what most were expecting on ARR. It feels like a portion of that is flowing through, not the entire thing. Again, understanding it's early in the year, so maybe that's the answer, but again, I just want to make sure the question was asked on how you sort of feel about the full year guide going up versus the beat in the quarter.

Josh Siegel

Yes, hi, thanks, Saket and thanks for the question. The revenue in the quarter was impacted by really the great mix of outperforming on bookings, and the overall business that we saw from the first quarter. And our ability to raise for the year is because we outperformed in the first quarter, and we're increasing underlying booking assumptions for the year. And I think you also were alluding to it, but the fact that we're able to increase our guidance now for the ARR this early in the year really attest to our confidence in what we're seeing from the demand environment.

Saket Kalia

Okay. Got it. I’ll get back in queue. Thank you.

Josh Siegel

Thank you.

Operator

Your next question is from the line of Adam Borg from Stifel. Your line is now open.

Adam Borg

Great. And thanks very much for taking the question. This is either for either Udi or Josh, just on EMEA. So it's great to see the traction there, and you talked about bookings. I believe SaaS bookings up triple-digits, but just given the proximity to the war and your larger footprint, maybe just talk a little bit more about the demand trends you're seeing? And has anything changed either positively or negatively in the month of April?

Udi Mokady

Sure, Udi here, and I'll kick it off. I would say we're fresh from actually meeting the EMEA leadership team in person and they are reporting strong demand and very strong pipeline. And if we talk about the macro attention, it's only creating a tailwind of urgency and the need to take a serious look at cybersecurity. So I think some of the trends we saw in the Americas in previous years of increased awareness are definitely reaching Europe. And for us, it's a well-performing region.

Adam Borg

That’s great. And maybe just as a quick follow-up. So it was great to see a record new logos in 1Q, and you talked in the past about that improving velocity and probably the reduced friction in sales cycle. Just curious if you're starting to see a greater emphasis, more down market from your traditional, the enterprise stronghold and kind of what other investments you are making to better capitalize on that. Thanks again.

Udi Mokady

Yes, so again, I would say on all fronts, both on the enterprise front and as we look in the commercial market, we're landing with SaaS. And we have more landing -- we have more landing spots with both Privilege Cloud, EPM and CyberArk Identity. In the commercial sector, as we call it, which is, again, the high end of the mid-market, certainly, they're embracing our SaaS solution and the fact that there is quick time to value, and you can see that, it's about two-thirds of those 250 new logos in Q1 came from that segment of the market.

Adam Borg

Excellent. Thanks, again.

Operator

Your next question is from the line of Rob Owens from Piper Sandler. Your line is now open.

Rob Owens

Great. We'd love to touch on the new logo growth as well. Just given, I think what we've seen throughout the earnings season has been durability of spend, but it really feels like your business is seeing inflection here. So can you maybe speak -- you gave us the 250 number, but maybe speak a little bit to the pipeline that you're seeing as you head into the June quarter here.

Udi Mokady

So we've been talking about the buildup of pipeline in the last several calls, and I think the great new business and the doubling of new business sales is actually executing on that record pipeline we've been talking about landing with more spots, like I just mentioned we're having more solutions is landing spot.

The channel strength and the channel pipeline, and also landing in larger deal sizes, which is often more products and more users. And I would say that the new business portion -- you're asking about the forward-looking pipeline, new business as the percent of pipeline continues to grow. So that trend continues, and it's that strong execution of the team against this demand environment.

Rob Owens

Great. Thank you for the color.

Udi Mokady

Thank you.

Operator

Your next question is from the line of Brian Essex from Goldman Sachs. Your line is no open.

Brian Essex

Hi. Good morning. And thank you taking my question. Maybe to kind of pivot off of Rob's question. Could you give us an understanding -- maybe a little bit of perspective, I guess, during the onset of pandemic, when you saw a little pullback in deal sizes and how the platform is being consumed, given the mix that you have now with greater SaaS mix and the greater awareness, how do you think about the durability of growth and if we were to head into a more challenging macro environment? Where do you think you might see either benefit or risk to the durability of growth with regard to how enterprises consume the platform?

Udi Mokady

Absolutely. I would say, we're confident that we're looking at a durable long-term opportunity. We've done so much in these past two years to create a wide platform and increase our leadership position, expanding from PAM to Identity Security and having those initial, so many lending parts. If you look at the beginning, we talked about customers not being strategic. And if we talk about two years ago, are they thinking about this strategically, they definitely are. They see Identity Security and PAM at the center, as the vector of attack. And we're seeing that trickle across geography, across vertical. You see how diverse we are from a vertical perspective, and that's only strengthening.

And then the adoption of the SaaS solutions, as Josh mentioned, even in regions like APJ where we thought it would take longer here in Europe for the prior question, we just have, I would say, a stronger demand environment, a wider platform-based solution set to execute on that. And you have a management team that has seen different times and crossed those areas with great success. So we're very realistic. We look at numbers. When we allude to the strength of the pipeline and the demand environment, we really believe it's durable and strong.

Brian Essex

Great. That's very helpful. Maybe just a quick follow-up, so I want to congratulate you on the CMO hire. I know, it's early days, but what do you anticipate you might see with regard to changes within the sales and marketing management structure of the company? And how are hiring trends, I guess, expected to be impacted due to the change?

Udi Mokady

Yes, so we expect a smooth transition from an organizational perspective because this was highly embraced by the sales leadership team. And we all believe that we're -- back to your prior question, that we're actually in the best setup right now to step on that set of both on the gross marketing element, elevating our identity security posture and getting it out there, the leadership position that is reflected in the customer base and getting it out there and leveraging this flywheel effect that we're now seeing from that platform.

So we love that Simon comes from SaaS and in building great brands. And so it is basically hit the ground running. So our expectation is upwards and outwards. And like I mentioned, our next upcoming thing is our first event, our first live event out of the pandemic in July with our customers and prospects.

Brian Essex

Excellent. Thank you. Appreciate the color.

Udi Mokady

Thank you.

Operator

[Operator Instructions] Your next question is from Fatima Boolani from Citi. Your line is now open.

Fatima Boolani

Good morning. Thank you for taking my question. Udi, I want to go back to the script. You talked about Linux support for EPM. I'm curious if you can characterize and quantify for us how much of that actually opens up incremental opportunity around endpoint privilege management that you previously weren't addressing? And how that might change the competitive or co-optitive dynamic with some of the traditionally defined endpoint security vendors.. And then I have a quick follow-up for Josh, please.

Udi Mokady

First of all, great question, and I only have one sentence for it, but I'm super excited about EPM for Linux, because first of all, EPM is one of our strong performance and more than doubled for us along with the other SaaS solutions.

And I would say from a leadership position, it's just a great -- we're in a great place, but we've been addressing so far, Windows endpoints, Windows servers and endpoints and Mac endpoints, and this really takes us to the Linux platform, both servers and there are, of course, Linux endpoints as well and really taking us into our customers' cloud environments and for those who are hybrid to the data centers and giving them a UVA, that same easy to manage policies for lease privilege for the Linux environment, which is so important to -- in preventing ransomware and privilege escalation and all the, I would say, non-repeatable points of attack.

So I would say, it's within the huge TAM that we're addressing, but we went after the Windows environment first, and the team and our channels are very excited about this, and we'll make more of a splash at our Impact events.

From a competitive standpoint, I talked about standalone -- we have been fully partnering with the EDR vendors to date. EPM is not an EDR solution. It's an Identity Security solution for enforcing lease privilege on the endpoint. And we think that it applies just the same as we expand to the Linux environment. But from a standalone competitive standpoint, it gives us even additional advantage to do what we have today to be able to basically cover all platforms. And again, leverage the multiple learnings points we have. We have now to also Linux.

Fatima Boolani

And Josh, very quickly, I appreciate the EMEA demand environment and the feedback you're getting from the regional sales team, has been pretty robust and strong. But I was hoping you could more discreetly address any business activity in the conflict regions? And if there was any financial impact to your business vis-à-vis any suspension of operations, any write-down of business? Any quantification on your reserve current exposure would be very helpful. Thank you.

Josh Siegel

Yeah, Fatima, thanks. That area, it's not impacting our results. It's already reflected in our guidance. We're not doing business there. And in total anyway, the whole area is less than 1%. So on the flip side, it's kind of a tailwind when you think about the geopolitical volatility, especially as it elevates cyber risk, but we don't see it being a material impact on us.

Fatima Boolani

Thank you.

Operator

Your next question is from the line of Gregg Moskowitz from Mizuho. Your line is now open.

Gregg Moskowitz

Okay. Thank you for taking the question. Very impressive acceleration in ARR, congrats as well on reaching subscription bookings transition so far, the target so far ahead of schedule. So, I had a question, Udi, on EPM as well. Can you maybe just expand on what has made EPM in particular, so much more valuable to the point where it's become a key driver of that acceleration that you've been showing?

Udi Mokady

Yeah. I think it's -- the whole Zero Trust framework doesn't really work if someone can take over that end machine that somebody is establishing, that touch point or handshake with. The EPM really allows organizations to know that, okay, that endpoint will run with minimal privileges. We'll be in a lease provisional model and it's really foundational to Zero Trust. And then there's the additional added benefit discovered over the years. I mean it was -- at least it really prevents a malware from running and moving laterally and it's become an important force point for preventing ransomware from spreading.

And so we see those two major drivers and solutions to help basic cyber hygiene of running a lease privilege mode to support the Zero Trust framework and it helps prevent even ransomware landed. It helps to run most ransomware from landing, but even if it landed from proper gaming. And, of course, the many years of investing in making it super user-friendly is that it applies to all users in an organization, and they don't feel that, it's very transparent to the user.

Gregg Moskowitz

All right. That’s great. And then just as a follow-up, Udi, can you talk to how your global government business performed this quarter, as well as what your expectations are for this vertical over the rest of the year? Thank you.

Udi Mokady

Yeah. No, absolutely. As you can see probably in the slides that we presented, the global government is nicely at 10% part of the pie. And really, I would say we're seeing steady adoption worldwide, and it continues to be an important vertical that we're investing in. I talked about the investment in the FedRAMP certifications to be able to begin to sell our SaaS solutions to the US federal government, but we're seeing adoption around the world both for SaaS solutions, but also for governments that do want our self-hosted. We're giving that optionality, and that's very important for them. And very often now, US certifications are giving us credit elsewhere around the world on our investments in the security and scalability of the platform.

Gregg Moskowitz

Perfect. Thank you.

Udi Mokady

Thank you.

Operator

Your next question is from the line of Hamza Fodderwala from Morgan Stanley. Your line is now open.

Hamza Fodderwala

Hey guys, thanks for taking my question. So, really appreciate all the great detail earlier. Maybe just one for Josh. I'm curious as you think about your full year outlook, how are you handicapping for all the macro uncertainty out there? I get that security right now is fairly defensive given the geopolitical volatility. But in the past, CyberArk has had, I think, relatively longer sales cycles. And then in relation to that, how should we think about the seasonality in net new ARR for the rest of the year?

Josh Siegel

Yeah. So thanks Hamza. I mean with regard to your first question, we're very confident about what's going on this year. Obviously, the economy will do what the economy was doing, but I think Udi addressed it earlier on today that we have a very strong, resilient type of a business model that is basically especially now with us hitting our subscription mix at over 85%, we're really now driving towards going through to the other side of the transition towards growth and profitability. And when we think about this year, the demand environment has not changed, and if anything, has strengthened in the course of time. I mean, I think we saw news even this morning of pretty material events in Costa Rica. And so we're continuing to invest.

However, I will point out that we're an experienced management team, and Udi already talked about this before. So we understand that we're constantly monitoring the situation, but at this point, we're very confident on where the business is, where our pipeline is and the demand environment around cyber. So it's sail ahead. And on the second question, remind me? There was a second question…

Hamza Fodderwala

On the ARR seasonality for the rest of the year.

Josh Siegel

Yes, so I think clearly, we're -- as we get further and further into the year where the delta and with the delta on the mix, it gets smaller and smaller. So we have much bigger compares when we get into the second half of the year. So you're going to see a smaller growth in ARR, and we started off with a strong growth of 48% in the first quarter. So I think that it will go kind of in tandem with the narrowing of the headwind delta between the 80 -- the high 80s that we're doing in subscription business this year versus the 70s that we did last year. And so Q3 and Q4, we'll have the narrowest jump.

Hamza Fodderwala

Thank you.

Operator

Your next question is from the line of Joshua Tilton from Wolfe Research. Your line is now open.

Joshua Tilton

Hey, guys. Thanks for taking my question, and congrats on the results. I wanted to go back to the ARR raise first. Can you guys maybe just comment on how much of that is possible conservatism versus this dynamic of expanding subscription versus declining maintenance net new ARR that you guys baked into the guidance?

Josh Siegel

Yes, I think we do anticipate some decline in the maintenance, which actually makes our expansion of that ARR guide even much more powerful because we have to make up for that maintenance reduction. And we're really excited about the fact that we're able to come in at a 37% guide for the ARR. And it's -- I would say that the increase is really reflective of a lot from the net new ARR business that we're doing. So, it's not -- it's around the new business that we're doing and the continued renewals and upsell of the existing customers.

Joshua Tilton

And when you guys -- could you possibly maybe just expand on what you're seeing in regards to maybe deal sizes and ASPs as you continue to be more successful with your bundling strategy? And maybe how did that is it all benefit growth in the quarter?

Josh Siegel

Yes. We're actually seeing uptick as we have for several quarters in a row on deal size. And I think Udi alluded to it before, particularly on new biz, which really, really starting to surge this quarter. We saw an uptick on the new biz deal size. So I think -- and it's landing with more products and more users because of how we created the platform strength.

Joshua Tilton

Thanks very much. Appreciate it.

Operator

Your next question is from the line of Roger Boyd from UBS Securities. Your line is now open.

Roger Boyd

Hey. Thank you and congrats on a nice quarter. Wondering if you could talk about the cloud marketplace, AWS marketplace, the size and growth of that pipeline and just how you expect that opportunity to evolve as you push further with Secrets management and add things like EPM for LAX? Thanks.

Udi Mokady

Yes, I'm personally very, very bullish about that the partnership we're building with AWS, and it's kind of a new thing that evolved and started last year. If we look at -- just in Q1, we had great examples of that synergy where it actually complements what our channels are doing and we can streamline opportunities through the mutual AWS customers, and I will say, strong momentum continuing into Q1, and there's a strong pipe build for the rest of the year and for next year.

So we'll try to give more specific numbers, but I can tell you, I can definitely say that there's a strong pipeline built. And you're right that the additional solutions that we are rolling out create even more opportunity on that collaboration. There'll be -- there are some things in the works that we will elaborate in our customer event of more streamlined ways to partner up with AWS.

Roger Boyd

Got it. Makes sense. One quick follow-up. Can you just talk about operational security, OT, the role of CyberArk plays in securing infrastructure? And what you're seeing in demand, just given the emphasis on protecting critical infrastructure worldwide.

Udi Mokady

Yes, yes, we've seen -- I would say, when we -- and I think we even painted that in our last Investor Day that organizations usually leave that part to last, because it's a separate type of network, but we have multiple customers securing their operational technology environment with CyberArk, from electricity companies, energy companies, sometimes even remote locations in their environment.

And so, it's become a stage of, what we call, the CyberArk blueprint as customers roll out Identity Security and Privileged Access Management, they expand to their OT environment. Sometimes we have built-in integrations directly with the providers of, I would say, the endpoint on the operational side.

And sometimes we partner with gateway providers where they bridge us to be able to manage and rotate and secure identities for those environments. I agree with you, it's a growing concern for these infrastructure organizations, and we're an important part of the solution.

Roger Boyd

Great. Thanks a lot.

Udi Mokady

Thank you.

Operator

Your next question is from Ittai Kidron from Oppenheimer. Your line is now open.

Ittai Kidron

Thanks. A lot of questions have been asked. But, Josh, I want to, just from a financial standpoint, it looks like perpetual is kind of coming down. So in your guide for the next quarter, can you help us kind of get our hands on what do you think perpetual revenue? What is your assumption for perpetual revenue as part of the overall pie?

And then, second question is around inflation. Clearly, everyone is carrying the higher expenses with inflation, we feel it everywhere. How do you think about price increases going forward in your products or perhaps on maintenance as well? I mean, it's the first time that maintenance is down quarter-over-quarter ARR. So I'm just kind of trying to understand, how you're going to play that price increase card going forward.

Josh Siegel

I'll start with the second question, so I don't forget it. But -- so we do have price increases, particularly as we – particularly, around the maintenance and things that are also very personnel related. So in terms of services, in terms of maintenance, in terms of renewals, we have built in ways for price increases. I think also, when we think about our perpetual, those prices have increased as well. And we – every year, annually, look at price increases as it relates to the current inflation. But we have incorporated that, into our model for this year. And with regard to the perpetual revenue, I mean, we gave the kind of the mix at guiding for Q2. And a related headwind, I think the best way to look at it's probably similar to Q1.

Ittai Kidron

Very good. Excellent. Thank you.

Josh Siegel

Yeah.

Operator

Your next question is from the line of Eric Heath from KeyBanc Capital. Your line is now open.

Eric Heath

Great. Thanks for taking my question, and I'll echo my congrats as well. Udi, just curious to hear your thoughts maybe on the impact of the after security incident in the quarter, what that might have had an impact on the market more broadly? And maybe how it affected your business or customer conversations in the quarter? And more specifically, just curious, if you saw this provide a tailwind for your vendor access solution?

Udi Mokady

Yeah. So I would say that, it underscores that every company has to be diligent on security. And so it became one of those things, one of those names that come up or an example of a brief that comes up on that importance of investing in security and also to your last point in ensuring the vendor access and third-party controls. We have a six to six month cycle. So it didn't have a Q1 impact, but I think the important thing is the momentum we're seeing in for our access solution is really because customers are requiring a security-first approach. It helps us emphasize you need a security-first approach and this foundation of, a, from the makers of PAM were coming from PAM security most users and third parties, we're well positioned. So I think the example – it can also lead to that growing awareness of the importance to – for securing third-party and vendor access. And the most important thing is that we're proud of our security-first approach to identity.

Eric Heath

Okay. That's helpful. And just one quick follow-up. Just on Secrets Management. Just curious on an update the timing of the launch of the cloud version and how you might see that changing your competitive positioning or maybe an accelerating adoption of Secrets Management within your customer base?

Udi Mokady

Yeah, so like, it's – we'll give more specific timing. It's going to be launched this year. It will take away some of the reduced the time to value for customers. So any time we do that, and we've done that across the portfolio, it helps in adoption and will give us a competitive edge. So, in terms of timing, the SaaS version will be within this year and stay tuned.

In the meantime, we're helping customers in their hybrid environment and signing up some great marquee accounts and again, especially in their modern Kubernetes container environments like I mentioned.

Eric Heath

Great. Thank you.

Udi Mokady

Thank you.

Operator

Your next question is from the line of Trevor Walsh from JMP Securities. Your line is now open.

Trevor Walsh

Great. Good morning. Thanks for taking my question. Maybe just one quick one for you, Udi. I wanted to follow-up on one of the points you made during your prepared remarks around wins. You mentioned the cryptocurrency company that had actually replaced a homegrown solution. I just wanted to confirm or kind of make sure I'm clear. Was that a PAM-related homegrown solution, something we in the access space? If you could maybe give us some more detail there.

And then as a follow-up to that, is that a trend that you see just generally within the PAM part of the house of customers kind of having home-grown solutions. I mean, if you can give us some more color around that trend as you see it.

Udi Mokady

It’s a great question. I actually would say that in the past, it was in our early years is when we saw that some of the highly regulated organizations we're making an attempt to create their own homegrown and we were rapidly replacing that, and we're familiar with our strength in the financial industry.

I think this was an example where kind of type of a born on modern environment company took a stab at building it on its own and just saw that it doesn't scale and it's not -- and it doesn't provide the security that they need. So, it was a great win for us. And just like we saw other great wins in the quarter in born-in-the-cloud type organizations where we can come in and be part of the solution. And of course, they're very similar to a financial organization and are very -- and are highly targeted. So, it was a great win for us. And actually, I'm hoping that one of the days we will be able to actually show a case study and disclose the customer name with their consent because it's definitely a great --.

Trevor Walsh

Good. Thanks again and good job on the quarter.

Udi Mokady

Thank you very much.

Operator

Your next question is from the line of Andrew Nowinski from Wells Fargo. Your line is now open.

Justin Donati

Hi. This is Justin on for Andy. Thanks for taking my question. You've talked about the strong pipeline. I was just wondering if you could quantify anything around how your win -- sorry, your win rates have been trending. And just any color you could add there? Thank you.

Udi Mokady

Yeah. I don't have numerical. I would say, back to my initial comment, I was just going fast because we're at the end of the call. As I mentioned, competitive position is probably one of the best we've seen it in on the PAM front, so that's very strong. And for us, the world of access is an expansion. So we're very excited to see our win rates trend up and be very, very differentiated there.

Justin Donati

Okay. And if I could just ask one follow-up question. Outside of PAM, what is typically the next add-on for the customers?

Udi Mokady

So I would say that the landing spots are our Privilege Cloud EPM and CyberArk identity. And often, we see a combination of those in the land. And whatever was not part of that would be the run-off followed by Secrets Management as add-on business, especially in our strategic accounts that follow our blueprint and are expanding us to Secrets Management. But it rotates between Privilege Cloud landing with Privilege Cloud and EPM and/or CyberArk identity and expansion around there. And very often, we're coming in with a package that introduces them and given the flavor of the other solution -- and hence, that's why we talk about the velocity of add-on because they had a pace they're beginning to consume quick times of value and we can get that add-on business faster.

Operator

There are no further questions. Mr. Udi Mokady, please go ahead.

Udi Mokady

Great. Thank you very much. We are thrilled to start 2022 with an incredible quarter with strong demand for Identity Security platform. And as always, I want to thank our customers and partners for being that cornerstone of our success. I also want to extend special appreciation to the entire CyberArk team who came together and worked hard to execute on this subscription transformation strategy and shifting us in five quarters. Amazing. Thank you.

Operator

And with that, this concludes today's conference call. Thank you for attending. You may now disconnect.