Summary
SUMMARYThis summary highlights selected information contained elsewhere in this prospectus. This summary does not contain all the information that you should consider before deciding to invest in our ordinary shares. You should read the entire prospectus carefully, including “Risk Factors” and our consolidated financial statements and notes to those consolidated financial statements, before making an investment decision. In this prospectus, the terms “CyberArk,” “we,” “us,” “our” and “the Company” refer to Cyber-Ark Software Ltd. and its subsidiaries.
We are a global leader and pioneer of a new layer of IT security solutions that protects organizations from cyber attacks that have made their way inside the network perimeter to strike at the heart of the enterprise. Our software solution is focused on protecting privileged accounts, which have become a critical target in the lifecycle of today’s cyber attacks. Privileged accounts are pervasive and act as the “keys to the IT kingdom,” providing complete access to, and control of, all parts of IT infrastructure, industrial control systems and critical business data. In the hands of an external attacker or malicious insider, privileged accounts allow attackers to take control of and disrupt an organization’s IT and industrial control infrastructures, steal confidential information and commit financial fraud. Our comprehensive solution proactively protects privileged accounts, monitors privileged activity and detects malicious privileged behavior. Our customers use our innovative solution to introduce this new security layer to protect against, detect and respond to cyber attacks before they strike vital systems and compromise sensitive data.
Organizations worldwide are experiencing an unprecedented increase in the sophistication, scale and frequency of cyber attacks. The challenge this presents is intensified by the growing adoption of new technologies, such as cloud computing, virtualization, software-defined networking, enterprise mobility and social networking, which has resulted in increasingly complex and distributed IT environments with significantly larger attack surfaces. Organizations have historically relied upon perimeter-based threat protection solutions such as network, web and endpoint security tools as the predominant defense against cyber attacks, yet these traditional solutions have a limited ability to stop today’s advanced threats. As a result, an estimated 90% of organizations have suffered a cybersecurity breach according to a 2011 survey of approximately 580 U.S. IT practitioners by the Ponemon Institute, a research center focused on privacy, data protection and information security policy. Organizations are just beginning to adapt their security strategies to address this new threat environment and are evolving their approaches based on the assumption that their network perimeter has been or will be breached. They are therefore increasingly implementing new layers of security inside the network to disrupt attacks before they result in the theft of confidential information or other serious damage. Regulators are also continuing to mandate rigorous new compliance standards and audit requirements in response to this evolving threat landscape.
We believe that the implementation of a privileged account security solution is one of the most critical layers of an effective security strategy. Privileged accounts represent one of the most vulnerable aspects of an organization’s IT infrastructure. Privileged accounts are used by system administrators, third-party and cloud service providers, applications and business users, and they exist in nearly every connected device, server, hypervisor, operating system, database, application and industrial control system. Due to the broad access and control they provide, exploiting privileged accounts has become a critical stage of the cyber attack lifecycle. The typical cyber attack involves attackers effecting an initial breach, escalating privileges to access target systems, moving laterally through the IT infrastructure to identify valuable targets, and exfiltrating, or stealing, the desired information. According to Mandiant, credentials of authorized users were hijacked in 100% of the breaches that Mandiant investigated, and privileged accounts were targeted whenever possible.
We have architected our solution from the ground up to address the challenges of protecting privileged accounts and an organization’s sensitive information. Our solution provides proactive protection against cyber attacks from both external and internal sources and allows for real-time detection and neutralization of such threats. It can be deployed in traditional on-premise data centers, cloud environments and industrial control systems. Our innovative software solution is the result of over 10 years of research and expertise, combined with valuable knowledge we have gained from working with our diverse population of customers.
Our Privileged Account Security Solution is built on our shared technology platform and consists of several products:
As of March 31, 2014, we had nearly 1,500 customers, including over 30% of the Fortune 100 and approximately 15% of the Global 2000. We define a customer to include a distinct entity, division or business unit of a company. Our customers include leading enterprises in a diverse set of industries, including energy and utilities, financial services, healthcare, manufacturing, retail, technology and telecommunications, as well as government agencies. We sell our solution through a high touch, channel fulfilled hybrid sales model that combines the leverage of channel sales with the account control of direct sales, and therefore provides us with significant opportunities to grow our current customer base. This approach allows us to maintain close relationships with our customers and benefit from the global reach of our channel partners. Additionally, we are enhancing our product offerings and go-to-market strategy by establishing technology alliances within the IT infrastructure and security vendor ecosystem.
Our business has rapidly grown in recent years. During 2011, 2012 and 2013, our revenues were $36.4 million, $47.2 million and $66.2 million, respectively, representing year-over-year growth of 29.8% and 40.1%, in 2012 and 2013, respectively. Our net income for 2011, 2012 and 2013 was $5.9 million, $7.9 million and $6.6 million, respectively. For the three months ended March 31, 2013 and 2014, our revenues were $12.7 million and $17.4 million, respectively. Our net income for the three months ended March 31, 2013 was $0.1 million compared with a net loss of $1.2 million for the same period in 2014.
The recent increase in sophisticated, targeted security threats by both external attackers and malicious insiders, along with an increase in the attack surface due to the growing complexity and distributed nature of IT environments, have made it extremely challenging for enterprises and governments around the world to protect their sensitive information. These challenges are driving the need for a new layer of security that complements traditional threat protection technologies by securing access to privileged accounts and preventing the exploitation of organizations’ critical systems and data.
Privileged accounts represent one of the most vulnerable aspects of an organization’s IT infrastructure. Privileged escalation is a critical stage of the cyber attack because, if privileged credentials are compromised, the attacker is able to move closer to sensitive data while remaining undetected. Today’s advanced cyber attacks are typically designed to evade traditional threat prevention technologies that are focused on protecting the perimeter from outside breach. Furthermore, compliance requirements continue to become more stringent in response to the complex and evolving threat landscape.
The increasing sophistication, scale and frequency of advanced cyber attacks challenge traditional cybersecurity methods and create a need for a comprehensive approach to securing privileged accounts from use by external or internal attackers to gain access to and exploit an organization’s confidential data and IT systems. Such an approach must address a range of challenges presented by privileged accounts, including:
Our Privileged Account Security Solution provides organizations with the following benefits:
We believe that the security market is in the midst of a significant transition as enterprises are investing in a new generation of security solutions to help protect them against today’s sophisticated and targeted cyber threats from both external attackers and malicious insiders. Gartner estimates that by 2020, 60% of enterprise information security budgets will be allocated to rapid detection and response approaches, up from less than 10% in 2014. Recognizing that traditional perimeter-based threat protection solutions are not sufficient to protect against today’s advanced cyber threats, enterprises are investing in security solutions within the datacenter to protect the inside of their networks. According to a 2012 report by International Data Corporation (IDC), worldwide spending on datacenter security solutions was $10.7 billion in 2011 and is expected to grow to $16.5 billion by 2016, representing a compound annual growth rate of 9.3%. According to the same report, worldwide spending for IT security solutions was $28.4 billion in 2011 and is expected to grow to $40.8 billion in 2016, representing a compound annual growth rate of 7.6%.
We believe that privileged account security is a new, critical layer of security that is benefitting from this transition. Privileged accounts represent one of the most vulnerable aspects of an organization’s IT infrastructure and exist in nearly every connected device, server, hypervisor, operating system, database, application and industrial control system throughout on-premise and cloud-based datacenters. As a result, we believe that an increasing portion of the IT security budget, and specifically datacenter security spend, will be allocated for privileged account security solutions.
Our mission is to protect the heart of the enterprise from advanced cyber attacks. We have established a leadership position in protecting high-value data and critical IT assets by securing privileged accounts, and have several key competitive strengths including:
Our goal is to be the global leader in IT security solutions that protect organizations from cyber attacks that have made their way inside the network perimeter to strike at the heart of the enterprise. The key elements of our strategy to extend our global leadership include:
Investing in our ordinary shares involves risks. You should carefully consider the risks described in “Risk Factors” beginning on page 12 before making a decision to invest in our ordinary shares. If any of these risks actually occur, our business, financial condition or results of operations would likely be materially adversely affected. In such case, the trading price of our ordinary shares would likely decline, and you may lose all or part of your investment. The following is a summary of some of the principal risks we face:
We are incorporated under the laws of the State of Israel. Our principal executive offices are located at 94 Em-Ha’moshavot Road, Park Azorim, P.O. Box 3143, Petach Tikva 4970602, Israel, and our telephone number is +972 (3) 918-0000. Our website address is www.cyberark.com. Information contained on, or that can be accessed through, our website does not constitute a part of this prospectus and is not incorporated by reference herein. We have included our website address in this prospectus solely for informational purposes. Our agent for service of process in the United States is Cyber-Ark Software, Inc., located at 60 Wells Avenue, Suite 103, Newton, MA 02459, and our telephone number is (617) 965-1544.
Throughout this prospectus, we refer to various trademarks, service marks and trade names that we use in our business. The “CyberArk” design logo is the property of Cyber-Ark Software Ltd. CyberArk® is our registered trademark in the United States. We have several other trademarks, service marks and pending applications relating to our products. In particular, although we have omitted the “®” and “™” trademark designations in this prospectus from each reference to Cyber-Ark DNA, Inter-Business Vault, Network Vault, Password Vault, Privileged Session Manager and Vaulting Technology, all rights to such trademarks are nevertheless reserved. Other trademarks and service marks appearing in this prospectus are the property of their respective holders.
The number of ordinary shares to be outstanding after this offering is based on 24,193,711 ordinary shares outstanding as of March 31, 2014 assuming the conversion of all outstanding preferred shares and warrants to purchase Series B3 preferred shares as of that date. The number of ordinary shares to be outstanding after this offering excludes (1) 4,596,487 ordinary shares reserved for issuance under our share option plans as of March 31, 2014, of which there were outstanding options to purchase 4,446,670 shares at a weighted average exercise price of $1.51 per share, and (2) 15,000 ordinary shares underlying warrants issued to an Israeli non-profit organization with an exercise price of $2.21 per share.
Unless otherwise indicated, this prospectus:
The following tables set forth our summary consolidated financial data. You should read the following summary consolidated financial and other data in conjunction with “Selected Consolidated Financial Data,” “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and related notes included elsewhere in this prospectus. Historical results are not necessarily indicative of the results that may be expected in the future. Our financial statements have been prepared in accordance with U.S. Generally Accepted Accounting Principles, or U.S. GAAP.
The summary consolidated statements of operations data for each of the years in the three-year period ended December 31, 2013 is derived from our audited consolidated financial statements appearing elsewhere in this prospectus. The summary consolidated statement of operations data for the three months ended March 31, 2013 and 2014 and the summary balance sheet data as of March 31, 2014 are derived from our unaudited interim consolidated financial statements presented elsewhere in this prospectus. In the opinion of management, these unaudited interim consolidated financial statements include all adjustments, consisting of normal recurring adjustments, necessary for a fair statement of our financial position and operating results for these periods. Results for interim periods are not necessarily indicative of the results that may be expected for the entire year.
available valuation methodologies, subjective assumptions and the variety of equity instruments that can impact a company’s non-cash expense, we believe that providing non-GAAP financial measures that exclude non-cash share-based compensation expense allows for more meaningful comparisons between our operating results from period to period. In addition, we believe that excluding financial expenses with respect to revaluation of warrants to purchase preferred shares allows for more meaningful comparison between our net income from period to period, as following this offering, the warrants will be exercised and, as a result, will no longer be revalued at each balance sheet date. Each of our non-GAAP financial measures is an important tool for financial and operational decision making and for evaluating our operating results over different periods of time. The following tables reconcile operating income and net income, the most directly comparable U.S. GAAP measure, to non-GAAP operating income and non-GAAP net income for the periods presented:For a description of how we use non-GAAP operating income and non-GAAP net income to evaluate our business, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Key Financial Metrics.” We believe that these non-GAAP financial measures are useful in evaluating our business because of varying available valuation methodologies, subjective assumptions and the variety of equity instruments that can impact a company’s non-cash expenses, and we believe that providing non-GAAP operating income and non-GAAP net income that exclude share-based compensation expenses and warrant awards allows for more meaningful comparisons between our operating results from period to period.
Other companies, including companies in our industry, may calculate non-GAAP operating and non-GAAP net income differently or not at all, which reduces their usefulness as a comparative measure. You should consider non-GAAP operating income and non-GAAP net income along with other financial performance measures, including operating income and net income, and our financial results presented in accordance with U.S. GAAP.