Commvault Systems (CVLT) 10-K2024 FY Annual report

Our current customer base spans thousands of organizations across a variety of sizes, including large global enterprise companies, and small or mid-sized businesses and government agencies. We support customers in a range of industries, including banking, insurance and financial services, government, healthcare, pharmaceuticals and medical services, technology, legal, manufacturing, utilities and energy.

Our primary competitors in the data protection software applications market, each of which has one or more products that compete with a part of or our entire product suite, include Avepoint, Cohesity, Dell-EMC, Druva, IBM, Rubrik, Veeam, and Veritas.

Some of our competitors have greater financial resources and may have the ability to offer their products at lower prices than ours. In addition, some have greater name recognition, longer operating histories, substantially larger technical, sales, marketing and other global resources, and larger installed customer base with broader product offerings. As a result, these competitors can devote greater resources to the development, promotion, sale and support of their products than we can. Refer to our "Risk Factors" below.

We sell our cyber resilience solutions to businesses of all sizes and government agencies. We sell through our global direct sales force and partner channels.

We have a variety of marketing programs designed to create brand awareness and market recognition for our product offerings and sales lead generation. Our marketing efforts include sales campaigns, webinars, active participation at trade shows, technical conferences and seminars; advertising; content development and distribution; public relations; social media; industry analyst relations; publication of technical and educational articles in industry journals; sales training; and preparation of competitive analyses. In addition, our strategic partners augment our marketing and sales campaigns through seminars, trade shows, joint public relations and advertising campaigns. Our customers and strategic partners provide references and recommendations that we often feature in external marketing activities.

Our research and development organization is responsible for the design, development, testing and certification of our cyber resilience platform and solutions. Our engineering efforts support product development across all major operating systems, databases, applications, hyperscalers and network storage devices. A substantial amount of our development effort goes into certification, integration and support of our solutions to ensure interoperability with our strategic partners’ solutions. We have also made substantial investments in the automation of our product test and quality assurance laboratories.

We believe our solutions are a major differentiator versus our competitors’ portfolios. Our Commvault Cloud platform powered by Metallic AI aims to deliver the highest security, most intelligence, and fastest recovery across on-premises, hybrid and multi-cloud environments. Our solutions’ unique features drive the performance, scale, TCO benefits and interoperability of our offerings. Such features include encryption, indexing and immutable recovery. Additional options enable content search and auditing features to support data discovery and compliance.

We patent our technical infrastructure and key usability and design concepts. Our software’s unique capabilities are covered by a robust portfolio of patents worldwide. Areas such as cyber resilience, data protection, security, transformation, insights, and compliance and governance, including our SaaS and HyperScale X solutions, are core to our competitive advantage. More than 1,400 patents have been issued to Commvault globally as a result of our strategic patenting. We also have established proprietary trademark rights in markets across the globe, and Commvault owns over 150 worldwide trademark registrations and pending registration applications. Refer to our “Risk Factors” below.

The global legal environment of technology businesses is evolving rapidly and is often unclear. These topics include data privacy and security, pricing, advertising, taxation, economic sanctions, content regulation and intellectual property ownership and infringement.

We are subject to several local, state, federal and foreign laws and regulations regarding privacy and data protection. Regulators around the world have adopted or proposed limitations on, or requirements regarding, the collection, distribution, use, security and storage of personal information, payment card information or other confidential information of individuals, and the U.S. Federal Trade Commission and many state attorneys general are applying federal and state consumer protection laws to impose standards on the online collection, use and dissemination of data. In the event of a security breach, these laws may subject us to incident response, notice and remediation costs. Failure to safeguard data adequately or to destroy data securely could subject us to regulatory investigations or enforcement actions under applicable data security, unfair practices or consumer protection laws. The scope and interpretation of these laws could change, and the associated burdens and our compliance costs could increase in the future.

We are also subject to global laws and regulations that govern or restrict our business and activities in certain countries and with certain persons, including the U.S. Commerce Department’s Export Administration Regulations and economic and trade sanctions regulations maintained by OFAC, as well as anti-bribery and anti-corruption laws and regulations, including the FCPA and the U.K. Bribery Act.

Commvault aims to unlock potential in data, customers and our employees. To accomplish that, our employees are empowered to drive innovation and help our customers—by inspiring one another and working to make what’s already great, even greater—whether that’s product, process or team. As of March 31, 2024, we had 2,882 employees worldwide, of which approximately 40% were in the United States and 60% were located internationally.

We remain committed to providing employees with opportunities and resources that enable them to work successfully and creatively, while also investing in their professional and personal development. Throughout fiscal 2024, our employees participated in over 1,200 training programs, totaling more than 190,000 hours.

Our website is located at: www.commvault.com. On the Investor Relations section of the website, we post filings as soon as reasonably practicable after they are electronically filed with or furnished to the U.S. Securities and Exchange Commission ("SEC"), including: our Annual Reports on Form 10-K, our quarterly reports on Form 10-Q, our current reports on Form 8-K, our proxy statements related to our annual stockholders’ meetings and any amendment to those reports or statements filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act. All such filings are available on the Investor Relations portion of our website free of charge. The contents of our website are not incorporated by reference into this Form 10-K or in any other report, statement or document we file with the SEC.

In addition to facing risks similar to the risks faced by our domestic operations, our international operations are also subject to risks related to the differing legal, political, social and regulatory requirements and economic conditions of many countries, including:

Similarly, if our customers or partners experience liquidity issues as a result of financial institution defaults or non-performance where they hold cash assets, their ability to pay us may become impaired and could have a material adverse effect on our results of operations, including the collection of accounts receivable and cash flows.

Commvault has established a cybersecurity program for the benefit of the company, our customers, partners and stockholders. The cybersecurity program includes policies, processes and practices that are designed to assess, identify and manage material risks from cybersecurity threats and is integrated into our enterprise risk management program. Led by the Chief Information Security Officer (“CISO”), Commvault’s cybersecurity program leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, with the primary objective of securing systems and data from cyber threats. We procure security technologies, consistently work to mature our cybersecurity program, and partner with security service providers. We have established a Security Incident Response Plan ("SIRP") which outlines our processes for incident preparation, detection, analysis, containment, eradication, and post-incident analysis. In addition to the SIRP, we maintain a Crisis Management Plan to organize roles and responsibilities in the event of a crisis, a Disaster Recovery Plan to provide guidance in the recovery of systems following an outage, and a Business Continuity Plan to identify alternative means of conducting business in the event of business disruption. We partner with third parties to enhance monitoring and response capabilities and facilitate readiness activities including tabletop exercises and penetration testing. All employees are required to undergo annual security awareness training on current and potential cybersecurity threats and report suspicious activity. We also assess third-party service provider cybersecurity controls through a risk assessment questionnaire and include security and privacy terms in contracts as appropriate.

Commvault maintains a variety of third-party certifications and undergoes annual assessments for SOC 2 Type 2, ISO 27001, HIPAA, CJIS, and PCI DSS. In support of these certifications and assessments, our products also undergo security testing. Annually, internal auditors complete a risk assessment of specific business operations like privacy and sanctions compliance or travel & expense policy compliance, identify areas of heightened risk, and conduct dedicated audit engagements at the direction of Management. The findings, observations, and recommendations from these engagements are shared with Management and the Audit Committee, as appropriate.

To date, Commvault is not aware of any cybersecurity incidents that have materially affected Commvault’s financial condition or business operations. Given the increasingly complex and sophisticated cyber threat landscape, we try to be vigilant to predict and prevent attacks. Commvault has prioritized cyber resilience measures and leverages governance processes and procedures to mitigate potential business impacts if and when an adverse event occurs. Although no material impacts have been recorded to date, IT system failures, network disruptions, cybersecurity incidents, and data breaches could adversely impact our business, internal controls, results of operations, and financial condition.

For additional description of cybersecurity risks and potential related impacts on Commvault, refer to the risk factor captioned “Risks Related to Technology and Security – We may be subject to IT system failures, network disruptions, cybersecurity incidents and breaches in data security” in Part 1, Item 1A. “Risk Factors.”

Commvault’s Board of Directors (the "Board") provides oversight of Commvault’s enterprise risk management strategy, which includes risks from cybersecurity threats. The Audit Committee of the Board of Directors receives quarterly briefings on the cybersecurity program from the CISO and briefings on the Enterprise Risk Management Committee (“ERMC”) and Cybersecurity Oversight Team (“CSOT”) from the Chief Legal and Compliance Officer (“CLCO”). The Board is kept apprised of cybersecurity updates through quarterly, or as needed, reporting from the Audit Committee Chair and annual, or as needed, reporting directly to the Board from the CISO.

Commvault’s Management, including the CEO, CFO, CLCO, CISO, Chief Information Officer (“CIO”), and Senior Vice President of Engineering, is responsible for our cybersecurity risk management strategy, operational decision-making, and incident preparedness and response. The current CISO holds a Bachelor of Science in Information Technology, industry certifications such as CISSP, CISA, CISM, is affiliated with various CISO professional working groups, and has over twenty-five years of experience in information security, compliance, technology, and program management across financial, telecommunications, audit, healthcare, retail, and professional services organizations. Management ensures cybersecurity risks are communicated through the establishment of the ERMC and the CSOT and regular, or as needed, reporting to the Audit Committee and the Board. The ERMC is responsible for the implementation, maintenance, and execution of our enterprise risk management program. The ERMC meets quarterly, or as needed, to assess, consider, and manage material risks including cybersecurity threats across the business. The CSOT is responsible for the significant operational decisions in the event of an active cybersecurity incident. The CSOT meets as needed, with the Audit Committee Chair as an optional attendee, to provide counsel and foster productive communication between Management and the Board.

In addition, we have offices in the United States in Florida and Texas; and outside the United States in Australia, Belgium, Brazil, Canada, China, Denmark, France, Germany, India, Israel, Italy, Japan, Malaysia, Netherlands, Saudi Arabia, Singapore, South Africa, South Korea, Spain, Switzerland, Taiwan, United Arab Emirates, and United Kingdom.

As of May 9, 2024, there were approximately 41 holders of our common stock. The number of record holders does not represent the actual number of beneficial owners of shares of our common stock because shares are frequently held in street name by securities dealers and others for the benefit of individual owners who have the right to vote their shares.

We have never paid cash dividends on our common stock, and we intend to retain our future earnings, if any, to fund the growth of our business. We therefore do not anticipate paying any cash dividends on our common stock in the foreseeable future. Our future decisions concerning the payment of dividends on our common stock will depend upon our results of operations, financial condition and capital expenditure plans, as well as any other factors that the Board of Directors, in its sole discretion, may consider relevant.

The graph set forth below compares the cumulative total stockholder return on our common stock between March 31, 2019 and March 31, 2024, with the cumulative total return of (i) The Nasdaq Composite Index and (ii) The Nasdaq Computer Index, over the same period. This graph assumes the investment of $100,000 on March 31, 2019 in our common stock, The Nasdaq Composite Index and The Nasdaq Computer Index, and assumes the reinvestment of dividends, if any. The graph assumes the initial value of our common stock on March 31, 2019 was the closing sales price of $64.74 per share.

Our cost of revenues is as follows:

Sales outside the United States were 48% of our total revenue for fiscal 2024, 47% for fiscal 2023 and 48% for fiscal 2022. The income statements of our non-U.S. operations are translated into U.S. dollars at the average exchange rates for each applicable month in a period. To the extent the U.S. dollar weakens against foreign currencies, the translation of these foreign currency denominated transactions generally results in increased revenue, operating expenses and income from operations for our non-U.S. operations. Similarly, our revenue, operating expenses and net income will generally decrease for our non-U.S. operations if the U.S. dollar strengthens against foreign currencies.

In presenting our consolidated financial statements in conformity with U.S. generally accepted accounting principles ("GAAP"), we are required to make estimates and judgments that affect the amounts reported therein. Some of the estimates and assumptions we are required to make relate to matters that are inherently uncertain as they pertain to future events. We base these estimates on historical experience and on various other assumptions that we believe to be reasonable and appropriate. Actual results may differ significantly from these estimates. To the extent that there are material differences between these estimates and actual results, our future financial statement presentation, financial condition, results of operations and cash flows may be affected.

Interest income increased $4.1 million, from $1.3 million in fiscal 2023 to $5.4 million in fiscal 2024 primarily as a result of increases in interest rates and the amount of invested funds subject to interest income.

Income tax benefit was $85.3 million in fiscal 2024 compared to expense of $20.4 million in fiscal 2023. The income tax benefit for the fiscal year ended March 31, 2024 relates primarily to the release of the previously recorded valuation allowance against certain deferred tax assets in the U.S. and foreign jurisdictions.

In recent fiscal years, our principal source of liquidity has been cash provided by operations. As of March 31, 2024, our cash and cash equivalents balance was $312.8 million, of which approximately $214.2 million was held outside of the United States by our foreign legal entities. These balances are dispersed across approximately 35 international locations around the world. We believe that such dispersion meets the current and anticipated future liquidity needs of our foreign legal entities. In the event we need to repatriate funds from outside of the United States, such repatriation would likely be subject to restrictions by local laws and/or tax consequences, including foreign withholding taxes.

We believe that our existing cash, cash equivalents and our cash from operations will be sufficient to meet our anticipated cash needs for working capital, income taxes, capital expenditures and potential stock repurchases for at least the next twelve months. We may seek additional funding through public or private financings or other arrangements during this period. Adequate funds may not be available when needed or may not be available on terms favorable to us, or at all. If additional funds are raised by issuing equity securities, dilution to existing stockholders will result. If we raise additional funds by obtaining loans from third parties, the terms of those financing arrangements may include negative covenants or other restrictions on our business that could impair our operational flexibility, and would also require us to fund additional interest expense. If funding is insufficient at any time in the future, we may be unable to develop or enhance our products or services, take advantage of business opportunities or respond to competitive pressures, any of which could have a material adverse effect on our business, financial condition and results of operations.

Our material capital commitments consist of obligations under facilities and operating leases. Some of these leases have free or escalating rent payment provisions. Refer to Note 15 of the notes to the consolidated financial statements for further discussion on operating leases.

As of March 31, 2024, we did not have off-balance sheet financing arrangements, including any relationships with unconsolidated entities or financial partnerships, such as entities often referred to as structured finance or special purpose entities.

Certain of our software licensing agreements contain certain provisions that indemnify our customers from any claim, suit or proceeding arising from alleged or actual intellectual property infringement. These provisions continue in perpetuity along with our software licensing and SaaS agreements. We have never incurred a liability relating to one of these indemnification provisions in the past and we believe that the likelihood of any future payout relating to these provisions is remote. Therefore, we have not recorded a liability during any period related to these indemnification provisions.

See Note 2 of the notes to the consolidated financial statements for a discussion of the impact of recently issued accounting standards.

Economic Exposure

Transaction Exposure

The consolidated financial statements include the accounts of Commvault. All intercompany transactions and balances have been eliminated in consolidation.

The preparation of financial statements and related disclosures in conformity with U.S. generally accepted accounting principles ("GAAP") requires management to make judgments and estimates that affect the amounts reported in our consolidated financial statements and the accompanying notes. We base our estimates and judgments on historical experience and on various other assumptions that we believe are reasonable under the circumstances. The amounts of assets and liabilities reported in our balance sheets and the amounts of revenues and expenses reported for each of the periods presented are affected by estimates and assumptions, which are used for, but not limited to, the accounting for revenue recognition, income taxes and related reserves, deferred commissions, purchased intangible assets and goodwill. Actual results could differ from those estimates.

Restricted stock units without a market condition are measured based on the fair market values of the underlying stock on the date of grant. We recognize stock-based compensation expense using the straight-line method for all stock awards that do not include a market or performance condition. Awards that include a market or performance condition are expensed using the accelerated method.

The costs for the development of new products and substantial enhancements to existing products are expensed as incurred until technological feasibility has been established, at which time any additional costs would be capitalized in accordance with the accounting guidance for software. Because our current process for developing software is essentially completed concurrently with the establishment of technological feasibility, which occurs upon the completion of a working model, no costs have been capitalized for any of the periods presented.

Under ASC 740, deferred income taxes arise from temporary differences between the tax basis of assets and liabilities and their reported amounts. Valuation allowances are established when, in our judgment, it is more likely than not that deferred tax assets will not be realized. In assessing the need for a valuation allowance, we weigh the available positive and negative evidence, including historical levels of pre-tax income, legislative developments, expectations and risks associated with estimates of future pre-tax income, and prudent and feasible tax planning strategies.

The functional currencies of our foreign operations are deemed to be the local country’s currency. Assets and liabilities of our international subsidiaries are translated at their respective period-end exchange rates, and revenues and expenses are translated at average currency exchange rates for the period. The resulting balance sheet translation adjustments are included in other comprehensive income (loss) and are reflected as a separate component of stockholders’ equity.

We consider all highly liquid investments purchased with maturities of three months or less at the date of purchase to be cash equivalents.

Trade and other receivables are primarily comprised of trade receivables that are recorded at the invoice amount, net of an allowance for doubtful accounts, which is not material. Unbilled receivables represent amounts for which revenue has been recognized but which have not yet been invoiced to the customer. The current portion of unbilled receivables is included in trade accounts receivable on the consolidated balance sheets. Long-term unbilled receivables are included in other assets. The allowance for doubtful accounts was $173 as of March 31, 2024 and $197 as of March 31, 2023. For the years ended March 31, 2024, 2023 and 2022, bad debt expense was immaterial.

Historically, we have not experienced material losses related to the inability to collect receivables from our customers. There is presently no indication that we will not collect material amounts of accounts receivable as of March 31, 2024. The inability to collect receivables could have a material impact on our results of operations.

We grant credit to customers in a wide variety of industries worldwide and generally do not require collateral. Credit losses relating to these customers have been minimal.

The carrying amounts of our cash, cash equivalents, accounts receivable and accounts payable approximate their fair values due to the short-term maturity of these instruments. Our cash equivalents balance consists primarily of U.S. Treasury Bills with maturities of one month or less.

The following table summarizes the composition of our financial assets measured at fair value at March 31, 2024:

Goodwill is recorded when the consideration paid for an acquisition exceeds the fair value of net tangible and intangible assets acquired. The carrying value of goodwill is tested for impairment on an annual basis on January 1, or more often if an event occurs or circumstances change that would more likely than not reduce the fair value of its carrying amount. For the purpose of impairment testing, we have a single reporting unit. The impairment test consists of comparing the fair value of the reporting unit with its carrying amount that includes goodwill. If the carrying amount of the reporting unit exceeds the fair value of the reporting unit, an impairment loss would be recognized to reduce the carrying amount to its fair value.

We review our long-lived assets for impairment whenever events or changes in circumstances indicate that the carrying amount of the assets may not be fully recoverable. To determine the recoverability of our long-lived assets, we evaluate the estimated future undiscounted cash flows that are directly associated with, and that are expected to arise as a direct result of, the use and eventual disposition of the long-lived asset. If the estimated future undiscounted cash flows demonstrate that recoverability is not probable, an impairment loss would be recognized. An impairment loss would be calculated based on the excess carrying amount of the long-lived asset over the long-lived asset’s fair value. The fair value would be determined based on valuation techniques such as a comparison to fair values of similar assets.

Sales commissions, bonuses, and related payroll taxes earned by our employees are considered incremental and recoverable costs of obtaining a contract with a customer. Our typical contracts include performance obligations related to term-based software licenses, SaaS offerings, perpetual software licenses, software updates, and customer support. In these contracts, incremental costs of obtaining a contract are allocated to the performance obligations based on the relative estimated standalone selling prices and then recognized on a systematic basis that is consistent with the transfer of the goods or services to which the asset relates. We do not pay commissions on annual renewals of customer support contracts for perpetual licenses. The costs allocated to software and products are expensed at the time of sale, when revenue for the functional software license or appliance is recognized. The costs allocated to software updates and customer support for perpetual licenses are amortized ratably over a period of approximately five years, the expected period of benefit of the asset capitalized. We currently estimate a period of five years is appropriate based on consideration of historical average customer life and the estimated useful life of the underlying software sold as part of the transaction. The commission paid on the renewal of subscription arrangements is not commensurate with the commission paid on the initial purchase. As a result, the cost of commissions allocated to SaaS offerings, software updates and customer support on the initial term-based software license transactions are amortized over a period of approximately five years, consistent with the accounting for these costs associated with perpetual licenses. The costs of commissions allocated to SaaS offerings, software updates and support for the renewal of term-based software licenses is limited to the contractual period of the arrangement, as we pay a commensurate renewal commission upon the next renewal of the subscription software license and related updates and support.

Deferred revenues represent amounts collected from, or invoiced to, customers in excess of revenues recognized. This results primarily from the billing of annual customer support agreements, the billing of SaaS subscription arrangements and billings for other services that have not yet been performed by us. The value of deferred revenues will increase or decrease based on the timing of invoices and recognition of revenue.

We consider all shares repurchased as canceled shares restored to the status of authorized but unissued shares on the trade date. The aggregate purchase price of the shares of our common stock repurchased is reflected as a reduction to stockholders’ equity. We account for shares repurchased as an adjustment to common stock (at par value) with the excess repurchase price allocated between additional paid-in capital and accumulated deficit.

Comprehensive income is defined to include all changes in equity, except those resulting from investments by stockholders and distribution to stockholders.

We have 43,548 and 44,140 shares of common stock, par value $0.01, outstanding at March 31, 2024 and March 31, 2023, respectively.

At March 31, 2024, we have reserved 6,149 shares in connection with our Stock Plans discussed in Note 10 of the notes to the consolidated financial statements.

We maintain the Omnibus Incentive Plan (the “2016 Incentive Plan”) for granting awards to employees. On August 29, 2023, our shareholders approved an amendment to the 2016 Incentive Plan to increase the maximum number of shares of common stock that may be delivered under the plan to 14,250, an increase of 3,200 shares. The 2016 Incentive Plan authorizes a broad range of awards including stock options, stock appreciation rights, full value awards (including restricted stock, restricted stock units, performance shares or units and other stock-based awards) and cash-based awards. As of March 31, 2024, approximately 3,754 shares were available for future grant under the 2016 Incentive Plan.

The components of income (loss) before income taxes were as follows: