CyberArk Software Ltd. (NASDAQ:CYBR) Q3 2021 Earnings Conference Call November 4, 2021 8:30 AM ET

Company Participants

Erica Smith - Vice President, Investor Relations
Udi Mokady - Chairman and Chief Executive Officer
Joshua Siegel - Chief Financial Officer

Conference Call Participants

Saket Kalia - Barclays
Adam Borg - Stifel
Hamza Fodderwala - Morgan Stanley
Brian Essex - Goldman Sachs
Jonathan Ho - William Blair
Roger Boyd - UBS
Gregg Moskowitz - Mizuho Securities
Ittai Kidron - Oppenheimer
Catharine Trebnick - Colliers Securities
Joshua Tilton - Wolfe Research
Imtiaz Koujalgi - Guggenheim Securities
Michael Cikos - Needham & Company

Operator

Hello, and welcome to the Q3 2021 CyberArk Software Limited Earnings Conference Call. All lines have been placed on mute to prevent any background noise. After the speakers’ remarks, there will be a question-and-answer session. [Operator Instructions].

I would now like to turn the call over to Ms. Erica Smith. Please go ahead, ma'am.

Erica Smith

Thank you, Lisa. Good morning. Thank you for joining us today to review CyberArk's third quarter 2021 financial results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open the call up for a question-and-answer session.

Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management's best judgment based on currently available information. I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operations for the fourth quarter and the full year 2021. Our actual results might differ materially from those projected in these forward-looking statements. I direct your attention to the risk factors contained in the company's annual report on Form 20-F filed with the U.S. Securities and Exchange Commission and those referenced in today's press release that are posted to CyberArk's website, as well as risks regarding our ability to actively transition the business to a subscription model, the duration and scope of the COVID-19 pandemic, its related impact on global economies and our ability to adjust in response to the COVID-19 pandemic. CyberArk expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements.

Additionally, non-GAAP financial measures will be discussed on this conference call. Reconciliations to the most directly comparable GAAP financial measures are also available in today's press release as well as in an updated investor presentation that outlines the financial discussion in today's call. We also want to remind you that we provide the calculated headwind calculation for additional color on the impact of our subscription bookings mix shift but it should not be viewed as comparable to or a substitute for reported GAAP revenues or other GAAP metrics. A webcast of today's call is also available on our website in the IR section.

With that, I'd like to turn the call over to our Chairman and Chief Executive Officer, Udi Mokady. Udi?

Udi Mokady

Thanks, Erica, and thanks, everyone, for joining the call. Q3 was another amazing quarter and we are thrilled with our results. If I could use only 1 word to characterize this quarter, it would be acceleration, acceleration in the demand environment, and the underlying growth of the company, specifically bookings and in the metrics that demonstrate the health of the business. As examples, subscription ARR growth accelerated to 131%, reaching $139 million. Total ARR growth accelerated to 38%, reaching $344 million. Recurring revenue growth accelerated to 41%, reaching $89 million and new logos added during the quarter accelerated to over 230.

Our standout performance in Q3, following an incredible second quarter was again driven by record SaaS bookings, record total bookings, the execution of our subscription transformation and robust demand for our Identity Security platform centered on Privileged Access Management. Customers are embracing the subscription model as evidenced by 72% of new license bookings coming from SaaS and subscription in the third quarter, ahead of our guidance framework. Even with the revenue headwind from this mix, we generated total revenue of $122 million, above our midpoint, demonstrating again that our bookings were considerably higher than anticipated in our guidance. One way to think about the growth of the business is to isolate the license line adjusted for the calculated revenue headwind. This would represent license growth of faster than 50% year-over-year, which is indicative of our overall growth. Simply put, it was a stellar quarter.

As we have talked about throughout the year, our subscription mix, ARR and recurring revenue demonstrates the progress in the subscription transition and the strong demand for our SaaS solutions in particular. The 4 pillars of growth, subscription transition, innovation and profitability provide a great backdrop for today's discussion.

Let me start with growth. I love starting here because our growth trajectory has never been stronger. Excellence in our execution and the strong secular tailwinds of digital transformation, cloud migration and attacker innovation contributed to the acceleration in our business. With the acceleration in attacker innovation, our customers now contend with operator-driven ransomware, malware as a service and the tax on automation and supply chains and the DevOps pipeline. It is no longer enough to have an assumed breach mindset. Instead, enterprises have to dig deeper and take and assume identity posture. They recognize that every identity across human users, applications and bots can be privileged under certain conditions. It is easy to see why customer and prospect interest in our solutions is at an all-time high.

Looking at our geographies, we had another perfect game across our major territories. When you adjust for the calculated revenue headwind, every region grew total revenue by over 27% with license revenue obviously growing even faster across the Americas, EMEA and APJ, which Josh will talk about more. New business accelerated, and we added more than 230 marquee customers, as I mentioned, from law firms to software companies, oil and gas to retailers, to large government agencies. We want customers across the spectrum, demonstrating that every organization regardless of size or vertical meets our identity security platform. We typically land with PAM and momentum for Privileged Cloud continues to build both in the mid-market and much deeper in the large enterprise. In fact, in the third quarter, a Fortune 30 company signed our largest annual contract for Privilege Cloud ever, a great win that demonstrates the increased adoption we are seeing in our enterprise customer base.

With our subscription model resonating and SaaS taking off, customers are adding both more users and more products faster. And for customers with large self-hosted footprints, they are expanding with Privilege Cloud to secure new business units that best set pipelines or applications. Endpoint Privilege Manager, or EPM, had another record quarter as the crippling effects of ransomware continue to drive demand. Not only is EPM an expansion opportunity within our customer base, but it is also proving to be a great landing spot for new logos like a large food retailer, a born in the cloud software company and a large local school system to just name a few of the Q3 wins.

The increased focus on specialized resources from the Access and DevSecOps speedboat continued to pay off this quarter. Productivity levels increased in all regions and our cross-sell activity has improved considerably. Access had another strong growth quarter in Q3 with both exciting enterprise wins in our base and a broader set of customer wins in our commercial and emerging markets. I will talk more about our innovations in a few minutes, but identity security where access is tightly alive with PAM is differentiating CyberArk with customers.

I want to highlight a few more customer examples from the third quarter. In a highly competitive deal, an existing financial services customer 1 is the benefits of our identity security platform and will be replacing a legacy access solution with CyberArk Identity. A new financial services customer will be using Privilege Cloud and Conjur to secure secrets. This organization recognizes that securing both human and nonhuman access was critical particularly as every company becomes a de facto software company. Our ability to secure applications anywhere is giving us a nice competitive edge in the DevSecOps space, a high-profile pharmaceutical company bought Privilege Cloud. But more importantly, is committed to implementing a comprehensive identity securing program and PAM is just the first step.

A large insurance company expanded with every 1 of our solutions. They began their journey with CyberArk in 2010, expanding their Privilege Access program along the way. In Q3, they went deep and brought with CyberArk embracing our identity security platform, buying Secrets Manager, Privilege Cloud, remote access, endpoint, Workforce Identity and Cloud Intolerance Manager. We pride ourselves on our culture, building strong lasting relationships and putting the customer at the center of everything we do. This win demonstrates the power of our portfolio, and it shows the criticality of our relationships with enterprise customers. Our partner ecosystem is further extending our reach and driving scale in our go-to-market. Our certification programs have been stepping up as we focus more and more on leveraging our partners to drive growth.

Year-to-date, through Q3, we certified close to 20% more professionals than we did in the full year 2020. This commitment to invest in comprehensive training programs is a testament to the opportunity and significant growth our channel partners expect. A number of our partners are going even deeper into identity security and acquiring companies, including The Herjavec Group and CDW making strategic acquisitions in our space.

Next, I would like to focus on the subscription transition. We made strong progress and outperformed our expectations in the third quarter. Our transition continues to be driven by strong demand for our SaaS solutions, and we reached another new record for SaaS bookings, with particular strength in Privileged Cloud, and endpoint privilege manager. We have completed 3/4 of our active subscription transition and the number of customers with over $100,000 in ARR is now more than 760 growing faster than 40% year-over-year.

As we expected when we began the subscription journey, customers are getting faster type of value and prioritizing our platform, which will result in higher lifetime value over time. We are thrilled with the progress of our subscription transition. And with our success year-to-date, we are confident we will exit the transition by the third quarter of 2022.

Our innovation pillar is the foundation of our strategy, continues to put more distance between us and the competition and further strengthens our leadership position. We announced earlier this week the general availability of Secure Web Sessions, in workforce and customer identity solution. Secure Web Sessions merges the worlds of access and PAM. We are now the only vendor in the market that can empower customers with continuous authentication and session protection, including session recording for all types of web applications from business apps to cloud consoles. We are pleased to see our innovation recognized by industry experts. We were named a leader in the Forrester Wave Identity-as-a-Service for enterprise and an overall privileged access management leader by KuppingerCole. And just yesterday, we announced that we were named the Only Visionary in the 2021 Magic Quadrant for Access Management. We believe we are the undisputed leader in PAM and are leveraging this position to extend our expertise into access.

I will wrap up my discussion with some comments on the profitability pillar. As you've already seen from the acceleration in our business, our investments are paying off. The headwind on profitability from the subscription transition is obscuring the P&L. Given the strength of our bookings, which gives us more scale and our track record of delivering profitable growth, we are well positioned to return to strong profitability levels.

To sum up Q3 quickly. Our business is accelerating on the back of record year-over-year bookings growth. SaaS is leading the way and reached a new record quarter this quarter. Privileged Cloud is pushing into the large enterprise and EPM has moved into the mainstream security discussion. Our subscription transition is making strong progress. Our industry-leading idea security platform across PAM, Access and DevSecOps has never been more relevant.

I will now turn the call over to Josh, who will discuss our financial results in more detail and provide you our outlook for the fourth quarter and full year 2021. Josh, over to you.

Joshua Siegel

Thanks, Udi. Before we discuss the details of the quarter, we would like to remind you that we posted slides to the website that will be helpful as we walk through our results. As Udi mentioned, we had a great third quarter, our license bookings growth meaningfully accelerated even in comparison to a strong Q2 2021. We also made significant progress executing both our subscription transition and our identity security strategy.

In terms of the headline P&L, we delivered total revenue of $121.6 million with a 72% mix of subscription bookings ahead of our guidance framework of a 70% mix. As you may remember from last quarter, revenue above the midpoint of our guidance and a higher subscription bookings mix demonstrates that our total bookings beat our expectations for the quarter. Subscription revenue, which includes our SaaS and on-premise subscription revenue reached $35.3 million and represented 29% of total revenue in the third quarter, increasing in 143% from $14.5 million and only 14% of total revenue in the third quarter last year. Our maintenance and professional services revenue was $63.3 million with $53.6 million from recurring maintenance and $9.6 million in professional services revenue. We continue to have a strong renewal rate on our maintenance renewal business.

Recurring revenue, which includes our subscription and maintenance related on perpetual license revenue reached $88.9 million or 73% of total revenue, growing 41% year-on-year from $62.9 million and 59% of total revenue in the third quarter last year. With a 72% mix of subscription bookings, it is clear the subscription transition is ahead of schedule. Economically, the headwind created by the mix was approximately $16 million in the third quarter when we compare like-for-like to the mix of the third quarter 2020. Normalizing for the mix shift, growth in the license portion of our business, our SaaS, on-premise subscription and perpetual accelerated again in the third quarter to over 50% and is illustrated on the underlying growth in the business. Taking the calculated revenue headwind into consideration, total revenue growth accelerated to 29% year-on-year.

Moving on to the annual recurring revenue. We experienced our largest ever sequential increase in the subscription portion, adding about $29 million in the third quarter and reaching $139 million, representing over 40% of the total. Our total ARR was $344 million, growing 38% year-on-year, that's an acceleration from the second quarter of 2021. The maintenance portion was $206 million at September 30.

We had another great new business quarter, both in terms of new logos and business trends. We signed more than 230 new customers with 85% of them opting for subscription compared to about 59% in the third quarter of last year. New business deal sizes also increased again in the third quarter.

Geographically, the business continues to be well diversified. The Americas generated $68.2 million in revenue, representing 56% of total revenue. The Americas, again, had the strongest percentage of subscription bookings during the quarter. EMEA had $39.7 million in revenue or 33% of total. APJ generated $13.7 million in revenue or 11% of total revenue with an increasing mix of SaaS and subscription.

If we look across the geographies, adjusted for the calculated revenue headwind created by the mix, each region would have grown by over 27% of total revenue, with our license line growing even faster than 50% in the Americas and APJ and approximately 30% in EMEA.

Online items on the P&L will now be discussed on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release. Our third quarter gross profit was $102.5 million or 84% gross margin consistent with the 84% gross margin in the third quarter of last year. We continue to make investments to drive innovation and growth, resulting in operating expenses of $102.4 million. That's a 34% increase year-on-year and operating income was $130,000 in the quarter, which was better than the midpoint of our guidance. It is important to remember that our operating income is lowered by about $1.5 million from FX rates and approximately $16 million of headwind. On a like-for-like basis, neutralizing the calculated revenue headwind and foreign exchange, our operating margin would have been approximately 12% in the third quarter of 2021.

Over 70% of our operating expenses are related to headcount. So in the third quarter, we surpassed 2,000 CyberArk employees, ending the third quarter with 2,075 worldwide. Of our total employee count, 925 are in sales and marketing. Net loss for the third quarter was about $2.4 million or $0.06 per basic and diluted shares. In the first 9 months of 2021, free cash flow was $47.1 million or 13% free cash flow margin. This cash flow contributed to our strong balance sheet and we ended the quarter with $1.2 billion in cash and investments.

Turning to our guidance. Our guidance for the fourth quarter reflects the robust industry tailwinds, our record booking, strong execution year-to-date and improved productivity. For the fourth quarter of 2021, we expect total revenue of $140 million to $148 million. We expect a non-GAAP operating income of about $5.5 million to $11.5 million for the fourth quarter. We expect our EPS to range from non-GAAP net income of $0.06 to $0.21 per diluted share. This guidance assumes about a 68% of subscription bookings mix and a calculated revenue and profitability headwind of approximately $28 million for the fourth quarter of 2021.

So if you isolate our license lines of SaaS, on-premise subscription and perpetual, the normalized growth we are taking into account the calculated revenue headwind for the quarter is about 24% year-on-year. Similarly, for the total revenue, the growth rate would be about 19% at the midpoint of the range, taking the headwind into account. Our guidance also assumes 41.7 million diluted shares.

For the full year of 2021, we expect total revenue in the range of $491.6 million to $499.6 million. The mix assumption underlying our guidance for the full year is 65% from subscription bookings and our revenue headwind for the full year is now approximately $68 million. This represents an increase from our prior guidance, which assumed a mix of 64% from subscription bookings and a $63 million headwind to revenue.

Taking the calculated revenue headwinds into account, our revenue growth rate would be approximately 22% at the midpoint of the range. And if you isolate our license lines, SaaS and subscription and perpetual, the normalized growth rate is over 30% for the full year, taking the calculated hammer into account. I want to emphasize that increasing both our total revenue guidance and our mix indicates that we are again increasing the bookings assumptions underlying our guidance for the full year. This raise is above and beyond the bookings beat in the third quarter.

Now moving down the P&L. We expect non-GAAP operating income to be between $13.1 million to $19.1 million. We expect our non-GAAP net income per diluted share to be in the range of $0.11 to $0.25. For the full year, we expect about 40.9 million weighted average diluted shares and about $13.5 million in taxes.

We wanted to briefly mention our current thoughts on the timing of the transition and on ARR growth. Given our success year-to-date, we expect to exit the transition earlier, and we now expect to complete the transition in the third quarter of 2022 versus the fourth quarter of 2022 as we outlined in our August call. Also, given the acceleration of our growth and our record bookings this year, we expect annual recurring revenue to grow about 37% year-on-year. That's an increase from our prior framework of 35%. The third quarter was a great quarter and another important step in the execution of our subscription transition and our identity security strategy. Our business is accelerating, which you see in our results and recurring revenue growth rates. As we look ahead, we are in a great position to deliver long-term growth and profitability.

I will now turn the call over to the operator for Q&A. Operator?

Question-and-Answer Session

Operator

[Operator Instructions]. Your first question comes from the line of Saket Kalia with Barclays.

Saket Kalia

Udi, maybe just to start with you. It feels like you and the team have been talking about broader identity versus just Privilege here a lot more recently. I was just wondering if you could just talk about how the non-Privilege part of the business is doing. I know you touched on this in the prepared remarks, but maybe just go 1 level deeper. How is the non-Privilege part of the business doing with Access and DevSecOps, for example? And to what extent do you think customers want to buy both of these parts of the portfolio? Does that make sense?

Udi Mokady

Yes, absolutely. Sure thing. So I would say we're excited by the performance of all parts of the business and the fact that Privilege Cloud SaaS is leading the way. But as I mentioned, identity security and our message is really resonating with customers. If you look at the other elements, what you're calling the non-Privilege, first of all, we had EPM have a record quarter this quarter and is proving to be also a new landing point or a landing spot for new customers and really gets also the drivers that are related to Zero Trust and ransomware. And then when we look at the Access of DevSecOps speedboats, they have the power of both appealing to our existing customer base and that is resonating with the identity security message, but also having that speedboat overlay effort that is getting them into new accounts and again, into the upsell. More and more of our customers are buying the wide portfolio. I gave the example of the customer that bought all of our products, that is happening. And I would say that in every conversation and pipeline build, it's across the entire portfolio. I think with some of the bundling, they're actually getting a taste of elements of access, for example, in early deals. And again, I'm excited that the Privileged Access Management piece is on fire and leads the way and with the customer loyalty, we have the opportunity to upsell and get those new landing spots.

Saket Kalia

Josh, maybe for my follow-up for you. It sounds like we're going to exit the transition a quarter earlier than what you had originally expected. Can you just remind us sort of what that means from a mix? Or anything from a mix perspective or just anything we need to keep in mind from a modeling perspective, just kind of given that earlier exit?

Joshua Siegel

Yes. Thanks, Saket. I mean, the main thing is that when we talk about transitioning out of -- into a fully subscription company, we're talking -- we kind of put the threshold that when we get into past 85% of our bookings coming from SaaS and subscription. So when we talk today, about moving that quarter end from Q4 in the last call to now Q3, we're talking about kind of hitting that threshold of 85% or more -- bookings coming from coming from SaaS and subscription in the third quarter already. And what that means is that you'll continue to see the percentage going to perpetual decreasing particularly over next year. And then, of course, there will be after that kind of a tale of the remaining perpetual business happening after the third quarter. But it's really -- we set out a playbook at the beginning of the year, and we're really glad to be able to keep improving on that playbook quarter in, quarter out.

Operator

Your next question comes from the line of Adam Borg with Stifel.

Adam Borg

Maybe just on Secure Web Sessions to start. It seems like an interesting product. And you talked about that in the prepared remarks. I was just curious, kind of are there any particular users or verticals where you think something like this would be more demanded?

Udi Mokady

No, absolutely. We're very excited about it. We see the proliferation of privilege that you have more and more cases where a business user is actually privileged and the organization is worried about having no control over the session. So I would say 1 major part is IT like functions in a business user, whether they're using HR applications or a business application like a Salesforce or a success factors and others. But then also the folks using web sessions for administrative like functions like the web consoles and others. So there are elements that are IT like and there are elements of business users. And in terms of verticals, we actually see it applying across verticals, all companies. Of course, the more regulated will tend to want to put those controls even faster. And the beauty of it is that it can run on any single sign-on solution that doesn't have to just attach to CyberArk, and it gives us the opportunity to sell the solution and apply these PAM like controls to all companies across the -- that even have identity management in place.

Adam Borg

That's really helpful. And maybe just as a quick follow-up. In the slide deck, you talked about the bookings by vertical. It's just interesting to see that over the last several quarters, banking and financials, it becomes a smaller part of the mix as other areas are growing faster and manufacturing stands out. So I'd love to hear more about what's leading to the success you're seeing in some of what I’ll call your less traditional verticals.

Udi Mokady

No, absolutely. I think historically, CyberArk saw the more regulated verticals jumping into the fray earlier and the trend over the last couple of years is Privileged Access Management and identity security consider best practice across all verticals. And you see a catch-up. This quarter, we saw energy the energy vertical, global government, manufacturing more than doubled. And so I would say we're continuing to be applicable to all verticals. There are some verticals that are in a faster catch-up mode. And of course, we have a very strong customer base in the financial sector, and that will continue.

Operator

Your next question comes from the line of Hamza Fodderwala with Morgan Stanley.

Hamza Fodderwala

Udi, first question for you. I was wondering if you can comment a little bit about the growth and opportunity you're seeing in machine-to-machine identity, in particular, just given the rise of open source tools. Any sort of comment there?

Udi Mokady

Yes. And I wanted to add on my earlier answer before, I talked a lot about the opportunity in our Access as we thought that that's very much in the secrets management world, there's growing awareness definitely after SolarWinds and like you mentioned, the proliferation of the DevOps pipeline as the place where attackers are going after. And if you stole a human secret or if you stole a strong machine-to-machine type secret, you can get similar access or even deeper. And so it's definitely applicable to all companies, and we're seeing that grow. We see more and more customers also want to leverage the fact that they can buy our secrets management solution and leverage Privilege Cloud as a solution to attach to. And of course, a lot of the self-hosted customers are expanding to secrets management, and we'll now consume this in the subscription model. So you're right, it's a growing trend where there are -- there's a proliferation of secrets across applications and machines. And if we had these special glasses, we would see, yes, a big proliferation of credentials on the human side, but an even faster and probably out of control on the development side and on the application side, and we're going after it.

Hamza Fodderwala

That's helpful. Just a quick follow-up for for Josh. Just on the ARR, how should we think about the puts and takes with subscription versus maintenance? And then obviously, maintenance is going to be a bit of a drag just given the transition. So how should we think about kind of modeling that over the next few quarters?

Joshua Siegel

Yes, absolutely. We're going to see still a very high growth on the subscription piece of the ARR that we've been seeing. We saw it grow to 131% in the third quarter, and maintenance of the perpetual will kind of continue to trend kind of flat at some point as we get to the transition quarter, we'll start to go even could go potentially minus sequentially. So I think the way we kind of look at it is we can consider already the subscription piece of the ARR business are already crossing over the 50% in the first half of next year. Today, it's around 40% of the total ARR and growing to more than 50% of it in the first half of next year. And in terms of the exact timing of when the maintenance will start to go negative, it's later on in next year, and it really depends on the mix rate.

Operator

Your next question comes from the line of Brian Essex with Goldman Sachs.

Brian Essex

I was wondering if I could follow up on Hamza's question actually. 4Q has historically been a relatively heavy perpetual license quarter. So maybe if you could give us a little bit more color around what the previous changes in incentive compensations to skew the efforts towards SaaS, what the impact is with regard to what you typically see or have typically seen on the perpetual side? And then how do we think about progress with the installed base with regard to kind of transitioning the SaaS. What do you see in your pipeline? And maybe any -- anything you can call out with regard to potential volatility on the perpetual side in fourth quarter?

Udi Mokady

So Brian, I'll start with your second piece. I think the way we approach -- the way we approach this transition was always do right by the customer and follow the trend. I think we were even surprised like I alluded to the existing self-hosted customers are embracing and without us having to push them, they see that as part of their road map. So you see that in the right timing, they also consider and look for ways to adopt our privileged cold solution. Some examples, and like I gave in the script, are some very large CyberArk customers that were self-hosted that bought our Privilege Cloud for new business units or for M&A, where they want to put these controls faster and up and running quickly. And so they'll -- and others are excited to adopt other SaaS solutions like our EPM or identity and look at Privilege Cloud as the solution as they start to downsize their data center, but we will allow them to do it in the right time for them. And of course, every new solution out here has been SaaS, and we're seeing those adopted.

In terms of the incentive, we, of course, put out the program at the beginning of the year incentivizing the team to sell SaaS and subscription with that always do right by the customer. And so existing customers that have had on business lined up for Q4, we're definitely expecting that.

Joshua Siegel

Yes. So -- and I'll add, Brian, in addition, we set out to what Udi just said, we set out a clear playbook for transitioning and included the incentives to the sales teams, as Udi just pointed out, but it also included a full-blown education package of how do we move through going from selling perpetual to selling to SaaS and subscription. And for this year, we're really focused on incentivizing them to quote and to create new pipeline on the SaaS and subscription, which has been definitely happening for us. We've -- we see the majority of our new pipeline coming out as to asset subscription. And I think it's also indicative when we look at 85% of our new logos from the third quarter where SaaS and subscription-based new logos. Specifically around Q4, we do anticipate seeing more perpetual business in Q4. It's not really related to the -- to our compensation or incentive plans, it's just that Q4 is our largest quarter, and also we sell to enterprises. So there's typically budget flush and deals that are opening and closing in the fourth quarter, and those will be to be more add-on deals with existing customers and adding on more licenses in their current installed base, which is most likely going to be a perpetual installed base. So we do expect to see in the fourth quarter a tick up in perpetual. But then again, as we go into next year, we'll start to see more and more in SaaS and subscription because most of the new pipeline this year has been created in SaaS and subscription, and that hence our ability to move in our target to the third quarter of getting over 85%.

Brian Essex

Got it. That's helpful. And maybe just real quick for a follow-up. Given the pull forward in expectation for completion of your transition, thoughts on the -- how you think about spending, I mean, great innovation on the platform. We see the elevated R&D costs. Sales and marketing spend is also elevated relative to historical growth rates. But how do you think about when we might start to see to let an inflection back to kind of double-digit profitability in operating margins and better profitability given the shift in time line forward?

Udi Mokady

Yes. I think it's basically a shift. I mean we -- the way the mechanics work and the transition is going to be all the way through the transition quarter, and the next 1 following is usually the trough of the operating margins. And then you start some slow increasing 1 to 2 quarters after year through the transition. So the early -- the faster we bring in the transition, then we get faster, we can get back there. But we can't control the fact that going through the transition to the end of that quarter. It's still going to take 1 to 2 quarters afterwards before we start to see it rising from there. The rise is not going to be in a single quarter, is going to be gradual over several quarters post that transition.

Operator

Your next question comes from the line of Jonathan Ho with William Blair.

Jonathan Ho

Just wanted to, I guess, start with EPM, just given the success that you're seeing there, is there any change to your thinking around how large EPM could be as a product area? Just want to get a sense for that.

Udi Mokady

Jonathan, it's 1 of the areas where we're -- again, they're all our children, so we're excited about all of them. But EPM is 1 of those that has the -- it's a best practice of reducing risk and removing least privilege but it also is very effective against ransomware. So we think the opportunity is great. And we finally got to a point where the awareness is there for us to further step on the gas and leverage this growth engine. So I'm not going to -- we're not going to refine the TAM numbers we put out there because we saw this opportunity, but it is maturing and like I said, becoming a mainstream awareness that -- of a strong and important control to put in place, both as part of a wider Privileged Access Management program, but also stand-alone. We've put things in place that also bring it more as a landing spot for us, both in how our sales team works but also the type of channels that are expanding and taking us there and even down to the mid-market with channels like CDW that can bring this into the mid-market.

Operator

Your next question comes from the line of Jonathan Ruykhaver with Baird.

Jonathan Ruykhaver

And congrats on the strong performance. Udi, it's great to see the success you're witnessing with Privilege Cloud. I'm wondering if you can talk a little bit more detail about the adoption trends you're seeing in terms of new customer acquisition versus installed base expansion and what you're seeing in terms of those adoption trends across commercial versus large enterprise?

Udi Mokady

Yes. I would say that we're very excited to see the acceleration in the new logos. And part of that is, the solutions are more relevant before the attack surface is expanding and we've built this record pipeline over the past 18 months that we're converting. I think we're seeing in the logos more landing spots with EPM with -- and of course, with Access and with PAM. And the speedboat structure really provides a more subject matter experts to take the opportunity. And then as I mentioned before, we have been investing in the channel and the channel programs, and those are paying off for those landings. So those include the CDW, but they also include doing more with AWS and others.

Now with regards to enterprise versus commercial, if I understood it's really going after both enterprise has been our sweet spot, but with these expanded channels were able to go further down market and it's moving from the highly regulated to the less regulated part of the mid-market, which is exciting.

Jonathan Ruykhaver

And maybe you could talk about that push in the commercial. Where are you in terms of driving that enablement amongst your channel partners? Is this something that becomes more material as a driver to bookings as we look into 2022?

Udi Mokady

I think we want to be -- we want to excel in both Enterprise is the holy grail for CyberArk, it's where we're coming from, and we have the strongest customer base. But we saw that double down our efforts on the commercial without distracting the enterprise focus again because it's incremental types of channels and a focus team that that is going after the commercial space. And so yes, you'll see it continue to be a major source of growth. But of course, the larger deals and the larger ASP is coming from the enterprise part of the business, which is really embracing the identity security messaging and appreciating the innovation we put in place.

Operator

Your next question comes from the line of Roger Boyd with UBS.

Roger Boyd

I was wondering if you could talk a little more about the adaptive customer base and what you're seeing out of these customers in terms of their willingness to upsell the PAM and just general recognition of your strategy of a privileged access centered identity security strategy.

Udi Mokady

Yes, absolutely. I think the biggest motion is upselling the PAM customers on Access and our DevSecOps and Secrets Management. So that's the -- of course, the majority of our 7,000 customers, and we formed those deep relationships where they're happy to explore covering that proliferation of privilege into workforce users into their suppliers, into the third-party elements and to secrets management. The motion of the pure Idaptive customers from the acquisition, the most important piece over the last -- over the last year was to make sure they're happy and growing and then also introduce additional elements to them on the PAM side. But like I said, the bigger motion is expanding with our PAM customers across the portfolio.

Operator

Your next question comes from the line of Gregg Moskowitz with Mizuho.

Gregg Moskowitz

So Udi, I know that existing customers have a loyalty incentive to move to SaaS and with all of the success that you're seeing with respect to the overall subscription transition. I'm wondering if you're also seeing more migrations from on-premise to SaaS?

Udi Mokady

Okay. Yes. Yes. So we incentivize, obviously, our salespeople, but #1 thing is to follow the -- and allow the customers to execute the strategy in their base. But of course, they see the new bundled packages, and that's incentivizing them to look at our subscription, which really -- even if they're an on-premise customer to get more value with add-on business coming into the subscription packages. The move from it for an on-prem customer to adopt -- to move to SaaS is more gradual among the enterprise while we find ourselves pleasantly surprised like some of the examples I gave in the Fortune 30 customer that more and more enterprises are also migrating taking on Privilege Cloud. We'll see that as a pathway over the year -- in the coming years. And 1 of the strength of CyberArk is really giving customers optionality on how to consume the identity security portfolio.

Operator

Your next question comes from the line of Rob Owens with Piper Sandler.

Rob Owens

So Udi, in your prepared remarks, you talked about SaaS driving more users and driving more users faster. Is that a SaaS adoption comments? Or is this democratization of Privilege by SaaS and the fact that there's broader applicability now, especially given the attack surface?

Udi Mokady

I think we're seeing the classic benefits of SaaS, where there's quicker type of value. A customer does not have to install and go through the process of taking care of the infrastructure, and we deliver success packages. And so they get up and running. They see it's working. They see that it alleviated a lot of -- they gave them both security but also the ability to manage their infrastructure faster. And then you have a faster path to the upsell of more users of Privileged Cloud or at our business on other elements of the portfolio. So I would say the benefit of faster time to value, faster time to innovation and an overall quicker path to an add-on sale. But we -- but it's all very real in CyberArk. We put the customer in the center and the entire organization is all about creating customer value.

Operator

Your next question comes from the line of Ittai Kidron with Oppenheimer.

Ittai Kidron

Great quarter. I guess now that you're getting close to the end of the transition with the big question is you're going to have a hard core of customers who are still stuck on perpetual and what is it that you're going to do about and meaning are you going to terminate what is the time line by which you will stop offering perpetual? And what are the odds that midpoint or late next year, you actually raise prices on your maintenance in order to push that last bastion of customers into the subscription model?

Udi Mokady

Yes. We have -- I think our constitution puts the customer first. So -- and that customer loyalty has really worked for us. So I think it's going to be much more on the carrot side versus the stick for them to see more value in the subscription packages, a taste of other elements of the portfolio as they pick up elements of the subscription packages. And overall, we're seeing that they are open to it, especially as they are on a maintenance renewal with CyberArk and are open to expand and take on the subscription packages. And of course, let's remember that maintenance is a great recurring revenue for us as well. And the opportunity is out there to gradually bring them on to the subscription journey and definitely to lead with SaaS to the SaaS journey. And that's the -- and to the prior question, that's where they're going to see even greater value in the transition.

I don't know, Josh, if you want to add anything on.

Joshua Siegel

Yes. No, I think you covered the points and the main issue is that as they add on more and more sales, they're going to be really incented because of our great subscription packages to kind of move their current installed base to an add-on sales to be subscription based. And it's also a form of a tech upgrade for them if they want to now reverse and get that same tech upgrade for their installed base on perpetual. So we see it happening pretty naturally, but there will be a tail once for -- but it's happening naturally as we see it today.

Operator

Your next question comes from the line of Catherine Trebnick with Colliers Securities.

Catharine Trebnick

Udi, could you try to quantify the new business, how much is that really being driven by the acceleration or organizations to really undertake Zero Trust architectures?

Udi Mokady

Yes. Sure, Catherine. I couldn't give a number, but I would say that all the strong business drivers out there, our business of Zero Trust and also the protection against ransomware are strong drivers for our business. And even in the executive order and other elements, it's very clear that least privilege and putting PAM controls is really a basic tenant to achieve Zero Trust. So I would say it's in every customer conversation, definitely at CIO and CSO so level. They like the connection of how CyberArk with PAM at the center, but also the full identity security approach is part of them getting to a Zero Trust or executing on the Zero Trust framework. So it's a great -- a great driver on top of all the enablement we provide and, of course, the proactive protection they can get with our solution. I was -- I want to touch the enablement side because I think the beauty of this portfolio is that we both are a proactive security layer, but we're also really allowing them to get digital transformation going and connect to their suppliers, connect their remote workforce, allow their IT to transform and modernize. And so it's all part of the supporting tailwinds for us, but Zero Trust frameworks are right out there.

Operator

Your next question comes from the line of Joshua Tilton with Wolf Research.

Joshua Tilton

For my first one, I was kind of hoping when we think about the broader identity space, can you just comment on the demand environment, but specifically compare and contrast the demand for Privileged Access Management versus the demand for access management, and maybe how does this compare to 6 months or even a year ago?

Udi Mokady

Yes. So I would say a year ago, we didn't have this combined motion of going after the existing customer base. I think we benefit from the 2 worlds right now where for a customer looking to put in that critical layer of Privileged Access Management, CyberArk is the market leader, go to us. We have the go to market, the reach and the opportunity to really capture that demand is strong and the strongest I can recall for Privileged Access Management. Access is a new motion for us and -- but it's a huge growing market because of the need to enable digital transformation. And we can write it -- and the way we're doing it is very much centered on our customer base that trust us on PAM. So I would say they're both in strong demand. PAM is definitely the 1 that resonates the most with the CISO is a layer that they must have and need to present to the Board. And I would say, even a basic pillar of their cybersecurity strategy. So PAM is more of cybersecurity driven. Our PAM customers trust us with the expansion to the rest of the portfolio, and Access gets the driver of digital transformation and enablement, which is also here to stay.

Operator

Your next question comes from the line of Taz Koujalgi with Guggenheim Securities.

Imtiaz Koujalgi

Can you comment on your Fed performance in this quarter? And any products that show strength in that vertical?

Udi Mokady

Absolutely. So I would say the Federal for us, it was not -- we did see the same levels of budget flush like in previous years. We mostly attribute that to the new administration and budget, but the awareness is stronger than ever. I mentioned the executive order that touches elements of Zero Trust and least privilege and I would say a lot of engagement with various agencies and with our partners in the Federal market. I can share that the global government vertical, if we look at in a full bucket grew more than 100% for us in Q3. And it's very much led by Privileged Access Management as the major, I would say, grower in this segment, where many agencies, many governments still need to do the basics around Privilege Access Management. I also mentioned that the SLED vertical, the state and local and education vertical performed really well in the quarter.

Operator

Your next question comes from the line of Mike Cikos with Needham & Company.

Michael Cikos

First question, I just wanted to touch on the cross-sell motion. Obviously, we're talking about customers once they come to SaaS or subscription are incentivized to continue down that track with their add-on sales. Curious, do you guys have enough data at this point to give us a sense for that cross-sell motion where customers are typically going to next? What's the -- where are they congregating to within CyberArk's portfolio?

Udi Mokady

So it really varies on -- I would say that a PAM, a pure PAM customer would typically expand the EPM as the kind of the next stage of a PAM program. You've secured servers, but you left your endpoints and exposed with over privilege. So it's kind of the next step in the cross-sell. And I did mention earlier, but we're also partnering with the EDR and the XDR companies to actually make it. So the EPM list together and nicely with our partners on that front.

And then from that front, if they're executing on a PAM or an identity program, there's the expansion to secrets management because it's the other side of privilege and then securing their applications and then, of course, to access. And so I would say that if I had to generalize, that would be a course for a PAM customer. In a new account, we're actually seeing that we can land with multiple products as again, the awareness of both what's the best practice in PAM and the bundled elements of identity security we can land with more.

Operator

At this time, I would like to turn the call back over to Mr. Udi Mokady for closing remarks.

Udi Mokady

Thank you, Lisa. Thanks, everyone. I want to thank our customers, partners and employees for contributing to our strong third quarter and supporting our transition to a modern subscription company. I'm confident that as we execute our strategy, we will build even deeper relationships with our customers and partners. Thanks, everyone.

Operator

This concludes today's conference. You may now disconnect.