Varonis Systems, Inc. (VRNS) Earnings Call Transcript

Research team here at Citi and very excited to host you all on day 1 of the Citi TMT Conference, and I am very excited to have Varonis on stage with me. To my left, CFO, COO Guy Melamed and to his left, David Gibson.

Guy, I want to start the conversation at the highest level. This year has been very interesting from the standpoint of macro gyrations, right? So at the macro level, you had those dynamics playing out. And then internally, you've had several compounding layers of changes take effect for the business. So I'm wondering if we can set the stage with sort of what have you been experiencing in the macro, how the business has reacted? And then just from a micro perspective, some of the sales organizational and incentive dynamics that have evolved, the SaaS transition, which we will certainly get into. Would love to kind of start there and bifurcate the conversation between macro dynamics and micro dynamics.

So first of all, good to be here. There's a lot to digest in that question, and I'll try and cover at a high level as much as possible, and we can dig in further with anything not covered. I think when you look at where we are today, the fact that we have moved to SaaS or really at the late stages of the transition, we should be done at the end of this year, 2 years earlier than initially planned is a testament of the technology and the offering and the evolving market. When we look at kind of the landscape from a risk perspective and what customers need to face, their biggest challenge is that the hackers and the sophistication of hackers and even the inside threat, the amount of employees within the organization that try and take data and give it to competition is increasing by the day. And with that level of sophistication, our SaaS offering and the MDDR offering that we can talk more about has really changed the game for those customers. They no longer need to operate the software and need to make sure that they're taking care of that risk. We're helping them mitigate that risk. A lot of kind of the MDDR is covered by AI. 80% of the alerts are covered in an automated way, and we have those technical personnel that overlook and make sure that anything that looks strange or abnormal, we can then notify the customer and let them know that they need to look into it further with us, obviously, we help them do that as well. So I think when you look at kind of the environment, the SaaS and the MDDR has been a significant change in our favor. And I'd say that Copilot and AI in general has been kind of the second item that is really kind of changing the landscape. And when you look at AI today and the fact that Microsoft is trying to push Copilot and all of the other big companies are pushing kind of the AI. I think AI, that train in a sense of -- it will change the world. We don't know when that point will kind of take off, but there's definitely that focus, employees are asking for it more. And what is happening for organizations is that they realize how vulnerable they are if they don't take care of their data before they roll it out. We've received frantic phone calls from customers that rolled out Copilot and realized that employees went into the chat box and wrote who got a salary increase in 2024 and got that information within seconds. Because now if you didn't take care of who has access to what type of information, AI doesn't know to distinguish between what's sensitive, what isn't sensitive, what you should be having access to and what you shouldn't. It gives you whatever you're exposed to. And if you don't take care of it, you'll have those catastrophical moments. So I wouldn't say that AI or Copilot has been fully adopted. I think many of us from conversations with customers, either it's rolled out on a subsidiary or a small group, but there's way more conversations on starting to roll it out to the entire organization. We can talk about the partnership with Microsoft that has warmed up significantly where we signed an agreement. There's a press release that came out July 3 that talks about kind of the intention of a go-to-market together and building maybe technological capabilities that would cater to customers. So I think when you look at where we stand today, there's a lot of interesting things. We can talk about the acquisition that was announced yesterday. We can dig into that. There's a lot of things that we're very excited about.

And I think just to recap from Q2, what are some of the key messages that you want to really emphasize and how you're thinking about the remainder of the year and naturally in the context of some of the things you talked about, right, SaaS and MDDR and the transition coming to its full fruition by the end of the year. So some of the more tactical elements and more memorable highlights from Q2.

So to kind of tie to your first question, the part that I didn't answer on the macro, I think when we look at the macro, we've seen kind of macro be very steady. What is actually working in our favor is that the sales cycles for SaaS are shorter than the sales cycles for the on-prem subscription. So there's still that deal scrutiny. There's additional requirements to put pen to paper. But I think with the SaaS offering and with kind of the savings that we can offer our customers with the move to SaaS, where they don't need to manage the hardware and where they can reduce their headcount with the MDDR offering, that has really helped. So it's very fitting to this environment really. And when I look at how Q2 ended and kind of the continuation of what we see for the rest of the year, it was a very strong quarter from a new customer perspective, from an existing customer perspective. We -- when we look at all the metrics, we're seeing that the customer lifetime value is increasing with our SaaS offering. We're seeing that customers -- our SaaS customers are talking about what they would buy in addition to their initial first purchase. So we talked about NRR of our SaaS offering continuing to be much better than the reported NRR that we disclosed at the end of 2024. So I think when we look at Q2, it was very much a continuation of Q1. We're set up for a healthy Q2 -- for a healthy H2, sorry. And I think that when we look at what we have to offer, with the Cyral acquisition and with the additional offerings, once you get customers to SaaS and you've kind of taken care of that red tape bureaucratical challenge of just moving them to a SaaS agreement and going through the SaaS checklist and taking care of all of that stuff, which I think we're doing much better in 2025 compared to what we have done in 2024. I think when you look at all of those elements, we're very excited for the second part of the year.

And can you give us a reminder on -- just from a metrics perspective, how much of the base is now full-fledged on Varonis SaaS? How much more of a transition effort remains? And we're all familiar with the notion that, hey, the sales team has been very hard at work and their time has been very occupied in porting and forklifting customers over to the SaaS. And there's all these behind the scenes legal and procurement things that us as investors don't necessarily see that can gum up the machine, if you will, for transition, right? So can you give us a sense of sort of numerically and quantitatively as best you can, where we are on the entire installed base having moved and what might be some sort of the remaining hurdles or...

So at the end of Q2, we increased the SaaS mix guidance to 82%. So we expect to finish the year with an 82% SaaS mix, again, within 3 years, moving very, very quickly. The one thing that's important to note is that Q4 has always been the largest quarter for us where the largest amount of renewals are in play, and that's obviously one of the lessons we have learned from last year is that we're having conversations with those customers that are up for renewal in Q4. We started those conversations in Q1 earlier than usual in terms of the benefits of SaaS, why it's a much better product. The reception that we're getting is very, very good. Customers are excited to move to SaaS. So I think throughout there's still a lot of the base that we need to convert. But from a commission perspective, this is the year of transition as we kind of exit the year with an 82% SaaS mix, which is the guidance or if we can do better than that, that doesn't leave a lot of customers to convert. The one element that is actually worth talking about is that a lot of the ones that haven't converted are state and government. And we received our FedRAMP certification in the last couple of weeks, which is -- it was a lot of effort to get it a lot of -- it was a big investment, both from a monetary perspective and from a time perspective, but it was definitely worth it from our perspective because now we can go to our state and government customers and show them that they can move to SaaS with that FedRAMP certification. So I think that probably kicks in -- I'm not sure it kicks in this quarter. I think it probably was a bit late in the cycle. We're still trying and we're still working on that. But if I look at kind of the ability to convert those customers to SaaS, I think that will be part of what we focus on next year. But if I look at the enterprise business, we're very much in conversations with the one that haven't converted. And I think that it's extremely we've been extremely focused on kind of moving as quickly as we can and the reception of our customers has been great.

So learning lessons for the sales team from last year was, hey, don't wait until Q4 to talk about conversions in Q4. Sales team is talking about conversions in Q1 when your renewal pipeline is the chubbiest in Q4, all the T's have been crossed, all the I's have been dotted. Just from that standpoint, with the sales team having the reps on really evangelizing and educating the customer much, much earlier on, on the benefits of the transition. The flip side of that, that naturally opens up there -- that naturally opens up their time to actually generate new pipe and build new pipeline, right? I'm wondering if you can shed a little bit of light on or comment on how new pipeline generation has trended over the course of this year after having learned what we learned last year that, hey, sales team is having to take a lot of cycles to talk about conversion. So they're not actually going out prospecting or they don't have the bandwidth to go out to prospect. So just new deal, new logo, net new business pipeline generation activity.

I think probably one of the biggest challenges for investors to understand was how the conversion is cannibalizing the time of our sales force. I know that when we sit here and when we talk about conversions and the adoption, it wasn't a challenge from a technological perspective. Switching customers to SaaS, the way the technology has been built, taking all the experience that we've had over the last 20 years and kind of implementing it into the SaaS platform has made the platform efficient, easy to use. We can see it in the leverage. We can see it in the free cash flow. All the metrics that are hit have actually done better than what we initially expected. But the time to get a customer to start a conversation about a new contract and start doing SaaS checklists and making sure that from a security perspective, everything is in place, that was taking way more time than just getting a PO for a renewal. So when we thought about where should we put our focus on, we wanted to make sure that we don't kind of stay in that limbo stage for too much longer. We have seen new customers over the last, I'd say, 2 years work really, really well. We see not only an increase in the ASP, we also see an increase in the number of new customers that we can acquire. I think one point to note is that the move to SaaS actually increased our TAM, 3x. The offering, our ability to not only sell it in different markets, but sell it to customers that probably wouldn't buy under the on-prem subscription offering. The ease of use of it has really increased our opportunity dramatically. And now when you go to a customer and you talk about the MDDR offering, basically telling the customer, this is the platform, we have a team that manages any abnormal behavior, and we can help you with that is a completely different conversation than selling you the software and kind of letting you deal with it yourself. So I think with the move to SaaS and with the MDDR offering and the MDDR offering has only been in place since the beginning of 2024. I know a lot of people kind of think that it's always been there, but it's been by far the fastest adopted platform Varonis has ever had, and there's no close second really when you think about how it's been adopted. So I think when you look at all of those offerings, our ability to sell to new customers has increased significantly with the SaaS and MDDR compared to what we had in the past. We see it in the numbers. We see it in the trends. When we get customers over, we can now go back to the base and start upselling them in the same manner, in the same way we have done when we had on-prem subscription. So the setup for us of continuing to sell to new customers in the same way and getting to our existing customers with all the trends that we're seeing where we can continue to upsell to them is part of the reason we want to move as quickly as we can on the SaaS offering conversions and not get stuck in that transition. So that's really the set.

And just as a point of clarification and even a reminder for us, MDDR has been deployed as a carrot to get customers over to SaaS, right, as opposed to independently and individually monetizing MDDR. It is a powerhouse offering in and of itself, but it just makes the whole SaaS platform usage sing, right? Where is kind of the philosophy on that? I know there's been some evolution there, right? How should we think about the direct -- to ask it more simply, how should we think about the direct monetization of MDDR because it is such an important layer on top of the SaaS platform usage?

I am not sure the phrasing you used is the exact accurate way I would use. It's definitely used as a carrot, but we are able to monetize on the MDDR offering. It just really depends how you count the dollars, whether -- if I give you the MDDR, but you're buying a more comprehensive platform, you're paying more dollars, the ASPs are going up. But on the MDDR, there's no specific SKU associated with that. So it's really hard to distinguish what exactly is driving the increase in spend, honestly, as long as we can provide our customers the right service, they're happy and they're increasing their spend. It doesn't really matter what it's associated with. And we are seeing our existing customers spending more with us, buying additional platforms, getting the MDDR. And the way we have structured the MDDR is that if you buy the larger platform, you get the MDDR at a reduced price. If you want to buy MDDR as a stand-alone, you'd pay a much higher price. The way we set it up was really to cater our customers to buy the more comprehensive platform. It helps us with the way we structure the alerts and make sure that we have a much larger view as to what's happening in their environment. And we're happy to see that that's actually the path that most of the customers have taken.

And just to kind of continue on this thread. So clearly, still a good chunk of the base needs to be moved over, but let's talk about the installed base that actually has graduated and migrated over to the promise of SaaS, right? Can you talk about some of the buying behavior and more specifically, just to put some numbers and sort of model-related context around it, as we sit here, what should be the driving forces for SaaS net retention rate expansion and overall SaaS ARR growth acceleration? Is it, hey, SaaS customers are buying more product to secure data sprawl and data classification pain points for existing workloads? Or are you enjoying or are these customers now so much more easily able to jump to completely new solutions to tackle completely new environments. So between more of the same versus more new capabilities being added, what are going to be the most sensitive drivers to SaaS NRR growth and SaaS ARR expansion?

So maybe I'll talk about the numbers, and David can give some color because he's talking to so many of the customers and what their journey is. When we look at our total NRR, and we talked about the reported number for 2024 was $105 million. I think part of the reason that, that number has come down is because of the time it takes to convert and the fact that it was really cannibalizing the time of our reps. When we look at the SaaS NRR, not taking into consideration any of the uplifts that relate to the conversions, but just customers that were on SaaS at the end of 2023, what they bought throughout 2024, we see that the SaaS NRR is significantly higher than the reported $105 million. And that gives us the confidence. When you look at kind of the ARR growth, we've talked a lot about our desire and focus on getting back to that 20-plus percent growth rate. We're at 19% ARR growth right now. If we can continue selling to new customers the way we have over the last year or 2, and I think there's no reason we couldn't when we look at the opportunity, and we look at the SaaS NRR being significantly higher than that $105 million, when you -- in simple math terms, that really helps us get there. So from a numbers perspective, we feel very good about kind of the desire to go back to that 20-plus percent. And the trends of the SaaS NRR being significantly higher than the reported one gives us the confidence to get there.

Yes. From my perspective, my experience with our SaaS customers is they are delighted. And we have kind of a routine. Here are the data stores that we're protecting for you. Here are the things that we found and fixed because there's so much automated remediation built into the platform. And here are the threats that we've detected and stopped for you without you having to do anything but take a phone call from us. We know -- we've been talking to you, we know you have data over here. We know you have data over here. So being able to expand the coverage there is a big opportunity, and we're doing this regularly and routinely. Now in addition to that, I'm usually reviewing our customers -- reviewing our road map, some of the short-term road map that's coming up, like some of the things that we've now announced like the database activity monitoring. Now we've announced e-mail security. So there's so much eagerness for some of the functionality that we've added and that we continue to release. I feel like both the breadth and the depth and the functionality are big opportunities for us, and customers are really excited as am I about what we're offering and what value we're able to provide for them.

I think it's a good plug to maybe talk about the acquisition.

Acquisitions. Yes, fantastic. That's actually great to think alike. -- you'd historically been very selective on M&A. I think Polyrize was your first foray into doing M&A, and that was 5 years ago. And we've now seen 2 deals this year, right? So generally, M&A philosophy and thesis, how that mindset has shifted, right? And why come out guns blazing into e-mail security?