© 2024 Alpha Spread Limited. All Rights Reserved.
www.alphaspread.com is not operated by a broker, a dealer, or a registered investment adviser. Under no circumstances does any information posted on www.alphaspread.com represent a recommendation to buy or sell a security. The information on this site, and in its related newsletters, is not intended to be, nor does it constitute, investment advice or recommendations. The information on this site is in no way guaranteed for completeness, accuracy or in any other way. In no event shall Alpha Spread Limited be liable to any member, guest or third party for any damages of any kind arising out of the use of any content or other material published or available on www.alphaspread.com, or relating to the use of, or inability to use, www.alphaspread.com or any content, including, without limitation, any investment losses, lost profits, lost opportunity, special, incidental, indirect, consequential or punitive damages. Past performance is a poor indicator of future performance.
You don't have any saved screeners yet
Intrinsic Value is all-important and is the only logical way to evaluate the relative attractiveness of investments and businesses.
Intrinsic Value is all-important and is the only logical way to evaluate the relative attractiveness of investments and businesses.
Good morning. My name is Julie, and I will be your conference operator today. At this time, I would like to welcome everyone to the CyberArk Second Quarter 2019 Earnings Conference Call. All lines have been placed on mute to prevent any background noise. After the speakers’ remarks, there will be a question-and-answer session. [Operator Instructions] Thank you. Ms. Erica Smith, Investor Relations, CyberArk, you may begin your conference.
Thank you, Julie. Good morning. Thank you for joining us today to review CyberArk's second quarter 2019 financial results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open up the call up to a question-and-answer session.
Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflect management's best judgment based on currently available information, specifically, our expectations and beliefs regarding our projected results of operations for the third quarter and the full-year 2019. Our actual results might differ materially from those projected in these forward-looking statements.
Please see the risk factors contained in the company's Annual Report on Form 20-F filed with the U.S. Securities and Exchange Commission and those referenced in today's press release. CyberArk disclaims any obligation or undertaking to release publicly any updates or revisions to any forward-looking statements made today.
Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation to the most directly comparable GAAP financial measures is also available in our earnings press release, which would be found on www.cyberark.com in the Investor Relations section. Also, please note that a webcast of today's call will be available on our website in the Investor Relations section.
With that, I'd like to turn the call over to our Udi Mokady. Udi?
Thanks, Erica, and good morning everyone. Thank you for joining the call today. We were pleased to exceed expectations across all guided metrics. Revenue reached a $100 million, [growing] 29%. Our revenue outperformance, disciplined investments, and strong business model resulted in $26 million of operating income for the quarter and in the first six months of the year we generated $67 million in cash flow from operations.
Given the strength of our business in the first half, we are raising our guidance for the full-year, which Josh will talk about later in this call. Demand for our solution remains strong across the Americas, EMEA, and APJ, and we continue to see broad market tailwinds. While digital transformation and cloud migration strategies are accelerating business operations, they are also exponentially increasing the complexity of enterprise IT, creating opportunities for CyberArk with new and existing customers.
In addition, regulators are flexing their muscles making headlines in the last few weeks by imposing staggering fines of $700 million, 250 million and 125 million related to breaches. The stakes have never been higher than security and in almost every successful breach, a hacker infiltrates the network or cloud environment and exploits Privileged Access, putting our solution at the top of Chief Information Security Officer’s priority list.
In today's environment, organizations are prioritizing proven and measurable solutions that deliver value. They recognize, the securing Privileges Identities human and nonhuman is the foundation of the strong Cyber Security strategy. In fact, industry analysts again listed protecting privilege as one of the top 10 most impactful security projects for 2019.
Privileged Access extends across all enterprise IT and the breadth of our solution simplifies the customer journey. A customer typically secures the most critical assets and applications first. And then expands increasing the number of users adding our application and endpoint solution, and ultimately extending protection enterprise-wide across on-premise, cloud, and hybrid environments. This is driving add-on business, which again represented just over 60% of license revenue in the second quarter.
On the new business front, we won more than 200 new logos in the second quarter, and are now helping secure over 4,800 organizations around the world. The majority of our new business continues to be Greenfield, and we are also surprised to see large enterprises managing privileged accounts manually.
Overall, in both new and add-on deals, our results were well diversified across industries, customer size, as well as geography demonstrating that every organization needs to secure Privileged Access.
In the second quarter, six verticals grew by 40% or more, including insurance, manufacturing, media, pharmaceuticals, retail, and transportation. We continue to see strong traction with our newer solutions. We were thrilled with our record quarter for endpoint privileged manager, including records SaaS bookings. Most breaches begin at the endpoint.
Removing local administrator rights, running a least privilege is recognized as a foundational pillar of security best practices from institutions like the Center for Internet Security, CIS; and the National Institute of Standards and Technology or NIST. Our platform provides customers with end-to-end visibility into privileged activity from endpoint through on-premise and cloud environments.
In addition, Application, Application Access Manager continues to gain momentum and was included in half of our top-10 largest deals in the second quarter with an increasing number of customers also landing with this solution. As organizations migrate workloads to the cloud and implement digital transformation strategies securing applications is increasingly important to reduce the attack surface.
Our more than 200 integrations are major competitive differentiator in the market, reducing the friction of securing mission-critical applications and making it easier for customers to strengthen their overall security posture. Securing robotic process automation or RPA projects was a trend again in the second quarter. To successfully automate and standardize human processes, RPA robots need access to multiple essential applications and systems.
Customers are increasingly turning to CyberArk to secure leading RPA vendors like automation anywhere, Blue Prism, and UI PAS. I want to highlight a few powerful new and add-on customer examples. In the Greenfield opportunity, a large global manufacturing company landed with Endpoint Privilege Manager and Core Privilege Access security. The firm's new Chief Information Security Officer quickly identified securing privileged access as a top priority.
They chose CyberArk because of our leadership position, ongoing investment in innovation, and ability to provide visibility into privileged activity enterprise-wide. A government agency in EMEA had a specific GDPR used case, which was extended to also secure its applications and IT environment with a comprehensive PAS program.
A European media company expanded its deployment of CyberArk. The customer wanted to mitigate the risk of cyber-attacks across its European operations. The simplification of our solution and licensing, as well as our ability to secure its digital transformation strategy and AWS environment where meaningful contributors to this seven-figure add-on deal. A U.S. federal agency extended its coverage with Core PAS and added Application Access Manager and endpoint privileged manager. The agency wanted a single view into its privileged activity enterprise-wide, including its AWS environment.
In our largest deal in the second quarter, a financial services firm in the Americas is expanding with Core privileged access and Application Access Manager for its mission-critical customer facing applications. They have a multi-cloud environment and will leverage CyberArk to secure both AWS and Azure.
Our unwavering focus on innovation is critical to extending our leadership position. We continue to set the standard and define the market for privileged access security with the early July introduction of CyberArk Alero, our latest SaaS solution. Alero helps customers mitigate the risks of third-party vendor access to critical systems. We are the only vendor to combine Zero Trust access, biometric authentication, and just-in-time provisioning without the use of VPNs, agents, or passwords.
Our new solution makes it simple and easy for customers to manage remote vendor access. We also enhanced endpoint privileged manager to provide just-in-time administrative access to Windows and Mac endpoints on-demand. Given our security first approach, we’re also providing customers with a full audit log and the ability to revoke access as needed. The combination of Alero, CyberArk privileged cloud, and endpoint privileged manager is the most comprehensive SaaS portfolio for privileged access in the market.
Customers can deploy or access CyberArk anywhere; on premise, in the cloud, or as a service. Our laser innovations spread introduced at our recent CyberArk impact events for customers and partners in Amsterdam and in Chicago. These events were our most successful yet and marked the largest gathering of privileged access security professionals in the world with more than 2,500 attendees.
Partners also had an opportunity to dive into the new CyberArk Partner Network. This partner enablement program connects our ecosystem of advisory firms, global system integrators, and regional solution providers, and introduces enhanced competency-based tiering and certifications. The indirect channel represented about 65% of our revenue in the second quarter. We believe this new partner program provides us with an opportunity to accelerate momentum with our channel and advisory partners.
As part of our ongoing commitment to helping customers secure their cloud environments, we expanded our relationship with Microsoft by joining the Microsoft Intelligent Security Association. We are working with Microsoft to deliver joint customers, greater flexibility, and efficiency for securing privileged access. Our enterprise customers can more easily deploy our solutions in Azure and consistently enforce security and compliance across hybrid environments.
As you saw in our release today, we also announced that Ron Zoran will be transitioning out of CyberArk to help grow and scale early stage organizations as a board member. Ron was one of the very first employees at CyberArk and played an important role in defining privileged access as a critical layer of security and in establishing CyberArk as the de facto leader in the space. Like all strong leaders, Ron has built an exceptional sales organization with strong leadership across all regions.
We have initiated a search for new Global Head of sales. Ron will continue to serve as Chief Revenue Officer through September 30. To help ensure a smooth transition, he will continue as an advisor into the first quarter of 2020. We appreciate his ongoing commitment to the company. Our financial performance continues to demonstrate our significant market opportunity, the increasing awareness of privileged access security as a critical layer, and our ongoing commitment to delivering profitable growth.
With that, let me turn it over to Josh to discuss more details about our strong Q2 results. Josh?
Thanks Udi. As Udi mentioned, we had a strong second quarter with total revenue growing by 29% year-on-year to $100.2 million. License revenue reached $52.2 million, increasing 27% over the second quarter last year, and representing 52% of total revenues. We showed growth across all geographies and for both new and add-on business.
On the product side, Application Access Manager represented about 9% of license revenue and Endpoint Privilege Manager represented about 7%. In the second quarter, we were again pleased to see the strong growth in the EPM bookings derived from SaaS deals. Maintenance and professional services revenue was $48 million, increasing 31% year-on-year and representing 48% of revenue.
The professional services revenue associated with this line was $9.2 million or 9% of total revenue. The business was well diversified across geographies. The Americas, revenue grew 28% to [$61.8] million and represented 62% of total revenue. EMEA revenue also increased 20% to $28.7 million or 28% to total revenue, APJ which achieved a record $9.7 million of revenue growing 41%, and representing 10% of total revenue.
As I move through the P&L, all line items will be discussed on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation in the tables of our press release. Our second quarter gross profit was $87.7 million or 88% gross margin consistent with last year's 88%. We are continuing to invest in the business to deliver innovation, drive growth and scale of the operations.
R&D grew by 24% year-on-year to $14.6 million. Sales and marketing increased 19% to $38.6 million as we expanded our sales organization across all geographies to support direct and indirect sales. G&A expense increased 16% year-on-year to $8.1 million as we continue to scale the business to support our growth. In total, operating expenses for the second quarter increased 20% to $61.2 million, compared with $51.2 million for the second quarter last year.
With our disciplined investments and revenue outperformance, we again deliver operating income ahead of our guidance at $26.5 million or 26% operating margin, compared with $17 million or 22% operating margin in the year ago period. Our overall expense growth is primarily related to headcount, and we ended the second quarter with 1,254 employees worldwide, compared with 1,077 at the end of second quarter last year.
We ended the quarter with 588 employees in sales and marketing, compared to 513 at the end of the second quarter last year. Net income was $23 million or $0.59 per diluted share for the second quarter of 2019, compared to $13.5 million or $0.36 per diluted share for the second quarter of last year. We were pleased to generate $67.3 million in cash flow or 34% margin for the first half of 2019 that represents an increase of 20% over the first six months of last year.
The strong cash flow continues to be driven by strong collections, as well as our high maintenance renewal rates. As a result, we ended the quarter with $538 million in cash and investments. This compares to $451 million in cash and investments at year-end, and we ended the second quarter with $174 million in total deferred revenue, a 34% increase from $130 million at June 30, 2018.
Turning to our guidance. As a reminder, our guidance does not consider any potential impact to financial, other income, and expenses associated with foreign exchange gains or losses as we do not try to estimate future movements in foreign currency rates. So, for the third quarter 2019, we expect total revenue of $102 million to $104 million or 22% year-on-year growth at the mid-point.
We expect non-GAAP operating income to range between $21.8 million to $23.3 million, and non-GAAP net income per diluted share of $0.45 to $0.48. The increase in our expenses in the third quarter is primarily related to seasonal employee expenses and our major third quarter marketing programs. Our guidance also assumes 39.4 million weighted average diluted shares and a tax rate of 21% for the third quarter. Because of our first of execution and demand for our solution, we are increasing our guidance for the full-year of 2019.
We expect total revenue now to be in the range of $419 million to $423 million or a growth of approximately 23% at the midpoint. We are also increasing our guidance for non-GAAP operating income to be in the range of $106 million to $109 million and non-GAAP net income per diluted share of $2.24 to $2.30. This is assuming $39.1 million weighted average diluted shares, and our guidance for the full-year assumes effective tax rate of approximately 21% for 2019. We are pleased with our execution and our results in the first half of 2019, and it positions us very well for the remainder of the year.
I will now turn the call over to the operator for Q&A. Operator?
And at this time your first question comes from Saket Kalia of Barclays Capital.
Hi guys. Thanks for taking my questions here.
Absolutely. Hi, Saket.
Hi, morning, Udi. Maybe Udi, just to start with you, you know from a product perspective, it seems like the momentum for Application Identity Manager and I'm guessing Conjur as well continues to be strong, can you just dig into that a little more, why do you feel like we are seeing that demand for AIM currently? And maybe related to that, how does the economics for AIM compare to Core PAS is if that’s comparable at all?
Sure. Like we highlighted there was a record quarter for endpoint privileged manager, which really has its drivers around the fact that attacks begin at the endpoint and it’s becoming a no-brainer lets – let users run with full privileges on the endpoint and make it easier for an attack or two to exploit and [land there]. That’s our endpoint privileged manager. And with regards to AIM, it’s super strategic as part of digital transformation strategies of our customers, and so whenever we come to an existing account or new prospect, they are somewhere on that journey to moving their applications to modern infrastructure and running on containers, and again securing those keys and credentials is key. It’s still a smaller, obviously, a still smaller part compared to our Core PAS is the prime growth of this ship, but it’s behaving like a growth engine and is super strategic for us.
Got it.
And Saket, when we think about the economics behind the AIM versus our Core PAS, well first of all, again, it’s a pure software. So, on a margin basis, it’s a very, very high margins related. It probably drives also equal amount of services as well. It’s priced, you know a bit differently in the context because it’s both dynamic and for non-dynamic application environments, but overall, we think about organizations that would require it across the entire organization. The value of it would certainly be very close to the value of a Core PAS for that organization.
Got it. That’s helpful. Josh, maybe for you, just in terms of revenue, nice speed on license, but also an even bigger beat versus [indiscernible] on maintenance and services, can you just talk a little bit about the breakout there within maintenance and services, what the split was between the two and sort of how do you think about that going into the second half?
I think, when we look at the support of maintenance, that number included, I think I talked about it. It was 9 million – 9% of the total revenue was professional services.
Got it. Very helpful. Thanks guys.
Thanks, Saket.
Your next question comes from the line of Sterling Auty with JPMorgan.
Hi, guys. Just to clarify that, so I think we get to the same number, but I think in the prepared remarks you said, $9.2 million of services?
Yes. Exactly. And that’s 9% of total revenue.
Alright, perfect. Just wanted to make sure. So, Udi, in terms of your Chief Revenue Officer deciding to work with smaller companies, any additional insight as to why now?
Yes. Absolutely. First of all, I wanted to be down in the book as the best possible and most amicable transition in recorded history because it is a long time and strong relationship and friendship. And he’s been with us basically from the beginning of time. So, the timing is his decision, but in everything he says and articulates, he's just very proud of where we are as a company and the opportunity for us. And after so many years in a demanding operational role wants to contribute from his experience to startups, and early stage companies, mostly as a board member and investor.
And so, it’s really, I would say, a good timing for him and for us, the best possible transition, because he’s leading the charge for Q3. He’s staying with the company all the way into Q1 and allowing us to really make this the best transition. Take our time and like we said, we launched a search for and will be very selective to make this a great fit and leverage the strong leadership we already we have in place across the regions.
That makes sense. And then you mentioned the new partner program, is that ruled-out globally and when was that in effect? So, in other words, is everybody trained and up and running on the same page in all three theaters?
Yes, absolutely, absolutely, we had the opportunity to launch it at our major events in Europe, in Amsterdam and Chicago for the Americas, but also earlier in several of the APJ regions, and we did it very thoroughly where we gave partners a heads up about it coming into effect where essentially it’s taking CyberArk to the next step. The demand is there, it’s top priority now across geographies, we really want to leverage our partners to be more capable, more enabled as they go to market.
So, it’s basically more rewarding, the more they invest in getting up and running and trained and launching it within these big events is just a great platform, because they have the opportunity to see full road map, everything the upside for them and hear more about the program and get up to speed.
Makes sense, thank you.
Thanks, Sterling.
Your next question comes from Gur Talpaz with Stifel.
Great, thanks for taking my question and congrats on the quarter. Udi, I wanted to ask if you would classify what you are seeing as a sort of inflection in terms of demand for cloud solutions and that’s whether because of the launch of new solutions like Alero or because of just general increase in market awareness. You talked a lot about it on the call and I just kind of care to see if you could sort of classify that kind of terminology?
Yeah, I think that in every customer and the beauty is that no matter where we are in the region, we find that they are somewhere in their journey. By the way, you still have those that are just tip towing and you have those that have moved all in, and somewhere in the middle, and we wanted just like we are diverse from a geography and a vertical perspective. We always want to be diverse on where they on their cloud journey, and for many of them it’s the ability to deploy CyberArk in the cloud or for CyberArk to secure their cloud infrastructure, but also new offerings if we can deliver them – as a service we’re definitely playing to the modern appetite.
And for example, Alero, which we’re very excited about was – we saw increasing demand for customers to expand privileged access to also those third parties that need privileged access and need to get into their infrastructure and the decision was rightfully okay. We’ll build this and launch this as a service, and expand our SaaS portfolio. The CyberArk privileged cloud is more intended towards mid-market and we launched it for that, for the customers with an appetite to consume privilege as a service, so that they’ll have that and of course EPM, which had a record quarter most of it, like the majority of the EPM was consumed in SaaS. When we look at Core PAS, we still see that enterprises want to own and put the keys to the kingdom, mostly on premise, but they have a variety of options and we cater to that.
And your next question comes from Rob Owens with KeyBanc Capital Market.
Great, and thanks for taking my question. Udi in high levels we’re hearing about some disruption in Europe, maybe you had obviously a successful quarter there, but just give us some color in general, relative to what you guys are seeing at this point and any potential economic warning signs?
Absolutely. Hi Rob. I’m think, I’m fresh to actually deep dive on the European business. We were very pleased with 28% growth this quarter. We ask about macro, obviously they are waking up in the morning and they are reading the news, but they are not seeing it translate directly into the pipe or the opportunity. And so, I would say that right now it has translated and again, perhaps it’s a matter of privilege being really in the high priority and not a nice to have privileged access being foundational, but of course we stay very close to it and stay tuned. Diversity is really a big part of our strength, so it’s also diversity within the region.
And following for Josh, relative to a couple of the balance sheet items, the differed revenue, I don't think met your expectation but was in line with where you guys have been historically Q1 to Q2 if I look back a couple of years. So, maybe some of the puts and takes around differed and then number two, your DSOs did spike quite a bit sequentially, did that speak to the linearity of the quarter? Thanks.
Thanks Rob. On the deferred revenue, I think you kind of nailed it in terms of where we are in the seasonality, this was where we thought we would end up around on deferred revenues. Let’s not forget it is a 34% year-on-year increase. So, nevertheless still a nice growth rate. Deferred revenue for CyberArk is predominantly the support and maintenance contracts, which have their seasonality and have their ebbs and flows for when we booked them and they are aligned with the licenses.
So, with the Q3 and with Q4 being the heaviest license period of the year, and then it dips down in the first half of the year, which is why you see lower on deferred revenue growth, but we’re aligned with where the deferred revenue growth is, and I think you pointed it out, it’s in line with the seasonality that we’ve seen in the past. With regard to DSO, actually the linearity was fairly close when we look at it from a month-by-month and weekly perspective into the last month of the quarter. It’s 41 days, it’s a bit, I think spiking is bit of a tough word, when it only jumps, when it’s only 41 days, compared to mid-30s as it was in Q1, but overall, it’s very much in our range of comfort zone for DSO.
Next question comes from Daniel Bartus with Bank of America.
Thanks guys. I wanted to ask first about just recurring revenue in general. Imagine most of the maintenance lines is recurring and then you have a decent amount of SaaS now in the business. I remember from the Analyst Day in the past, you guys showed that pretty steady repeat selling to existing customers every quarter too. So, you add all those up, I was just wondering how much of your revenue would you now classify as recurring or recurring like, and how do you expect this trend going forward?
Yes, still the majority of our deferred revenue and recurring revenue is coming out of maintenance. We do have some SaaS, which is building certainly with the growth of the business and churn-based licensing which is growing within the course of the business. So, I would put the number roughly 40% in terms of recurring that we have today, and then on top of that as you kind of pointed out, is that we have a pretty consistent stream of recurring revenue.
In fact, about just over 60% of our license revenue, when I talk about recurring customers, just over 60% of our existing customers came back also in Q1 and also in Q2 this year and purchased additional licenses. So, it’s something we’ve seen consistently over the last few years, and while we don’t know exactly and always who will be coming back and for how much, we have consistency for customers coming back and purchasing more each quarter. On top of the 40% of contractual recurrence.
Your next question comes from Jonathan Ho with William Blair.
Hi, good morning and congratulations on the strong results. I just wanted to start out with version 11 of your product and some of the new features like geographic distribution, maybe open up some new opportunities with your customers?
Yes. This was, I would say version 11 really was a major enhancement for us. And a lot of it has to do with customers who really deploy CyberArk at scale, and a big part was what we call the active, active vault where it really allows them to trust the infrastructure to always be up and support their – of their critical systems. It’s been long in work and launched in version 11. We also continued to invest the items around simplicity, which we started back in – when we first rolled out 10, and we've been rolling that out consistently and showed it in our two impact events.
One of the exciting new introductions in version 11 were our secret list broker, which adds on to the strength of our AAM solution allowing in certain used cases developers to really be totally seamless in dealing with credentials and where the management is all behind the scenes for them. We view that as another important enhancement for that adoption. And on top of that, like I said earlier, we made major enhancements to our CyberArk privileged cloud. So, yes, all of these contribute to our ability to continue to expand globally.
Great, and then, just with regards to Alero, you know, how quickly do you think this could potentially ramp? And if starts to, you know, cross over a little bit into the traditional SSO space, can you maybe help clarify, you know, where there’s this overlap and where, you know, there’s sort of uniqueness?
Yes. It’s very much privileged access. It’s answering demand for our customers. They say we’re – CyberArk is our solution for employee, and strong users and their access to our IT infrastructure, but we also have a lot of third parties who need to come in and it could be that they are administering a router or a database or they could be an IT service provider. And so, it's a big pain, and – but it's very much in the privileged access world, so we give them a VPN less, password less and agent less way to get very strong and – strongly controlled privileged access and do what they are need to do.
And so, I would say it’s adjacency to the other IAM parts. In terms of the opportunity, the opportunity is very large. We see it really as great new, but also very at our business to our existing customers, but it is a new solution. So, we – you know we’re going to take our time as we roll it and its not baked into a big impact into 2019 itself, but definitely is going to be part of every sales process to new and existing customers.
Next question comes from Gary Powell with Deutsche Bank.
Great, thanks for taking the questions. Yes, maybe we can – can we talk about the competitive environment. Have you seen any benefit from customers looking to turn off from CA yet? And has that been a material driver to growth in the first half of this year?
Yes. Hi, Gary. I would say, no major change since we updated last quarter. I would say, primarily seeing the PE role up companies in the competition amidst we – with regards to CA, yes, we see them trying to cling onto existing customers less or zero involvement in new business. And you're right, we have seen displacements in CA. Some of them have been ones that we’ve been eyeing for a while and in important enterprises, but it wasn't meaningful in terms of the overall impact on the number, but important for us strategically, especially since the customers really appreciate that we have the experience of also migrating from CA infrastructure. And so, the more we have added, the more we can do more in the future.
Thank you. The next question comes Catharine Trebnick with Dougherty.
Hi, thank for taking my question, and an awesome quarter. Mine has to do just with the advisory curve, could you dig into a little bit how that process works and, you know, how much are they really feeling? Could you give us may be an idea what percent of revenue comes from the advisory firms? Thank you.
Yes. So, I don’t think we provided it in this quarterly snapshot, but we will in the future continue to talk about influenced deals. The influence our revenue, they usually do not resell. I would say that the partnership and their level of competency is the best ever, and it's the numbers. It’s the amount of trained professionals that they have and also really creating a business around us. One way to see it was their presence in our impact events. You really see the Big4, you see Accenture, really investing and partnering with us and it's really a win-win, especially with their footprint in Fortune 500 and Global 2000 and their ability to influence there. You're right; it's one of the things I’m really most excited about in the past one or two years.
And the question comes from Andrew Nowinski with Piper Jaffray.
Alright, thanks. Thanks for asking the question. So, I understand your comments on seasonality with regard to deferred revenue, but it does seem like for the last few years and particularly in Q2 billings growth has generally outpaced revenue growth though it looks like this quarter it slowed pretty materially relative to your revenue growth rate. So, can you provide any more color as to what might be driving that and how we should think about it going forward?
Yes. Andrew, you know, basically again, in terms of – you know this company is, you know, predominantly selling perpetual software licenses. So, when we look at – you know when we look at billings as predominantly the impact of deferred revenues, and then – and that's really driven by the seasonality of our maintenance renewals, and, you know, I think that, you know, overall, when we look at, you know, the maintenance renewals, we’re still above our 90% plus threshold, and, you know, I think, you know, it’s just a matter of the ebbs and flows of our renewal contracts of, you know, how it ties into the billings. But we’re happy with our 34% increase on deferred revenues, and the license growth revenue year-on-year, which is going to keep driving those maintenance contracts going forward.
Okay. That makes sense. And then, I know you implemented some pricing changes last year at this time, and so, I’d assume all the new customers are on their new pricing model, but can you give us any color as to maybe what percentage of your existing customers have moved to the new pricing model? And should we view that transition to the new model as a growth driver? Thanks.
Yes. So, as you said, all of – any new quote going out the door today is on the new pricing model has been for a year now. And then, you know, basically our existing customers, when they come back and buy more licenses, as I said before about 60% of our revenue – of our license revenue is coming from existing customers, though either choose to convert and to the new prices or continue buying a la carte and the old price list. And roughly about 30% of our customer base is on the new price list.
Again, your next question comes from Gregg Moskowitz with Mizuho.
Okay, thank you. Udi, you spoke a little about the enhanced partner program, but can you update us on your mid-market initiative more specifically just in terms of how that’s progressing?
Yes, absolutely. Hi, Gregg. I would say it's still early days from us. The biggest growth still comes from enterprise, but two quarters into it, we’re really seeing processes definitely improve and it – you know really the fruits of our investment in a different sales motion, our ability to touch the mid-market with less presence in the field. So, I would say it’s in the right direction. It’s still a smaller part of the business, but we view that as long term strategic for us.
And that’s great. And then just a quick one for Josh, so your gross margins again were very good this quarter. I think you had previously guided to 87% to 88% for the year, but you're already at the high end, and, you know, historically speaking your second half margins are typically higher than first half, so just kind of wondering how you’re thinking about gross margins over the rest of the year? Thanks.
Yes. I think we’re – you know we think that we’re still sticking with the original range, but as you said, we’re hovering towards the high-end of it. Some of it will depend upon, you know, the level of services in the fourth quarter in terms of how much we need to extend out to sub-contractors to help us, you know, provide that level or not. But I think we feel comfortable with the 87% to 88%.
Next question comes from Alex Henderson with Needham.
Great, thank you very much. I wanted to ask a question on the verticals. You cited six verticals that specifically grew in excess of 40%, which is great news, and I’m glad to see it. But the question is, is that a function of the need in those vertical? Or is that a function of you targeting those verticals? And if so, how do we think about the targeting efforts going forward? Is there other verticals where you haven’t targeted that you might be able to add in to provide that extra kick to growth?
Yes. You know, absolutely. I think we want to show color about where – the beauty is we sell the same software to every vertical and across the world. And so, except for the federal team, we don't have dedicated teams for vertical, which really allows us to be diverse and scale. And so, the results of these growth are results of growing demand in a vertical, and of course, execution against that demand and just, you know, that beautiful pie of diversity that we have continues, and, you know, the growth levers are definitely just to go after the next 30,000 customers, 40,000 customers that don't have privileged access and do that cross-geography, cross-vertical because every vertical needs this.
Next question comes from Ken Talanian with Evercore ISI.
Hi, thanks for taking the question. First off, have you made any changes to your 2019 hiring plans relative to what you're thinking last quarter?
Hi, Ken. This is Josh. No, I think we’re very much on track for – in accordance with the plan that we had set out at the beginning of the year. I think, if anything as we look into H2, we start to think about, you know, whether or not we want to, you know, do early hiring’s for next year. But we’re very much on the same strategy that we had set out at the beginning of the year.
Okay. Next question comes from Fatima Boolani with UBS.
Good morning. Thank you for taking the questions. I wanted to drill in on some of the sales hiring comments you just made. Last year, we saw a significant improvement in productivity from your sales force and that certainly translated into upside into your license performance and relative to last year I think that’s moderated. So, I wanted to better understand what type of productivity trends you're seeing as you ramped up on sales capacity hiring and you expect to ramp on sales capacity hiring? And secondarily, if you can give us some color on retention and/or attrition trends within the sales organization, especially as we think about Ron transitioning out of the organization? Thanks.
So, with regard to productivity, you know, we’ve had good productivity this year. I think as you can see from our nice growth year-on-year in each of the first two quarters. We continue to grow headcount across the entire organization, across sales and marketing. I believe it’s in the mid-teens, but if we were to look at the [quota carriers] actually we've increased them significantly more than that, so that's a big – that’s a lion share of what we've grown there. The sales and marketing organization is coming in quota carriers across both, you know, the commercial targets and also enterprise.
So – and that's really an anticipation of the fact that, you know, we see – you know we have to – we seek basically a sales ramp up of the quota carriers of six to nine months. And – so that's why we’re always ahead of the game for bringing quota carriers on, and, you know, we’re seeing good productivity from them this year. And as you said, it's kind of a continuation of what we saw last year. With regard to the question on Ron, whether or not you expect to see any change in the organization?
No. I mean, I think like I said earlier, we’re managing this as a best-in-class transition, and he’s with us through all the way into Q1. And so, we’re going to minimize any distractions here and I think we put a good plan in place to do that.
Next question comes from Dan Ives with Wedbush Securities.
Yes, thanks. So, my question is about some of the mid-market teams in both the U.S. and Europe, maybe just tell about some of the progress you are seeing there in terms of you minor installed base? Thanks.
It is a new process for us to have dedicated teams, one of the prime benefits is allowing the enterprise reps to really focus on the enterprise and I think we’re seeing good process and progress, it’s part – like you said it’s primarily in the Americas and in Western Europe, we’ve done that differentiation of dedicated teams. We will report more on it, but there’s opportunity there to continue to see low touch sales and reach out to the mid-market where we will be more sporadically reaching out to and doing more in methodical, in our book right now it’s on the right track, but still early.
Your next question comes from Taz Koujalgi with Guggenheim Partners.
Hi guys, thanks for taking my question. If I’m doing my math right, it looks like revenues in Americas were flat sequentially; usually they go up by quite a bit from Q1 to Q2. Can you comment on that?
First of all Americas revenues grew up 28% year-on-year, so we’re happy with type of growth rate and also happy with the fact that if you look at all other regions, we build as Udi said earlier, we really built the organization to be diversified and seeing EMEA growing 28% and APJ growing 41%, you know that really helps us be able to operate the business over the long term.
Typically, the sequential growth between the first and second quarter is not as strong, but the region is our most mature, it’s consistently delivered strong growth and overall when we also look at kind of dig down under the hood of the America sales, one of the things that I kind of alluded to briefly in the call is that we had a very strong EPM SaaS bookings and the majority of those bookings were in America. So, actually kind of if we were to of neutralized out selling a lot more SaaS in the quarter in the Americas relative to what we had seen a year ago, we probably would have seen more sequential growth.
Got it. Thanks. Just one follow-up. Last year you had a strong growth in Q4, I think you had one of the highest sequential growth from Q3 to Q4 last year and given that majority of your business comes from add on sales, you think that reflects in this year’s [indiscernible] Q3 to Q4, did you get a benefit from the fact that, you’ve a such big Q4 in 2018, those guys come back for renewals this year in Q4. Do we see that seasonality that you saw from Q3 to Q4 in 2018? Also, be a tailwind for your seasonality this year from Q3 to Q4?
Well, I mean, certainly, we do expect such sequential growth between Q3 and Q4, which we typically have seen in years past and we do get certainly from bookings perspective, we get a lot more, we get growth on the [mentioned] renewal contracts from licenses that were booked in prior Q4s as well, but overall you are right. At this point, we feel good about the rest of the year and hence our guidance for Q3 and for the full year and I think part of Q4 is also what’s going on with regard to the budget flush environment as well, and especially in our space of enterprise software, so, but we feeling like we are in a good position to meet our goals there.
Your next question comes from Shebly Seyrafi with SBM Securities.
Yes. So, your maintenance gross margin appears to have declined sequentially in year-to-year, I haven’t seen that in a while, you did grow that metric by 5 percentage points in 2018 to 75%, but now it’s down to 74.4%, I realized in the past you said that as SaaS grows that line item will decline. Is the ramp of our Alero impacting this or do you expect that to continue to decline?
Actually, I would say, the, kind of the small step down that you saw in this quarter would be more related to the professional services side. You saw we actually had a nice growth and professional services, which also meant that we use some more subcontractors in that in order to provide those professional services, and that’s what could move the needle there by that 0.5% that you noted. So, that’s where on the support and maintenance piece, specifically. It would not be related to Alero. Certainly, not at this point and that would be related more to when we think – right now about the cost of goods on the licenses line as supposed to the services line?
Next question comes from Shaul Eyal with Oppenheimer.
Hi. Congrats on the quarter. Just one quick question on the security breaches that you mentioned on the [back of signs]. Have you seen that translate to, I guess better sales tailwind in the pipeline, due to the record signs you have seen at Capital One et cetera?
Hello Eyal. I think it’s been very recent. I mean the publications are around the finds and Equifax and British Airways and Marriott and others have been recent, but it did come out when we had a lot of interaction with a lot of customers at our Chicago impact event, and you can see that it is becoming another factor in their thought process. So, I wouldn't say it supported sales in retro look, and I wouldn't say, that it’s like a mega tailwind, but it’s adding additional teeth to the regulatory element, which has always been another driver for our business.
So, our biggest one is of course reducing the risk. Digital transformation is a big driver, and compliance was always a driver, but now compliance comes with hefty fines and has teeth to it. And so, it is going to be top of mind of [indiscernible] and that has been our first impression from customer interaction since those publications.
And just one follow-up Udi. In terms of the CCTA regulation, has customers been asking about CyberArk's products in relation to that? I know it’s not active until next year, but have you seen things through the channel from the angle?
Yes. That’s a point, it’s – customers speak about it as a given, as something they have to deal with just like we, just like GDPR has become a given. They are talking about it as something that they will have to live with. Some they can approach that if they comply with GDPR, the will or they aim for GDPR, and therefore comply with the California regulations, but back to the previous point that’s going to be another tailwind, and we believe privilege is just foundational to ever looking anybody in the eye and saying we were securing our critical asset and private information.
Your next question comes from [indiscernible].
Hi, guys. Thanks for taking my questions. So, I appreciate the digital transformation driver, could you possibly, just speak directionally maybe on how much of the success in the quarter was due to customers actually using the solutions to secure more of those modern IT infrastructure uses, you’ve been speaking to relative to maybe just continuing to spend on securing credentials associated with more of the traditional assets that’s been driving growth in the past?
Yes. It continues to be both. I think one data point is the adoption of our Application Access Manager, which as I mentioned was in more than half of the top 10 deals and that’s usually a direct connection to digital transformation, but as we talk to our teams and our deployment teams, basically in every single account, and in part of what they're trying to do in the privileged access security program there is a connection to digital transformation. So, it could be their RPA, the Robotic Process Automation. It could be, we need to secure these administrators of our cloud server.
So, it’s becoming hard to actually disconnect it. It’s in every sale motion, and the customer then prioritizes. Very often they do want to prioritize with locking down domain controllers and critical infrastructure and user access to that, but in other phases of the program, we tie in to their digital transformation. Sometimes it is the landing point of, okay, now is the opportunity we want to get this infrastructure right because we’re doing the lifted shift or moving applications.
That was very helpful. Thanks, and then just a quick follow-up. Of the existing customer revenue in the quarter, would you classify it more as customers moving towards that enterprise-wide strategy or are we still seeing tactical deployments whenever it’s necessary?
Of the new deals in the quarter or are you asking …?
Customer revenue.
The existing customers, it’s been now more years of us pushing what we call the CyberArk hygiene program where we take a programmatic approach. So, you can attach most of the add-on business to most – to customers going through and taking off pieces that they want to take or accomplish on the program. You still have, of course customers that have taken more tactical approach, but I think it’s really working and we had a chance to really test that and touch that in the customer events.
There are no more questions at this time. I will now turn the call back over to Udi Mokady.
Thank you. Thank you everyone. In closing, I would like to thank our customers, partners, and employees, our dear employees for contributing to our strong second quarter results. Thank you. Thanks everyone.
Thank you again for your participation. This concludes today's conference call. You may now disconnect.