CyberArk Announces Strong First Quarter 2025 Results

Total ARR Reaches $1.215 billion

Subscription Portion of Annual Recurring Revenue (ARR) Reaches $1.028 billion

Total Revenue of $318 million for the First Quarter of 2025

Free Cash Flow of $96 million, or a 30% FCF margin, for the First Quarter of 2025

CyberArk (NASDAQ: CYBR), the global leader in identity security, today announced strong financial results for the first quarter ended March 31, 2025.

"CyberArk delivered a strong start to 2025, highlighting the power of our unified platform and the durability of our business model," said Matt Cohen, Chief Executive Officer of CyberArk. "In Q1, total ARR reached $1.215 billion, driven by robust net new ARR of $46 million. Our consistent execution and ongoing innovation fueled strong top-line growth, while we continue to scale profitably — achieving an 18% non-GAAP operating margin and generating $96 million in free cash flow."

"Our first quarter performance shows we continue to operate in a resilient demand environment. Identity security is a top priority for organizations, and customers are accelerating their roadmaps while consolidating spend on CyberArk's platform to drive security outcomes and operational efficiency. We are particularly pleased with the success of our machine identity business, with strong contributions from both Venafi and our Secrets Management solutions, showing we are delivering transformational value across all types of identities."

"We're living in an exponential era: threats are accelerating, and the number of identities and privileges is multiplying across every enterprise. Human privileges have proliferated beyond traditional roles, machine identities now outnumber humans by more than 80-to-1, and AI agents are emerging as a new, rapidly growing identity group. These realities underscore why identity security is not optional — it's foundational. With the acquisition of Zilla Security and continued product innovation, CyberArk remains uniquely positioned as the only platform designed to discover, govern, provision, and enforce security controls across every identity — human, machine, and AI. With our first quarter performance, we are set up to deliver against our growth, profitability and free cash flow targets in 2025."

Financial Summary for the First Quarter Ended March 31, 2025

The financial results for the first quarter of 2025 include the financial contributions from the acquisition of Venafi, which closed on October 1, 2024, and the financial contributions from the acquisition of Zilla Security, which closed on February 12, 2025. The financial results in the comparable period in 2024 did not include any financial contribution from these acquisitions.

• Total revenue was $317.6 million in the first quarter of 2025, up 43 percent from $221.6 million in the first quarter of 2024.
• Subscription revenue was $250.6 million in the first quarter of 2025, an increase of 60 percent from $156.2 million in the first quarter of 2024.
• Maintenance, professional services and other revenue was $67.0 million in the first quarter of 2025, compared to $65.3 million in the first quarter of 2024.
• GAAP operating loss was $(20.7) million compared to GAAP operating loss of $(6.4) million in the same period last year. Non-GAAP operating income was $57.5 million, or 18 percent margin, compared to non-GAAP operating income of $33.0 million, or 15 percent margin, in the same period last year.
• GAAP net income was $11.5 million, or $0.22 per diluted share, compared to GAAP net income of $5.5 million, or $0.13 per diluted share, in the same period last year. Non-GAAP net income was $50.3 million, or $0.98 per diluted share, compared to non-GAAP net income of $35.9 million, or $0.75 per diluted share, in the same period last year.

Balance Sheet and Net Cash Provided by Operating Activities

• As of March 31, 2025, cash, cash equivalents, short-term deposits, and marketable securities were $776.1 million. The changes in CyberArk's cash balance reflect approximately $165 million in cash paid for the acquisition of Zilla Security.
• During the three months ended March 31, 2025, the Company's net cash provided by operating activities was $98.5 million, compared to $68.6 million in the three months ended March 31, 2024.

Key Business Highlights

• Annual Recurring Revenue (ARR) was $1.215 billion, an increase of 50 percent from $811 million at March 31, 2024.
  • The Subscription portion of ARR was $1.028 billion, or 85 percent of total ARR at March 31, 2025. This represents an increase of 65 percent from $621 million, or 77 percent of total ARR, at March 31, 2024.
  • The Maintenance portion of ARR was $188 million at March 31, 2025, compared to $190 million at March 31, 2024.
• Recurring revenue in the first quarter of 2025 was $298.2 million, an increase of 45 percent from $205.8 million for the first quarter of 2024.

Recent Developments

• CyberArk Announced the Acquisition of Zilla Security, a Leader in modern Identity Governance and Administration (IGA) Solutions.
• CyberArk Announces Identity Security Solution to Secure AI Agents At Scale.
• CyberArk Unveils First-Of-Its-Kind Machine Identity Security Solution To Secure Workloads Across Every Environment.
• CyberArk Bolsters Identity Security Platform with New Capabilities for Human, AI and Machine Identities.
• CyberArk Strengthens Identity Security for AI Agents with Accenture's AI Refinery.
• CyberArk Released its 2025 Identity Security Landscape Report, showing the Exponential Threats of Fragmented Identity Security.
• CyberArk Released its 2025 State of Machine Identity Security Report, showing Rapid Growth of Machine Identities, AI Adoption and Cloud Native Innovations Leave Organizations More Vulnerable to Attacks.
• CyberArk named an Overall Leader in the KuppingerCole Analysts 2025 Leadership Compass for Enterprise Secrets Management.⁽²⁾

⁽²⁾KuppingerCole Analysts "2025 Leadership Compass for Enterprise Secrets Management," by Martin Kuppinger, April 28, 2025.

Business Outlook

Based on information available as of May 13, 2025, CyberArk is issuing guidance for the second quarter and full year 2025 as indicated below. The guidance for the second quarter and full year 2025 includes the expected contribution from the acquisition of Venafi, which closed on October 1, 2024 and the acquisition of Zilla Security, which closed on February 12, 2025. The comparable periods in 2024 did not include financial contributions from the acquisitions of Venafi and Zilla Security.

Second Quarter 2025:

• Total revenue is expected to be in the range of $312.0 million and $318.0 million.
• Non-GAAP operating income is expected to be in the range of $41.5 million to $46.5 million.
• Non-GAAP net income per share is expected to be in the range of $0.74 to $0.81 per diluted share.
  • Assumes 51.5 million weighted average diluted shares.

Full Year 2025:

• Total revenue is expected to be in the range of $1.313 billion to $1.323 billion, representing growth of 31 percent to 32 percent compared to the full year 2024.
• Non-GAAP operating income is expected to be in the range of $221.0 million to $229.0 million.
• Non-GAAP net income per share is expected to be in the range of $3.73 to $3.85 per diluted share.
  • Assumes 51.6 million weighted average diluted shares.
• ARR as of December 31, 2025 is expected to be in the range of $1.410 billion to $1.420 billion, representing growth of 21 percent from December 31, 2024.
• Adjusted free cash flow is expected to be in the range of $300.0 million to $310.0 million for the full year 2025. Adjusted free cash flow guidance normalizes for a one-time tax payment of $42 million and approximately $15 million in capital expenditures related to our new U.S. headquarters, both of which are discussed below.

Tax Payment Related to Transfer of Venafi IP

CyberArk's forward-looking guidance for adjusted free cash flow for the full year 2025 excludes the estimated impact of an approximately $42 million one-time tax payment related to the capital gain associated with the intercompany migration of intellectual property related to the Venafi acquisition. We expect this to occur in the second quarter of 2025.

This estimated tax payment represents our best estimate of the tax payment related to the IP transfer based on current assumptions and information available. The final tax liability will ultimately be dependent on and could be affected by a number of factors including, but not limited to, deductions based on our stock price, income recognition and/or deductibility of deferred items, eligibility to and utilization of tax credits and other tax deductions, and intercompany payments in the fiscal year 2025.

Capital Expenditures Related to our New U.S. Headquarters

CyberArk's forward-looking guidance for adjusted free cash flow for the full year 2025 excludes the estimated capital expenditures of approximately $15 million related to leasehold improvements to our new U.S. headquarters.

New Presentation of Revenue Line Items

Beginning in the first quarter of 2025, CyberArk is revising the presentation of its lines of revenue and cost of revenue by combining the revenues and cost of revenues previously reported under the "Perpetual license" line and "Maintenance and Professional Services" line under the "Maintenance, Professional Services and Other" line. The Company believes this presentation of revenue and cost of revenue on the consolidated statement of operations aligns with how management evaluates the business. Historical information by quarter for fiscal years 2023 and 2024, which has been retroactively reclassified to reflect the new lines of revenue and cost of revenue, can be found in the PowerPoint presentation posted to CyberArk's investor relations website.

Conference Call Information

In conjunction with this announcement, CyberArk will host a conference call on Tuesday, May 13, 2025 at 8:30 a.m. Eastern Time (ET) to discuss the company's first quarter financial results and its business outlook. To access this call, dial +1 (888) 330-2455 (U.S.) or +1 (240) 789-2717 (international). The conference ID is 6515982. Additionally, a live webcast of the conference call will be available via the "Investor Relations" section of the company's website at www.cyberark.com.

Following the conference call, a replay will be available for one week at +1 (800) 770-2030 (U.S.) or +1 (609) 800-9909 (international). The replay pass code is 6515982. An archived webcast of the conference call will also be available in the "Investor Relations" section of the company's website at www.cyberark.com.

About CyberArk

CyberArk (NASDAQ: CYBR) is the global leader in identity security, trusted by organizations around the world to secure human and machine identities in the modern enterprise. CyberArk's AI-powered Identity Security Platform applies intelligent privilege controls to every identity with continuous threat prevention, detection and response across the identity lifecycle. With CyberArk, organizations can reduce operational and security risks by enabling zero trust and least privilege with complete visibility, empowering all users and identities, including workforce, IT, developers and machines, to securely access any resource, located anywhere, from everywhere. Learn more at cyberark.com.

Copyright © 2025 CyberArk Software. All Rights Reserved. All other brand names, product names, or trademarks belong to their respective holders.

Key Performance Indicators and Non-GAAP Financial Measures

Recurring Revenue

• Recurring Revenue is defined as revenue derived from SaaS and self-hosted subscription contracts, and maintenance contracts related to perpetual licenses during the reported period.

Annual Recurring Revenue (ARR)

• ARR is defined as the annualized value of active SaaS, self-hosted subscriptions and their associated maintenance and support services, and maintenance contracts related to the perpetual licenses in effect at the end of the reported period.

Subscription Portion of Annual Recurring Revenue

• Subscription portion of ARR is defined as the annualized value of active SaaS and self-hosted subscription contracts in effect at the end of the reported period. The subscription portion of ARR excludes maintenance contracts related to perpetual licenses.

Maintenance Portion of Annual Recurring Revenue

• Maintenance portion of ARR is defined as the annualized value of active maintenance contracts related to perpetual licenses. The Maintenance portion of ARR excludes SaaS and self-hosted subscription contracts in effect at the end of the reported period.

Net New ARR

• Net new ARR refers to the difference between ARR as of March 31, 2025 and ARR as of December 31, 2024.

Annual Recurring Revenue (ARR), Subscription portion of ARR and Maintenance portion of ARR are performance indicators that provide more visibility into the growth of our recurring business in the upcoming year. This visibility allows us to make informed decisions about our capital allocation and level of investment. Each of these measures should be viewed independently of revenues and total deferred revenue as each is an operating measure and is not intended to be combined with or to replace either of those measures. ARR, Subscription portion of ARR and Maintenance portion of ARR are not forecasts of future revenues and can be impacted by contract start and end dates and renewal rates.

Non-GAAP Financial Measures

CyberArk believes that the use of non-GAAP gross profit, non-GAAP operating expense, non-GAAP operating income, non-GAAP net income, free cash flow and adjusted free cash flow is helpful to our investors. These financial measures are not measures of the Company's financial performance under U.S. GAAP and should not be considered as alternatives to gross profit, operating loss, net income or net cash provided by operating activities or any other performance measures derived in accordance with GAAP.

• Non-GAAP gross profit is calculated as GAAP gross profit excluding share-based compensation expense, and amortization of intangible assets related to acquisitions.
• Non-GAAP operating expense is calculated as GAAP operating expenses excluding share-based compensation expense, acquisition related expenses, and amortization of intangible assets related to acquisitions.
• Non-GAAP operating income is calculated as GAAP operating loss excluding share-based compensation expense, acquisition related expenses, and amortization of intangible assets related to acquisitions.
• Non-GAAP net income is calculated as GAAP net income excluding share-based compensation expense, acquisition related expenses, amortization of intangible assets related to acquisitions, amortization of debt discount and issuance costs and tax adjustments.
• Free cash flow is calculated as net cash provided by operating activities less purchase of property and equipment and other assets, and capitalized internal-use software.
• Adjusted free cash flow is calculated as free cash flow plus one-time tax payment on the capital gain from the intercompany migration of intellectual property (IP) related to the Venafi acquisition and capital expenditures related to our new U.S. headquarters.

The Company believes that providing non-GAAP financial measures that are adjusted by, as applicable, share-based compensation expense, acquisition related expenses, amortization of intangible assets related to acquisitions, amortization of debt discount and issuance cost, tax adjustments, purchase of property and equipment and other assets, capitalized internal-use software, one-time tax payment on the capital gain from the intercompany migration of intellectual property, and capital expenditures related to our new U.S. headquarters allows for more meaningful comparisons of its period to period operating results. Share-based compensation expense has been, and will continue to be for the foreseeable future, a significant recurring expense in the Company's business and an important part of the compensation provided to its employees. Share-based compensation expense has varying available valuation methodologies, subjective assumptions and a variety of equity instruments that can impact a company's non-cash expense. The Company believes that expenses related to its acquisitions, amortization of intangible assets related to acquisitions, and amortization of debt discount and issuance costs do not reflect the performance of its core business and impact period-to-period comparability. The Company believes free cash flow and adjusted free cash flow are liquidity measures that, after the purchase of property and equipment and other assets, capitalized internal-use software, one-time tax payment on the capital gain from the intercompany migration of intellectual property, and capital expenditures related to our new U.S. headquarters provide useful information about the amount of cash generated by the business.

Non-GAAP financial measures may not provide information that is directly comparable to that provided by other companies in the Company's industry, as other companies in the industry may calculate non-GAAP financial results differently, particularly related to non-recurring, unusual items. In addition, there are limitations in using non-GAAP financial measures as they exclude expenses that may have a material impact on the Company's reported financial results. The presentation of non-GAAP financial information is not meant to be considered in isolation or as a substitute for the directly comparable financial measures prepared in accordance with U.S. GAAP. CyberArk urges investors to review the reconciliation of its non-GAAP financial measures to the comparable U.S. GAAP financial measures included below, and not to rely on any single financial measure to evaluate its business.

Beginning in the first quarter of 2025, we will utilize a fixed projected non-GAAP tax rate when calculating non-GAAP financial measures to provide better consistency across interim reporting periods. In projecting this rate, we exclude the effects of certain non-recurring items, which do not necessarily reflect our normal operations, and the direct income tax effects of other non-GAAP adjustments. The fixed projected non-GAAP tax rate is based on annual financial projections and reflects our evaluation of historical and projected geographic earnings mix within our operating structure, recurring tax credits, existing tax positions in various jurisdictions and current impacts from key legislation. Based on these considerations, we applied a fixed projected non-GAAP tax rate for 2025 of 24%. We will provide updates to this rate on an annual basis, or more frequently, if significant events have a material impact on the rate. The rate could be subject to change for a variety of reasons, such as significant changes in the geographic earnings mix, relevant tax law changes in major jurisdictions where we operate, or significant acquisitions.

Guidance for non-GAAP financial measures excludes, as applicable, share-based compensation expense, acquisition related expenses, amortization of intangible assets related to acquisitions, tax adjustments, purchase of property and equipment and other assets, one-time tax payment on the capital gain from the intercompany migration of intellectual property, and capital expenditures related to our new U.S. headquarters. A reconciliation of the non-GAAP financial measures guidance to the corresponding GAAP measures is not available on a forward-looking basis due to the uncertainty regarding, and the potential variability and significance of, the amounts of share-based compensation expense, amortization of intangible assets related to acquisitions, and the non-recurring expenses that are excluded from the guidance, as well as changes in interest rates and foreign exchange rates, which impact other GAAP performance metrics or liquidity measures. Accordingly, a reconciliation of the non-GAAP financial measures guidance to the corresponding GAAP measures for future periods is not available without unreasonable effort.

Cautionary Language Concerning Forward-Looking Statements

This release contains forward-looking statements, which express the current beliefs and expectations of CyberArk's (the "Company") management. In some cases, forward-looking statements may be identified by terminology such as "believe," "may," "estimate," "continue," "anticipate," "intend," "should," "plan," "expect," "predict," "potential" or the negative of these terms or other similar expressions. Such statements involve a number of known and unknown risks and uncertainties that could cause the Company's future results, levels of activity, performance or achievements to differ materially from the results, levels of activity, performance or achievements expressed or implied by such forward-looking statements. Important factors that could cause or contribute to such differences include, but are not limited to: risks related to the Company's acquisitions of Venafi Holdings, Inc. ("Venafi") and Zilla Security Inc. ("Zilla"), including potential impacts on operating results; challenges in retaining and hiring key personnel and maintaining Venafi and Zilla business; risks related to the successful integration of the operations of Venafi or Zilla and the ability to realize anticipated benefits of the combined operations; the rapidly evolving security market, increasingly changing cyber threat landscape and the Company's ability to adapt its solutions to the information security market changes and demands; the Company's ability to acquire new customers and maintain and expand its revenues from existing customers; real or perceived security vulnerabilities and gaps in the Company's solutions or services or the failure of customers or third parties to correctly implement, manage and maintain solutions; the Company's IT network systems, or those of third-party providers, may be compromised by cyberattacks or other security incidents, or by a critical system disruption or failure; intense competition within the information security market; failure to fully execute, integrate, or realize the benefits expected from strategic alliances, partnerships, and acquisitions; the Company's ability to effectively execute its sales and marketing strategies, and expand, train and retain its sales personnel; risks related to the Company's compliance with privacy, data protection and AI laws and regulations; the Company's ability to hire, upskill, retain and motivate qualified personnel; risks related to the integration of AI technology into our operations and solutions; reliance on third-party cloud providers for the Company's operations and software-as-a-service (SaaS) solutions; the Company's ability to maintain successful relationships with channel partners, or if channel partners fail to perform; fluctuation in the Company's quarterly results of operations; risks related to sales made to government entities; economic uncertainties or downturns; the Company's history of incurring net losses, its ability to generate sufficient revenue to achieve and sustain profitability and its ability to generate cash flow from operating activities; regulatory and geopolitical risks associated with the Company's global sales and operations; risks related to intellectual property; fluctuations in currency exchange rates; the ability of the Company's solutions to help customers achieve and maintain compliance with government regulations or industry standards; the Company's ability to protect its proprietary technology and intellectual property rights; risks related to using third-party software, such as open-source software and other intellectual property; risks related to share price volatility or activist shareholders; any failure to retain the Company's "foreign private issuer" status or the risk that the Company may be classified, for U.S. federal income tax purposes, as a "passive foreign investment company"; risks related to issuance of ordinary shares or securities convertible into ordinary shares and dilution, leading to a decline in the market value of the Company's ordinary shares; changes in tax laws; the Company's expectation to not pay dividends on its ordinary shares for the foreseeable future; risks related to the Company's incorporation and location in Israel, including wars and other hostilities in the Middle East; and other factors discussed under the heading "Risk Factors" in the Company's most recent annual report on Form 20-F filed with the Securities and Exchange Commission. Forward-looking statements in this release are made pursuant to the safe harbor provisions contained in the U.S. Private Securities Litigation Reform Act of 1995. These forward-looking statements are made only as of the date hereof, and the Company disclaims any obligation to update or revise the forward-looking statements, whether as a result of new information, future events or otherwise, except as required by applicable law.

View source version on businesswire.com: https://www.businesswire.com/news/home/20250513160762/en/

Investor Relations Contact:

Srinivas Anantha, CFA

CyberArk

617-558-2132

[email protected]

Media Contact:

Rachel Gardner

CyberArk

603-531-7229

[email protected]