Edgar Filing: CyberArk Software Ltd.

zk1618171.htm

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

WASHINGTON, D.C. 20549

FORM 20-F

¨	REGISTRATION STATEMENT PURSUANT TO SECTION 12(b) OR (g) OF THE SECURITIES EXCHANGE ACT OF 1934

x	ANNUAL REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

For the fiscal year ended December 31, 2015

¨	TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

¨	SHELL COMPANY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934

Commission file number 001-36625

CYBERARK SOFTWARE LTD.

(Exact name of Registrant as specified in its charter)

ISRAEL

(Jurisdiction of incorporation or organization)

94 Em-Ha’moshavot Road

Park Ofer, P.O. Box 3143

Petach Tikva 4970602, Israel

(Address of principal executive offices)

Donna Rahav, Adv.

General Counsel & Corporate Secretary

Telephone: +972 (3) 918-0000

CyberArk Software Ltd.

94 Em-Ha’moshavot Road

Park Ofer, P.O. Box 3143

Petach Tikva 4970602, Israel

(Name, telephone, e-mail and/or facsimile number and address of company contact person)

Securities registered or to be registered pursuant to Section 12(b) of the Act:


Title of each class		Name of each exchange on which registered
Ordinary shares, par value NIS 0.01 per share		NASDAQ Global Select Market

Securities registered or to be registered pursuant to Section 12(g) of the Act: None.

Securities for which there is a reporting obligation pursuant to Section 15(d) of the Act: None.

Indicate the number of outstanding shares of each of the issuer’s classes of capital or common stock as of the close of the period covered by the annual report: As of December 31, 2015, the registrant had outstanding 33,289,839 ordinary shares, par value NIS 0.01 per share.

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act.

Yes x No ¨

If this report is an annual or transition report, indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934.

Yes ¨ No x

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.

Yes x No ¨

Indicate by check mark whether the registrant has submitted electronically and posted on its corporate website, if any, every Interactive Data File required to be submitted and posted pursuant to Rule 405 of Regulation S-T (§229.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files).

Yes x No ¨

Indicate by check mark whether the registrant is a large accelerated filer, an accelerated file, or a non-accelerated filer. See the definitions of “accelerated filer” and “large accelerated filer” in Rule 12b-2 of the Exchange Act (Check one):

Large accelerated filer x Accelerated filer ¨ Non-accelerated filer ¨

Indicate by check mark which basis for accounting the registrant has used to prepare the financing statements included in this filing:


U.S. GAAP x			International Financial Reporting Standards as issued by the International Accounting Standards Board ¨	Other ¨

If “Other” has been checked in response to the previous question, indicate by check mark which financial statement item the registrant has elected to follow.

¨ Item 17 ¨ Item 18

If this is an annual report, indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act).

Yes ¨ No x

CYBERARK SOFTWARE LTD.

FORM 20-F

ANNUAL REPORT FOR THE FISCAL YEAR ENDED DECEMBER 31, 2015

TABLE OF CONTENTS

Introduction		1
Special Note Regarding Forward-Looking Statements		1

PART I

Item 1.	Identity of Directors, Senior Management and Advisers	3
Item 2.	Offer Statistics and Expected Timetable	3
Item 3.	Key Information	3
Item 4.	Information on the Company	26
Item 4A.	Unresolved Staff Comments	36
Item 5.	Operating and Financial Review and Prospects	36
Item 6.	Directors, Senior Management and Employees	58
Item 7.	Major Shareholders and Related Party Transactions	83
Item 8.	Financial Information	87
Item 9.	The Offer and Listing	88
Item 10.	Additional Information	89
Item 11.	Quantitative and Qualitative Disclosures About Market Risk	101
Item 12.	Description of Securities Other Than Equity Securities	102

PART II

Item 13.	Defaults, Dividend Arrearages and Delinquencies	103
Item 14.	Material Modifications to the Rights of Security Holders and Use of Proceeds	103
Item 15.	Controls and Procedures	103
Item 16.	[Reserved]	104
Item 16A.	Audit Committee Financial Expert	104
Item 16B.	Code of Ethics	104
Item 16C.	Principal Accountant Fees and Services	105
Item 16D.	Exemptions from the Listing Standards for Audit Committees	105
Item 16E.	Purchases of Equity Securities by the Issuer and Affiliated Purchasers	105
Item 16F.	Change in Registrant’s Certifying Accountant	105
Item 16G.	Corporate Governance	106
Item 16H.	Mine Safety Disclosure	106

PART III

Item 17.	Financial Statements	107
Item 18.	Financial Statements	107
Item 19.	Exhibits	107

INTRODUCTION

In this annual report, the terms “CyberArk,” “we,” “us,” “our” and “the company” refer to CyberArk Software Ltd. and its subsidiaries.

This annual report includes statistical, market and industry data and forecasts, which we obtained from publicly available information and independent industry publications and reports that we believe to be reliable sources. These publicly available industry publications and reports generally state that they obtain their information from sources that they believe to be reliable, but they do not guarantee the accuracy or completeness of the information. Although we believe that these sources are reliable, we have not independently verified the information contained in such publications. Certain estimates and forecasts involve uncertainties and risks and are subject to change based on various factors, including those discussed under the headings “Special Note Regarding Forward-Looking Statements” and “Item 3.D Risk Factors” in this annual report.

Throughout this annual report, we refer to various trademarks, service marks and trade names that we use in our business. The “CyberArk” design logo is the property of CyberArk Software Ltd. CyberArk® is our registered trademark in the United States. We have several other trademarks, service marks and pending applications relating to our products. In particular, although we have omitted the “®” and “™” trademark designations in this annual report from each reference to our Privileged Account Security Solution, Enterprise Password Vault, SSH Key Manager, Privileged Session Manager, Privileged Threat Analytics, Application Identity Manager, On-Demand Privileges Manager, secure Digital Vault, Web Management Interface, Master Policy Engine and Discovery Engine, DNA and Viewfinity, all rights to such names and trademarks are nevertheless reserved. Other trademarks and service marks appearing in this annual report are the property of their respective holders.

SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS

In addition to historical facts, this annual report contains forward-looking statements within the meaning of Section 27A of the U.S. Securities Act of 1933, as amended, or the Securities Act, Section 21E of the U.S. Securities Exchange Act of 1934, as amended, or the Exchange Act, and the safe harbor provisions of the U.S. Private Securities Litigation Reform Act of 1995. These forward-looking statements are subject to risks and uncertainties, and include information about possible or assumed future results of our business, financial condition, results of operations, liquidity, plans and objectives. In some cases, you can identify forward-looking statements by terminology such as “believe,” “may,” “estimate,” “continue,” “anticipate,” “intend,” “should,” “plan,” “expect,” “predict,” “potential,” or the negative of these terms or other similar expressions. The statements we make regarding the following matters are forward-looking by their nature:

our expectations regarding revenues generated by our hybrid sales model;

our expectations regarding our operating and net profit margins;

our expectations regarding significant drivers of our future growth;

our plans to continue to invest in research and development to develop technology for both existing and new products;

our plans to invest in sales and marketing efforts and expand our channel partnerships;

our plans to hire additional new employees;

our plans to leverage our global footprint in existing and new industry verticals to further expand our market share;

our plans to pursue incremental sales by further expanding our customer success team;

our expectations regarding our tax classifications;

our ability to successfully integrate the operations, products and personnel of Cybertinel Ltd. and Viewfinity, Inc., which we recently acquired; and

our plans to pursue additional strategic acquisitions.

The preceding list is not intended to be an exhaustive list of all of our forward-looking statements. The forward-looking statements are based on our beliefs, assumptions and expectations of future performance, taking into account the information currently available to us. These statements are only predictions based upon our current expectations and projections about future events. There are important factors that could cause our actual results, levels of activity, performance or achievements to differ materially from the results, levels of activity, performance or achievements expressed or implied by the forward-looking statements. In particular, you should consider the risks provided under “Item 3.D Risk Factors” in this annual report.

You should not rely upon forward-looking statements as predictions of future events. Although we believe that the expectations reflected in the forward-looking statements are reasonable, we cannot guarantee that future results, levels of activity, performance and events and circumstances reflected in the forward-looking statements will be achieved or will occur. Except as required by law, we undertake no obligation to update publicly any forward-looking statements for any reason after the date of this annual report, to conform these statements to actual results or to changes in our expectations.

PART I

ITEM 1.

IDENTITY OF DIRECTORS, SENIOR MANAGEMENT AND ADVISERS

Not applicable.

ITEM 2.

OFFER STATISTICS AND EXPECTED TIMETABLE

Not applicable.

ITEM 3.

KEY INFORMATION

Selected Financial Data

The following tables set forth our selected consolidated financial data. You should read the following selected consolidated financial data in conjunction with “Item 5. Operating and Financial Review and Prospects” and our consolidated financial statements and related notes included elsewhere in this annual report. Historical results are not necessarily indicative of the results that may be expected in the future. Our financial statements have been prepared in accordance with U.S. Generally Accepted Accounting Principles, or U.S. GAAP.

The selected consolidated statements of operations data for each of the years in the three-year period ended December 31, 2015 and the consolidated balance sheet data as of December 31, 2014 and 2015 are derived from our audited consolidated financial statements appearing elsewhere in this annual report. The consolidated statements of operations data for the years ended December 31, 2011 and 2012 and the consolidated balance sheet data as of December 31, 2011, 2012 and 2013 are derived from our audited consolidated financial statements that are not included in this annual report.

	Year ended December 31,
	2011			2012		2013			2014			2015
	(in thousands except share and per share data)
Consolidated Statements of Operations:
Revenues:
License	$	21,125		$	27,029	$	38,907		$	61,320		$	100,113
Maintenance and professional services		15,240			20,179		27,250			41,679			60,699
Total revenues		36,365			47,208		66,157			102,999			160,812
Cost of revenues:
License		899			1,002		1,216			2,654			5,088
Maintenance and professional services		4,517			5,922		7,860			12,053			17,572
Total cost of revenues(1)		5,416			6,924		9,076			14,707			22,660
Gross profit		30,949			40,284		57,081			88,292			138,152
Operating expenses:
Research and development(1)		6,272			7,273		10,404			14,400			21,734
Sales and marketing(1)		15,929			22,081		32,840			44,943			66,206
General and administrative(1)		3,077			3,297		4,758			8,495			16,990
Total operating expenses		25,278			32,651		48,002			67,838			104,930
Operating income		5,671			7,633		9,079			20,454			33,222
Financial income (expenses), net		(190	)		4		(1,124	)		(5,988	)		(1,479	)
Income before taxes on income		5,481			7,637		7,955			14,466			31,743
Tax benefit (taxes on income)		392			225		(1,320	)		(4,512	)		(5,949	)
Net income	$	5,873		$	7,862	$	6,635		$	9,954		$	25,794
Basic net income per ordinary share(2)	$	0.43		$	0.51	$	0.25		$	0.46		$	0.80
Diluted net income per ordinary share(2)	$	0.26		$	0.31	$	0.14		$	0.34		$	0.73
Weighted average number of ordinary shares used in computing basic net income per ordinary share(2)		4,969,489			6,592,997		6,900,433			13,335,059			32,124,772
Weighted average number of ordinary shares used in computing diluted net income per ordinary share(2)		22,791,354			25,245,790		10,765,914			29,704,730			35,322,716

	As of December 31,
	2011		2012		2013		2014		2015
	(in thousands)
Consolidated Balance Sheet Data:
Cash, cash equivalents and short-term bank deposits	$	33,353	$	45,995	$	65,368	$	177,181	$	238,252
Deferred revenue, current and long term		9,302		15,068		24,478		32,160		54,389
Working capital(3)		28,234		38,908		48,900		156,829		197,095
Total assets		47,654		64,379		89,632		210,552		334,424
Preferred share warrant liability		512		688		2,134		—		—
Total shareholders’ equity		30,290		38,494		45,846		155,008		246,670

(1)	Includes share-based compensation expense as follows:

	Year ended December 31,
	2011		2012		2013		2014		2015
	(in thousands)
Cost of revenues	$	70	$	32	$	39	$	137	$	499
Research and development		481		58		73		172		1,507
Sales and marketing		432		81		126		347		2,214
General and administrative		693		113		165		917		2,829

Total share-based compensation expenses	$	1,676	$	284	$	403	$	1,573	$	7,049

(2)	Basic and diluted net income per ordinary share is computed based on the weighted average number of ordinary shares outstanding during each period. For additional information, see note 11 to our consolidated financial statements included elsewhere in this annual report.

(3)

We define working capital as total current assets minus total current liabilities. In November 2015, the Financial Accounting Standards Board or the FASB issued Accounting Standards Update No. 2015-17, Income Taxes (Topic 740): Balance Sheet Classification of Deferred Taxes (ASU 2015-17), which simplifies the presentation of deferred income taxes by requiring deferred tax assets and liabilities to be classified as noncurrent on the balance sheet. We early adopted this standard retrospectively and reclassified all of our current deferred tax assets to noncurrent deferred tax assets which has resulted in a change to previously published working capital amounts for the years ended December 31, 2011, 2012, 2013 and 2014.

Non-GAAP operating income and non-GAAP net income are non-GAAP financial measures. We define non-GAAP operating income and non-GAAP net income as operating income and net income, respectively, which each exclude (i) share-based compensation expense, (ii) expenses related to the March 2015 public offering of ordinary shares by certain of our shareholders and to the June 2015 public offering of ordinary shares by us and certain of our shareholders, (iii) expenses related to acquisitions and (iv) amortization of intangible assets related to acquisitions. Non-GAAP net income also excludes (i) financial expenses resulting from the revaluation of warrants to purchase preferred shares and (ii) tax effects related to the non-GAAP adjustments set forth above. The following tables reconcile operating income and net income, the most directly comparable U.S. GAAP measures, to non-GAAP operating income and non-GAAP net income for the periods presented:

	2011		2012		2013		2014		2015

Reconciliation of Operating Income to Non-GAAP Operating Income:
Operating income	$	5,671	$	7,633	$	9,079	$	20,454	$	33,222
Share-based compensation		1,676		284		403		1,573		7,049
Public offering related expenses		–		–		–		–		1,568
Acquisition related expenses		–		–		–		–		677
Amortization of intangible assets – Cost of revenues		–		–		–		–		359
Amortization of intangible assets – Research and development		–		–		–		–		749
Amortization of intangible assets – Sales and marketing		–		–		–		–		17

Non-GAAP operating income	$	7,347	$	7,917	$	9,482	$	22,027	$	43,641

	Year ended December 31,
	2011		2012		2013		2014		2015
	(in thousands)
Reconciliation of Net Income to Non-GAAP Net Income:
Net income	$	5,873	$	7,862	$	6,635	$	9,954	$	25,794
Share-based compensation		1,676		284		403		1,573		7,049
Warrant adjustment		179		176		1,446		4,309		–
Public offering related expenses		–		–		–		–		1,568
Acquisition related expenses		–		–		–		–		677
Amortization of intangible assets – Cost of revenues		–		–		–		–		359
Amortization of intangible assets – Research and development		–		–		–		–		749
Amortization of intangible assets – Sales and marketing		–		–		–		–		17
Taxes on income related to non-GAAP adjustments		–		–		–		–		(951	)

Non-GAAP net income	$	7,728	$	8,322	$	8,484	$	15,836	$	35,262

For a description of how we use non-GAAP operating income and non-GAAP net income to evaluate our business, see “Item 5. Operating and Financial Review and Prospects—Key Financial Metrics.” We believe that these non-GAAP financial measures are useful in evaluating our business because of varying available valuation methodologies, subjective assumptions and the variety of equity instruments that can impact a company’s non-cash expenses and because they exclude one-time cash expenditures that do not reflect the performance of our core business. We believe that providing non-GAAP operating income and non-GAAP net income that exclude, as appropriate, share-based compensation expenses, expenses relating to public offerings of our ordinary shares, financial expenses resulting from the valuation of warrants to purchase preferred shares, expenses related to acquisitions, amortization of intangible assets related to acquisitions and the tax effects related to these non-GAAP adjustments allows for more meaningful comparisons between our operating results from period to period. Share-based compensation expense has been, and will continue to be for the foreseeable future, a significant recurring expense in our business and an important part of the compensation we provide to employees. Additionally, excluding financial expenses with respect to revaluation of warrants to purchase preferred shares allows for more meaningful comparison between our net income from period to period. As these warrants were exercised in connection with our initial public offering, they are no longer revalued at each balance sheet date. We also believe that expenses related to the public offerings of our ordinary shares in March 2015 and June 2015, expenses related to our acquisitions and amortization of intangible assets related to acquisitions do not reflect the performance of our core business and would impact period-to-period comparability.

Other companies, including companies in our industry, may calculate non-GAAP operating income and non-GAAP net income differently or not at all, which reduces their usefulness as a comparative measure. You should consider non-GAAP operating income and non-GAAP net income along with other financial performance measures, including operating income and net income, and our financial results presented in accordance with U.S. GAAP.

Capitalization and Indebtedness

Not applicable.

Reasons for the Offer and Use of Proceeds

Not applicable.

Risk Factors

Our business faces significant risks. You should carefully consider all of the information set forth in this annual report and in our other filings with the United States Securities and Exchange Commission, or the SEC, including the following risk factors which we face and which are faced by our industry. Our business, financial condition and results of operations could be materially and adversely affected by any of these risks. In that event, the trading price of our ordinary shares would likely decline and you might lose all or part of your investment. This report also contains forward-looking statements that involve risks and uncertainties. Our results could materially differ from those anticipated in these forward-looking statements, as a result of certain factors including the risks described below and elsewhere in this report and our other SEC filings. See “Special Note Regarding Forward-Looking Statements” on page i.

Risks Related to Our Business and Our Industry

The IT security market is rapidly evolving within the increasingly challenging cyber threat landscape. If the industry does not continue to develop as we anticipate, our sales may not continue to grow at current rates or may decline, and our share price could decline.

We operate in a rapidly evolving industry focused on securing organizations’ IT systems and sensitive data. Our solutions focus on safeguarding privileged accounts, which are those accounts within an organization that give the user high levels of access, or “privileged” access, to IT systems, infrastructure, industrial control systems, applications and data. While breaches of such privileged accounts have gained media attention in recent years, IT security spending within enterprises is often concentrated on endpoint and web security products designed to stop threats from penetrating corporate networks. Organizations that use these security products may allocate all or most of their IT security budgets to these products and may not adopt our solutions in addition to such products. Further, security solutions such as ours, which are focused on disrupting cyber attacks by insiders and external perpetrators that have penetrated the organization’s perimeter, is a relatively new technology that has been developed to respond to advanced threats and more rigorous compliance standards and audit requirements. However, advanced cyber attackers are skilled at adapting to new technologies and developing new methods of gaining access to organizations’ sensitive data. Changes in the nature of advanced cyber threats could result in a shift in IT budgets away from solutions such as ours. In addition, any changes in compliance standards or audit requirements that deemphasize the types of controls, storage, monitoring and analysis that our solutions provide would adversely impact demand for our offerings. It is therefore difficult to predict how large the market will be for our solutions. If solutions such as ours are not viewed by organizations as necessary, or if customers do not recognize the benefit of our solutions as a critical layer of an effective security strategy, then our revenues may not continue to grow at their current rate or may decline, and our share price could suffer.

Our business and operations will be negatively affected if we fail to effectively manage our growth.

We have experienced significant growth in a relatively short period of time and intend to continue to aggressively grow our business. Our revenues grew from $66.2 million in 2013 to $160.8 million in 2015. Our headcount has increased from 317 as of December 31, 2013 to 644 as of December 31, 2015, in part attributable to 49 employees who were hired in connection with our acquisitions of Viewfinity and Cybertinel in 2015. We plan to hire additional employees in 2016 across all areas of the organization. In addition, the number of customers that we serve has grown significantly over the same period. Our rapid growth has placed significant demands on our management, sales and operational and financial infrastructure, and our growth will continue to place significant demands on these resources. Further, in order to manage our current and future growth effectively, we must continue to improve and expand our IT and financial infrastructure, operating and administrative systems and controls and efficiently manage headcount, capital and processes. We may not be able to successfully scale or implement these improvements in a manner that keeps pace with our growth, is timely or efficient, and our failure to do so may materially impact our projected growth rate.

As we invest in the growth of our business, we expect our operating and net profit margins and our revenue growth rate to decline in the near-term.

As we invest in the growth of our business, we expect our operating and net profit margins and our operating and net income to decline compared to prior period. During the year ended December 31, 2015, we did not experience such declines due to an increase in revenue at a rate that exceeded the increase in expenses; however, in future periods, we expect our operating and net profit margins to decline, primarily as a result of the costs associated with expanding our direct and indirect sales forces and marketing activities, our increased rate of investment in research and development and our increased administrative costs associated with scaling our business and improving internal processes, including with relation to operating as a public company. We expect that these invested costs will adversely impact our operating and net profit margins as we may not be able to increase our revenue at a rate sufficient to offset the expected increase in our costs. It will take time and resources to train and integrate new sales force members and to implement such infrastructure improvements across our global operations. In addition, costs associated with adding new personnel to our sales force are expensed before their positive impact on our sales is recognized, and even then a significant portion of any revenues that they generate from maintenance and professional services are deferred over the delivery period of those services. Further, for the year ended December 31, 2011 to the year ended December 31, 2015 our revenue grew from $36.4 million to $160.8 million, which represents a compounded annual growth rate of approximately 45%. We expect that our revenue growth rate will decline as we continue to grow. A failure to meet market expectations regarding our revenue growth rate or profitability could have an adverse effect on our share price.

Our reputation and business could be harmed based on real or perceived shortcomings, defects or vulnerabilities in our solutions or the provision of our services, or due to the failure of our customers or channel partners to correctly implement, manage and maintain our solutions, which may subject us to lawsuits and financial losses.

Organizations are facing increasingly sophisticated and targeted cyber threats, including the growing threat of cyber terrorism throughout the world. If we fail to identify and respond to new and increasingly complex methods of attack on privileged accounts and update our products to detect or prevent such threats, which will require significant resources, our business and reputation will suffer. In particular, we may suffer significant adverse publicity and reputational harm if our solutions (or the services we provide in relation to our solutions) are associated, or are believed to be associated, with a significant breach or a breach at a high profile customer network, or in the event of a breach in third party systems utilized by us as part of our cloud-based security solution. In addition, we may need to devote more resources to address security vulnerabilities in our solutions, and the cost of addressing these vulnerabilities could reduce our operating margins. If we do not address security vulnerabilities, or otherwise provide adequate security features in our products, certain customers, particularly government customers, may delay or stop purchasing our products.

False detection of threats, while typical in our industry, may reduce perception of the reliability of our products and may therefore adversely impact market acceptance of our products. If our solutions restrict legitimate privileged access by authorized personnel to IT systems and applications by falsely identifying those users as an attack or otherwise unauthorized, our customers’ businesses could be harmed. There can be no assurance that, despite testing by us, errors will not be found in existing and new versions of our products, resulting in loss of or delay in market acceptance. In such an event, we may be required, or may choose, for customer relations or other reasons, to expend additional resources in order to help correct the problem.

As our solutions not only reinforce but also rely on the common security concept of placing multiple layers of security controls throughout an IT system, the failure of our customers or our channel partners to correctly implement and effectively manage and maintain our solutions, or to consistently implement and utilize generally accepted and comprehensive, multi-layered security measures and processes in the customer networks, may lessen the efficacy of our solutions. Additionally, our customers or our channel partners may independently develop plug-ins or change existing plug-ins or APIs that we provided to them for interfacing purposes in an incorrect or insecure manner. Such failure or these other customer and partner actions may lead to breaches of our customers’ IT systems and loss of sensitive data, and potentially to a perception that our solutions failed. Further, our failure to provide our customers and channel partners with adequate services related to the use, implementation and maintenance of our solutions, could lead to claims against us.

An actual or perceived security breach or theft of our customers’ data, regardless of whether the breach or theft is attributable to the failure of our products (or the services we provided in relation to our products), could adversely affect the market’s perception of the efficacy of our solutions and current or potential customers may look to our competitors for alternatives to our solutions. An actual or perceived failure of our products, or our failure to provide adequate services to our customers and channel partners, may also subject us to lawsuits, indemnity claims and financial losses, as well as the expenditure of significant financial resources to analyze, correct or eliminate any vulnerabilities. It could also cause us to suffer reputational harm, lose existing customers, or deter new and existing customers from purchasing our solutions, additional products or our services.

Our quarterly results of operations may fluctuate for a variety of reasons, including our failure to close significant sales before the end of a particular quarter.

A meaningful portion of our revenues is generated by significant sales to new customers and sales of additional products to existing customers. Purchases of our products and services often occur at the end of each quarter, particularly in the last quarter of the year. In addition, our sales cycle can last several months from proof of concept to delivery of our solutions to our customers, and this sales cycle can be even longer, less predictable and more resource-intensive for larger sales. Customers may also require additional internal approvals or seek to test our products for a longer trial period before deciding to purchase our solutions. As a result, the timing of individual sales can be difficult to predict. In some cases, sales have occurred in a quarter subsequent to those we anticipated, or have not occurred at all, which can significantly impact our quarterly results and make it more difficult to meet market expectations. Furthermore, even if we close a sale during a given quarter we may be unable to recognize the revenues derived from such sale during the same period due to our revenue recognition policy. See “Item 5.A. Operating and Financial Review and Prospects—Operating Results—Application of Critical Accounting Policies and Estimates—Revenue Recognition.”

In addition to the sales cycle-related fluctuations noted above, our results of operations will continue to vary as a result of a number of factors, many of which are outside of our control and may be difficult to predict, including:

our ability to attract and retain new customers;

our ability to sell additional products to current customers;

the ability of our service operation to keep pace with license sales to new and existing customers;

changes in customer or channel partner requirements or market needs;

changes in the growth rate of the information security market;

the timing and success of new product and service introductions by us or our competitors or any other change in the competitive landscape of the information security market, including consolidation among our customers or competitors;

a disruption in, or termination of, our relationship with channel partners;

our ability to successfully expand our business globally;

reductions in maintenance renewal rates;

changes in our pricing policies or those of our competitors;

general economic conditions in our markets;

future accounting pronouncements or changes in our accounting policies or practices;

the amount and timing of our operating costs;

a change in our mix of products and services; and

increases or decreases in our expenses caused by fluctuations in foreign currency exchange rates.

Any of the above factors, individually or in the aggregate, may result in significant fluctuations in our financial and other operating results from period to period. These fluctuations could result in our failure to meet our operating plan or the expectations of investors or analysts for any period. If we fail to meet such expectations for these or other reasons, the market price of our ordinary shares could fall substantially, and we could face costly lawsuits, including securities class action suits.

If we are unable to acquire new customers, our future revenues and operating results will be harmed.

Our success depends on our ability to acquire new customers. The number of customers that we add in a given period impacts both our short-term and long-term revenues. If we are unable to attract a sufficient number of new customers, we may be unable to generate revenue growth at desired rates. The IT security market is competitive and many of our competitors have substantial financial, personnel, and other resources that they utilize to develop products and attract customers. As a result, it may be difficult for us to add new customers to our customer base. Competition in the marketplace may also lead us to win fewer new customers or result in us providing discounts and other commercial incentives. Additional factors that impact our ability to acquire new customers include the perceived need for IT security, the size of our prospective customers’ IT budgets, the utility and efficacy of our existing and new offerings, whether proven or perceived, and general economic conditions. These factors may have a meaningful negative impact on future revenues and operating results.

If we are unable to sell additional products and services to our existing customers, our future revenues and operating results will be harmed.

A significant portion of our revenues are generated from sales to existing customers. Our future success depends, in part, on our ability to continue to sell new licenses and incremental licenses to our existing customers. We devote significant efforts to developing, marketing and selling additional licenses and associated maintenance and support to existing customers and rely on these efforts for a portion of our revenues. These efforts require a significant investment in building and maintaining customer relationships, as well as significant research and development efforts in order to provide product upgrades and launch new products. The rate at which our existing customers purchase additional products and services depends on a number of factors, including the perceived need for additional IT security, the efficacy of our solutions and the utility of our new offerings, whether proven or perceived, our customers’ IT budgets, general economic conditions, our customers’ overall satisfaction with the maintenance and professional services we provide and the continued growth and economic health of our customer base. If our efforts to sell additional products and services to our customers are not successful, our future revenues and operating results will be harmed.

We face intense competition from IT security vendors, some of which are larger and better known than we are, and we may lack sufficient financial or other resources to maintain or improve our competitive position.

The IT security market in which we operate is characterized by intense competition, constant innovation and evolving security threats. We compete with companies that offer a broad array of IT security products. Our current and potential future competitors include CA, Inc., Dell Inc., International Business Machines Corporation, Microsoft Corporation and Oracle Corporation in the access and identity management market, and may also include providers of advanced threat protection solutions such as Hewlett-Packard Company, EMC Corporation (which has signed an agreement to be acquired by Dell Inc.), International Business Machines Corporation, FireEye, Inc., Splunk Inc., Check Point Software Technologies Ltd. and Palo Alto Networks, Inc. and other smaller companies that offer point solutions with a more limited range of functionality than our own offerings. Some of our competitors are large companies that have the technical and financial resources and broad customer bases needed to bring competitive solutions to the market and already have existing relationships as a trusted vendor for other products. Such companies may use these advantages to offer products and services that are perceived to be as effective as ours at a lower price or for free as part of a larger product package or solely in consideration for maintenance and services fees. They may also develop different products to compete with our current solutions and respond more quickly and effectively than we do to new or changing opportunities, technologies, standards or client requirements. Additionally, from time to time we may compete with smaller regional vendors that offer products with a more limited range of capabilities that purport to perform functions similar to our solutions. Such companies may enjoy stronger sales and service capabilities in their particular regions.

Our competitors may enjoy potential competitive advantages over us, such as:

greater name recognition, a longer operating history and a larger customer base, notwithstanding the increased visibility of our brand following our initial public offering;

larger sales and marketing budgets and resources;

broader distribution and established relationships with channel and distribution partners and customers;

increased effectiveness in protecting, detecting and responding to cyber attacks.

greater customer support resources;

greater speed at which a solution can be deployed;

greater resources to make acquisitions;

larger intellectual property portfolios; and

greater financial, technical and other resources

Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their resources. Current or potential competitors may be acquired by third parties with greater available resources. As a result of such acquisitions, our current or potential competitors might be able to adapt more quickly to new technologies and customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of other opportunities more readily or develop and expand their product and service offerings more quickly than we do. Larger competitors with more diverse product offerings may reduce the price of products that compete with ours in order to promote the sale of other products or may bundle them with other products, which would lead to increased pricing pressure on our products and could cause the average sales prices for our products to decline.

In addition, other IT security technologies exist or could be developed in the future by current or future competitors, and our business could be materially and adversely affected if such technologies are widely adopted.

We may not be able to successfully anticipate or adapt to changing technology or customer requirements on a timely basis, or at all. If we fail to keep up with technological changes or to convince our customers and potential customers of the value of our solutions even in light of new technologies, our business, results of operations and financial condition could be materially and adversely affected.

If our internal network system is compromised by cyber attackers or other data thieves, public perception of our products and services will be harmed.

We will not succeed unless the marketplace is confident that we provide effective IT security protection. We provide privileged account security products, and as such we may be an attractive target for attacks by cyber attackers or other data thieves since a breach of our system could provide data information regarding not only us, but potentially regarding the customers that our solutions protect. As a result of our initial public offering in September 2014, we have enjoyed increased visibility as a company, which could have the effect of attracting the attention of more hackers than would otherwise target us for data theft. Further, we may be targeted by cyber terrorists because we are an Israeli company. If we experience an actual or perceived breach of our network or privileged account security in our systems, it could adversely affect the market perception of our products and services. Further, a security breach could impair our ability to operate our business, including our ability to provide maintenance and support services to our customers. If this happens, our revenues could decline and our business could suffer.

If we do not effectively expand, train and retain our sales and marketing personnel, we may be unable to acquire new customers or sell additional products and services to existing customers, and our business will suffer.

We depend significantly on our sales force to attract new customers and expand sales to existing customers. We generate approximately 40% of our revenues from direct sales. As a result, our ability to grow our revenues depends in part on our success in recruiting, training and retaining sufficient numbers of sales personnel to support our growth, particularly in the United States. The number of our sales and marketing personnel increased from 202 as of December 31, 2014 to 294 as of December 31, 2015. We expect to continue to expand our sales and marketing personnel significantly and face a number of challenges in achieving our hiring and integration goals. There is intense competition for individuals with sales training and experience. In addition, the training and integration of a large number of sales and marketing personnel in a short time requires the allocation of significant internal resources. We invest significant time and resources in training new sales force personnel to understand our solutions and growth strategy. Based on our past experience, it takes an average of approximately six to nine months before a new sales force member operates at target performance levels. However, we may be unable to achieve or maintain our target performance levels with large numbers of new sales personnel as quickly as we have done in the past. Our failure to hire a sufficient number of qualified sales force members and train them to operate at target performance levels may materially and adversely impact our projected growth rate.

We rely on channel partners, including systems integrators, distributors and value-added resellers, to generate a significant portion of our revenue. If we fail to maintain successful relationships with our channel partners, or if our channel partners fail to perform, our ability to market, sell and distribute our solutions will be limited, and our business, financial position and results of operations will be harmed.

In addition to our direct sales force, we rely on our channel partners to sell and support our solutions, particularly in Europe and the Asia Pacific and Japan regions. We expect that sales through our channel partners will continue to account for a significant percentage of our revenue. We generate approximately 60% of our revenues from sales to channel partners and we expect that channel partners will represent a substantial portion of our revenues for the foreseeable future. Our agreements with channel partners are non-exclusive, meaning our partners may offer customers IT security products from other companies, including products that compete with our solutions. If our channel partners do not effectively market and sell our solutions, or choose to use greater efforts to market and sell their own products and services or the products and services of our competitors, our ability to grow our business will be adversely affected. Our channel partners may cease or deemphasize the marketing of our solutions with limited or no notice and with little or no penalty. Further, new channel partners require training and may take several months or more to achieve productivity. The loss of a substantial number of our channel partners, the inability to replace them or the failure to recruit additional channel partners could materially and adversely affect our results of operations. Our reliance on channel partners could also subject us to lawsuits or reputational harm if, for example, a channel partner misrepresents the functionality of our solutions to customers or violates laws or our corporate policies. Our ability to grow revenues in the future will depend in part on our success in maintaining successful relationships with our channel partners and training our channel partners to independently sell and install our solutions. If we are unable to maintain our relationship with channel partners or otherwise develop and expand our indirect sales channel, or if our channel partners fail to perform, our business, financial position and results of operations could be adversely affected.

If our products fail to help our customers achieve and maintain compliance with certain government regulations and industry standards, our business and results of operations could be materially and adversely affected.

We generate a substantial portion of our revenues from our products and services because they enable our customers to achieve and maintain compliance with certain government regulations and industry standards, and we expect that will continue for the foreseeable future. Examples of industry standards and government regulations include the Payment Card Industry Data Security Standard (PCI-DSS); the Federal Information Security Management Act (FISMA); the Sarbanes-Oxley Act; the North American Electric Reliability Corporation Critical Infrastructure Protection Plan (NERC-CIP);; and the Monetary Authority of Singapore’s Technology Risk Management Notices (MAS TRM). These industry standards may change with little or no notice, including changes that could make them more or less onerous for businesses. In addition, governments may also adopt new laws or regulations, or make changes to existing laws or regulations, that could impact whether our solutions enable our customers to maintain compliance with such laws or regulations. If we are unable to adapt our solutions to changing government regulations and industry standards in a timely manner, or if our solutions fail to expedite our customers’ compliance initiatives, our customers may lose confidence in our products and could switch to products offered by our competitors. In addition, if government regulations and industry standards related to IT security are changed in a manner that makes them less onerous, our customers may view compliance as less critical to their businesses, and our customers may be less willing to purchase our products and services. In either case, our sales and financial results would suffer.

Our model for long-term growth depends upon the introduction of new products. If we are unable to develop new products or if these new products are not adopted by customers, our growth will be adversely affected.

Our business depends on the successful development and marketing of new products, including adding complementary offerings to our current products. For example, we introduced our first behavioral analytics product, Privileged Threat Analytics, in December 2013, continued the expansion of our proactive, controls monitoring and management product line with the introduction of SSH Key Manager in November 2014 and added Viewfinity to that same product line following our acquisition of Viewfinity, Inc. in October 2015. Development and marketing of new products requires significant up-front research, development and other costs, and the failure of our new products to gain market acceptance may result in a failure to achieve future sales and adversely affect our competitive position. There can be no assurance that any of our new or future products will achieve market acceptance or generate revenues at forecasted rates or that the margins generated from their sales will allow us to recoup the costs of our development efforts.

If we are unable to hire, retain and motivate qualified personnel, our business will suffer.

Our future success depends, in part, on our ability to continue to attract and retain highly skilled personnel. Our inability to attract or retain qualified personnel or delays in hiring required personnel may seriously harm our business, financial condition and results of operations. Any of our employees may terminate their employment at any time. Additionally, two of our U.S. executive officers have not signed non-compete agreements with us. Competition for highly skilled personnel is frequently intense, especially in Israel, where we are headquartered. Further, certain of our employees are substantially vested in significant equity incentive plans, and their ability to exercise those options and sell their shares in a public market may result in a larger than normal turn-over rate. We may struggle to retain employees because our profile, which has been raised since our initial public offering, may attract competitors who may then actively seek to hire skilled personnel away from us. In addition, to the extent we hire personnel from competitors, we may be subject to allegations that they have been improperly solicited or divulged proprietary or other confidential information.

Failure by us or our channel partners to maintain sufficient levels of customer support could have a material adverse effect on our business, financial condition and results of operations.

Our customers depend in large part on customer support and professional services delivered through our channel partners or by us to resolve issues relating to the use of our solutions. However, even with our support and that of our channel partners, our customers are ultimately responsible for effectively using our solutions and ensuring that their IT staff is properly trained in the use of our products and complementary security products and processes. The failure of our channel partners to support and train our customers in the correct use of our solutions, or their failure to effectively assist customers in installing our solutions and providing effective ongoing support, may result in an increase in the vulnerability of our customers’ IT systems and sensitive data. Additionally, if our channel partners do not effectively provide support and professional services to the satisfaction of our customers, we may be required to provide support to such customers, which would require us to invest in additional personnel, which requires significant time and resources. We may not be able to keep up with demand, particularly if the sales of our solutions exceed our internal forecasts. To the extent that we or our channel partners are unsuccessful in hiring, training and retaining adequate support resources, our ability and the ability of our channel partners to provide adequate and timely support to our customers will be negatively impacted, and our customers’ satisfaction with our products will be adversely affected. Accordingly, our failure to provide satisfactory maintenance and technical support services could have a material and adverse effect on our business and results of operations.

If we do not successfully anticipate market needs and enhance our existing products or develop new products that meet those needs on a timely basis, we may not be able to compete effectively and our ability to generate revenues will suffer.

Our customers operate in markets characterized by rapidly changing technologies and business plans, which require them to adapt to increasingly complex IT infrastructures that incorporate a variety of hardware, software applications, operating systems and networking protocols. As our customers’ technologies and business plans grow more complex, we expect them to face new and increasingly sophisticated methods of attack. We face significant challenges in ensuring that our solutions effectively identify and respond to these advanced and evolving attacks without disrupting the performance of our customers’ IT systems. As a result, we must continually modify and improve our products in response to changes in our customers’ IT and industrial control infrastructures.

We cannot guarantee that we will be able to anticipate future market needs and opportunities or be able to develop product enhancements or new products to meet such needs or opportunities in a timely manner, if at all. Even if we are able to anticipate, develop and commercially introduce enhancements and new products, there can be no assurance that enhancements or new products will achieve widespread market acceptance.

Our product enhancements or new products could fail to attain sufficient market acceptance for many reasons, including:

delays in releasing product enhancements or new products;

failure to accurately predict market demand and to supply products that meet this demand in a timely fashion;

inability to interoperate effectively with the existing or newly introduced technologies, systems or applications of our existing and prospective customers;

inability to protect against new types of attacks or techniques used by cyber attackers or other data thieves;

defects in our products, errors or failures of our solutions to secure privileged accounts;

negative publicity about the performance or effectiveness of our products;

introduction or anticipated introduction of competing products by our competitors;

installation, configuration or usage errors by our customers;

easing or changing of regulatory requirements related to security; and

reluctance of customers to purchase products incorporating open source software.

If we fail to anticipate market requirements or fail to develop and introduce product enhancements or new products to meet those needs in a timely manner, it could cause us to lose existing customers and prevent us from gaining new customers, which would significantly harm our business, financial condition and results of operations.

We may fail to fully integrate, or realize the benefits expected from, our recent acquisitions and future acquisitions, which may require significant management attention, disrupt our business, dilute shareholder value and adversely affect our results of operations.

As part of our business strategy and in order to remain competitive, we continue to evaluate acquiring or making investments in complementary companies, products or technologies, such as the acquisitions we have made during the year ended December 31, 2015 of Viewfinity, a provider of Windows least privilege management and application control software, and Cybertinel, a cyber security company specializing in cyber threat detection technology. We may not be able to find suitable acquisition candidates or be able to complete such acquisitions on favorable terms. If we complete acquisitions, we may not ultimately strengthen our competitive position or achieve our goals, and any acquisitions we complete could be viewed negatively by our customers, analysts and investors. In addition, if we are unsuccessful at integrating our recent or future acquisitions or the technologies associated with such acquisitions or to fully attain the expected benefits of these acquisitions, our revenues and results of operations could be adversely affected. Any integration process may require significant time and resources, and we may not be able to manage the process successfully. We may not successfully evaluate or utilize the acquired technology or personnel, or accurately forecast the financial impact of an acquisition transaction, including accounting charges. In addition, despite our review of acquired technology, we could become subject to infringement claims from third parties as a result of our use of such acquired technology. The sale of equity or issuance of debt to finance any such acquisitions could result in dilution to our shareholders. The incurrence of indebtedness would result in increased fixed obligations and could also include covenants or other restrictions that would impede our ability to manage our operations.

If our products do not effectively interoperate with our customers’ existing or future IT infrastructures, installations could be delayed or cancelled, which would harm our business.

Our products must effectively interoperate with our customers’ existing or future IT infrastructures, which often have different specifications, utilize multiple protocol standards, deploy products from multiple vendors and contain multiple generations of products that have been added over time. If we find errors in the existing software or defects in the hardware used in our customers’ infrastructure or problematic network configurations or settings, we may have to modify our software so that our products will interoperate with our customers’ infrastructure and business processes. In addition, to stay competitive within certain markets, we may be required to make software modifications in future releases to comply with new statutory or regulatory requirements. These issues could result in longer sales cycles for our products and order cancellations, either of which would adversely affect our business, results of operations and financial condition.

Our research and development efforts may not produce successful products or enhancements to our solutions that result in significant revenue or other benefits in the near future, if at all.

We expect to continue to dedicate significant financial and other resources to our research and development efforts in order to maintain our competitive position. For example, in 2015, we increased our dedicated research and development personnel by 48% compared to 2014. However, investing in research and development personnel, developing new products and enhancing existing products is expensive and time consuming, and there is no assurance that such activities will result in significant new marketable products or enhancements to our products, design improvements, cost savings, revenues or other expected benefits. If we spend significant time and effort on research and development and are unable to generate an adequate return on our investment, our business and results of operations may be materially and adversely affected.

We are subject to a number of risks associated with global sales and operations.

Business practices in the global markets that we serve may differ from those in the United States and may require us to include non-standard terms in customer contracts, such as extended payment or warranty terms. To the extent that we enter into customer contracts that include non-standard terms related to payment, warranties, or performance obligations, our results of operations may be adversely impacted.

Additionally, our global sales and operations are subject to a number of risks, including the following:

greater difficulty in enforcing contracts and managing collections, as well as longer collection periods;

higher costs of doing business globally, including costs incurred in maintaining office space, securing adequate staffing and localizing our contracts;

fluctuations in exchange rates between the U.S. dollar and foreign currencies in markets where we do business (See “—We are exposed to fluctuations in currency exchange rates, which could negatively affect our financial condition and results of operations”);

management communication and integration problems resulting from cultural and geographic dispersion;

risks associated with trade restrictions and foreign legal requirements, including any importation, certification, and localization of our platform that may be required in foreign countries;

greater risk of unexpected changes in regulatory practices, tariffs, and tax laws and treaties;

compliance with anti-bribery laws, including, without limitation, compliance with the U.S. Foreign Corrupt Practices Act and the UK Anti-Bribery Act;

heightened risk of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of, or irregularities in, financial statements;

reduced or uncertain protection of intellectual property rights in some countries;

social, economic and political instability, terrorist attacks and security concerns in general; and

potentially adverse tax consequences.

These and other factors could harm our ability to generate future global revenues and, consequently, materially impact our business, results of operations and financial condition.

If we are unable to adequately protect our proprietary technology and intellectual property rights, our business could suffer substantial harm.

The success of our business depends on our ability to protect our proprietary technology, brands and other intellectual property and to enforce our rights in that intellectual property. We attempt to protect our intellectual property under patent, trademark, copyright and trade secret laws, and through a combination of confidentiality procedures, contractual provisions and other methods, all of which offer only limited protection.

As of December 31, 2015, we had three issued patents in the United States, three provisional U.S. patent applications and 15 pending U.S. patent applications. We also had two issued patents and 16 applications pending for examination in non-U.S. jurisdictions, all of which are counterparts of our U.S. patent applications. We may file additional patent applications in the future.

The process of obtaining patent protection is expensive and time-consuming, and we may not be able to prosecute all necessary or desirable patent applications at a reasonable cost or in a timely manner all the way through to the successful issuance of a patent. We may choose not to seek patent protection for certain innovations and may choose not to pursue patent protection in certain jurisdictions. Furthermore, it is possible that our patent applications may not issue as granted patents, that the scope of our issued patents will be insufficient or not have the coverage originally sought, that our issued patents will not provide us with any competitive advantages, and that our patents and other intellectual property rights may be challenged by others or invalidated through administrative processes or litigation. In addition, issuance of a patent does not guarantee that we have an absolute right to practice the patented invention. Our policy is to require our employees (and our consultants and service providers that develop intellectual property included in our products) to execute written agreements in which they assign to us their rights in potential inventions and other intellectual property created within the scope of their employment (or, with respect to consultants and service providers, their engagement to develop such intellectual property), but we cannot be certain that we have adequately protected our rights in every such agreement or that we have executed an agreement with every such party. Finally, in order to benefit from the protection of patents and other intellectual property rights, we must monitor and detect infringement and pursue infringement claims in certain circumstances in relevant jurisdictions, all of which are costly and time-consuming. As a result, we may not be able to obtain adequate protection or to effectively enforce our issued patents or other intellectual property rights.

In addition to patents, we rely on trade secret rights, copyrights and other rights to protect our unpatented proprietary intellectual property and technology. Despite our efforts to protect our proprietary technologies and our intellectual property rights, unauthorized parties, including our employees, consultants, service providers or customers, may attempt to copy aspects of our products or obtain and use our trade secrets or other confidential information. We generally enter into confidentiality agreements with our employees, consultants, service providers, vendors, channel partners and customers, and generally limit access to and distribution of our proprietary information and proprietary technology through certain procedural safeguards. These agreements may not effectively prevent unauthorized use or disclosure of our intellectual property or technology and may not provide an adequate remedy in the event of unauthorized use or disclosure of our intellectual property or technology. We cannot be certain that the steps taken by us will prevent misappropriation of our intellectual property or technology or infringement of our intellectual property rights. In addition, the laws of some foreign countries where we sell our products do not protect intellectual property rights and technology to the same extent as the laws of the United States, and these countries may not enforce these laws as diligently as government agencies and private parties in the United States. Based on the 2015 report on intellectual property rights protection and enforcement published by the Office of the United States Trade Representative, such countries included Ukraine, Chile, China, India, Indonesia, Russia and Thailand (designated as priority watch list countries). If we are unable to protect our intellectual property, we may find ourselves at a competitive disadvantage to others who need not incur the additional expense, time and effort required to create the innovative products that have enabled us to be successful to date.

Intellectual property claims may increase our costs or require us to cease selling certain products, which could adversely affect our financial condition and results of operations.

The IT security industry is characterized by the existence of a large number of relevant patents and frequent claims and related litigation regarding patent and other intellectual property rights. In particular, leading companies in the IT security industry have extensive patent portfolios. From time to time, third-parties have asserted and may assert their patent, copyright, trademark and other intellectual property rights against us, our channel partners or our customers. Furthermore, we may be subject to indemnification obligations with respect to third-party intellectual property rights pursuant to our agreements with our channel partners or customers. Such indemnification provisions are customary for our industry. Successful claims of infringement or misappropriation by a third-party against us or a third-party that we indemnify could prevent us from distributing certain products or performing certain services or could require us to pay substantial damages (including, for example, treble damages if we are found to have willfully infringed patents and increased statutory damages if we are found to have willfully infringed copyrights), royalties or other fees. Such claims also could require us to cease making, licensing or using solutions that are alleged to infringe or misappropriate the intellectual property of others, to expend additional development resources to attempt to redesign our products or services or otherwise to develop non-infringing technology, to enter into potentially unfavorable royalty or license agreements in order to obtain the right to use necessary technologies or intellectual property rights, and to indemnify our partners and other third parties, including our customers and channel partners whom we typically indemnify against such claims. Even if third parties may offer a license to their technology, the terms of any offered license may not be acceptable, and the failure to obtain a license or the costs associated with any license could cause our business, results of operations or financial condition to be materially and adversely affected. Defending against claims of infringement or being deemed to be infringing the intellectual property rights of others could impair our ability to innovate, develop, distribute and sell our current and planned products and services. If we are unable to ensure that we are not violating the intellectual property rights of others, our financial position may be adversely affected.

Prolonged economic uncertainties or downturns could materially adversely affect our business.

Our business depends on our current and prospective customers’ ability and willingness to invest money in IT security, which in turn is dependent upon their overall economic health. Negative economic conditions in the global economy, including conditions resulting from financial and credit market fluctuations, could cause a decrease in corporate spending on information security software. We generated 31.5% of our revenues from Europe, the Middle East and Africa and 11.3% from the rest of the world, including countries in North and South America other than the United States and countries in the Asia Pacific region, in 2015. Continuing economic challenges throughout Europe, the Asia Pacific region and other parts of the world may cause our customers in those locations to reevaluate decisions to purchase our solutions or to delay their purchasing decisions, which could adversely impact our results of operations due to the importance of that region to us.

In addition, a significant portion of our revenues is generated from customers in the financial services industry, including banking and insurance. Negative economic conditions may cause customers generally and in that industry in particular to reduce their IT spending. Customers may delay or cancel IT projects, choose to focus on in-house development efforts or seek to lower their costs by renegotiating maintenance and support agreements. To the extent purchases of licenses for our software are perceived by customers and potential customers to be discretionary, our revenues may be disproportionately affected by delays or reductions in general IT spending. If the economic conditions of the general economy or industries in which we operate worsen from present levels, our results of operation could be adversely affected.

We rely significantly on revenues from maintenance and support contracts, which we recognize ratably over the term of the associated contract and, to a lesser extent, from professional services contracts, which we recognize as services are delivered, and downturns in sales of these contracts are not immediately reflected in full in our quarterly operating results.

Maintenance and support and professional services revenues accounted for 37.7% of our total revenues in 2015. Sales of maintenance and support and professional services may decline or fluctuate as a result of a number of factors, including the number of product licenses we sell, our customers’ level of satisfaction with our products and services, the prices of our products and services, the prices of products and services offered by our competitors or reductions in our customers’ spending levels. If our sales of maintenance and support and professional services contracts decline, our revenues or revenue growth may decline and our business will suffer. We recognize revenues from maintenance and support contracts ratably on a straight-line basis over the term of the related contract which is typically one year and, to a lesser extent, three years, and from professional services as services are performed. As a result, a meaningful portion of the revenues we report each quarter results from the recognition of deferred revenues from maintenance and support and professional services contracts entered into during previous quarters. Consequently, a decline in the number or size of such contracts in any one quarter will not be fully reflected in revenues in that quarter, but will negatively affect our revenues in future quarters. Accordingly, the effect of significant downturns in maintenance and support and professional services contracts would not be reflected in full in our results of operations until future periods.

We are subject to governmental export and import controls that could subject us to liability in the event of non-compliance or impair our ability to compete in international markets.

We incorporate encryption capabilities into certain products and these products are subject to U.S. export control requirements. We are also subject to Israeli export controls on encryption technology since our product development initiatives are primarily conducted in Israel. If the applicable U.S. or Israeli requirements regarding the export of encryption technology were to change or if we change the encryption means in our products, we may need to satisfy additional requirements in the United States or Israel. There can be no assurance that we will be able to satisfy any additional requirements under these circumstances in either the United States or Israel. Furthermore, various other countries regulate the import of certain encryption products and technology, including import permitting and licensing requirements, and have enacted laws that could limit our ability to distribute our products or could limit our customers’ ability to implement our products in those countries.

We are also subject to U.S. and Israeli export control and economic sanctions laws, which prohibit the shipment of certain products to embargoed or sanctioned countries, governments and persons. Our products could be exported to these sanctioned targets by our channel partners despite the contractual undertakings they have given us and any such export could have negative consequences, including government investigations, penalties and reputational harm. Any change in export or import regulations, economic sanctions or related legislation, shift in the enforcement or scope of existing regulations, or change in the countries, governments, persons or technologies targeted by such regulations, could result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers with international operations. Any decreased use of our products or limitation on our ability to export or sell our products would likely adversely affect our business, financial condition and results of operations.

In addition, in the future we may be subject to defense-related export controls. For example, currently our solutions are not subject to supervision under the Israeli Defense Export Control Law, 5767-2007, but if they were used for purposes that are classified as defense-related or if they fall under “dual-use goods and technology” as referred to below, we could become subject to such regulation. In particular, under the Israeli Defense Export Control Law, 5767-2007, an Israeli company may not conduct “defense marketing activity” without a defense marketing license from the Israeli Ministry of Defense (MOD) and may be subject to a requirement to obtain a specific license from the MOD for any export of defense related products and/or knowhow. The definition of defense marketing activity is broad and includes any marketing of “defense equipment,” “defense knowhow” or “defense services” outside of Israel, which includes “dual-use goods and technology,” (material and equipment intended in principle for civilian use and that can also be used for defensive purposes, such as our cybersecurity solutions) that is specified in the list of Goods and Dual-Use Technology annexed to the Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies, if intended for defense use only, or is specified under Israeli legislation. “Dual-use goods and technology” will be subject to control by the Ministry of Economy if intended for civilian use only. In December 2013, regulations under the Wassenaar Arrangement included for the first time a chapter on cyber-related matters, which chapter was last amended in December 2015. We believe that our products do not fall under this chapter; however, in the future we may become subject to this regulation or similar regulations, which would limit our sales and marketing activities and could therefore have an adverse effect on our results of operations. Similar issues could arise under the U.S. defense/military export controls under the Arms Export Control Act and the International Traffic in Arms Regulations.

Further, the U.S. Department of Commerce’s Bureau of Industry and Security (“BIS”) issued a proposed rule on May 20, 2015 on new export regulations for “cybersecurity items.” The proposed rule was subject to public comment until July 20, 2015. At a congressional hearing in January 2016, BIS indicated that the proposed rule would be revised before formal issuance in light of the comments received during the comment period. As a result, there can be no assurance whether our solutions would be impacted by these potential new regulations and what impact the new regulations would have on our sales or our costs relating to compliance. In December 2015, the Israeli Ministry of Defense also issued a preliminary draft proposing certain cyber-export regulations seeking industry input and views on such proposal. The adoption of regulations is subject to their finalization by the relevant ministry, and then to further review, discussion and possibly revision by the Foreign Affairs and Defense Committee of Israel’s Parliament. At this time we believe that such regulations – if adopted as is – are not likely to have an adverse effect on our results of operations; however there can be no assurance that the proposed regulations would not be revised, or whether our solutions would be subject to any additional requirements which could result in additional administrative cost or affect sale cycles.

We are exposed to fluctuations in currency exchange rates, which could negatively affect our financial condition and results of operations.

Our functional and reporting currency is the U.S. dollar and we generate a majority of our revenues in U.S. dollars. In 2015, the majority of our revenues were denominated in U.S. dollars and the remainder primarily in euros and British pounds sterling. In 2015, the substantial majority of our cost of revenues and operating expenses were denominated in U.S. dollars and New Israeli Shekels (NIS), and the remainder primarily in euros and British pounds sterling. Our foreign currency-denominated expenses consist primarily of personnel, rent and other overhead costs. Since a significant portion of our expenses is incurred in NIS and is substantially greater than our revenues in NIS, any appreciation of the NIS relative to the U.S. dollar would adversely impact our net loss or net income, as applicable. In addition, since the portion of our revenues generated in euros and British pounds sterling is greater than our expenses incurred in euros and British pounds sterling, respectively, any depreciation of the euro or the British pounds sterling relative to the U.S. dollar would adversely impact our net loss or net income, as relevant. We estimate that a 10% strengthening or weakening in the value of the NIS against the U.S. dollar would have increased or decreased, respectively, our net income by approximately $2.1 million in 2015. We estimate that a 10% strengthening or weakening in the value of the euro against the U.S. dollar would have increased or decreased, respectively, our net income by approximately $1.3 million in 2015. We estimate that a 10% strengthening or weakening in the value of the British pounds sterling against the U.S. dollar would have increased or decreased, respectively, our net income by approximately $0.6 million in 2015. These estimates of the impact of fluctuations in currency exchange rates on our historic results of operations may be different from the impact of fluctuations in exchange rates on our future results of operations since the mix of currencies comprising our revenues and expenses may change. We evaluate periodically the various currencies to which we are exposed and take hedging measures to reduce the potential adverse impact from the appreciation or the depreciation of our non U.S. dollar-denominated operations, as appropriate. We expect that the majority of our revenues will continue to be generated in U.S. dollars with the balance in euros and British pounds sterling for the foreseeable future and that a significant portion of our expenses will continue to be denominated in NIS, U.S. dollars, British pounds sterling and in euros. We cannot provide any assurances that our hedging activities will be successful in protecting us from adverse impacts from currency exchange rate fluctuations. See “Item 11—Quantitative and Qualitative Disclosures About Market Risk—Foreign Currency Risk.”

A portion of our revenues is generated by sales to government entities, which are subject to a number of challenges and risks.

A portion of our revenues is generated by sales to U.S. and foreign federal, state and local governmental agency customers, and we may in the future increase sales to government entities. Sales to government entities are subject to a number of risks. Selling to government entities can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that we will complete a sale. Government demand and payment for our products and services may be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our products. Finally, for purchases by the U.S. government, the government may require certain products to be manufactured in the United States and other high cost manufacturing locations, and we may not manufacture all products in locations that meet the requirements of the U.S. government.

Our use of open source software, third-party software and other intellectual property may expose us to risks.

We use open source software and expect to continue to use open source software in the future. Some open source software licenses require users who distribute or make available as a service open source software as part of their own software product to publicly disclose all or part of the source code of the users’ software product or to make available any derivative works of the open source code on unfavorable terms or at no cost. We may face ownership claims of third parties over, or seeking to enforce the license terms applicable to, such open source software, including by demanding the release of the open source software, derivative works or our proprietary source code that was developed using such software. In addition, if the license terms for the open source code change, we may be forced to re-engineer our software or incur additional costs.

Further, some of our products and services include software or other intellectual property licensed from third parties, and we otherwise use software and other intellectual property licensed from third parties in our business. This exposes us to risks over which we may have little or no control. For example, a licensor may have difficulties keeping up with technological changes or may stop supporting the software or other intellectual property that it licenses to us. There can be no assurance that the licenses we use will be available on acceptable terms, if at all. In addition, a third party may assert that we or our customers are in breach of the terms of a license, which could, among other things, give such third party the right to terminate a license or seek damages from us, or both. Our inability to obtain or maintain certain licenses or other rights or to obtain or maintain such licenses or rights on favorable terms, or the need to engage in litigation regarding these matters, could result in delays in releases of new products, and could otherwise disrupt our business, until equivalent technology can be identified, licensed or developed.

Risks Related to Our Ordinary Shares

Our share price may be volatile, and you may lose all or part of your investment.

Our ordinary shares were first offered publicly in our initial public offering in September 2014, at a price of $16.00 per share. Certain of our shareholders sold our ordinary shares in a public offering in March 2015. Subsequently, we issued and sold our ordinary shares and certain of our shareholders sold additional ordinary shares in a public offering in June 2015. Since our initial public offering in September 2014, our ordinary shares have traded as high as $76.35 per share and as low as $22.12 per share through February 29, 2016. In addition, the market price of our ordinary shares could be highly volatile and may fluctuate substantially as a result of many factors, some of which are beyond our control, including, but not limited to:

actual or anticipated fluctuations in our results of operations and the results of other similar companies;

variance in our financial performance from the expectations of market analysts;

announcements by us or our competitors of significant business developments, changes in service provider relationships, acquisitions or expansion plans;

changes in the prices of our products and services;

our involvement in litigation;

our sale of ordinary shares or other securities in the future;

market conditions in our industry;

changes in key personnel;

speculation in the press or the investment community;

the trading volume of our ordinary shares;

changes in the estimation of the future size and growth rate of our markets;

any merger and acquisition activities; and

general economic and market conditions.

In addition, the stock markets have experienced extreme price and volume fluctuations. Broad market and industry factors may materially harm the market price of our ordinary shares, regardless of our operating performance. In the past, following periods of volatility in the market price of a company’s securities, securities class action litigation has often been instituted against that company. If we were involved in any similar litigation we could incur substantial costs and our management’s attention and resources could be diverted.

If securities or industry analysts cease to publish research or publish inaccurate or unfavorable research reports about our business, our share price and trading volume could decline.

The trading price for our ordinary shares is affected by any research or reports that securities or industry analysts publish about us or our business. If one or more of the analysts who cover us or our business publish inaccurate or unfavorable research about us or our business, and in particular, if they downgrade their evaluations of our ordinary shares, the price of our ordinary shares would likely decline. If one or more of these analysts cease coverage of our company, we could lose visibility in the market for our ordinary shares, which in turn could cause our share price to decline.

As a foreign private issuer whose shares are listed on the NASDAQ Stock Market, or NASDAQ, we may follow certain home country corporate governance practices instead of otherwise applicable SEC and NASDAQ requirements, which may result in less protection than is accorded to investors under rules applicable to domestic U.S. issuers.

As a foreign private issuer whose shares are listed on the NASDAQ Global Select Market, we are permitted to follow certain home country corporate governance practices instead of certain rules of NASDAQ. We currently follow Israeli home country practices with regard to the quorum requirement for shareholder meetings and NASDAQ requirements relating to distribution of our annual report to shareholders. As permitted under the Israeli Companies Law, 5759-1999, or the Companies Law, our articles of association provide that the quorum for any meeting of shareholders shall be the presence of at least two shareholders present in person or by proxy who hold at least 25% of the voting power of our shares instead of 33 1/3% of our issued share capital. Further, as permitted by the Companies Law and in accordance with the generally accepted business practice in Israel, we do not distribute our annual report to shareholders but make it available through a public website. We may in the future elect to follow Israeli home country practices with regard to other matters such as the formation and composition of the nominating and corporate governance committee, separate executive sessions of independent directors and the requirement to obtain shareholder approval for certain dilutive events (such as for the establishment or amendment of certain equity-based compensation plans, issuances that will result in a change of control of the company, certain transactions other than a public offering involving issuances of a 20% or more interest in the company and certain acquisitions of the stock or assets of another company). Accordingly, our shareholders may not be afforded the same protection as provided under NASDAQ corporate governance rules. Following our home country governance practices as opposed to the requirements that would otherwise apply to a United States company listed on NASDAQ may provide less protection than is accorded to investors of domestic issuers. See “Item16.G. Corporate Governance.”

As a foreign private issuer we are not subject to the provisions of Regulation FD or U.S. proxy rules and are exempt from filing certain Exchange Act reports.

As a foreign private issuer, we are exempt from a number of requirements under U.S. securities laws that apply to public companies that are not foreign private issuers. In particular, we are exempt from the rules and regulations under the Exchange Act related to the furnishing and content of proxy statements, and our officers, directors and principal shareholders are exempt from the reporting and short-swing profit recovery provisions contained in Section 16 of the Exchange Act. In addition, we are not required under the Exchange Act to file annual and current reports and financial statements with the SEC as frequently or as promptly as U.S. domestic companies whose securities are registered under the Exchange Act and we are generally exempt from filing quarterly reports with the SEC under the Exchange Act. We are also exempt from the provisions of Regulation FD, which prohibits issuers from making selective disclosure of material nonpublic information to, among others, broker-dealers and holders of a company’s securities under circumstances in which it is reasonably foreseeable that the holder will trade in the company’s securities on the basis of the information. Even though we intend to comply voluntarily with Regulation FD, these exemptions and leniencies will reduce the frequency and scope of information and protections to which you are entitled as an investor. For so long as we qualify as a foreign private issuer, we are not required to comply with the proxy rules applicable to U.S. domestic companies, although pursuant to the Companies Law, we disclose the annual compensation of our five most highly compensated office holders (as defined under the Companies Law) on an individual basis, including in this annual report.

Since a majority of our voting securities are either directly or indirectly owned of record by residents of the United States, we would lose our foreign private issuer status if any of the following were to occur:(i) the majority of our executive officers or directors were United States citizens or residents, (ii) more than 50 percent of our assets were located in the United States, or (iii) our business was administered principally in the United States. Although we have elected to comply with certain U.S. regulatory provisions, our loss of foreign private issuer status would make such provisions mandatory. The regulatory and compliance costs to us under U.S. securities laws as a U.S. domestic issuer may be significantly higher. If we are not a foreign private issuer, we will be required to file periodic reports and registration statements on U.S. domestic issuer forms with the SEC, which are more detailed and extensive than the forms available to a foreign private issuer. We would also be required to follow U.S. proxy disclosure requirements, including the requirement to disclose more detailed information about the compensation of our senior executive officers on an individual basis. We may also be required to modify certain of our policies to comply with good governance practices associated with U.S. domestic issuers. Such conversion and modifications will involve additional costs. In addition, we would lose our ability to rely upon exemptions from certain corporate governance requirements on U.S. stock exchanges that are available to foreign private issuers.

The market price of our ordinary shares could be negatively affected by future sales of our ordinary shares.

If our existing shareholders, particularly our largest shareholders, or our directors or executive officers sell a substantial number of our ordinary shares in the public market, the market price of our ordinary shares could decrease significantly. The perception in the public market that these shareholders might sell our ordinary shares could also depress the market price of our ordinary shares and could impair our future ability to obtain capital, especially through an offering of equity securities.

Additionally, as of December 31, 2015, the holders of approximately 5.0 million of our ordinary shares are entitled to require that we register their shares under the Securities Act for resale into the public markets on a registration statement on Form F-3, subject to cutback for marketing reasons and certain other conditions. All shares sold pursuant to a public offering would be freely transferable. See “Item 7.B—Related Party Transactions—Registration Rights.”

Further, we have filed registration statements on Form S-8 under the Securities Act to register 5,472,500 ordinary shares issuable under our equity incentive plans. Such registration statements became effective immediately upon filing. Ordinary shares issued upon exercise of a share option or vesting of restricted stock units and registered pursuant to the corresponding registration statement on Form S-8 may be freely sold in the public market upon issuance, subject to vesting provisions and certain restrictions on sale by affiliates. As of December 31, 2015, 3,755,785 ordinary shares underlying options and restricted stock units were outstanding under our equity incentive plans.

Sales by us or our shareholders of a substantial number of ordinary shares in the public market, or the perception that these sales might occur, could cause the market price of our ordinary shares to decline or could impair our ability to raise capital through a future sale of, or pay for acquisitions using, our equity securities.

Our U.S. shareholders may suffer adverse tax consequences if we are classified as a passive foreign investment company.

Generally, if for any taxable year 75% or more of our gross income is passive income, or at least 50% of the average quarterly value of our assets (which may be measured in part by the market value of our ordinary shares, which is subject to change) are held for the production of, or produce, passive income, we would be characterized as a passive foreign investment company, or PFIC, for U.S. federal income tax purposes. Based on our gross income and gross assets, and the nature of our business, we believe that we were not classified as a PFIC for the taxable year ended December 31, 2015. Because PFIC status is based on our income, assets and activities for the entire taxable year, it is not possible to determine whether we will be characterized as a PFIC for our 2016 taxable year until after the close of the year. There can be no assurance that we will not be considered a PFIC for any taxable year. Our characterization as a PFIC could result in material adverse tax consequences for you if you are a U.S. investor, including having gains realized on the sale of our ordinary shares treated as ordinary income, rather than a capital gain, the loss of the preferential rate applicable to dividends received on our ordinary shares by individuals who are U.S. holders, and having interest charges apply to distributions by us and the proceeds of share sales. Certain elections exist that may alleviate some of the adverse consequences of PFIC status and would result in an alternative treatment (such as mark-to-market treatment) of our ordinary shares. Prospective U.S. investors should consult their own tax advisers regarding the potential application of the PFIC rules to them. Prospective U.S. investors should refer to “Item 10.E. Taxation—Certain United States Federal Income Tax Consequences” for discussion of additional U.S. income tax considerations applicable to them based on our treatment as a PFIC.

If we are unable to satisfy the requirements of Sections 404(a) and 404(b) of the Sarbanes-Oxley Act of 2002, or the Sarbanes-Oxley Act, or if our internal control over financial reporting is not effective, investors may lose confidence in the accuracy and the completeness of our financial reports and the trading price of our ordinary shares may be negatively affected.

Pursuant to Section 404(a) of the Sarbanes-Oxley Act, beginning with our annual report for the fiscal year ended December 31, 2015, we are required to furnish a report by management on the effectiveness of our internal control over financial reporting. Accordingly, during the fiscal year ended December 31, 2015, our management commenced the process of determining whether our internal control over financial reporting systems is effective under Section 404(a). Additionally, pursuant to Section 404(b) of the Sarbanes-Oxley Act, beginning with our annual report for the fiscal year ended December 31, 2015, as we are no longer an emerging growth company and qualify as a large accelerated filer, we must include an auditor attestation on our internal control over financial reporting.

To maintain the effectiveness of our disclosure controls and procedures and our internal control over financial reporting, we expect that we will need to continue enhancing existing, and implement new, financial reporting and management systems, procedures and controls to manage our business effectively and support our growth in the future. The process of evaluating our internal control over financial reporting will require an investment of substantial time and resources, including by our Chief Financial Officer and other members of our senior management. As a result, this process may divert internal resources and take a significant amount of time and effort to complete.Additionally, as part of management assessments of the effectiveness of our internal control over financial reporting required by Section 404(a), our management may conclude that our internal control over financial reporting is not effective due to our failure to cure any identified material weakness or otherwise, which would require us to employ remedial actions to implement effective controls. If we identify material weaknesses in our internal control over financial reporting, if we are unable to comply with the requirements of Section 404(a) or 404(b) in a timely manner or to assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an opinion or issues an adverse opinion in its attestation as to the effectiveness of our internal control over financial reporting required by Section 404(b), investors may lose confidence in the accuracy and completeness of our financial reports and the trading price of our ordinary shares could be negatively affected. We could also become subject to investigations by the stock exchange on which our securities are listed, the SEC or other regulatory authorities, which could require additional financial and management resources.

Irrespective of compliance with Sections 404(a) and 404(b), any failure of our internal control could have a material adverse effect on our stated results of operations and harm our reputation.In order to implement changes to our internal control over financial reporting triggered by a failure of those controls, we could experience higher than anticipated operating expenses, as well as higher independent auditor fees during and after the implementation of these changes.

As a public company we may become subject to further compliance obligations, which may strain our resources and divert management’s attention.

Changing laws, regulations and standards in the United States relating to corporate governance and public disclosure and other matters may be implemented in the future, which may increase our legal and financial compliance costs, make some activities more time consuming and divert management’s time and attention from revenue-generating activities to compliance activities. If our efforts to comply with new laws, regulations and standards differ from the activities intended by regulatory or governing bodies due to ambiguities related to practice, regulatory authorities may initiate legal proceedings against us and our business may be harmed. Being a publicly traded company in the United States and being subject to U.S. rules and regulations may make it more expensive for us to obtain director and officer liability insurance, and we may be required to accept reduced coverage or incur substantially higher costs to obtain coverage. These factors could also make it more difficult for us to attract and retain qualified members of our board of directors, particularly to serve on our audit committee, and qualified executive officers.

Risks Relating to Our Incorporation and Location in Israel

Our headquarters, research and development activities and other significant operations are located in Israel and, therefore, our results may be adversely affected by political, economic and military instability in Israel.

Our headquarters and principal research and development facilities are located in Israel. In addition, the majority of our key employees, officers and directors are residents of Israel. Accordingly, political, economic and military conditions in Israel may directly affect our business. Since the establishment of the State of Israel in 1948, a number of armed conflicts have taken place between Israel and its neighboring countries. In recent years, these have included hostilities between Israel and Hezbollah in Lebanon and Hamas in the Gaza strip, both of which resulted in rockets being fired into Israel causing casualties and disruption of economic activities. In addition, Israel faces threats from more distant neighbors, including, in particular, Iran. Our commercial insurance does not cover losses that may occur as a result of an event associated with the security situation in the Middle East. Although the Israeli government is currently committed to covering the reinstatement value of direct damages that are caused by terrorist attacks or acts of war, we cannot assure you that this government coverage will be maintained, or if maintained, will be sufficient to compensate us fully for damages incurred. Any losses or damages incurred by us could have a material adverse effect on our business. Any armed conflict involving Israel could adversely affect our operations and results of operations.

Further, our operations could be disrupted by the obligations of personnel to perform military service. As of December 31, 2015, we had 272 employees based in Israel, certain of which may be called upon to perform up to 54 days in each three year period (and in the case of non-officer commanders or officers, up to 70 or 84 days, respectively, in each three year period) of military reserve duty until they reach the age of 40 (and in some cases, depending on their specific military profession up to 45 or even 49 years of age) and, in certain emergency circumstances, may be called to immediate and unlimited active duty. Our operations could be disrupted by the absence of a significant number of employees related to military service, which could materially adversely affect our business and results of operations.

Several countries, principally in the Middle East, restrict doing business with Israel and Israeli companies, and additional countries may impose restrictions on doing business with Israel and Israeli companies whether as a result of hostilities in the region or otherwise. In addition, there have been increased efforts by activists to cause companies and consumers to boycott Israeli goods based on Israeli government policies. Such actions, particularly if they become more widespread, may adversely impact our ability to sell our products.

The tax benefits that are available to us require us to continue to meet various conditions and may be terminated or reduced in the future, which could increase our costs and taxes.

We were granted Approved Enterprise status under the Israeli Law for the Encouragement of Capital Investments, 1959, referred to as the Investment Law. We had elected the alternative benefits program, pursuant to which income derived from the Approved Enterprise program is tax-exempt for two years and enjoys a reduced tax rate of 10.0% to 25.0% for up to a total of eight years, subject to an adjustment based upon the foreign investors’ ownership. We were also eligible for certain tax benefits provided to Benefited Enterprises under the Investment Law. In March 2013, we notified the Israel Tax Authority that we apply the new tax regime under the Investment Law instead of our Approved Enterprise and Benefited Enterprise. We are eligible for certain tax benefits provided to Preferred Enterprises under the Investment Law. If we do not meet the conditions stipulated in the Investment Law, any tax benefits will be canceled and we would be required to refund the amount of the benefits, in whole or in part, including interest and CPI linkage (and other monetary penalties, if imposed on us). Further, in the future these tax benefits may be reduced or discontinued. If these tax benefits are reduced, cancelled or discontinued, our Israeli taxable income would be subject to regular Israeli corporate tax rates. The standard corporate tax rate for Israeli companies in 2013 was 25.0%, was increased to 26.5% for 2014 and 2015, and was reduced to 25.0% for 2016 and thereafter. Additionally, if we increase our activities outside of Israel through acquisitions, for example, our expanded activities might not be eligible for inclusion in future Israeli tax benefit programs. See “Item 5. Operating and Financial Review and Prospects—Operating Results—Israeli Tax Considerations and Government Programs—Law for the Encouragement of Capital Investments, 5719-1959.”

We may be required to pay monetary remuneration to employees who invented inventions during and as a consequence of their employment, even if the proprietary rights to such inventions have been assigned to us.

We enter into assignment-of-invention agreements with our employees pursuant to which such individuals agree to assign to us all rights to any inventions created in the scope of their employment or engagement with us. A significant portion of our intellectual property has been developed by our employees during the course of their employment by us. Under the Israeli Patent Law, 5727-1967, or the Patent Law, inventions conceived by an employee during the scope of his or her employment with a company are regarded as “service inventions,” which belong to the employer, absent a specific agreement between the employee and employer giving the employee service invention rights. Although our employees have agreed to assign to us service invention rights, as a result of uncertainty under Israeli law with respect to the efficacy of waivers of service invention rights, we may face claims demanding remuneration in consideration for assigned inventions. As a consequence of such claims, we could be required to pay additional remuneration or royalties to our current and/or former employees, or be forced to litigate such claims, which could negatively affect our business.

Provisions of Israeli law and our articles of association may delay, prevent or otherwise impede a merger with or an acquisition of us, even when the terms of such a transaction are favorable to us and our shareholders.

Israeli corporate law regulates mergers, requires tender offers for acquisitions of shares above specified thresholds, requires special approvals for transactions involving directors, officers or significant shareholders and regulates other matters that may be relevant to such types of transactions. For example, a tender offer for all of a company’s issued and outstanding shares can only be completed if the acquirer receives positive responses from the holders of at least 95% of the issued share capital. Completion of the tender offer also requires approval of a majority of the offerees that do not have a personal interest in the tender offer, unless at least 98% of the company’s outstanding shares are tendered. Furthermore, the shareholders, including those who indicated their acceptance of the tender offer (unless the acquirer stipulated in its tender offer that a shareholder that accepts the offer may not seek appraisal rights), may, at any time within six months following the completion of the tender offer, petition an Israeli court to alter the consideration for the acquisition. See “Item 10.B. Articles of Association—Acquisitions under Israeli Law” for additional information.

Our articles of association provide that our directors (other than external directors) are elected on a staggered basis, such that a potential acquirer cannot readily replace our entire board of directors at a single annual general shareholder meeting.

Furthermore, Israeli tax considerations may make potential transactions unappealing to us or to our shareholders whose country of residence does not have a tax treaty with Israel exempting such shareholders from Israeli tax. For example, Israeli tax law does not recognize tax-free share exchanges to the same extent as U.S. tax law. With respect to mergers involving an exchange of shares, Israeli tax law allows for tax deferral in certain circumstances but makes the deferral contingent on the fulfillment of a number of conditions, including, in some cases, a holding period of two years from the date of the transaction during which sales and dispositions of shares of the participating companies are subject to certain restrictions. Moreover, with respect to certain share swap transactions, the tax deferral is limited in time, and when such time expires, the tax becomes payable even if no disposition of the shares has occurred. In order to benefit from the tax deferral, a pre-ruling from the Israel Tax Authority might be required.

It may be difficult to enforce a judgment of a U.S. court against us, our officers and directors or the Israeli auditors named in this annual report in Israel or the United States, to assert U.S. securities laws claims in Israel or to serve process on our officers and directors and these auditors.

We are incorporated in Israel. The majority of our directors and executive officers, and the Israeli auditors listed in this annual report reside outside of the United States, and most of our assets and most of the assets of these persons are located outside of the United States. Therefore, a judgment obtained against us, or any of these persons, including a judgment based on the civil liability provisions of the U.S. federal securities laws, may not be collectible in the United States and may not be enforced by an Israeli court. It also may be difficult for you to effect service of process on these persons in the United States or to assert U.S. securities law claims in original actions instituted in Israel. Israeli courts may refuse to hear a claim based on an alleged violation of U.S. securities laws reasoning that Israel is not the most appropriate forum in which to bring such a claim. In addition, even if an Israeli court agrees to hear a claim, it may determine that Israeli law and not U.S. law is applicable to the claim. If U.S. law is found to be applicable, the content of applicable U.S. law must be proven as a fact by expert witnesses, which can be a time consuming and costly process. Certain matters of procedure will also be governed by Israeli law. There is little binding case law in Israel that addresses the matters described above. As a result of the difficulty associated with enforcing a judgment against us in Israel, you may not be able to collect any damages awarded by either a U.S. or foreign court.

Your rights and responsibilities as a shareholder are, and will continue to be, governed by Israeli law which differs in some material respects from the rights and responsibilities of shareholders of U.S. companies.

The rights and responsibilities of the holders of our ordinary shares are governed by our articles of association and by Israeli law. These rights and responsibilities differ in some material respects from the rights and responsibilities of shareholders in U.S.-based corporations. In particular, a shareholder of an Israeli company has a duty to act in good faith and in a customary manner in exercising its rights and performing its obligations towards the company and other shareholders, and to refrain from abusing its power in the company, including, among other things, in voting at a general meeting of shareholders on matters such as amendments to a company’s articles of association, increases in a company’s authorized share capital, mergers and acquisitions and related party transactions requiring shareholder approval. In addition, a shareholder who is aware that it possesses the power to determine the outcome of a shareholder vote or to appoint or prevent the appointment of a director or executive officer in the company has a duty of fairness toward the company. There is limited case law available to assist us in understanding the nature of this duty or the implications of these provisions. These provisions may be interpreted to impose additional obligations and liabilities on holders of our ordinary shares that are not typically imposed on shareholders of U.S. corporations.

ITEM 4.

INFORMATION ON THE COMPANY

History and Development of the Company

Our History

We were founded in 1999 with the vision of protecting high-value business data and pioneered our Digital Vault technology, which is the foundation of our platform. That same year, we began offering our first product, the Sensitive Information Management Solution (previously called the Sensitive Document Vault), which provides a secure platform through which our customers’ employees can share sensitive files. We believe our early innovation in vaulting technology enabled us to evolve into a company that provides a comprehensive security solutions built for privileged accounts. In 2005, we introduced our Privileged Account Security Solution, which has become our leading offering and reflects our emphasis on protecting privileged accounts across an organization. In September 2014, we listed our ordinary shares on the NASDAQ Global Select Market. In 2015, we acquired Viewfinity, a provider of Windows least privilege management and application control software, as well as Cybertinel, a cyber security company specializing in cyber threat detection technology.

Our Privileged Account Security Solution consists of several products: Enterprise Password Vault, SSH Key Manager, Privileged Session Manager, Privileged Threat Analytics, Application Identity Manager, Viewfinity and On-Demand Privileges Manager.

We are a company limited by shares organized under the laws of the State of Israel. We are registered with the Israeli Registrar of Companies. Our registration number is 51-229164-2. Our principal executive offices are located at 94 Em-Ha’moshavot Road, Park Ofer, P.O. Box 3143, Petach Tikva 4970602, Israel, and our telephone number is +972 (3) 918-0000. Our website address is www.cyberark.com. Information contained on, or that can be accessed through, our website is not part of this annual report and is not incorporated by reference herein. We have included our website address in this annual report solely for informational purposes. Our agent for service of process in the United States is Cyber-Ark Software, Inc., located at 60 Wells Avenue, Suite 103, Newton, MA 02459, and our telephone number is (617) 965-1544.

Principal Capital Expenditures

Our capital expenditures for fiscal years 2013, 2014 and 2015 amounted to $0.8 million, $1.4 million and $2.1 million, respectively. Capital expenditures consist primarily of investments in leasehold improvements for our office space and the purchase of computers and related equipment. We anticipate our capital expenditures in fiscal year 2016 to be in a range of $4 million and $5 million. We anticipate our capital expenditures in 2016 will be financed with cash on hand and cash flow generated from operating activities.

Business Overview

We are a global leader and pioneer of a new layer of IT security solutions that protects organizations from cyber attacks that have made their way inside the network perimeter to strike at the heart of the enterprise. Our software solutions are focused on protecting privileged accounts, which have become a critical target in the lifecycle of today’s cyber attacks. Privileged accounts are pervasive and act as the “keys to the IT kingdom,” providing complete access to, and control of, all parts of IT infrastructure, industrial control systems and critical business data. In the hands of an external attacker or malicious insider, privileged accounts allow attackers to take control of and disrupt an organization’s IT and industrial control infrastructures, steal confidential information and commit financial fraud. Our comprehensive solutions proactively protect privileged accounts, monitor privileged activity and detect malicious privileged behavior. Our customers use our innovative solutions to introduce this new security layer to protect against, detect and respond to cyber attacks before they strike vital systems and compromise sensitive data.

Organizations worldwide are experiencing an unprecedented increase in the sophistication, scale and frequency of cyber attacks. The challenge this presents is intensified by the growing adoption of new technologies, such as cloud computing, virtualization, software-defined networking, enterprise mobility and social networking, which has resulted in increasingly complex and distributed IT environments with significantly larger attack surfaces. Organizations have historically relied upon perimeter-based threat protection solutions such as network and web security tools as the predominant defense against cyber attacks, yet these traditional solutions have a limited ability to stop today’s advanced threats. According to a 2015 special report issued by FireEye, Inc., 96% of the systems of more than 1,600 FireEye network and email sensors deployed in real-world networks had suffered a network security breach. Organizations are in the early stages of adapting their security strategies to address this new threat environment and are evolving their approaches based on the assumption that their network perimeter has been or will be breached. They are therefore increasingly implementing new layers of security inside the network to disrupt attacks before they result in the theft of confidential information or other serious damage. Regulators are also continuing to mandate rigorous compliance standards and audit requirements in response to this evolving threat landscape.

We believe that the implementation of a privileged account security solution is one of the most critical layers of an effective security strategy. Privileged accounts represent one of the most vulnerable aspects of an organization’s IT infrastructure. Privileged accounts are used by system administrators, third-party and cloud service providers, applications and business users, and they exist in nearly every connected device, server, hypervisor, operating system, database, application and industrial control system. Due to the broad access and control they provide, exploiting privileged accounts has become a critical stage of the cyber attack lifecycle. The typical cyber attack involves an attacker effecting an initial breach, escalating privileges to access target systems, moving laterally through the IT infrastructure to identify valuable targets, and exfiltrating, or stealing, the desired information. According to Mandiant, credentials of authorized users were hijacked in 100% of the breaches that Mandiant investigated, and privileged accounts were targeted whenever possible.

We have architected our solutions from the ground up to address the challenges of protecting privileged accounts and an organization’s sensitive information. Our solutions provide proactive protection against cyber attacks from both external and internal sources and allow for real-time detection and neutralization of such threats. They can be deployed in traditional on-premise data centers, cloud environments and industrial control systems. Our innovative software solutions are the result of over 16 years of research and expertise, combined with valuable knowledge we have gained from working with our diverse population of customers and from our recent acquisitions of Viewfinity and Cybertinel.

Our comprehensive, purpose-built Privileged Account Security Solution enables our customers to secure, manage and monitor privileged account access and activities. Our Privileged Account Security Solution consists of our Enterprise Password Vault, SSH Key Manager, Privileged Session Manager, Privileged Threat Analytics, Application Identity Manager, Viewfinity and On-Demand Privileges Manager. These products leverage a common technology platform that includes our secure Digital Vault, Web Management Interface, Master Policy Engine and Discovery Engine, and integrates out of the box with over 100 types of IT assets in the datacenter or the cloud. Our solutions complement network, endpoint, web and other security tools and enhances the effectiveness of other security defenses by preventing the misuse of privileged accounts that are built into these products.

As of December 31, 2015, we had approximately 2,500 customers, including over 40% of the Fortune 100 and approximately 20% of the Global 2000. We define a customer to include a distinct entity, division or business unit of a company. Our customers include leading organizations in a diverse set of industries, including energy and utilities, financial services, healthcare, manufacturing, retail, technology and telecommunications, as well as government agencies. We sell our solutions through a high touch, channel fulfilled hybrid sales model that combines the leverage of channel sales with the account control of direct sales, and therefore provides us with significant opportunities to grow our current customer base. This approach allows us to maintain close relationships with our customers and benefit from the global reach of our channel partners. Additionally, we continue to enhance our product offerings and go-to-market strategy by establishing technology alliances within the IT infrastructure and security vendor ecosystem.

Our business has rapidly grown in recent years. During 2013, 2014 and 2015, our revenues were $66.2 million, $103.0 million and $160.8 million, respectively, representing year-over-year growth of 55.7% and 56.1% in 2014 and 2015, respectively. Our net income for 2013, 2014 and 2015 was $6.6 million, $10.0 million and $25.8 million, respectively.

Industry Background

The recent increase in sophisticated, targeted security threats by both external attackers and malicious insiders, along with an increase in the attack surface due to the growing complexity and distributed nature of IT environments, have made it extremely challenging for enterprises and governments around the world to protect their sensitive information. These challenges are driving the need for a new layer of security that complements traditional threat protection technologies by securing access to privileged accounts and preventing the exploitation of organizations’ critical systems and data.

Our Products

Our products secure organizations’ high-value data and critical IT assets by providing proactive protection against external and internal cyber threats and enabling real-time detection and neutralization of attacks.

Privileged Account Security Solution

Our comprehensive, purpose-built Privileged Account Security Solution provides our customers a set of products that enable them to secure, manage and monitor privileged account access and activities. Our Privileged Account Security Solution consists of our Enterprise Password Vault, SSH Key Manager, Privileged Session Manager, Privileged Threat Analytics, Application Identity Manager, Viewfinity and On-Demand Privileges Manager. These products share a common technology platform that includes our secure Digital Vault, Web Management Interface, Master Policy Engine and Discovery Engine, and integrates out of the box with over 100 types of IT assets in the datacenter or the cloud.

Enterprise Password Vault. Our Enterprise Password Vault provides customers with a powerful tool to manage and protect all privileged accounts across an entire organization, including physical, virtual or cloud-based assets. Customers can control how often to require scheduled password changes for different privileged accounts or grant passwords solely for one-time use based on operational needs and regulatory requirements. This automated process reduces the time-consuming and error-prone task of manually tracking and updating privileged credentials thereby enhancing system security and facilitating observance of audit and compliance standards.

SSH Key Manager. Our SSH Key Manager product securely stores, rotates and controls access to SSH keys to prevent unauthorized access to privileged accounts. This includes the protection of keys at rest and in transit, granular access controls and integration with strong authentication solutions. Detailed audit logs and reporting capabilities provide visibility into key usage to meet audit and compliance requirements. SSH keys are used as an alternative to password credentials, commonly used for administrative access for users, devices and applications to UNIX and Linux systems. SSH Key Manager is a logical extension to our Privileged Account Security Solution, leveraging our shared technology platform infrastructure, enabling organizations to protect all privileged credentials with a single integrated platform that can be built out over time in accordance with business needs.

Privileged Session Manager. Our Privileged Session Manager protects IT assets including servers, applications, databases and hypervisors from malware and provides command-level monitoring and recording of all privileged activity. Privileged Session Manager prevents malware on an infected workstation from capturing a privileged credential and spreading to additional assets. It also provides a single point of control, forcing all privileged access to pass through our server, ensuring that all privileged activity is monitored and recorded. The single point of control also allows for real-time viewing of privileged activities, enabling customers to terminate privileged sessions in real-time as a threat is detected. In addition, Privileged Session Manager records complete privileged sessions and stores the recordings in the Digital Vault to prevent tampering. Auditors, forensics team and others are able to view and quickly search through an entire session recording for specific activities. Privileged Session Manager does not impact the privileged account session and can operate entirely in the background, although customers can opt to deter privileged account users from prohibited conduct by alerting users that their sessions are being recorded. We offer customers the choice of licensing Privileged Session Manager based on the number of devices secured or the number of concurrent sessions it monitors. Our Privileged Session Manager and Enterprise Password Vault serve complementary functions and are part of a shared platform. As such, we frequently sell them together.

Privileged Threat Analytics. Our Privileged Threat Analytics product allows organizations to detect, alert, and respond to anomalous privileged activity while attacks are in progress. Privileged Threat Analytics uses proprietary algorithms to profile and analyze individual privileged user behavior and creates prioritized alerts when abnormal activity is detected. For example, our product can be used to detect privileged account access at unusual times or access to an abnormal quantity of privileged assets. Privileged Threat Analytics can automatically contain an attack by invalidating a stolen credential to block an attacker from further penetrating the network perimeter. Privileged Threat Analytics uses historical data collected by our Privileged Account Security Solution, Digital Vault and other network data sources to create and maintain a current profile of each privileged user’s behavior. It allows incident response teams to investigate the details that triggered the alert in order to prioritize and respond to the threat. We specialize in analyzing behavior related to privileged user behavior, thus providing vital intelligence on the most critical attack vector. This intelligence can be integrated into an organization’s existing systems and incident response processes enabling a faster response time.

Application Identity Manager. Our Application Identity Manager addresses the challenges of hard-coded, embedded credentials and cryptographic keys being hijacked and exploited by malicious insiders or external cyber attackers. This is enabled by our proprietary Digital Vault application provider technology, which eliminates the need to store such credentials in applications, scripts or configuration files. Instead, Application Identity Manager allows for secure, programmatic retrieval of needed credentials only at run-time and based on master policy control and monitoring.

Viewfinity. CyberArk Viewfinity, which we added to our product offerings following our acquisition of Viewfinity, Inc. in 2015, is intended to address problems that businesses face with local administrator rights and application control on endpoints and can be deployed on-premise or as a cloud-based solution. Removing local administrator rights for business users on endpoints can significantly reduce the attack surface, but it can also result in unintended productivity tradeoffs and high help desk costs, as users attempt to regain privileges necessary for day-to-day tasks. Viewfinity is designed to help organizations reduce the attack surface by removing local administrative privileges for business users, granularly controlling IT administrator privileges on Windows Servers based on role and elevating privileges when necessary and authorized. Viewfinity’s application control features also enable organizations to closely control and monitor all applications within the environment, identify the original source and instances of malicious applications in the environment for incident response, or supporting forensic investigations. Malicious applications may be immediately blocked, unknown applications may be “grey” listed and restricted pending further analysis and trusted applications may seamlessly run without frustrating business or IT users.

On-Demand Privileges Manager. Our On-Demand Privileges Manager allows customers to limit the breadth of access of Unix/Linux administrative accounts and granularly restrict them from performing certain commands and functions. We also offer this product to customers using Windows through software licensed from an outside vendor.

Shared Technology Platform. Our shared technology platform is the foundation of our Privileged Account Security Solution and includes our secure Digital Vault, Web Management Interface, Master Policy Engine and Discovery Engine. Our Digital Vault is an encrypted server that only responds to preset vault protocols to ensure security throughout an organization’s network. Our Privileged Account Security Solution’s products use our Digital Vault to safely store, audit and manage passwords, privileged credentials, policy information and privileged account session data. Our Web Management Interface provides a single, user-friendly interface for customers to set, manage and monitor privileged account security policies across an entire organization in a matter of minutes while allowing for granular level exceptions to meet the organization’s unique operational needs. Our Master Policy Engine and Discovery Engine enable organizations to understand the scope of privileged account risk and helps to ensure that all privileged account activity is accounted for by automatically discovering new privileged accounts or changes to existing accounts. Our platform integrates out of the box with over 100 types of IT assets in the datacenter or the cloud, including leading operating systems, databases, network devices, security appliances, hypervisors, applications, industrial control systems and application servers. Our platform further leverages our proprietary vault protocol technology to enable distributed deployments across global networks for central management and auditing while providing enterprise-wide global coverage.

Sensitive Information Management Solution

Our Sensitive Information Management Solution provides a secure platform through which our customers’ employees can share sensitive files while enabling the customer to monitor who is sharing these files. This allows organizations to isolate, store, share and track sensitive files and documents, such as customer credit card information, human resource records, intellectual property documents and legal information in a secure, internal environment. It also allows organizations to exchange sensitive information securely and efficiently with their business partners, customers, suppliers and subcontractors. Our Sensitive Information Management Solution integrates with an organization’s existing applications and can be deployed on-premise or as a cloud-based solution for faster audit readiness without the need for significant upfront cost.

Our Services

Maintenance and Support

Our customers typically purchase one year or, to a lesser extent, three years, of software maintenance and support in conjunction with their initial purchase of our products (other than our cloud-based Viewfinity product, which include these services as part of the annual subscription fee). Thereafter, they can renew such maintenance and support for additional one or three-year periods. These two alternative maintenance and support periods are common in the software industry. Customers pay for each alternative in full at the beginning of their terms. The substantial majority of our contracts sold are for a one-year term. For example, for the years 2013 through 2015 more than 90% of the renewal contracts were for a one year term.

Our global customer support organization has expertise in our software and how it interacts with complex IT environments. When sales are made to customers directly, we typically also provide any necessary maintenance and support pursuant to a maintenance and support contract directly with the customer. When sales are made through channels, primarily in the EMEA and Asia Pacific and Japan regions, the channel partner typically provides the first and second level support and we typically provide third level support if the issue cannot be resolved by the channel partner.

Our maintenance and support program provides customers the right to software bug repairs, the latest system enhancements and updates on an if-and-when available basis during the maintenance period, and access to our technical support services. Our technical support services are provided via our online support center, which enables customers to submit new support queries and monitor the status of open and past queries. Our online support system also provides customers with access to our CyberArk Knowledge Base, an online user-driven information repository that provides customers the ability to address their own queries. Additionally, we offer email and telephone support during business hours to customers that purchase a standard support package and 24/7 availability to customers that purchase a premium support package.

Professional Services

Our products are designed for customers to be able to download, install and deploy our software on their own. They are highly configurable and many customers will select either one of our many trained channel partners or our professional services team to provide services. Our professional services team can be contracted to assist customers in planning, installing and configuring their solution to meet the needs of their security and IT environment. Our professional services team provides ongoing consulting services regarding best practices in privileged account security, and recommended ways to implement our solutions to meet specific customer requirements. Additionally, they share best practices associated with use of our software and educate customers on alternative ways to use our product through CyberArk University, which offers in-person and WebEx courses globally.

Our Technology

Our comprehensive Privileged Account Security Solution relies on a set of proprietary technologies that provide a high level of security, scalability and reliability. The core technologies included in our solution are as follows:

Secure Digital Vault Technology. Our proprietary Digital Vault technology provides a highly secure, isolated environment, independent of other software, and is engineered with multiple layers of security. Our Digital Vault provides a data encryption mechanism that eliminates the need for encryption key management by the end user, while each object in our Digital Vault is encrypted with its own unique encryption key. To ensure security throughout the network, our Digital Vault communicates within an organization’s network and over the internet through a proprietary and highly protected Vault Protocol, enabling an organization to implement the centrally managed Privileged Account Security Solution with products located in multiple datacenters and geographic locations. Our Digital Vault provides an additional level of protection by preventing the vault administrator from accessing or discovering protected data stored within it. In addition, our Digital Vault database is embedded, isolated and self-managed as part of our Digital Vault software, thereby blocking database administrator access to our Digital Vault database to further eliminate threats. Our Privileged Account Security Solution’s additional products use the highly secured Digital Vault to safely store, audit and manage passwords, privileged credentials, policy information and privileged account session data.

Sophisticated Threat Analytics Algorithms. Our team of cyber experts and development engineers has developed proprietary algorithms that are at the core of our Privileged Threat Analytics product. These algorithms were developed using our deep understanding of cybersecurity and cyber attack techniques, together with over a decade of rich experience in analyzing privileged account activities. Our Privileged Threat Analytics product uses these proprietary algorithms to construct a behavioral profile for privileged users within an organization and continuously updates the profile based on normal changes in behavior. Once a behavioral profile is established, the threat analytics algorithms provide the ability to look for deviations from that profile in order to identify anomalies in user behavior. It then scores each individual anomaly and determines the level of threat based on the correlation of such anomalous events. Alerts with full details of the incident, including the probability of malicious intent, can be raised immediately, allowing an organization’s incident response team to review the potential threat and take action when necessary.

Strong Application Authentication and Credential Management. Our Application Identity Manager product’s architecture allows an organization to eliminate hard-coded application credentials, such as passwords and encryption keys, from applications and scripts. Our secure, proprietary product permits authentication of an application during run-time, based on any combination of the application’s signature, executable path, or IP address, and operating system user. Following application authentication, the authenticated application uses a secure application programming interface, or API, to request privileged account credentials during run-time and, based on the application permissions in our Privileged Account Security Solution, up-to-date credentials are provided to the application. To ensure business continuity, and high availability and performance even within complex and distributed network environments, our advanced product architecture provides a secure local credentials cache on the application server, eliminating the dependency on network availability and traffic during a run-time application credential request. Our proprietary architecture provides even higher value in application server environments, allowing an organization to eliminate application credentials without the need to perform any code changes and without impacting application availability.

Privileged Session Recording and Controls. Our innovative privileged session recording and control mechanisms provide the ability to isolate an organization’s IT systems from end-user desktops, while monitoring and recording the privileged session activities. Our proprietary architecture provides a highly secure, proxy-based solution that does not require agent installation on the target systems and provides a single-access control point to the target systems. The architecture blocks direct communication between an end-user’s desktop and a target system, thus preventing potential malware on the desktop from infiltrating the target system. This architecture further ensures that privileged credentials will remain protected and will not be exposed to the end-user or reach the desktop. Comprehensive recording capabilities provide the ability to record every keystroke and mouse click on the privileged session, and also provide DVR-like recordings with search, locate and alert capabilities.

Viewfinity Server and Endpoint Agents. Following the acquisition of Viewfinity, Inc. in 2015, we began offering Viewfinity endpoint agent technology, which provides policy-based privilege management and application control capabilities. The agent is able to detect the privileged commands, and application installation or invocation on the endpoint and validate whether permissible by the organization’s security policy, otherwise blocking the operation. Having users operate in a least privilege mode together with the Viewfinity agent technology effectively reduces the surface that attackers or malware can exploit. The Viewfinity server provides policy-based agent management and consolidated reporting, which allows organizations to manage privileges and handle application control. The Viewfinity server can also leverage third party threat and reputation information to enrich the policy and black-list definitions to further strengthen controls and block bad or malicious applications based on such security intelligence.

Our Customers

As of December 31, 2015, we had approximately 2,500 customers, including over 40% of the Fortune 100 and approximately 20% of the Global 2000. Our customers include leading organizations in a diverse set of industries, including energy and utilities, financial services, healthcare, manufacturing, retail, technology and telecommunications, as well as government agencies.

Our business is not dependent on any particular customer. No customer or channel partner accounted for more than 10% of our revenues in any of the last three years. Our diverse global footprint is evidenced by the fact that in 2015, we generated 57.2% of our revenues from customers in the United States, 31.5% from the EMEA region and 11.3% from the rest of the world, including countries in North and South America other than the United States and countries in the Asia Pacific region.

Sales and Marketing

Sales

We believe that our hybrid sales model, which combines the leverage of high touch, channel sales with the account control of direct sales, has played an important role in the growth of our customer base to date. We maintain a highly trained sales force that is responsible for developing and closing new business, the management of relationships with our channel partners and the support and expansion of relationships with existing customers. Our sales organization is organized by geographic regions, consisting of the Americas, EMEA and Asia Pacific and Japan regions. As of December 31, 2015, our global network of channel partners consisted of approximately 250 resellers and distributors. Our channel partners generally complement our sales efforts by helping to identify potential sales targets, maintaining relationships with certain customers and introducing new products to existing customers and offering post-sale professional services and technical support. In 2015, we generated approximately 40% of our revenues from direct sales from our field offices located throughout the world. Approximately 50% of our sales in the United States are direct while the substantial majority of our sales in the EMEA region and the rest of the world are through channel partners. We work with many global systems integration partners, such as Hewlett-Packard Company and Wipro Limited, and several leading regional security value added resellers, such as Optiv Security Inc., Computacenter PLC, Orange S.A., Business Services (Orange Cyberdefense), Carahsoft Technology Corp and Forsythe Solutions Group, Inc. These companies were each among our top 15 channel partners in 2015 by revenues and we have derived a meaningful amount from sales to each of them during the last two years.

Our sales cycle varies by size of the customer, the number of products purchased and the complexity of the customer’s IT infrastructure, ranging from several weeks for incremental sales to existing customers to many months for sales to new customers or large deployments. To support our broadly dispersed global channel and customer base, as of December 31, 2015, we had sales personnel in 26 countries. We plan to continue investing in our sales organization to support both the growth of our channel partners and our direct sales organization.

Marketing

Our marketing strategy is focused on building our brand strength, communicating the benefits of our solutions, developing leads and increasing sales to existing customers. We market our software as a solution to stop cyber threats before they have the chance to stop business. We execute our strategy by leveraging a combination of internal marketing professionals and a network of channel partners to communicate the value proposition and differentiation for our products, generating qualified leads for our sales force and channel partners. Our marketing efforts also include public relations in multiple regions and extensive content development available through our website. We are focused on an ongoing thought-leadership campaign to further establish ourselves as a leader in the cybersecurity market. Our marketing team is expanding its efforts by investing in analytics-driven lead development, stronger global coordination, quick response to current events and proactive and consistent communication with market analysts.

Research and Development

Continued investment in research and development is critical to our business. Our research and development efforts are focused primarily on improving and continuing to enhance existing products and services, as well as developing new products, features and functionality. We believe the timely development of new products is essential to maintaining our competitive position. We regularly release new versions of our software which incorporate new features and enhancements to existing ones. We also maintain a dedicated team that researches reported advanced cyber attacks, the attackers’ techniques and methods that lead to new security development initiatives for our products and provide thought-leadership on targeted attack mitigation.

As of December 31, 2015, we had 176 employees focused on research and development. We conduct our research and development activities in Israel and we believe this provides us with access to world class engineering talent. Our research and development expenses were $10.4 million, $14.4 million and $21.7 million in 2013, 2014 and 2015, respectively.

Intellectual Property

We rely on a combination of patent, trademark, copyright and trade secret laws, confidentiality procedures and contractual provisions to protect our technology and the related intellectual property.

The claims for which we have sought patent protection relate to several elements in our technology, including the Digital Vault, Discovery & Audit tool, Privileged Threat Analytics, Privileged Session Manager and Application Identity Manager.

We generally enter into confidentiality agreements with our employees, consultants, service providers, resellers and customers and generally limit internal and external access to, and distribution of, our proprietary information and proprietary technology through certain procedural safeguards. These agreements may not effectively prevent unauthorized use or disclosure of our intellectual property or technology and may not provide an adequate remedy in the event of unauthorized use or disclosure of our intellectual property or technology.

Our industry is characterized by the existence of a large number of relevant patents and frequent claims and related litigation regarding patent and other intellectual property rights. In particular, leading companies in the security industry have extensive patent portfolios. If we become more successful, we believe that competitors will be more likely to try to develop products that are similar to ours and that may infringe our proprietary rights. It may also be more likely that competitors or third parties will claim that our products infringe their proprietary rights. From time to time, third parties have asserted and may assert their patent, copyright, trademark and other intellectual property rights against us, our channel partners, users or customers, whom our standard license and other agreements obligate us to indemnify against such claims under certain circumstances. Successful claims of infringement or misappropriation by a third party could prevent us from distributing certain products or performing certain services or could require us to pay substantial damages (including, for example, treble damages if we are found to have willfully infringed patents and increased statutory damages if we are found to have willfully infringed copyrights), royalties or other fees. Such claims also could require us to cease making, licensing or using solutions that are alleged to infringe or misappropriate the intellectual property of others, or to expend additional development resources to attempt to redesign our products or services or otherwise to develop non-infringing technology; enter into potentially unfavorable royalty or license agreements in order to obtain the right to use necessary technologies or intellectual property rights; and to indemnify our partners or other third parties. Even if third parties may offer a license to their technology, the terms of any offered license may not be acceptable, and the failure to obtain a license or the costs associated with any license could cause our business, results of operations or financial condition to be materially and adversely affected.

Competition

The IT security market in which we operate is characterized by intense competition, constant change and innovation. We believe that none of our competitors offer a fully comprehensive and integrated privileged account security solution; however, we do compete with companies that offer a broad array of IT security products. Our current and potential future competitors include CA, Inc., Dell Inc., International Business Machines Corporation, Microsoft Corporation and Oracle Corporation, in the access and identity management market, as well as providers of advanced threat protection solutions such as Hewlett-Packard Company, EMC Corporation (which has signed an agreement to be acquired by Dell Inc.), International Business Machines Corporation, FireEye, Inc., Splunk Inc., Check Point Software Technologies Ltd. and Palo Alto Networks, Inc. and other smaller companies that offer products with a more limited range of functionality than our own offerings.

The principal competitive factors in our market include:

the breadth and completeness of a security solution;

reliability and effectiveness in protecting, detecting and responding to cyber attacks;

analytics and accountability at an individual user level;

ability of customers to achieve and maintain compliance with compliance standards and audit requirements;

strength of sale and marketing efforts, including distribution and channel relationships;

global reach and customer base;

scalability and ease of integration with an organization’s existing IT infrastructure and security investments;

brand awareness and reputation;

innovation and thought leadership;

quality of customer support;

speed at which a solution can be deployed; and

price of a solution and cost of maintenance and professional services.

We believe we compete favorably with our competitors on the basis of these factors. However, some of our current and potential future competitors may enjoy potential competitive advantages, such as greater name recognition, longer operating history, larger market share, larger existing user base and greater financial, technical and other resources.

Properties

Our corporate headquarters are located in Petach Tikva, Israel in an office consisting of approximately 47,200 square feet. In February 2015, we signed a new lease with our current landlord for different premises in Petach Tikva consisting of up to approximately 90,000 square feet. This new lease is scheduled to commence in July 2017, at which time our current lease would expire. The new lease expires in June 2022. Our U.S. headquarters are located in Newton, Massachusetts in an office consisting of approximately 21,000 square feet. The lease for this office expires in April 2022 with the option to extend for two successive five-year periods. We maintain additional sales offices in England, France, Germany, Singapore, Australia, Italy, Netherlands and Turkey, and a second research and development office in Israel of approximately 4,300 square feet following the acquisition of Cybertinel and Viewfinity. We believe that our facilities are sufficient to meet our ongoing needs and that if we require additional space to accommodate our growth we will be able to obtain additional facilities on commercially reasonable terms.

Legal Proceedings

See “Item 8.A. Financial Information—Consolidated Financial Statements and Other Financial Information—Legal proceedings.”

Organizational Structure

The legal name of our company is CyberArk Software Ltd. and we are organized under the laws of the State of Israel. We have three wholly-owned subsidiaries: Cyber-Ark Software, Inc., Cyber-Ark Software (UK) Limited and CyberArk Software (Singapore) PTE. LTD. Our wholly-owned United Kingdom subsidiary, Cyber-Ark Software (UK) Limited, has two wholly-owned subsidiaries, which are incorporated in Germany and Italy, respectively: Cyber-Ark Software (DACH) GmbH and CyberArk Software Italy S.r.l. Our United Kingdom subsidiary also operates a branch office in Paris, France.

Following the acquisitions conducted in 2015, Viewfinity Ltd. and Cybertinel Ltd., companies incorporated in Israel, became wholly-owned subsidiaries of CyberArk Software Ltd., and Viewfinity, Inc., a company incorporated in Delaware, United States, became a wholly-owned subsidiary of Cyber-Ark Software, Inc. We expect to merge these companies into CyberArk Software Ltd. and our U.S. subsidiary, respectively.

Property, Plants and Equipment

See “Item 4.B.—Business Overview—Properties” for a discussion of property, plants and equipment.

ITEM 4A.

UNRESOLVED STAFF COMMENTS

Not applicable.

ITEM 5.

OPERATING AND FINANCIAL REVIEW AND PROSPECTS

Company Overview

We are a global leader and pioneer of a new layer of IT security solutions that protects organizations from cyber attacks that have made their way inside the network perimeter to strike at the heart of the enterprise. Our software solutions are focused on protecting privileged accounts, which have become a critical target in the lifecycle of today’s cyber attacks. Privileged accounts act as the “keys to the IT kingdom,” providing complete access to, and control of, all parts of IT infrastructure, industrial control systems and critical business data. In the hands of an external attacker or malicious insider, privileged accounts allow attackers to take control of and disrupt an organization’s IT and industrial control infrastructures, steal confidential information and commit financial fraud. Our comprehensive solutions proactively protect privileged accounts, monitor privileged activity and detect malicious privileged behavior. Our customers use our innovative solutions to introduce this new security layer to protect against, detect and respond to cyber attacks before they strike vital systems and compromise sensitive data.

We have a history of innovation. We started operations in 1999 with the vision of protecting high-value business data and pioneered our Digital Vault technology, which is the foundation of our platform. That same year, we began offering our first product, the Sensitive Information Management Solution (previously called the Sensitive Document Vault), which provides a secure platform through which our customers’ employees can share sensitive files. We believe our early innovation in vaulting technology enabled us to evolve into a company that provides comprehensive security solutions built for privileged accounts. In 2005, we introduced our Privileged Account Security Solution, which has become our leading offering and reflects our emphasis on protecting privileged accounts across an organization. Our Privileged Account Security Solution leverages a shared technology platform and consists of several products: Enterprise Password Vault, SSH Key Manager, Privileged Session Manager, Privileged Threat Analytics, Application Identity Manager, Viewfinity and On-Demand Privileges Manager.

We derive our revenues from licensing our cybersecurity software, selling maintenance and support contracts, and providing professional services to the extent requested by customers. Our license revenues consist primarily of revenues from sales of our Privileged Account Security Solution. Our customers typically purchase one year and, to a lesser extent, three years, of maintenance and support in conjunction with their initial purchase of our products. Thereafter, they can renew such maintenance and support for additional one or three-year periods.

We seek to foster long-term relationships with our customers. We have a significant opportunity to generate additional revenues from our existing customers by helping them identify and address gaps in their current privileged account security strategy. Our platform provides our customers flexibility to initially deploy one or more of our products for a single use case and then expand usage over time to address more use cases, to add incremental licenses for more users or systems or to license additional products from our comprehensive platform. We measure the perpetual license maintenance renewal rate for our customers over a 12-month period, based on a dollar renewal rate of contracts expiring during that time period. Our renewal rate for each of the years ended December 31, 2013, 2014 and 2015 was over 90%. Our key strategies to maintain our renewal rate include focusing on the quality and reliability of our product updates and our technical support services.

We sell our products directly and through a global network of channel partners, including distributors and resellers, who then sell to their end customers. In 2015, we generated approximately 60% of our revenues through sales made by our global network of channel partners, with the balance being generated through our direct sales force. We refer to end customers as our customers throughout this annual report. We believe that our hybrid sales model, which combines the leverage of channel sales with the account control of direct sales, will continue to play an important role in the growth of our customer base. Our hybrid sales model has aided our global growth by allowing us to partner with local distributors while being able to use our direct sales team in locations where that approach is advantageous to our business.

We market and sell our solutions to organizations in a variety of industries and geographies. As of December 31, 2015, we had approximately 2,500 customers, including approximately 40% of the Fortune 100 and approximately 20% of the Global 2000. We define a customer to include a distinct entity, division or business unit of a company. The growth of our business and our future success depend on our ability to expand our customer base and increase our sales to existing customers, which depend on many factors, including our ability to expand our sales force, introduce new products and grow our relationships with channel partners. While each of these areas presents significant opportunities for us, they also pose important challenges and risks that we must successfully address in order to sustain the growth of our business and improve our results of operations. Additionally, the IT security market in which we operate is characterized by intense competition, constant innovation and evolving security needs, each of which may impact our ability to grow our business.

We have experienced strong growth over the last several years, as evidenced by a compound annual growth rate in revenues of 55.9% from 2013 to 2015. We have also increased our number of employees and subcontractors from 317 as of December 31, 2013 to 644 as of December 31, 2015. We intend to continue to aggressively grow our business to meet the needs of our customers and to pursue opportunities in new and existing verticals, geographies and products. We intend to continue to invest in the development of our sales and marketing teams, with a particular focus on expanding our channel partnerships, targeting new customers, creating technology partnerships and solidifying relationships with existing customers. We also plan to continue to invest in research and development in order to continue to develop technology for both existing and new products.

During the years ended December 31, 2013, 2014 and 2015, our revenues were $66.2 million, $103.0 million and $160.8 million, respectively, representing year-over-year growth of 55.7% and 56.1% in 2014 and 2015, respectively, and with maintenance and professional services comprising over 37% of our revenues each year. Our net income for the years ended December 31, 2013, 2014 and 2015 was $6.6 million, $10.0 million and $25.8 million, respectively.

Key Financial Metrics

We monitor several key financial metrics to help us evaluate growth trends, establish budgets, measure the effectiveness of our sales and marketing efforts and assess operational efficiencies. The key financial metrics that we monitor are as follows:

	Year ended December 31,
	2013		2014		2015
	(in thousands)
Revenues	$	66,157	$	102,999	$	160,812
Non-GAAP operating income(1)		9,482		22,027		43,641
Non-GAAP net income(1)		8,484		15,836		35,262
Net cash provided by operating activities		20,159		23,195		59,160
Total deferred revenues (as of period-end)		24,478		32,160		54,389

(1)	For a reconciliation of non-GAAP operating income to operating income and of non-GAAP net income to net income, the nearest comparable GAAP measures, see “Item 3.A. Selected Financial Data.”

Revenues. We derive our revenues from licensing our cybersecurity software, selling maintenance and support contracts, and providing professional services to the extent requested by customers. We review our revenues generally to assess the overall health of our business and our license revenues in particular to assess the adoption of our software and our growth in the markets we serve.

We consider our license revenues to be particularly important in assessing our results of operations because license fees, particularly from new customers, impact both our short-term and long-term revenues. New customers impact our revenues favorably in the short-term because we recognize substantially all license fees immediately upon delivery. New customers contribute significantly to our revenues in the long term because the size of our maintenance and support contracts is directly related to our licenses revenues, but revenues from maintenance and support contracts are recognized on a straight-line basis over the term of the related contract. This fact, coupled with the high renewal rate for our maintenance and support contracts, means that a meaningful portion of the revenues we report each period are recognized from deferred revenues generated by maintenance and support contracts entered into during previous quarters.

The amount that a customer pays for a license can vary from a few thousand dollars to many millions of dollars depending on its scope. We generally license our products on a price per user or price per server basis; however, our license agreements with a small number of our largest customers do not contain any limit on the number of users or servers in recognition of the size of the overall agreement. We also license certain of our products based on the number of concurrent sessions monitored or endpoints secured. As a result, we do not track, and are unable to track, the amount of license revenues we generate on a per user or per server basis. We do, however, maintain internal price guidelines for different size transactions and, since our cost of license revenues is negligible, we generate incremental profit from every license. Although we are focused on growing our customer base, we also do not focus on the exact number of customers that we add in a given period because our revenues are also a function of the size of initial sales to new customers and the size of upsells to existing customers. We seek to increase the number of large transactions that we enter into because they better leverage our operating expense base, and particularly our sales and marketing expenses, and also generate larger maintenance and support contracts to drive future revenues and margins.

Because the size of our maintenance and support contracts is directly related to our licenses revenues and because the rates that we charge for professional services fluctuate very little, the drivers of changes in these sources of revenues have to date been volume-based. Historically, there has been little fluctuation in price when we renew a contract for maintenance and support or for professional services. While the demand for professional services is expected to increase as our customers and license base grow, we expect that our channel partners will increase the amount of such services that they provide. Therefore, while we expect an increase in the dollar amount of our professional services revenue, we do not expect our professional services revenues to increase materially as a percentage of total revenues.

See “—Components of Statements of Operations—Revenues” for more information.

Non-GAAP Operating Income and Non-GAAP Net Income. Non-GAAP operating income and non-GAAP net income are non-GAAP financial measures. We define non-GAAP operating income and non-GAAP net income as operating income and net income, respectively, which each exclude (i) share-based compensation expense, (ii) expenses related to the March 2015 public offering of ordinary shares by certain of our shareholders and to the June 2015 public offering of ordinary shares by us and certain of our shareholders, (iii) expenses related to acquisitions and (iv) amortization of intangible assets related to acquisitions. Non-GAAP net income also excludes (i) financial expenses resulting from the revaluation of warrants to purchase preferred shares and (ii) tax effects related to the non-GAAP adjustments set forth above.

Because of varying available valuation methodologies, subjective assumptions and the variety of equity instruments that can impact a company’s non-cash expense, we believe that providing non-GAAP operating income and non-GAAP net income that exclude, as appropriate, share-based compensation expenses, expenses relating to public offerings of our ordinary shares, financial expenses resulting from the valuation of warrants to purchase preferred shares, expenses related to acquisitions, amortization of intangible assets related to acquisitions and the tax effects related to these non-GAAP adjustments allows for more meaningful comparisons between our operating results from period to period. Share-based compensation expense has been, and will continue to be for the foreseeable future, a significant recurring expense in our business and an important part of the compensation we provide to employees. Additionally, excluding financial expenses with respect to revaluation of warrants to purchase preferred shares allows for more meaningful comparison between our net income from period to period. As these warrants were exercised in connection with our initial public offering, they are no longer revalued at each balance sheet date. We also believe that expenses related to the public offerings of our ordinary shares in March 2015 and June 2015, expenses related to our acquisitions and amortization of intangible assets related to acquisitions, do not reflect the performance of our core business and would impact period-to-period comparability. Each of our non-GAAP financial measures is an important tool for financial and operational decision making and for evaluating our own operating results over different periods of time. In particular, these financial measures reflect our operating expenses, the largest of which is currently sales and marketing. Accordingly, we assess the effectiveness of our sales and marketing efforts in part by considering whether increases in such expenditures are reflected in increased revenues and increased non-GAAP operating income and non-GAAP net income. The material factors driving changes in these financial measures are discussed under the subheading “Revenues” within “—Comparison of Period to Period Results of Operations.”

Net Cash Provided by Operating Activities. We monitor net cash provided by operating activities as a measure of our overall business performance. Our net cash provided by operating activities is driven in large part by net income and from up-front payments for maintenance and support contracts and professional services. Monitoring net cash provided by operating activities enables us to analyze our financial performance as it includes our deferred revenues and removes the non-cash effects of certain items such as depreciation and share-based compensation expense, thereby allowing us to better understand and manage the cash needs of our business. Substantially all of the increase in our net cash provided by operating activities has been from growth in our net income (as adjusted for non-cash items) and in our deferred revenues. The material factors driving changes in our net income and our deferred revenues (which are driven by growth of our license revenues) are discussed under “—Comparison of Period to Period Results of Operations.”

Total Deferred Revenues. Our total deferred revenues consist of amounts that have been collected but that have not yet been recognized as revenues because they do not meet the applicable criteria. The substantial majority of our deferred revenues consists of the unrecognized portion of upfront payments associated with maintenance and support contracts. The remaining balance of our deferred revenues consists of payments for licenses, and, to a lesser extent, professional services that could not yet be recognized. We monitor our total deferred revenues because it represents a significant portion of revenues to be recognized in future periods. Substantially all of the increase in our total deferred revenues has been from growth in our maintenance and support contracts which, in turn, is driven by growth of our license revenues. The material factors driving changes in our license revenues are discussed under “—Comparison of Period to Period Results of Operations.”

Operating Results

The following discussion and analysis should be read in conjunction with the section titled “Item 3.A. Selected Financial Data” of this annual report and our consolidated financial statements and the related notes contained elsewhere in this annual report. This discussion and analysis may contain forward-looking statements based upon current expectations that involve risks and uncertainties. Our actual results may differ materially from those anticipated in these forward-looking statements as a result of various factors, including those set forth in “Item 3.D. Risk Factors” of this annual report. Our financial statements have been prepared in accordance with U.S. GAAP.

Components of Statements of Operations

Revenues

Our revenues are comprised of the following:

License Revenues. License revenues are generated from sales of perpetual licenses for our cybersecurity software: Privileged Account Security Solution and Sensitive Information Management Solution.

Privileged Account Security Solution—The substantial majority of our license revenues has been from sales of our Privileged Account Security Solution. Customers can purchase Enterprise Password Vault, SSH Key Manager, Privileged Session Manager, Privileged Threat Analytics, Application Identity Manager, Viewfinity and On-Demand Privileges Manager. We license our Enterprise Password Vault to our customers based on the number of privileged account users. We offer customers the choice of licensing our Privileged Session Manager based on the number of devices secured or the number of concurrent sessions it monitors. We license our SSH Key Manager, Application Identity Manager and On-Demand Privileges Manager to our customers based on the number of servers that each such product protects. We license our Privileged Threat Analytics to customers based on the number of protected endpoints, such as servers, desktops, databases or mobile devices. We license our Viewfinity to our customers based on the number of protected endpoints such as servers and desktops.

Sensitive Information Management Solution—We generate additional license revenues through sales of our Sensitive Information Management Solution, our first product to market. Customers license the Sensitive Information Management Solution based on the permitted number of users of the software.

Maintenance and Professional Services Revenues. Maintenance revenues are generated from maintenance and service contracts purchased by our customers in order to gain access to the latest software enhancements and updates on an ‘if and when available’ basis and to telephone and email technical support. We also offer professional services focused on both deployment and training our customers to fully leverage the use of our products.

Geographic Breakdown of Revenues

The United States is our biggest market, with the balance of our revenues generated from the EMEA region and the rest of the world, including North and South America (excluding the United States) as well as countries in the Asia Pacific region. The following table sets forth the geographic breakdown of our revenues by region for the periods indicated:

	Year ended December 31,
	2013				2014				2015
	(in thousands)
United States	$	32,041	48.4	%	$	60,761	59.0	%	$	92,034	57.2	%
EMEA		25,796	39.0	%		33,198	32.2	%		50,644	31.5	%
Rest of World		8,320	12.6	%		9,040	8.8	%		18,134	11.3	%

Total revenues	$	66,157	100.0	%	$	102,999	100.0	%	$	160,812	100.0	%

Cost of Revenues

Our total cost of revenues is comprised of the following:

·	Cost of License Revenues. Cost of license revenues consists primarily of shipping costs associated with delivery of our software and license payments to third-party software vendors. We expect the absolute cost of license revenues to increase as our license revenues increase.

Cost of Maintenance and Professional Services Revenues. Cost of maintenance and professional services revenues is primarily comprised of personnel costs for our global customer support organization. Personnel costs associated with customer support consist of salaries, benefits, bonuses and share-based compensation. We expect the absolute cost of maintenance and professional services revenues to increase as our customer base grows and as we hire additional professional services and technical support personnel.

Gross Profit and Gross Margin

Gross profit is total revenues less total cost of revenues. Gross margin is gross profit expressed as a percentage of total revenues. Our gross margin has historically fluctuated slightly from period to period as a result of changes in the mix of license revenues and maintenance and professional services revenues and we expect this pattern to continue.

Operating Expenses

Our operating expenses are classified into three categories: research and development, sales and marketing and general and administrative. For each category, the largest component is personnel costs, which consists of salaries, employee benefits (including commissions and bonuses) and share-based compensation expense. Operating expenses also include allocated overhead costs for facilities and foreign currency hedging contracts gains and losses. Allocated costs for facilities primarily consist of rent, depreciation and office maintenance and utilities. Operating expenses are generally recognized as incurred. We expect personnel and all allocated costs to continue to increase in absolute dollars as we hire new employees and add facilities to continue to grow our business. We expect operating margins to decline in the near term compared to prior periods as we further increase our headcount to support the future growth of our business.

Research and Development. Research and development expenses consist primarily of personnel costs attributable to our research and development personnel and consultants as well as allocated overhead costs. We expense research and development expenses as incurred. We expect that our research and development expenses will continue to increase in absolute dollars and, in the near term, as a percentage of revenues as we increase our research and development headcount to further strengthen our technology platform and invest in the development of both existing and new products.

Sales and Marketing. Sales and marketing expenses are the largest component of our operating expenses and consist primarily of personnel costs, including variable compensation, as well as marketing and business development costs, product certifications, travel expenses and allocated overhead costs. We expect that sales and marketing expenses will continue to increase in absolute dollars and, in the near term, as a percentage of our revenues as we plan to expand our sales and marketing efforts globally. We expect sales and marketing expenses to be our largest category of operating expenses.

General and Administrative. General and administrative expenses consist primarily of personnel costs for our executive, finance, human resources, legal and administrative personnel. General and administrative expenses also include external legal, accounting and other professional service fees. We expect that general and administrative expense will increase in absolute dollars as we grow and expand our operations and operate as a public company, including higher legal, corporate insurance, investor relations and accounting expenses, and the additional costs of achieving and maintaining compliance with the Sarbanes-Oxley Act and related regulations.

Financial Income (Expenses), Net

Financial income (expenses), net consists of interest income, foreign currency exchange gains or losses, foreign exchange forward transactions and warrant liability expenses. Interest income consists of interest earned on our cash, cash equivalents and short-term bank deposits. We expect interest income to vary depending on our average investment balances and market interest rates during each reporting period. Foreign currency exchange changes reflect gains or losses related to transactions denominated in currencies other than the U.S. dollar. Warrant liability changes relate to our preferred share warrants. Our preferred share warrants are classified as a liability on our consolidated balance sheets and, as such, are remeasured to fair value each period with a corresponding expense from the adjustment recorded as financial income (expenses), net. Immediately prior to the completion of our initial public offering, all of our preferred share warrants were exercised and, accordingly, we no longer record any financial expenses in respect of them on our statement of operations. As of the most recent reporting period, we did not have any indebtedness for borrowed amounts.

Taxes on Income

The standard corporate tax rate in Israel is currently 25.0%, and was 26.5% for 2014 and 2015.

As discussed in greater detail below under “Israeli Tax Consideration and Government Programs”, we have received various tax benefits under the Investment Law. Under the Investment Law, our effective tax rate to be paid with respect to our Israeli taxable income under these benefits programs is 16.0%.

Under the Investment Law and other Israeli legislation, we are entitled to certain additional tax benefits, including accelerated depreciation and amortization rates for tax purposes on certain assets, deduction of public offering expenses in three equal annual installments.

Our non-Israeli subsidiaries are taxed according to the tax laws in their respective jurisdictions of organization. Due to our multi-jurisdictional operations, we apply significant judgment to determine our consolidated income tax position.

Comparison of Period to Period Results of Operations

The following table sets forth our results of operations in dollars and as a percentage of revenues for the periods indicated:

	Year ended December 31,
	2013						2014						2015
	Amount			% of Revenues			Amount			% of Revenues			Amount			% of Revenues
	(in thousands, except for %)
Revenues:
License	$	38,907			58.8	%	$	61,320			59.5	%	$	100,113			62.3	%
Maintenance and professional services		27,250			41.2			41,679			40.5			60,699			37.7

Total revenues		66,157			100.0			102,999			100.0			160,812			100.0

Cost of revenues:
License		1,216			1.8			2,654			2.6			5,088			3.2
Maintenance and professional services		7,860			11.9			12,053			11.7			17,572			10.9

Total cost of revenues		9,076			13.7			14,707			14.3			22,660			14.1

Gross profit		57,081			86.3			88,292			85.7			138,152			85.9

Operating expenses:
Research and development		10,404			15.7			14,400			14.0			21,734			13.5
Sales and marketing		32,840			49.7			44,943			43.6			66,206			41.2
General and administrative		4,758			7.2			8,495			8.2			16,990			10.6

Total operating expenses		48,002			72.6			67,838			65.8			104,930			65.3

Operating income		9,079			13.7			20,454			19.9			33,222			20.6
Financial expenses, net		(1,124	)		(1.7	)		(5,988	)		(5.8	)		(1,479	)		(0.9	)

Income before taxes on income		7,955			12.0			14,466			14.1			31,743			19.7
Taxes on income		(1,320	)		(2.0	)		(4,512	)		(4.4	)		(5,949	)		(3.7	)

Net income	$	6,635			10.0	%	$	9,954			9.7	%	$	25,794			16.0	%

Year Ended December 31, 2014 Compared to Year Ended December 31, 2015

Revenues

	Year ended December 31,
	2014					2015					Change
	Amount		% of Revenues			Amount		% of Revenues			Amount		%
	($ in thousands)
Revenues:
License	$	61,320		59.5	%	$	100,113		62.3	%	$	38,793		63.3	%
Maintenance and professional services		41,679		40.5			60,699		37.7			19,020		45.6

Total revenues	$	102,999		100.0	%	$	160,812		100.0	%	$	57,813		56.1	%

Revenues increased by $57.8 million, or 56.1%, from $103.0 million in 2014 to $160.8 million in 2015. This increase was due to increased sales of our solutions. This increase was also driven by growth in both our license revenues and our maintenance and professional services revenue. This growth was most pronounced in the United States where revenues increased by $31.3 million compared to increases of $17.4 million in EMEA and $9.1 million in the rest of the world. The significant increase in revenues from the United States primarily resulted from a higher volume of deals including large transactions of greater than $1.0 million each that together accounted for $11.7 million. Multiple large transactions or even a single large transaction in a specific period could materially impact relative growth rates among our different regions for a particular period. We increased our number of customers from approximately 1,800 as of December 31, 2014 to approximately 2,500 as of December 31, 2015.

License revenues increased by $38.8 million, or 63.3%, from $61.3 million in 2014 to $100.1 million in 2015. In 2015, approximately 50% of license revenues were generated from sales to customers from whom we had generated revenues before this period. Substantially all of the license revenue growth resulted from increased sales of our Privileged Account Security Solution, driven by increased demand for our Enterprise Password Vault and Privileged Session Manager.

Maintenance and professional services revenues increased by $19.0 million, or 45.6%, from $41.7 million in 2014 to $60.7 million in 2015. Maintenance revenues increased by $15.0 million from $33.1 million in 2014 to $48.1 million in 2015, with renewals accounting for approximately $4.7 million and initial maintenance contracts for approximately $10.3 million, respectively, of this increase. Professional services revenues increased by $4.0 million from $8.6 million in 2014 to $12.6 million in 2015 due to the provision of more services to customers.

Cost of Revenues and Gross Profit

	Year ended December 31,
	2014					2015					Change
	Amount		% of Revenues			Amount		% of Revenues			Amount		%
	($ in thousands)
Cost of revenues:
License	$	2,654		2.6	%	$	5,088		3.2	%	$	2,434		91.7	%
Maintenance and professional services		12,053		11.7			17,572		10.9			5,519		45.8

Total cost of revenues	$	14,707		14.3	%	$	22,660		14.1	%	$	7,953		54.1	%

Gross profit	$	88,292		85.7	%	$	138,152		85.9	%	$	49,860		56.5	%

Cost of license revenues increased by $2.4 million, or 91.7%, from $2.7 million in 2014 to $5.1 million in 2015. The increase in cost of license revenues was driven primarily by an increase in license revenue and amortization of intangible assets from our recent acquisitions.

Cost of maintenance and professional services revenues increased by $5.5 million, or 45.8%, from $12.1 million in 2014 to $17.6 million in 2015. The increase in cost of maintenance and professional services revenues was driven primarily by a $3.5 million increase in personnel costs and related expenses as our technical support and professional services headcount grew from 76 at the end of 2014 to 118 at the end of 2015.

Gross profit increased by $49.9 million, or 56.5%, from $88.3 million in 2014 to $138.2 million in 2015. Gross margins increased from 85.7% in 2014 to 85.9% in 2015. This increase was driven by our revenue growth outpacing the growth of our cost of revenue.

Operating Expenses

	Year ended December 31,
	2014					2015					Change
	Amount		% of Revenues			Amount		% of Revenues			Amount		%
	($ in thousands)
Operating expenses:
Research and development	$	14,400		14.0	%	$	21,734		13.5	%	$	7,334		50.9	%
Sales and marketing		44,943		43.6			66,206		41.2			21,263		47.3
General and administrative		8,495		8.2			16,990		10.6			8,495		100.0

Total operating expenses	$	67,838		65.8	%	$	104,930		65.3	%	$	37,092		54.7	%

Research and Development. Research and development expenses increased by $7.3 million, or 50.9%, from $14.4 million in 2014 to $21.7 million in 2015. This increase was primarily attributable to a $5.7 million increase in personnel costs and related expenses as we increased our research and development team headcount from 119 at the end of 2014 to 176 at the end of 2015 to support continued investment in our future product and service offerings. The increase was also attributable to a $0.7 million increase related to amortization of intangible assets from our recent acquisitions.

Sales and Marketing. Sales and marketing expenses increased by $21.3 million, or 47.3%, from $44.9 million in 2014 to $66.2 million in 2015. This increase was primarily attributable to a $17.5 million increase in expenses for salaries and related expenses due to increased headcount in all regions to expand our sales and marketing organization coupled with a $1.6 million increase in expenses related to our marketing programs and a $0.7 million increase in travel and related expenses. Our sales and marketing headcount grew from 202 at the end of 2014 to 294 at the end of 2015.

General and Administrative. General and administrative expenses increased by $8.5 million, or 100.0%, from $8.5 million in 2014 to $17.0 million in 2015. This increase was primarily attributable to an increase of $4.0 million in payroll expenses, including variable compensation to executive management, due to increased headcount coupled with a $3.5 million increase in legal and accounting fees of which $2.2 million was expenses related to acquisitions and expenses related to the public offerings of our ordinary shares in March 2015 and June 2015.

Financial Expenses, Net. Financial expenses decreased by $4.5 million from $6.0 million in 2014 to $1.5 million in 2015. This decrease resulted primarily from expenses associated with the revaluation of fair value of warrants to purchase series B3 preferred shares of $4.3 million in 2014.

Taxes on Income. Taxes on income increased from $4.5 million in 2014 to $5.9 million in 2015. This increase was attributable to the increase in pre-tax income partially offset by tax benefits we had from our recent acquisitions

Year Ended December 31, 2013 Compared to Year Ended December 31, 2014

Revenues


	Year ended December 31,
	2013					2014					Change
	Amount		% of Revenues			Amount		% of Revenues			Amount		%
	($ in thousands)
Revenues:
License	$	38,907		58.8	%	$	61,320		59.5	%	$	22,413		57.6	%
Maintenance and professional services		27,250		41.2			41,679		40.5			14,429		53.0

Total revenues	$	66,157		100.0	%	$	102,999		100.0	%	$	36,842		55.7	%

Revenues increased by $36.8 million, or 55.7%, from $66.2 million in 2013 to $103.0 million in 2014. This increase was due to increased sales volume of our solutions. This increase was also driven by growth in both our license revenues and our maintenance and professional services revenue. This growth was most pronounced in the United States where revenues increased by $28.7 million compared to increases of $7.4 million in the EMEA and $0.7 million in the rest of the world. The significant increase in revenues from the United States primarily resulted from large transactions of greater than $1.0 million each that together accounted for $14.9 million. Multiple large transactions or even a single large transaction in a specific period could materially impact relative growth rates among our different regions for a particular period. We increased our number of customers from approximately 1,500 as of December 31, 2013 to approximately 1,800 as of December 31, 2014.

License revenues increased by $22.4 million, or 57.6%, from $38.9 million in 2013 to $61.3 million in 2014. In 2014, approximately 40% of license revenues were generated from sales to customers from whom we had generated revenues before this period. Substantially all of the license revenue growth resulted from increased sales of our Privileged Account Security Solution, driven by increased demand for our Enterprise Password Vault, Privileged Session Manager and our Application Identity Manager.

Maintenance and professional services revenues increased by $14.4 million, or 53.0%, from $27.3 million in 2013 to $41.7 million in 2014. Maintenance revenues increased by $10.8 million from $22.3 million in 2013 to $33.1 million in 2014, with renewals accounting for approximately $5.9 million and initial maintenance contracts for approximately $4.9 million, respectively, of this increase. Professional services revenues increased by $3.6 million from $5.0 million in 2013 to $8.6 million in 2014 due to the provision of more services to customers.

Cost of Revenues and Gross Profit

	Year ended December 31,
	2013					2014					Change
	Amount		% of Revenues			Amount		% of Revenues			Amount		%
	($ in thousands)
Cost of revenues:
License	$	1,216		1.8	%	$	2,654		2.6	%	$	1,438		118.3	%
Maintenance and professional services		7,860		11.9			12,053		11.7			4,193		53.3

Total cost of revenues	$	9,076		13.7	%	$	14,707		14.3	%	$	5,631		62.0	%

Gross profit	$	57,081		86.3	%	$	88,292		85.7	%	$	31,211		54.7	%