(CYBR)
Q3 2021 Earnings-Transcript
Erica Smith - Investor Relations
Udi Mokady - Founder, Chairman & Chief Executive Officer
Josh Siegel - Chief Financial Officer
Saket Kalia - Barclays - Analyst
Adam Borg - Stifel - Analyst
Hamza Fodderwala - Morgan Stanley - Analyst
Brian Essex - Goldman Sachs - Analyst
Jonathan Ho - William Blair - Analyst
Jonathan Ruykhaver - Baird - Analyst
Roger Boyd - UBS - Analyst
Gregg Moskowitz - Mizuho - Analyst
Rob Owens - Piper Sandler - Analyst
Ittai Kidron - Oppenheimer - Analyst
Catharine Trebnick - Colliers Securities - Analyst
Joshua Tilton - Wolfe Research - Analyst
Imtiaz Koujalgi - Guggenheim Securities - Analyst
Mike Cikos - Needham & Co. - Analyst
Operator
Hello, and welcome to the Q3 2021 CyberArk Software Limited Earnings Conference Call. [Operator Instructions] Thank you.
I would now like to turn the call over to Ms. Erica Smith. Please go ahead, ma'am.
Erica Smith - Investor Relations
Thank you, Lisa. Good morning. Thank you for joining us today to review CyberArk's third quarter 2021 financial results. With me on the call today are Udi Mokady, Chairman and Chief Executive Officer; and Josh Siegel, Chief Financial Officer. After prepared remarks, we will open the call up for a question-and-answer session.
Before we begin, let me remind you that certain statements made on the call today may be considered forward-looking statements, which reflects management's best judgment based on currently available information. I refer specifically to the discussion of our expectations and beliefs regarding our projected results of operations for the fourth quarter and the full year 2021. Our actual results might differ materially from those projected in these forward-looking statements. I direct your attention to the risk factors contained in the company's Annual Report on Form 20-F filed with the U.S. Securities and Exchange Commission, and those referenced in today's press release that are posted to CyberArk's website, as well as risks regarding our ability to actively transition the business to a subscription model, the duration and scope of the COVID-19 pandemic, its related impacts on global economies and our ability to adjust in response to the COVID-19 pandemic. CyberArk expressly disclaims any obligation or undertaking to release publicly any updates or revisions to any forward-looking statements.
Additionally, non-GAAP financial measures will be discussed on this conference call. Reconciliations to the most directly comparable GAAP financial measures are also available in today's press release, as well as in an updated investor presentation that outlines the financial discussion in today's call. We also want to remind you that we provide the calculated headwind calculation for additional color on the impact of our subscription bookings mix shift, but it should not be viewed as comparable to, or a substitute for reported GAAP revenues or other GAAP metrics. A webcast of today's call is also available on our website in the IR section.
With that, I'd like to turn the call over to our Chairman and Chief Executive Officer, Udi Mokady. Udi?
Udi Mokady - Founder, Chairman & Chief Executive Officer
Thanks, Erica. And thanks everyone for joining the call. Q3 was another amazing quarter and we are thrilled with our results. If I could use only one word to characterize this quarter, it would be acceleration; acceleration in the demand environment, in the underlying growth of the company, specifically bookings, and then the metrics that demonstrates the health of the business.
As examples, subscription ARR growth accelerated to 131%, reaching $139 million. Total ARR growth accelerated to 38% reaching $344 million. Recurring revenue growth accelerated to 41%, reaching $89 million. And new logos added during the quarter accelerated to over 230. Our standout performance in Q3 following an incredible second quarter was again driven by record SaaS bookings, record total bookings, the execution of our subscription transformation and robust demand for our Identity Security platform centered on Privileged Access Management.
Customers are embracing the subscription model as evidenced by 72% of new license bookings coming from SaaS and subscription in the third quarter, ahead of our guidance range. Even with the revenue headwinds from this mix, we generated total revenue of $122 million, above our midpoint, demonstrating again that our bookings were considerably higher than anticipated in our guidance. One way to think about the growth of the business is to isolate the license line adjusted for the calculated revenue headwind. This would represent license growth of faster than 50% year-over-year, which is indicative of our overall growth. Simply put, it was a stellar quarter.
As we've talked about throughout the year, our subscription mix, ARR and recurring revenue demonstrate the progress in the subscription transition and the strong demand for our SaaS solutions in particular. The four pillars of growth, subscription transition, innovation and profitability provide a great backdrop for today's discussion.
Let me start with the growth. I love starting here because our growth trajectory has never been stronger. Excellence in our execution and the strong secular tailwinds of digital transformation cloud migration as attacker innovation contributed to the acceleration in our business. With the acceleration in attacker innovation, our customers now contend with operator-driven ransomware [Indecipherable] as a service and attacks on automation in supply chains and the DevOps pipeline. It is no longer enough to have an assumed breach mindset. Instead, enterprises have to dig deeper and take an assumed identity posture. They recognize that every identity across human users, applications and bots can be privileged under certain conditions. It is easy to see why customer and prospect interest in our solutions is at an all-time high.
Looking at our geographies. We had another perfect game across our major territories. When you adjust for the calculated revenue headwind, every region grew total revenue by over 27%, with license revenue obviously growing even faster across the Americas, EMEA and APJ, which Josh will talk about more. New business accelerated and we added more than 230 marquee customers, as I mentioned, from law firms to software companies, oil and gas companies, to retailers, to large government agencies. We won customers across the spectrum, demonstrating that every organization, regardless of size or verticals, needs our Identity Security platform.
We typically land with PAM and momentum for Privilege Cloud continues to build, both in the mid-market and much deeper in the larger enterprise. In fact, in the third quarter, a Fortune 30 company signed our largest annual contract for Privilege Cloud ever; a great win that demonstrates the increased adoption we are seeing in our enterprise customer base.
With our subscription model resonating and SaaS taking off, customers are adding both more users and more products faster. And for customers with large self-hosted footprints, they are expanding with Privilege Cloud to secure new business units [Indecipherable] our pipelines or applications. Endpoint Privilege Manager or EPM had another record quarter as the crippling effects of ransomware continued to drive demand. Not only is EPM an expansion opportunity within our customer base, but it is also proving to be a great landing spot for new logos like large - a large food retailer, a born-in-the-cloud software company, and a large local school system, to just name a few of the Q3 wins.
The increased focus in the specialized resources from the Access and DevSecOps speedboats continues to pay off this quarter. Productivity levels increased in all regions and our cross-sell activity has improved considerably. Access had another strong growth quarter in Q3, with both exciting enterprise wins in our base and a broader set of customer wins in our commercial and emerging markets. I will talk more about our innovations in a few minutes, but Identity Security, where Access is tightly aligned with PAM, is differentiating CyberArk with customers.
I want to highlight a few more customer examples from the third quarter. In a highly competitive deal, an existing financial services customer wanted the benefits of our Identity Security platform and will be replacing a legacy Access solution with CyberArk Identity. A new financial services customer will be using Privilege Cloud and Conjur to secure secrets. This organization recognized that securing both human and non-human access was critical, particularly as every company becomes a de facto software company. Our ability to secure applications anywhere is giving us a nice competitive edge in the DevSecOps space. A high-profile pharmaceutical company, [Indecipherable], but more importantly, is committed to implementing a comprehensive Identity Security program and PAM is just the first step.
A large insurance company expanded with every one of our solutions. They began their journey with CyberArk in 2017 [Phonetic], expanding their Privileged Access program along the way. In Q3, they went deep and broad with CyberArk, embracing our Identity Security platform, buying Secrets Manager, Privilege Cloud, Remote Access, Endpoint, Workforce Identity and Cloud Entitlements Manager. We pride ourselves on our culture, building strong lasting relationships and putting the customer at the center of everything we do. This win demonstrates the power of our portfolio and it shows the criticality of our relationships with enterprise customers.
Our partner ecosystem is further extending our reach and driving scale in our go-to market. Our certification programs have been stepping up as we focus more and more on leveraging our partners to drive growth. Year-to-date, through Q3, we certified close to 20% more professionals than we did in the full year 2020. This commitment to invest in comprehensive training programs is a testament to the opportunity and significant growth our channel partners expect. A number of our partners are going even deeper into Identity Security and acquiring companies including the Herjavec Group and CDW making strategic acquisitions in our space.
Next, I would like to focus on the subscription transition. We made strong progress and outperformed our expectations in the third quarter. Our transition continues to be driven by strong demand for our SaaS solutions and we reached another new record for SaaS bookings with particular strength in Privilege Cloud and Endpoint Privilege Manager. We have completed three-fourth [Phonetic] of our active subscription transition and the number of customers with over $100,000 in ARR is now more than 760, growing faster than 40% year-over-year. As we expected when we began the subscription journey, customers are getting faster time to value and prioritizing our platform, which will result in higher lifetime value over time. We are thrilled with the progress of our subscription transitions and, with our success year-to-date, we are confident we will exit this transition by the third quarter of 2022.
Our innovation pillar is the foundation of our strategy. It continues to put more business between us and the competition and further strengthens our leadership position. We announced earlier this week, the general availability of Secure Web Sessions, a Workforce and Customer Identity solution. Secure Web Sessions merges the worlds of Access and PAM. We are now the only vendor in the market that can empower customers with continuous authentication and session protection, including session recording for all types of web applications, from business apps to cloud consoles.
We are pleased to see our innovation recognized by industry experts. We were named a leader in the Forrester Wave Identity-as-a-Service For Enterprise and an overall Privileged Access Management leader by KuppingerCole. And just yesterday, we announced that we were named the only visionary in the 2021 Magic Quadrant for Access Management. We believe we are the undisputed leader in PAM and are leveraging this position to extend our expertise into Access.
I will wrap up my discussion with some comments on the profitability pillar. As you've already seen from the acceleration in our business, our investments are paying off. The headwind on profitability from the subscription transition is obscuring the P&L. Given the strength of our bookings, which gives us more scale, and our track record of delivering profitable growth, we are well-positioned to return to strong profitability levels.
To sum up Q3 quickly, our business is accelerating on the back of record year-over-year bookings growth. SaaS is leading the way and reached a new record quarter this quarter. Privilege Cloud is pushing into the large enterprise and EPM has moved into the mainstream security discussion. Our subscription transition is making strong progress. Our industry-leading Identity Security platform across PAM, Access and DevSecOps has never been more relevant.
I will now turn the call over to Josh, who will discuss our financial results in more detail and provide you our outlook for the fourth quarter and full year 2021. Josh, over to you.
Josh Siegel - Chief Financial Officer
Thanks, Udi. Before we discuss the details of the quarter, we would like to remind you that we posted slides to the website that will be helpful as we walk through our results.
As Udi mentioned, we had a great third quarter. Our license bookings growth meaningfully accelerated even in comparison to a strong Q2 of 2021. We also made significant progress, executing both our subscription transition and our Identity Security strategy. In terms of the headline P&L, we delivered total revenue of $121.6 million with a 72% mix of subscription bookings ahead of our guidance framework of a 70% mix. As you may remember from last quarter, revenue above the midpoint of our guidance and a higher subscription bookings mix demonstrates that our total bookings beat our expectations for the quarter.
Subscription revenue, which includes our SaaS and on-premise subscription revenue, reached $35.3 million and represented 29% of total revenue in the third quarter, increasing 143% from $14.5 million and only 14% of total revenue in the third quarter of last year. Our maintenance and professional services revenue was $63.3 million with $53.6 million from recurring maintenance and $9.6 million in professional services revenue. We continue to have a strong renewal rates on our maintenance renewal business.
Recurring revenue, which includes our subscription and maintenance related on perpetual license revenue, reached $88.9 million or 73% of total revenue, growing 41% year-on-year from $62.9 million and 59% of total revenue in the third quarter of last year. With a 72% mix of subscription bookings, it is clear the subscription transition is ahead of schedule. Economically, the headwind created by the mix was approximately $16 million in the third quarter when we compare it like-for-like to the mix of the third quarter of 2020. Normalizing for the mix shift, growth in the license portion of our business, our staff, on-premise subscription and perpetual accelerated again in the third quarter to over 50% and as those illustrative of the underlying growth in the business. Taking the calculated revenue headwinds into consideration, total revenue growth accelerated to 29% year-on-year.
Moving on to the annual recurring revenue. We experienced our largest ever sequential increase in the subscription portion, adding about $29 million in the third quarter and reaching $139 million representing over 40% of the total. Our total ARR was $344 million, growing 38% year-on-year, that's an acceleration from the second quarter of 2021. The maintenance portion was $206 million at September 30.
We had another great new business quarter both in terms of new logos and business trends. We signed more than 230 new customers with 85% of that obtained for subscription compared to about 59% in the third quarter of last year. New business deal sizes also increased again in the third quarter.
Geographically, the business continues to be well diversified. The Americas generated $68.2 million of revenue, representing 56% of total revenue. The Americas again had the strongest percentage of subscription bookings during the quarter. The EMEA had $39.7 million in revenue or 33% of total. APJ generated $13.7 million in revenue or 11% of total revenue with an increasing mix of SaaS and subscription. If we look across the geographies, adjusted for the calculated revenue headwind created by the mix, each region would have grown by over 27% of total revenue, with our license line growing even faster in 50% in the Americas and APJ and approximately 30% in EMEA.
All our line items of the P&L will now be discussed on a non-GAAP basis. Please see the full GAAP to non-GAAP reconciliation tables of our press release. Our third quarter gross profit was $102.5 million or 84% gross margin consistent with the 84% gross margin in the third quarter of last year. We continue to make investments to drive innovation and growth resulting in operating expenses of $102.4 million. That's a 34% increase year-on-year and operating income was $130,000 in the quarter, which was better than the midpoint of our guidance. It is important to remember that our operating income is lower by about $1.5 million from FX rates and approximately $15 [Phonetic] million of headwind. On a like-for-like basis, neutralizing the calculated revenue headwind and foreign exchange, our operating margin would have been approximately 12% in the third quarter of 2021. Over 70% of our operating expenses are related to headcount. So in the third quarter, we surpassed 2,000 CyberArk employees, ending the third quarter with 2075 worldwide. Of our total employee count, 925 are in sales and marketing. Net loss for the third quarter was about $2.4 million or $0.06 per basic and diluted shares.
In the first nine months of 2021, free cash flow was $47.1 million or 13% free cash flow margin. This cash flow contributed to our strong balance sheet and we ended the quarter with $1.2 billion in cash and investments.
Turning to our guidance. Our guidance for the fourth quarter reflects the robust industry tailwinds, our record bookings, strong execution year-to-date and improved productivity. For the fourth quarter of 2021, we expect total revenue of $140 million to $148 million. We expect a non-GAAP operating income of about $5.5 million to $11.5 million for the fourth quarter. We expect our EPS to range from non-GAAP net income of $0.06 to $0.21 per diluted share. This guidance assumes about 68% of subscription bookings mix and calculated revenue, and profitability headwind of approximately $28 million for the fourth quarter of 2021.
So if you isolate our license lines of Saas, on-premise, subscription and perpetual, the normalized growth rate, taking into account the calculated revenue headwind for the quarter, is about 24% year-on-year. Similarly, for the total revenue, the growth rate would be about 19% at the midpoint of the range, taking the headwind into account. Our guidance also assumes 41.7 million diluted shares.
For the full year of 2021, we expect total revenue in the range of $491.6 million to $499.6 million. The mix assumption underlying our guidance for the full year is 65% from subscription bookings and our revenue headwind for the full year is now approximately $68 million. This represents an increase from our prior guidance, which assumed a mix of 64% from subscription bookings and a $63 million headwind to revenue. Taking the calculated revenue headwind into account, our revenue growth rate would be approximately 22% at the midpoint of the range. And if you isolate our license lines of SaaS and subscription and perpetual, the normalized growth rate is over 30% for the full year, taking the calculated headwind into account.
I want to emphasize that increasing both our total revenue guidance and our mix indicates that we are again increasing the bookings assumptions underlying our guidance for the full year. This rate is above and beyond the bookings we had in the third quarter.
Now, moving down the P&L. We expect non-GAAP operating income to be between $13.1 million to $19.1 million. We expect our non-GAAP net income per diluted share to be in a range of $0.11 to $0.25. For the full year, we expect about 40.9 million weighted average diluted shares and about $13.5 million of taxes.
We wanted to briefly mention our current thoughts on the timing of the transition and our ARR growth. Given our success year-to-date, we expect to exit the transition earlier and we now expect to complete the transition in the third quarter of 2022 versus the fourth quarter of 2022 as we highlighted on our August call. Also, given the acceleration of our growth and our record bookings this year, we expect annual recurring revenue to grow about 37% year-on-year. That's an increase from our prior framework of 35%.
The third quarter was a great quarter and another important step in the execution of our subscription transition and our Identity Security strategy. Our business is accelerating, which you see in our results and recurring revenue growth rates. As we look ahead, we are in a great position to deliver long-term growth and profitability.
I will now turn the call over to the operator for the Q&A. Operator?
Operator
[Operator Instructions] Your first question comes from the line of Saket Kalia with Barclays.
Saket Kalia - Barclays - Analyst
Okay, great. Hey, good morning, guys and thanks for taking my questions here.
Udi Mokady - Founder, Chairman & Chief Executive Officer
Hey, Saket. Good morning.
Saket Kalia - Barclays - Analyst
Hey, good morning, Udi. Udi, maybe just to start with you. Feels like you and the team have been talking about broader Identity versus just Privilege here a lot more recently. I was just wondering if you could just talk about how the non-Privilege part of the business is doing. I mean you touched on this in the prepared remarks, but maybe just go one level deeper. How is the non-Privilege part of the business doing with Access and DevSecOps, for example? And to what extent do you think customers want to buy both of these parts of the portfolio? Does that makes sense?
Udi Mokady - Founder, Chairman & Chief Executive Officer
Yeah, yeah, absolutely. Sure thing. So I would say we're excited by the performance of all parts of the business and the fact that Privilege Cloud and SaaS is leading the way. But as I mentioned, Identity Security and our message is really resonating with customers. If you look at the other elements, what you're calling the non-Privilege, first of all, we had EPM have a record quarter this quarter and is proving to be also a new landing point or landing spot for new customers and really gets also the drivers that are related to Zero trust and ransomware. And then when we look at the Access and DevSecOps speedboats, they have the power of both appealing to our existing customer base and that is resonating with the Identity Security message, but also having that speedboat overlay effort that is getting them into new accounts and again into the upsell.
More and more of our customers are buying the wide portfolio. I gave the example of the customer that bought all of our products. That is happened. And I would say that in every conversation and pipeline build, it's across the entire portfolio. I think with some of the - some of the bundlings are actually getting a taste of elements of Access, for example, in early deals. And again I'm excited that the Privileged Access Management piece is on fire and leads the way and with the customer loyalty, we have the opportunity to upsell and get those new landing spots.
Saket Kalia - Barclays - Analyst
Got it, got it. That's great. Josh, maybe for my follow-up for you. It sounds like we're going to exit the transition a quarter earlier than what you had originally expected. Can you just remind us sort of what that means from a mix or anything or from a mix perspective or just anything we need to keep in mind from a modeling perspective, just kind of given that earlier exit?
Josh Siegel - Chief Financial Officer
Yeah, thanks, Saket. I mean the main thing is that when we talk about transitioning out of - into a wholly subscription company, we're talking, kind of, putting the threshold at when we get into past the 85% of our bookings coming from SaaS and subscription. So when we talk today about moving that quarter end from Q4 in the last follow-up to now Q3, we're talking about kind of meeting that threshold of 85% or more of subscription - bookings coming from SaaS and subscription in the third quarter already. And what that means is that you'll be continuing to see the percentage going to perpetual decreasing, particularly over the next year. And then, of course, it will be, after that, kind of a tail of the remaining perpetual business happening after that third quarter. But it's really - we set out a playbook at the beginning of the year and we really got to be able to keep improving on that playbook quarter in and quarter out.
Saket Kalia - Barclays - Analyst
Absolutely. Thanks very much, guys.
Udi Mokady - Founder, Chairman & Chief Executive Officer
Thank you.
Operator
Your next question comes from the line of Adam Borg with Stifel.
Adam Borg - Stifel - Analyst
Hey, guys, thanks so much for taking the questions. Maybe just on Secure Web Sessions to start. It seems like an interesting product and you talked about that in the prepared remarks. I'm just curious, are there any particular users or verticals where you think something like this would be more demanded?
Udi Mokady - Founder, Chairman & Chief Executive Officer
Yeah, absolutely, we're very excited about it. We see the proliferation of Privilege that you have more and more cases where a business user is actually privileged and the organization is worried about having no control over the session. So I would say one major part is IT-like functions in a business user, whether they're using HR applications or a business application like a sales force or a success factors and others, but then also the folks using Web Sessions for administrative-like functions like the web consoles and others. So there are elements that are I feel like, and there are elements of business users. And in terms of verticals, we actually see it applying across verticals of all companies. Of course, the more regulated will tend to want to put those controls even faster. And then the beauty of it is that it can run on any single sign-on solution. So it doesn't have to just attach to CyberArk and it gives us the opportunity to sell the solution and apply these PAM-like controls to all companies across the - that even have identity management in place.
Adam Borg - Stifel - Analyst
That's really helpful. And maybe just as a quick follow-up. In the slide deck, you talk about the bookings by vertical and just interesting to see that [Indecipherable] over quarters. Banking and financial, it becomes a smaller part of the mix as other areas are growing faster and manufacturing stands out. So I'd love to hear more about what's leading to the success you're seeing in some of, I'll call, your less traditional verticals? Thanks again.
Udi Mokady - Founder, Chairman & Chief Executive Officer
Yeah, absolutely. I think historically CyberArk saw the more regulated verticals jumping into the fray earlier and the trend over the last couple of years is Privileged Access Management and Identity Security considered best practice across all verticals and you see a catch-up. This quarter, we saw energy - the energy vertical, global government manufacturing more than double. And so I would say we're - continue to be applicable to all verticals. There are some verticals that are in a faster catch-up mode and of course, we have a very strong customer base in the financial sector and that will continue.
Operator
Your next question comes from the line of Hamza Fodderwala with Morgan Stanley.
Hamza Fodderwala - Morgan Stanley - Analyst
Hey, guys. Thanks for taking my question. Udi, first question for you. I was wondering if you can comment a little bit about the growth and opportunity you're seeing in machine-to-machine identity in particular, just given the rise of open source tools. Any sort of comment there?
Udi Mokady - Founder, Chairman & Chief Executive Officer
Yeah. And I wanted to add on my earlier answer before. I talked about a lot about the opportunity in our Access speedboat that's very much in the Secrets Management world. There is growing awareness definitely after SolarWinds and, like you mentioned, the proliferation of the DevOps pipeline as the place where attackers are going after. And if you stole a human secret or if you stole a strong machine-to-machine type secret, you can get similar access or even deeper. And so it's definitely applicable to all companies, and we're seeing that grow. We see more and more customers also want to leverage the fact that they can buy our Secrets Management solution and leverage Privilege Cloud as a solution to our passthrough. And of course, a lot of the self-hosted customers are expanding to the Secrets Management and will now consume this in the subscription model. So you're right, it's a growing trend where there are - there is a proliferation of Secrets across applications and machines and if we have these special glasses, we will see yet a big proliferation of credentials on the human side, but an even faster and probably out of control on the development side and on the application side and we're going after it.
Hamza Fodderwala - Morgan Stanley - Analyst
Perfect. Just a quick follow-up for Josh. Just on the ARR, how should we think about the puts and takes with subscription versus maintenance? And obviously maintenance is going to be a bit of a drag just given the transition. So how should we think about kind of modeling that over the next few quarters?
Josh Siegel - Chief Financial Officer
Yeah, absolutely. We're going to see still very high growth on the subscription piece of the ARR that we've been seeing. We saw it grow to 131% in the third quarter. And maintenance - our perpetual will kind of continue to trend kind of flat. And then at some point, as we get to the transition quarter, we'll start to - it could go potentially miles sequentially. So I think the way we kind of look at it is we can consider already the subscription piece of the ARR business already crossing over the 50% in the first half of next year. Today it's around 40% of the total ARR and growing to more than 50% of it in the first half of next year. And to the exact timing of when the maintenance will start to go negative, it's later on in next year and it really depends on the mix rate.
Hamza Fodderwala - Morgan Stanley - Analyst
Super helpful. Thank you.
Operator
Your next question comes from the line of Rob Owens with Piper Sandler. Mr. Owens, your line is open, sir. Your next question comes from the line of Brian Essex with Goldman Sachs.
Brian Essex - Goldman Sachs - Analyst
Hey. Great, thank you very much. Thank you for taking the question and great to see the acceleration in results. I was wondering if I could follow up on Hamza's question actually. 4Q has historically been a relatively heavy perpetual license quarter. So maybe if you could give us a little bit more color around what the previous changes in incentive compensations to skew the efforts towards SaaS, what the impact is with regard to what you typically see or have typically seen on the perpetual side. And then how do we think about progress with the installed base with regard to kind of transitioning to SaaS? So what do you see in your pipeline and maybe anything you can call out with regard to potential volatility on the perpetual side in 4Q?
Udi Mokady - Founder, Chairman & Chief Executive Officer
Brian, I'll start with your second piece. I think the way we approach this transition was always do right by the customer and follow the trend. I think we were even surprised, like I alluded to, that the existing self-hosted customers are embracing and without us having to [Indecipherable] they see that as part of their roadmap. So you see that in the right timing, they also consider and look for ways to adopt our Privilege Cloud solution. Some examples, and like I gave them in the script, are some very large CyberArk customers that were self-hosted that bought our Privilege Cloud for new business units or for M&A where they want to put these controls faster and up and running quickly. And so they'll - and others are excited to adopt other SaaS solutions like our EPM or Identity and look at Privilege Cloud as the solution as they start to downsize their data center. But we will allow them to do it in the right time for them. And of course, every new solution out here has been SaaS and we're seeing those adopted.
In terms of the incentive, we, of course, put out the program at the beginning of the year incentivizing the team to sell SaaS and subscription, with that always do right by the customer. And so existing customers that have add-on business are lined up for Q4, we are definitely expecting that.
Josh Siegel - Chief Financial Officer
Yes, and I'll add, Brian. In addition, we set out a - to what Udi just said, we set out a clear playbook for transitioning and it included incentives to the sales team, as Udi just pointed out, but also included a full blown education package of how do we move through going from selling perpetual to selling to SaaS and subscription. And for this year, we're really focused on incentivizing them to quote and to create new pipeline on the SaaS and subscription, which has been definitely happening for us. We see the majority of our new pipeline coming out as SaaS and subscription and I think it's also indicative when we look at 85% of our new logos in the third quarter were SaaS versus - and subscription-based new logos. Specifically around Q4, we do anticipate seeing more perpetual business in Q4. It's not really related to the - to our compensation or incentive plans, it's just that Q4 is our largest quarter.
It also results in our enterprises. So there's typically budget plus [Phonetic] - and deals that are opening and closing in the fourth quarter and those will be to be more add-on deals that - with existing customers and adding on more licenses in their current installed base, which is most likely going to be a perpetual installed base. So we do expect to see, in the fourth quarter, a take-up in perpetual, but then again, as we go into next year, we'll start to see more and more in SaaS and subscription because most of the new pipeline this year has been created in SaaS and subscription. And that enhance our ability to move in at our targets from the third quarter of getting over 85%.
Brian Essex - Goldman Sachs - Analyst
Got it. That's helpful. Maybe just real quick for a follow-up. Given the pull forward in expectation for completion of your transition, thoughts on how you think about spending, I mean, great innovation on the platform, we see the elevated R&D costs, sales and marketing spend is also elevated relative to historical growth rates. But how do you think about when we might start to see an inflection back to kind of double-digit profitability - operating margins and better profitability, given that shift in timeline forward?
Josh Siegel - Chief Financial Officer
Yeah, I mean, I think it's basically a shift. I mean we - the way that the [Indecipherable] work in the transition is going to be all the way through the transition quarter and an excellent follow-on [Phonetic] is usually the trough of the operating margins. And then you start to see some slow - increasing one to two quarters after you're through the transition. So the faster we bring in the transition then the faster we can get back to it, but we can't control the fact that it's going through the transition to the end of that quarter. It's still going to take one or two quarters afterwards before we start to see it rising from there. The rise is not going to be in a single quarter. It's going to be gradual over several quarters post that transition.
Brian Essex - Goldman Sachs - Analyst
Okay, very helpful. Thank you.
Operator
Your next question comes from the line of Jonathan Ho with William Blair.
Jonathan Ho - William Blair - Analyst
Hi, good morning. I just wanted to, I guess, start with EPM. Just given the success that you're seeing there, is there any change to your thinking around how large EPM could be as a product area? I just want to get a sense for that.
Udi Mokady - Founder, Chairman & Chief Executive Officer
Hey, Jonathan. It's one of the areas where I guess it's - they're all our children, so we're excited about all of them. But EPM is one of those that has the - it's a best practice of reducing risk and removing risk Privilege, but it also is very effective against ransomware. So we think the opportunity is great and we finally got to a point where the awareness is there for us to further step on the gas and leverage this business risk [Indecipherable]. So I'm not going to - we're not going to refine the PAM numbers we put out there, because we saw this opportunity. But it is maturing and, like I said, becoming a mainstream awareness that - of a strong and important control to put in place, both as part of a wider Privileged Access Management programs, but also stand-alone. We've put things in place that also bring it more as a landing spot for us, both in how our sales team works, but also the type of channels that are expanding and taking us there and even down to the mid market with channels like CDW that can bring this to - into the new markets.
Operator
Your next question comes from the line of Jonathan Ruykhaver with Baird.
Jonathan Ruykhaver - Baird - Analyst
Yeah. Good morning and congrats on the strong performance. Udi, it's great to see the success you're - we can see with Privilege Cloud. I'm wondering if you can talk a little bit more detail about the adoption trends you're seeing in terms of new customer acquisition versus installed base expansion, and what you're seeing in terms of those adoption trends across commercial versus large enterprise.
Udi Mokady - Founder, Chairman & Chief Executive Officer
Yeah, I would say that we're very excited to see the acceleration in the new logos and part of that is the solutions are more open than before, the attack surface is expanding and we've built this record pipeline over the past 18 months that we're converting. I think we're seeing in the logos more landing spots with EPM, with - and of course with Access and with PAM and the speedboat structure really provides more subject matter experts to take the opportunity. And then, as I mentioned before, we have been investing in the channel and the channel programs and those are paying off for those landings. So those includes CDW, but they also include - doing more with AWS and others. Now with regards to enterprise versus commercial, it's really going after both. Enterprise has been our sweet spot but with these expanded channels, we're able to go further down market and it's moving from the highly-regulated to the less-regulated part of the mid-market, which is exciting.
Jonathan Ruykhaver - Baird - Analyst
And maybe you could talk about that portion, the commercial. Where are you in terms of driving at enablement amongst your channel partners? Is it something that becomes more material driver to bookings as we look into 2022?
Udi Mokady - Founder, Chairman & Chief Executive Officer
I think we want to be - we want to excel in both. Enterprise is the Holy Grail for CyberArk. It's where we're coming from and we have the strongest customer base, but we saw that we can double down our efforts on the commercial without distracting the enterprise focus. And again because it's incremental types of channels and its focused team that is going after the commercial space. And so, yeah, you'll see it continue to be a major source of growth, but of course the larger deals and the larger ASP is coming from the enterprise part of the business, which is really embracing the security messaging and appreciating the innovation we put in place.
Operator
Your next question comes from the line of Roger Boyd with UBS.
Roger Boyd - UBS - Analyst
Hi, thank you for taking my questions. I was wondering if you could talk a little more about the Idaptive customer base and what you're seeing out of these customers in terms of their willingness to upsell the PAM and just general recognition of your strategy of Privilege Access-centered Identity Security strategy.
Udi Mokady - Founder, Chairman & Chief Executive Officer
Yeah. No, absolutely, I think the biggest motion is upselling the PAM customers on the - on Access and our DevSecOps and Secrets Management. So that's the - that's with, of course, the majority of our 7,000 customers and we form those deep relationships where they're happy to explore covering that proliferation of Privilege into Workforce users, into their suppliers, into the third-party elements and to Secrets Management. The motion of the pure Idaptive customers from the acquisition - the most important piece over the last year was to make sure they're happy and growing, and then also introduce additional elements to them on the PAM side. But like I said, the bigger motion is expanding with our PAM customers across the portfolio.
Operator
Your next question comes from the line of Gregg Moskowitz with Mizuho.
Gregg Moskowitz - Mizuho - Analyst
Okay, thank you for taking the question, and congratulations on a very good quarter. So Udi, I know that existing customers have a loyalty incentive to move to SaaS and with all of the success that you're seeing with respect to the overall subscription transition, I'm wondering if you're also seeing more migrations from on-premise to SaaS. Thanks.
Udi Mokady - Founder, Chairman & Chief Executive Officer
Okay. Yeah, yeah. So we incentivize, obviously, our salespeople. But the number one thing is to follow the - and allow the customers to execute the strategy in their base, but of course, they see the new bundled packages and that's incentivizing them to look at our subscription, which really, even if they're an on-premise customer, to get more value with add-on business coming into the subscription packages. The move for an on-prem customer to adopt - to move to SaaS is more gradual among the enterprise. It's - but we [Indecipherable] pleasantly surprised like some of the examples I gave in the Fortune 30 customer, that more and more enterprises are also migrating and taking on Privilege Cloud. We'll see that as a pathway over the year - coming years and one of the strengths of CyberArk is really giving customers optionality on how to consume the Identity Security portfolio.
Operator
Your next question comes from the line of Rob Owens with Piper Sandler.
Rob Owens - Piper Sandler - Analyst
Great, thank you guys for taking my question and I apologize for the technical difficulties earlier. I swear it wasn't user error so. Udi, in your prepared remarks, you talked about SaaS driving more users and driving more users faster. Is that a SaaS adoption comments or is this a democratization of Privilege by SaaS and the fact that there's broader applicability now especially given the attack surface?
Udi Mokady - Founder, Chairman & Chief Executive Officer
I think we're seeing the classic benefits of SaaS where there's quicker time to value. A customer does not have to install and go through the process of taking care of the infrastructure and we deliver success packages and so they get up and running, they see it's working, they see that it will alleviate a lot of - it gives them both security, but also the ability to manage their infrastructure faster, and then you have a faster path to the upsell of more users of Privilege Cloud or add-on business on other elements of the portfolio. So I would say that the benefit of a faster time to value, faster time to innovation and an overall quicker path to an add-on sales, but we're - but it's all very real and at CyberArk, we put the customer in the center and the entire organization is all about creating customer value.
Operator
Your next question comes from the line of the Ittai Kidron with Oppenheimer.
Ittai Kidron - Oppenheimer - Analyst
Hey, guys, great quarter. I guess now that you're getting close to the end of the transition, Udi, the big question is you're going to have a hardcore of customers who are still stuck on perpetual, and what is it that you're going to do about it. Meaning, are you going to terminate? What is the timeline by which you will stop offering perpetual and what are the odds that midpoint to or late next year, you actually raise prices on your maintenance in order to push that last bastion of customers into the subscription model?
Udi Mokady - Founder, Chairman & Chief Executive Officer
Yeah. We have a - I think our current situation puts the customer first so - and that customer loyalty has really worked for us. So I think it's going to be much more on the carrot side versus the stick for them to see more value in the subscription packages, a taste of other elements of the portfolio as they pick up elements of the subscription packages. And overall, we're seeing that they are open to it, especially as they are on a maintenance renewal rate with CyberArk and are open to expand and take on the subscription packages. And of course, let's remember that maintenance is a great recurring revenue for us as well and the opportunity is out there to gradually bring them on to the subscription journey and definitely to lead with SaaS and to the SaaS here. And that's the - and so to the prior questions, that's where they're going to see even greater value in the transition. I don't know Josh if you want to add anything on.
Josh Siegel - Chief Financial Officer
Yeah, no, I think you covered the points and the main issues. As they add on more and more sales, they're going to be really incented because of our great subscription packages to kind of move their current installed base to - on add-on sales to be subscription-based and it's also a form of a tech upgrade for them if they want to now reverse and get that same tech upgrade for their installed base on perpetual. So we see it happening pretty naturally, but there will be a tail once we're - but it's happening naturally as we see it today.
Operator
Your next question comes from the line of Catharine Trebnick with Colliers Securities.
Catharine Trebnick - Colliers Securities - Analyst
Well, thanks for taking my question, and excellent quarter. Udi, can you tried to quantify, of the new business, how much is that really being driven by the acceleration for organizations to really undertake Zero Trust architectures?
Udi Mokady - Founder, Chairman & Chief Executive Officer
Yeah, sure. Hi, Catharine. I couldn't give a number, but I would say that all the great - the strong business drivers out there are business of Zero Trust and also the protection against ransomware are strong drivers for our business and even in the executive order and in other elements, it's very clear that least privilege and putting PAM controls is really a basic tenant to achieve Zero Trust. So I would say it's in every customer conversation, definitely at CIO and CISO level. They like the connection of how CyberArk with PAM at the center, but also the full Identity Security approach is part of them and getting to a Zero Trust or executing on the Zero Trust framework and it's a great driver on top of all the enablement we provide and, of course, the proactive protection they can get with our solution. I always aligns [Phonetic] on to the enablement side because I think the beauty of this portfolio is that we both are a proactive security layer but we're also really allowing them to get digital transformation going and connect to their suppliers, connect their remote workforce, allow their IT to transform and modernize. And so it's all part of the supporting our tailwinds for us that Zero Trust frameworks are right out there.
Operator
Your next question comes from the line of Joshua Tilton with Wolfe Research.
Joshua Tilton - Wolfe Research - Analyst
Hey, guys, thanks for taking my questions. For my first one, I was kind of hoping, when we think about the broader Identity space, can you just comment on the demand environment, but specifically compare and contrast the demand for Privileged Access Management versus the demand for Access Management and maybe how to just compare it to six months or even a year ago?
Udi Mokady - Founder, Chairman & Chief Executive Officer
Yeah, so - hi, Josh. So I would say a year ago, we didn't have this combined motion of going after the existing customer base. I think we benefit from the two worlds right now, where for a customer looking to put in that critical layer of Privileged Access Management, CyberArk is the market leader, go to us. We have the go-to-market, the reach and the opportunity to really capture that demand. And demand is strong, the strongest I can recall for Privileged Access Management. Access is a new motion for us and - but it's a huge growing market because of the need to enable digital transformation and we can ride it and the way we're doing it is very much centered on our customer base that trusts us on past. So I would say they're both - it has strong demand. PAM is definitely the one that resonates the most with a CISO as a layer that they must have or need to present to the Board and I would say even a basic pillar of their cyber security strategy. So PAM is more cyber security-driven. Our PAM customers trusts us with the expansion to the rest of the portfolio, and Access gets the driver of digital transformation and enablement which is also used there.
Operator
Your next question comes from the line of Taz Koujalgi with Guggenheim Securities.
Imtiaz Koujalgi - Guggenheim Securities - Analyst
Yes, thanks for taking my question. Can you comment on your Fed performance in this quarter and any products that showed strength in that vertical?
Udi Mokady - Founder, Chairman & Chief Executive Officer
Absolutely. So I would say the federal for us was not - we didn't see the same levels of budget flush like in previous years. We mostly attribute that to the new administration and budget. But the awareness is stronger than ever. I mentioned the executive order that touches elements of Zero Trust and least privilege, and I would say a lot of engagements with our various agencies and with our partners in the federal market. I can share that the global government vertical, if we look at in a full bucket, grew more than 100% for us in Q3. And it's very much led by Privileged Access Management as the major, I would say, grower in this segment where many agencies, many governments still need to do the basics around Privileged Access Management. And I also mentioned that the SLED vertical, the state and local and education vertical performed really well in the quarter.
Operator
Your next question comes from the line of Mike Cikos with Needham and Company.
Mike Cikos - Needham & Co. - Analyst
Hey, guys. Thanks for squeezing me in here. First question, I just wanted to touch on the cross-sell motion. Obviously, we're talking about customers once they come to SaaS or subscription are incentivized to continue down that track with their add-on sales. Curious, do you guys have enough data at this point to give us a sense for that cross-sell motion where customers are typically going to next? What's the - where are they kind of getting to within CyberArk portfolio?
Udi Mokady - Founder, Chairman & Chief Executive Officer
So it really varies. I would say that a PAM - a pure PAM customer would typically expand to EPM as the kind of the next stage of a PAM program. You've secured your servers, but you left your endpoints and exposed with over privilege and it's over to the next step in the cross-sell. And I didn't mention it earlier, but we're also partnering with the EDR and the XDR companies to actually make it so that the EPM lists together and nicely with our partners on that front. And then from that front, if you're executing on a PAM or an Identity program, there is the expansion to Secrets Management because it's the other side of Privilege and then - and securing their applications and then of course to Access. And so I would say is that, if I have to generalize, that would be a course for a PAM customer. In a new account, we're actually seeing that we can land with multiple products as, again, the awareness of what's the best practice in PAM and the bundled elements of Identity Security we can leverage.
Operator
At this time, I would like to turn the call back over to Mr. Udi Mokady for closing remarks.
Udi Mokady - Founder, Chairman & Chief Executive Officer
Thank you, Lisa. Thanks everyone. I want to thank our customers, partners and employees for contributing to our strong third quarter and supporting our transition to a modern subscription company. I'm confident that as we execute our strategy, we will build even deeper relationships with our customers and partners. Thanks everyone.
Operator