CyberArk Software Ltd. (NASDAQ:CYBR) Q4 2021 Earnings Conference Call February 10, 2022 8:30 AM ET

Company Participants

Erica Smith - Vice President, Investor Relations
Udi Mokady - Chairman and CEO
Josh Siegel - Chief Financial Officer

Conference Call Participants

Saket Kalia - Barclays Capital
Jonathan Ho - William Blair
Hamza Fodderwala - Morgan Stanley
Doug Anmuth - JPMorgan
Rob Owens - Piper Sandler
Brian Essex - Goldman Sachs
Tal Liani - Bank of America
Adam Borg - Stifel
Jonathan Ruykhaver - Baird
Ittai Kidron - Oppenheimer
Fatima Boolani - Citi
Joshua Tilton - Wolfe Research
Roger Boyd - UBS
Imtiaz Koujalgi - Guggenheim Partners
Alex Henderson - Needham

Operator

Good day and thank you for standing by. Welcome to CyberArk Fourth Quarter and Full Year 2021 Earnings Call. At this time, all participants are in a listen-only mode. After the speaker presentation, there will be a question-and-answer session. [Operator Instructions] Please be advise that today’s conference is being recorded. [Operator Instructions]

I would now like to hand the conference over to your speaker today, Erica Smith. Please go ahead.

Erica Smith

Thank you, April. Good morning. Thank you for joining us today to review CyberArk’s fourth quarter and year end 2021 financial results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open the call up for a question-and-answer session.

Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management’s best judgment based on currently available information.

I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operations for the first quarter and full year 2022. Our actual results might differ materially from those projected in these forward-looking statements.

I direct your attention to the risk factors contained in the company’s annual report on Form 20-F filed with the U.S. Securities and Exchange Commission, and those referenced in today’s press release that are posted to CyberArk’s website, as well as risks regarding our ability to actively transition the business to a subscription model, the duration and scope of the COVID-19 pandemic, its related impact on global economies and our ability to adjust in response to the global -- to the COVID-19 pandemic. CyberArk expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made today.

Additionally, non-GAAP financial measures will be discussed on this conference call. Reconciliations to the most directly comparable GAAP financial measures are also available in today’s press release, as well as in an updated investor presentation that outlines the financial discussion in today’s call.

We also want to remind you that we provide the calculated headwind for additional color on the impact of our subscription bookings mix shift, but it should not be viewed as comparable to or a substitute for reported GAAP revenues or other GAAP metrics. A webcast of today’s call is also available on our website in the IR section.

With that, I would like to turn the call over to our Chairman and Chief Executive Officer, Udi Mokady. Udi?

Udi Mokady

Thanks, Erica, and thanks, everyone, for joining the call this morning. It was a record breaking year for CyberArk best characterized by transformation, outperformance and acceleration. Momentum continue to build as we move through 2021, culminating in a record fourth quarter. The most important takeaway from Q4 is that we experienced another step function increase in demand for our platform, with our SaaS solutions driving our performance.

We delivered the largest ever sequential increase in ARR of an incredible record Q3. Subscription ARR reached $183 million and growth accelerated to 146%. Total ARR reached $393 million and growth accelerated to 44%.

Again, in the fourth quarter, we significantly beat our bookings assumptions, resulting in total revenue of $151 million and the 71% of booking mix, with a $33 million calculated revenue headwind, all above the guidance framework. While subscription transition max the underlying growth of the business, if you adjust for maintenance bookings, our license line grew by about 40% in the fourth quarter.

Geographically we had another perfect game, every region outperformed our guidance framework. From every angle it was stellar quarter. Operations, we outperformed against our strategic imperatives to drive growth, execute our subscription transition, continue to deliver innovation and profitably scale our operations.

I will frame today’s discussion around these pillars starting with growth. We are one of the best -- we are in one of the best positions if not the best position to drive long-term sustainable growth. The strong secular tailwind of digital transformation, cloud migration and attacker innovation gathered more steam in the fourth quarter and continue to push Identity Security to the center of every customer discussion.

As we all know, 2021 kicked off under the dark cloud with SolarWinds and we ended the year with the Log4j vulnerability, with countless attacks in between. Most recently, Cisco published an advisory of a state sponsored advanced persistent threat or APT in this attack and others throughout the year. Stolen credentials were the common denominator leverage in the attacking. The threat landscape is the most aggressive that I’ve ever received. With our foundation intact, we are in the best position of any vendor to address the any security challenge.

Our results demonstrate that enterprises agreed. While post-breach activity is a small part of our business, we have been fully through engagements in the wake of these attacks, as the second call the hybrid mediation firms, because of our trusted advisor status and cybersecurity experts.

Beyond secular tailwinds we make the right strategic moves at the right time. Supercharging the acceleration of our business, we formally rolled out our Calculation Program early 2021, creating centers of excellence in PAM, Access and DevSecOps, unifying our experience under one umbrella our customer experience under one umbrella and driving the business towards a recurring revenue.

Each quarter in 2021 was significantly better than the previous, with our execution kicking into an even higher year, our Q4 often incredible third quarter, as I mentioned. Importantly, productivity is back well above 2019 levels. This combined with the increased sales capacity creates a strong foundation for growth in the quarters ahead.

SaaS reached -- yet another record with particular strength in Privileged Cloud, Endpoint Privilege Manager and CyberArk Identity. The growth in our Privilege Access Solutions outstripped industry estimates for 2021. On the Access and DevSecOps front the increased focus and specialized resources significantly improved our competitive position.

From a bookings perspective, Access more than doubled in 2021 and we have key competitive enterprise wins for Secrets Manager. We will talk about innovation little bit at Secure Web Sessions and Dynamic Privileged Access are game changers, moving us further ahead of competition.

Optimizing our go-to-market machine paved the way for our record new business this quarter, with more than 375 new logos added during the quarter, a material increase in new business deal sizes.

A few new ways to highlight, as part of this digital transformation, a large broadcaster bought our Identity Security platform because of its foundation in PAM, including Privileged Cloud, Endpoint Privilege Manager, Secrets Manager, Remote Access and Cloud Intolerance Manager.

A travel and transportation company that has outgrown a competitive PAM offering is moving to Privileged Cloud because of our scalability and SaaS types of value. This customer is one among many, turning to CyberArk to meet today’s rigors cyber insurance requirements and charity expected picked up in 2022.

The crippling effects of ransomware contributed to a record year for EPM and also the strong growth in PAM. Our two largest deals in the quarter were expansion from PAM into EPM. We signed our largest ever EPM deal with a European manufacturing company and the major deal into a large U.S. banks. In fact, EPM was a eight of our top 10 deals in the quarter.

With our subscription model resonating and SaaS taking off the velocity of our business is picking up steam with customers adding on both more users and more products SaaS. As examples, expanding from PAM to Identity a regional investment bank that has been work -- has been a CyberArk customer since 2012 and require the efficiency of workforce identity for all its users added to Secure Web Sessions.

As part of a broad PAM program, an existing insurance company -- customer needed a single pane of glass for managing all human and non-human identities, and expanded from core Privileged Access to the Secrets Manager.

Traditionally our customers have leveraged PAM as a jumping off point for their identity security programs, as our platform model is gaining momentum, we are excited to see newer EPM and Cyber Identity customers extended to PAM. In Q4, a global food manufacturing company, a CyberArk Identity customer extended their cyber program with Privileged Cloud, Remote Vendor Access and EPM.

Strengthening our partner program was another focus area in 2021. We are deepening our relationships across our first Global System Integrators and Advisories, Managed Security Service providers, Cloud Marketplace and CQ partners.

On the Cloud Marketplace side, our business with AWS continued to gain traction in the fourth quarter and our pipeline quadrupled. Marketplaces are a productive, efficient, highly scalable, complementary new route to market for CyberArk.

Moving to subscription transition, our transformation is well on its way. And as we mentioned, we outperformed again in the fourth quarter. Our SaaS products continue to lead the way and we are already seeing the flywheel effect. We are confident this will result in higher lifetime value.

We now have more than 890 customers with over $100,000 in annual recurring revenue. Given our success in 2021, we are accelerating the transition exit and expect to reach about 85% of bookings from subscription in the second quarter of 2022 or in just six quarters, which is well ahead of our initial timeline outlined in February of 2021.

Innovation is a core pillar of our growth strategy, and in 2021, we introduced Secure Web Sessions and Dynamic Privileged Access. The pace of demand for Secure Web Sessions is incredibly strong. In the first few weeks after GA, we have key ways and strong pipeline heading into 2022.

Secure Web Sessions harnesses the power of both IDaaS and PAM providing PAM security and controls with a frictionless user experience. It is an elegant solution and no other vendor in the market can provide this level of operational efficiency and security in a single platform.

We also won early Dynamic Privileges Access for EPA customers in Q4. EPA uniquely positioned CyberArk as the only vendor which secures both static and dynamic privileges regardless of environment, from born in the cloud, to hybrid, to self-hosted. We are hearing from customers that the combination of EPA and Secure Web Sessions changes the competitive landscape for Identity Security.

I will wrap up my discussion with some comments on profitability. Our investments in 2021 delivered exceptional returns. With our strong execution, the inflection in the demand environment and our incredibly favorable competitive positioning across PAM, Access and DevSecOps, we plan to invest in growth and innovation in 2020.

Our investments demonstrate the competence in our unprecedented opportunity as a data centric security models are now a requirement. Our approach to investment hasn’t changed. We invest in step with the demand, our focused on impactful spending and given our track record, I am confident in our ability to deliver long-term profitable growth.

Our priorities heading into 2022 include, complete our subscription transition by the second quarter, invest in our global sales organization, including our partner ecosystem to drive growth, protect our ARR by investing in customer success, support and services, and invest in research and development to enhance our data security platform and drive innovation. With our turbocharged performance in the fourth quarter, we are in an incredible position to execute against our massive opportunity.

I will now turn the call over to Josh who will discuss our financial results in more detail and provide you our outlook for the first quarter and full year 2022. Over to you, Josh.

Josh Siegel

Thanks, Udi. We’d like to remind you that we posted slides to the website that will be helpful as we walk through our results. So, as Udi mentioned, we had a record fourth quarter, tapping off an incredible year of acceleration, outperformance and transformation.

In terms of the headline P&L, we generated record total revenue above the high-end of the range of $151.3 million in the fourth quarter, with a 71% mix of subscription bookings. That is ahead of our guidance framework of the 68% mix. We were thrilled to again see both revenue and mix outperformance, really a great demonstration of the strength in our bookings.

Before digging deeper into the P&L revenue, I want to highlight our annual recurring revenue, which illustrates the step function change in the demand environment for the fourth quarter. We experienced our largest ever sequential increase adding $44 million to the subscription ARR in the fourth quarter alone. The subscription portion of our annual recurring revenue reached $183 million, representing over 46% of the total and year-over-year growth accelerating to 146%.

Just one year ago, the subscription portion was only $74 million or 27% of total. Our total ARR was $393 million. That is an acceleration to 44% year-on-year versus 38% year growth that we showed in the third quarter of 2021.

The maintenance portion was $210 million at December 31, and reflects our strong renewal rates. The acceleration in our ARR is driven by the strong demand environment, transformation of our business and great execution of our go-to-market engine, all of which sets us up very well for 2022 and beyond.

In addition, we are pleased with our increased visibility from the strong execution of our transition. We ended 2021 with remaining performance obligation of $516 million. That is 42% growth from year end 2020.

Moving to revenue, subscription revenue that includes SaaS and self-hosted subscription reached $47.6 million and represented 31% of total revenue in the fourth quarter. That’s increasing 142%. Consistent with our transition progress, perpetual license revenue declined to $38.7 million, our maintenance and professional services revenue was $65.1 million, with $55.3 million coming from recurring maintenance and $9.8 million in professional services revenue.

Recurring revenue defined as our total subscription plus our maintenance related to perpetual license revenue reached $102.9 million or 68% of total revenue, growing 48% year-on-year. We continue to have a SaaS revenue transition with nearly 50% of our total bookings coming from SaaS, with our mix reaching 71% in the fourth quarter, we have made great progress transforming CyberArk into a subscription company.

Economically, the headwind created by the mix was approximately $33 million in the fourth quarter, when we compare it like-for-like to the mix in the fourth quarter 2020. Normalizing for the mix shift growth in the license portion of the business, our SaaS, self-hosted subscription and perpetual would have grown about 40% and demonstrates the underlying growth in the business. Taking the calculated revenue into consideration, total revenue growth would have accelerated to 28% year-on-year.

New business also accelerated in the quarter, we signed more than 375 new customers and that’s a record. New business average deal size is also increased by just over 20% in the fourth quarter, driven by strong demand for SaaS in particular.

Geographically, the business is well diversified. The Americas generated $86.2 million in revenue, representing 57% of total revenue, the Americas again had the strongest percentage of SaaS bookings during the quarter. EMEA had $49.3 million in revenue or 33% of total revenue, with SaaS bookings more than doubling over the last year. APJ generated $15.8 billion in revenue or 10% of total revenue, with SaaS and subscription now over 50% of bookings for that quarter.

If we look across the geographies, adjusted for the calculated revenue headwind created by the mix each region would have grown by over 25% in license revenue, with our license line growing over 25% in EMEA, about 45% in the Americas and over 60% in APJ. Normalizing for the revenue headwind, our licensed line grew over 30% in each region on a full year basis.

All items of the P&L will now be discussed on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release.

Our fourth quarter gross profit was $130.1 million or an 86% gross margin. That’s compared with 88% gross margin in the fourth quarter last year, primarily the result of the increase in our SaaS business in 2021.

We continue to make investments to drive innovation and growth, resulting in operating expenses of $113.8 million, a 31% increase year-on-year and operating income of $16.3 million in the quarter, significantly beating the high-end of our guidance.

It is important to remember that our operating income is lowered by $2.2 million from foreign exchange and approximately $33 million calculated revenue headwind. Isolating for the calculated revenue headwind, our operating margin would have been approximately 26% and adjusting for the FX impact, the margin would have increased by another 2 points to 28% in the fourth quarter of 2021.

Net income was $11.8 million or $0.28 per diluted share for the fourth quarter. For the full year, revenue was over $500 million and that’s a great milestone for CyberArk, reaching $502.9 million, with a 66% subscription booking mix for the year.

This resulted in a $74 million calculated headwind for the full year and taking the economic impact from the headwind into consideration, the year-on-year comparison would be over 35% license revenue growth and 24% total revenue growth.

To underscore how great a year 2021 was for CyberArk, I wanted to reflect on the guidance we sat in February 2021. The top of our revenue range was $496 million and that assumed a 55% mix and a $39 million headwind.

We generated revenue above the range and our mix reached 66% or 11 percentage points above our framework, which resulted in a total calculated revenue headwind in 2021 of $74 million. The bookings underlying our results materially beat the assumptions in our guidance. As Udi mentioned, there was a step up function increase in demand for our solutions with momentum building both in our bookings and in our pipeline, as we moved through the year.

Moving to the full year P&L, operating expenses increased by 31%, as we invested to deliver against the strong demand. Operating income was $23.9 million and our EPS was $0.33 per diluted share for the full year.

We continue to attract and retain top talent, a testament to our culture and our success in the market, adding 450 new employees in 2021, the highest number in a single year. We ended December with over 2,100 employees worldwide, with 942 employees in sales and marketing.

For the full year 2021, free cash flow was $65.8 million or 13% free cash flow margin. This cash flow contributed to our strong balance sheet and we now ended the quarter with $1.2 billion in cash and investments.

Turned into our guidance, our guidance for the first quarter of 2022 and a full year reflects the robust industry tailwinds, a record pipeline build, incredible execution and acceleration in our bookings. And so for the first quarter of 2022, we expect total revenue of $125 million to $133 million.

We expect a non-GAAP operating loss of about $16 million to $9 million for the first quarter. We expect our EPS to range from a non-GAAP net loss of $0.42 per basic and diluted share to $0.25 per basic and diluted share. The guidance assumes a jump up to about 79% of subscription bookings mix, and a calculated revenue and profitability headwind of approximately $13 million for the first quarter of 2022.

So if you isolate our licensed lines of SaaS, self-hosted subscription and perpetual, the normalized growth rate taking into account the calculated revenue headwind for the first quarter, would be over 50% year-on-year for just the license portion.

Similarly, for the total revenue, the growth rate will be at 26% at the midpoint of the range taking the headwind into account. Our guidance also assumes 40.3 million basic and diluted shares and about $2 million in taxes.

Looking at the full year 2022, we expect total revenue in the range of $580 million to $598 million. The mix assumption underlying our guidance for the full year is 85% from subscription bookings and our revenue headwind is approximately $53 million.

And now moving down the P&L, for the full year we expect non-GAAP operating loss to be between $34 million and $20 million. We expect our non-GAAP net loss per basic and diluted share to be in the range of $0.98 to $0.64, and for the full year, we expect about 14.7 million basic and diluted chairs and about $10 million in taxes.

For the full year, the increase in our expenses are related to four more major areas, increasing investments in our cloud infrastructure to support our record SaaS bookings in 2021, which will lower our gross margin for the full year to between about 80% and 81%. Changes in exchange rates are increasing our expenses by about $7 million over 2021 in particular for R&D and G&A. We are continuing to make critical investments in R&D, including our SaaS and self-hosted solutions.

And lastly, the investments in sales and marketing, we have deep conviction and the opportunity in our incredibly strong competitive position. More importantly, our productivity levels continue to increase, our win rates are strong and our pipeline is at record levels, which supports productively stepping up our investments to help ensure we capture the opportunity and sustain our strong growth in 2022 and beyond.

At our Investor Day in March of 2021, we discussed the trajectory of the transition, which we expected to take eight to 10 quarters and ARR are to grow at about 30% through the transition. Given our success in 2021, we now expect to hit our original transition target of about an 85% mix from subscription bookings already in the second quarter of this year or only six quarters from when the transition kicked off in the first quarter last year.

As we have consistently pulled in a subscription timeline, it impacts both the growth and profitability curves of the transition. The rebound in revenue is already starting in 2022 with 17% growth and about 32% growth in the licensed lines expected at the midpoint of the guidance range.

As with any transition, a faster timeline has an impact on the bottomline, creating a deeper near-term bottom in margins. While the shape of the transition in terms of revenue growth and operating margin is relatively consistent, the slope of the curves we talked about in March last year are steeper with a faster transition now.

Given the acceleration in our business, we expect annual recurring revenue to be between $530 million and $536 million at December 31, 2022 or 36% growth year-on-year at the midpoint. As we look into 2022, we do expect the maintenance portion of ARR to begin to decline, while this drag -- while this will drag the total growth rate we expect rapid growth in the subscription portion. With our strong performance in 2021, we are on our way to meet $1 billion ARR target, which we now believe we can achieve already by June of 2025.

In terms of free cash flow, we anticipate that will be in line with our non-GAAP net income margin over a 12-month period. We also expect capital expenditures to be in the range of $15 million and $16 million, which represents just about 3 -- under 3% of revenue at the midpoint.

The fourth quarter was a standout quarter to round off an amazing year at CyberArk, the business is firing on all cylinders. As we look ahead, we expect to hit our subscription transition target goal much faster than we originally anticipated. Our sustainable growth drivers paired with outstanding execution from our team put us in a great position to deliver long-term growth and profitability.

I will now turn the call over to the Operator for Q&A. Operator?

Question-and-Answer Session

Operator

[Operator Instructions] And your first question is from Saket Kalia with Barclays Capital.

Saket Kalia

Okay. Great. Hey, guys. Thanks for taking my question here. Great to see the ARR acceleration.

Udi Mokady

Thank you, Saket.

Saket Kalia

Maybe if I can just a two-part question that’s kind of related for both of you. Udi, again, on the ARR acceleration, just starting high level, what do you think is driving the demand? It sounds different? So I’m just kind of curious how you position that? And then, Josh, for you, the guide for next year assumes nice growth in net new, you touched on some of this in your prepared remarks, but can you just kind of lay out a little bit more about sort of what gives you the confidence in guiding to that, that healthy net new ARR. Sorry, there’s a lot there, but does all that make sense?

Udi Mokady

Absolutely. So I will kick it off. We really executed, I would say, executed and fired all cylinders against a strong and growing demand environment. What we’re seeing is that companies are recognizing the importance of PAM and Identity Security as that layer in the platform you need and that assume breach environment in this heightened threat environment, whether either back to vulnerabilities like Log4j or SolarWinds and others you have to assume breach and we call it the assume identity, what are the attacker is going to go after, how will they propagate the attack and also identity is a landing point. And so conditions are aware of the importance of this layer with Privileged Access Management at the center and they was expanding to identity security controls and they partner with the market leader in the space that can support their complex hybrid environment and continuously invest in innovation. I would say that we’re in one of the most best competitive positions we’ve ever been. It’s very clear, if you look at the growth of the business in 2021 that in light of industry, industry reports, analysts reports that we’re taking market share. So going after this demand and executing against it and always innovating, because we see that we have their back for the long run.

Josh Siegel

And Saket, I’ll add to the follow-up of your question, based off of what Udi just talked about in terms of the demand environment. I can look under the hood and we talked about record -- again record pipeline growth during last year. So we look at our pipeline levels and our win rates.

We also looked at the execution that we’re going, that we’re coming out of Q4 that we’re going into this year with and our productivity levels from our go-to-market teams in the last quarter and really over the last several quarters.

And I think the third point is that we talked about the hiring this year, we have built capacity to be able to meet that, that accelerating demand environment. And so, we really are confident about how we look at 2022.

Saket Kalia

Makes sense. Thanks, guys.

Udi Mokady

Thank you.

Operator

Your next question is from Jonathan Ho with William Blair.

Jonathan Ho

Hi. Good morning. Let me echo my congratulations on a very strong quarter as well. I guess one thing I wanted to understand a little bit better is, would you see this opportunity to incrementally invest on the sales and marketing side? Are there any particular geographies or verticals or that these new marketplaces. Can you just really help us understand, just given the strong backdrop, where you can have the most impact? Thank you.

Josh Siegel

Yeah. Right now we’re seeing demand increase both in enterprise and in our commercial business, and we’re going across those two, I would say, as I mentioned, and globally, so the global opportunity across the organization. We, of course, the partners are writing stuff with us. There’s investing in everything has to do with increasing our work with the channel partners around the world.

And then, of course, everything that we’re doing around securing the ARR around customer success and walking our customers through this cycle. We’re very excited to see the platform in play and some of the examples I gave of customers really moving our cross products, if it’s taking more usage also growing cross product, and of course, we have the speedboats that are unique motion for us for both Access and DevSecOps and that’s another part of investment. So in all of the above and we’re confident that we are -- like, we saw in 2021 that we’ll see earnings coming from that.

Operator

Your next question is from Hamza Fodderwala with Morgan Stanley.

Hamza Fodderwala

Hey, guys. Thanks for taking my question. I want to follow up on a question in line with what had Saket asked. So, Josh, for you, you obviously did a great job highlighting a lot of the growth drivers for 2022. If I look at your ARR guide, and I assume maintenance -- let’s assume is just a flat, you’re guiding for about a 30% growth in net new sub ARR after what was a really strong acceleration in 2021. So I’m curious, how much of that is attributed to this demand inflection that you spoken so clearly about in the back half of last year versus a faster transition? And put it bluntly, do you feel like you’ve given yourself enough wiggle room to really outperform like you did last year?

Josh Siegel

Yeah. Yeah. Thanks. And I think you got it right. You -- it was important that you talked about the maintenance piece of the ARR as well, because we do actually and I call it out in my prepared remarks that we can and we will probably see -- start to see the decline even in -- on the maintenance ARR, but then the super growth rate on the subscription piece of the ARR.

And the competence, again, it’s really coming from, first of all, the faster transition and also the SaaS heavy side of the transition. And we’re seeing Privileged Cloud really being a big piece of that. And not just, we’re also seeing Privilege Cloud also going even further up market and we talked a little bit about our average deal size is going up as well, especially for new logos and it’s really tied to Privilege Cloud success also further up market and the value that our customers in the enterprise are seeing in the subscription packages and for the self-hosted as well.

So, I think that, the -- we feel confident about the ARR growth, about overachieving, we put out the number in our guidance, that we feel comfortable given, well -- given the information we have in front of us. We had great execution in 2021, but the -- for now the guide is the guide, but absolutely the demand environment is there for us to invest in.

Operator

Your next question is from Sterling Auty with JPMorgan.

Doug Anmuth

Hey. This is Doug on for Sterling. Thank you for taking my question. So in regards to the growth in subscription revenue, can you talk about how much of that is coming from new versus existing customers?

Josh Siegel

Yeah. If we look at the -- if we look at our ARR incremental, we’re seeing about third of it coming from new customers and the balance coming from our existing customers.

Doug Anmuth

Okay. Great. Thank you.

Udi Mokady

Thanks, Sterling.

Operator

Your next question is from Rob Owens with Piper Sandler.

Rob Owens

Great. Good morning, guys. Thanks for taking my question. I want to double click a little bit around the DevSecOps portfolio to understand, is it a lot of that coming from new customers? Is it an add-on? Is it being added into deals? So, is it the actual tip of the spear with new customer acquisition in some cases? Are you seeing it more as part of a suite as customers are looking at this more holistically? Thanks.

Udi Mokady

Absolutely, Rob. Yeah. I would say tip of the spear are much or new tip of the spear are much more EPM and then CyberArk Identity as new landing places for us and strategically and that that was our plan. The Secrets Management and the DevSecOps portfolio is much more of an add-on business to our existing customers and expand from the humans to machine identities and the speedboat really supports that emotion with an overlay team to cater to those needs, and of course, customers want that full platform that covers both the human and machine. And so that’s primarily the case and it’s part of the CyberArk blueprint on how you guide customers to go deep in Identity Security.

Rob Owens

Thank you.

Udi Mokady

Thank you.

Operator

Your next question is from Gregg Moskowitz with Mizuho.

Unidentified Analyst

Yes. Hi. This is Mike [ph] on for Gregg. Thanks for taking the question. I was just wondering, have you made any changes to your sales incentives in 2022 to increase the emphasis of SaaS vis-à-vis perpetual licenses or perhaps even term licenses?

Udi Mokady

Yeah. We made, I would say, the major transitions were in 2021. But I will say that we further ratcheted it up in 2022. And we recently had our global kickoff and it’s very clear that we are incentivizing our team to SaaS and subscription, okay. So I would say further -- and further ratcheted up on some of the things we put in motion in 2021 all ready.

Unidentified Analyst

Great. Thanks.

Udi Mokady

Thank you.

Operator

Your next question is from Brian Essex with Goldman Sachs.

Brian Essex

Hi. Good morning and thank you for taking the question. Maybe just one for Udi and may be more of a longer term strategic type of a question. But if we think about the growing number of enterprise class companies with cloud native architecture, I’m thinking more like a, I don’t know, zoom or Airbnb. I know it’s early stages, but maybe you can hit on three areas in particular. I am curious to see how you’re seeing those types of customers invest in Privileged Cloud or Privileged Access differently than those more traditional hybrid models. How did their Privileged Access strategy and attacks evolve over time and how different is your go-to-market for those deals, as you’re establishing cyber to compete -- CyberArk to compete in those markets?

Udi Mokady

No. Absolutely. I think one of the important strategic initiative for us is to cater to all types of enterprises, when we’re actually seeing a growing success in born in the cloud type entities, because we give them so much optionality, they can consume Privileged Cloud-as-a-service, they can consume our EPM as a landing point for least privilege on the Endpoint and also our new innovations around our like DPA, Dynamic Privileged Access allows them to manage workloads in the just in time environment.

So I would say with some of them the landing at the beginning part were may be different from a hybrid environment, they may look at more traditional core assets to start with first defending active directory, defending critical servers. But the opportunity is very large. They typically have a large number of users cloud native or born in the cloud with a large number of users both from privileged user definition, and of course, from a workforce definition, and a large number of machine identities that we can help solve with our Secrets Management.

Brian Essex

Great. Very helpful. Thank you.

Udi Mokady

Thank you.

Operator

Your next question is from Tal Liani with Bank of America.

Tal Liani

Hi, guys. I have two questions. First is, can you talk about seasonality, I see that fourth quarter last year was also strong and I’m wondering if there is any new seasonality that we need to consider, the fourth quarter is becoming so strong? And then, second, was there any change in the channel or anything that could, demand is being created somehow, you spoke about very strong demand, I’m trying to understand if the demand just happen or you helped it through sales, channel relationship or anything that could explain this demand? And then I have a question on margins.

Udi Mokady

Great. I’ll kick off maybe, Tal, with your second question on channel and hand it over to Josh to talk about seasonality. I think, as I started, first off, the biggest change is in the demand environment and there some trail and the importance of Privileged Access Management and Identity Security, as we have been investing in -- and taking a leadership position in what’s making money for our channels.

And in many of our large VARs out there, we will be in their top five, top 10 vendors and they’re giving it more attention advisories, building practices around CyberArk and new motions around, if you talk about some new motions around MSSP and what I mentioned with the AWS Marketplace.

So I would say, the ongoing investment and the growing priority within the customer and within the channel help us really to execute on the strong pipeline that we built. And yes, some new channel motions introduced as well.

Josh Siegel

And on seasonality Tal, no, I think, we’re still very much an enterprise security software vendor and this is kind of the nature of the beast, and we’re seeing, I think, strong fourth quarters as we have for a while and we don’t necessarily anticipate a change at this point and I think it’s pretty much same.

Tal Liani

Got it. So, Josh, just on margins, so you are going through an investment phase now in cloud infrastructure. What’s the outlook? I’m not looking for specific numbers beyond, but what’s the outlook? Is this going to be multiple years of elevated investments or is it more of an initial investment followed by margin improvement as your volume goes up. I am trying to understand to what extent you need to invest over the next few years?

Josh Siegel

Yeah. Excellent. I think this is -- we’ll continue to invest really into 2022 the same way that we’ve been looking at it over the last, since you’ve been following us, since the public offering, which is investing with the growth and the demand of the market and investing ahead of it to ensure that not only are we going to be able to meet the current years of growth, but when we look at, we always looking at kind of for multiple years and we want to set ourselves up for going into the following year to be able to meet the new capacity and the new growth for the following year as well.

So I don’t think anything’s really changed. There’s a specific incremental investment for 2022. There isn’t more, because we’re seeing a bigger demand and we’re scaling the company. And at this point, that’s what I would say, looking forward as well.

Tal Liani

Okay. Thanks.

Operator

Your next question is from Adam Borg with Stifel.

Adam Borg

Great and thanks so much for taking the question. Maybe for Udi on Endpoint Privileged Manager, it was great to hear the success and some of the deals you called out earlier. Maybe just remind us kind of where we stand now as in terms of the mix of ARR and what kind of uplift it provides relative to a traditional PAM deal?

Udi Mokady

So, if you repeat the last part of the question.

Adam Borg

Yeah. Absolutely. And what kind of monopoly does EPM provide relative to, if you just started with core PAM or Privileged Cloud, what does EPM uplift look like?

Udi Mokady

Yeah. So, first of all, in terms of the -- in terms of -- look, in terms of the outlook for the EPM is basically can be, when we looking at our SaaS perspective. Erica, you have that number?

Erica Smith

Sure. Yeah. I think he started off with what EPM was the percent of the ARR, which is about 22% and so it was right north of 20%.

Udi Mokady

So, north of 20% now the EPM portion of the ARR.

Adam Borg

Great. I mean, it just -- yeah, no, no worries. And then any color on if a standard core PAS or Privileged Cloud deal is a dollar, what kind of uplift EPM was relative to that?

Udi Mokady

Probably about, I would call it about half of that, an additional 50% on top of core PAS.

Adam Borg

Awesome. Thanks so much.

Operator

The next question is from Jonathan Ruykhaver with Baird.

Jonathan Ruykhaver

Yeah. Hey, guys. Congrats on the strong performance. Udi, you’ve talked about PAM like controls for adaptive, Secure Web Sessions, particularly, which seems to be doing extremely well. I’m curious if you could just talk broadly, how you’re thinking about this identity security positioning strategically, just given the importance of Privilege? And what can we see in terms of additional security controls for the product portfolio to further differentiate?

Udi Mokady

Yeah. So these are -- thanks Jonathan. These -- the fresh new things that we’ve rolled out are, like, I mentioned, Secure Web Sessions and Dynamic Privileged Access and you’ll see us -- and again, that’s -- Secure Web Sessions has been very new. But we’re seeing great excitement from customers to be able to defend the regular user. It could be somebody in HR, finance and others, but they’re able to both controls and protection over their session, that are PAM like, but in a transparent way to the user.

You’ve given even the ability to protect the session itself. So that’s new and you’ll see us extending that motion of bringing PAM like controls in a transparent way to the regular user. It also will take place and how we can -- we continue to advance our continuous authentication, making sure that we work in a continuous zero trust in that business verification model.

The other, I would say, long term and continuing investment we have is everything just in time to give more and more optionality for our customers to protect standing access, but more and more just in time scenarios, like, Dynamic Privileged Access, which is brand new and it’s a great differentiator for us. And stay tuned, I think, that’s going to be the -- why our customers select. They know that it’s coming from the makers of that, were now -- were not coming to you with solutions for your workforce, for your vendors, for your third parties, leveraging the same platform.

Jonathan Ruykhaver

That’s helpful. Thanks, Udi.

Udi Mokady

Thank you.

Operator

Your next question is from Ittai Kidron with Oppenheimer.

Ittai Kidron

Yeah. Hey, guys. Great quarter. A couple for me, maybe Udi for you on the SaaS side. I want to double click on that a little bit. Is there any way you can unpack this for us a little bit in the context of how’s the adoption between new customers and existing ones. And with respect to new ones, are you -- is it bring it to the table new customers they didn’t have access to before, I’m just kind of trying to understand how this changes their landscape from a customer standpoint. And for you, Josh, just want to make sure on your guidance for the year, we’ve inflation all around. Are there any price increases that are -- that you’re implementing? And if so, how has they been worked into the guide? Thanks.

Udi Mokady

Yeah. So I will say that the SaaS solutions definitely open up new -- have opened up and we’re seeing that roofing in new opportunities. If you take a look at the new logos, just the record new logos in Q4, about half of them would be, what we would call from the commercial market, which is are still kind of the small type of enterprise, but a new expansion [Technical Difficulty] really crossed verticals. So the ability to get into consumer Privileged Cloud and EPM SaaS, and of course, our CyberArk Identity, it opened up an opportunity further down market. But then I would say cross enterprise, the effect that they can get quicker time to value. It’s such an important layer against this threat environment, it just really expanded our opportunity to give so much optionality to the customer. So it’s really across the Board there.

Josh Siegel

Yeah. And then with regard to the prices, Ittai, so basically, we didn’t do across the Board, because of inflation increases, but we did absolutely have some price increases across certain products and services and it is included in terms of the context of our guide as well.

Ittai Kidron

Very good. Thank you.

Operator

Your next question is from Fatima Boolani with Citi.

Fatima Boolani

Good morning. Thank you for taking your questions. Josh, this one’s for you, just with respect to free cash flow. So it was nice to see the outperformance this quarter. But if you can help walk us through some of the thought process for calendar 2022 as you reinvest, as you accelerate the timeframe by which you are going to complete your subscription transition, as well as some of the drags on the perpetual maintenance or fading away. Anything you can help us vis-à-vis those factors and how we should be thinking about the shape and the complexion of free cash flow in 2022. That’d be really helpful. Thank you.

Josh Siegel

Yeah. Great. The cash flow will -- we will definitely see some seasonality in the cash flow. We probably will see it being on the positive side in the beginning of the year in the early quarter, and then as we -- and then during the middle of the year, it’ll go down and then towards the end of the year, we can see again some improvement on the cash flow. So it’ll be kind of strong in the middle quarters. It will be weaker than towards the end. It could be stronger again.

Fatima Boolani

Thank you.

Udi Mokady

Yeah. Thank you, Fatima.

Fatima Boolani

Thank you, Udi.

Operator

Your next comes from Joshua Tilton with Wolfe Research.

Joshua Tilton

Yeah. Hi, guys. Thanks for taking my question. So, historically, that’s kind of been the 800 pound gorilla in the room in the on-premise PAM market. But as you move to the Cloud, would you say your win rate suggests that you kind of maintain the status and you maybe become the 1000 pound gorilla. Any commentary on kind of the competitive environment and how your position has changed as the PAM moves to the cloud would be great?

Udi Mokady

Yeah. Yeah. Absolutely. That’s one of the most exciting elements for us is that we are the market leader, no matter how you slice it in PAM and in Privileged Cloud, the solution basically has impact investments caught up and then went beyond what we offer on-prem. So the customers can really get the full solution with Privileged Cloud and we’re seeing great win rates and the ability for the customer, like, I said earlier to get quick time to value and expand faster.

So I don’t know what pounds to give it there. But I -- if we were to just slice it and say, hey, how is the leadership from a PAM perspective from -- in SaaS with a clear market leader is there just like we showed up on the Gartner Magic Quadrant three years in a row.

And in this space, we’re seeing that the PAM players have been continuously disrupted by PE and changing hands over the last couple years and really didn’t invest in R&D, while SaaS market continued to invest in R&D and innovation and continue to open up a stronger.

And then take it into the platform approach where we’re approaching everything as a platform sale and customers can say, well, we’re starting to do with Privileged Cloud, but while you’re -- you have been also security on the Endpoint and Secrets Management or on my workforce and vendors. And so that that’s really another great differentiator there for the SaaS motion.

Josh Siegel

Udi, I want to interject here and make -- and just call out a correction. We said earlier that the EPM was 20% of total ARR and I want to make sure that it was clear that was 20% of subscription and our ARR was 40 PAM, so correct to that.

Operator

Your next question is from Roger Boyd with UBS.

Roger Boyd

Thanks for taking my questions and congrats on the nice end of the year. Udi, you’d mentioned the impact of the tighter cyber insurance market at the tailwind. I am just wondering also to what we’re seeing their higher premiums, lower capacity, is it possible to talk about maybe what percent of new deals you’re seeing being influenced by cyber insurance conditions and maybe how you expect that tailwind to hold up in 2022?

Udi Mokady

No. Thanks for that. I would say it’s still not a percentage that we can put out there. It’s more anecdotal, but it’s coming up in conversation as another reason. So I don’t think we’re dependent on this driver in shape or form.

But it’s an additional driver that’s added to everything we’ve seen before, facility care and expanding that organizations needed. But now they’re already getting absolute for different elements of Identity Security, Privileged Access, Secrets Management, elements of MSA and protecting the workforce.

And the fact that they’re clearly asked for it as a condition for cyber insurance is, I would say, an additional tailwind. We definitely do expect it to persist. We think that is just emerging the cyber insurance companies and we know many of them they are finding that, all of their subscribers are in some shape or form getting attacked and they want to put meaningful layers in place to minimize damage and Privileged Access Management and Identity Security is one of those no brainer layers.

Roger Boyd

Terrific. Thanks a lot.

Udi Mokady

Thank you.

Operator

Your next question is from Imtiaz with Guggenheim Partners.

Imtiaz Koujalgi

Yeah. Thanks. I have a question about adaptive, it’s almost six quarters since acquired the company, do you have any update on the ARR run rates for adaptive today. Then I have a follow up.

Udi Mokady

I didn’t hear the end of that.

Erica Smith

As you…

Imtiaz Koujalgi

The adaptive -- ARR contribution from adaptive ARR, the adaptive product.

Udi Mokady

Yeah. We are basically continuously increased after the first year, where we saw kind of the migration into CyberArk. We’ve now seen two quarters in a row where we just sequentially increased it by and I think it’s closing in on around the $20 million number.

Imtiaz Koujalgi

Got it. Thanks. And then for the ARR growth next year, as we complete the transition in the beginning of the middle of next year and the focus for the ARR growth, I guess, ramps up in the first half and then slows down, because now you are ending the transition and then ARR growth look much more with revenue growth, how do you think about the trajectory of ARR growth, I guess, first half and second half next year?

Udi Mokady

I think you’re asking about whether or not there will be seasonality within the ARR growth. No, I think, we -- we are not guiding to ARR from quarter-to-quarter. But we continue to anticipate it growing the ARR every quarter, but we’re not going to talk about guiding for every quarter here.

Operator

Your next question is from Alex Henderson with Needham.

Alex Henderson

Great. Thank you very much. So I was hoping you could talk a little bit about the competitive landscape and not in the way that, I think, most people are thinking about it. So there’s a lot of blurring and swim lanes with people like SailPoint like and even HashiCorp getting into your space. But my sense is that that actually has resulted in an increase in demand for your products as the simulated awareness, but not necessarily impacted your share. And in fact, customers will see them come in hear the pitch and then realize they need the technology and therefore come to you as opposed to going with the spin down initial versions of their products. So we’ve seen the stimulation in demand for Privileged Access as a result of the competitive, the lightweight competitive entry?

Udi Mokady

Thanks, Alex, and I love your angle here. I think, first and foremost, increased demand environment and now increased leadership positions based on merit, having the better products will address all of these broad use cases and definitely Privileged Access Management and expanding to Identity.

I do agree that there has been more publicity to the space from that perspective with announcements of entry that -- a very early products where we do not see those products in the field and customers have heard of those preannouncements. And I don’t know how much we factor that into the awareness, but the awareness is off across the Board for Identity Security and that may be a probably some contributing factor. But the biggest thing are the demand drivers and all of these years of focusing on the customers and focusing on being a broad platform for Identity is bearing fruit for us in a very strong competitive position as strong as I can remember.

Alex Henderson

Great. Thanks.

Udi Mokady

Thank you.

Operator

And I will now pass the call back over to Udi Mokady for closing remarks.

Udi Mokady

Great. Thank you very much. 2021 was an incredible year of transformation for CyberArk and I want to thank our customers, partners and our global, global employees for contributing to this historic year. Thank you very much.

Operator

This concludes today’s conference call. Thank you for participating. You may now disconnect.