CyberArk (CYBR) Q4 2022 Earnings Call Transcript

CyberArk (NASDAQ: CYBR) Q4 2022 earnings call dated Feb. 09, 2023

Corporate Participants:

Erica Smith — Senior Vice President of Investor Relations and ESG

Udi Mokady — Chairman and Chief Executive Officer

Matt Cohen — Chief Operating Officer

Josh Siegel — Chief Financial Officer

Analysts:

Saket Kalia — Barclays Capital — Analyst

Hamza Fodderwala — Morgan Stanley — Analyst

Rob Owens — Piper Sandler — Analyst

Fatima Boolani — Citi — Analyst

Eric Heath — KeyBanc Capital Markets — Analyst

Shaul Eyal — Cowen and Company — Analyst

Brian Essex — JPMorgan — Analyst

Adam Borg — Stifel — Analyst

Roger Boyd — UBS Securities — Analyst

Tal Liani — Bank of America — Analyst

Jonathan Ho — William Blair — Analyst

Joshua Tilton — Wolfe Research — Analyst

Gregg Moskowitz — Mizuho — Analyst

Presentation:

Operator

At this time, I would like to welcome everyone to the Q4 2022 CyberArk Software Earnings Conference Call. [Operator Instructions] After the speakers’ remarks, there will be a question-and-answer session. [Operator Instructions] Thank you.

Erica Smith, SVP, Investor Relations and ESG, you may begin your conference.

Erica Smith — Senior Vice President of Investor Relations & ESG

Thank you, Chantal. Good morning. Thank you for joining us today to review CyberArk’s fourth quarter and full year 2022 financial results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer, Matt Cohen, our Chief Operating Officer, and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open the call up to a question-and-answer session.

Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements which reflect management’s best judgment based on currently available information. I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operations for the first quarter, full year 2023, and beyond.

Our actual results might differ materially from those projected in these forward-looking statements. I direct your attention to the risk factors contained in the Company’s annual report on Form 20-F filed with the U.S. Securities and Exchange Commission and those referenced in today’s press release that are posted to the website. CyberArk expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made today.

Additionally, non-GAAP financial measures will be discussed on this conference call. Reconciliations to the most directly comparable GAAP financial measures are also available in today’s press release as well as in an updated investor presentation that outlines the financial discussion in today’s call.

We also want to remind you that we provide the calculated revenue headwind for additional color on the impact of our subscription mix shift, but it should not be viewed as comparable to or a substitute for reported GAAP revenues or other GAAP metrics. A webcast of today’s call is also available on our website in the IR section.

With that, I’d like to turn the call over to our Chairman and Chief Executive Officer, Udi Mokady. Udi?

Udi Mokady — Chairman and Chief Executive Officer

Thanks, Erica, and thanks, everyone, for joining the call.

We had another strong quarter to cap off an amazing year, where we outperformed, executed, and delivered against each of our key strategic initiatives in 2022. We optimized our go-to-market engine, expanded our channel partnerships, and enhanced our platform selling motion.

Our breakaway innovation extended our solutions well beyond PAM and resulted in CyberArk being recognized as the leader in Identity Security. We are in a great competitive position, and we are taking market share, not only in PAM, but across our product portfolio.

We entered 2023 with a more durable, more resilient, and highly visible business model. CyberArk is in a position of strength, well on our way to our $1 billion ARR target, and we have already reset our sights well beyond that. Because of this execution, as we are gearing up for 2023, we recognized that CyberArk was in the best possible position to make the executive changes we announced this morning.

In early April, I will move into the Executive Chair role, and Matt Cohen, our Chief Operating Officer, will become our CEO. Matt is an incredible leader, and I can’t imagine a better person to be the next CEO of CyberArk.

Since joining the company, he had a tremendous value and has been instrumental to our success. He experimented the subscription transition, transformed our go-to-market engine, and has inspired people across the organization to deliver well ahead of expectations. With his support and leadership, we have delivered tremendous results and the Company is set up for long-term success.

While my role with CyberArk is changing as Executive Chair, I’ll stay very active, working with Matt and the management team, I will focus on shaping our future by aligning our long-term strategy to our mission, preserving CyberArk’s unique culture and brand and fostering relationships with key customers and partners. It is very important to me that we get this right and that we have a smooth transition, continuity of leadership and that we don’t skip a beat in our execution.

I believe that our plan accomplishes these objectives. Personally, Matt and I have formed a strong partnership based on shared values, a commitment to our mission, and friendship. We will continue to work together closely to ensure CyberArk executes and that we deliver our vision.

Matt has joined us today, and I’m going to hand it over to him for a few comments. Matt?

Matt Cohen — Chief Operating Officer

Thank you, Udi. It is the honor of a lifetime to be named the next CEO of CyberArk. Udi, along with Josh, the leadership team and every site of our employees have worked hard to build an amazing company. Udi has been a mentor and become a dear friend over the last three years. He is a special leader with genuine empathy and measurable energy and deep passion for our mission, our culture and our people. I am looking so forward to working with him to scale CyberArk, drive profitable growth, and deliver shareholder value.

I will also focus on preserving the Company’s culture, which has been so critical to CyberArk’s success. Our leadership team is completely aligned on our plan for 2023 and our long-term vision and our massive opportunity. Our future has never been brighter, and I am humbled to lead CyberArk’s next chapter.

I will now turn the call back to Udi to talk about the quarter in more detail.

Udi Mokady — Chairman and Chief Executive Officer

Thank you, Matt. Moving into the quarter. Our performance demonstrates a few key points. First, the power of our business model. Second, the durability of demand for our Identity Security platform. And lastly, the strength of our execution. The financial highlights include subscription ARR reached $364 million, growing 99% year-over-year. We also added a record $63 million in net new subscription ARR from the end of Q3. Total ARR reached $570 million, growing 45% year-over-year, well ahead of our November guidance.

ARR is still the best metric to measure our success. We ended the year with more than 1,300 customers, with over $100,000 in annual recurring revenue, growing more than 40% year-over-year. Total revenue came in at $169 million for the fourth quarter, with a subscription booking mix of 90% in Q4, well ahead of our guidance framework. The mix created a revenue headwind of about $24 million. Normalizing the mix for the fourth quarter of last year, our revenue would have grown by 27% this quarter.

The license portion of our business, our SaaS, self-hosted subscription and perpetual would have grown about 42%. As we talk about the quarter, I will frame today’s discussion around growth, innovation, and profitability. Persistent secular tailwinds are contributing to our growth. I’ve spoken to dozens of customers and partners in the last few months, and they all face similar challenges. Digital transformation is leading to an explosion of identities, both human and machine.

Implementing Zero Trust strategies remains complex and time consuming. And attacker innovation is only accelerated with the emergence of new technology and new attack vectors. Take ChatGPT, our lab team posted breakthrough research on ChatGPT, which can dynamically mutate malware, making it incredibly hard to detect and stop. With examples like this, there is a little debate that identity is the attack surface and taking an assumed breach mindset is the best way to protect the enterprise.

In the fourth quarter, we landed with more than 380 new customers. And for the full year, we added more than 1,100 new logos, an all-time record for CyberArk. We continue to see strong diversity in our business and are signing customers from healthcare and biotech, hotel, fashion brands, hospitals, manufacturing, banking, and insurance companies. A few examples include a multinational healthcare company couldn’t scale with its existing PAM point solution, particularly given the increasing number of machine identities within the organization.

In a seven-figure rip and replace deal, the customer will protect human and machine identities with our modern Privilege Cloud and Secrets Management solutions. A large hotel chain is building its enterprise-wide Identity Security program on our platform. During the quarter, this cloud-first organization landed with Privilege Cloud, Workforce Password Management and Dynamic Privileged Access as its first steps with plans to expand to MFA and single sign-on in 2023.

Cyber insurance was once again a driver in Q4 across many examples, including a prominent clothing brand buying Privilege Cloud to meet the insurance requirements and lower premiums. Our subscription transition is increasing the velocity of add-on business, particularly with our SaaS solutions. A few examples. A major hotel chain is accelerating its cloud-first strategy with CyberArk expanding coverage from PAM, CyberArk Identity and Secrets Management to Endpoint Privilege Manager. A Global 2000 financial services company was our first Conjur Cloud customer and also has Secrets Hub. As customers implement Zero Trust strategies, they want the peace of mind with a single pane of glass into all privileged activity, visibility that only CyberArk can provide today.

A Fortune 500 healthcare company expanded its Identity Security program and decided Cloud Entitlements Manager, Endpoint Privilege Manager and Dynamic Privileged Access as game changers for securing its cloud-first environment. We are seeing returns from strengthening our partner program in 2022. The new routes to market, enhance collaboration, and improve efficiency across the ecosystem increased our momentum and significantly expanded our reach. As an example, the number of unique CyberArk certified partners grew by over 90%, and the certifications across our platform continue to grow, a great indication for future growth in our Access and Secrets Management solutions.

Before moving into innovation, we wanted to comment on the macro environment. While Identity Security remains top priority, more approvals continue to be required in deals, consistent with what we saw in prior quarters. The demand trends, deal progression, win rates, renewal rates and sales cycles remain healthy across the board, which we see in our strong ARR growth.

On the innovation side, we were thrilled to be named a leader in the 2022 Gartner Magic Quadrant for Access Management in early Q4, making us the only company to be named a leader by Gartner for both PAM and Access Management. We are already benefiting from the Magic Quadrant with the pipeline for our CyberArk Identity reaching new record. We believe this is another important validation of our strategy to deliver the most complete Identity Security platform in the market.

The enhancements of CyberArk Identity, like flows and our innovations in PAM, including broader threat detection and response on VMs and self-hosted machines differentiate us in the field. Innovation continues to be the cornerstone of our success. In addition, we won our first deals for AWS Secrets Hub and Conjur Cloud during the fourth quarter.

Josh will cover profitability in more detail. But as we look into 2023, we will continue to invest with discipline and expect to leverage each of our operating expense lines. Most importantly, we plan to be agile in our investment plans and have the flexibility to make adjustments as we move through the year. When looking through the transition dynamics, we are operating CyberArk as a Rule of 40 company today and remain committed to delivering profitable growth.

To ensure we capitalize on our growth opportunity, we expanded our management team adding Chris Kelly as CRO. Chris joined us from Adobe, where he scaled the Global Customer Solutions business. Chris is already making an impact. He hit the ground running and participated in our global kickoff last month. He fit seamlessly into the cyber culture and is fully supported by each of our three theater heads.

As we look into the coming year, our top priorities for 2023 include accelerate our Identity Security platform sales motion across PAM, EPM, Access and Secrets Management, further leverage the channel and marketing alignment to extend our reach, enhance our customer success organization at scale to ensure we protect and expand our base of ARR and deliver cutting edge innovation and extend our leadership position in Identity Security.

With our execution over the years, CyberArk is in a position of strength. We have a strong experienced management team focused on executing our strategy. We have a massive market opportunity and are taking market share. Our Identity Security platform is mission-critical, and our solutions are being prioritized even in today’s challenging macro environment. I have never been more energized or enthusiastic about CyberArk, our leadership position, our team, our culture, and our future.

We have put in place a best-in-class transition that will help ensure that we deliver against this massive opportunity. I’m looking forward to working closely with Matt, the Board and the entire CyberArk team as we build CyberArk to a $1 billion ARR company and beyond.

I will now turn the call over to Josh, who will discuss our strong financial results in more detail and provide you with our outlook for the first quarter and full year 2023. Josh, off to you.

Josh Siegel — Chief Financial Officer

Thanks, Udi. As Udi mentioned, we were pleased with the durable demand for our solutions. Customers are embracing our Identity Security platform and our subscription model is delivered, resulting in annual recurring revenue growing 45% and reaching $570 million. That’s well ahead of our guidance. The subscription portion reached $364 million, increasing 99% and now represents 64% of our total. We had another record quarter for net new subscriptions and total ARR driven by the strong demand for our solutions, particularly for SaaS.

Our progress is clear when you compare today to a year ago when the subscription portion was only $183 million, then just 46% of total and half of our year-end 2022 amount. Our guidance in February of last year estimated just 35% to 36% growth in total ARR to outperform and grow nearly 10 percentage points faster showcases the strength of our execution throughout the year. We have convincingly flipped our business to a fully recurring model, a key multiyear goal we set just under two years ago in our March 2021 Investor Day.

The maintenance portion was $206 million at year-end. The year-over-year and sequential decline in maintenance ARR was due to the decline in the perpetual license sales expected and included in our guidance. We continue to see very strong renewal rates of more than 90% for our perpetual maintenance business. In addition, our visibility continues to increase with the remaining performance obligations now at $730 million at year-end. That’s increasing 38% from December 2021. Total revenue of $169 million, grew 12% year-on-year and was impacted by our subscription bookings mix, which hit a record 90% for the fourth quarter. That’s well above the guidance framework we provided.

Economically, the revenue headwind created by the mix and duration was approximately $24 million in the fourth quarter. That’s when we compare like-for-like to the fourth quarter 2021 when the mix was just 71%. Taking the calculated revenue headwind into consideration, total revenue would have grown by 27% year-on-year. And if you include the $1.5 million in currency impact as well, we would have grown by 28%. If you isolate just the license portion of revenue adjusted for headwinds, our license revenue grew by 42% in the fourth quarter.

On the macro environment, during the quarter, we continue to experience more approval of deal cycles. And in addition, some existing customers also wanted shorter commitments, opting for one-year versus three-year deals related to self-hosted subscription or our term-based license contracts, which impacted our duration, recognized revenue and long-term deferred in the quarter.

Overall, we continue to be very pleased with our bookings and to see Identity Security programs being prioritized. Momentum in our business continued, and the demand environment is resilient with budgets being allocated as evidenced by the significant ARR outperformance and the strength of our new logos.

Moving into the details of the revenue line for the fourth quarter. Subscription revenue reached $88.5 million, growing 86% year-on-year, representing 52% of total revenue in the fourth quarter. Consistent with our move to a subscription business model, perpetual license revenue came in at about $14.6 million.

Our maintenance and professional services revenue was $66.1 million, that’s $54.1 million coming from recurring maintenance and the balance of $12 million in professional services revenue. Recurring revenue reached $142.6 million or 84% of total revenue, growing 39% year-on-year from $102.9 million in the fourth quarter last year. Geographically, the business continues to be well diversified. The Americas revenue reached $99.5 million, growing 15% year-on-year. EMEA grew by 5% year-on-year to $51.8 million and APJ grew by 13% to $17.8 million in revenue.

Normalizing for the mix and the duration, the Americas would have grown by 31% year-over-year and APJ by 30%. Normalizing the headwind and FX, EMEA would have grown by about 24% in the fourth quarter. All line items of the P&L that I’ll discuss now are on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release.

Our fourth quarter gross profit was $140.2 million or 83% gross margin compared with 86% in fourth quarter last year. The lower year-on-year gross margin is in large part due to the significantly increased portion of SaaS revenues and the result of the declining of the perpetual license sales in the fourth quarter of 2022. While we continue to make disciplined investments to drive innovation and growth, our results demonstrate our operational rigor as evidenced by our operating expenses increasing 20% to $136.1 million, resulting in income of $4.1 million, and that compared to our headwinds adjusted revenue growth of 27% in the fourth quarter.

We are still being impacted by the mix shift towards ratable revenue, which lowered our operating results. Normalizing for the headwinds, our operating margin would have been positive 14% in the fourth quarter. As a reminder, this only level set to the mix to the prior year, not all the way back to the beginning of the transition. Net income was $7.2 million or $0.16 per diluted share, beating our guide for the fourth quarter. For the full year, revenue was $591.7 million, accelerated to 18% year-on-year growth versus the 8% last year.

For the full year, subscription bookings mix was 88%, which was higher than we were expecting and which resulted in approximately a $72 million headwind for the full year. This compared to a 66% subscription bookings mix for the full year 2021. Normalizing for the headwind, the total revenue would have grown 32% year-on-year. And for the full years — for the full year, Americas would have grown by 23%, EMEA by 9% and APJ by 12%. Normalizing for the headwind for Americas — normalizing for the headwind, though, the Americas grew by 38%, EMEA by 23% and APJ by 28% year-on-year.

Moving down the P&L for the full year. Our gross margin for the year was better than we expected at 82% as we closely manage the expenses related to SaaS. Operating loss was $22.4 million. Normalizing for the headwind, operating margin would have been a positive 7% for the full year. Our net loss was $0.44 per basic and diluted share, which was also impacted by the same revenue headwind of $72 million for the full year.

We also observed an FX impact for the full year of approximately $6 million on revenue, $7 million on ARR and $2 million on operating income. We continue to attract and retain top talent ending December with over 2,750 employees worldwide, including nearly 1,160 in sales and marketing. For the full year, free cash flow was $37.2 million or 6% free cash flow margin, which came in nicely ahead of the free cash flow guardrails we set for the full year and demonstrates the strength of our subscription model.

Turning to our guidance. Our guidance for the first year — for the first quarter and the full year 2023, balances, the strong competitive position and the durable demand for our platform against the uncertainty in the macro environment. For the first quarter of 2023, we expect total revenue of $160 million to $164 million, which represents 27% year-on-year growth at the midpoint. We expect a non-GAAP operating loss of about $15.5 million to $12.5 million for the first quarter, and we expect our non-GAAP EPS to range from a net loss of $0.30 to $0.23 per basic and diluted share.

Our guidance also assumes 41.3 million weighted average basic and diluted shares and about $4 million in taxes. For the full year 2023, we expect total revenue in the range of $724 million to $736 million. That’s representing growth of between 22% and 24%, an acceleration from our 18% growth rate in 2022 and consistent with the playbook we outlined when we kicked off our subscription transition. For the full year, we expect our operating results to range between an operating loss of $5 million and an operating income of $5 million. We expect a range of net income per share of $0.07 to $0.28. And for the full year, we expect about 46.1 million weighted average diluted shares. We also expect about $20 million in taxes. For the full year, we expect annual recurring revenue to be between $730 million and $740 million at December 31, 2023, or between 28% and 30% year-over-year growth.

To help model the expenses for the year, we expect to see an increase in marketing expenses in the second quarter related to our Global Impact Customer event and its World Tour, leading to a seasonally lower operating income in the second quarter. For the full year, we plan to leverage our P&L with each operating expense line growing at a slower rate in 2023 compared to 2022.

The increase in our expenses fall into three main categories. Increasing investments in our cloud infrastructure to support our record SaaS bookings in 2022, which we expect to — which we expect will lower our gross margin for the full year to between 80% and 81%. Second, making critical investments in R&D, including our SaaS and self-hosted solutions. And lastly, the investments in sales and marketing, we have deep conviction in the opportunity and our incredibly strong competitive position. As we think about our guidance for the year, we plan to be agile on our investments. If we see the demand environment change, we will adjust our hiring and investment plans for 2023.

Moving to free cash flow margin. We anticipate that it will be approximately equal to our non-GAAP net income margin over a 12-month period. We remain focused on capitalizing on the massive opportunity in front of us that will deliver profitable growth and strong cash flow, creating long-term value for shareholders.

If we sum up 2022, we were pleased to complete our subscription transition ahead of schedule already in the first quarter. The benefits of our subscription engine are already starting to kick in. Revenue growth accelerated to 18% in 2022, and there is further acceleration expected in 2023. As you saw from the guidance I just provided, we expect operating margins to have bottomed out in 2022 and to modestly improve in 2023. And what’s even more exciting is that we expect even more meaningful improvement once we get beyond 2023 and the flywheel effect fully kicks in.

Before I turn the call over for QA, I’d also like to congratulate Matt. We are aligned on our vision for execution and strategy and very much look forward to continue working closely with him in his new role.

I will now turn the call over to the operator for Q&A. Operator?

Questions and Answers:

Operator

[Operator Instructions] Our first question comes from Saket Kalia with Barclays Capital. Your line is open.

Saket Kalia — Barclays Capital — Analyst

Okay, great. Hey, good morning, guys. Thanks for taking my questions here. Let me just start by saying, Udi, it’s been a pleasure working with you. Wish you best of luck as Executive Chair, very happy you’re still staying with the Company. And Matt, very much look forward to working with you as well after all the work that you’ve done through this transition.

Udi Mokady — Chairman and Chief Executive Officer

Thank you so much, Saket.

Matt Cohen — Chief Operating Officer

Thank you, Saket.

Saket Kalia — Barclays Capital — Analyst

Maybe — yeah, absolutely. Maybe shifting to the business, Udi, maybe starting with you. I was wondering if you could just zoom out and talk about why you think Privileged Account Management seems to be bucking the trend in this macro. There are more headcount reductions happening in certain areas of the economy, not all security companies are seeing this type of ARR. I’m curious why you think PAM or just maybe even just the broader identity as a category seems to be doing better?

Udi Mokady — Chairman and Chief Executive Officer

Great. Obviously, we’re very excited that we continue to outperform and the 45% growth in ARR. Privileged Access Management is one of the few critical security layers that really make a difference in enterprise security. I would categorize it in one of the few that are on the must-have side of enterprise buying decisions. And no matter how you dissect every attack that’s in the news. There’s — that point of no return is when they elevated privileges, moved laterally, captured identities. And CyberArk captures both the human and machine identities in our PAM platform and in our Identity Security platform.

And today, it’s become clear that Identity is not just the new perimeter. Identity is the attack surface. And so it’s one of the few things that enterprises do today. And of course, we pioneered the space. We’re a market leader in the space. And the flip side of it is also executing on that opportunity that we created through our best-in-class go-to-market team, our channels, and, of course, delivering great solutions, all of these years. And I would say that the team is executing and firing all cylinders against a growing opportunity.

Saket Kalia — Barclays Capital — Analyst

That makes a lot of sense. Josh, maybe for my follow-up for you. Great to see the ARR guide for next year. I was wondering if you could just go one little deeper into some of your assumptions in terms of macro, in terms of close rates, in terms of maintenance ARR, there’s obviously a lot that goes into that ARR forecast. Is there anything you just want us to know given the — what is still arguably an uncertain macro?

Josh Siegel — Chief Financial Officer

Yeah. Thanks, Saket. And you’re right, there are a couple of dynamics that play for ARR. First of all, as we’ve been kind of talking about over the last year, we do expect maintenance ARR to decrease. It started to last year in 2022, and we can see it’s decreasing of a couple of million dollars a quarter into 2023. And so effectively, you’re seeing that we’re guiding generally to a flat net new subscription ARR for 2023.

The other dynamic is, if all things are held equal, if we look at our win rates, our pipeline and in the macro, we actually believe we can grow faster than that. But given the current macro and where we are in the year, I think we believe this is really the right starting point as we guide for 2023. But if I were to end, I’d say we’re actually really confident in the underlying demand environment, and we have the pipeline to actually support a faster growth than in the ARR side.

Saket Kalia — Barclays Capital — Analyst

Very helpful. Thanks, guys. Congrats again.

Operator

Your next question is from the line of Hamza Fodderwala with Morgan Stanley. Please go ahead.

Hamza Fodderwala — Morgan Stanley — Analyst

Hey, good morning. And congratulations, Udi, and look forward to working with you, Matt. Just for Udi, it seems like CyberArk is really separating itself from the pack from a lot of your competitors, which have been acquired and others that may be facing their own execution challenges. CyberArk has been a profitable company in the past. But just given that the opportunity that you’re seeing and the success that you’re seeing in multiple Identity categories, how do you think about just doubling down investment and continuing to just accelerate your share gain versus getting back to those very high margins that you saw prior to the transition?

Udi Mokady — Chairman and Chief Executive Officer

Yeah. So thanks, Hamza. I think we’ve been very prudent in leveraging our market leadership in the space and in pioneering. I think as both Josh and I said, we’re creating a plan that’s very agile. We’re going after this opportunity. We do want to return back to the beautiful profitability we had before the transition. And then — and of course, coming to it with that position of strong — of fully ratable revenue. But we are investing where we see the strong ROI coming, and we have a plan that’s going to keep us agile on this front, and that includes PAM, that includes going after the Access opportunity now that we’re a leader in the Magic Quadrant there and includes going after the Secrets Management angle as well and of course, EPM. So we do have those great growth engines. SaaS delivered, and we’ll invest, we’ll do it like the CyberArk style, agile but prudent.

Hamza Fodderwala — Morgan Stanley — Analyst

Got it. Josh, on that front, can you give any color around the percentage of ARR that’s coming from some of the different categories like Access Management, PAM, etc.? I think you’ve done that in the past as well.

Josh Siegel — Chief Financial Officer

Yeah. If we kind of look at the ARR pie, it’s been pretty consistent. PAM is still around 55% of that subscription ARR, with EPM coming in at second at 20%, Access at 15% and Secrets around 10%.

Hamza Fodderwala — Morgan Stanley — Analyst

Great. Thank you so much.

Udi Mokady — Chairman and Chief Executive Officer

Thanks, Hamza.

Operator

Your next question is from the line of Rob Owens from Piper Sandler. Please go ahead.

Rob Owens — Piper Sandler — Analyst

Yeah, good morning, everyone. In your prepared remarks, you did talk about the record new logo additions that you had during the year and talked about optimized go-to-market extending channel partnerships. Maybe focus a little bit on the channel front with the new partners, what is their contribution to net new ARR at this point? And how do you expect that to ramp throughout ’23 and in the future?

Udi Mokady — Chairman and Chief Executive Officer

Yeah. I would say definitely strong contributors to the growth and in capturing the new logos. And especially as we expanded and have more and more channels trained on the new solutions also helping us land with Access and other fronts. I don’t have the metric handy of how much do we attribute. But again, the majority of our sales involve channels. And probably 70%, 80% of our business, we attribute through direct work with channels. So there are definitely strong contributors to this net ARR.

And I think, like I mentioned in the remarks, it’s strategic for us to have them embracing our broad portfolio, and we see that through their certifications and training and through sales that they’re continuously expanding beyond PAM with us also to Access and Secretes Management.

Rob Owens — Piper Sandler — Analyst

And quickly for Josh, as you contemplate the profitable growth and the return of the margin moving forward having gone through the transition, how should we think about free cash flow and any hints there in terms of modeling it? Thanks.

Josh Siegel — Chief Financial Officer

Yeah. Thanks, Rob. And as I talked about earlier in the remarks, we’re — I would look at over a 12-month period because we get a lot of seasonality and fluctuations from quarter-to-quarter. But on a 12-month period for 2023, we’re looking at free cash flow at non-GAAP net income margin level.

And then I think if I would add to that, because you also talked about kind of post transition, as we kind of continue on through the transition, we certainly would expect to see that expansion of free cash flow in the out years as our — as we get to already back into ’24 and ’25, and we’re post now roundtripping our full ARR base.

Operator

Your next question is from the line of Fatima Boolani with Citi. Please go ahead.

Fatima Boolani — Citi — Analyst

Good morning. Thank you for taking my questions. And Udi, sad to see you go, but I’m looking forward to getting Matt a hard time from here. So maybe I’ll start with you. Just with respect to the model transition, as you essentially move it into Phase 2 of the transition with continued ARR growth, I’m curious what sort of changes, if at all, that you’re thinking about making by way of go-to-market bundling pricing strategy? So any of those inputs potentially changing the way you scale the ARR base from here? And would love to hear Matt chime in too, if relevant. And a follow-up for Josh, please.

Udi Mokady — Chairman and Chief Executive Officer

Yeah. So it’s Udi. First of all, thanks, Fatima. I’m staying, but I’m looking forward to you giving Matt a hard time. And let’s start with that. Maybe Matt, you take this.

Matt Cohen — Chief Operating Officer

Sure, Udi. Thanks. I think as we look at 2023, we kind of just see continued momentum in the go-to-market channels that we’ve already put into place. We’ve started to rely and kind of build a much stronger engine in the marketing organization to help us with the kind of demand generation, and we continue to put more focus and frankly, more resources on that ability to be able to drive pipe that way.

Certainly, our bundles have been a piece of the success over the last couple of years where we have our core PAM C come with a little bit of identity and a little bit of other areas that help to drive and see those products in. We’re certainly instituting a price increase in 2023 here, kind of matched to the inflationary environment that we’ve seen, and that will help us kind of get a little bit of uptick.

And then as we were just talking about, we push on the channel partner program and making sure that these, what we keep referring to is new routes to market, the focus with the MSP program, the distributors, even the marketplaces that are out there and leveraging them to help us drive demand. But I look at 2023 kind of as a continuation of what we’ve been doing because we’ve been seeing such success with that.

Operator

Your next question is from the line of Eric Heath with KeyBanc Capital Markets. Please go ahead.

Eric Heath — KeyBanc Capital Markets — Analyst

Great, and thanks for taking my question. And Matt, congratulations on the new appointment there.

Udi, I guess both a question for you and Matt. Looking forward, I mean, I guess, how do you think of CyberArk’s success? How much is predicated on successfully moving into Access Management and beyond, call it, broader Privileged Access? And how meaningful do you push into that market over the next few years, given it is a more competitive market, and there’s really a couple of large vendors that kind of already are large incumbents in the space? So how do you think about that initiative over the next couple of years?

Udi Mokady — Chairman and Chief Executive Officer

Yeah, absolutely. I think the beauty of the CyberArk chart right now is that we have such a great opportunity in PAM itself as such a critical layer of security and then this growth engine in Access. In Access, our business almost doubled in ARR. We’re seeing a record pipeline. We’re improving win rates. I mentioned that now with the Magic Quadrant, we’re also invited to more and more RFPs. So the way we look at it is great upside for us in expanding into Access. We are and we will and that we’re doing it differentiated. You mentioned competition. We’re coming to it as from the makers of PAM, those who really pioneered the hardest layer of security in identity.

The hardest part of identity coming into securing all types of identities, the human, workforce users, the third-party supplier, the machine identities. And coming to it from that position of strength and trust as the security vendor. So we are going after it. And — but we’re going after it in a differentiated way. We have a great customer base to leverage. We have new lending — new ways to land. And so it is an upside, along with, of course, the other growth engines like Secrets Management.

Matt Cohen — Chief Operating Officer

And I would just add here that I think increasingly, it’s an Identity Security story with our customers, and we’re able to talk to them about our platform, we’re able to talk to them about all the solutions working together to drive value and to protect their environments. And so even when we think about our recent global kickoff that we just had where we had all our sellers together, the main story that we were training on is how to position the full Identity Security story. And that brings us then obviously with the foundation in PAM, but outside into these other areas in our conversations with our customers.

Operator

Your next question is from the line of Shaul Eyal with Cowen and Company. Please go ahead.

Shaul Eyal — Cowen and Company — Analyst

Thank you. Hi, good afternoon. Congrats, Udi. Congrats, Matt. Best wishes to all of you. Looking forward to working with Matt. Udi, what a ride. I actually had a question about machine identity. I think you just mentioned that, you and Matt. At a recent conference, you made some, I would even say both, statement about machine identity, the opportunity and CyberArk taking pretty much a nice share longer term within this market.

Can you talk to us about what you see within the machine identity now that you guys are doing absolutely great on the human side? But what should we be expecting out of CyberArk going forward within the machine identity arena?

Udi Mokady — Chairman and Chief Executive Officer

Yeah, absolutely, Shaul. And again, thanks for the warm words. I think what we discovered in our surveys and also in the field is that with digital transformation and with cloud adoption, organizations are creating a multitude more machine identities than they have human identities, even to the factor of 45 times more machine identities than human. That’s what I mentioned in the conference.

And as Matt mentioned earlier, we’re going after this with a platform sale that covers both the human and machine under Identity Security. And it’s becoming this gaping hole. By the way, in some of the recent breaches, the point of no return is — was when the attacker achieved Privileged Access through credentials that were machine identities and were able to get into systems that way.

And so our strategy is to do that with our platform and to make it easier and easier for the developers to adopt our solutions as we announced that at our last Big Impact event, and as we mentioned, we’re seeing our first customers adopt it. We announced Secrets Hub, which make it very transparent to the developer to work natively in the cloud environment. The first announcement was with AWS Secret Store, where CyberArk is the backbone securing secrets for all types of applications, both on-premise and cloud environments, and it’s transparent to the developers.

So that’s going to be our strategy going forward, make it easy for the developer, but provide the security professionals the single pane of glass, and be the backbone to securing all types of credentials and identities.

Operator

Your next question is from the line of Brian Essex with JPMorgan. Please go ahead.

Brian Essex — JPMorgan — Analyst

Hi, good morning. And thank you for taking my question. Matt, congratulations from me as well. Hopefully, Udi, we still get to engage with you on a regularly frequent basis. So nice to see that you’re sticking with the company and will remain engaged. I guess, for me, I’d like to maybe see if we can like dig into ARR a little bit. It looks like you had some nice new logo adds. It’s almost like the new customer. Cadence didn’t flinch in this macro and then net new ARR or the ARR contribution from those new adds. It seems like you’re landing at a greater pace or at a greater amount for new logos. But I know you also mentioned some — I think, Udi, you mentioned some shorter duration incidents with revenue. Maybe could you dig in there a little bit and offset where are you seeing the headwinds outside of shorter duration? And what do you attribute the larger, I guess, land rates with new logos, too?

Udi Mokady — Chairman and Chief Executive Officer

So I’ll start, Josh, and maybe you want to step in. And thank you, Brian. I would say from the new logos, we see that half of them land with PAM and additional solutions. So the platform sale is working. So we see that contribution of the wider portfolio to a growing deal size in our landing spot. And of course, it’s a great sea for us as we work on the renewals and expansion in our ARR model. And again, that was something we’ve been proving throughout the years.

Matt mentioned some of the bundling that we’ve done and that’s all contributing to a better land. And I think like I’ve mentioned in other calls, we have more landing points. And of course, PAM is still the majority. And back to the first question for the day, PAM being so critical, but we’re able to land with PAM plus additional solutions. And you asked about the duration. So Josh off to you.

Josh Siegel — Chief Financial Officer

Yeah. So Brian, when we think about the duration, it actually doesn’t impact at all the ARR. The duration is — we refer to as part of the headwind because it’s part of our self-hosted term-based license contracts. And as you know, as duration goes down, you would recognize less in the end period.

So we saw duration come in during the fourth quarter on those term-based license contracts, which had some headwind on our recognized revenue for the fourth quarter, but it’s just a matter of when we’ll recognize it and we’ll just recognize more of it down the road upon renewals. So we think that certainly the shorter duration was kind of attributed to customers looking at their budgets and their intent for buying and deciding that they were going for one-year instead of longer term.

But from our perspective, given our very high renewal rates, particularly on all of our products that — we’re good with that because it’s not an impact on the business. It’s just purely creating more ratability.

Operator

Your next question is from the line of Adam Borg with Stifel. Please go ahead.

Adam Borg — Stifel — Analyst

Thanks so much for taking my question. And congrats to both Udi and Matt. Maybe for Josh, you’ve talked in the past about a single-digit growth rate on ARR coming from converting the existing maintenance base to subscription and SaaS. And I was just curious kind of what was that — was that true for all of fiscal ’22? And how should we think about the conversion mix in the context of fiscal ’23 guidance? Thanks so much.

Josh Siegel — Chief Financial Officer

Yeah, Adam. It actually was pretty consistent all through 2022. And if we look at it from an annual basis, it was exactly that, kind of a single-digit percentage of the ARR growth rate coming from conversions. And we’re really happy with that because it really shows, first of all, that we’re getting a lot of new customers. And we’re also getting a lot of add-ons coming in off of their existing installed base. And it continues to provide a lot of engagement with our existing customers going forward. So yeah, it remains around just the single digits.

Adam Borg — Stifel — Analyst

Great. Any expectations for that to change in fiscal ’23?

Josh Siegel — Chief Financial Officer

No. At this point, we don’t see signals for that. But clearly, we’re monitoring it. And I think — and our guide obviously contemplates our estimates for that.

Adam Borg — Stifel — Analyst

Great. Thanks so much.

Operator

Your next question is from the line of Roger Boyd with UBS Securities. Please go ahead.

Roger Boyd — UBS Securities — Analyst

Great. Thank you for taking my questions. And Udi and Matt, I want to echo my congrats on your respective moves, and congrats on what overall looks like a very smooth transition. Maybe for Udi or for Matt, you’ve consistently talked about a SaaS heavy transition. And it looks like that was even more so the case in 4Q with SaaS growing nicely above 100%. Any high-level thoughts on the expectations of Privileged Cloud versus term-based license in ’23? And specifically, what are you hearing from customers around demand for self-hosted versus SaaS and the feature barrier there?

Matt Cohen — Chief Operating Officer

Yeah, sure. This is Matt here. So I think that we continue to be really enthused by the momentum in Privileged Cloud. We see, obviously, most of our new logos that are choosing to land with PAM, they land with Privileged Cloud. It’s definitely the default option the customers get to value significantly quicker. They’re able to get to an expand motion for us in a faster rate, which is good for the lifetime value coming out of the customer. So we continue to see that kind of happen. There’s pockets where there’s holdouts, certain geographies or regions around the world or maybe the access to the data center isn’t as normalized or some government accounts. But we definitely see Privileged Cloud as kind of the leading entity for us moving forward.

And mainly the self-based subscription — or sorry, on-prem subscription is generally to existing customers who are buying more seats who aren’t quite ready yet to lift and shift over to the SaaS environment. And I think that trend will continue to play out and accelerate over the next couple of years. At this point, to your last point of your question, we are seeing not only full parity with our Privileged Cloud offering but we’re actually seeing differentiation in our Privileged Cloud offering, where the kind of integration of our Dynamic Privileged Access into the Privileged Cloud offering, the ability to be able to actually offer even better threat analytics, that really starts to set the stage for, I think, that being the premium offering that we have out in the market.

Operator

Your next question is from the line of Tal Liani with Bank of America. Please go ahead.

Tal Liani — Bank of America — Analyst

Hey, thank you. Udi, if you need a partner for your next fishing trip, you know who to call.

Udi Mokady — Chairman and Chief Executive Officer

I’ll have to learn how to [Speech Overlap]. Thank you.

Tal Liani — Bank of America — Analyst

I have two questions. The first one is pricing. You mentioned that there is a pricing increase in 2023. What’s the impact on your revenues on your ARR? How long does it take to translate the pricing increase to revenue growth and ARR? And the second question is — let’s do it one by one. That’s fine.

Udi Mokady — Chairman and Chief Executive Officer

Okay. So Tal, on that, it’s going to be really a small amount during 2023, any price increase impacting ARR and revenue, especially because we have more and more being ratable. So it’s not a significant piece of the raise in the guide.

Tal Liani — Bank of America — Analyst

Got it. The second question is to Matt. And Matt, every CEO brings new spirit and new kind of changes. What is your agenda? What do you see as your main focus areas for 2023 and beyond?

Matt Cohen — Chief Operating Officer

Yeah, I appreciate the question. I think that when you look at what was worked so well for Udi and I is that we do share a similar view on the market, on the importance of culture and the importance of the teams that we’ve built here. And we’ve been so kind of intricately linked from a standpoint of coming up with the strategy that we have today.

So I think what I have promised to the team and to Udi really is a continuation of the great momentum that we have. We feel like we’ve never been in a better position or in a better place. And we have a special opportunity here in the market and a group of special people here at the company. And so I’m kind of excited to continue the spirit, as you said, of where we’ve been and to bring it forward for the years ahead.

Tal Liani — Bank of America — Analyst

And are there any areas where you’re going to focus on more to try and even accelerate the growth? Or any things that you’re going to focus in — focus on especially to try and bring either new revenues, new areas? Or is it going to be more of the same, basically?

Matt Cohen — Chief Operating Officer

Yeah. I mean, we believe that this kind of shift up into the Identity Security vision, the Identity Security platform and our ability to be able to go out there and help our customers across the entire identity landscape, human and nonhuman or machine into access, into all the new areas we’ve been, that the market opportunity for us remains huge. And we can go and tap into that over the next couple of years. We don’t need to pivot to a new strategy. We need to go and execute or continue to execute against the current strategy to go get that opportunity.

Operator

Your next question is from the line of Jonathan Ho with William Blair. Please go ahead.

Jonathan Ho — William Blair — Analyst

Hey, Udi. Let me echo my congratulations as well. It’s been a pleasure for all of these years. And Matt, congrats on the new opportunity. Just wanted to maybe dig a little bit more into sort of the new Secrets Management products that you guys referenced. Just — what’s been the initial reception from customers there? How do you think about sort of the total market opportunity? And how does this maybe augment your existing Secrets Management strategy? Thank you.

Udi Mokady — Chairman and Chief Executive Officer

Absolutely, Jonathan. And thank you for those warm words, and thank you for getting to know me when we were an unknown category as we were pioneering PAM as a private company.

Jonathan Ho — William Blair — Analyst

Yeah, I still remember the days of $20 million in ARR. So it’s good to see the growth.

Udi Mokady — Chairman and Chief Executive Officer

Great. So to your question, I think the two that I would highlight is that we released Conjur Cloud. So the ability to consume Secrets Management as a service, where our customer can hit the ground running and they don’t have to set up infrastructure. We have our first customers on that and the reception. That optionality is really well received by customers. They can still decide to have it on-premise or they can now have Conjur as a service, which is really breakthrough innovation in the market.

And the second one that I mentioned earlier, and it’s very strategic for us is Secrets Hub. We’re on top of our solution for, I would say, native applications and for dynamic applications. We allow the organizations to decide to use the native cloud Secret Store and CyberArk as the backbone. That was announced, that had an impact and is very well received. The first, the cloud supported is AWS, and we will follow with Azure and GCP. And again, customers are eager, and again, have started with the AWS aspect. And it also further strengthens our partnership with AWS.

And so those are being well accepted. And in terms of the opportunity, it’s really — we’ve highlighted the multibillion-dollar opportunity in Identity Security and the machine identity is a big part of that. And we have a unique angle to take after it because we are coming as the trusted security provider, but understanding the unique needs of the developer. So bridging between security and developers is a very large opportunity.

Operator

Your next question is from the line of Joshua Tilton with Wolfe Research. Please go ahead.

Joshua Tilton — Wolfe Research — Analyst

Hey, guys. Thanks for taking my question. And Udi, it’s been an absolute privileged, no pun intended. And Matt, congrats on the appointment. Just a quick one for me. I think in the prepared remarks, you guys touched on this tailwind from cyber insurance. Is there any way you can dive one level deeper on that and just maybe how long do you think this tailwind could last?

Udi Mokady — Chairman and Chief Executive Officer

I think it’s going to — so thanks for the question and the warm words. I think it’s going to last because we’re seeing just the early parts of it. It’s mostly in North America. We believe similar drivers will show up in Europe and in the rest of the world. The insurers are — they found themselves like — every company in the world, every organization is being attacked. It’s a given — and we’ve recently showed in a conference that companies are being attacked multiple times, even after they recover.

So the insurance providers had to step up and take an approach of we’re going to enforce important layers that make a difference before we ensure you over to lower the premium. So I think it’s going to be another one of those drivers that will last. As long as that cyber insurance will exist, then it’s going to exist. It’s becoming kind of table stakes at companies.

And it gives an opportunity for CyberArk and companies like us to also further partner with the insurance companies to educate their customers and make it very seamless for them to get onboard. And the fact that we now have the SaaS optionality really serves that well that they — when they need to meet the requirement, they can join CyberArk and be up and running fast and get that insurance set up.

Operator

Your next question is from the line of Gregg Moskowitz with Mizuho. Please go ahead.

Gregg Moskowitz — Mizuho — Analyst

Okay, thank you. And congratulations, Udi, on everything you’ve achieved thus far in building such a terrific company. Congrats to Matt as well in an extremely well-deserved promotion. Udi, as you know, CyberArk is one of a select few software vendors that was able to execute at a very high level throughout all of 2022. Many investors wonder if you can continue to defy gravity in this environment. So it might be helpful just to hear a bit more from you on your confidence level in repeating this in 2023, even if we were to assume that the macro gets a little tougher from here.

Udi Mokady — Chairman and Chief Executive Officer

Yeah. I would say that we’re extremely confident. I think we’ve built a plan. And like we mentioned, Matt and Josh and I and the executive team, we built a plan that factored the macro. Macro was in the room as we worked on the plan and really also very data-driven, analyzing our pipeline, analyzing our continued contributions from channels.

And so we’re very confident in the opportunity we have into this year and for our ability to push those levers that we put in place. I mean, a lot of the components in CyberArk are actually behaving like growth engines, also like start-ups within the company, like the way the Access business is growing. So we have the growth engines, we have the PAM market become — it’s a no greater security layer, and we’re taking it all over the world. And so yes, I would answer that. And Josh, do you have a numerical answer for that?

Josh Siegel — Chief Financial Officer

No. I think you said it well in terms of how we built our expectations for the year. I would also add that in our 2023 guide, it actually even includes a $20 million headwind when we think about the kind of the last bit of the transition as we go from the high 80% mix in 2022 to well over 90% mix into 2023. And so I think when you combine all that, I think that we’re confident about where we’re headed. And if our business trends remain as they are, well, we have the durability of demand in pipeline to support possibly even faster growth.

Operator

This concludes the Q&A session. I will now turn the call over to Udi Mokady for closing remarks.

Udi Mokady — Chairman and Chief Executive Officer

All right. Udi Mokady for the record, but it’s all good. So I really want to thank everyone for the warm congrats that we saw throughout the call, we all really appreciate and the support of as you saw CyberArk journey. We’re just getting started. We’re very excited about the year ahead. And again, we had another strong quarter, demonstrating that durable demand that we talked about. And our platform selling momentum in the market positioning us very well for 2023.

So thank you to our customers, first and foremost, and partners that are the cornerstone of our success. And I want to extend special appreciation to the entire CyberArk crew around the world for the hard work and strong execution, very mission-driven team. So thank you very much.

Operator

[Operator Closing Remarks]