CyberArk (CYBR) Q1 2025: Recurring Revenue Hits 94% as Machine Identity Deals Double Platform Scope
CyberArk’s Q1 2025 results underscore a platform shift as machine and AI identity security drive multi-solution adoption and recurring revenue to new highs. Management’s disciplined conservatism in guidance stands in contrast to robust pipeline signals and accelerating cross-sell, with machine identity and agentic AI emerging as the next wave of high-value growth. Investors should watch for continued platform consolidation, evolving pricing models, and the impact of regulatory mandates on certificate management.
Summary
- Platform Consolidation Accelerates: Multi-solution deals and cross-sell momentum deepen enterprise lock-in.
- Machine and AI Identity Drive Expansion: Machine identity deals now outpace human, reshaping deal size and sales focus.
- Guidance Remains Cautious: Leadership embeds macro conservatism despite no visible demand softening.
Performance Analysis
CyberArk’s Q1 delivered above all guided metrics, with total revenue of $317.6 million and annual recurring revenue (ARR) reaching $1.215 billion. The shift to recurring revenue is now nearly complete, with recurring revenue accounting for 94% of total revenue and subscription revenue representing 79%. The inclusion of Venify, machine identity security, and Zillow, modern identity governance and administration (IGA), is already visible in both top-line growth and the breadth of customer adoption. Notably, net new ARR was $46 million, up from $37 million a year ago, with Zillow contributing $5 million upon acquisition close.
Operating leverage continues to improve as gross margin expanded to 85% and operating margin reached 18%, up three points YoY, even as the company absorbed over 400 Venify employees and six weeks of Zillow costs. Free cash flow generation was robust at $95.5 million, or a 30% margin, highlighting the efficiency of the subscription-first model. The Americas remain the largest region, but EMEA and APJ both saw healthy double-digit growth, aided by cross-sell and platform adoption. Multi-solution deals are now the norm, with half of new logos landing with two or more solutions and nine of the top ten deals in Q1 including both Venify and Secrets Management.
- Recurring Revenue Dominance: 94% of total revenue is now recurring, reducing volatility and boosting predictability.
- Cross-Sell Synergy Realized: Venify and Secrets Management featured in 90% of top deals, validating the platform thesis.
- Deal Size Expansion: Machine identity and AI agent deals are now 2-3x larger than traditional privileged access management (PAM) sales.
This quarter’s results confirm CyberArk’s pivot from product to platform, with operational scale and customer stickiness rising as identity security becomes central to enterprise security architectures.
Executive Commentary
"The identity security imperative is real and accelerating. As the digital ecosystem grows more interconnected and decentralized, the threat landscape is not just expanding, it's evolving at an unprecedented pace. Organizations must respond. CyberArk is uniquely positioned with the only unified platform for securing every identity and addresses a critical pain point for overburdened CISOs by simplifying identity security."
Matt Cohen, Chief Executive Officer
"We delivered solid top-line growth, expanded operating profitability, and generated robust free cash flow. The outperformance in Q1 was from two primary factors, the strength in our overall business compared to our guidance, and a slightly higher than expected mix of self-hosted subscriptions. The value proposition we outlined at the time of the Ventify acquisition is being validated by strong cross-sell into existing customer base, new customers being added, and growing activation of our channel partners."
Erica Smith, Chief Financial Officer
Strategic Positioning
1. Unified Platform Adoption
CyberArk’s shift from point solutions to a unified identity security platform is driving customer expansion and higher lifetime value. The company’s go-to-market now centers on full-identity roadmaps, with customers increasingly consolidating human, machine, and AI identity needs on a single platform. This approach is validated by the fact that half of new logos land with multiple solutions, and even single-product starts are architected for future expansion.
2. Machine and AI Identity Leadership
Machine identity security is now a core growth vector, with the machine-to-human identity ratio rising from 45:1 to over 80:1. Venify and Secrets Management are now embedded in the majority of large deals, and new regulatory mandates (like the CA Browser Forum’s 47-day certificate lifespan) are driving urgency for automated certificate management. AI agent security is emerging as the next frontier, with CyberArk’s secure AI agent solution expected to launch later this year and a strategic partnership with Accenture to integrate identity security into AI-driven workflows.
3. Recurring Revenue and Margin Expansion
The subscription-first model now defines CyberArk’s economics, with recurring revenue near 95% and perpetual licenses falling to 1% of revenue. This model boosts gross margin and cash flow, even as the company absorbs M&A-related headcount and integration costs. Operating leverage is expected to persist as the business scales, with management raising full-year free cash flow and operating income guidance.
4. Cross-Sell and Channel Activation
Cross-sell is no longer aspirational but operational, with Venify and Zillow both driving incremental ARR and activating hundreds of newly certified channel partners. The ability to bundle solutions and address both legacy conversion and greenfield opportunity is accelerating deal velocity and increasing average deal size.
5. Regulatory and Macro Tailwinds
Regulatory shifts, such as certificate lifespan mandates, are creating new urgency for automation, while macro volatility has yet to impact demand. Management’s guidance remains conservative, embedding potential headwinds, but all current pipeline and customer conversations point to sustained demand for identity security as a non-discretionary spend.
Key Considerations
This quarter marks a turning point in CyberArk’s competitive and operational positioning, with several levers shaping the company’s trajectory into 2026:
Key Considerations:
- Multi-Solution Land and Expand: Platform-centric selling is increasing customer stickiness and long-term value, with roadmaps built for cross-sell from day one.
- Machine Identity Scale Effects: As machine and agent identities proliferate, pricing models will shift to volume-driven curves, but total deal sizes are expected to rise substantially.
- Legacy Conversion Opportunity: Maintenance ARR is declining as customers migrate to SaaS, with management expecting $15 million in conversion this year and a multi-year tailwind as readiness builds.
- Certificate Lifecycle Regulation: Mandated reductions in certificate lifespan (from 398 to 47 days) are driving urgent demand for automated certificate management, with CyberArk well-positioned as a solution provider.
- Conservative Guidance vs. Pipeline Strength: Management’s guidance factors in macro and tariff risks, but all real-time data suggests continued robust demand and execution upside if current trends persist.
Risks
Macro uncertainty, tariff volatility, and evolving customer budgets remain the primary risks, though management reports no current demand impact. Prolonged sales cycles for legacy IGA displacement and potential pricing compression as machine and agent volumes scale could pressure growth rates. Regulatory shifts may also increase compliance costs or alter competitive dynamics.
Forward Outlook
For Q2 2025, CyberArk guided to:
- Total revenue of $312 to $318 million
- Non-GAAP operating income of $41.5 to $46.5 million
- Non-GAAP EPS of $0.74 to $0.81
For full-year 2025, management raised guidance:
- Total revenue of $1.313 to $1.323 billion (32% YoY growth at midpoint)
- Non-GAAP operating income of $221 to $229 million
- ARR of $1.410 to $1.420 billion (21% YoY growth at midpoint)
- Free cash flow of $300 to $310 million (23% margin)
Management cited continued pipeline strength, high customer engagement, and robust cross-sell activity, but embedded macro conservatism to account for tariff and economic volatility.
- Impact event and world tour driving higher seasonal marketing costs in Q2
- Full-year CapEx raised to 2.5-3% of revenue for new US headquarters
Takeaways
Investors should focus on CyberArk’s platform transition, with multi-solution adoption, machine identity scale, and recurring revenue dominance defining the next phase of growth.
- Platform Expansion Is Working: Cross-sell and multi-solution deals are now the norm, embedding CyberArk deeper into customer environments and increasing deal sizes.
- Machine and AI Identity Shift the TAM: Machine and agent identity security are expanding the addressable market, with regulatory mandates creating urgency and pricing models evolving to volume curves.
- Guidance Understates Momentum: Management’s conservative posture on macro risk leaves room for upside if current demand trends persist and cross-sell continues to accelerate.
Conclusion
CyberArk’s Q1 2025 results confirm its emergence as a unified identity security platform with accelerating customer adoption, operational leverage, and a clear lead in machine and AI identity security. While management’s guidance remains cautious, the core business shows no signs of demand deterioration, and regulatory tailwinds may further accelerate platform consolidation.
Industry Read-Through
CyberArk’s results signal a broader industry pivot to platform-based identity security, as fragmented tools and legacy IGA give way to unified, automated solutions. The surge in machine and agent identities, coupled with regulatory mandates on certificate management, creates a rising tide for vendors able to automate discovery, privilege, and lifecycle controls at scale. Competitive differentiation is shifting from point solutions to integrated platforms, with cross-sell and multi-solution adoption now critical for long-term share gains. Other cybersecurity and infrastructure vendors should expect increasing customer demand for consolidation, automation, and regulatory compliance as core buying criteria.