Cognyte's Quiet Pivot: Subscription Adoption, Financial Investigations, and the US Bet

The investigative analytics vendor is converting its installed base to recurring revenue, opening a new financial-crime domain, and finally quantifying its US opportunity — while managing FX and hardware pressures.

CGNT · Earnings Call · 2026-06-03

Solid start, but the engine is changing

Cognyte's first-quarter fiscal 2027 report shows a company executing well on its core investigative analytics franchise, but the more interesting story is what is changing beneath the surface. Revenue grew 10.4% year-over-year to $105.5 million, and non-GAAP operating income jumped 41.5% to $10.7 million. Yet the company is now telling investors that the mix of its business is becoming more subscription-heavy, which is reshaping how revenue, RPO, and cash flow behave. This is not a one-off: the shift toward subscription and Recurring revenue has been building for several quarters, and this call makes clear it is now a deliberate strategic inflection. “We delivered a solid start to fiscal '27, reflecting steady execution across the business and sustained demand for Cognyte's investigative analytics solutions.” — Elad Sharon · 2026-06-03 The prepared remarks immediately point to what management wants investors to focus on: strong software revenue growth (up 26.5% year-over-year) and a recurring revenue line that reached 49.2% of total revenue, up 10% year-over-year. The company says this reflects "better-than-expected adoption of our subscription offering." The word that really matters, though, is tech refresh — a term that has spiked in momentum this quarter. Customers are moving to subscription because they want faster access to new capabilities, particularly around AI. As CEO Elad Sharon explained, "the changes in the technology is faster than before, they want to be able to benefit from the innovation and the availability of new technologies that we offer them."

The RPO paradox and cash flow timing

One of the most debated numbers on the call was cash flow from operations. Q1 delivered negative $4.7 million from operations and negative $6.1 million free cash flow, a head-scratcher given the strong profit growth. Management attributed this to three factors: FX headwinds (the U.S. dollar weakening against the shekel), subscription deals that change collection timing, and deliberate inventory buildup to support anticipated demand. CFO David Abadi was candid: “From an FX perspective, we're seeing in the last few weeks, a significant weakness of the U.S. dollar mainly versus the shekel that creates some impact on -- also in Q1.” — David Abadi · 2026-06-03 He also noted that inventory increased by $3 million during the quarter. The company reaffirmed its full-year operating cash flow guidance of ~$45 million, arguing that cash generation will be back-end loaded, as it has been historically. This tension between profit growth and cash generation is not new. On the prior call (March 2026), David Abadi addressed the same topic: “we are very pleased with the leverage that we had with the gross margin. As you saw, we achieved 73% gross margin 2 years ahead of our initial plan.” — David Abadi, CFO · 2026-03-25 The market is now waiting to see whether the subscription model will eventually improve cash conversion or keep creating noise. The RPO number is the key signal: total RPO ended Q1 at $528.8 million, with short-term RPO of $363.4 million — solid visibility into next twelve months. The company even raised its recurring revenue growth outlook for fiscal 2027, while keeping total revenue guidance unchanged at ~$448 million (plus or minus 3%). That is a quiet but meaningful statement: they can grow recurring revenue faster than total revenue without sacrificing the top line.

Financial investigations: a new domain with momentum

Among the company's own keyword trajectory, the most striking new theme is financial investigations. The prepared remarks highlight new capabilities in this area, addressing "rising demand around transnational illicit financing and the broader evolution of financial crime." This is not a passing mention; it is a distinct domain expansion. The company cites a Tier 1 military intelligence agency in EMEA that used its platform for counter-terror financing and won a National Ministry of Defense Innovation Award. This is a concrete proof point. The company-specific keyword list for Q1 includes financial investigations and terror financing, both new entries with meaningful momentum. This looks like a company-unique thematic expansion, not just repackaged security software.

Today, I also have the confidence to quantify it. And I think that for this year, for next year, we should see strong results in this market.
Elad Sharon · 2026-06-03

The quote comes from the discussion about the U.S. market, but it also applies to the company's broader confidence in new domains. Elad went on to say, "We are scaling our market presentation. We are growing sales and marketing efforts. And actually, our visibility is much stronger today than before." That statement reflects a new willingness to put numbers behind the U.S. opportunity — something the company has previously avoided.

The US opportunity, finally quantified

The U.S. has been a long-running narrative for Cognyte, but historically management have been vague about the timeline. On this call, they quantified it for the first time: they expect approximately $20 million of deals in fiscal 2027 and an additional $25 million next year. CFO David Abadi clarified that the $20 million is deals, not necessarily revenue, but "we believe that a significant portion of it will translate into revenue." This is a meaningful step from the prior language. In the March 2026 call, Elad had framed the U.S. as a growth pillar but not yet a contributor to the current-year guide: "We do believe that about 50% of it will come from expansions and upgrades of existing customer base." Now the company is willing to commit to a number, and even hint at upside: "I see a potential for an overachievement." The market may be starting to price this in. The company's stock has been quiet, but the underlying narrative is shifting. The keyword U.S. market has been a top-30 company keyword for the past several quarters, and its prominence here underscores that investors are watching for the first real U.S. revenue inflection. The company has not yet broken out U.S. revenue, but the $20 million deal target is a concrete KPI that can be tracked.

Conclusion

Cognyte is not merely reporting a solid quarter; it is signaling a structural shift in its business model. The move toward subscription is accelerating faster than expected, which is both encouraging (better recurring revenue visibility) and disruptive to near-term cash flow. The company is also expanding into financial investigations, a domain that could open a new growth vector beyond its traditional law-enforcement and national-security base. And for the first time, it is putting a dollar figure on its U.S. ambition. Each of these moves carries execution risk, but together they paint a picture of a company that is actively shaping its own future rather than waiting for the threat environment to dictate terms. As Elad Sharon noted, "The more complex the threat environment becomes, the more indispensable our platform becomes to the agencies that rely on it." If the subscription conversion delivers as planned, and the U.S. deals materialize, Cognyte could be in a very different place a year from now.