CyberArk：仍然是一个便宜货

At a time when a lot of cybersecurity stocks are getting overpriced and overvalued, CyberArk (CYBR) remains one of the few undervalued names for investors to swap their frothy shares of expensive SaaS stocks. It offers a balance of growth, a healthy balance sheet, and offerings with a strong product-market fit in its niche privilege access space. Demand for cloud security solutions remains a strong tailwind, and I expect its valuation to keep expanding from here.

CyberArk remains one of the few cybersecurity plays that offer a decent balance of growth and value. While most investors don't care about value in the formative years of a SaaS business, I believe a SaaS business which can demonstrate value in the form of an identifiable competitive advantage, great management, healthy balance sheet and profitable P&L at a decent valuation shouldn't be passed up by investors.

I've been following CyberArk for the past three years. Initially, I was skeptical about its ability to sustain its growth narrative. Like other skeptics, I've been proven wrong after watching its market cap triple within the past 36 months.

Going forward, its clearer that CyberArk has a management team that can drive a successful go-to-market narrative to expand the TAM of its privilege identity space.

The narrative has always been about protecting privileged accounts and securing access to the most critical security devices and agents. CyberArk is one of the few plays that's been able to sell the importance of securing both the man and the machine. While most network security vendors focus on securing the networks and the devices within it, CyberArk's narrative is more about securing the agents that build the networks and operate the devices within it. In reality, if these agents are up to speed on the best security practices and policies, we won't have data breaches and data loss at the current rate we are experiencing.

To combat these, CyberArk has focused on tuning its marketing message to CISOs about the need to protect against sophisticated attacks like spear phishing, social engineering, and other attack vectors that play on the vulnerability of humans.

Putting myself in the shoes of a typical CISO, I 100 percent buy this narrative, and I don't doubt the reason not to convince my CEO to increase my security budget to accommodate privileged access solutions.

Given the growing volume of endpoints, apps, and privileged access solutions, CyberArk has recorded massive revenue growth. This was achieved by offering new products endpoint (endpoint privilege manager) and application access (application access manager) products in addition to its core revenue driver (core privileged access security).

The company has recently rolled out new sales initiatives to target the mid-market as the large enterprise market becomes saturated. This is reflected in its growing headcount. A serious concern for me is the recent loss of its global head of sales. According to management, the transition is going to be well managed.

we're managing this as a best-in-class transition, and he's with us through all the way into Q1. And so, we're going to minimize any distractions here and I think we put a good plan in place to do that.

Going forward, I expect CyberArk to continue to retain and win more security contracts with its privileged access playbook.

Valuation

Data by YCharts

At a market cap of $3.8 billion, 2019E revenue growth of 24%, and P/S ratio of 9.5, CyberArk remains a bargain compared to more frothy competitors. I see investors rotating out of these frothy names into cheaper plays like CyberArk. CyberArk has cash and short-term investment of $538 million with no debt on its balance sheet. Deferred revenue grew by 34% to $174 million last quarter. Cash flow from operations is positive at $21.5 million, while FCF stands at $19.2 million slightly offset by CAPEX of $0.9 million. CyberArk doesn't buy back its shares rather opting to invest its cash in marketable securities which generated cash flow of $12.2 million last quarter. My only concern is that CyberArk is getting into the matured phase as growth decelerates, which means investors will begin to care more about profitability metrics by focusing on ratios like its EV/EBITDA or EV/FCF. In that scenario, investors might be reluctant to buy CyberArk instead opting for other fast-growing cyber plays.

Management isn't guiding for unforeseen headwinds in the near term. Therefore, I don't see a reason why CyberArk's valuation won't stretch beyond the $3.8 billion market cap. Though, I'm getting the sense that the lack of near-term optimism might be driven by lack of management's willingness to diversify into other growth generating initiatives either organically or via more acquisitions. The company appears to be content with selling its privileged access solutions.

Conclusion

CyberArk is currently trading at a 30.5% discount to its average analysts' price target. The stock has one of the best gross margin and profitability ratios in the cybersecurity space. It is still growing in the double digits, and it isn't debt-laden. Though I would love to see management diversify a bit outside of its specialized niche.

Regardless, CyberArk remains a BUY, and I believe a market cap of $3.8 billion doesn't reflect the stock's full worth.

Disclosure:

I/we have no positions in any stocks mentioned, and no plans to initiate any positions within the next 72 hours.I wrote this article myself, and it expresses my own opinions. I am not receiving compensation for it (other than from Seeking Alpha). I have no business relationship with any company whose stock is mentioned in this article.