Varonis Systems, Inc. (VRNS) Earnings Call Transcript
May 22, 2023
Earnings Call Speaker Segments
Great. Good afternoon, everyone. My name is Brian Essex. I'm JPMorgan's cybersecurity analyst. And -- so thank you for joining us. With me today, I have Guy Melamed, CFO of Varonis; and Brian Vecci, Field CTO. So thank you both for joining me as well.
Thank you for having us.
Thank you.
Maybe a great place to start, Guy, if you wouldn't mind just maybe an overview of the company, what you guys do for those that might not be familiar with it. And yes, I mean, where exactly you participate in the security landscape?
So we protect data. And at the end of the day, there are a lot of companies out there that protect the perimeter. We're under the assumption that someday, somehow, someone will get in. And you're supposed to protect this, I'd say, the second most valuable asset that every organization has, which is data first being their employees. And not only do we want to protect against people coming from the outside trying to take that sensitive information, we are also protecting against people from the inside that are trying to take, maybe the PII, patents, employment information and give it to competitors. So that's how we think about cybersecurity. And it's a very interesting place to be in.
Got it. And then from a competitive standpoint, how fragmented is the market? And who do you typically see when you're out competing in the marketplace?
Yes. So we don't typically see -- or we don't see any direct competition, right? There's no -- there's no other company that does what we do in all the places that we do it, identify data, make sure that it's properly protected, monitor it so that you can reduce the time it takes to detect and respond to a threat. That said, these are really big problems. This is a big business problem. So when we do see competition, and it's still relatively rarely, but when we do, it's typically point tools or adjacent product categories like DLP or posture management or configuration management tools, which really focus to Guy's point on the perimeters. There's nothing that protects data in the way that we do. But there is certainly point tools that organizations use to try, which is why we do our risk assessments to show them that they're almost certainly failing.
Yes. Maybe that's a great segue to like how you actually go to market with risk assessments. I mean, how do -- how do companies think about solving for the problem of data at risk? And I mean, is it something that a CTO is going to have a Magic Quadrant and they go to see which vendors they need? Or is this something where maybe their eyes need to be opened a little bit and they need to be educated around what kind of data landscape they have at risk?
They almost certainly do. So you asked like 3 questions in there that -- I can take one at a time. So the way we go to market is that we do what we call data risk assessments, which you might think of it as a valuation or a proof of value. But what we're really doing is we're taking our platform and looking at some or all of an organization's data and showing them what they have and where it is and how and where it's exposed and how it's being used. To your question about how is, say, a CISO thinking about this typically is that they're looking at technologies where they know they need to look. They're looking at the perimeters. They're looking at endpoints. They're looking at gateways. They're looking at configurations in the cloud. They probably have a SIM to aggregate logs. And the reason we do the risk assessment is that we show them that while those technologies are certainly useful, I would never tell a CISO, oh, you don't need endpoint protection. You'd be like saying you don't need antivirus, that would be crazy. But the risk assessment shows them that while they have all of these other technologies at the perimeter, the data itself is not properly protected, which is why we do them.
And how do you -- I'm sorry. Go ahead.
I just want to emphasize one thing about how the risk assessment helps us in the whole selling motion. If you look at the room here, and I told each and every one of you that you have 10 million files open to everyone in the company. You'd shake your head, you go get coffee because what else can you do? But if I actually showed each and every one of you, how the list of best stocks for 2023, long and short, is open to everyone in your organization. That's when you take notice. So the whole visualization of the risk is what is the jaw-dropping moment and what's worked very well for us.
So how do you -- how do you get an audience with your customers and get to that assessment process? Is this -- you cold-call a list of customers or you have customers that have certain attributes and you know that those are target-rich or you have partners that are already involved with your customers and they bring you and said, "Hey, there's this customer that has these attributes, we should bring you in here. Like how do we think about the way that you penetrate your markets?
It's kind of all of the above. There's lots of different reasons that we would engage with a customer. We're obviously aggressively reaching out to anybody that will take a phone call or read a website or a blog or we -- our partners will help us with introductions. One of the advantages that we have is that every single enterprise has these problems. Nobody -- there's no vertical or even organizational size that has solved for this. So really, all we need is the introduction and all of the reasons -- all of the above are reasons that we might get introduced or maybe they had an incident security breach, yes.
Yes, we've definitely seen more and more of the market coming to us. So there's -- when you -- were at a mass of just shy of $0.5 billion of ARR. So we have the name in the market, and there are many incidents where we get a phone call where something happened or they're afraid that something will happen and they reach out to us in a desire to see how vulnerable they are, and that's when we go through the risk assessment process.
Got it. And then maybe as we think about the shifting landscape of compute, more stuff moving to the cloud, including data, how does that affect the competitive landscape that you see in your markets?
So a couple of things to think about is once you start moving more data and more workloads into the cloud, which is happening everywhere, the risks associated with that data become much higher because it is so much easier for not just an outside attacker to get a hold of it, but for an insider as well. I can just go to OneDrive and right click and create a link. I can exfiltrate data without needing access to anything. So the security and data protection issues become much more complicated. From a competitive standpoint, I mentioned that we're most -- when we do compete in about 5% of our deals, it's often against an adjacent product category like SIM or identity or DLP that doesn't solve the problem. In the cloud, the categories are a little bit different. You're talking about posture management or configuration management, CSPM, DSPM, you might be looking at something like CASB, which is really just DLP for the cloud. All of those are adjacent categories with lots and lots of point vendors, none of which solve the same problems. And we can do a risk assessment on your data on-premises. We can do a risk assessment on your data in the cloud. Often these days, we're doing all of the above because as a CISO, I can show you a list of logos, and I'm using 365, and we still have a NetApp on-premises. And yes, we use Salesforce, and we've got Amazon S3 as well. And it's easy for us to do a risk assessment on all of that data very quickly and show you that an adjacent category, a configuration management tool or a CASB isn't solving the problem and can't.
Got it. Next one I hit on is structured versus unstructured data. And how do we think about the potential to like go deeper into structured data, maybe clarify how you focus on unstructured?
This helps with understanding the history of Varonis. We were founded because the problems that we're talking about were so much more complicated and harder to solve on unstructured file systems because they were basically chaos and growing much faster than anywhere else. That said, there's important data in lots of places, unstructured systems on premises in the cloud, which we fully support. Object storage, which has lots of structure to it, like Amazon S3 and Azure Blob, we support that. We also now support structured databases through Amazon RDS. So our goal is to follow the data to give our customers visibility and automation to properly protect that data and detect threats wherever it might be. And so we started unstructured and now there's a variety of places, both structured and unstructured that we can support.
Got it. And then how do I think about the platform? I think there are vendors out there that do kind of data discovery, data mapping, but you have a much deeper platform in terms of remediation, actual protection of the data. Maybe help me understand what that platform looks like and how that might be differentiated from others that kind of are just kind of maybe to describe it like at the surface?
And checking, you're making a motion like checking your box? So a classification or discovery tool is a good way to think about why we don't have any direct competition. So if I'm a CISO or a privacy officer or a data management officer or something like that, I might think that my biggest problem from a security perspective is that I don't know where all of my important data is. So I might look at classification vendors, of which that's a piece of what we do. It's a big part of what we do. But let's say, I find -- this vendor finds all of my sensitive data. You haven't actually solved the one problem. You've created hundreds of thousands or millions of new problems. We have hospitals, for instance, that will tell us we don't have any patient information on our file systems. It's all in our medical record systems, and we'll say, are you sure? And then we'll find it everywhere. We don't have mortgage applications as a real estate company in G Drive. Are you sure? And we find it everywhere. So to your question, what -- when Varonis can provide a deeper level of protection, what we do is, once we found it that the fact that we know that something sensitive is context. We can identify the exposure because we map all of the ways that somebody or something could get access to it. We monitor it, and we tell you when somebody like an insider or an outside attacker starts accessing that data strangely. We can implement stricter controls safely because we know how the data is being used. So when you -- when you think about what data protection really means, just finding and discovering data doesn't protect it. It, in fact, probably shows you where you have gaps, which is one reason that our risk assessments are so valuable. And when we support a platform for us to say we support this kind of data, it means that we're applying that level of automation to protect it, to monitor it, to detect threats to it, which at the end of the day, it keeps it private and makes it easy to be compliant.
Got it. Super helpful. I want to maybe shift gears a little bit and talk about the macro. I think every vendor that we cover is talking about the macro in one way shape or form, and you guys certainly talked about it on your earnings call. Maybe just an update in terms of what you're seeing, are things the same as maybe that you relate on the call, where are you seeing any macro issues? And how might you be addressing those?
I'll start with the end. In Q1, we saw the macro be very similar in terms of challenges to Q4. It wasn't any worse, but it definitely wasn't any better. And if I go back, we were kind of one of the earlier companies that called out some of the macro challenges in our Q3 earnings call. And the macro that we see is longer sales cycles, more deal scrutiny. But I think the problem of protecting your data is there. And when you think about the transition to SaaS and we can talk more about that, but the transition to SaaS is definitely at a good point because it provides -- it's a better product. it provides more value to customers. It eliminates 2 of the biggest friction points that we got from customers, which is one, we don't have hardware or we don't want to buy hardware. And two is we don't have enough people to manage this problem. And SaaS eliminates that. So in this environment, we're very happy that we came out with the SaaS product, and I think we're very well positioned to weather the storm and be stronger on the other side.
And specifically with where the pressure that you're seeing, like from a geographic perspective, I think you called out Europe as being a little bit more pressured than the U.S., for example. What is it about European market that is providing a little bit more macro pressure?
I don't think that there's anything in the European customer that is any different than North America. I think that what we're seeing is slightly more deal scrutiny in terms of looking at every single expense. But the problem is the same and our way to solve that problem is the same. So we did call it out in Q2 as longer sales cycles and gave more color on that in Q3. But we also called out kind of some of the spillover into North America, which actually happened in Q4 of last year. In our guidance for 2023, we actually baked in deterioration in the macro environment. So an expectation that it would get worse before it gets better. Hopefully, it doesn't happen, but that was part of our numbers that were put out for 2023.
Okay. Great. And you mentioned the transition, so maybe we'll dig into that. Maybe just help us maybe walk us through the evolution of the transition that you're currently in progress with. You went through a transition a few years ago, which was extremely successful. Now you're going through a transition this time to a SaaS platform. How did that evolve? And in terms of the timing, why now?
So in 2019, as you mentioned, we announced our transition from perpetual to on-prem subscription. And when we did that transition, we knew that there was another one in the cards, move from on-prem to SaaS. Over the last couple of years, our R&D has worked very hard in order to come out with a product that is stable and has -- in a very simplistic way is a much better product than the on-prem subscription. We talked about investing more than $100 million in R&D over the last 2 years in order to come out with the SaaS offering. Our first transition, as you mentioned, was very successful. It took us about 5 quarters to move from literally no on-prem subscription sales to 99% of our license sales to be on-prem. And this transition is slightly different. It's not a financial engineering exercise. And that's why we talked about the fact that we expect it to take longer. But the value that we provide to customers through the SaaS offering is significant and the value -- the leverage that we can get on the sales and marketing department is significant. We expect shorter sales cycles. The risk assessments are easier to run, the demands from your customer are lower, so you don't need them to set up the way they did on the on-prem subscription side, and we're kind of managing the whole process. So that's eliminated a lot of the heavy lifting for customers. And the leverage that we expect to see on some of the other departments is significant, whether it's the R&D that don't -- eventually won't need to support 2 codes. We'll move into kind of supporting 1 code only and going from R&D investments that have been in the high 20s out of revenue and ARR to what we expect. And we talked about that in the Investor Day, we expect it to be in the high teens by 2027. So still investing in the next year or 2 in order to kind of get the SaaS up and running and improve it and get it to a place where we want it to be. But over kind of the -- if you look at the 5-year horizon, see some significant leverage from that department. And there's leverage in the customer success and support and the sales and marketing, as I spoke about before. So there's definitely a lot of benefits for the customer in moving to SaaS, but there's also a lot of benefits for us in our desire to move there. And we talked about the phases, there's Phase 1 and Phase 2. So -- so far, we've only been a quarter and a bit in the transition, but we feel very good about where we are.
Right. And I think you touched on it real quick, but just to kind of go back to it. I mean why the timing now as opposed to maybe like I don't know when you did the first transition, do it all together? Was it more just an allocation of technical resources to build the platform? Or how should we kind of...
So we definitely had to spend time and money in order to get the technology. It's not easy to come with an offering that is -- we've talked a lot today with our investors about the fact that the offering as it came out is one of the most stable versions we've ever come out with. And the fact that the feedback has been so well received by both our sales force and our customers. And you have to invest time and money in order to get there. But I also think that it's easier to make the transition from on-prem subscription to SaaS than from perpetual to SaaS. So we kind of had that in between phase. But we always knew that the kind of end result and part of our strategic thinking was to get to SaaS, and that's where we are today.
Got it. And then I guess with regard to the first transition that you did, what are the most critical takeaways or experiences from that transition that may help you execute better with this one?
I think there are 3 pillars that will determine whether a transition is successful. And I'd say, change in general in an organization. Pillar number one is the technology. If you don't have technology that is supportive of the change, it will never happen. And we had that when we moved from perpetual to on-prem because it allowed customers to consume more of the product. And in the move to SaaS, we definitely have that in a much better product that eliminates a lot of the friction for our customers. So pillar number one, I think, is in a good place. Pillar number two is the comp plan. And if you want to generate change within your sales force, you have to make sure that they understand how to make money, and we did that well in the move from perpetual to on-prem. And I think we have a good comp plan put in place that aligns with what the company is trying to achieve. We put that in place in January when we announced the transition. And I feel good about where we are and how to take advantage of the technological capabilities of SaaS and the benefits that it provides customers because the reps understand how they can make money or how they can make more money and that's through that plan. So that's pillar number two. And pillar number three is management commitment. You can have pillar number one and pillar number two, but if your management isn't committed in moving and making that change. I don't think it really matters and you get stuck. We faced that in the move from perpetual to on-prem. Many of the investors in this room that were part of that transition. Remember some of the stories that we had to face in Q1 of 2019, but we had a very committed management team to support the change. We have the same commitment from management to move from on-prem to SaaS. I can tell you that we have way less resistance from our sales force because I think they understand the benefits of the product. And they are definitely pushing for a much simpler selling discussion, which they see. So I think those 3 pillars are the lessons learned from the previous transition, and I think they're very well aligned for this transition as well.
Right. Great. And then maybe you could talk about the pricing uplift that you can see from SaaS. And I think it makes a lot of sense in terms of ease of deployment and the robust technology and customers get the best version all the time. What is the pricing environment like as customers shift on to SaaS or initially deploy SaaS, the initial land?
So there are 2 components of my answer. The simple answer is that same product, same users. We have our price list at 25%, 30% higher when you buy SaaS versus on-prem subscription. But the second element of the answer is that in 2022, we came out with bundles because we got to a point where we had 40 SKUs, it became too challenging for our sales reps to have conversations about every single SKU, and it became very challenging for our customers to understand what every SKU does. And in 2022, we came out with bundles to try and consolidate, and that was very well received by both customers and reps. So we decided to double down on that. And in 2023, with our SaaS offering, we're not even offering it as bundles anymore. You can't buy the licenses in an individual manner. If you're buying SaaS for Windows, it would appear as 1 SKU, and it's combination of about 7 SKUs that we had in the on-prem subscription, the same with the Office 365. So we're definitely moving to an offering that talks about outcomes. What do you need in order to buy -- to be protected? And it's the platform. And one of the things that we talked a lot about is that at Varonis, more is more, which means the more licenses you buy, the more you would want to consume more of the platform because there's an element of automation that can only be provided if you have 5, 6, 7 licenses at a minimum. So we always talked about the fact that getting a customer from 5 licenses to 12 is easier than getting our customers from 1 license to 5. And the move to SaaS definitely helps on that because it gears towards the automation and the outcomes and the benefits that customers see will get them to buy and consume more of the platform.
Got it. And I think you've talked a couple of times whether its Analyst Day or earnings calls about customers in the pipeline that have expressed an interest in maybe on-prem. There are some incentives to get them onto a SaaS platform. What would -- I guess, if we think about how a customer that's currently looking at an on-prem license, what are some of the things that would kind of cause them to pivot and then adopt SaaS instead?
Simple answer. It's a better product and they -- a lot of our existing customers understand that and are asking for that. And if I take a step back, yes, during the Investor Day, we talked about 2 phases. Phase 1 is focusing on selling SaaS to new customers, and we estimated that to be anywhere between 1 to 2 years. And then we talked about the fact that as we approach the end of Phase 1, we'll start focusing on Phase 2, which is trying to convert our existing customers to SaaS. And we said that, that would take anywhere between our expectation and so it would take between 3 to 4 years. In the last earnings call, we gave a lot of real estate in the call talking about existing customers and the increased pipeline of those existing customers wanting to buy SaaS. Now in Q1, it was a very small dollar amount, a couple of hundred thousand dollars of existing customers that converted to SaaS. And in Q2, we have seen the pipeline increase significantly. And the reason we called it out is because if that number actually -- if that pipeline actually does convert, there will be headwind to revenue and operating margin, but that's a good thing as you look at kind of the customers converting to SaaS, and it's actually happening very naturally. We're not incentivizing reps to go to existing customers and convert. The only money they are making towards their quota is on the uplift. So getting a customer from on-prem subscription to SaaS, they will make towards their quota, anything above the on-prem subscription amount. And we're definitely seeing the ability to get that uplift from our customers. So overall, it's a very positive thing. We'll update as we see things progress, but the Q2 pipeline has definitely increased compared to what we saw in the past.
Got it. And I have a follow-up and then I'll open it up for others to ask questions if you have one. But maybe the follow-up to that is, in the earnings call, you actually talked about much higher-than-expected conversion rates. What drove those conversion rates? I think initially you were expecting about 15% and it came in much higher than that in terms of new business that's accounted for with SaaS. What drove that higher adoption rate? And should we just expect it to kind of like run at that higher rate going forward?
So just to emphasize, I think you're talking about the SaaS mix, which was 37%. The SaaS mix is new ACV, basically gross ACV that we're selling and the percentage of that being SaaS, we guided for 15% and came in at 37% and actually increased our SaaS mix guidance to 35%. I think the reason it was as high as it was straight off the bat in the first quarter we did the transition is because the product is better and customers understand the benefits of SaaS, how they are better protected. Think about this landscape of additional hacking going on and how vulnerable customers are. In SaaS, you can actually see an incident in one part of the world and distribute it in minutes to the rest of your customers and have SaaS all over the world. You don't need them to do anything in on-prem subscription, if you found something that was problematic or an attempt to hack into an organization that requires an update. Once you have the update ready, you need to make sure that you call every single customer and make sure that they download and install whatever you send them. So the value in SaaS is so significant, and it's a no-brainer for customers to want to buy it. And I think that was the main driver for the 37% SaaS mix we saw in Q1.
Got it. Super helpful. With that, any questions in the audience? Keep going. At your Investor Day last year, you laid out a path of to $1 billion in ARR and 20% contribution margins. What progress have you made? And how are you tracking towards those goals?
So yes, in the Investor Day we had in Q1 this year, we laid out a 5-year plan talking about a $1 billion ARR by the year 2027. I think what's very clear to us is our ability to increase top line growth but keep the cost structure in the right way. And I know it's very -- the new fashion right now is to talk about operating margin and profitability. But if you go back to all of our transcripts years ago, we talked about the desire and need to grow the business, but increase operating margin and increased free cash flow and cash flow generation is an important concept of every business. The 2027 plan talks about getting to a much higher ARR number, but also kind of getting to the Rule of 40 and we define the Rule of 40 based on ARR, which is the leading indicator. Revenue has less of an impact when you move from on-prem subscription to SaaS because of the accounting treatment going to the ratable recognition. So ARR is the leading kind of metric on the top line. And then the Rule of 40 is comprised of ARR and ARR contribution margin, which is ARR minus your non-GAAP operating expenses. And that's really kind of the right way to think about showing investors that we're keeping the cost structure even during a transition. And as we exit the transition, we should start benefiting from the leverage that the SaaS has to offer. So I think we're very well positioned to take advantage of a tremendous opportunity, and we want to execute against it.
Right. And then typically, with these transitions, I think what you see is you do see the revenue headwinds. So I think investors are used to, like, all right, we're going to stop paying attention to revenue, look at ARR and cash flow. And then over time, you'll see ARR and revenue growth rates converge. Any sense of what the time frame might look like in terms of what you forecasted out and internal expectations of where revenue might hit that kind of like normalized run rate and align better with ARR?
So it really depends on the pace of Phase 1 and Phase 2, especially Phase 2, when you have such a large base that is recognized upfront, the quicker the pace of the conversion, the more headwind you will see on revenue. So I think it's a bit too early to call out when you'll see revenue converge. And I reemphasize the fact that ARR is the leading indicator throughout this transition on the top line. And we talked about free cash flow and ARR contribution margins is kind of the North Stars together with ARR that will show and kind of signal the health of the business throughout the transition. And those are the right metrics to focus in the next couple of years.
Right. And then I guess one of the things that happened this quarter was you actually increased your guidance for ARR and cash flow. I guess what are you seeing that allowed you to raise guidance just in the first quarter of this year?
Q1 was -- we baked in a lot of things that could go wrong. The adoption of the SaaS by our customers and our sales force was very good, very early in the year, I know. And we baked in the full year guidance, a lot of things that could go wrong from a macro perspective and a lot of friction on the transition, especially in the first 6 months of the year. We talked a lot about that in the last 2 earnings calls. So I'd say overall, we feel good about where we are, still a lot of things that we want to do and execute against. But it was a good start for us that gave us the confidence to raise our ARR number and still bake in a lot of things that could still go wrong throughout the year.
And you came in, like you said, at 37% mix. You guided to 35%. Why the lower guidance relative to where you came in this quarter?
It's a very good question. I'd say, first of all, we take our commitments to the street very seriously, and the SaaS mix is no different than some of the other metrics that we put out there. But when you think about Q1, Q1 has historically been the lowest quarter in dollar terms of the year. So when you think about a SaaS mix that is much higher, 35% for the year in dollar terms, that's a significantly higher number than what we have achieved in Q1. The other element is the federal business. We're not FedRAMP certified yet. So in Q3, which is the largest quarter of the Federal business, they are expected to be a headwind to our SaaS mix, and we wanted to factor that in as well. So those are kind of the reasons.
Super helpful. With that, I think we're out of time. So Guy, Brian, thank you very much for joining us. Thank you all as well.
Thank you.
All right. Of course, thank you.
Read the full transcript via the API
You're viewing the first half of this call. Get the complete Varonis Systems, Inc. transcript - plus 251,000+ transcripts from 12,000+ companies, speaker segments and full-text search - through the EarningsAPI REST API or hosted MCP server.
Get an API key View API docs →For developers and AI pipelines
Programmatic access to Varonis Systems, Inc. earnings transcripts and 251,000+ others is available through the
EarningsAPI REST API and the hosted MCP server.
Quarterly plans from $105 - full transcripts, speaker segments, full-text search,
and the /api/v1/transcripts/recent polling endpoint for ETL pipelines.