Varonis Systems, Inc. (VRNS) Earnings Call Transcript & Summary

Good morning, everybody. Thank you for being here for day 3 of the Morgan Stanley TMT Conference. My name is Hamza Fodderwala, I'm the cyber security analyst here at Morgan Stanley. And with me, I have the pleasure of having the team from Varonis. We have Brian Vecci, the Field CTO; as well as Tim Perz, the Head IR. And before I begin, just a brief programming note for important disclosures. Please see the Morgan Stanley Research Disclosure website at www.morganstanley.com/researchdisclosures. With that, Brian, Tim, thank you so much for being here this morning.

Thank you.

Thanks, Hamza.

And Guy, if you're listening. I hope you feel better.

Brian, I think I'll start with you before we kind of get into [indiscernible]. You hear a lot today from CIO, CISOs that cyber security is increasingly becoming a data problem or especially as you move to the cloud, the infrastructure layer gets more obfuscated. Talk a little bit about that trend and Varonis' positioning against that.

Our position from the beginning has always been the point of any security initiative, is to secure data. The infrastructure, the end points, the applications, they can be rebuilt, reconfigured, no problem. The data is still in, you can't get that back. That's the business asset. And that's always, always, always been our position. And it remains, so you made a really good point with more and more data applications moving to the cloud and collaborative stores. We're expected to work from anywhere. All these applications are connected together. The infrastructure becomes more and more obfuscated. There is no more perimeter to protect. What are we doing? We're protecting data. And that's exactly what Varonis does. And we do it in a unique way. I'm sure you're going to ask about competition at some point, and where and how we fit in the landscape. We're the only ones that look at data in the way that we do. We're the only ones that can automate protection in the way that we do. Because I think if you ask all of those same CISOs and CIOs, they'd all say they're stretched to them, I think, is maybe the most diplomatic way to say it. There's not enough time in people to do everything that you need to do from a security perspective. So automation becomes absolutely critical, especially when it comes to data because there's so much of it.

Got it. And to what extent do you feel like you're still evangelizing the market in many ways. Because it should be a bigger problem, but it seems like a lot of customers are still very much greenfield.

I think we don't necessarily have to evangelize the problem as much anymore. Everybody knows they've got data. Everybody knows that data is the target of every attack. Everybody knows the data is the target of every insider threat. But what we have to evangelize is, what we do, and how we do it, and the scale of the problems that we're trying to solve. You can't solve data problems at scale, especially in the cloud with endpoint protection or with bigger firewalls or with the [indiscernible] doesn't work. So what we're evangelizing is not necessarily the core problem of protecting data. What we're evangelizing is what you need to do in order to effectively fix it, if that makes some sense.

Got it. Got it. Tim, feel for your time in here. But -- so from a macro standpoint, the September quarter was considerably weaker than expected for Varonis. It seems like a lot of customers scrutinizing their budgets. EMEA was quite weak. And you would expect to see some spillover in the U.S. And I think for the most part, you did other vendors did as well. Just talk to us about has the demand environment started to stabilize? And how are you thinking about pipeline for the rest of the year as you talk to customers?

Yes. So just a little bit of background. So kind of third quarter is when we saw demand kind of soften in Europe. We kind of saw that spill over to North America in the fourth quarter. That was in line with our expectations with where we guided to. We haven't seen any meaningful changes kind of year-to-date so far. But structurally, we see data continuing to grow in more places and risk accumulating, which bodes well for us longer term, even if in the short term, we're seeing the macro environment kind of impact customer budgets.

Got it. Got it. And so do you think -- was Q4 a leg down versus what you saw in Q3?

Yes. I would say we saw more of a deceleration in 4Q, but that was as expected. And since then, we've kind of seen demand stabilize. We haven't seen it being much worse year-to-date. It's been similar to what we saw in 4Q.

So not much worth and not any better either though?

Yes. Exactly, exactly.

Okay, okay. Shifting gears towards the SaaS transition. This was kind of, I think, a bit of a sudden announcement, you guys came out with a new SaaS product and you announced that you're really going to put the metal -- put the pedal to the metal on gas -- SaaS, I guess.

We'll sorry, a long week.

So yes, on SaaS, so talk a little bit about why you decided to do that why maybe later relative to some of your peers? What was the thought process of announcing it when you did?

So 3 really good questions there. I take them in kind of reverse order. Why did we announce them when we did because that's when it was ready. It's 2 years, $100 million plus of development. The why, it took time to build. There was a lot of lessons that we needed to learn. We wanted to make sure that the market was ready for a SaaS version of Varonis. We started work on it and we've announced it when it was ready. So that kind of -- that's how we think about the timing of it. The why, I mean, ask any one of our customers now that's using it. It's -- there's so many benefits for both us and our customers. It's easier to deploy. It's easier to support. It's -- there's functionality there that doesn't exist in our on-premise offering like automation for Microsoft 365. We can offer proactive incident response at no additional cost, which I don't think any other vendor can do. The TCO is lower for our customers since they don't have to worry about database licensing and infrastructure costs. So you add all of that together, and it's a better product that delivers more value more quickly. And time to value is everything. So it's -- that's why we did it. And when we did it, as soon as we could, I'll put it that way.

Got it, got it. No, I mean we've been doing a lot of work on this space and cloud data security or I guess, what Gartner calls DSPM or whatever you want to call it, is definitely a growing priority within security budgets. But I think the problem with cloud relative to on-prem, just still most of Varonis the business today is sort of the scale and the dynamism of cloud data store. So how are you addressing that problem with this new SaaS product that you have, is it going to be harder to do? Are there any cost or compute implications with your product that we have to consider?

The answer to the last part of that is no. And it's also important to realize when we announce Varonis-as-a-SaaS. This is support for on-premises data stores and Microsoft 365, which we already supported, it's just delivering the platform as a SaaS. For the last few years, we've also supported and help to protect data in other SaaS platforms through what we call DatAdvantage Cloud, which is Salesforce and G-Drive and GitHub and Box and AWS S3 and Azure Blob and Zoom and Slack. So to your question is really speaking about how do you -- what are the challenges with protecting data in a world where everything is in the cloud and everything is connected together. And DSPM is a good example where it's very -- it's often very surface level. And it doesn't help you actually take action. Our challenge is helping our customers understand what they need to do from a debt perspective, what are they -- what's the depth of visibility that they need and how do you build automation on top of that to actually protect data. Our SaaS offering doesn't change the outcomes that we were selling. It just makes it easier to get to them, if that makes some sense.

Okay. From a pricing standpoint, is there any difference between that -- an on-prem product?

Yes. So on an apples-to-apples basis, it's 25% to 30% higher, which is justified by kind of all the additional benefits that we expect our customers to see, and also the TCO savings that Brian had mentioned. And one thing that we're changing with SaaS, we're only selling platform packages. So rather than buying 40 individual licenses. We're making it simpler. We're kind of doubling down on bundles like we did last year. And we're really trying to simplify the selling motion further as we move to SaaS.

And in terms of pricing, like what is it going to be based on? Is it more seat base? Are there going to be some consumption elements there as well?

Yes. So it's still based. You shouldn't think of any major changes to that. That's how we've always kind of priced our product. We do have some additional measures kind of built in for customers who might use the products more than we expect. So that way we kind of keep our margin structure in place.

Got it. So there's going to be some charges for overages if you're securing from more host than you expect?

Yes. But I would expect that to be a very small percentage of the customers.

And a lot of that is baked in when we do the risk assessment. One of the reasons that we do the risk assessment is to get a good sense of sizing and scale so that when we price a product -- when we price the platform for a given customer, they're not going to be surprised by any consumption charges.

Got it, got it. So I mean, Varonis has long been a leader in the data governance space on-prem. As you move to the cloud, they are a new competitive set these days, right? You've got the Wizards of the world that just came out with their DSPM product and a lot of the cloud workload security CNAPP vendors are coming into the space. Why do you think Varonis' positioning is differentiated relative to those people who are coming at it from the cloud side.

So 15 years of actually going in and securing large data sets, both on premises and 365. It's impossible to overstate the lessons learned from a technology and operationalization perspective, every customer environment is different. That's a massive differentiator for us. We rebuilt our platform as a SaaS to make it easier to deploy it, easier to deliver features and easier to add automation. But it's built on the 15 years of experience that we have we're the only ones that do the depth of visibility to not just classify data and map configurations to build a dashboard to actually look at where all these configurations and entitlements and permissions and sensitivity combines to put data at risk. And then build automation on top of it. One of the things a lot of CISOs will tell you these days, if you ask them, is any company can give you findings. But what do you to findings? It used to be alert fatigue, now it's finding fatigue. Like what action can I actually take with this DSPM dashboard. We're the only ones that will actually help you fix the problems that we find because we're the only ones that really understand where these configurations and these risks combined at the depth of every one of these platforms. The flip side of it is, we're not a SIM. We're not a CASB where we can just connect into everything. We need to build support for a platform. But when you think about on-premises data sets return the petabytes now, 365, which is just a massive problem. And then you add in the Salesforce and the S3 and the Azure Blobs of the world, that's where most of the risk is, and that's where we built our company. And only we can solve these problems in these ways. We are running up against, I would say, other adjacent technologies, but CASB is just DLP in the cloud. It's a lot of the same stuff with different names on it. And while those other vendors that you mentioned, do offer some value, they can't solve the same problems that we do, especially when you're in a hybrid environment, which most companies are.

Got it. I mean do you see any value in partnerships with those types of vendors?

Potentially, we're always looking at those kinds of things. But these days, the partnerships that we have, primarily with SIM vendors and then especially platform vendors like Microsoft, we feel like our kind of where we need to be. If there's an opportunity to partner with another vendor, because we can deliver value together that we couldn't deliver separately, we're happy to do it.

The other question I get, Brian, is just around Microsoft as a competitor. And I know it's a partner as well. They have a data governance, data protection offering purview. To what extent is that driving any changes in sort of competitive or pricing dynamics or perhaps slowing down the sales cycle even as customers look to consolidate their security tooling?

I don't think it's slowed down anything. And frankly, they don't really compete with us because they're doing Purviews a completely different set of things. And in fact, we have a lot of customers that have built a flat out. I couldn't have made Purview work without Varonis. It's because we're -- Purview doesn't do anything with the permissions and the access or the monitoring doesn't have any kind of automation that we provide. The automation that you can get with Purview Information Protection and the Microsoft tooling depends on files being properly tagged, which we do better than anybody else. And that's where the crux of our partnership with Microsoft is. We make Azure more valuable, so we see Microsoft as a partner. We want to be a force multiplier for all of the functionality that you get when your E3 or E5 or G5 or whatever level you are, we make all of that tooling and all that automation much more effective.

Got it. Shifting gears to maybe some of the financials. I want you to give away what you're going to say at Analyst Day in a couple of weeks. But I think -- so you're expecting SaaS to be about 15% of net new ARR in 2023 versus, I think, 5% for 2022. Why, I guess, such a low percentage of net new ARR when you do have that ASP uplift. And you are making this big push to have more and more net new business go to core towards the SaaS product.

Yes. So let me give you a little background on that. So we guided to a 5% mix of basically gross ACV, new business and net new upsell ARR for the first half of 2023 originally. We did 10% in the fourth quarter, and we guided to 15% for the first quarter and full year 2023. In terms of why such a low number, we're just getting started here. It's early in the year. We want to take a prudent approach with our guidance. Also, if you think about our sales cycle being 3 to 9 months upward to 12 months, all of the deals in our pipeline are a majority of our deals in the pipeline have started as on-prem subscription. So a lot of those are still closed as on-prem subscription. Obviously, we're going back to a lot of those deals asking if they want to do SaaS. But if we close a lot of those is on-prem subscription, we wouldn't expect to kind of start to close more SaaS deals as we move throughout the year, and we've kind of transitioned the pipeline over to SaaS. But from a transition perspective, we kind of expect the back half to be cleaner from like a sales cycle perspective.

Got it, got it. 25% to 30% ASP uplift when you move from the on-prem support base to SaaS. Typically, we hear uplift as high as 2 to 4x. So why only 25% to 30%?

I mean we're already a premium product, so we didn't want to make the product too expensive initially. And if you think about the pricing uplift versus kind of the maintenance customers, it is like a 2.5 to 3x uplift at a list.

Okay. So if you're looking at just maintenance ARR versus SaaS ARR, it is a 2.5 to 3x uplift?

Yes. So then for on-prem subscription is the 25% to 30% uplift.

Okay. Got it, got it. Okay. And you still have a pretty considerable maintenance ARR base that's still left.

Yes. We have about $100 million of maintenance ARR.

Okay. Got it, got it, got it. And then in terms of the incremental hosting costs, I'm sure you will probably give more color at a future date, but can you give us any sense of what the gross margin differential would be for a SaaS product versus the on-prem?

Yes. So today, we're at about 90% gross margins, best-in-class. Obviously, those will come down over time. We expect them to be more in line with other SaaS companies, which I think is kind of high 70s, low 80s percent. I think that's the right way to think about us. kind of longer term in terms of gross margins. Obviously, this year with only a 15% SaaS mix, I wouldn't expect there to be much of an impact on gross margins. And thinking about operating margins, we kind of expect to drive leverage within R&D, sales and marketing, and kind of support which kind of offset that gross margin pressure that we expect from SaaS. So net-net, we expect operating margins to kind of be better on SaaS versus what we would expected for on-prem subscription.

Got it. Brian, what are some of the things you have to do from a go-to-market support customer success standpoint to make the SaaS transition successful?

I think we've spent the last 5 years doing all of the right things to make a SaaS transition successful. What you need to do is make sure that your customers get value quickly. And the way we do that is we have the best support team, and we've had this for years, the best support team in security as many CISOs will tell you. but then we have a customer success team. All of our field teams meet with every single one of our customers every single quarter. They do all the initial configuration and deployment work for them. We have an incident response team that makes sure that the alerts are noisy. So you're getting a really small number of alerts, 10 to 15 for every 0.5 billion events or so. And that you know how to use them, and we've set up automated responses with SaaS, we can be proactive. The same IR analysts can now support 10x as many customers, which is kind of a CISO do you want an extra set of incident response hands that will reach out to you if we see anything, show me somebody that says no to that. We have a classification research team that will make sure that when we start looking for sensitive data that we're not finding any noise because if classification is noisy, it's useless. In fact, it could be -- we could give you a negative value because you're spending time chasing ghost. We will make sure that all of that is accurate and there's no noise. We have an ops team for deployment. We do all of this in service of ensuring that our customers see value immediately and over time and that they recognize the value that they're getting. That's how you make a SaaS transition successful. And we've built all of that infrastructure before the transition. That was all in the run-up to launching it. So we think we have everything that we need in place right now.

Jumping back to some of the financial topics, Tim. So I think you've got over 3/4 of your customers now that are adopting 4 or more products. How much can you really continue to sell into that installed base? And to what degree are you going to go back towards sort of bundling rather than selling these individual licenses as customers really want to rationalize the number of tooling that they have.

Yes. So the average customer has about 5 or 6 licenses today under the on-prem subscription licensing model. We think that can go to double digits over time. And while we're changing how we package our products in SaaS, we still think there's potential to basically double the value that we have from our existing customer base just in terms of penetration of our products. So if you think of 6 licenses on-prem, typically, you'd be protecting an on-prem windows deployment with all the automation that Brian has talked about kind of the classification and alerting that we have. Going from 6 to 12 would kind of be adding 365 classification, 365 kind of alerting and all those licenses that associated with that. So that's kind of why we see a pathway to double-digit licenses.

Got it. I'll ask one more question. I'll flip the audience to Q&A. Can you remind us what the net retention rate was for this year? And if we think about 2023. To what extent is that going to be driven by upsell versus new customers?

Yes. So we reported 115% NRR for last year. That was 117% on constant currency, and that's only on our subscription base of customers. Thinking about 2023, we don't guide to NRR or anything like that. But if you think about kind of the -- our guidance of 10% to 12%. Obviously, we do expect that to come down somewhat with the tougher macro environment impacting upsell and kind of higher unemployment rates just impacting seat counts, but that's all baked into our current assumptions for our 2023 guidance.

Any questions from the audience? Can I can ask more? Just on a growth versus profitability standpoint, we've always felt like Varonis with 90% gross margins in a pretty sticky enterprise installed base, that the margins haven't quite been optimized historically. I know you guys have been focused a lot more on growth. You now have the SaaS transition, can you talk us a little bit about how we should expect operating margins to progress throughout this transition? Are they going to continue to remain steady, grow, yes?

Yes. So we've always kind of focused on balancing top line growth, operating margin improvement and cash flow generation. I don't see any of that changing. What will change during the transition, at least is the accounting treatment of SaaS versus on-prem subscription, which will obviously cause a headwind to our income statement metrics. That's why we've kind of pointed people towards looking at ARR and free cash flow as the leading indicators of the transition because neither of those are impacted by the speed of the transition, right? ARR is recorded exactly the same way for an on-prem subscription deal and SaaS deal. Same with free cash flow. Free cash flow, we'll be billing and collecting annually in advance. So there's no headwinds there from a free cash flow basis. That's why you want to look at profitability improvements throughout the transition, I would point you to free cash flow margins. And in terms of top line growth, I'd look at our ARR improvement.

And in terms of free cash flow, I think you're guiding is about 10%, if I'm not mistaken.

It's actually about 4.5%.

4.5%...

Which is about a 400 basis point improvement versus last year. And historically, you've kind of seen us drive about 200 to 300 basis points of operating margin improvement each year.

Okay. So 4.5% free cash flow margin, both the term license subscription and the SaaS subscription is annually invoiced. Didn't the free cash flow margins be much better than 4.5%?

Well, they're still showing a 400 basis point improvement versus last year. So you're seeing the leverage kind of being driven on a year-over-year basis. And we do expect those to get better over time.

Okay. Okay. Going back to the product. So there are a lot of cloud native data governance players out there. They haven't reached a scale that Varonis has. How do you feel about your positioning relative to those competitors and the penetration rate when it comes to cloud due to security within your customer base?

We feel really good about it because none of those players can do what we do, especially when you talk about we're still supporting even with our SaaS offering, protecting on-premises data, which isn't going anywhere, right? None of them can touch the petabyte the file systems that we're looking at. None of them do a really good job at 365 either. They can't offer the same kind of automation and visibility that we do. We are now able to, both with DatAdvantage Cloud and Varonis as a SaaS, expand into other cloud stores much, much more quickly. And when we support a, say, an application or a data store, Salesforce is a good example, there's nobody out there today. There's no other vendor that can do what we do in Salesforce to find sensitive data in both fields and attachments and figure out the combination of settings and profiles and objects and rules that grant different people access to different sets of data and then fix all of those problems. Nobody else can do that. So we feel really strong about our position as a data security player, and the only ones that can really protect this kind of data at scale.

From a partnership perspective, can you remind us how much of the sales today are coming direct versus channel? And as you move to SaaS, are you exploring other partnership opportunities, whether it be like the cloud marketplaces or otherwise?

Yes. So we have 100% of our sales kind of coming through the channel. So channel is important for kind of the introductions and helping us close the deals, finding out who procures like the software at customers. But our sales force is really running the risk assessment process. We don't really see that changing at all in SaaS. We are able to sell our products on the Azure and AWS marketplaces to assess. So that could be a potential avenue of growth going forward.

Got it. And can you remind us what are the sales cycles today? And then to the extent that you have data, are they different at all for the SaaS product?

Yes. So our typical sales cycle today is 3 to 9 months, upwards of 12 months for the larger deals. Obviously, we've only introduced the SaaS products in October. So on average, any SaaS deal that's closed so far has to be shorter than the average 3- to 9-month sales cycle that we've seen. But I'd say it's too early to really comment on what we're seeing from a sales cycle perspective. But we do expect those to come down over time because of a lot of the reasons that Brian talked about, about lower infrastructure requirements, easier deployment and updated product packaging as well.

Got it. And then as far as the -- sorry, we've got one here. Do you want to wait for the mic, or I guess, just so the people on the webcast can hear you.

So 2 questions. One, how much is the SaaS is giving you net new customers? How much of it is just converting old customers? Just -- I don't know if there's a sense on that.

So right now, it's all net new or mostly. We haven't started converting existing customers except on a case-by-case basis when they come to us and said, "I really need this," like we want to move the SaaS ASAP, and we'll work with them to do that. But we're phasing in -- we're taking a phased approach. So we started with -- it's all new customers for the most part right now. We started with smaller customers, SMBs, and then very quickly built to enterprises. We're not yet at the point where any new prospective customers should be in SaaS, but we're very quickly getting that.

Got it. And then the second question, you said something about we need -- you need to integrate back into the apps more with you than standard deal type solution. Can you just sort of double-click on what that means and what the value add is, but also what's the incremental labor or effort required to do that.

Yes. And maybe I misspoke. We give a depth of visibility that none of those other tools do, but doesn't require engineering or configuration work. One of the advantages that we have, and this is core to what Varonis does is, when we look at a data store like a file system or 365. We have solved all the technical problems to gather all of the information we need at all levels of the tree and the different kinds of metadata like classification and behavior and identities and entitlements. We've sold like to gather all of that for a Windows file server or a NetApp or icon is a different challenge than to do it in 365 is a different challenge to do it in Salesforce? Is it a different challenge to do it in S3. We've solved all those problems. So it doesn't require any engineering or configuration or operational work for our customers to do it. It's click a box, connect it, and we've already done all the automation to gather it all. It's one of the massive advantages that we have.

Brian, Tim, thank you so much for joining us. We look forward to Analyst Day next week.

Thank you.

Thank you, everybody.