Varonis Systems, Inc. (VRNS) Earnings Call Transcript & Summary

Good morning, and welcome to everyone just joining us to day 1 of Citi's Global Tech Conference. I'm Fatima Boolani. I help run the U.S. software equity research effort here at Citi. And this morning, I am thrilled to have with me the management team of Arous. Welcome, gentlemen. We've got the CEO and founder, Yaki Faitelson, with us; as well as Guy Melamed, who is CFO and COO. So excited to jump right into the conversation with you. Thank you for being here.

Thanks for having us.

Before we dive right into the media part of the discussion, I did want to remind the audience, if you do have any questions, please feel free to use the chat link or also feel free to send me an e-mail, if that's more convenient, [email protected].

So without further ado, I'd love to get right in there. Gentlemen, I want to start big picture. I want the opportunity for you to share with investors what some of the key secular trends you've been tapping into. And what's really driven the financial momentum in the business over the course of the last 18 months.

Hi, everyone. So I will start, Guy, with your permission. Well, what we see essentially just we are in our opinion, the most important pillar for data protection. There are -- just if you want to protect your data in a platform like us and essentially, we're doing 3 things. One is data protection, making sure that only the right people can access the right data. Events can't manage access control; and in a second, I will also dissect and really explain what is happening in the world, if you will, it's just very important what is going on with the digital transformation. The second thing is trade detection and response from the digital assets backhaul. So we can understand any abnormal behavior towards your data and with very high reliability. We can alert on any abnormal behavior, and the integrity of the data, exploitation of data and can give you the ability afterwards to do very effective forensics. Then we also classify the data, understand what is critical, and you can really adhere to almost every regulation that you've related to your data. I think what is happening in Varonis why we believe that slowly but surely the market is coming to us, so what happened with digital transformation and work from home, people are coming back to the offices. We see it in office and -- but in a hybrid mode. And what happened is all this massive adoption of the cloud is several things. One, the on-prem is not going anywhere. So we have massive explosive data on on-prem, but also a lot of adoption in the cloud and 365 is a huge driver for us. The other thing that you see is that, yes, you have so much endpoint, and it's very hard to define the perimeter and how we see that this endpoint is exploring, but you have less and less data on-prem. So you have a lot of access funds, which are the endpoints that can access from anywhere and then you can -- you're accessing your systems and data through VPN and from the cloud and to the cloud. And what happened is that you have less data on -- and much easier to define what are the sanctioned places that you have data. So on-prem, in the cloud and SaaS applications. And we are doing what I just mentioned, data protection, validation and response 5% compliance. On-prem data, SaaS applications, 365 and a lot of Azure AD. And what we see is that they can spend so much on security and get so lethal because just bad actors become so sophisticated. It's so easy to monetize cybercrime with cryptocurrency. If you want critical data, I will bypass your perimeter, and I will try to get to the data. The most practical way is to understand what are the critical digital assets, making sure that only the right people can access this data and alert on any abnormal behavior and get to the root cause of every problem. And on these 3 use cases, we also provide tremendous amount of automation. And this is why I think that it's driving for us. We believe we are in a very unique place that if you want to protect your digital assets and you do it in a very cost-effective way with a lot of automation in the places that matter to get the biggest event from you back, Varonis is a very good platform.

Yes, I want to take a step back. You touched on a lot of important themes and trends. Data itself is fragmenting and proliferating. The access to that data is fragmenting and proliferating, whether it's on-prem, whether it's the ballooning use of staff applications. But if I were to take a step back, cybersecurity in general, it is a very busy space, you'd agree. You have a lot of peers in the space who also talk about taking advantage of a lot of those trends, right? You've got a very serious and menacing attack environment. You have very large cyber gaps for exactly the reasons you point out and hybrid work, of course. So where and how does Varonis specifically grab the attention of the sizzle and say, "Hey, this is what you need to protect as opposed to, again, a lot of your peers in the cybersecurity space who have also generally enjoyed the same secular trends that you're referring to?

Yes. So essentially, we barely have any competition. We have very strong IP, and we're very lucky to start early and build this very strong modes. This is the first thing just to understand in terms of where we play. Secondly, when we're coming to a customer, usually it's 1 plus 1 equal 5. But more than anything else, if you really want to dissect all the vectors of security, all of them, the means to an end is in order to protect data by and large. So if somebody -- whatever supply chain attacks, sometimes it's an infrastructure, but buying out it just take critical data and then to do something with it. So let's take all the ransomware attack in order to take data, explored to do something easy. So what is going on when we are engaging these customers, it's becoming more strategic and more simpler in the sense of they understand that they need to protect data. It's something that they are doing today and they completely lost control. And Varonis is one of the important building blocks of this strategy. These people spend more on security. There are -- it's more and more discussions. But the other thing that is happening in security that always benefited us. So you have security incident, you have these rough spending. But after a while, people understand, okay, what I'm doing. So what we're starting to see because of the big 4 and the way that audit committees think about cybersecurity today, reputation damage, and the way that the cyber insurance companies. So everything in our universe is really coming to the organization. The organization can do so much and really encourage them to start a very thoughtful process of, okay, what I'm protecting and how I'm going to balance this tension between productivity and security. And this is the biggest issue, okay? I want to -- because what happens in organizations today is that organization's capacity to create and share information has really exceeded drastically the capacity to protect. And this is what you need. And in this intersection between security and productivity. And these are things that we need to do, we work very well. So -- and also the market understand -- we need to understand where the digital assets, we need to understand where is the partner base, intellectual properties, employee data and protect it. And with Varonis, we are doing it in the best way. And the other thing, you can be on so many places in order to protect data, but there is one bridge to one endpoint, compromised user. You bypass an MFA and you have the whole kingdom if the data is not protected. So you need to do everything. But by and large, we definitely see that customers are spending more money on solution like ours. This is one thing that they are doing. And once you engage in a thoughtful discussion, people really want to understand how I protect my digital assets, usually Varonis is the top priority.

And Guy, maybe you can chime in here, a lot of important trends that you're benefiting from. But how have some of these dynamics that Yaki was referring to, how have you been able to deliver and manifest this in your growth? And can you talk about some of the top line dynamics and the growth levels that you've seen? And how sustainable is this level of growth for Varonis?

I think that's a great question. And part of our job as the management team is understand when is the time to invest. And when is the time to be more defensive. And I think if you look at the last 18 months, a lot has happened in the world, COVID, it's a completely different world as we stand here today. And if you go back to March of 2020, when it felt like the sky was falling, no one knew what was going on, we became slightly more defensive just because we didn't know what was going on. We wanted to be able to analyze the trends and make the right decisions. So we cut salaries and we stopped hiring in all the different departments apart from our quota-carrying reps. But what we started to realize very quickly was that the underlying trends of the business were very, very strong, even though we had the hiccup in the actual revenue side in Q1 of 2020. The actual underlying trends were starting to be very, very strong and we could -- because we're such a metric-driven type company, we can identify pretty far and advance how things are going to look in 3, 6 and 9 months. Our sales cycles are between 3 to 9 months, and on the larger deals, up to 12 months. So the actual pipeline -- as revenue was kind of stopping with COVID, the actual pipeline was building up, and it has to do a lot with what Yaki was talking about, the fact that companies were set up first kind of with the VPNs and the laptops, but then they realized the whole collaboration and the whole work-from-home environment is causing increased risks. So as we saw Q2 of 2020, we had a much better Q2, then Q3 was even better and Q4 of 2020 was actually outstanding. So we decided to be slightly more offensive with our investments. And we started investing more on the sales and marketing side, more on the R&D side. We actually had our first acquisition and acquired Polyrize in Q4 of 2020. And that was all part of that plan of making the necessary investments, not for the next quarter, but for the next year, 3 and 5 years because we see this tremendous opportunity in front of us. And we want to take advantage of this long-term opportunity and capitalize on it. So we've been very, very focused and very, very measured in the level of investments that we are. We want to bring some of it to the bottom line. But we also want to make sure that, that top line growth can continue for the years ahead for us taking advantage of this opportunity.

So speaking to this notion of top line growth and the drivers that you have at play here, a number of different vectors, a number of different avenues to drive the 35 -- or sustain rather, the 35% growth that you consistently have been able to deliver the last several quarters. So if you sort of break the world up into new logos. So companies that are entirely new Varonis versus your existing installed base with whom you have very strong financial relationships and a very large product portfolio to sell, how do you think about the investments between those 2 pillars to then drive overall growth?

The simplistic answer is that as we continue to grow, we have a base of more than 7,000 customers. And that base should account for a much larger portion as we continue to grow. But at the same time, we're absolutely very focused on getting that new blood in that. Those new customers in because we know that the customer lifetime value that we can get from those customers with this subscription model is very high. So we focus on companies with more than 1,000 employees, the risk assessment that we do with companies and kind of part of the reason we're focusing on the larger enterprises is because the risk assessment that takes us from a time perspective to a 2,000-user shop and a 500-user shop is pretty much the same. Yet the customer lifetime value is significantly higher on the larger enterprises. So we're putting our focus on those. And as we sell to them, we know that the more licenses we sell, the higher the likelihood that we can sell even more licenses to them. So this has been kind of a concept that we've been talking a lot to investors and analysts about. And I know it's slightly counterintuitive, but for us, more is more. The more licenses you sell, the higher the customer satisfaction and the higher the likelihood that those customers are going to come back and want to purchase additional licenses that protect additional platforms. So we've seen the actual number of licenses that we sell to new customers double from what we sold when we were a perpetual company. We sold between 2 to 3 licenses. And that number has actually doubled, but it hasn't cannibalized our growth. It's actually allowed us to show that value to customers. A lot of it has to do with the automation that we can provide with the licenses. And then the likelihood of us getting to double-digit licenses per customer increases significantly.

To emphasize kind of what Guy said, the key is automation and reaching. And also, if you look at all the contemporary risks that are going towards data. So what you can say about the future is that if you have critical data, someone will want it, someone will want to sell it, and you need to protect it. And that you will have more data will go and the world will be hybrid, and you have more adoption of important SaaS application, and it will be interconnected. In this kind of universe, we believe that Varonis is a top priority. Therefore, in terms of where the risks are and how organizations create and will need to protect data, we have the attributes, the properties here something that is very sustainable.

Just out of curiosity, if you can frame for us, so you're now landing with between 4 and 6 licenses, right, when you sign your deals with customers. What does that 4 to 6 look like in the aggregate universe of products you can sell to a customer? And as an extension of that question, when you think about some of your largest customers, some of your best customers, call it the customer on a roll, right? You wish all your customers look like it's 1 customer. How many licenses or products with 1 of your largest customers have at present? So what's sort of that theoretical near-term maximum you can get to?

I'll start with the KPI that we actually introduced to investors recently as part of the transition, we talked a lot about the fact that we're selling more licenses in that first initial sale with that subscription model, and we wanted to support that with the KPI. So we introduced a number of companies with more than 500 employees that have 4 or more licenses and those that have 6 or more licenses. And the numbers actually speak for themselves. And are very supportive of the whole kind of message that more is more. So we've actually seen the numbers increase significantly. We've seen the 4 or more licenses go from 58% to 68% between Q2 of 2020 to Q2 of 2021. And we've seen the 6 or more licenses go from 24% to 35% in a 1-year period and actually more than double over a 2-year period. And what that -- that actually has kind of 2 signs to it. On the one side, we've increased the number significantly. But on the flip side, it still shows that 65% of our customers have 5 or less licenses, which means that we have so much more meat on the bone and we need to get to those customers, show them the value and make sure that they consume more of the product because they will be better protected, they will see more value, and that also gives us the ability to continue to sell to them. Now with the DatAdvantage Cloud that we recently introduced as part of the Polyrize acquisition, we now have more than 35 licenses to sell. So there's such a significant opportunity for us to go to those customers and show them value. And what's interesting about the DatAdvantage Cloud is that the licenses that we have introduced are not instead of the licenses that we currently have. There are additional platforms that we weren't supportive before, which means that, that gives us a huge opportunity to continue to sell to the base.

I want to come back to Polyrize and DatAdvantage Cloud in just a second. But just as it relates to another KPI that you've been referencing and talking about is your dollar-based net retention, right? Can you give us a sense of how important that metric is to you? Do you manage the business around it? And to the extent you do start seeing a lot more momentum and faster momentum with cross-selling more licenses in the base, how should we see that number in that metric rather evolve or change or hopefully expand a lot more from current levels?

So a great question. A couple of points in relation to that. First of all, NRR is an important metric. But 1 of the things that I've been talking to investors over the last couple of quarters about is that NRR is a pure subscription metric, which means that companies that have been subscription companies for years actually have that metric showing kind of the true reflection of how you can expand within the base. For us, it's still slightly different because we have maintenance of perpetual that is part of ARR and NRR that isn't really selling more of those licenses. So that's, in a way, a headwind to NRR for us. And -- but we expect that as we continue to grow as part of it being a subscription company. And that the NRR that relates to subscription as opposed to the maintenance of perpetual, that becomes a larger way. We expect the NRR to reflect more of a true NRR subscription company. So for us, that metric is still kind of impacted by the fact that we only recently moved from perpetual to subscription. But as we continue to grow and continue to sell more of the subscription licenses, it would be much more reflective on an apples-to-apples basis than what we see with other companies.

And then just to put a finer point on it. As a reminder for investors, what was that time frame between when you flip the switch, you move from perpetual to subscription, where are you in that journey? And consequently, when should we see some of the drag or the headwind from the maintenance or perpetual maintenance basically leaking out of the model so that we are apples-to-apples? Is there a time frame that you can point us to, to think about?

So on the revenue side, we're done, we kind of announced the transition in Q1 of 2019 and actually moved very, very quickly. And within 5 quarters, we moved from about 5% subscription mix out of total licenses sold, the 99% subscription mix out of total licenses sold. So it was a very quick move. It worked very well in showing value to our customers and really unleashing the potential of the platform. That was kind of the theme that we talked throughout 2019 and it actually worked very, very well, way exceeding our expectations. But from an NRR perspective, we still have a significant base of maintenance of perpetual, which we're not trying to forcefully convert. We're not going to our existing customers and trying to flip them from maintenance of perpetual to subscription, that's kind of staying there, where we expect it to slightly decline in terms of kind of the regular churn. We have a very high renewal rate consistently over 90%, and that should gradually decrease over time in terms of the dollar amount of maintenance perpetual. But the reason we're not going back to our existing customers and try and force them to convert is because we have so many more licenses to sell. So we're leaving the customers the option to continue to renew that maintenance of perpetual. It's still OpEx, so no one really cares, and it appears this is a line item on the PO. But then the additional licenses, they're OpEx as well. And they're buying the additional licenses under subscription, and that's been working very well. We're not in the kind of the business that's causing friction with our customers. So we've kept that maintenance as is and providing them more and more value with the additional licenses that we're selling.

Yes. Okay, I want to shift to you and jump back to DatAdvantage Cloud and the bones of this offering is from the acquisition that you did a Polyrize, almost exactly a year ago. And so I'm wondering if you can kind of give us a refresher on what the impetus was to bring that technology into the Varonis family? And how you've extended those capabilities and, frankly, diversified your ability to protect the data living outside of the Microsoft ecosystem, which is where you've been very prominent?

So we find a lot of success with Office 365 and probably, we saw tremendous adoption of SaaS applications. And before that, it was part of the road map. But we just found a very good team in Polyrize with very good technology that we can reaugment by taking salesforce.com and [ Ecard ] and Box and Slack, S3 in AWS and Okta. And on top of it, we can do what we've done with Varonis and other platforms. The other thing we understood very fast that we can realize a lot of synergy, we are a market leader in classification technology that we can take our classification technology and integrate it with the Polyrize acquisition. And we're in the early innings, but we invested a lot in the team, maintain everybody, and we grew it in drastically. And we believe that it's a huge opportunity for us. The same problems that you see on, on-prem 365. You see these cloud applications. We believe that more and more SaaS applications in the cloud can, call it, business applications, and everything we have done to on-prem data, UNIX file systems, Windows fire system, 365, we can do to many SaaS applications, and some of them on just a stand-alone opportunities are massive. If you think about salesforce.com, a company that sell well over 20 billion, more than 20%, all critical data, it's much harder to maintain data protection there than on regular file systems, also these applications are connected. So there is a big play with API security. We believe that this acquisition has a massive potential. It's increased drastically the total available market and also will help us with acquire new customers and sell to the base. As I said before, we believe that this is where the contemporary rigs are going, and this is maybe the biggest blind side at every CISO [Indiscernible].

Yaki, I'm curious if you can comment on some of the technical differences with what you're trying to achieve with DatAdvantage Cloud versus what some of the web security vendors are doing with their cloud access security broker plus data loss prevention offerings. Where does Varonis and data advantage compare and contrast with some of those capabilities that the web security vendors are talking about?

It's a very good question. Essentially, we are all about the data. If you go to a CASB or DLP, you can say, okay, this is the user, where they can access. This is a profile or user can access the data to have to classify a massive amount of data at scale to show you the potential of access to do remediation to connect to their on-prem. So what they are doing, even if they're referring to data, they are doing it on a case-by-case basis, and it's not something that we can really solve the program. And you can do some conditional -- augmental conditional access, and you can have some basic DLP in terms of downloads. But you can manage permission, you can have very strong machine learning regarding the data and you can't have any usable classification. So now we're already starting to generate a lot of DatAdvantage Cloud meetings, and I can tell you that we don't see a lot of competition. It's very much similar to the Varonis, maybe 1 out of 20 meetings we see something that can generate some confusion. And we can immediately eliminate it, and we can also show that we can bring the value the same way that we are doing with the risk assessment with the Varonis enterprise offering.

Guy, maybe adding a little bit more detail to that observation. How is DatAdvantage cloud impacting your pipeline, your sales cycles and even new customer acquisition activity? If you can put some quantitative points around it for us.

We -- with the acquisition in Q4 of 2020, we talked to investors about the fact that we don't expect any meaningful contribution in 2021. I can tell you that from a milestone perspective, we're actually hitting all the milestones and the progression is very positive. But it's still early for us to provide any data in terms of sales and sales cycles. We want to make sure that we provide color that is supported by the metrics that we closely track. So we introduced it again and came out with it in Q2 of 2021. Again, not expecting any meaningful contribution in the second part of the year. But we did say that as we progress throughout the year, we'll provide more and more color as we see the data come to us. And that's kind of where we are. We feel very good in terms of the opportunity that it holds for us. And we're making the right investments to actually be able to benefit from it, but still not expecting any meaningful contribution this year.

Anything you're doing differently from a pricing or packaging standpoint with DatAdvantage Cloud that is perhaps different from how you're going to market with the traditional and the core portfolio?

So one of the things that we're doing with pricing is just trying to simplify the whole process because when you have 25 licenses, that's one thing. When you have more than 35 licenses, that's another thing. So we've actually introduced a bundling option, which we had before, but we just kind of tweaked it where there is silver, gold and platinum offering to our customers. And those are based on number of licenses in terms of the offering that customers need to have and they can start with kind of the silver, gold and then continue to go and purchase more licenses. And we just recently came out with it, and we're tracking kind of that progression. But at the end of the day, I think what's very interesting to keep in mind is that we're selling technology on multiple platforms that can allow customers to see value the more licenses they have. So we're trying to make sure that customers realize that the automation component comes with more licenses that they have. And that's part of the reason that we've seen kind of new customers buying more than double or more and more the number of licenses they bought under perpetual. So really, the move to subscription allowed us to unleash the potential of that.

And just to wrap up our conversation around cloud. At present, Varonis still predominantly is being deployed on-premise. I'm curious in terms of broader product strategy, technical road map, is there an aspiration or a time line you have to potentially make the entire Varonis platform consumable as a cloud service?

We don't want to talk about road map, but rest assured that we are doing the right things for our customers and the way that they want to see the platform to give them all the flexibility. We are manically focused on customer value.

Fair enough. Guy, maybe back to you, we talked a lot about the growth and top line drivers. Just digging into the expense profile of the business. Obviously, 2020 was a unique year from an expense management standpoint. Can you give us the broad contours of how you're thinking about the 2021 expense profile? And then maybe specifically as it relates to R&D, if you take care of your existing customers who are on the perpetual SKUs, how do you think about your R&D priorities shifting towards some of the newer solutions and newer form factors as you kind of continue to expand the portfolio and expand the foreign factors in which the portfolio is available?

Maybe I will answer the R&D. Just in terms of the R&D, the same customers that bought perpetual bank subscription now. So we just invested in scalability and feature set and a lot of -- just a lot of automation in accuracy, this is something that is going on. And also the feature set, we generate a lot of features. So there are just a lot of features because the key here is automation. And I said there is enrichment, so anything we're doing in pacification, automation in remediation, reporting capabilities, cash book and the scalability itself as we have more platform. Lastly, we need to support more platform, and this is many times a collective effort. So this is what we are doing. So R&D is right in the center because there is just so much to do. And there is so much to do that now we even don't need a crystal ball. Just there is a big platform, and we know how the playbook is working and now there is another level of the connectivity between these SaaS applications and also the on-prem [indiscernible]. So this is really in terms of the R&D.

And another way to think about kind of the cost structure is when you look at the cost of acquiring new customers, that's obviously the highest cost. And then the cost of upsell is the second highest cost and then you have the renewals. And the move to subscription kind of happening when it did in 2019 generated a significant headwind from a revenue perspective but we knew that, that investment would kind of bear the fruits in the years ahead. So we still in 2020, kind of still had that impact of the headwind. And as we're exiting the transition and becoming a full apples-to-apples, we're going to see more and more the base of subscription becoming a larger component of total revenues as opposed to the maintenance of perpetual that I talked about before. And from a cost perspective, if you look prior to the announcement of the transition, you can see that we've been committed to operating margin improvement year-over-year. There's a lot of leverage in the model to kind of the power of the renewals. And you can see that we showed improvement year-over-year that ranged between 100 basis points, 300 basis points and in 1 of the years, it was even 700, 800 basis points. So there's a lot of flexibility for us. But at the same time, you want to make sure that you're not underinvesting to make sure that you really capitalize on the long-term opportunity. Because if we wanted to show operating margin, high operating margin percentages today, it could be done in a relatively easy way, but that's not the right thing to do for the business for the years ahead. So what we've done for many, many years is balance the top line growth with the bottom line operating margin. So we're very focused on both of those metrics. We want to continue to grow, but at the same time, we want to bring some of it to the bottom.

And then just the last question to round out the discussion around the investments in sales capacity and go-to-market. Anything that you're doing differently? Any specific go-to-market objectives or initiatives that you're undertaking over the course of '21 and even '22, as you think about supporting your top line growth aspirations?

On paper we can sell to everybody. Everybody that has critical data, Varonis is relevant. But the most really where we focus is 1,000 users to 50,000 users, and what we also see because thankfully all the investments in R&D are already working with so much to sell to the customer. So the customer lifetime value is increasing drastically. So our reps can do what we needed to do with less account. But the other thing you need to make sure is that it's this proprietary sales force. We barely have competition, you need to come in, you need -- there is a lot of cultivation, you need to enable people and make sure they're the right managers. So we want to make sure we have the right coverage, we cater to own customers in the right way. We also put our energy in places that can move the needle, but we will not consume this market. So this is what we are trying. But just to bring your reps and not to give them the right support and they will know what they need to do in terms of account management and know how to pitch the product and how to do the demo doesn't make sense. And we also -- so what really changed is that let's account predictable productivity, more CSO control, better conversion on the pipeline that we have, but we will keep building significant and strong sales force that knows how to sell for us.

So if I were to distill sort of what you said, really a lot of blocking and tackling with just general capacity additions and just improving the rigor as opposed to maybe verticalizing the sales force or changing incentives in a meaningful way.

Incentive, no, because this is something that we had and it's working now. You always manage change, but you want to manage change incremental. We're trying to do evolution, not revolution. So maybe this was a better way to answer. We're just trying to make sure that we have incremental changes that have a big impact and not overall.

Fair enough. All right. Well, with that, we're at time. But I wanted to thank you for 40 minutes that flew by. So thank you so much for a great discussion, and we'll hope to see you very soon.

Thank you.

Thank you so much.

Take care, gentlemen.