Varonis Systems, Inc. (VRNS) Earnings Call Transcript & Summary

Well, hey, good afternoon, everyone. Welcome to the home stretch actually of day 2 at the Barclays TMT Conference. My name is Saket Kalia. I cover SMID Cap Software here. Honored to have the team here from Varonis. We've got Guy Melamed, Chief Financial Officer as well as Chief Operating Officer; and we've got Brian Vecci, Field CTO. So we've got about 30 minutes together. Let's maybe take the first 20 or 25 minutes to do some fireside chat with the team, which I know is going to be fun. And then we'd love to make this interactive. [Operator Instructions] So maybe with all that as a framework, Guy, Brian, thanks so much for being with us here today.

Thanks.

Yes, it wouldn't be a conference without you folks. Guy, maybe just to start. Can you just level set for us what were some of the key points that you wanted to make sure investors took away from Q3 earnings from a financial perspective?

There was a lot going on in our Q3 earnings call. I think we packed into one earning call material that was worth 3 or 4 earnings calls. When you think about kind of the macro environment, we basically saw the European macroeconomic situation deteriorate. And we assume that, that continues in Q4 and even actually worsens throughout the quarter. We also assume that there will be spillover from the European business -- from the European macroeconomic conditions into the U.S. We didn't see any of the KPIs indicating that but I think it's unreasonable to assume that there won't be any spillover into the U.S., especially when 50% of your business closes in the last 2 weeks of the quarter. So we basically derisked Q4. On the same front, we introduced a new SaaS offering and that new SaaS offering, which has tremendous benefits to our customers, and we can talk more about that. We actually decided to give some color on of 2023. So apart from kind of assuming that the macroeconomic conditions in Europe have a larger impact in 2023, an additional 2 quarters versus the 2022 year and the fact that the macroeconomics spillover into the U.S. for kind of the full 2023 year. We also baked in uncertainty and ramp-up time with our reps kind of for the first 6 months of the year, not because we think that they won't receive the SaaS offering in a positive way. But that's just what we saw when we introduced the change from perpetual to on-prem subscription. So every time you introduce a new change in model and you introduce a new comp plan, and there will be a new comp plan in January of 2023, there is some friction that takes place with your sales force until they fully adopt kind of the change, we wanted to bake everything in. So we assume that a lot of things could go wrong, not necessarily all of them will go over. And that was the majority of the conversation in our last earnings call.

Yes, absolutely makes a lot of sense. And listen, I think you're not the only security company to be calling out the macro. And honestly, I think we all appreciate certain level of derisking as we look forward. So totally get it and appreciate it. Maybe we can start with the SaaS transition here first, Guy. I think we announced in the Q3 call that we're going to offer your flagship data security platform in both SaaS and on-prem form factors. So just tell us a little bit about why you decided to start that shift to SaaS and thinking about the benefits of our kind of going forward, what are some of the benefits you expect to see on the other end of this.

So we talked about investing more than $100 million over the last 2-plus years in our R&D department in order to develop this offering. So this has been in the works for quite some time. We started kind of piloting this with customers at the beginning of the year. And as the product was ready, we decided to kind of introduce it. We started kind of hearing from customers that they want to try it, and we felt that it was the right time to introduce it, the product is ready. And it has tremendous benefits to our customers. Brian can talk about kind of the technological aspect and the ease of use, but I want to kind of framework from my perspective. There are 3 major benefits for Varonis. And there's definitely a lot of benefits for the customer. But let's talk about the benefits of Varonis. Keeping one code, which is what we eventually want to do, we want to transition our customers' base into a SaaS offering. That will be Phase 2. Phase 1, we talked about starting selling SaaS to new customers. We'll start with the low end of our new customers and then kind of go to newer customers that are larger. Once we're done with that phase, we plan to convert our existing customers. The maintenance of perpetual will be first and then the on-prem subscription customers into 1 code, 1 SaaS offering, which would generate significant benefits and leverage within the model. Because from an R&D perspective, they had to maintain 2 sets of code. There will be 1 of code eventually at the end of the day, which generates a lot of benefits for us. But there are additional benefits. The other benefit that we see is that the expectation that renewal rates will pick up even further than what they are today. They've been consistently over 90% with the on-prem subscription. But with this offering, there are -- it's a better product, better ease of use, that will help us generate a higher renewal rate. And on top of that, I'd say the third element is that the risk assessment that it's not heavy lifting today. It's not like it's problematic in any way. And I don't want anyone to feel like with ditching and bad mouthing our on-prem subscription offering because we're not, but the SaaS offering is better. And when the sales cycles are expected to come down because of the ease of use and the fact that customers don't need to bring hardware into the mix, we do everything on our end, so it kind of eliminates a lot of the objections that we got from customers as we introduce that. So that's kind of the benefit from our side. There's a lot of benefits from the customer side.

Yes, absolutely. A lot to chew on there. I think that's really interesting. But Brian, maybe for you, just to touch on the product perspective. I mean if we think about the shift to SaaS from a product perspective, are there any technical differences between the SaaS and on-prem offerings? And if so, what benefits or enhancements could customers see -- so the opposite side of the question, right? Like what's the benefit that the customer could see by going a SaaS?

There's a bunch of them. First of all, as Guy said a couple of times, it's a better product. It's easier to use. There's already automation in the SaaS offering that doesn't exist on premises. So -- and it's easier to deploy, it's easier for a customer to support. They don't have hardware to worry about. We can be proactive with support. It's also easier for us to deliver new features. We can innovate much more quickly, put all that together, it's a much better product for our customers.

Yes, absolutely. Guy, maybe now to ask about the transition from a financial perspective. I mean, a very successful transition to a term subscription model a couple of years ago now. So I would argue the team is no stranger to some of the revenue and margin mechanics of a transition, but can you just remind us of some of those transition mechanics and impacts that we could see to the income statement through this transition, which may be -- which will be a little different than the term subscription transition.

Yes. So the one thing we talked a lot about, and you've heard us say this over the last couple of quarters is that ARR should become the leading metric for the company. And we talked about 2023, kind of the 2 north stars for us and we'll indicate on the strength of the business going through the transition, our ARR and free cash flow. And we guided the free cash flow being positive $20 million to $25 million, and that's an improvement versus what we expect to have in 2022, but it's an indication because the quicker you transition and the higher your SaaS mix, because of accounting treatment, you'll have a headwind on the revenue side and obviously on the operating income side. Free cash flow is the same thing because the collection of deals for both on-prem and SaaS are the same annually in advance. And that's why we wanted to make sure that investors understand how critical we see our operating margin improvement, putting everything equal, not moving to SaaS and our commitment to not just growing the business, but bringing some of it to the bottom line, you won't see it in the regular "metrics" because of the SaaS transition, but you will see it through the free cash flow. And that's why we gave that number out. ARR, obviously, doesn't have that revenue accounting treatment, right, that has the difference between SaaS and on-prem subscription. And that's why those 2 North Stars are ARR and free cash.

That's really how we should be kind of thinking about gauging the health of the business, right, through this transitory time makes a ton of sense. Guy, maybe if we could talk about -- a little bit about the economics of the SaaS license, right? So certainly some financial benefits on the statements, right? But I guess if you look at the new SaaS products from a pricing perspective, and understanding it's still early, what kind of uplift could we see by selling SaaS as opposed to an on-prem license. Because again, you guys are going to be bearing the hosting cost. So of course, there's going to be additional value that you would extract from that as well. What kind of value -- additional value can you see?

So apples-to-apples, selling the same number of licenses on-prem versus SaaS there is a 25%, 30% uplift on the SaaS offering. The total cost of ownership for the customer will actually be lower for them. So they don't have to host and they need less people to manage the product, which is a big deal that can -- is part of the benefits that customers will see with the SaaS offering and the automation that it provides in the alerting capabilities. So apples-to-apples is a 25%, 30% uplift. However, one of the things that we have noticed this year is just the bundling that is really working on-prem. So we introduced that at the beginning of the year. We have the gold, silver and platinum bundles that simplifies a lot of SKUs into 1 SKU, but it also benefits the conversation with the customer. So you don't have to start talking about every application within the platform, you're talking about the platform as a whole. And because it's been so well received by both customers and our sales force. One of the things that we plan to do from a SaaS perspective is double down on that. We don't want to start talking about every single line item. We want to make sure that the bundles will provide that simplicity as part of the selling process. And that's part of our new initiatives for 2023.

Yes, absolutely. Maybe remove some friction, right, from the process through the -- Brian, maybe for you from a product perspective. I don't want you to preannounce anything over here, but just what's generally available out there, which products are available in the SaaS form factor? And how do they -- maybe it's early to gauge is, but how did it compare in terms of feature parity with the on-prem tools, which I think some of your on-prem customers are maybe going to compare one versus the other. I'm curious what you think about it.

So it's important to note there will be feature parity to time next year, relatively early next year. And there are features, as I mentioned, in the SaaS product, automation for Microsoft 365 doesn't exist on-prem. It does exist in the SaaS product. That's one of the reasons it's already more valuable to a lot of customers. There are -- we feel like for 80%, 85% of our customers, it's ready right now. It's got everything that they need. There are some things that will be coming in the first quarter, first half of next year to make it fully -- kind of feature complete with the on-premises offering. Besides features and functionality, there's also a value that we can offer in SaaS that we couldn't offer on-prem. For instance, now that we're hosting everybody's instance of Varonis, we see things like alerts and threats and risks among a wide variety of customers that we can correlate together. And we've had an incident response team now for the last 2 years, which has helped to make sure that our customers are getting the most value out of Varonis and they're not seeing any noise. And when they need help investigating something, they've got an extra set of hands. Now we can be proactive about incident response and call you up and say, you know what, it looks like there might be a ransomware issue or it looks like you might have an insider threat. Let's help you which reduces the time to detection and time resolution for any potential threat, which makes Varonis a lot more valuable.

Yes, absolutely, for sure. Guy, what are we assuming for SaaS mix next year? And again, I know we're still in the very early innings of this. But how are you thinking about -- I think one of the things that worked really well during the Varonis' last subscription transition was really incentivizing the sales force to really lead with subscription. To the extent that you can, how are you thinking about maybe some of those dials that you can turn in '23?

So we talked in the last earnings call about kind of the expectation to move within 4 to 6 years. And let's define what transitioning is first because different companies think about it differently. Our way of thinking about transitioning the business to SaaS is that we will complete the transition when anywhere between 70% to 90% of our ARR would be under SaaS. And that talks about the 1 code and the leverage in some of the different departments that aren't just the sales and marketing, which should see some leverage in itself, but it's the R&D and the professional services and the customer success, all of those would be kind of under 1 platform. So completing a transition means that we would start with new customers. I talked about that the lower end, then you go to the higher end and then you start converting your customers, and there are ways to do that. And we've always been very focused on doing what's right for the customer. The on-prem subscription transition came from our customers' desire to consume more of the platform. It obviously made a lot of sense financially, and that's why we did it, but it was a win-win in that sense. This SaaS transition won't be any different. We want to win with our customers because it's a better product. So we will work with our existing customers to make sure that they see the value in moving to SaaS. So you're right, the commission plan has to fit exactly what the company is trying to achieve. So in 2023, one of our plans, and we've been working a lot about tweaking the comp plan in preparation for 2023. It's been in the works for more than 6 months now. And it's very similar to the way we thought about the comp plan when we transition from perpetual to on-prem. In that thought process, we want to incentivize the reps to sell to new customers, SaaS. We won't necessarily incentivize them to convert customers not quite yet because that's kind of the second phase, right? But at least in the first phase, we want to align the comp plan to what we want to achieve from a company's perspective. And we've worked very hard in trying to set it in the right way. So when you think about the transition, I think there are 3 pillars that a company needs in order to successfully transition. Pillar #1 is the technology. When you think about kind of the technological advantages that were in selling on-prem subscription, they're just as much in SaaS, if not more. So pillar #1 is in a way a no-brainer. Pillar #2 is the commission. You have to make sure that it's properly aligned in order to make sure that what you want to achieve from a technological perspective is aligned with your sales force because sales force won't change behavior unless they are incentivized to do so. And that's pretty obvious for all of us. So we have that second pillar, I think, in place. And then the third pillar is management commitment to the transition, and we are very much committed to doing this in the right way. I think the first transition gives us a lot of experience on what needs to happen as part of that process. I think we're ready and kind of very excited to kick this off at the beginning of next year.

Yes, yes, as a [ rim. ] Brian, maybe just to make sure we cover this because I want to continue going on with the transition because I think it's so structural to the story. But Brian, maybe just to make sure we touch on some of the fundamental stuff as well. I was wondering if you could just give us an update just on the competitive environment? And how -- if at all, if that's changed at all over the past year or 2?

Generally, it hasn't changed. Remember, the way we think about competition is, first of all, there's nobody that does what we do everywhere that we do it. There's nobody that combines classification with activity in threat monitoring with an analysis of access and permissions that you know and can fix where you're at risk in all the places that we do it. So when we compete, it's with point tools or with adjacent solutions that do a piece of what we do in certain places. That hasn't changed at all. Now we have a technical mote around us. We're more than a decade in front of anybody who'd like to compete with us. The transition to SaaS will affect that and that now we can accelerate that moat. There is -- we put more into the SaaS product from an innovation standpoint in the last 4 months than we've been able to do in the last year with our on-premises product because when you have an on-premises product, you've got 5,000 different environments that you have to QA everything in. And everybody can only upgrade once maybe twice a year. And it's a lot more complicated. Now when we want to push the benefits of new threat models or new features and functionality or improvements to the interface, we make the change once and everybody gets it. And we can add more automation on the back end. So our technical moat is going to accelerate. So from a competitive standpoint, now not only can we offer a SaaS product that really none of our competitors can, now we're going to be able to accelerate even faster.

Yes, absolutely. And you know what, it's just -- I think customers are increasingly getting comfortable with getting security itself to...

Sure. Everybody want to buy it as well...

So it's the timing. Timing makes a ton of sense. Guy, maybe back to you. You gave some very helpful assumptions for 2023 on the last call, by the way, we really appreciate it, right, just given the uncertainty around the macro. I think the assumption is 5% SaaS mix, but -- right, which I think is important. But what other assumptions did you make in 2023 that we used the word derisked early, which I think is a very important one, right? But I think we're talking about 10% to 12% ARR growth. Why do you feel like that's derisk? What are the assumptions that go in there that make you feel like that we've derisked to guide a decent bet.

When you look at our growth rates, in the last couple of years and you look at kind of the adjustment we made in 2023, that bakes in, a lot of things that could go wrong, whether it's the macroeconomic deterioration in Europe, spillover into the U.S. and the ramp-up time with the introduction of the new SaaS offering. So when you kind of bundle everything together, there really are a lot of things that could go wrong. I don't know if we're going to have the same friction with our sales force as we had when we introduced the move to on-prem subscription. I don't know. But I had to make some assumptions, and we had to take what we know happen into effect and into account as part of our 2023 numbers. Well, obviously, we promised to update our analysts and investors as we go through this transition. We talked about 5% mix in the first 6 months. So 5% out of net new ARR that will be in the first 6 months. We didn't even give the full number yet, because it's too early, and we don't really know. We'll update as we move through this, and we'll give additional KPIs and additional color at the beginning of next year after we announce kind of the quarterly results. we want to provide as much visibility as possible, and we've been very transparent in the previous transition and the expectation and intention is to do the same in this one.

Yes, makes sense a ton of sense. Guy, obviously, with the macro, one of the other kind of moving targets here, if you will, has been foreign exchange, right? And so I'd love to just maybe touch on FX a little bit since Varonis -- I believe, prices in local currencies. We've all seen the strength of the dollar. Can you just maybe walk us through the impact FX has had on ARR this year. And maybe also adjusted for FX, I mean, how is ARR growth sort of trended over the last few quarters, because it does have an impact.

It definitely has an impact. So when you think about the headwind that it's generated in 2022, it's been pretty significant. We -- as you mentioned, we invoice in local currency. So pound and euro, you would sell kind of the same local currency amount and U.S. dollar strengthened by 20% year-over-year. So your U.S. dollar that you're generating is down significantly. Now foreign currency is all over the place. And the volatility is crazy. So it's moved in the last kind of 2 weeks slightly in the other direction. So there's a lot of moving parts, and we tried to signal kind of the growth of the business versus the impact on local -- on foreign currency as a whole. The -- in 2022, the overall impact has been about $10 million to $15 million headwind on the ARR side. And when we guided at the end of Q3, the pound and the euro were very close to 52 week low, if not a 20-year lows in the pound. And we assumed for kind of the rest of the year and 2023 those rates. It's mark-to-market every time that renewal comes into effect. So it makes that adjustment. And obviously, that's not in our control. We focus on the business it moves in one direction, sometimes and in another direction and the others, all we need to do is make sure that the execution happens the way we want it to, and currency is kind of a side effect.

Yes. No, makes a ton of sense. Brian, I want to come back to you for a second just on the product market question. You spent a lot of time with customers, I know that. I'm curious, how do you think about the choice that customers might have to consider, right, when you've got an on-prem product as well as a similar form factor in SaaS. Is that -- is there a risk that that's confusing at all for them to see two form factors? Or is the value difference between the two, just so apparent, there's going to be a there's going to be a market for SaaS and there's going to be a market for on-prem. Talk to us a little bit about that decision point.

I think enterprises want to consume SaaS technology, whether it's security or in any other segment. Given the choice, apples-to-apples, and we saw this when we launched the SaaS product a few months ago, it's almost 10 out of 10, 9 out of 10 that they would prefer SaaS. The only reason they would go with on-premise that they have very specific reason to. Like I -- we, as a company, for whatever reason, do not want to consume SaaS technology, which is increasingly rare. And then you add in the fact that it's a better product. I'm not concerned at all. Given the choice, customers will choose SaaS and they have been so far.

Yes. No, that makes sense. Guy, I had to come back to FX, but just maybe there's such a talented team out in Israel, right? So FX matters from an FX perspective as well. I think your hedging strategy with shekel has been helpful in prior years. Can you just give us a sense for how you're thinking about just movements in the shekel from just an expense perspective in 2023?

So you're right. In Israel, we have a very good team, mostly R&D, but we also have support and back office there, and we've been hedging the shekel against the dollar. We actually closed our hedging for 2023. There's no material change in terms of the operating margin headwind or tailwind. So it's pretty much similar to the overall rates that we've had last year, which is what a hedging program is supposed to do. So after we had very good 2 years where we were able to close -- very close to the highest rate possible we did the hedging program for 2023 and no major change there.

Got it. Got it. Maybe just in the last few minutes that we've got here, right, just to elevate the financial discussion a little bit with you, Guy. I think -- and this is before the macro as well. I think over the years, you've been very consistent and just the approach of balancing growth and profitability. It was never growth at any cost. And so I'm wondering, right, maybe the north stars in this transition are going to be different as we said earlier. But can you just walk us through how you're going to manage that balance how you're thinking about maybe ARR growth, margins, free cash flow -- however you want to think about it. How do you think about that balance as we start this transition?

We are not a low teens growth type company in the long term and kind of the reduction that we have done for 2023 embeds a lot of macroeconomic uncertainty and the introduction of a new offering. But as we exit both of those, and no one knows when the macro will change. But I think longer term, we don't see ourselves as low teens type growth company. It's become very trendy to talk about operating margin and the importance of that, but we've been talking about that for years. And the balance of top line growth with operating margin improvement and generation of cash has been in the forefront of our business for many, many years. So that doesn't change. We haven't changed our philosophy. I think the free cash flow guidance for 2023 is an indication to investors and analysts of how important we see that element of the business. And why even with the investments that we plan to make in the initiation of the transition, we're still trying to improve the bottom line in terms of free cash flow because the operating margin is going to be all over the place with the percentage of SaaS moving. So we've always tried to balance the expense level to the top line that we plan to generate, and we make adjustments when needed. When COVID hit at the beginning of 2020, we made adjustments. We were much more conservative defensive because in March, and beginning of April, no one knew what was going on. So we went on the defensive side from an expense perspective. But then very quickly, we realized what was going on from a pipeline perspective and started significantly increasing and making relevant investments that we believe can do very well for the company in the longer term. Part of it was the acquisition of Polyrize at the end of 2020. So I think we have that flexibility in making the adjustments from the expense side to fit the level of top line expected growth. Q4 guidance is a clear indication. We were able to cut about $7 million on the expense side to match on top of kind of matching the revenue side and making that adjustment. So it was a clear indication to everyone that we don't just talk the talk, we walk the walk in terms of the expense. But you also don't want to give up the long-term opportunity. And we don't believe that under a recessionary period, you need to stop investing completely. You need to continue the investments because companies can benefit, recessions don't last forever. We definitely feel that the opportunity that we have ahead is significant, and we want to take advantage of it.

Yes, absolutely. Brian, maybe a question for you. I mean, I think maybe just assuming a type of question as well. I mean I think a lot of security vendors have talked about maybe a little bit more resilience in security budgets kind of through the software macroeconomic patch. Again, you spent a lot of time with customers. I'm curious what your customers have said about the defensiveness of their spending here and whether the mission criticality of data security and classification tools has changed at all?

If anything, so I agree with your -- the first part of your statement that security spending has been resilient. People -- even they've got to cut somewhere. It's not going to be security, especially today, that you can't. And the object of every security initiative is to protect data as nobody breaks into Barclays still depends they're after money, bank robbers after money. If somebody is getting access to a device, to a network, on-premises or in your cloud, they're after data, and that's what does damage. That's the real business asset, and that's what we protect. So far, what I've seen is data security spends are staying right where they need to be.

Yes. Got it. Last question here maybe for you, Guy. I mean just given the topic of macro, one of the questions that we're trying to ask all of our coverage companies that are here at the conferences, how you define the business, ARR revenue, bookings, but whatever the case may be, roughly what percentage of your business comes from new logos. And Varonis has been around for a while. I mean, how has that new business historically performed -- new logo business performed in prior recessions?

So one of the things that we have done over the last couple of years is focus on new business at a larger size type company because the ROI that you get on doing a risk assessment with a company with 2,000 employees or 1,500 employees is much larger than doing a risk assessment with a company that is 500 employees, sure. So we've very much focused not just on generating business from new customers but doing it at the right size. The majority of our revenue, ARR -- let's talk about ARR because that's really the leading indicator. The majority of AR still comes from the base because we have such a large breakdown of companies in all industries and all sizes. But both from a commission perspective, we've been very focused. And from the reps perspective, we've been very focused on generating ARR from new customers. The mix is still kind of skewed towards majority coming from the base. But in order for them to achieve maximum commission, they have to bring ARR from new customers and for the majority of the reps, it's ARR from companies with more than 1,000 employees. And that's been the focus. And for 2023, we're actually going to be even more aggressive with our reps on that.

Makes sense. I've got so many more questions here from the Team, but unfortunately, that's about all the time that we've got. Guy, Brian, always a pleasure having you here at the conference. Thanks for making the time.

Thank you very much.

Thanks.