CyberArk Software - 20-F annual report 2021

We began transitioning our business to a subscription model in January 2021. Our transition goal is to achieve at least 85% of our sales through subscriptions, for both SaaS and self-hosted offerings, and to change business processes, systems and organizational structure to support and grow our subscription customers. Our strategy requires considerable investments across the entire organization with significant changes to our go-to-market and research and development organizations and activities, as well as adjustments in our operations, reporting and financial resources. We have no assurance that these investments and changes will result in the desired growth in our subscription revenue, nor be favorably accepted by our existing customers. As we execute our strategy, we expect our perpetual license revenue to continue to rapidly decline and our maintenance and support revenue to gradually decline over the coming years. While we expect the majority of our existing customers to expand their deployment leveraging subscription offerings (whether self-hosted or SaaS) and new customers to purchase subscriptions at an increased rate, certain customers may view these changes unfavorably and terminate their engagement with us, or they may still desire perpetual licenses, which may cause fluctuations in our financial performance and our sales transition timeline to be delayed.

We began transitioning our business to a subscription model in January 2021, offering our customers multiple software and delivery models. It may be difficult to predict the mix of the subscription and perpetual bookings and the mix of self-hosted and SaaS subscriptions in any given quarter, which could impact our financial results and cause us to fail to meet publicly announced financial guidance or other expectations. We recognize revenue differently based on the composition of the selected offering. Specifically, we recognize revenue from perpetual licenses upon their delivery and the license portion of self-hosted subscriptions upon the commencement of the subscription period. By contrast, we recognize revenue from SaaS subscriptions and from maintenance services for perpetual licenses or self-hosted subscription ratably, over the period of the subscription or maintenance contract. This may cause trends in revenue recognition to lag those in sales, potentially causing us to fall short of investor expectations for revenue even while meeting or exceeding periodic sales targets. Accordingly, our transition to a subscription model could continue to reduce our overall revenue growth rates, operating margins and cash flow from operating activities in the near term.

A meaningful portion of our quarterly revenues is typically generated through transactions of significant size, and purchases of our solutions and services often occur at the end of each quarter. We also experience quarterly and annual seasonality in our sales, demonstrated by increased sales in the third month of each quarter relative to the first two months, and increased sales in the fourth quarter of each year. The timing in which SaaS deals close may further exacerbate the seasonality impact on reported revenues due to the ratable recognition. In addition, our sales cycle can be intensively competitive and last several quarters from proof of concept to the actual sale and initial delivery of our solutions to our customers. The sales cycle can be even longer, less predictable and more resource-intensive for larger sales, or with customers implementing complex digital transformation strategies or facing a complex set of compliance and user requirements. Customers may require additional internal committee or executive approvals, extensive security reviews, longer product trial periods and prolonged contract negotiation before making a final purchase, all of which has intensified with the increased volume of SaaS transactions, which are subject to even greater scrutiny.

 

Security products, solutions and services such as ours are complex in development, design and deployment and may contain errors, bugs, misconfigurations or vulnerabilities, that are potentially incapable of being remediated or detected until after their deployment, if at all. Any real or perceived errors, bugs, design failures, defects, vulnerabilities, misconfigurations in our solutions or their accompanying documentation, or untimely or insufficient remediation thereof, could cause our solutions not to meet their specifications or security standards. The affected solutions may not fulfil their primary security functions, falsely identify threats or create new security threats, and be vulnerable to security attacks.

There is no guarantee that our products would be free of flaws or vulnerabilities at all times and we may not correct all known vulnerabilities or errors, promptly or at all.

As we increase our developers’ workforce globally to meet our business goals, including by engaging external developers or through mergers and acquisitions, the risk of errors, misconfigurations, vulnerabilities or intentional misconduct, may be heightened due to governance difficulties and limited centralized oversight. In addition, difficulties or delays in hiring and retaining personnel may impact the resources available to us for continuous improvement of our product security posture and therefore, increase this risk (see “—The tight global labor market has created difficulty to attract and retain qualified personnel, has increased wages and compensation, and has increased employee turnover across industries.  If we are unable to hire, retain and motivate qualified personnel, our business will suffer.”).

An actual or perceived error, bug, misconfiguration, vulnerability, cyberattack or other security breach, regardless of whether the vulnerability or breach is actually attributable to the failure of our products, SaaS solutions or the related services we provide, could adversely affect the market’s perception of the efficacy of our solutions and our industry standing. Such circumstances could cause current or potential customers to look to our competitors for alternatives to our solutions and subject us to negative media attention, reputational harm, lawsuits, regulatory investigations and other government inquiries, indemnity claims and financial losses, as well as the expenditure of significant financial resources to, among other actions, analyze, correct or eliminate any vulnerabilities. Provisions in our agreements that attempt to limit our liability towards our customers, channel partners and relevant third parties may not withstand legal challenges, and certain liabilities may not be limited or capped. Additionally, any insurance coverage we have may not adequately cover all claims asserted against us and may leave a significant portion of such claims to be directly covered by us. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all.

As the identity and access and Privileged Access Management markets have matured and continue to grow significantly over recent years, it may become more attractive for new competitors, including both large security vendors and startups, or vendors in adjacent markets to enter our market, further increasing direct technology and pricing competition which could negatively impact our sales or market share.

Our future success, productivity, revenue growth, profitability and cash flow from operating activities depend, in part, on our ability to continue to timely attract and retain highly skilled personnel. The tight global labor market has created an incredibly intense hiring environment, resulting in us experiencing increased difficulty in attracting and retaining qualified personnel. Since we require a highly skilled workforce in order to successfully compete in an increasingly competitive cybersecurity market, we have experienced and may continue to experience difficulty in hiring, high employee turnover, and considerable costs and productivity as well as time to market losses. Global compensation inflation in the market may impact our ability to retain our existing personnel or attract new personnel which, over time, may impact our productivity, ability to meet customers’ expectation and overall profitability levels. Many corporations and startup companies have greater resources and compensation tools at their disposal for talent acquisition, which may not be available at our Company. Our compensation relies partially on different equity vehicles (such as RSUs or ESPP). Volatility within the stock market or inability of our stock to perform may affect our employee attrition and ability to attract new talent. Our inability to attract or retain qualified personnel or delays in hiring such personnel may seriously harm our performance, business and financial condition and results of operations. Furthermore, if we hire employees who previously worked for our competitors, we may be subject to allegations that such employees have been improperly solicited or divulged proprietary or other confidential information, which could subject us to potential liability and litigation.

Our success and continued growth will depend, in part, on our ability to acquire a sufficient number of new customers while maintaining and expanding our revenues from existing customers, by renewing contracts for our solutions and selling incremental or new solutions to existing customers. If we are unable to succeed in such efforts, we will likely be unable to generate revenue growth at desired or projected rates. In addition, competition in the industry may lead us to acquire fewer new customers or result in us providing more favorable commercial terms to new or existing customers. Macro-economic effects may also affect our ability to maintain our customer base and expand it, and the COVID-19 pandemic and its associated global response may also make establishing relationships and new supplier expertise among potential customers more challenging (see “—The COVID-19 pandemic, measures globally taken in response to it and the resulting economic environment have adversely affected, and may adversely affect in the future, our business, financial condition, and results of operations.”).

With our ongoing introduction of new solutions to meet market demands, our sales, research and development, support and customer success and IT teams may have difficulties selling, supporting and maintaining multiple license models and code bases. These may lead to lower rates of software sales, longer sales cycles, customer dissatisfaction, lower renewal rates and a reduction in our ability to sell add-on business to customers or gain new customers. Further, as part of the natural lifecycle of our solutions, we may determine that certain products will be reaching their end of development or end of life and will no longer be supported or receive updates and security patches. Failure to effectively introduce new solutions or manage our product lifecycles could lead to increased expenses, existing customer dissatisfaction and contractual liabilities.

We and our third-party providers may also be subject to information technology system failures or network disruptions caused by a variety of factors, including pandemics, natural disasters, climate change (such as increased frequency and storm severity or drought), accidents, power disruptions, telecommunications failures, acts of terrorism, wars (including an escalation of the conflict between Russia and Ukraine), computer viruses and malware (such as ransomware), or other events or disruptions. System redundancy and other continuity measures may be ineffective or inadequate, and our business continuity and disaster recovery planning may not be sufficient for all eventualities. Cyberattacks, security breaches and other incidents could result in significant damage to our market position and lead to costly remediation requirements, indemnity claims, legal claims (including class action litigation), regulatory investigations and fines or penalties, as well as the loss of proprietary and confidential data, trade secrets and customers (see “—The dynamic regulatory environment around privacy and data protection may limit our offering or require modification of our products and services, which could limit our ability to attract new customers and support our current customers and increase our operational expenses. We could also be subject to investigations, litigation, or enforcement actions alleging that we fail to comply with the regulatory requirements, which could harm our operating results and adversely affect our business.”). An actual or perceived failure, disruption, or breach of our network or privileged account security in our systems could adversely affect the market perception of our products and services, or of our expertise in this field. Moreover, if critical business functions or services from third party providers are breached and become unavailable due to extended outages or interruptions or because they are no longer available on commercially reasonable terms, our ability to manage our operations could be interrupted, our contractual service level commitments could be breached, and our ability to provide timely and adequate maintenance and support services to our customers could be impacted. Any of the foregoing events could have a material and adverse effect on our operations, reputation, financial condition and operating results and expenses.

 

With the increase in the likelihood and severity of potential security breaches and the increase in cybersecurity insurance premiums for our customers, negotiations may require us to assume higher liabilities with regards to security and data breaches. In addition, we are unable to ensure that any limitations of liability provisions in our contracts with respect to our information security operations or our product liability would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim (including in cases where existing customers purchase new solutions based on previously agreed contractual terms), or that we would be able to adequately recover damages from third parties associated with us, who were involved in a security incident. Additionally, any insurance coverage we may have may not adequately cover any of these claims asserted against us or any related damage and may leave a significant portion of such claims to be directly covered by us. If any of the foregoing were to occur, our business may suffer extensive costs, our sales may be reduced and our share price may be negatively impacted.

Enactment of further privacy laws in the United States, at the state or federal level, or introduction of new services or products that are subject to additional regulations, as well as ensuring compliance of solutions that we obtained through acquisitions, may require us to expend considerable resources to fulfill regulatory obligations, and could carry the potential for significant financial or reputational exposure to our business, delay introduction to the market and affect adoption rates.

 

Claims that we or our service providers have breached our contractual obligations or failed to comply with applicable privacy and data protection laws, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business. In addition to litigation, we could face regulatory investigations, negative market perception, potential loss of business, enforcement notices and/or fines (which, for example, under GDPR / UK regime can be up to 4% of global turnover for the preceding financial year or €20 / £17.5 million, whichever is higher).

 

There is considerable uncertainty regarding the duration, scope and severity of the pandemic or its effects on us and our customers, channel partners, managed service providers or subcontractors, which can result in extended customer sales cycles, reduced demand for our solutions, lower renewal rates, delayed spending on our solutions, smaller deal sizes, lower revenue from new customers, impairment of our ability to collect accounts receivable, reduced payment frequencies, and attrition and availability of employees. Any of the foregoing may have a material adverse impact on our business and results of operations.

Our business depends on our current and prospective customers’ ability and willingness to invest money in IT security, which in turn is dependent upon their overall economic health. Negative economic conditions in the global economy or certain regions, including conditions resulting from financial and credit market fluctuations exchange rate fluctuations, or inflation, could cause a decrease in corporate spending on cybersecurity software. Other matters that influence consumer confidence and spending, including COVID-19 and its reverberating economic consequences, political unrest, public health crises, terrorist attacks, armed conflicts (such as the conflict between Russia and Ukraine) and natural disasters could also negatively affect our customers’ spending on our products and services. Our international operations involve risks that could increase our expenses, adversely affect our operating results, and require increased time and attention of our management. A significant portion of our business operations are concentrated in core geographic areas and if they were to experience economic downturns, this could severely affect our business operations. In addition, some of our business operations depend on emerging markets that are less resilient to fluctuations in the global economy. In 2021, we generated 50.5% of our revenues from the United States, 32.5% of our revenues from Europe, the Middle East and Africa and 17.0% from the rest of the world, which includes countries from the Asia Pacific and Japan region, the Latin America region and Canada.

Our SaaS solutions are hosted by third-party providers of cloud infrastructure services (“Cloud Service Providers”), primarily Amazon Web Services (AWS). We do not have control over the operations or the facilities of Cloud Service Providers that we use and Cloud Service Providers have also in the past experienced and may in the future experience cyberattacks. If any of the services provided by the Cloud Service Providers fail or become unavailable due to extended outages, cyberattacks interruptions or because they are no longer available on commercially reasonable terms or prices, we may be unable to deliver our committed uptime under our service level agreements, our revenues could be reduced, our reputation could be damaged, we could be exposed to legal liability and incur additional expenses, and our ability to manage our finances and our processes for managing sales of our offerings could be interrupted. If we are unable to renew our agreements with our Cloud Service Providers on commercially reasonable terms, or an agreement is prematurely terminated, or we need to add new Cloud Services Providers to increase capacity and uptime, we could experience interruptions, downtime, delays, and additional expenses related to transferring to and providing support for these new platforms. Any of the above circumstances or events may harm our reputation and brand, reduce the availability or usage of our platform and impair our ability to attract new users, any of which could adversely affect our business, financial condition and results of operations.

We rely on our channel partners to market, sell, support and implement our solutions. We expect that indirect sales through our channel partners will continue to account for a significant percentage of our revenue. In the year ended December 31, 2021, we generated approximately 74% of our revenues from sales to channel partners, such as distributors, systems integrators, value-added resellers, managed security service providers and marketplaces, and we expect that channel partners will represent a substantial portion of our revenues for the foreseeable future. Further, we cooperate with advisory firms in marketing our solutions and providing implementation services to our customers, in both direct and indirect sales. Our agreements with channel partners are non-exclusive, meaning our partners may offer customers IT security products from other companies, including products that compete with our solutions.

A portion of our revenues is generated by sales to U.S. and foreign federal, state and local governmental agency customers, and we may in the future increase sales to government entities. Selling to government entities can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that we will complete a sale, or imposing terms of sale which are less favorable than the prevailing market terms. Government demand and payment for our products and services may be impacted by public sector budgetary cycles and funding authorizations, funding reductions, government shutdowns or delays, adversely affecting public sector demand for our products. The foregoing may be intensified due to the effects of COVID-19. Additionally, for purchases by the U.S. government, the government may require certain products to be manufactured, maintained or developed in the United States and other high-cost locations, and we may not manufacture, maintain or develop all products in locations that meet the requirements of the U.S. government. Finally, some government entities require products such as ours to be certified by industry-approved security agencies as a pre-condition of purchasing them. We have initiated the process, and have begun incurring costs, to obtain authorization from the Federal Risk and Authorization Management Program (“FedRAMP”), for certain SaaS products. The grant of such certifications depends on the then-current requirements of the certifying agency and our ability to meet them. We cannot be certain that any certificate will be granted, remain in effect or renewed, or that we would be able to satisfy the technological and other requirements to maintain certifications. The loss of any of our current product certificates, or the failure to obtain new ones, could result in the imposition of various penalties, reputational harm, loss of existing customers, or could deter new and existing customers from purchasing our solutions, additional products or our services, any of which could adversely affect our business, operating results or financial condition.

 

Our functional and reporting currency is the U.S. dollar. In 2021, the majority of our revenues were denominated in U.S. dollars and the remainder primarily in euros and British pounds sterling. In 2021, the majority of our cost of revenues and operating expenses were denominated in U.S. dollars and New Israeli Shekels (NIS) and the remainder primarily in euros and British pounds sterling. Our foreign currency-denominated expenses consist primarily of personnel, marketing programs, rent and other overhead costs. Since the portion of our expenses generated in NIS and British pounds sterling is greater than our revenues in NIS and British pounds sterling, respectively, any appreciation of the NIS or the British pounds sterling relative to the U.S. dollar could adversely impact our operating income. In addition, since the portion of our revenues generated in euros is greater than our expenses incurred in euros, any depreciation of the euro relative to the U.S. dollar would adversely impact our operating income. We estimate that a 10% strengthening or weakening in the value of the NIS against the U.S. dollar would have decreased or increased, respectively, our operating income by approximately $11.6 million in 2021. We estimate that a 10% strengthening or weakening in the value of the euro against the U.S. dollar would have increased or decreased, respectively, our operating income by approximately $2.3 million in 2021. We estimate that a 10% strengthening or weakening in the value of the British pounds sterling against the U.S. dollar would have decreased or increased, respectively, our operating income by approximately $0.9 million in 2021. These estimates of the impact of fluctuations in currency exchange rates on our historic results of operations may be different from the impact of fluctuations in exchange rates on our future results of operations since the mix of currencies comprising our revenues and expenses may change. We evaluate periodically the various currencies to which we are exposed and take hedging measures to reduce the potential adverse impact from the appreciation or the depreciation of our non U.S. dollar-denominated operations, as appropriate. We expect that the majority of our revenues will continue to be generated in U.S. dollars with the balance primarily in euros and British pounds sterling for the foreseeable future, and that a significant portion of our expenses will continue to be denominated in NIS, U.S. dollars, British pounds sterling and in euros. We cannot provide any assurances that our hedging activities will be successful in protecting us from adverse impacts from currency exchange rate fluctuations. In addition, we have monetary assets and liabilities that are denominated in non-U.S. dollar currencies. For example, starting January 1, 2019, in accordance with a then newly introduced lease accounting standard, we were required to present a significant NIS linked liability related to our operational leases in Israel. As a result, significant exchange rate fluctuations could have a negative effect on our net income. See “Item 11—Quantitative and Qualitative Disclosures About Market Risk—Foreign Currency Risk.”

We depend significantly on our sales force and go-to-market organization to attract new customers and expand sales to existing customers. Our ability to grow our revenues depends in part on our success in recruiting, training and retaining sufficient numbers of sales, customer success and marketing personnel to support our growth. The number of our sales, customer success and marketing personnel increased from 772 as of December 31, 2020 to 941 as of December 31, 2021. We expect to continue to expand our sales, customer success and marketing personnel significantly and face a number of challenges in achieving our hiring, retention and integration goals (see “—The tight global labor market has created difficulty to attract and retain qualified personnel, has increased wages and compensation, and has increased employee turnover across industries.  If we are unable to hire, retain and motivate qualified personnel, our business will suffer.”). The training and integration of a large number of sales, customer success and marketing personnel in a short time requires the allocation of significant internal resources. Based on our past experience, it takes an average of approximately six to nine months before a new sales force member operates at target performance levels. We may not be able to recruit at our anticipated rate or achieve or maintain our target performance levels with large numbers of new sales personnel as quickly as we have done in the past, which may materially and adversely impact our projected growth rate. In addition, significant turnover in our sales, customer success or marketing organizations, may impact our ability to retain and expand our customers, obtain new customers or deliver on our revenue, profitability or cash flow generation goals.

 

We generate a substantial portion of our revenues from our products and services that enable our customers to achieve and maintain compliance with certain government regulations and industry standards, and we expect that to continue for the foreseeable future. Governments and other customers may require our products to comply with certain privacy, security or other certifications and standards with respect to those solutions utilized by them as a control demonstrating compliance with government regulations and industry standards. We have maintained a SOC 2 certification for multiple products since 2019. Additionally, we have maintained the ISO 27001 annual certification since April 2017. We are in the process of having several of our Privilege Access Management solutions evaluated for the international Common Criteria certification by the Netherlands Scheme for Certification in the Area of IT Security (NSCIB). We have also initiated the process, and have begun incurring costs, to obtain authorization from the Federal Risk and Authorization Management Program (FedRAMP), for certain SaaS products. However, we are unable to guarantee that we will achieve FedRAMP authorization in a timely manner, or at all. If our products are late in achieving or fail to achieve or maintain compliance with these certifications and standards, or our competitors achieve compliance with these certifications and standards, we may be disqualified from selling our products to such customers, or may otherwise be at a competitive disadvantage, either of which would harm our business, results of operations, and financial condition.

The IT security industry is characterized by the existence of a large number of relevant patents and frequent claims and litigations regarding patent and other intellectual property rights. Leading companies in the IT security industry have extensive patent portfolios. From time to time, third parties have asserted, and in the future may assert, their patent, copyright, trademark and other intellectual property rights against us, our channel partners or our customers. Furthermore, we may be subject to indemnification obligations with respect to third-party intellectual property rights pursuant to our agreements with our customers and channel partners. Such indemnification provisions are customary for our industry. We cannot ensure that we will have the resources to defend against all such claims. Successful claims of infringement or misappropriation by a third party against us or a third party that we indemnify, could prevent us from distributing certain products or performing certain services or could require us to pay substantial damages (including, for example, treble damages if we are found to have willfully infringed patents and increased statutory damages if we are found to have willfully infringed copyrights), royalties or other fees. Such claims also could require us to cease making, licensing or using solutions that are alleged to infringe or misappropriate the intellectual property of others, to expend additional development resources to attempt to redesign our products or services or otherwise to develop non-infringing technology, to enter into potentially unfavorable royalty or license agreements in order to obtain the right to use necessary technologies or intellectual property rights, and to indemnify our customers and channel partners (and parties associated with them). The failure to obtain a license or the costs associated with any license could cause our business, results of operations or financial condition to be materially and adversely affected. Defending against claims of infringement, regardless of their validity, or being deemed to be infringing the intellectual property rights of others could be very expensive and time consuming to defend, harm our reputation and impair our ability to innovate, develop, distribute and sell our current and planned products and services.

The process of obtaining patent protection is expensive and time-consuming, and we may not be able to complete all necessary or desirable patent applications at a reasonable cost or in a timely manner all the way to the successful issuance of a patent. We may choose not to seek patent protection for certain innovations and may choose not to pursue patent protection in certain jurisdictions. Furthermore, it is possible that our patent applications may not be approved, that the scope of our issued patents will be insufficient or not have the coverage originally sought, that our issued patents will not provide us with any competitive advantages, and that our patents and other intellectual property rights may be challenged by others or invalidated through administrative processes or litigation. Finally, issuance of a patent does not guarantee that we have an absolute right to practice the patented invention. Our policy is to require our employees (and our consultants and service providers that develop intellectual property included in our products) to execute written agreements in which they assign to us their rights, if such exist, in potential inventions and other intellectual property created within the scope of their employment (or, with respect to consultants and service providers, their engagement to develop such intellectual property. We cannot be certain that we have adequately protected our rights in every such agreement or that we have executed an agreement with every such party. Finally, in order to benefit from the protection of patents and other intellectual property rights, we must monitor and detect infringement and pursue infringement claims under certain circumstances in relevant jurisdictions. Litigating claims related to the enforcement of intellectual property rights is very expensive and can be burdensome in terms of management time and resources. Any litigation related to intellectual rights or claims against us could result in loss or compromise of our intellectual property rights or could subject us to significant liabilities. As a result, we may not be able to obtain adequate protection or to effectively enforce our issued patents or other intellectual property rights.

We integrate certain open-source software components from third parties into our software, and we expect to continue to use open-source software in the future. Some open-source software licenses require, among other things, that users who distribute or make available as a service, open-source software with their own software products, add appropriate copyright notices and disclaimers, publicly disclose all or part of the source code of the users’ developed software or make available any derivative works of the open-source code under open-source license terms or at no cost. Our efforts to use the open-source software in a manner consistent with the relevant license terms that would not require us to disclose our proprietary code or license our proprietary software at no cost may not be successful. We may face claims by third parties seeking to enforce the license terms applicable to such open-source software, including by demanding the release of our proprietary source code, or we may face termination of such licenses if the owner of the open-source software asserts we are in breach of its license terms. In addition, if the license terms for the open-source code change or the license is terminated, we may be forced to re-engineer our software or incur additional costs. In addition, open-source software typically comes without warranties or indemnities from the owner, whereas we are expected to offer our customers both. Accordingly, if there were technical problems with open-source software that we used in our products, or if such open-source software infringed third-party intellectual property rights, we could have a warranty obligation or infringement indemnity obligation to our customer without a corresponding warranty or indemnification obligation from the owner of the open-source software.

While we scan the open-source software that we use in our products and patch discovered vulnerabilities, we have no assurance that they will be free from vulnerabilities or malicious code, as demonstrated in the 2021 Apache Log4J vulnerabilities. The use of open-source software in our solutions may expose us, and our customers using our solutions, to additional vulnerabilities and security breaches, which may result in significant adverse impacts to us and our customers (see “—Our reputation and business could be harmed due to real or perceived vulnerabilities in our solutions or services or the failure of our customers or third parties to correctly implement, manage and maintain our solutions, resulting in loss of customers, enforcement actions, lawsuits or financial losses.”).

 

From January 2019 through January 2022, our ordinary shares have traded on the Nasdaq Global Select Market (“Nasdaq”) at a price per share between a range of $69.15 and $201.68. In addition, the market price of our ordinary shares could be highly volatile and may fluctuate substantially as a result of many factors, some of which are beyond our control, including, but not limited to:

As a foreign private issuer whose ordinary shares are listed on Nasdaq, we are permitted to follow certain home country corporate governance practices instead of certain rules of Nasdaq. We currently follow Israeli home country practices with regard to the quorum requirement for shareholder meetings and the requirements relating to distribution of our annual report to shareholders. As permitted under the Israeli Companies Law, 5759-1999 (the “Companies Law”), our articles of association provide that the quorum for any meeting of shareholders shall be at least two shareholders present in person or by proxy who hold at least 25% of the voting power of our shares instead of 33 1/3% of our issued share capital (as prescribed by Nasdaq’s rules). Further, as permitted by the Companies Law and in accordance with the generally accepted business practice in Israel, we do not distribute our annual report to shareholders but make it available through our public website. We may in the future elect to follow Israeli home country practices with regard to other matters such as director nomination procedures, separate executive sessions of independent directors and the requirement to obtain shareholder approval for certain dilutive events (such as for the establishment or amendment of certain equity-based compensation plans, issuances that will result in a change of control of the Company, certain transactions other than a public offering involving issuances of a 20% or more interest in the Company and certain acquisitions of the stock or assets of another company). Accordingly, our shareholders may not be afforded the same protection as provided under Nasdaq corporate governance rules. Following our home country governance practices as opposed to the requirements that would otherwise apply to a U.S. company listed on Nasdaq may provide less protection than is accorded to shareholders of domestic issuers. See “Item 16.G. Corporate Governance.”

In November 2019, we issued $575.0 million aggregate principal amount of 0.00% Convertible Senior Notes due 2024 (the “Convertible Notes”). The sale of the Convertible Notes may affect our earnings per share figures, as accounting procedures may require that we include in our calculation of earnings per share the number of ordinary shares into which the Convertible Notes are convertible. The Convertible Notes may be converted, under the conditions and at the premium specified in the Convertible Notes, into cash and our ordinary shares, if any (subject to our right to pay cash in lieu of all or a portion of such shares). If our ordinary shares are issued to the holders of the Convertible Notes upon conversion, there will be dilution to our shareholders’ equity and the market price of our ordinary shares may decrease due to the additional selling pressure in the market. Any downward pressure on the price of our ordinary shares caused by the sale or potential sale of ordinary shares issuable upon conversion of the Convertible Notes could also encourage short sales by third parties, creating additional downward pressure on our share price.

In addition, in connection with the pricing of the Convertible Notes, we entered into privately negotiated capped call transactions (the “Capped Call Transactions”), with certain of the purchasers of the Convertible Notes. The Capped Call Transactions cover, collectively, the number of our ordinary shares underlying the Convertible Notes, subject to anti-dilution adjustments substantially similar to those applicable to the Convertible Notes. The cost of the Capped Call Transactions was approximately $53.6 million. The Capped Call Transactions are expected generally to reduce the potential dilution to the ordinary shares upon any conversion of the Convertible Notes and/or offset any cash payments we are required to make in excess of the principal amount upon conversion of the Convertible Notes under certain events described in the Capped Call Transactions. We are subject to the risk that one or more of the counterparties to the Capped Call Transactions may default, or otherwise fail to perform, or may exercise certain rights to terminate, their obligations under the Capped Call Transactions. Our exposure will depend on many factors but, generally, our exposure will increase if the market price or the volatility of our common stock increases. Upon a default, a failure to perform or a termination of obligations by a counterparty to the Capped Call Transactions, we may suffer adverse tax consequences or experience more dilution than we currently anticipate with respect to our ordinary shares.

Pursuant to Section 404(a) of the Sarbanes-Oxley Act of 2002 (“the Sarbanes-Oxley Act”), we are required to furnish a report by management on the effectiveness of our internal control over financial reporting. Additionally, pursuant to Section 404(b) of the Sarbanes-Oxley Act, we must include an auditor attestation on our internal control over financial reporting.

Generally, if for any taxable year, after the application of certain look-through rules, 75% or more of our gross income is passive income, or at least 50% of the average quarterly value of our assets (which may be measured in part by the market value of our ordinary shares, which is subject to change) are held for the production of, or produce, passive income (as defined in the relevant provisions of the Internal Revenue Code of 1986, as amended (the “Code”)), we would be characterized as a “passive foreign investment company” (“PFIC”), for U.S. federal income tax purposes under the Code. Based on our market capitalization and the nature of our income, assets and business, we believe that we should not be classified as a PFIC for the taxable year that ended December 31, 2021. However, PFIC status is determined annually and requires a factual determination that depends on, among other things, the composition of our income, assets and activities in each taxable year, and can only be made after the close of each taxable year. Furthermore, because the value of our gross assets is likely to be determined in part by reference to our market capitalization, a decline in the value of our ordinary shares may result in our becoming a PFIC. Accordingly, there can be no assurance that we will not be considered a PFIC for any taxable year. If we are a PFIC for any taxable year during which a U.S. Holder (as defined in “Item 10.E. Taxation—Certain United States Federal Income Tax Consequences”) holds our ordinary shares, certain adverse U.S. federal income tax consequences could apply to such U.S. Holder. Prospective U.S. Holders should consult their tax advisors regarding the potential application of the PFIC rules to them. See “Item 10.E. Taxation—Certain United States Federal Income Tax Consequences—Passive Foreign Investment Company Considerations.”

If a U.S. person is treated as owning (directly, indirectly or constructively) at least 10% of the value or voting power of our ordinary shares, such person may be treated as a “U.S. shareholder” with respect to each controlled foreign corporation (“CFC”), in our group (if any). If our group includes one or more U.S. subsidiaries (as has been the case for 2021), certain of our non-U.S. subsidiaries will be treated as CFCs regardless of whether or not we are treated as a CFC. A U.S. shareholder of a CFC may be required to report annually and include in its U.S. taxable income its pro rata share of such CFC’s “Subpart F income,” “global intangible low taxed income” and investments in U.S. property by CFCs, regardless of whether we make any distributions. An individual who is a U.S. shareholder with respect to a CFC generally would not be allowed certain tax deductions or foreign tax credits that would be allowed to a U.S. shareholder that is a U.S. corporation. Failure to comply with these reporting obligations may subject a U.S. shareholder to significant monetary penalties and may prevent the statute of limitations with respect to such U.S. shareholder’s U.S. federal income tax return for the year for which reporting was due from starting. We cannot provide any assurances that we will be able to assist holders of ordinary shares in determining whether any of our non U.S. subsidiaries is treated as a CFC or whether any holder of ordinary shares should be treated as a U.S. shareholder with respect to any such CFC or furnish to any U.S. shareholders information that may be necessary to comply with the aforementioned reporting and tax paying obligations. The United States Internal Revenue Service provided limited guidance on situations in which investors may rely on publicly available alternative information to comply with their reporting and tax paying obligations with respect to foreign controlled CFCs. U.S. investors are strongly advised to consult their own tax advisors regarding the potential application of these rules to their investment in our ordinary shares.

 

For example, there is growing pressure in many jurisdictions and from multinational organizations such as the Organization for Economic Cooperation and Development (“OECD”) and the EU to amend existing international taxation rules in order to align the tax regimes with current global business practices. Specifically, in October 2015, the OECD published its final package of measures for reform of the international tax rules as a product of its Base Erosion and Profit Shifting (“BEPS”) initiative, which was endorsed by the G20 finance ministers. Many of the initiatives in the BEPS package required and resulted in specific amendments to the domestic tax legislation of various jurisdictions and to existing tax treaties. We continuously monitor these developments. Although many of the BEPS measures have already been implemented or are currently being implemented globally (including, in certain cases, through adoption of the OECD’s “multilateral convention” (to which Israel is also a party) to effect changes to tax treaties which entered into force on July 1, 2018 and through the European Union’s “Anti Tax Avoidance” Directives), it is still difficult in some cases to assess to what extent these changes will have on our tax liabilities in the jurisdictions in which we conduct our business or to what extent they may impact the way in which we conduct our business or our effective tax rate due to the unpredictability and interdependency of these potential changes. In January 2019, the OECD announced further work in continuation of the BEPS project, focusing on two “pillars.” On October 8, 2021, 136 countries approved a statement known as the OECD BEPS Inclusive Framework, which builds upon the OECD’s continuation of the BEPS project. The first pillar is focused on the allocation of taxing rights between countries for in-scope large multinational enterprises (with revenue in excess of €20 billion and profitability of at least 10%) that sell goods and services into countries with little or no local physical presence. We do not expect to be within the scope of the first Pillar. The second pillar is focused on developing a global minimum tax rate of at least 15% applicable to in-scope multinational enterprises (with revenue in excess of €750 million). Israel is one of the 136 jurisdictions that has agreed in principle to the adoption of the global minimum tax rate, and it is unclear what would be the impact on Preferred Technological Enterprises currently eligible for reduced corporate tax rate of 12%. Given these developments, it is generally expected that tax authorities in various jurisdictions in which we operate may increase their audit activity and may seek to challenge some of the tax positions we have adopted. It is difficult to assess if and to what extent such challenges, if raised, might impact and potentially increase our future effective tax rate.

 

Our principal executive offices and research and development facilities are located in Israel and therefore may be influenced by regional instability and extreme security tension. Accordingly, political, economic and security conditions in Israel and the surrounding region could directly affect our business. Any political instability, terrorism, armed conflicts, cyberattacks or any other hostilities involving Israel or the interruption or curtailment of trade between Israel and its present trading partners could adversely affect our operations. Additionally, we may also be targeted by cyber terrorists specifically because we are an Israeli company. Ongoing and revived hostilities or other Israeli political or economic factors, could harm our operations and cause any future sales to decrease.

We were granted Approved Enterprise status under the Israeli Law for the Encouragement of Capital Investments, 5719-1959 (the “Investment Law”). We elected the alternative benefits program, pursuant to which income derived from the Approved Enterprise program is tax-exempt for two years and enjoys a reduced tax rate of 10.0% to 25.0% for up to a total of eight years, subject to an adjustment based on the percentage of foreign investors’ ownership. We were also eligible for certain tax benefits provided to Benefited Enterprises under the Investment Law. In March 2013, we notified the Israel Tax Authority that we apply the new tax Preferred Enterprise regime under the Investment Law instead of our Approved Enterprise and Benefited Enterprise. Accordingly, we are eligible for certain tax benefits provided to Preferred Enterprises under the Investment Law. If we do not meet the conditions stipulated in the Investment Law and the regulations promulgated thereunder, as amended, for the Preferred Enterprise, any of the associated tax benefits may be canceled, and we would be required to repay the amount of such benefits, in whole or in part, including interest and CPI linkage (or other monetary penalties). Starting from 2017, we were recognized as eligible for the Technological Preferred Enterprise regime, a sub-category of the Preferred Enterprise regime, which grants enhanced tax benefits to enterprises with significant research and development activities. In the future these tax benefits may be reduced or discontinued. If these tax benefits are reduced, cancelled or discontinued, our Israeli taxable income would be subject to regular Israeli corporate tax rates which would harm our financial condition and results of operation. Additionally, if we increase our activities outside of Israel through acquisitions, for example, our expanded activities might not be eligible for inclusion under future Israeli tax benefit regimes. See “Item 5. Operating and Financial Review and Prospects—Critical Accounting Estimates—Law for the Encouragement of Capital Investments, 5719-1959.” 

We are incorporated in Israel, the majority of our directors and executive officers, and the Israeli auditors listed in this annual report reside outside of the United States, and most of our assets and most of the assets of these persons are located outside of the United States. Therefore, a judgment obtained against us, or any of these persons, including a judgment based on the civil liability provisions of the U.S. federal securities laws, may not be collectible in the United States and may not be enforced by an Israeli court. It also may be difficult for our shareholders to effect service of process on these persons in the United States or to assert U.S. securities law claims in original actions instituted in Israel. Israeli courts may refuse to hear a claim based on an alleged violation of U.S. securities laws reasoning that Israel is not the most appropriate forum in which to bring such a claim. In addition, even if an Israeli court agrees to hear a claim, it may determine that Israeli law and not U.S. law is applicable to the claim. If U.S. law is found to be applicable, the content of applicable U.S. law must be proven as a fact by expert witnesses, which can be a time consuming and costly process. Certain matters of the procedure will also be governed by Israeli law. There is little binding case law in Israel that addresses the matters described above. As a result of the difficulty associated with enforcing a judgment against us in Israel, our shareholders may not be able to collect any damages awarded by either a U.S. or foreign court.

CyberArk Software Ltd. was founded in 1999 with the vision of protecting high-value business data and pioneering our Digital Vault technology. That same year, we began offering our first product, the Sensitive Information Management Solution (previously called the Sensitive Document Vault), which provided a secure platform for our customers’ employees to share sensitive files. We began with our early vaulting technology, which has enabled us to evolve into a company that provides a comprehensive solution to secure identities anchored on Privileged Access Management. In 2005, we introduced our Privileged Access Management Solution, upon which we built our leadership position in the Privileged Access Management market, providing a layer of security that protects high level and high value access across an organization. In September 2014, we listed our ordinary shares on the Nasdaq Stock Market LLC (Nasdaq). In addition to investing in organic research and development, in 2015 we began to execute a merger and acquisition strategy and acquired Viewfinity, Inc., a provider of Windows least privilege management and application control software, as well as Cybertinel Ltd., a cybersecurity company specializing in cyber threat detection technology. In May 2017, we acquired Conjur Inc., a provider of DevOps security software. In May 2020 we acquired IDaptive Holdings, Inc., an Identity as a Service (IDaaS) provider. Based on our organic investment in research and development to drive new product releases and innovation, coupled with the incremental acquisitions of selected technologies and the execution of our go-to-market strategy, today CyberArk is a global leader in Identity Security, centered on Privileged Access Management. We secure access for any identity – human or machine – to help organizations secure critical business assets, protect their distributed workforce and customers, and accelerate business in the cloud.

 

 

 

 

Any of the identities operating in a modern environment (such as employees, partners, IT Admins, DevOps team members and developers, applications or robots, vendors, or customers) might have some level of privilege that, if improperly secured, can provide an attack path into an organization’s most valuable assets. This trend is coupled with the rapid expansion and adoption of hybrid and cloud infrastructure, applications and application programming interfaces (APIs), mobile and remote workers, and use of third parties such as vendors. We now live in a world where the number, types, and interrelationships of identities have exploded, creating new dimensions to the threat landscape.

Zero Trust Security: A conventional security approach that relies on perimeter-based security is relatively less effective and applicable in a modern environment, as organizations adopt cloud and SaaS applications and as more of the workforce continues to work remotely. In parallel, it has become increasingly difficult to keep attackers out of an organization’s network altogether. The expansion of the attack surface and prevalence of threats has led to a growing application of a Zero Trust approach to security.

In alignment with our Identity Security strategy, we sell packaged offerings that align with the requirements of workforce users, privileged users, and external vendors. The workforce user offering includes credential vaulting and sharing, Adaptive MFA, and SSO. The privileged users offering includes full credential management, session management, and Remote Access. The external vendor offering aligns to the capabilities detailed above for Vendor Privileged Access Manager.

Our capabilities in the area of DevSecOps are focused on securing secrets used by machine identities such as applications, scripts, containers, DevOps tools, and third-party security solutions. Secrets Manager enables organizations to avoid the need to store secrets within applications and instead allows them to easily and securely access the required credentials from the CyberArk Vault. Secrets Manager supports traditional applications with its Credential Providers and dynamic applications with Conjur.

Strong Application Authentication and Credential Management.The Secrets Manager (formerly Application Access Manager) architecture allows an organization to eliminate hard-coded application credentials, such as passwords and encryption keys, from applications and scripts. Our secure, proprietary technology permits authentication of an application during run-time, based on any combination of the application’s signature, executable path or IP address, and operating system user. Following application authentication, the authenticated application uses a secure application programming interface (“API”), to request privileged account credentials during run-time and, based on the application permissions in Privileged Access Manager, up-to-date credentials are provided to the application.

In 2021, our marketing investments and campaigns continued to address our customers’ and prospects’ “new normal” of remote work and online engagement versus in-person trade shows, regional events, and in-person meetings. For example, in July 2021 we held our 15^th annual Impact User Conference entirely online. Additional adjustments included replacing in-person regional events with regional online experiences, as well as increased investment and focus on digital marketing channels. We believe that just as parts of the new normal for our customers and prospects will be permanent, our investments, experience, and focus on online events and digital marketing will become a permanent focus of our marketing mix going forward.

 

We believe that our hybrid sales model, which combines the leverage of high-touch, channel sales with the account control of direct sales, has played an important role in the growth of our customer base to date. We maintain a highly trained sales force that is responsible for developing and closing new business, the management of relationships with our channel partners and the support and expansion of relationships with existing customers. Our sales organization is organized by geographic regions, consisting of the Americas, EMEA and Asia Pacific and Japan regions. As of December 31, 2021, our global network of channel partners consisted of more than 450 resellers, distributors, and managed service providers. Our channel partners generally complement our sales efforts by helping identify potential sales targets, maintaining relationships with certain customers and introducing new products to existing customers and offering post-sale professional services and technical support. In 2021 we generated approximately 26% of our revenues from direct sales from our field offices located throughout the world. Approximately 36% of our sales in the United States are direct while most of our sales in the rest of the world, including the EMEA and Asia Pacific and Japan regions, are through channel partners. We work with many global systems integration partners and several leading regional security value added resellers, such as Optiv Security Inc., Merlin International, Computacenter United States Inc., Netpoleon, SHI, M.Tech and GuidePoint Security. These companies were each among our top 15 channel partners in 2020 and 2021 by revenues and we have derived a meaningful amount of revenues from sales to each of them during the last two years. Further, we work with advisory firms such as Deloitte and KPMG in marketing our solutions and providing implementation services to our customers. We also have a joint business relationship contract with PricewaterhouseCoopers LLP in which we may engage in co-marketing and associated co-delivery of solutions and implementation services.

Our maintenance and support program provides all customers who purchase maintenance and support in conjunction with their perpetual licenses, and customers who purchase self-hosted and SaaS subscriptions, the right to software bug repairs, the latest software enhancements, and updates on an if-and-when available basis during the maintenance period or subscription term, and access to our technical support services. Customers who purchase maintenance and support in conjunction with their initial perpetual license purchase typically buy for one year or three years, and can subsequently continue to renew maintenance and support for additional one- or three-year periods. These two alternative maintenance and support periods are common in the software industry. Customers typically pay for each alternative in full at the beginning of their terms but in select situations can opt for annual payments.

 

Our technical support services are provided to perpetual and subscription customers via our online support center, which enables customers to submit new support queries and monitor the status of open and past queries. Our online support system also provides customers with access to our CyberArk Knowledge Base, an online user-driven information repository that provides customers the ability to address their own queries. Additionally, we offer email and telephone support during business hours to customers that purchase a standard support package and 24/7 availability to customers that purchase our 24/7 support or subscription package.

Continued investment in research and development is critical to our business. Our research and development efforts are focused primarily on improving and continuing to enhance existing products and services, as well as developing new products, platforms, features and functionality to meet market needs. We believe the timely development of new products and capabilities is essential to maintaining our competitive position. We regularly release new versions of our software which incorporate new features and enhancements to existing features. We also maintain a dedicated CyberArk Labs team that researches reported cyber-attacks, the attackers’ techniques and post-exploit methods that lead to new security development initiatives for our products and provides thought-leadership on new product capabilities and targeted attack mitigation.

Our current competitors in the Privileged Access Management market include BeyondTrust Corporation, One Identity LLC, and Delinea Inc. (formerly ThycoticCentrify), as well as companies that offer identity security and DevOps solutions, such as Okta Inc., Microsoft Corporation and HashiCorp, Inc. In addition, we may face competition due to changes in the manner that organizations utilize IT assets and the security solutions applied to them, such as the provision of Privileged Access Management functionalities as part of public cloud providers’ infrastructure offerings, or cloud-based identity management solutions.  IT security spending is spread across a wide variety of solutions and strategies, including, for example, endpoint, network and cloud security, vulnerability management and identity and access management. Organizations continually evaluate their security priorities and investments and may allocate their IT security budgets to other solutions and strategies and may not adopt or expand use of our solutions. Accordingly, we may also compete for budgetary reasons, to a certain extent, with additional vendors that offer threat protection solutions in adjacent or complementary markets to ours, such as Palo Alto Networks or CrowdStrike Holdings, Inc.

The audit committee of our board periodically reviews our cybersecurity risks and controls with senior management, keeping our board informed of key issues.

Research and Development. Research and development expenses increased by $46.7 million, or 48.9%, from $95.4 million in 2020 to $142.1 million in 2021. This increase was primarily attributable to a $33.7 million increase in personnel costs and related expenses, as we increased our research and development team headcount from 464 at the end of 2020 to 643 at the end of 2021 to support continued investment in our existing and future product and service offerings. The increase was also attributable to a $7.4 million increase in software and related expenses, a $3.2 million increase in expenses related to consultants and contractors and a $0.9 million increase in research and development personnel recruiting expenses.

Sales and Marketing. Sales and marketing expenses increased by $54.4 million, or 24.7%, from $220.0 million in 2020 to $274.4 million in 2021. This increase was primarily attributable to a $45.7 million increase in personnel costs and related expenses due to increased headcount in all regions to expand our sales and marketing organization. The increase was also attributable to a $5.4 million increase in marketing programs expenses, a $2.5 million increase in software and related expenses and a $0.9 million increase in costs of certifications. Our sales and marketing headcount grew from 772 at the end of 2020 to 941 at the end of 2021.

General and Administrative. General and administrative expenses increased by $11.0 million, or 18.2%, from $60.4 million in 2020 to $71.4 million in 2021. This increase was primarily attributable to an increase of $10.6 million in personnel costs and related expenses due to increased headcount, coupled with a $3.3 million increase in insurance premiums and facilities and depreciation overhead costs, partially offset by a $3.6 million decrease in services fees for external legal counsel, accounting and patent administration. Our general and administrative headcount grew from 144 at the end of 2020 to 175 at the end of 2021.

Additionally, we entered into a non-cancelable material agreement for the receipt of cloud infrastructure services, effective as of April 2021 through March 2024. As of December 31, 2021, our outstanding contractual commitment is $14.4 million due in the next twelve months and $23.8 million due thereafter.

Our accounting policies and their effect on our financial condition and results of operations are more fully described in our consolidated financial statements included elsewhere in this annual report. We have prepared our financial statements in conformity with U.S. GAAP, which requires management to make estimates and assumptions that in certain circumstances affect the reported amounts of assets and liabilities, revenues and expenses and disclosure of contingent assets and liabilities. These estimates are prepared using our best judgment, after considering past and current events and economic conditions. While management believes the factors evaluated provide a meaningful basis for establishing and applying sound accounting policies, management cannot guarantee that the estimates will always be consistent with actual results. In addition, certain information relied upon by us in preparing such estimates includes internally generated financial and operating information, external market information, when available, and when necessary, information obtained from consultations with third parties. Actual results could differ from these estimates and could have a material adverse effect on our reported results. See “Item 3.D. Risk Factors” for a discussion of the possible risks which may affect these estimates.

We primarily generate revenues from providing the right to access our SaaS solutions and licensing the rights to use our software products, as well as from maintenance and professional services. Subscription revenues include SaaS and self-hosted subscription contracts. We sell our products through our direct sales force and indirectly through channel partners.

 

Goodwill and certain other purchased intangible assets have been recorded in our financial statements as a result of acquisitions. In business combinations, in accordance with ASC Topic 805, “Business Combination,” we allocate the fair value of purchase consideration to the tangible assets acquired, liabilities assumed, and intangible assets acquired based on their estimated fair values. Such valuations require us to make significant estimates, assumptions, and judgments, especially with respect to intangible assets. The estimated fair values and useful lives of identifiable intangible assets are based on many factors, including estimates and assumptions of future operating performance and cash flows of the acquired business, market conditions, technological developments and specific characteristics of the identified intangible assets. The allocation of the consideration transferred in certain cases may be subject to revision based on the final determination of fair values during the measurement period, which may be up to one year from the acquisition date.

 

The Investment Law was significantly amended effective April 1, 2005 (the “2005 Amendment”), further amended as of January 1, 2011 (the “2011 Amendment”), and further amended as of January 1, 2017 (the “2017 Amendment”). Pursuant to the 2005 Amendment, tax benefits granted in accordance with the provisions of the Investment Law prior to its revision by the 2005 Amendment remain in force but any benefits granted subsequently are subject to the provisions of the 2005 Amendment. Similarly, the 2011 Amendment introduced new benefits to replace those granted in accordance with the provisions of the Investment Law in effect prior to the 2011 Amendment. However, companies entitled to benefits under the Investment Law as in effect prior to January 1, 2011 were entitled to choose to continue to enjoy such benefits, provided that certain conditions are met, or elect instead, irrevocably, to forego such benefits and have the benefits of the 2011 Amendment apply. The 2017 Amendment introduced new benefits for Technological Enterprises which meet certain conditions, alongside the existing tax benefits.

In addition, a company that has an Approved Enterprise program is eligible for further tax benefits if it qualifies as a Foreign Investors’ Company (“FIC”), which is a company with a level of foreign investment, as defined in the Investment Law, of more than 25%.

The 2017 Amendment provides that a technology company satisfying certain conditions will qualify as a “Preferred Technology Enterprise” (“PTE”) and will thereby enjoy a reduced corporate tax rate of 12% on income that qualifies as PTE which is generally generated by “Benefited Intangible Assets,” as defined in the Investment Law. The tax rate is further reduced to 7.5% for a PTE and/or for its segment located in development Zone A. In addition, a PTE will enjoy a reduced corporate tax rate of 12% on capital gain derived from the sale of certain “Benefitted Intangible Assets” (as defined in the Investment Law) to a related foreign company if the Benefitted Intangible Assets were acquired from a foreign company on or after January 1, 2017 for at least NIS 200 million, and the sale receives prior approval from the National Authority for Technological Innovation (“NATI”).

Ehud (Udi) Mokady is one of our founders and has served as our Chief Executive Officer since 2005 and as chairman of the board since June 2016. He has also served as a member of our board since November 2004. Mr. Mokady previously served as our President from 2005 to 2016 and as our Chief Operating Officer from 1999 to 2005. He has served as a member of the Board of Advisors of Brandeis International Business School since September 2019. Mr. Mokady served as a member of the board of directors of Demisto, Inc. commencing in January 2018 until its acquisition by Palo Alto Networks, Inc. in March 2019. From 1997 to 1999, Mr. Mokady served as general counsel at Tadiran Spectralink Ltd., a producer of secure wireless communication systems. From 1986 to 1989, Mr. Mokady served in a military intelligence unit in the Israel Defense Forces. Mr. Mokady was honored by a panel of independent judges with the New England EY Entrepreneur Of The Year™ 2014 Award in the Technology Security category. Mr. Mokady holds a Bachelor of Laws (LL.B.) from Hebrew University in Jerusalem, Israel and a Master of Science Management (MSM) from Boston University in Massachusetts.

Matthew Cohen has served as our Chief Operating Officer since December 2020 after he served as our Chief Revenue Officer since December 2019. Prior to joining CyberArk, Mr. Cohen held several leadership positions in PTC Inc. (Nasdaq: PTC). His most recent position was Executive Vice President of Field Operations, from February 2018 to November 2019, where he led the go-to-market strategy and all Sales, Commercial Marketing, Customer Success, Services, and Partner functions. Prior to that he was Executive Vice President, Customer Success and Partners from July 2016 to February 2018, Executive Vice President, Global Services from April 2014 through July 2016, and Divisional Vice President, Global Services from October 2013 to March 2014. Before that, Mr. Cohen held various positions in the company’s Global Services group. Mr. Cohen holds a Bachelor of Arts in Psychology from Harvard University.

Donna Rahav has served as our Chief Legal Officer since December 2021. She previously served as our General Counsel and Compliance Officer since March 2014 and as Corporate Secretary from April 2014 until December 2019. Prior to joining CyberArk, Ms. Rahav served as Deputy General Counsel at Allot Communications Ltd. (Nasdaq and TASE: ALLT) from 2011 to 2014 and as legal counsel at Alvarion Ltd. (Nasdaq and TASE: ALVR) 2009 to 2011 and MediaMind Technologies, Inc. (formerly Eyeblaster, Inc.; Nasdaq: MDMD) from 2008 to 2009. Prior to that, from 2005 to 2006 she was an associate at an Israeli law firm specializing in technology transactions. Ms. Rahav holds a Bachelor of Laws (LL.B.) from Tel Aviv University in Israel, and a Master of Laws (LL.M.) from Tel Aviv University in collaboration with University of California, Berkeley, an executive program focused on corporate and commercial law.

Kim Perdikou has served as a member of our board of directors since July 2014 and served as an external director under the Companies Law between July 2014 and May 2016. Ms. Perdikou has served as Chairman of REBBL Inc., since June 2014, a private beverage company. Ms. Perdikou has served as Chairman of The @Company, a private startup Internet Protocol company, from December 2019. Ms. Perdikou serves on the board of Trunomi, Ltd. a private fintech startup, based in Bermuda, from June 2018. Ms. Perdikou serves on the Supervisory Board of Alter Domus, a Financial Services Company based in Luxembourg, since January 2021. From 2010 to August 2013, Ms. Perdikou served as the Executive Vice President for the Office of the Chief Executive Officer at Juniper Networks, Inc. Before that she served as the Executive Vice President and General Manager of Infrastructure Products Group and as Chief Information Officer at Juniper Networks, Inc. from 2006 to 2010 and from August 2000 to January 2006, respectively. Ms. Perdikou served in leadership positions at Women.com, Readers Digest, Knight Ridder, and Dun & Bradstreet. Ms. Perdikou holds a Bachelor of Science degree in computing science with operational research from Paisley University (now the West of Scotland University) in Paisley, Scotland, a Post-Graduate degree in education from Jordanhill College in Glasgow, Scotland and a Master of Science in information systems from Pace University in New York, United States.

Amnon Shoshani has served as a member of our board of directors since November 2009. Since February 1995, Mr. Shoshani has served as the Founder and Managing Partner of Cabaret Holdings Ltd. and, since March 1999, he has also served as Managing Partner of Cabaret Security Ltd., CyberArk’s founding investor and Cabaret and ArbaOne Inc. ventures activities where he had a lead role in managing the group’s portfolio companies. Since 2018, Mr. Shoshani has served as the President and Chairman of the Board of Smartech, a portfolio company of Cabaret and ArbaOne, that provides game changing technologies to the industrial world. Between 2005 and 2018, he served as CEO and Chairman of the Board of Smartech. From 1994 to April 2005, Mr. Shoshani owned a Tel Aviv boutique law firm engaged in entrepreneurship, traditional industries and high tech, which he founded. Mr. Shoshani holds a Bachelor of Law (LL.B.) from Tel Aviv University in Israel.