Cabot Small Cap Confidential 251

This month we’re looking past all the current uncertainty in the market at a profitable, young company that should hold its own during this rough patch then accelerate growth into the back half of 2020 (assuming the pandemic eases as we move into the summer months).

The company offers intelligent identity solutions for global enterprises. These solutions are strategic imperatives because they help workers do their job from anywhere and help companies streamline customer experiences.

It’s not the type of stock that’s likely to surge on expectations of an immediate surge in demand, like Zoom Video (ZM) or Teladoc (TDOC). But with 115% net revenue retention the company should grow with current clients in the near-term, then grab its fair share of new business once economic activity picks up again.

We start today with a half position given the market conditions. All the details are inside.

Cabot Small Cap Confidential 251

[premium_html_toc post_id="201855"]

The Big Idea
In the old days, before cloud computing, mobile apps, application programming interfaces (APIs), big data depositories, and all manner of digital transformation initiatives, companies relied on network perimeter security solutions to keep bad actors away.
That’s all changing.

Today, with workers, consumers, business partners and machines accessing sensitive computing resources from all corners of the globe, on all manner of devices and at all hours, the battleground has shifted from protecting the network perimeter to protecting individual identities.

The clearest data point to illustrate exactly why identity solutions have become mission critical for so many organizations is that over 80% of hacking-related threats involve identity theft.

Organizations can dramatically reduce that threat if they only allow the right users to access approved resources at the appropriate times.

Doing so isn’t all that easy, however, especially for large and complex global enterprises that have many departments and a wide variety of resources to protect.

They need identity solutions that work across different IT infrastructures, integrate with many other IT solutions and partners, offer self-service capabilities, can be implemented relatively quickly, and can be scaled up depending on strategic priorities.

This area of the market, the enterprise market, is where today’s recommendation generates the bulk of its revenue. These are companies like Intuit, Progressive, Netflix and Hewlett Packard.

It’s a big market, valued at roughly $25 billion. And while near-term disruptions are likely due to COVID-19, the pandemic has shown exactly why intelligent identity solutions are so important.

This week’s addition to Cabot Small-Cap Confidential is a leader in identity management. It has a subscription business model, a stable growth trajectory among large enterprises and is profitable.

In short, it’s an attractive asset to start buying now when few investors are paying attention. We’ll average in with a half position today.

The Company
Ping Identity (PING) is a $1.4 billion market cap company that has developed an identity management software platform for enterprises that ensures secure access to any service, application or application program interface (API), from any device.
Solutions, which include secure single sign-on (SSO), adaptive multi-factor authentication (MFA), API Intelligence and more, help organizations prevent security breaches, boost productivity and enhance customer experiences.

These types of security products were in high demand before COVID-19 struck. They’ll likely be in higher demand as more work is done out of office settings in the coming weeks and months, and they should remain in demand once the pandemic has passed.

The big picture trends toward distributed workforces, digital transformation and cloud computing – all of which require authorized access to apps and databases from outside of a network perimeter – aren’t changing.

Ping’s platform has been gaining customers because it gives enterprises what they need, including performance at scale, flexibility to work across different IT environments, and integrations with solutions that large enterprises have already invested a ton of money in.

In other words, Ping makes complex security requirements relatively simple.

One of the key selling points is that Ping’s solutions have a wide variety of use cases spanning customers, workers, partners and IoT devices.

Ping’s primary use case, accounting for just over 40% of revenue, is for enterprises to extend identity solutions to customers so they have positive user experiences. Consumer solutions reduce the frustrations of multiple passwords, sign-on sites and scattered user data that we’ve all dealt with before.

Enterprises also use Ping’s solutions for their own workforces and partners to provide seamless access to all cloud and on-premise apps and APIs. The most recent product bundle, Workforce360, includes the most common solutions to keep workers productive while protecting apps, directories and other resources.

Finally, Ping’s solutions are used to manage and authenticate IoT devices, including consumer devices, connected vehicles, and to authenticate human-to-machine and machine-to-machine connections.

Ping’s 1,361 customers (up 6% in 2019) include many of the world’s largest companies, and over half of the Fortune 100. Current customers include Netflix, Equinix, HP, Intuit, Cisco, Walgreens, Marriott, Chevron, Kraft Foods, GlaxoSmithKline and Applied Materials.

Customers are typically looking for solutions that work in hybrid IT infrastructures, are easy to integrate and can scale up based on the organization’s needs. No customer accounts for more than 5% of revenue. In 2019, 38 customers generated annual revenue over $1 million (up 52%) while 232 generated annual revenue over $250,000 (up 15%).

The Product
Ping’s Intelligent Identity Platform enables secure access to any service, app or API from any device. It uses AI and ML to analyze devices, user behavior data, applications and networks to make real-time authentication and security control decisions.

When anomalies arise, Ping’s solutions automatically insert extra security steps, such as multi-factor authentication. Solutions can be deployed across cloud, hybrid and on-premise infrastructures. Customers can also connect to both Microsoft cloud infrastructure and services (Azure and Office 365), Google Cloud and Amazon Web Services.

The platform includes six solutions, all of which can be purchased individually or as a set of integrated offerings. It is not necessary to tear out other solutions for an enterprise to begin working with Ping, and the platform uses open standards to ensure interoperability with other vendor solutions.

Secure Single Sign-on (SSO)
The SSO solution lets users sign on and use apps and resources with one set of secure credentials, regardless of their physical location. It provides turnkey integrations for many apps, cloud services, IT infrastructures and directory solutions, including third-party directories.

Adaptive Multi-Factor Authentication (MFA)
Adaptive MFA balances security and user experiences by requiring authentication factors (one-time passwords sent via SMS, voice or email, secure key, biometrics, swipe, etc.) to access sensitive information, complete high-value transactions and complete other high-risk activities. The adaptive component scales the required factors up or down depending on the scenario, type of device being used and pattern of user behavior.

Access Security
Access Security allows the enterprise to apply more security controls over web apps and APIs that work on the URL level to make sure only authorized users can access resources.

Personalized and Unified Profile Directories
The Directory solution securely stores and manages sensitive identity and device data and allows for real-time synching across multiple sources so users have a consistent experience, regardless of where apps and services are deployed.

Data Governance
The Data Governance solution allows precise control over applications and restrict them from accessing sensitive information, such as credit card numbers, social security numbers, billing addresses and user profiles.

API Intelligence
Ping’s API intelligence solution uses MI and AL to continuously inspect, report and take actions on all API activity. It specifically identifies and responds to attacks that are designed to take advantage of weaknesses of individual APIs.

New Solution Packages
Ping has recently introduced two packages for its biggest use cases, Workforce360 and Customer360, to streamline pricing discussions and implementations. These cloud-ready solutions include authentication, SSO, MFA and professional services, and can be deployed in almost any cloud environment.

The Business Model
Ping Identity sells its solutions on a subscription basis (both term-based and SaaS) through a direct sales force and channel partners. Channel partners and system integrators help with implementation. The company typically looks to land within a large enterprise where it solves a specific use case then expand the relationship with additional solutions. This has been working, as evidenced by a 115% dollar-based net retention rate in 2019. Pricing is based on the number of identities, solutions and type of use case. There is seasonality in the business, with revenue typically ramping up into the fourth quarter.

The Bottom Line
In Q4, reported on March 4, revenue was up 14.7% to $68.2 million, beating by $2.5 million. Adjusted EPS of $0.14 beat by $0.04.

Revenue in 2019 rose 21% to $242.9 million, driven by a 22% jump in subscription revenue (up $40.2 million to $225.3 million). Annualized recurring revenue (ARR) was up 23% to $224.9 million. ARR includes both term licenses (up 21% and representing 66% of revenue) and SaaS subscriptions (up 25% and representing 26% of revenue). Professional services revenue was up 6% to $17.6 million, or 7% of total revenue. Adjusted EPS rose from $0.01 in 2018 to $0.21 in 2019.

Ping ended 2019 with $67.6 million in cash and $52.2 million drawn on a $150 million revolving credit facility. It has a history of generating positive operating cash flow ($5.8 million in 2019). On the Q4 conference call management stated it believed positive operating cash flow in 2019 would help Ping to continue investing in the business.

Looking forward, management guided for Q1 2020 revenue of around $61.5 million, implying growth of 22%. Initial 2020 guidance calls for revenue in a range of $263 million to $273 million, implying growth of 8% to 12%. ARR guidance of $263.5 million to $267.5 million implies 17% to 19% growth. Analyst see 2020 adjusted EPS rising by 435 to $0.30. Given the timing of the Q4 call on March 4 it seems logical that management was trying to be conservative, but probably didn’t have a great sense of the COVID-19 impact at the time.

Risk
Near-Term Sales Headwinds: Ping uses a direct sales force, with collaboration from channel partners, to sell and to provide implementation services. With 55% of business influenced by channel partners in 2019 and a high likelihood of significant near-term disruption from COVID-19, it’s likely that Q1 and Q2 will be adversely affected. That said, this should lead to pent-up demand later in the year, which is typically a stronger period for Ping even in a normal market.
Customer Risk: There is some risk that troubled customers may reduce their engagements with Ping in the near-term, most likely by pausing larger rollouts that were previously planned. However, security is mission critical and therefore should be relatively far down the list on the chopping block.

Implementation Risk: With workforces restricted from travel there’s near-term risk that implementations expected to occur in the first half of 2020 will get pushed back and lead to delays due to limited implementation resources when travel restrictions are lifted.

Newly Public Stock: PING went public in September 2019 and isn’t well-known yet. Its higher risk profile could reduce investor interest in the near-term. On a positive note, lockup expiration recently passed.

Competition
Ping Identity competes with legacy providers, including IBM (IBM), Oracle (ORCL) and Broadcom (AVGO), that offered solutions deployed on-premise, making them inflexible, expensive and complicated. It also competes with cloud-only providers, including Okta (OKTA) and OneLogin, that are tilted toward the small and medium-sized business market where IT infrastructures are hosted in the cloud and customers typically need solutions for workforces. Ping sees its solutions, which address multiple use cases in large, complex hybrid IT environments and integrate with all apps (cloud and on-premise), as offering a compelling value to customers.

The Stock
Trading Volume: PING trades an average of 660,000 shares daily, implying roughly $12 million worth of stock trades hands daily. Over 1 million shares have traded hands on five days over the last three months. Our subscriber base should not move this stock.

Historical Price: Ping went public on September 19, 2019 at 15 and jumped 34% on the first day. After pulling back to the IPO price in October PING advanced steadily through mid-January. The stock then flattened out before a quick spike to 29 in late February. Then it began to slide with the market in the last week of February and into March. Support held around 15.5, though there was an intra-day drop down to 12 when the market crashed on March 16. Lockup expiration was the following day. PING regained the 21 level last week and held there until yesterday when shares fell back below 19.

Valuation & Projected Price Target: With a share price below 19 and estimated 2020 revenue of $263 million (at the low end of management’s guidance range) PING trades at less than 6 times forward revenue on an enterprise value basis. That’s a steep discount to the peak of 8.5 times back in February when most analyst price targets were in the 27 to 30 area. If we assume the economy bounces back (clearly there is risk to this assumption) and the company achieves results relatively close to the low end of guidance with an improved outlook into 2021, it’s reasonable to assume the stock could trade back up to a forward EV/Revenue multiple in the 7 to 8 range 12 to 16 months from now. With that multiple, and assuming a subdued revenue growth rate of 10% in 2021, the implied upside is over 50% now, but PING could easily be a double from these depressed levels. Given all the uncertainty let’s go with a price target near 28, which implies roughly 50% upside.

Buy Range: We are looking to build a half-sized position in a beaten-up stock, and the chart suggests we should be able to do that in the 15.5 to 20 range in the near-term. I’ll update buy range guidance as we move forward.

The Next Event: PING’s estimated report date for Q1 2020 results is April 28.

Ping Identity Holding Corp. (PING)
Denver, CO
www.pingidentity.com

Updates on Current Recommendations

Glossary
Buy means accumulate shares at or around the current price.
Hold means just that; hold what you have. Don’t buy, or sell, shares.
Sell means the original reasons for buying the stock no longer apply, and I recommend exiting the position.
Sell a Half means it’s time to take partial profits. Sell half (or whatever portion feels right to you) to lock in a gain, and hold on to the rest until another ratings change is issued.

Please email me at tyler@cabotwealth.com with any questions or comments about any of our stocks, or anything else on your mind.

The next Cabot Small-Cap Confidential issue is scheduled for May 7, 2020.

Cabot Wealth Network
Publishing independent investment advice since 1970.

CEO & Chief Investment Strategist: Timothy Lutts
President & Publisher: Ed Coburn
176 North Street, PO Box 2049, Salem, MA 01970 USA
800-326-8826 | support@cabotwealth.com | CabotWealth.com

Copyright © 2020. All rights reserved. Copying or electronic transmission of this information is a violation of copyright law. For the protection of our subscribers, copyright violations will result in immediate termination of all subscriptions without refund. No Conflicts: Cabot Wealth Network exists to serve you, our readers. We derive 100% of our revenue, or close to it, from selling subscriptions to its publications. Neither Cabot Wealth Network nor our employees are compensated in any way by the companies whose stocks we recommend or providers of associated financial services. Disclaimer: Sources of information are believed to be reliable but they are not guaranteed to be complete or error-free. Recommendations, opinions or suggestions are given with the understanding that subscribers acting on information assume all risks involved. Buy/Sell Recommendations: All recommendations are made in regular issues or email alerts or updates and posted on the private subscriber web page. Performance: The performance of this portfolio is determined using the midpoint of the high and low on the day following the recommendation. Cabot’s policy is to sell any stock that shows a loss of 20% in a bull market or 15% in a bear market from the original purchase price, calculated using the current closing price. Subscribers should apply loss limits based on their own personal purchase prices.