Cybersecurity companies have been gaining a lot of attention in recent years as cybercrime, state-backed attacks, and corporate espionage tactics become increasingly sophisticated. 37 billion records were exposed in data breaches last year, representing a 141% increase from 2019, and that figure could keep rising for the foreseeable future.
That’s why Grand View Research expects the cybersecurity market to grow at a compound annual growth rate (CAGR) of 10% between 2020 and 2027. That rosy forecast caused many leading cybersecurity stocks -- such as CrowdStrike (CRWD 3.36%), Palo Alto Networks (PANW 1.39%), and Cloudflare (NET 1.95%) -- to rally over the past year.
Yet CyberArk (CYBR 1.14%), a leader in the PAM (privileged access management) market, is often left out of those conversations. It’s smaller than those three cybersecurity giants and it’s growing at a slower rate, but it still deserves your attention for three simple reasons.
Image source: Getty Images.
1. A leader in a valuable niche market
Most cybersecurity companies focus on blocking external threats. CrowdStrike deploys cloud-native cybersecurity services to block attacks, Palo Alto’s core platform is a next-gen firewall, and Cloudflare protects websites from attacks and shields their visitors from malware.
CyberArk, however, focuses on internal threats like corporate spies and disgruntled employees. It sets different access levels for a company’s employees, and locks down the system upon detecting an internal breach.
Gartner has consistently named CyberArk a market leader in the global PAM market, which Market Research Future expects to expand at a CAGR of nearly 33% between 2020 and 2026.
This niche market could grow faster than the broader cybersecurity market because many companies will likely realize they bolted up the doors and windows when the intruder is already inside the house.
CyberArk currently serves more than half of the Fortune 500 and over a third of the Global 2000, so it still has room to grow. It’s also been expanding its customer base by acquiring smaller companies like Viewfinity, Conjur, Vaultive, and Adaptive over the past six years.
2. Pivoting towards cloud-based services
Many cybersecurity companies, including CyberArk, Palo Alto, and FireEye, install on-site appliances and sell their services through licenses. However, younger companies like CrowdStrike are skipping appliances and providing cloud-based security services -- which are stickier, easier to scale, and generate predictable recurring revenues.
Image source: Getty Images.
That’s why CyberArk has been gradually pivoting from its on-premise services towards newer cloud-based services. That focus boosted its annual recurring revenues (ARR) 43% to $274 million, or 59% of its top line, in fiscal 2020. It expects cloud-based bookings to account for 55% of its new license bookings in fiscal 2021, compared to 50% in 2020.
That ongoing evolution, which CyberArk is supporting with higher cloud infrastructure investments, ensures that it keeps pace with the industry as on-site appliances gradually disappear.
3. Its slowdown should be temporary
CyberArk’s revenue rose 7% to $464 million in 2020, but its adjusted net income declined 25% to $81 million. Analysts expect its revenue to rise 6% this year, but for its adjusted earnings to drop another 72%.
Based on those estimates, CyberArk’s stock trades at nearly 230 times forward earnings and ten times this year’s sales. Many investors might look at CyberArk’s sluggish growth and high valuations and stick with Palo Alto, which generates stronger growth and trades at lower valuations.
However, CyberArk’s near-term growth is throttled by two main factors. First, CyberArk initially generates higher revenues from its on-site appliances than cloud-based subscriptions. But over time, its cloud-based subscriptions will generate more recurring revenues.
Second, CyberArk’s aggressive cloud infrastructure expansion and its elevated R&D and marketing expenses are temporarily weighing down its gross and operating margins. After it clears this investment phase, its earnings growth should normalize again.
That’s why analysts expect CyberArk’s revenue and earnings to grow 12% and 4%, respectively, next year. CyberArk’s stock still might look pricey relative to those estimates, but its low enterprise value of $4.9 billion still makes it a compelling takeover target for larger cybersecurity companies.
The bottom line
CyberArk isn’t my favorite cybersecurity stock right now, but I wouldn’t underestimate its long-term growth potential. It dominates an essential niche market, it’s expanding its businesses in the right directions, and it will probably fully transition to cloud-based services in the near future.
