Varonis Systems, Inc. (VRNS) Earnings Call Transcript & Summary

All right. Well, thank you all for joining us here at the UBS TMT 2021 Conference. I'm Roger Boyd, I cover cybersecurity software here at UBS. We have Varonis today. Very happy to be hosting Field CTO, Brian Vecci, and Head of IR, Jamie Arestia. [Operator Instructions] So with that, Brian and Jamie, thank you both for being here.

Thank you.

Thanks for having us.

Yes, of course. So maybe we can start with a high-level question. And the Varonis platform is -- it might be helpful for investors who are maybe less familiar with the story to understand what the Varonis platform really competes with and the market for data security, where you fit into that market and -- yes.

So I'll start with the first part of your question, and I'm sure we'll get into it in more detail, but nobody really competes with us. So Varonis is a platform designed to secure the data itself. We start by giving our customers a deeper understanding of data that they can get with any other technology. We understand what data is, not just what's sensitive but where it is and how it's being used, really critically, who has access to it, where it's exposed, what the blast radius of a potential attack is, what could this person access if their account were compromised, whether that data is on-premises and file systems or NAS platforms or increasingly in the cloud and platforms like 365 or Box or G Drive, Salesforce or GitHub. We monitor all of that data access along with the behaviors that get people access to that data. Varonis is not a SIM, not a CASB. So we're not just topping logs. What we're doing is looking at data access events, enriching it with information about who the user is, what they have access to, whether that data is sensitive, the devices being used and where they're coming from. And that lets us build really useful, accurate profiles about what's normal so we know what's abnormal. And we know uniquely when users or applications start accessing data inappropriately or maliciously, and we know when people start accessing sensitive data that they've never looked at before or we know when an account starts looking at data it's never looked at before and, for instance, encrypting it. So the reasons that our customers use us is that for this kind of data, file system data that's on-premises and in the cloud, application data, they can ensure that it's properly protected. And by that, I mean not just that they have endpoint protection and perimeter controls like firewalls and e-mail filters, but the data itself is actually protected. The data is only accessible to those who need it. Everything is monitored in the right way so that you get a small number of alerts that are really actionable and tell you when something is going wrong without a lot of noise. And if you do those 2 things well, you can keep data private, and you can prove under whatever framework we want to use, whether it's the GDPR or CCPA or SOX, HIPAA or PCI, CMMC, whatever it might be, you can ensure that those controls are in place. And it's impossible to do otherwise because only Varonis is what's actually looking at the data itself. We're the only ones that combine these various dimensions of what data is, where it's at risk and who has access to it and how it's being used critically, along with the ability to fix the problems that we find through automation. And of course, that -- all of that is built into a platform that's evolved over the last 15 years. And I know there's a lot there. I hope that gives you some color.

No. That's a perfect overview. And I think with all that in the context, you've now delivered 3 quarters of, call it, 35% ARR growth as you start lapping some more impressive numbers. Coming out of the pandemic, can you just talk about, I mean, all the stuff you just talked about, how that is further impacted by trends like remote work and data being distributed across on-prem and cloud and what those tailwinds have meant for your business over the last, call it, 6 or 7 quarters?

Sure. I'll start, and I'm sure Jamie can fill in. All of those secular trends, more data, more collaboration -- one way to think about it is our ability, and by our, I mean, enterprise's ability to create data and collaborate, has dramatically outstripped its ability to protect it. That transition has been happening for the last 1.5 decades, but it accelerated over the last 2 years as everybody went home and the number of endpoints doubled and more and more data moved into cloud collaboration platforms like 365. All of that benefits us because when data is in multiple places accessible by people inside and outside the organization, applications on-prem and in the cloud are designed to be connected together. If the configuration risk continues to grow, you need a platform to be able to secure that data. And all of those secular trends are what we've been building our platform to support, and they've accelerated over the last 2 years. And even as people start to go back into the office a little bit, I don't think we'll ever see a return to data being 100% on-premise as accessible by only people in an office environment. We're expected these days to be able to access anything from anywhere, from any device at any time, collaborate with anybody who might need it. Applications are designed for collaboration at their core, and they're designed to be connected together. And all of that benefits a platform-based approach to protecting data.

Got it. Okay. And I guess with that in the context, I mean, you're now -- with the net new ARR, you saw pretty significant growth there in the first half of the year and, call it, maybe a little more modest growth in 3Q as you start lapping some tougher comps. How should we think about the overall opportunity in front of you and your ability to keep that net new ARR growth number growing?

Yes. It's a good question. I think we feel very good about kind of a number of growth drivers that are supporting us, in addition to sort of -- the sort of bigger tailwinds that Brian described from a macro standpoint. I mean we sort of look at growth as coming from 3 different ways. The first is obviously new logo acquisition. We continue to add high-quality, large enterprises every single quarter. We're -- the second piece is selling into the base, where we are tremendously underpenetrated with our existing customers, and we have more than 7,000 today, most of whom are not where we think they should be, which is kind of the double-digit number of licenses. And then the third piece is just innovation. We started in 2005 with 1 license. In 2014, when we went public, we had 10 licenses. When we announced the transition to a subscription model in the beginning of 2019, we had a little over 2 dozen licenses. And today, with the recent launch of DatAdvantage Cloud, which extends our platform into a number of cloud data stores and SaaS applications, we have more than 3 dozen products that we can sell to customers. We're certainly not done with that point. Yaki, our founder, is very fond of saying that we have more innovation ahead of us than behind us. He still says that today, and he absolutely means it. So we will continue to build out the platform, and that should be another sort of source of growth for us going forward. So you couple that with, I think, the demand environment, which is sort of being driven by a very dangerous threat environment as digital transformation, and we really think that there's just a greater and greater demand for our platform. Our focus of starting from the inside out, starting with the data, protecting the data first is something that only we really do. And I think that approach -- a few years ago, we really had to evangelize both the problem and the solution. We really don't have to talk and convince customers of the problem anymore. And there's less that we have to do, I think, from evangelizing the solution, although we still have to go through our risk assessment. But I think our process, this inside-out approach is really resonating more and more with customers, which isn't really surprising because I think a lot of these breaches that we've been seeing have really bypassed a lot of perimeter controls by design to go after sensitive data. We've been saying for years that the perimeter is really critical, but we think it's ultimately insufficient. And a lot of these breaches continue to sort of bear that out. So all of this, I think, should continue to drive very strong ARR growth. As you mentioned, we're very happy with the numbers we saw, with 36% year-over-year ARR growth in Q3. And also the net new ARR comment, I think the one thing that's probably worth keeping in mind as you look at the year-over-year comps is just 2020 was a bit of an odd year for a number of reasons. But obviously, for us, with COVID, in Q1, we missed our financial guidance for the first time as a public company because of COVID. A lot of business we typically closed in the last few weeks of the quarter. And if you recall, March of 2020, kind of mid-March was really when a lot of the COVID lockdowns and restrictions went into place, right, when we would typically close a good amount of our business. And we saw some customers defer purchases as a result of that because they really had to focus overnight on getting their people sort of set up for business continuity and employee safety. And so we missed our results. Some deals slipped into Q2 and Q3, but we really saw business start to resume and pick up as we move through 2020. And so it's probably more helpful to look at the ARR we've added so far this year versus what we added through the 3 quarters of last year. And when you do that, I think it probably adjusts for some of that noise that we saw from COVID and you still see that growth is up 32%. So I think we're very encouraged by all the metrics that we see. And there's no reason we see the momentum slowing down as we kind of look to 4Q, which was our strongest financial guidance from a revenue standpoint that we provided since 2014 and was also against a very strong comp last year. And while we haven't guided yet to 2022, we'll do that on the next earnings call, I think everything that we're seeing from a demand standpoint and from our ability to sell more to customers has us feeling good about our position.

Got it. Makes sense. And maybe then as a jumping off point, I mean, relative to the 36 licenses you sell today or 35 licenses, one of the key stories you talked about throughout the transition was that when you move to a term-based model, you can get customers more -- more adoption earlier on, more automation. And the pathway to double-digit license counts becomes more obvious. Can you just talk about the metrics you've shown in terms of platform adoption, both net retention rate and also just module adoption and really how that's kind of improved as you've exited the transition?

Yes, sure. So I'll talk -- I'll start by talking about some of those metrics. And then I think Brian can provide a lot of insight as to why a greater number of licenses upfront sort of delivers a different level of value to customers versus when they start with a lower number. So yes, as we embarked on the transition, we started producing -- or reporting a metric: the number of our customers with 500 employees or more who take 4 or more licenses and 6 or more licenses. And just to set the stage here, when you go back to us as a perpetual company, the average number of licenses for a new customer was between 2 and 3. And now with the move to subscription, it was originally 4 to 5. Today, it's between 5 and 6 and really approximately 6. So that number of new licenses -- new deal has doubled with the move to subscription. So we provide this metric of the percentage of those customers who take 4 or more licenses and 6 or more licenses. And those have grown very rapidly, not surprisingly. So 4 or more was 70% of those customers in Q3. That compares to 60% a year ago and 50% 2 years ago. And then 6 or more licenses is 37% in Q3, which is great because it's more than double where we were at 17% in the third quarter of 2019 in the first year of the transition. So in a short period of time, those have grown very, very rapidly, which is phenomenal. But I think it's also important to keep in mind that we want every single one of our customers at a double-digit number of licenses. Just think about how many products we have to sell to customers. And so that sort of illustrates, as you look at those numbers, 63% of customers or the opposite of the 37% are taking 5 or fewer licenses. And what we've said is it's easier to get -- when a customer starts with 5 licenses, it's easier to get them to 10 than it is when they start with 2 to get them to 5 licenses. And maybe I'll sort of pass to Brian to sort of elaborate on that point because I think it's really, really critical when you think about the different level of lifetime value we're providing to customers.

Think about having problems or challenges [ in security, for instance, ] and compliance. You need to understand not only what data you have is, which is a flavor or 3 or 4 of DatAdvantage. You might want to look at on-premises, Windows file systems. You might want to look into 365 and OneDrive and SharePoint Online, the amount of data exchanged. There's 4 licenses right there. But just understanding what you have and how it's being used and where it's at risk is important, but so is understanding what's important to a new classification. When you do that, only do you understand what data is sensitive, you understand where that data is exposed and how sensitive data is being used. And once you're monitoring not just sensitive data but all your data in the context of where PII or intellectual property is being used, you might want to alert on misbehavior. So [indiscernible] makes sense because now you're not only monitoring behavior, you're analyzing user behavior in a really intelligent way and you're alerting. And suddenly, your classification becomes more powerful because not only are you monitoring and alerting, you can alert when somebody starts accessing sensitive data that they've never looked at before or wherever it might be. And you really want to understand the devices people are using and how they're getting to that data, how they're authenticating. So Active Directory -- or Azure Active Directory starts to become really important. And you might want to automatically reduce exposure. So now you want to use the automation engine. All of those licenses make each other license that much more valuable. And I just went through, if you've just used those licenses, 10 or 15, depending on exactly where you're deployed, Varonis licenses, whereas with just 1 or 2, maybe you know where sensitive data is under Windows file systems. But these days, it makes so much more sense to have a broader -- a wider set of visibility, a deeper set of visibility with advanced classification and analytics and alerting and the automation to take care of the issues that you find. All those licenses make all of the other ones that you're using much more valuable, which is what we mean when we say more is more. It is much easier for us to take a customer who has us in their on-premises environment, for instance. They're mapping and monitoring Windows file systems and all of their Isilon or NetApp data. They're classifying data. They're alerting on misbehavior. They're adding in directory services. And then perhaps at the beginning of COVID, they put the pedal down and accelerated their adoption of Microsoft 365 because everybody was working from home. And they wanted to use Teams to collaborate in OneDrive and SharePoint Online to store data and get people access to it. Suddenly, there was an appetite for 5 or 6 more Varonis licenses. It's much easier for us to get a customer to that point, to double-digit licenses when they're already getting the value of the interconnectedness of all of the other functionality that we offer versus a customer that only has 1 or 2 licenses and is probably using us for what would be considered more tactical use cases and less strategic ones that really map to large business challenges like data protection and risk reduction. It's why the subscription transition was so important for us because our customers could consume more of the platform upfront, which means they get more value right away, which means that it's much easier for us to then accelerate their deployment and consume up to the double-digit licenses that we know will be needed for them to get full value out of the platform.

And Roger, just the one thing I neglected to mention which you asked about was serving that retention rate number, which we're providing on an annual basis. So we will give it for 2021, on the next earnings call. But for all of 2020, it was 119%. And I think what's important about that is it sort of, I think, illustrates exactly what we're talking about, that we are seeing customers buy more upfront. But then they see that value more quickly, and it's much easier for them to add on more and more quickly. So we would expect -- while we don't guide to that number and we'll give the 2021 number on the next earnings call, we've seen qualitatively sort of continuation of those trends, where we're spending a lot more time with our customers, making sure that they're using the platform, understanding the value that they're getting. And when they do that, what we've seen in the 2 years since announcing the transition and all these renewals that have taken place is, certainly, they don't just renew but they expand as well. And it's very easy for us to turn on additional licenses and provide them even more value.

Yes. That's a great point. And just to clarify, the 119% is a full company-wide number that -- you're no longer selling perpetual licenses, but you still have potential maintenance. And so the 119% is a blend of that plus subscription, which would considerably be higher than that.

That's right. And that's a good point as well because, yes, the net retention rate is the growth in the ARR from a cohort of customers a year ago. ARR for us is obviously our subscription revenue, but it is also the maintenance revenue from our legacy perpetual customers. And while those have very strong renewal rates of above 90%, there is a little bit of churn in that line in any given quarter. And so that would obviously be serving as a little bit of a headwind to the net retention rate number. So the subscription component is actually outpacing the 119% that we report, which, as you know, is a blended number.

Got it. Okay. Maybe relative to this broad upsell opportunity, can you talk about how you balance that -- balance ARR growth between upsell and new logo acquisitions? And what sort of trends are you seeing there in terms of how data securities may be brought in, in the last year in terms of demand from new customers?

Yes. So maybe I'll start and talk about sort of the balance and then Brian can talk about some of the trends that we're seeing from a demand standpoint. So Varonis, we've always actually seen the majority of our revenues in any given quarter come from the base of existing customers, which I think makes sense when, again, you just consider how many products we have to sell relative to what we were selling. Even back when we were perpetual and a new customer was starting with 2 licenses, we had plenty more that we could sell them. That trend hasn't changed. It's obviously picked up. And even though we're selling them more, there's still plenty more that we can sell them. And as we just discussed, it's actually kind of fueling and enabling that upsell opportunity. So in any given quarter, I think we're seeing the majority of revenues come from the base. But obviously -- and we could, I think, grow very nicely for a few years just by selling to the base. Now obviously, that is not our strategy, and that's not what we're doing. We know that high-quality logos are going to be critical for us to fuel the future opportunities. So all of our reps have quotas that they have to hit to bring in new logos every quarter. That will -- and it's not just any new logos. Again, we made a decision a few years ago to go upmarket to larger enterprises. And we are primarily focused on companies with more than 1,000 employees. And just to remind everyone, we price our offerings based on the number of users with access to data, which typically is the number of employees within the organization. So it is seat or headcount-based. But we also -- larger companies like that have larger budgets, more flexibility around their OpEx spend for subscription software. It's also a company to that size that typically have a CISO in place, and that's really who we're targeting in selling motion. So that's very critical as well. So it's going to be very important for us to continue to bring in those new logos every single quarter. And that's what we've been seeing. It's just a continuation of that. So we would expect a nice balance between new customers and existing customers contributing to strong ARR growth that we've seen and expect to continue to see.

As for the kind of broader, more secular trends, it's nothing I would think surprising for this audience. But we're seeing increased adoption of cloud platforms like 365, G Drive, Box, AWS and S3, Salesforce and GitHub. And all of those SaaS platforms are built for collaboration. They're built to connect users inside and outside of the organizations to a variety of data sets and enable the collaboration that makes that data more valuable. That's the antithesis of security though, because it makes it very hard to ensure that the right people have access to the right data. And all of these SaaS platforms have configuration options that are changing constantly as new features and functionality are deployed instantly, which makes them difficult to manage and can lead to a misconfiguration that can lead to a disaster. Just look up the Salesforce community potential breach where Salesforce communities can lead to -- a misconfiguration there could lead to access by an attacker to private data. And all these applications are designed to connect together through APIs, which is just another vector for attackers to move laterally between applications. And all of that is not to say that on-premises data isn't going away. In fact, we're seeing file systems that sit on file servers, and NAS platforms continue to grow. Data is growing. The collaboration needs are growing. The velocity of that data is growing. And all of this speaks to an organization's ability to create and collaborate with this data being far greater than their ability to protect it, which is exactly what we help with. And then you add on top of all of these regulations that actually have teeth these days and the threat environment that's taking advantage of all this complexity, the need for Varonis is bigger than it's ever been before.

Got it. Okay. In terms of feeding the demand engine, you've been growing overall head count in, call it, the double digits so far in calendar '21 and 21% in calendar 3Q relative to, call it, high single digits, low double digits historically. How should we think about the pace of investment going forward and really just the philosophy that Varonis has or investments relative to the business growth?

Yes. It's a good question. I think some context is important because, obviously, we've been hiring pretty rapidly this year. We added 99 net new employees in Q3. We've added 250 so far this year. And again, as of the end of Q3, our total employee count was a little under 2,000. So in the last, call it, 5 or 6 quarters, we've grown very, very rapidly. And I think that ties to how we feel about the business and the opportunity. And so if you go back a little bit before that time frame to sort of Q1, we talked at the beginning about COVID and sort of how that was a big headwind for us initially. And at that time, I think it was appropriate for us to be a bit more defensive. And so with the exception of a few key sales positions, we froze hiring across the organization. But I think as we saw business in the pipeline start to build in Q2, business resumed. And then that really picked up in Q3. You saw our hiring, I think, pick up sort of in the same line. And that's really -- that momentum has obviously continued this year. And so I think we've always tried to tie our expense levels to the revenues that we plan to achieve. I think we are investing right now across the business, across departments, across geographies to really capture the opportunity that we see. And we started by talking about some of the growth levers around that we can pull for new logo acquisitions, selling into the base and innovation. I think our investments really match that. We are -- the headcount numbers that we talked about are, I would say, primarily split between sales and marketing and R&D. But just -- it's really about supporting capacity and innovation. And I don't think -- again, that's sort of across the board. I think the problems that we are helping solve are not limited to one region of the world or one vertical or one company size. They are really global in nature. And while the bulk of the opportunity today, I think, for us continues to be in North America and Europe, we still feel very good about Rest of World as a long-term opportunity. There's a lot more for us to do to sort of take advantage of the greenfield opportunity that we see sell into the base. And so that really will require, I think, us to continue growing headcount thoughtfully but aggressively. And the one other thing to keep in mind for us, I'm sure we'll talk about competition or our lack thereof. One of the few downsides of not having competition is we don't necessarily have sales reps that we can hire from a true competitor and get them productively selling right away. It takes us time to get reps fully productive in mature territories. And that number -- that time frame has come down significantly over the last couple of years. A few years ago, it was around 18 months. Today, it's really 9 to 12 months, but it still takes time. And because it is a unique sale and a platform and our reps really need to be able to convey to customers how we're different and complementary to other players in the security ecosystem. And so that does take time for us to do. So we are mindful of that as we continue to build up the sales force. But I think our investment levels, we would expect those to sort of continue and reflect the opportunity that we see.

Got it. Okay. Maybe shifting to DatAdvantage Cloud. You purchased Polyrize about a year ago. You launched DA Cloud earlier this year based on that technology, investing a lot in that product. Can you just talk about, one, what that technology brings not only in the form of more data stores in the cloud but also additional functionality around role-based analytics and SaaS access?

Sure. So as you mentioned, we acquired Polyrize last year. And we took the core of that technology and kind of made it Varonis ready and launched it as a set of licenses that support SaaS applications and data stores earlier this year. These are data stores and applications that our customers have been asking for support from Varonis for a while. Some of these are file stores that behave a lot like OneDrive, G Drive and Box being the primary examples there as well as applications that store a huge amount of data, Salesforce for customer information, GitHub for source code, collaboration platforms like Slack and Zoom, Okta for application access, infrastructure and data in AWS and S3. So DatAdvantage Cloud dramatically broadened our support for new data stores and applications. And the problems that organizations face are similar and very closely related but not identical to the problems that they face on premises. All of these applications and data stores are, by their nature, built for collaboration. They're built to connect users and applications to data and to each other. That makes them very hard to secure. Where do I have sensitive data in places that I don't expect, accessible to people who don't need it? And DatAdvantage Cloud, much like Varonis enterprise, match the relationships between users and data. That's an even harder job to do when we talk about a variety of SaaS applications since it's not like there's just one active directory that's controlling access to data. There is directory stores in each of these applications. And you have to connect those identities together, map all of the associated entitlements and then connect those to the data and other resources within these data stores and applications. And that's exactly what DatAdvantage Cloud does. It also monitors behavior, alerts on misbehavior like configuration changes or unreasonable data access and possible travel. And one of the things that's very difficult to do is to manage the variety of configurations within all of these applications that could lead to a potential data breach and the API connections between them. Those are 2 other important differences between SaaS data stores and applications and on-premises applications and data stores because all of these applications, when they're built for collaboration, are also built with APIs in place. So we help identify and manage misconfigurations. We also can help identify and manage lateral movement between applications because that's how you move laterally in the cloud. You move application to application. You go from Okta to Salesforce to Slack to Zoom to GitHub and then you actually trade data and [ lead back tours ] behind. So DatAdvantage Cloud helps manage all of that in a unique way. It's completely additive to the set of Varonis enterprise licenses on premises and in Microsoft 365. All of our customers have some or all of these SaaS applications for the most part. The demand is there. And from a business standpoint, it gets us in front of customers that were born in the cloud is the right way to think about it, that don't have any on-premises data and maybe aren't using the 365 data stores. So we didn't have much to talk to them about before and now we do. So the reception has been fantastic. And we've started extending the core of the Polyrize technology with the Varonis enterprise platform. The right way to think about that is we added Data Classification Cloud later after our launch. And that adds our classification engine and rule set, which is maybe the most mature in the enterprise security space, to G Drive and Box. So now you can use the same rule set and the same engine to find sensitive data on-premises and OneDrive and SharePoint Online and G Drive or in Box, which means that our customers have a really powerful single pane of glass to see what's going on.

Perfect. Perfect. Okay. But then the context, I mean, we really talked about competition a couple of times. Maybe to hit it directly on, you've always -- Varonis has always been vocal about the idea that there really isn't another competitor in data security that does what you do on the enterprise scale. And I'm curious if you could just, one, remind us what that competitive run-in rate looks like. But then as you expand into DA Cloud and add functionality, that starts to look maybe more like a CASB or identity governance. How are you thinking about competition as the platform gets a little bit broader?

Two really, really good questions. So just to remind everybody, we look at competition or any potentially competitive scenario in every single deal. We look at it very, very closely. We're a very data-driven company. And what we see is there is some sort of perceived competition in about 1 out of every 20 of the deals that we do, whether it's a new prospect, a new deal or an upsell deal. And that's about 5%. And that's been pretty steady over the last few years. And anybody who's talked to us and asked us that question has heard that answer. And it remains true. When we do see any competition, it's generally -- it's always among a galaxy of different either point tools, adjacent technologies or manual methods, manual kind of approaches to doing things, none of which are effective at reaching the same outcomes. There is no other technology. There's no other product. There's no other vendor that does what we do in the way that we do it that can help our customers and can help you really reach a state of making sure that data is locked down to just who needs it and that you're not just gathering logs but that you're enriching data access behavior with context about -- like with classification, device usage, geolocation and have a picture of how data is being accessed both on premises and in all these cloud repositories. That remains true, let alone the automation to reduce access safely. Now -- and that remains true. Now when I say point tools, I'm talking about active directory reporting tools or configuration reporting tools on single data stores, which don't get you even close to reaching these outcomes. They frankly won't work. Or adjacent technologies like DLP or SIM or endpoint or firewalls. Those are all potentially valuable but, again, don't solve the same problems and can't get you to those outcomes. They can't solve the business problems of, "I have no idea we're at risk and I have no idea how to fix those problems. And I need to reduce the time to detection to data access." Because if you have data and somebody wants it, then only Varonis is what's actually looking at the data access. So that was true last year. It's true today. You asked very specifically about DatAdvantage Cloud. The only difference there is that now we are in situations where we're up against perceived competition with different categories of products. You mentioned CASB. That's basically DLP for the cloud. It, again, can't reach the same outcomes because CASB doesn't map the entitlements. It doesn't look at what this Brian Vecci account, which exists in multiple different places, it doesn't connect those together and then map those down to what does Brian Vecci actually have access to in all these G Drive files and folders, in all of these Box files and folders, in all of these Salesforce accounts and opportunities and cases and records, in all of these GitHub repositories and the specific sensitive data that I have access to. CASB can't do that nor can cloud security posture management or configuration management. Those are certainly potentially useful tools, but they don't solve the same problems. So we're still not seeing any credible competition for DatAdvantage Cloud, let alone the broader offering that Varonis provides, whether your data is on premises, in 365, in G Drive, Box, Salesforce, GitHub, AWS, the applications in Okta, the collaboration going on in Zoom and Slack. The ability to connect all of those identities, entitlements, data importance and classification and behavior together, we're unique. Nobody else can do this.

Very clear. Very clear. So Jamie, I mean, it sounds like the demand for DA Cloud is there. You've talked about it not having a material impact on 3Q and nothing really included in the 4Q guide. But can you just talk about how we should expect to see that show up in the numbers? And maybe draw up the distinction that this is true SaaS ratable revenue and you're more -- I think it would be right to think that you'd be more likely to show ARR before you saw it in revenue. Is that the right way to think about it?

That's exactly right. And it's an important point. So yes, this is a SaaS technology that we acquired and that is what DA Cloud is. And as a result, yes, all of that revenue will be recognized fully ratably, which is a contrast to everything we currently sell and previously be selling, where about 80% of the contract value for the year is recognized upfront. That's a license component and then the other kind of 20% or so is the maintenance component and is recognized ratably versus all of DA Cloud will be recognized ratably. So I think the contribution from a DA Cloud contract, from a revenue standpoint, especially if you assume it's going to be closed late in the quarter, will be almost -- it will be very minimal, but it should show up a lot more in ARR. And I think this is part of the reason why we talked about introducing guidance for ARR beginning next year because right now, what we've seen is as the subscription transition is complete and the sort of the subscription mix from a comp standpoint is normalized, we're seeing revenue growth and ARR growth track very closely together. So there's still a little bit of a delta between the 2. So for Q3, ARR grew 36% year-over-year. Revenues grew 31% year-over-year. But if you look at our recurring revenues on a trailing 12-month basis, and basically all of our revenues today are recurring, you'll see that, that's growing exactly in line with ARR, both were 36% in this latest quarter. So as DA Cloud in turn becomes more material and more of a financial contribution, which again is probably more of a 2022 event, it will show up more in ARR. And I think while we haven't sort of said exactly what level of breakdown we'll be providing, we will certainly give plenty of color every single quarter in terms of what we're seeing from a contribution standpoint. So yes, there was nothing in Q3 from DA Cloud. Our Q4 revenue guidance doesn't assume anything material. But beginning next year, we will start guiding to ARR and, I think, trying to give more color as to what we're seeing there from that specific standpoint.

Got it. And then maybe on the gross margin side of things, recognizing that the revenue is not quite there yet for DA Cloud but thinking through the broader gross margin for a SaaS product relative to a licensed product and recognizing that infrastructure build there is not always linear, how should we think about that impact to gross margins going forward?

It's a sort of thing, I think, we'll be able to give a lot more color on as that becomes -- as something we're selling and we have a sense of kind of what the impact is. I think we're probably a little hesitant to give that now when we really don't see much of a contribution. But obviously, yes, true SaaS companies probably have a lower gross margin than our high 80% gross margins or where we are today. So there, I think we're anticipating that there would be some impact. But right now, it's tough for us to sort of exactly quantify what that is. So I think you can expect us to give more color on that next year as we start selling more of that product.

Sure. Fair enough. Maybe the last question for me. As we think about leverage in the model, I mean, clearly, as you work through the transition, a lot of that was suppressed by the lower top line growth. But historically, Varonis has been pretty prudent in how they manage operational costs and show leverage. How should we think about margins going into calendar '20? And I guess, embedded in that question is I know you typically hedge around this time of the year for the coming year. Just wondering if you could talk about the exposure to the shekel and the rates you've locked in for calendar '22.

Sure. So yes, some really good questions there. I think from a larger margin standpoint, we, as a company, I think, have shown very healthy margin expansion over the years. If you go back prior to the transition, there was a few hundred basis points of margin expansion per year through 2018. Obviously, in 2019, there was a massive impact to top line growth, which slowed down to operating margins. But then in 2020, with a lot of the transition largely complete, we saw sort of a return, and the operating margin for last year was negative 1.5%. We've now guided to about 600 basis points of expansion for full year 2021. I think the philosophy of the company has always been to continue or to balance investing for growth with profitability. We want to make sure that we are not leaving anything on the table. But we also believe, obviously, that companies should be profitable for investors and be generating cash. And I think we're starting to see a lot of that -- the benefit of the model transition show up in the numbers. Obviously, the cost of renewals are far less than acquiring new revenue or selling -- upselling to the base. And I think as we layer on more and more renewals, you'll see more leverage in the sales and marketing line. At the same time, as sort of market awareness continues to grow and the market comes more to us, we would expect that to continue as well. But we also -- we need to make sure, and we've talked a lot about this today and over the last few quarters, the opportunity that we see, we really think, mandates the investments that we are making. We want to make sure that we are not leaving anything on the table. And we will continue investing across the company, which is across geographies and departments to make sure that we're doing that. As for hedging, yes, it's a good question. And we obviously monitor foreign currencies very closely because of our exposure to the shekel and, specifically, our R&D investments and expenses in Israel. So we've locked or entered into those forward contracts for those hedging positions for 2022. Obviously, there's been a lot of volatility in currencies. And in retrospect, we're the best rates that we could get for next year. But they will result in a 200 basis point margin headwind in 2022 compared to this year. Just to remind you, we had 100 basis points of tailwind for 2021 to our operating margins as we took advantage of some COVID-related volatility early last year to secure favorable rates. So as you can see, sometimes these are headwinds, sometimes tailwinds. We try and minimize the volatility through our hedging program. But I think overall, the key takeaway is that our focus is on margin improvements where we have control and sort of optimizing those. So that's what we've done from a hedging standpoint for next year.

Terrific. Well, we're just about up at time. I want to thank you both, Brian and Jamie, for a great session, been a lot of fun. And I hope everyone has a great rest of the day.

Thanks, Roger. We appreciate it. Thank you, everyone.

Thank you so much.