CyberArk Software Ltd (CYBR) Q3 2020 Earnings Call Transcript

CyberArk Software Ltd. (NASDAQ: CYBR) Q3 2020 earnings call dated Nov. 10, 2020

Corporate Participants:

Erica Smith — Vice President, Investor Relations

Udi Mokady — Founder, Chairman and Chief Executive Officer

Josh Siegel — Chief Financial Officer

Analysts:

Saket Kalia — Barclays — Analyst

Fatima Boolani — UBS — Analyst

Sterling Auty — J.P. Morgan — Analyst

Rob Owens — Piper Sandler — Analyst

Andrew Nowinski — D.A. Davidson — Analyst

Hamza Fodderwala — Morgan Stanley — Analyst

Jonathan Ho — William Blair — Analyst

Gregg Moskowitz — Mizuho — Analyst

Brian Essex — Goldman Sachs — Analyst

Presentation:

Operator

Ladies and gentlemen, thank you for standing by and welcome to the CyberArk Third Quarter 2020 Earnings Conference Call. [Operator Instructions].

I would now like to hand the conference over to your speaker today, Erica Smith with Investor Relations. Thank you. Please go ahead, madam.

Erica Smith — Vice President, Investor Relations

Thank you, Cindy. Good morning. Thank you for joining us today to review CyberArk’s third quarter 2020 financial results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; and Josh Siegel, Chief Financial Officer. After prepared remarks we will open the call up for a question-and-answer session.

Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management’s best judgment based on currently available information. I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operations for the fourth quarter. Our actual results may differ materially from those projected in these forward-looking statements. I direct your attention to the risk factors contained in the company’s Annual Report on Form 20-F filed with the U.S. Securities and Exchange Commission, and those referenced in today’s press release that are posted to CyberArk’s website, as well as risks regarding our ability to actively begin transitioning the business to a subscription model in 2021, and the duration and scope of the COVID-19 pandemic, its related impact on global economies, and our ability to adjust in response to the pandemic. CyberArk expressly disclaims any application or undertaking to release any public updates or revisions to any forward-looking statements made herein.

Additionally, non-GAAP financial measures will be discussed on this conference call. Reconciliations to the most directly comparable GAAP financial measures are also available in today’s press release, as well as in an updated investor presentation that outlines the financial discussion in today’s call. This information can be found at www.cyberark.com in the Quarterly Results section under Investor Relations. Also, a webcast of today’s call will be available on our website, in the IR section.

With that, I’d like to turn the call over to our Chairman and Chief Executive Officer, Udi Mokady. Udi?

Udi Mokady — Founder, Chairman and Chief Executive Officer

Thanks Erica. And thanks everyone for joining the call today. First of all, we hope you and your families are all well. While the global pandemic has had a profound impact on all of our lives, our community of customers, partners and employees have adjusted to the new normal. This is reflected in our third quarter business performance, record levels of customer and prospect engagement, and business productivity gains. I am very excited to discuss our strategy to begin actively transitioning to a subscription model in 2021.

But first, I will touch on third quarter highlights and industry trends. For the third quarter, we reported $107 million in revenue, $13 million in non-GAAP operating income, and non-GAAP EPS of $0.31 per share. We are pleased with our execution and the momentum in our business in the third quarter. Our mix of recurring revenue bookings accelerated, driven by increased demand for our SaaS solutions. This impacted our reported revenue and profitability, which Josh will discuss later in this call.

As we move deeper into our subscription transition, it will be important in the near term to look beyond the headline P&L, as it is a lagging indicator of our true success. We believe annual recurring revenue or ARR, which grew 40% in the third quarter, reaching $250 million, provides increased visibility into the overall strength and the long-term growth of our business. This metric demonstrates that we are building a rapidly growing base of high value, more predictable, recurring revenue.

Industry tailwinds continue to underpin our business and contribute to our record pipeline growth. PAM remains at the top of CIO and CISO priority list, delivering a critical layer of protection against hacker innovation, while enabling regulatory compliance, digital transformation and cloud migration. Escalating privileges is the most frequent pathway for attackers, who are more aggressive with the expanded attack surface and work from anywhere environment. To manage that risk, organizations turn to CyberArk as the clear market leader and industry innovator. There is also a long list of ever changing compliance requirements, that our solutions help address.

As an example, the National Institute of Standards and Technology or NIST, recently introduced standards for secured Zero Trust Architecture, which specify that the PAM, Privileged Access Management, is critical to comprehensive Zero Trust Security frameworks. When it comes to digital transformation and cloud migration strategies, customers can implement these programs faster, smarter and more securely, by leveraging PAM. These programs have created highly distributed IT environments, and increased automation and application development and business processes, resulting in the proliferation of privileges. Almost all identities, including users, machines, applications and tools can be privileged under certain conditions. Our customers have increasingly asked us to secure additional identity use cases, which is significantly expanding our total addressable market.

Our vision for identity security is taking a SaaS delivered, security first approach with the foundation in PAM, to provide users with the right level of access and privileges, depending on the activity. Transitioning to a subscription company, accelerates this long-term vision, by aligning CyberArk’s business to these trends. We have always focused on our customers and delivering a meaningful layer of security, that evolved at the pace of their IT environments. This included, being ready for when enterprises demand shifted to SaaS and subscription. In 2020, years of change has happened in a matter of months. COVID-19 and work from anywhere, has accelerated digital transformation and cloud migration, and significantly increased SaaS adoption. Because of our strong execution and business agility, we are in a great position, as we begin to actively transition our business next year. In fact, we will enter 2021 quarters ahead of most technology companies who have gone through similar transitions.

Our financial results show, that customers are embracing recurring revenue consumption models. Without making any changes to our go-to-market approach, year-to-date, more than 35% of our new license bookings were from SaaS and subscription. In the third quarter, this mixed reached over 45% of our new license bookings, including seven of our top 10 license deals. This dramatic increase in subscription mix was driven predominantly by record SaaS demand. We have the broadest, most feature rich cloud portfolio, to secure privileged access and identity security in the market. Our ongoing innovation, the breadth of our portfolio, and the maturity of our cloud offerings, will be a key driver of our subscription transition program. Adding incredibly valuable SaaS recurring revenue, and deeper long lasting customer relationships.

We have been working on a comprehensive readiness programs, to ensure strong execution throughout this transition. A dedicated cross-functional team is also working to ensure we execute the transition with rigor and focus. We also conducted internal research and engaged one of the leading independent consulting firms, who validated the durability of demand for on-premise subscription well beyond COVID-19 and the economic environment.

We will adjust our go-to-market approach, that will holistically nurture our customer relationships, putting their success at the center of everything we do. Matt Cohen is taking on an expanded role in the newly created position of Chief Operating Officer. He will continue to head the global sales organization, and is adding all post sales engagement, including services support and customer success. This organizational structure will support long-term sustainable growth, by accelerating customer adoption and expansion and at the same time, ensure that we deliver best in class customer satisfaction and strong renewals. Matt has deep operational experience, and will be an integral part of our subscription transition success.

The field team has done a great job selling SaaS and subscription year-to-date, to help accelerate the pace of our transition, we will not only rollout comprehensive sales and channel enablement programs, but also shift our compensation plans, in favor of SaaS and subscription sales versus perpetual licensing, beginning in 2021.

We will be rolling out attractive new solution packages, to incentivize customers to adopt our SaaS and subscription offerings. I am confident that this transition will reduce friction in the sales process, increase cross sell activity, and build enduring relationships with our customers, by delivering deeper value and stronger security.

Moving into a few details on the third quarter, we are seeing unprecedented activity with existing customers, who are increasingly turning to CyberArk as a trusted advisor, following our prescriptive PAM blueprint methodologies. As examples; a large U.K. consumer manufacturing company is building its long-term security programs on CorePAS, and Application Access Manager for DevOps, to protect its fast growing global multi-cloud environment. We are seeing increased traction for AAM, as organizations increasingly shift left, integrating security into DevOps earlier to drive down costs and improve speed to market.

Our largest Idaptive win to-date is an existing CyberArk enterprise customer. This organization understands the power of multi-factor, single sign-on lifecycle management integrated with PAM, which is the foundation of our Identity Security Strategy. In the third quarter, new business activity and pipeline progression continued to pick up. We added more than 190 new logos, including a Fortune 500 company and the Global 150 technology company. While we are seeing increased demand for new cloud solutions, our on-premise offerings, including core privileged access security, continue to meet the requirements of many large enterprises.

A few new business highlights include, in a seven-figure rip and replace win, a large regional bank is modernizing a security program with CorePAS for operational efficiency, with automatic Prudential onboarding across its AWS and on-premise environments, and will also benefit from our extensive C3 [C-Cube] integrations, including SailPoint, Qualys and Blue Prism.

As part of its digital transformation program, a Fortune 500 company is rolling out CyberArk Privilege Cloud. This new Chief Information Security Officer wanted to maximize control of the environment, while benefiting from the efficiency and tremendous time to value of SaaS delivery. A large healthcare system in the U.S. landed with Privilege Cloud, Endpoint Privilege Manager and Application Access Manager. Hospitals are frequently attacked by ransomware, and we provided this customer with peace of mind, given that Endpoint Privilege Manager has been tested against and successfully blocked over 3 million types of ransomware.

Innovation is the foundational pillar of our strategy, and strengthens our leadership position in the market. We were pleased to be named a leader in the Gartner August 2020 Magic Quadrant for Privilege Access Management, positioned both highest in ability to execute, and furthest in completeness of vision, for the second time in a row.

We continue to make ongoing foundational investments in our core architecture, that are enabling us to release major innovation and functionality more quickly. Yesterday’s introduction of CyberArk Cloud Entitlements Manager, an AI powered SaaS solution that enhances cloud security, is a prime example of the innovation engine from our CyberArk Labs team. As new environments in cloud services are deployed, thousands of permissions are created, that provide a pathway for attackers to gain privileged access. We can now help organization to take back control of cloud security, by transforming how these permissions are secured and managed, with continuous visibility, in-depth analysis and real-time remediation.

Finally, I want to provide a bit of color on what we are seeing from customers and partners. After crisis planning and business continuity in early 2020, organizations are deep into strategic planning. They recognize that long-term success is dependent on the speed of their digital transformation programs. This is increasing the sense of urgency, to not only implement strong security controls to mitigate risk, but also incorporate technology that will enable the organization to move forward faster. In every quarter of 2020, our new pipeline generation across all of our solutions has reached another record, demonstrating that we are capitalizing on these trends.

We are well on our way to transforming CyberArk into a high-growing, recurring revenue company, with significant contribution from our SaaS solutions. I am confident, that this subscription transition program will further solidify our position as the market leader, accelerate SaaS adoption, build a base of high value recurring revenue, and position us to deliver sustainable growth and profitability.

Josh will now discuss our financials in more detail, our subscription transition, and outlook for the fourth quarter. Josh?

Josh Siegel — Chief Financial Officer

Thanks Udi. Before we discuss the details of the quarter, we wanted to remind you that we posted slides to the website this morning, that would be helpful, as we walk through our results. As Udi mentioned, we are pleased with the momentum in the business. The acceleration of our SaaS and subscription offerings is beginning to impact our reported revenue and profitability, making the P&L in the near term more a lagging indicator of our success. The shift in the bookings resulted in total revenue of $107 million in the third quarter, compared to $108 million in the third quarter last year, while license revenue in the third quarter was $46 million, compared with $58 million in the third quarter last year.

The recurring portion of the license revenue was $13 million, that’s an increase from $4 million last year, driven by even faster recurring license bookings growth year-to-date. The detailed breakdown of license revenue can be found in the slides on our site, but I would like to highlight that SaaS revenue increased nearly 300% year-on-year, reaching $7 million, and that subscription or term based license revenue more than doubled to $5 million in the third quarter. In total, our SaaS and subscription license revenue represented about 28% of our total license revenue, a significant increase from 7% last year.

Our combined Maintenance and Professional Services revenue was $61 million, increasing 21% year-on-year. The breakdown of this line is approximately $50 million from recurring maintenance contracts and $11 million in Professional Services revenue.

As we begin actively transitioning our business to a subscription model in January 2021, we will be focusing more on metrics, that measure and provide visibility into our business, beyond the traditional P&L. These metrics include, our total recurring revenue, the percentage mix of bookings from SaaS and subscription; and most importantly, annual recurring revenue or ARR.

I will start with total recurring revenue; this metric includes SaaS, subscription or term based license, and recurring maintenance revenue associated with our perpetual license contracts. In the third quarter, recurring revenue grew to $63 million or 59% of total revenue, and that’s up 40% from the $45 million and 42% in the third quarter of last year. Our recurring revenue growth is being driven by strong SaaS and subscription bookings in 2020, as well as our continued strong maintenance renewal rates for our software.

Our next metric, which we are introducing this quarter, is the mix of new SaaS and subscription bookings as a percent of total license bookings, which is an indicator of where the business is heading, and is the driver of the increase in our deferred revenue. In total, SaaS and subscription represented more than 45% of our license booking, which compares to about 10% last year, and brings us to more than 35% of our license bookings from SaaS and subscription year-to-date. This mix has accelerated dramatically throughout the year, and gives us strong confidence in our momentum, as we head into our active subscription transition, including incentivizing our team. Of course, this growth in recurring license revenue bookings is increasing the headwind to our reported revenue. In the first quarter, our headwind was approximately $5 million; in the second, it was approximately $9 million; and in the third quarter, the headwind to revenue from the bookings mix was about $14 million.

This quarter, we are also introducing the well-known metric of ARR to provide investors with more visibility into the growth of our recurring business. ARR is defined as the annualized value of SaaS, subscription or term based license and maintenance contracts, in effect at the end of the reported period. As of September 30th, our ARR was $250 million, increasing 40% year-on-year from the $178 million as of September 2019. These three metrics demonstrate our success already towards becoming a high growth subscription company.

As Udi discussed, in January, we are also implementing a comprehensive strategy to support our transition, which includes, modifying our compensation plan to further incentivize the team, to sell recurring revenue, rolling out attractive subscription packages, strengthen our customer success culture and team, to ensure long-term sustainable growth, and shifting our reporting and financial system, towards a recurring revenue model, as demonstrated by the introduction of ARR and mix of percent [Phonetic] bookings. Historically, most subscription transition have taken companies approximately eight to 10 quarters. Given our strong starting point, we believe we are positioned to complete our transition on the earlier side of that timeline.

Now, I will provide some further color on the business. We are increasingly seeing our approximately 6,300 customers turn to CyberArk as a trusted advisor to execute their mission critical identity security programs. The level of engagement with existing customers is at an all-time high, with add-on business representing about 77% of license revenue during the quarter. As Udi mentioned, we believe the move to subscription will help accelerate the cross-sale motion.

On the new business front, we signed more than 190 marquee logos, in line with about 200 logos in the third quarter last year. We did experience smaller new business deal sizes, as some new perpetual license customers are making shorter-term purchasing decisions because of the economic environment, buying only the licenses they need immediately to get started, but with plans to expand. In addition, we saw an increase in SaaS bookings from new customers, which often start smaller, before they expand their overall footprint with CyberArk solutions.

Another key area for us, is the amount of activity we see in the market overall. New pipeline generation across geographies, and our product portfolio for our SaaS and on-premise solutions was at a record level again in the third quarter, which positions us very well for 2021.

In terms of solution areas Application Access Manager and Endpoint Privilege Manager represented about 9% and 10% of license revenue respectively. Even faster than we anticipated, already about 90% of our EPM bookings are for SaaS [Phonetic].

The business was well diversified across geographies; the Americas revenue in the quarter was $63 million, representing 59% of total revenue. It is worth noting, that the Americas had the strongest percentage of SaaS and subscription bookings during the quarter, which impacts recognized revenue. The EMEA revenue was $34 million or 32% of total revenue in the third quarter. APJ generated $10 million in revenue, representing 9% of total revenue for the third quarter.

In terms of verticals, we experienced strong year-on-year growth in financials, healthcare, telecom, pharma and the IT services software vertical. We were also encouraged by the strength in the retail vertical, in large part as a result of the digital transformation strategies.

As I move further through the P&L, all line items will be discussed on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release and posted to our website. Our third quarter gross profit was $89 million or an 84% gross margin, in line with our expected decline from 87% gross margin in the same period last year. The year-on-year decline in gross margin, is primarily related to the increase in our SaaS revenue, and bookings mix during the quarter and the incremental cost in cloud infrastructure for our SaaS business, including about $1 million, which is related to Idaptive.

We continue to make strategic but disciplined investments in the business to drive long-term growth. R&D grew by 33% year-on-year to $20 million, to enhance our solutions and expand our SaaS portfolio, like yesterday’s introduction of the Cloud Entitlements Manager. Sales and marketing increased 18% to $47 million, to expand the reach of our global sales team, with the increase partially though, offset by the reduced travel spending.

G&A expense was relatively flat at $9 million. In total, operating expenses for the third quarter increased 18% to $76 million, which includes about $5.5 million in operating expenses associated with the Idaptive acquisition.

Our operating income was $13 million or 12% operating margin, and in total Idaptive lowered our operating margin by about 4%. As a reminder, the approximately $14 million revenue headwind had a corresponding impact on our operating income, normalizing for the headwind from the bookings mix, our operating margin would have been approximately 22% in the third quarter.

Over 70% of our operating expenses are related to headcount. We ended the third quarter with 1,661 employees worldwide, and of our total employee count, 757 employees are in sales and marketing. Net income was $12 million or $0.31 per diluted share for the third quarter of 2020, that’s compared to $26 million or $0.65 for the third quarter of 2019. We were pleased to generate $63 million in free cash flow from operations or a 20% margin for the first nine months of 2020. This cash flow contributed to our strong balance sheet and we ended the quarter with $1.1 billion in cash and investments. We also ended the third quarter with $228 million in total deferred revenue, that’s a 28% increase from the $177 million at September 30, 2019. Approximately 15% of total deferred revenue or $34 million is related to recurring SaaS contracts, and that’s compared to only 4% at September 30, 2019.

Turning to our guidance; as a reminder, our guidance does not consider any potential impact to financial, other income and expenses associated with foreign exchange gains or losses, as we do not try to estimate future movements in foreign currency rates. For the fourth quarter of 2020, we expect total revenue of $125 million to $235 million, which assumes about $80 million in revenue headwind, from our increased mix of SaaS and subscription bookings projected for the fourth quarter of 2020.

We expect non-GAAP operating income to range between $25 million to $33 million and non-GAAP net income per diluted share of $0.52 to $0.67. Our guidance also assumes 40 million weighted average diluted shares and a tax rate of 23% for the fourth quarter and for modeling the full year, we would expect 39.7 million weighted average diluted shares, and a tax rate of 21%.

Given the momentum in the business, we plan to still add between 35 to 45 people in the fourth quarter, including key hires to expand our sales and engineering organizations and position CyberArk to deliver future growth. We are not providing guidance for 2021, but to assist you in modeling, we expect our business next year to follow trends similar to other subscription transition stories. Our successful execution will be marked by strong growth in our mix of SaaS and subscription bookings, ARR and resulting deferred revenues. This growth will nicely expand our base of recurring business. Even with the delay in recognized revenue from a higher ratable recurring mix, we expect total revenue to increase next year off of 2020 levels. This will be against the backdrop of ongoing investments to drive long-term growth, that will cause a near-term decline in our operating margin.

In terms of free cash flow, we anticipate that it will continue to be in line our non-GAAP net income margin to 5 percentage points above net income margin over a 12-month period.

As we exit the transition period, we expect a meaningful acceleration of revenue growth, improving operating margins and cash flow generation. We are already beginning to see our recurring business expand, illustrated by more than 400% growth in SaaS deferred revenue and our $250 million in ARR. We are confident that our strategy to begin actively transitioning to a recurring revenue model in 2021, will make growth more durable and profitable, which will drive value for CyberArk, our customers, partners and shareholders.

We want to wish you and your families health and safety, I will now turn the call over to the operator for Q&A. Operator?

Questions and Answers:

Operator

[Operator Instructions]. Your first question comes from Saket Kalia. Your line is open.

Saket Kalia — Barclays — Analyst

Okay, great. Hey guys, thanks for taking my questions here. Can you hear me okay by the way?

Udi Mokady — Founder, Chairman and Chief Executive Officer

Yeah.

Saket Kalia — Barclays — Analyst

Okay, great. Awesome. So Udi maybe for you, maybe just to dig into some of the components of the subscription transition here. I think you mentioned salesforce incentives in 2021 to help drive that higher mix of recurring. Maybe without getting too specific, can you just go one level deeper into what that might entail and maybe others that you’ve looked out, to maybe think about how to model those salesforce incentives?

Udi Mokady — Founder, Chairman and Chief Executive Officer

Sure Saket. First of all, good morning. As you can tell, we’re very excited about the transition and the momentum we have going into this now, with $250 million in ARR, growing 40% and the fact that 45% of our Q3 license booking was from recurring. So this is without any changes. So we did this in the — as we called it with infusion. Now that we are actively transitioning where like we said, we’re going to put programs in place. We’re working on them to incentivize the reps in 2021. I think we have a lot of examples out there to where we move from making it neutral for them this past year, to actually making it a net positive for the rep to promote our SaaS solutions or our subscription for on-prem.

In parallel, the other side of is of course rolling out is the subscription packages that will incentivize the customers and we’re seeing healthy demand and we are really excited about putting that in place. I think on top of this, on the go-to-market front, the alignment that we’re having in the organization having Matt now as Chief Operating Officer, with both sales, but also a services customer success and support, everything that is in the lifecycle of customer care, is going to be very strong for us to drive value. And I would say the life with our customers and aligning our strategy with what’s best for our customers. So we’re very excited about putting this in place.

In terms of more details on the incentive packages, I would say we’re focused on Q4 now and finishing the year strong. But we will provide more details on the packages at the beginning of the year.

Saket Kalia — Barclays — Analyst

Got it, got it. That’s really helpful. Josh, maybe for my follow-up for you. It’s probably early to ask this, but out of curiosity, how are you thinking about the mix of license revenue between recurring and non-recurring in the next couple of years? I think you mentioned you’ve hit about 28% here in Q3. I think you mentioned about 45% of bookings in Q3 as well. Understanding it will not be necessarily a straight line and sort of getting to your target, how do you think about that target long term of recurring versus nonrecurring in that license revenue line? Yeah, sure. Hi Saket. Good to talk to you again. So I mentioned also in my prepared remarks, when we think about the transition, and we look at — we looked at a lot of other examples and so forth. This is usually an eight to 10 quarter transition. When we think that we’re going to be at the earlier side of that for a lot of the reasons that Udi just talked about now, in terms of where we are going into the transition. And so for the most part, we see — and we see kind of the success, the success point of coming out of that transition at being more than 85% recurring revenue, and so it’s kind of going from where we are today at 45% to getting well into the high 80s, where we kind of can see already, the other side of the transition. And I think when we think about next year, our sales cycle still is a six to nine month sales cycle, so a lot of the pipeline for H1 next year is already intact. So I think that it will be a little bit slower at first on gaining those percentage points, and then as we get into the middle of the transition, we’ll see a pick up towards subscription, but because we will still be selling perpetual, there’ll be lumpiness, so there may be some quarters that it fluctuates or is a bit volatile. And then of course as we get to the back end, it’s going to be kind of a — more of a linear tale hitting up to the into the high 80s. And then it will be mostly on the percentage of recurring revenue, in terms of the mix shift of the bookings.

Udi Mokady — Founder, Chairman and Chief Executive Officer

Yeah. And I just want to confirm Josh meant, success of the transition is 85% in the mix of license bookings.

Josh Siegel — Chief Financial Officer

Correct.

Saket Kalia — Barclays — Analyst

Got it, got it. Very helpful guys will get back in queue. Thanks a lot.

Udi Mokady — Founder, Chairman and Chief Executive Officer

Thanks Saket.

Erica Smith — Vice President, Investor Relations

Hi Cindy, we will take our next question?

Operator

Your next question comes from Fofina Boolani.

Fatima Boolani — UBS — Analyst

Good morning team. Thank you for taking the questions. Just at the highest level, as I digest some of the newer metrics and some of the headwinds that you quantified as a result of the business moving to SaaS and subscription form factor this quarter. I wanted to get your perspective on the product level. So with AAM and EPM, in total about 20% of your license revenue, that implies about 80% of the business is still tied to the bread and butter PAS. So I’m wondering if you can talk to you the speed or velocity at which the PAS business is accelerating, and how we should see that manifest and impact in your numbers, and then I have a follow-up for Josh?

Udi Mokady — Founder, Chairman and Chief Executive Officer

Absolutely, I think we’re excited of course to see the entire piece grow into subscription. Part of that is more and more on our Privileged Cloud Solution. But yes you are right, we’re seeing great demand for PAM on both form factors, and so, as part of this plan, we will serve customers that want to consume Privileged Access Management on premise, but in a subscription model, and of course service this great growing demand for our Privileged Cloud. So we saw great uptake for Privileged Cloud throughout the year and definitely in Q3 and it’s taking a place in the pipeline. I think, originally we were looking at mid-sized customers to the lower end of the enterprise. But we saw that it’s also going beyond that, and even some of the examples I gave this morning, were of Fortune 500 taking on Privileged Access Management as a service.

Fatima Boolani — UBS — Analyst

That’s very helpful. And, Josh just a follow-up question for you regarding the cash flow and cash flow impact, as we look towards the next eight to 10 quarters, as you’re in the second transition. You did talk about a roughly 5 point increase on net income margins, is the right way to think about cash flow and cash flow yields. But at a qualitative level, what are some of the puts and takes that you are considering in the cash flow profile from here, between invoicing and billings durations from some of these and newer form factors that you’re going to be introducing? And that’s it from me. Thank you.

Josh Siegel — Chief Financial Officer

Yeah. Thanks Fatima for that. And if we think about the puts and takes, obviously as we sell more and more SaaS, we’re looking at more annual payment terms, which is pretty traditional in that environment. So that’s certainly something that we’re considering in our calculation for cash flow forecast. As we’re thinking about subscriptions as well. It’s less subscriptions. We’re still seeing more that will make our multiple year payments upfront. But as we saw already in 2020, there has been kind of an increase towards annual payments and we anticipate that that trend will continue, as we go into 2021 as well. So about the staffs, for sure, which is the standard way for those — for that to be sold, and then even on the on-prem subscription, we anticipate more of that going to annual payments as well.

When we talked about duration, I think we’ll have a lot more visibility into that, as we get into the first quarter of next year, and we begin this transition actively. For the most part, what we’ve seen in the last year is — is the transition has been pretty stable around two years for both SaaS and subscription.

Fatima Boolani — UBS — Analyst

Very clear. Thank you.

Operator

I’m sorry. Your next question comes from Sterling Auty from J.P. Morgan.

Sterling Auty — J.P. Morgan — Analyst

Yeah, thanks. Hi guys and welcome to the recurring SaaS subscription world. It’s good to have you here. So I just want to level set on some understanding in terms of metrics and how you’re thinking about the transition. When you talk about, that the average transition takes eight to 10 quarters, what do you mean in terms of what that means to be complete?

Josh Siegel — Chief Financial Officer

Yeah. Hi Sterling. It’s Josh. So I’ll start. What we see that being complete is, when we get a bookings mix of our — when we get the new license booking mix above 85% of the mix in recurring revenue.

Sterling Auty — J.P. Morgan — Analyst

Okay, good. Because I think that’s important, because I think a lot of investors have been fortunate to cover most of the subscription transitions, and I think a lot of the investors look at the completion of the transition, is when you’ve gotten back in terms of a revenue run rate equal to or above what you had prior to the move, and I’m just kind of wondering, within that, usually it takes one time through your customer base to get them to consider moving to subscription. So under that type of guise, how long do you think it would take for all of your multiyear customers to at least have one shot to move over to subscription?

Udi Mokady — Founder, Chairman and Chief Executive Officer

You know we actually addressed most of our customers every year and we see probably half of our customers coming back to us and buying new licenses, on an annual basis. So, I certainly think that, if we were to look at kind of historical how much contact we’ve had with our customers, you know, probably over, you know, a couple of year, two plus year window, we’re going to see customers return to us for new licenses.

Sterling Auty — J.P. Morgan — Analyst

All right, perfect. That makes sense. Thank you, guys.

Operator

Your next question comes from Rob Owens with Piper Sandler.

Rob Owens — Piper Sandler — Analyst

Great, and thank you guys for taking my question. First of all, just want to touch a little bit on EPM, some of the opportunity you might be seeing there around recent ransomware outbreaks?

Udi Mokady — Founder, Chairman and Chief Executive Officer

Absolutely. I would say that, we’ve seen increased demand. We’ve seen the fact that the EPM — you don’t need to know what the malware is, in order to block it from accessing and encrypting, so it’s a tremendous success against ransomware samples. We’ve tested against almost 3 million — or more than 3 million samples with 100% blocking. Now, that’s in the labs. In the field, we have huge adoption for EPM already for many years and in the last couple of months, we’ve seen increased demand for it, because of the direct correlation. There’s no — the perimeter has dissolved, there are more endpoints out there and consumers to extend the Privileged Protection to the endpoint. And of course, as Josh mentioned earlier, primarily consuming our Endpoint Privilege Manager through SaaS. More than 90% of the business deals in Q3 were SaaS CPMs. It has become a very important product and solution for us.

Rob Owens — Piper Sandler — Analyst

Great, and then as you look towards the fourth quarter and where the pipeline sits, are you anticipating — I think you mentioned six to nine month sales cycles and that’s going to lend to some noise in the first half. But as you look at the fourth quarter guide, are you anticipating a snapback in license at this point or does SaaS continue — SaaS and subscription to an increasing percentage of the license mix? Thanks.

Josh Siegel — Chief Financial Officer

I think, you know, once — you know, when we’re looking at Q4 in terms of the pipeline, we really have a very robust pipeline, both on a perpetual and on the SaaS and subscription mix. So, you know, at this point, it would be hard to say it will be a snapback in one direction or the other. But you know, we’re really focused on, you know, just taking advantage of the — really a record pipeline for us, in terms of opening new opportunities and also the size of the opportunities.

Rob Owens — Piper Sandler — Analyst

All right, thank you.

Operator

Your next question comes from Andrew Nowinski with D.A. Davidson.

Andrew Nowinski — D.A. Davidson — Analyst

Great, thank you. At a high level, you know, I understand why a customer would transition to a term based subscription during the COVID period with tighter spending constraints. But why would a customer choose a term based subscription, versus a perpetual license, you know, outside of this COVID environment, looking into calendar 2021? You know, it seems like it has to be more expensive for that customer, over a three year period?

Udi Mokady — Founder, Chairman and Chief Executive Officer

So I’ll start, Andrew. And actually, that’s why when we talked last quarter, we really wanted to test it out, and be very thorough before we actively transition. And we did a combination of both our checks with customers, and also an external leading consulting firm, and the answer was very clear, this is how they’re buying other software solutions. This is how they’re oriented in terms of their budgeting and their and their spend towards opex. And so it’s becoming the exception to buy in a perpetual license model, and this way, we’re actually aligning with how they want to buy and spend.

It also gives them — of course, this is the common the common model in the industry, and it also gives the customer more flexibility. They feel that they are buying what they are going to use and that it’s going to better align them with the fact that this is a subscription model that the vendor needs to prove outcomes and customer success, which we continuously do and are eager to do. So I think it’s a win-win on all fronts and the combination of having the SaaS portfolio, but also the on-premise subscription, really allows us to cater to all of their preferences.

Andrew Nowinski — D.A. Davidson — Analyst

Great. Thank you. And then, you know, Okta announced a partnership with HashiCorp. back in August. Has that put any or have you seen any increase in competition on your Conjur business, as a result of that partnership and Okta sort of pushing more into the DevOps space? Thanks.

Udi Mokady — Founder, Chairman and Chief Executive Officer

Sure. We haven’t really seen an impact of that. I think we do a lot of partnerships in our C3 to increase our stickiness and lead into customers. So I would say with both, we haven’t seen an increase in competition, but definitely not related to this to this partnership. We do compete with Hashi on the DevOps side and it’s constant, it’s also good to have another vendor that pushes the need to secure secrets in modern applications. But we come to it really from security and a platform for all types of secrets.

Andrew Nowinski — D.A. Davidson — Analyst

Thank you very much.

Udi Mokady — Founder, Chairman and Chief Executive Officer

Thank you.

Operator

Your next question comes from Hamza Fodderwala with Morgan Stanley.

Hamza Fodderwala — Morgan Stanley — Analyst

Hey guys, thank you for taking my question. So if we just look back at kind of the disclosure you guys gave last quarter, right? So it seemed like the SaaS and term subscription was just about a quarter of license revenue that jumped up to 28%. In Q3, it seems like that mix shift was an incremental $5 million headwind versus what you were expecting, when you gave the Q3 guidance? So if we adjust for that, it seems like — the revenue came in just slightly above the midpoint of the Q3 guide. So I’m wondering, is there anything else that you would call out that perhaps drove revenue below the high end of what you guided from, from a macro or pipeline perspective? And at what point did you really see the pipeline mix shift really accelerate towards that? You know, since we spoke back in August?

Udi Mokady — Founder, Chairman and Chief Executive Officer

Yeah, I will start. So I will say we’re pleased with the results and the strong industry tailwinds we saw, driving us to this result of 45% SaaS subscription in our license booking. And, of course, you talked about the headwind. The other datapoint I would add is, we had a tough compare here, when it comes to the Americas, particularly in federal, the Americas grew 34% in in Q3 of ’19, driven by the largest ever federal quarter for us and this year, Q1 was our was our large — what we call the CDM spend, where the government can spend outside the fiscal cycle, and Q3 was not a strong federal quarter. And so we saw the spend elsewhere in the year. And I think that that creates a tough compare on that, if we if we double click on year-over-year.

Hamza Fodderwala — Morgan Stanley — Analyst

Got it. And just as we look into Q4, I’m wondering how you feel about the pipeline visibility into Q4 versus, you know, when we spoke back in Q3 and any sort of directional commentary on ARR in Q4 as well? And that’s it for me.

Josh Siegel — Chief Financial Officer

Well, any direction on what, I didn’t hear the last part?

Hamza Fodderwala — Morgan Stanley — Analyst

On ARRs. I mean, obviously that seems to be the main metric that we should focus on. So I’m wondering if, you know — I know you didn’t provide guidance, but any directional commentary on how we should think about that into Q4?

Josh Siegel — Chief Financial Officer

Yes, so with regard to the pipeline, as I kind of said earlier, you know, we’re hitting record levels of opening pipeline opportunities, really for this entire year, both across all the geographies and also across existing customers, and also across new customers, and across all of our product lines. And as so we go into Q4, we feel, you know — we’re feeling we’re in a good position, a very good position, with the pipeline that we have in Q4, and of course, as you know, we have long sales cycle. So actually, as it goes into 2021 as well.

When we think about, you know, the ARR, the mix shift for the fourth quarter, and it was after — a couple of minutes ago as well. You know, we anticipate, you know, kind of the headwind that we’re talking about now that we gave in our prepared remarks, of around $14 million, are we believe the headwind for this quarter would probably show an increase in mix shift towards new licensed bookings a bit higher than where we were this quarter and obviously, then that would relate to seeing a nice growth in ARR as well.

Udi Mokady — Founder, Chairman and Chief Executive Officer

Yes. And I want to emphasize that the pipeline is moving nicely so far and we see strong — not only in the opening, but also as the progression through the sales cycle.

Hamza Fodderwala — Morgan Stanley — Analyst

Got it. Thank you.

Operator

Your next question comes from Jonathan Ho.

Jonathan Ho — William Blair — Analyst

Hi. Can you hear me okay?

Josh Siegel — Chief Financial Officer

Yes. Hi Jonathan.

Jonathan Ho — William Blair — Analyst

Hi. So just wanted to start out with the transition from on-prem to SaaS. How much can you really influence that from a customer perspective? And, I know like you’re seeing the trend move in this direction, but can you push the customer harder? Like I just want to get a sense for how much influence you have on that side of the equation?

Udi Mokady — Founder, Chairman and Chief Executive Officer

Yeah. Jonathan, absolutely. First of all, we have the ability to introduce new packages, especially to new customers, that will include the subscription. Of course, SaaS is SaaS. But also new packages to existing customers. It gives them the excitement of not looking modularly at the different product components, but actually having the ability to transition to a user based subscription, as really an opportunity for them, and for us, as we really increased our portfolio over the years to really create, I would say win-win packages for them. So yes, we say yes. We think that we’ve succeeded with being — I will say just infusing, passively infusing. We are very bullish that with an active transition, we can make it happen and that we will come out very strong from this.

Jonathan Ho — William Blair — Analyst

Got it. And you referenced sort of the new identity use cases, where you were starting to see customers pulling demand. Can you talk about where you’re maybe seeing the highest demand, and how much of an uplift this could be, if you start adding on some of these newer used cases? Thank you.

Udi Mokady — Founder, Chairman and Chief Executive Officer

Yes. I would say really, since the acquisition of Idaptive and having the stronger, full identity security positioning, we’re seeing our customers — first of all, the proliferation of privileges is really on their mind, so they’re expanding from securing the classic IT and developer type of users, to definitely the personnel behind that are administrating cloud and the cloud consoles. We’ve had that before with Idaptive, we can really give them a smooth way to do that, and put these controls, and then they are looking and excited about the business users. They are actually having privilege, whether they are an employee from an HR department, who is administering the HR system or somebody from finance. So the ability for CyberArk to expand the controls to all types of users, I would say that this is a multi — we are seeing multi-vertical interest, and most of the dialog that I’ve seen has been with the large enterprises, and leveraging the fact that we have 6,300 customers to have these conversations with.

Operator

Your next question comes from Gregg Moskowitz with Mizuho.

Gregg Moskowitz — Mizuho — Analyst

Thank you very much. Hi, guys. Udi, I guess just my first question, you sound excited about the new subscription packages, and I’m sure the new Cloud Entitlements Manager product is going to be an important part of this. Can you elaborate on how you may look to go-to-market with these packages next year?

Udi Mokady — Founder, Chairman and Chief Executive Officer

Yes. I’m really excited that you brought up to the Cloud Entitlements Manager. Again, the launch was yesterday, but we’ve been sharing it with customers for a couple of months and it’s really right where the puck is going, because they are seeing that the cloud identities come with thousands of permissions and a human on their own, can’t really figure out how to put control over it. And this way, with AI and the solution here, we have the opportunity to give them at least privilege for cloud, immediately remediate access, and so they’re very excited about that. So that’s another example of a SaaS solution that goes into the mix here. In terms of the type of packages, I don’t have specifics to elaborate next year. But given the broad portfolio, we can create different landing points for customers, with the mix of our solutions.

Gregg Moskowitz — Mizuho — Analyst

Okay, terrific. Thanks Udi. And then just for Josh, it’s interesting that SaaS and subscriptions made up more than 45% of new license bookings this quarter versus only 10% a year ago. I think we all get the 14 point headwind on recognized revenues this quarter. But what impact does this mix shift have on licensed bookings in absolute dollars or licensed bookings growth for that matter? How should we think about that?

Josh Siegel — Chief Financial Officer

I’m sorry, what does have impact on licensed bookings for? I didn’t hear the last part.

Gregg Moskowitz — Mizuho — Analyst

On license bookings growth, so if it’s a 14 point headwind on recognized revenue growth, clearly there’s an impact to your license bookings growth rate as well from this mix shift. I’m just kind of wondering, how we should be thinking about that part of it?

Josh Siegel — Chief Financial Officer

Yes. Actually, I mean, the way we think about it is, first of all, in Q4, we’re looking at a bigger headwind based on the mix shift that we’re anticipating. We’re not breaking out the different license bookings from other types of bookings, as part of our guide. But really, in the end of the day, it’s going to be — what’s going to be important is, is how quick do we get to growing our ARR at the nice levels that we want and that’s going to really dictate the strength of the business. So, I can’t give out what we expect the license bookings growth will be. But we talked about in Q4 being about an $18 million headwind in the guidance we gave for total revenue.

Gregg Moskowitz — Mizuho — Analyst

Okay, that’s helpful. Thank you.

Operator

Your next question comes from Eric Sussex [Phonetic] with Goldman Sachs.

Brian Essex — Goldman Sachs — Analyst

Hi, good morning. It’s Brian Essex. Hey, thanks for taking the question. And apologize, if this has been asked before. But Udi, can you maybe touch on the difference between annual contract value? What you’re seeing SaaS versus license? And how you anticipate that might drive more effective customer adoption of the platform?

Udi Mokady — Founder, Chairman and Chief Executive Officer

Josh, do you want to take that?

Josh Siegel — Chief Financial Officer

Yes. Sorry, I was on mute. So, actually, we’re seeing on the SaaS and subscription side recently increase on the annual contract values that we’re getting on the SaaS and subscription pieces. Overall, they typically though, when we see our SaaS customers, they’re going to start smaller, but they expand much more quickly and we’re still new in this game, so bear with us. But at this point in this year what we’ve seen is that they’ve actually increased off of a smaller number at the beginning of this year, when we first started selling more SaaS and subscription.

Brian Essex — Goldman Sachs — Analyst

Got it. And then how might that compare to the way that you know — from what I understand, on the license side, there was a little bit more phasing of deals or lowering of initial contract buying expansion. Is it similar to what you’re seeing on the license side? Or is it materially different because of the different way that platform might be consumed?

Josh Siegel — Chief Financial Officer

No, I think it’s similar. I think that customers, particularly new customers, they come in and they start in a certain area where they want the high risk area, if it’s privileged cloud and then they have a map of where they want to expand over the next couple of years and move out within their IT infrastructure. So, I think we expect it to be fairly similar with the SaaS, either the SaaS offerings or with the buying on-premise in subscription pricing.

Brian Essex — Goldman Sachs — Analyst

Got it. That’s helpful. Thank you.

Operator

We would now like to turn the call back to Mr. Udi Mokady.

Udi Mokady — Founder, Chairman and Chief Executive Officer

Thank you, Cindy. I want to thank everyone here. I want to thank our customers, partners and employees for contributing to our success in the third quarter. As a subscription company, I’m confident that we will build even deeper relationships with our customers and partners. And again, thanks everyone for the time today and look forward to talking soon.

Operator

[Operator Closing Remarks].