Edinburgh Worldwide enlightenment: CyberArk

As with any investment, your capital is at risk.

Edinburgh Worldwide has owned CyberArk since 2018, but over that period, it has occupied an increasingly strategic position in the cybersecurity industry. And its commercial relevance has only increased following recent attacks on the Co-operative Group and Marks & Spencer.

CyberArk is a leader in privileged access management (PAM), which are systems that control and monitor access to an organisation’s critical systems and data.

The company is strategically expanding into the rapidly growing machine identity management market. This is highlighted by its $1.5bn acquisition of Venafi, which enhances CyberArk's ability to secure non-human digital identities, such as certificates, keys and application programming interface (API) credentials, allowing one piece of software to talk to another securely.

With machine identities outnumbering human identities by over 45 to 1, this integration significantly broadens CyberArk's market presence and potential customer base.

Why CyberArk matters

Robust identity security solutions are essential in today's landscape of sophisticated cyber threats. With most breaches involving compromised identities, identity management has become central to cybersecurity strategies.

CyberArk addresses these threats with its ‘CyberArk Identity Security Platform’, which manages privileged access across people, machines, and applications.

Unlike traditional perimeter-focused security, CyberArk emphasises controlling privileged access, effectively making identity the new perimeter.

The platform reduces risk by automating identity security tasks, enforcing strict access controls and managing credentials, all of which prevent unauthorised access.

Competitive strengths

CyberArk's competitive advantage lies in its expansive, integrated platform, which is unmatched among identity-centric cybersecurity vendors.

Unlike competitors focusing on limited security areas, CyberArk offers a comprehensive solution set that includes PAM, workforce access, cloud entitlement management, endpoint privilege security, and machine identity management.

This unified approach appeals to enterprises by streamlining security operations, reducing complexity and maintaining robust protection from a single provider.

CyberArk's deep integrations with leading cloud providers, such as Amazon Web Services (AWS), Microsoft Azure and Google Cloud, improve its offering by allowing seamless integration with customers' existing infrastructures. This creates high switching costs, strong customer retention and cross-selling opportunities.

With a substantial customer base, including over half of the Fortune 500 companies, CyberArk solidifies its industry dominance. These relationships provide credibility and a significant barrier to entry for competitors.

Clients often expand their investments from PAM solutions to broader identity management services, resulting in high customer retention and substantial opportunities to sell more advanced services to existing clients.

Growth catalysts

CyberArk's growth is driven by several structural trends:

1. AI-enhanced cyber threats: The rise of sophisticated phishing, automated ransomware and deepfakes, is increasing the need for advanced identity protection.

2. Rapid growth of machine identities: Digital transformation and automation are making the security of machine identities critical. Recent acquisitions, including Venafi for machine identity management and Zilla Security for identity governance and administration (IGA), enhance CyberArk's product offerings in these areas.

3. Rising cybersecurity budgets: Global cybersecurity spending is expected to rise due to increased awareness and regulatory pressures, with identity security being a key focus.

Financial strength

CyberArk surpassed $1bn in annual recurring revenue in 2024. This is the predictable, recurring income the company expects to receive annually from subscriptions and highlights its growth and market leadership.

In 2024, revenue – the income it generates from all its business activities – grew 33 per cent year-over-year, driven by high-margin subscription sales, which now make up over 80 per cent of total sales.

These subscriptions, along with reduced costs due to increased scale, resulted in improved profitability. Strategic investments and disciplined expense management led to positive operating income and free cash flow growth.

Management forecasts 30 per cent revenue growth in 2025, with continued margin enhancements.

Looking Ahead

CyberArk is well-positioned to capitalise on the growing demand for identity-centric cybersecurity, driven by increasing AI-driven cyber threats and rising enterprise cybersecurity budgets. Strategic acquisitions and product innovation place it at the forefront of industry challenges.

Despite a higher valuation than its peers, CyberArk's leadership, product expansion and share in enterprise security spending justify its value. It offers investors a compelling opportunity in a critical, growth-oriented cybersecurity sector.

Past performance

Edinburgh Worldwide Investment Trust plc - Annual discrete performance to 31 March

Source: Morningstar, S&P. Total return in sterling. *S&P Global Small Cap Index.

Past performance is not a guide for future returns.

Important information

The views expressed in this article should not be considered as advice or a recommendation to buy, sell or hold a particular investment. The article contains information and opinion on investments that does not constitute independent investment research, and is therefore not subject to the protections afforded to independent research.

Some of the views expressed are not necessarily those of Baillie Gifford. Investment markets and conditions can change rapidly, therefore the views expressed should not be taken as statements of fact nor should reliance be placed on them when making investment decisions.

Baillie Gifford & Co Limited is wholly owned by Baillie Gifford & Co. Both companies are authorised and regulated by the Financial Conduct Authority and are based at: Calton Square, 1 Greenside Row, Edinburgh EH1 3AN.

The investment trusts managed by Baillie Gifford & Co Limited are listed on the London Stock Exchange and are not authorised or regulated by the Financial Conduct Authority.

A Key Information Document is available by visiting bailliegifford.com

Legal notice

The S&P Global Small Cap Index is a product of S&P Dow Jones Indices LLC or its affiliates ("SPDJI"), and has been licensed for use by Baillie Gifford & Co. S&P®, S&P 500®, US 500, The 500, iBoxx®, iTraxx® and CDX® are trademarks of S&P Global, Inc. or its affiliates ("S&P"); Dow Jones® is a registered trademark of Dow Jones Trademark Holdings LLC ("Dow Jones"); and these trademarks have been licensed for use by SPDJI and sublicensed for certain purposes by Baillie Gifford & Co. Baillie Gifford & Co Product(s) are not sponsored, endorsed, sold or promoted by SPDJI, Dow Jones, S&P, their respective affiliates and none of such parties make any representation regarding the advisability of investing in such product(s) nor do they have any liability for any errors, omissions, or interruptions of the S&P Global Small Cap Index.