Varonis Systems, Inc. (VRNS) Earnings Call Transcript & Summary

All right. We will get started. I'm Roger Boyd, I cover cybersecurity here at UBS. Very happy to have the Varonis team here. Guy Melamed, who's CFO and Chief Operating Officer; and we have Brian Vecci my right, who's Field CTO. So gentlemen, thanks for being here.

Thank you for having us.

So I'm going to jump into some fireside questions, but if you guys have Q&A, please feel free to submit them through the app. I'm happy to forward it on to these guys. But maybe just to start, I think a lot of people are familiar with the story, but a lot of generalists here, [ a lot of ] people maybe not. Can you just start with the story of what Varonis does. Data is very in topic right now? What's the core problem you're solving and where do you sit in the security kind of hierarchy stack?

So we're a security software company. We make software that helps organizations of all sizes in every vertical secure and protect their data. What we see, what we've seen for 20 years is companies really, really struggle or enterprises really struggled with knowing what data they have and where it is -- they struggle with ensuring that it's properly secured, meaning that it's not exposed to people or applications or devices that don't need to have access. They struggle with detecting and responding to threats. And they struggle with keeping it private and being compliant. And now these days, they really struggled with protecting it when it comes to GenAI use cases as well. So what we do is we make sure that the enterprise knows what data they have, what's important, what's sensitive, where it is, whether it's on-premises or in the cloud, whether it's in OneDrive share or a Salesforce field. And then it's properly secured and protected that it's not exposed, that it's properly monitored. When something goes wrong, they know about it quickly, they can effectively respond to it.

Yes. Makes sense. With all this data, I mean, generative AI has been a big topic. It's been probably the #1 question I get regarding Varonis, and I'm sure you guys are getting the same. But Yaki made some comments on the third quarter call just about how generative AI and AI could ultimately become a tailwind of the business. And the risks that AI causes around data and how you solve them, I think there's two main types of risks that he called out. Can you just maybe first talk about the first one, the self-inflicted risk? And what does that mean for customers?

Talked to the CISO a couple of weeks ago, we said they want to use Microsoft Copilot. The Board says, "Go this is going to make our people much more productive, maybe the greatest productivity tool ever." For those that don't know, Microsoft Copilot is basically ChatGPT for your enterprise data, for all the files and e-mails that you have. And what she said was I'm terrified of turning this on. And suddenly people on our trading floor get access to the CEO's long-term plan or his e-mail, and that's exactly what's going to happen. So enterprises that want to benefit from generative AI and large language models, it's all about data. They need to protect and secure their data before they use these or they're going to really expose themselves to risk. The self-inflicted risk that you just asked about is organizations that are using new tools and technology like large language models to make their people more productive and get more value out of the data that they have, but the risk associated with it is people have access to wait too much. The people on the trading floor have access to the CEO's e-mail. And that's because the data is so hard to secure and protect. We have been solving that problem from the beginning of the company. We were founded specifically to solve those kinds of problems, which have become more and more difficult to solve. So if a company wants to use generative AI, they need Varonis to secure that data or else they're putting themselves at risk.

Varonis has been making this point about over permission data. Is it right to think about Copilot generative AI really just escalating how quickly organizations figure out how ever permission they are?

I think they need to do a risk assessment of Varonis to really figure out how ever permission they are. But it's interesting. If you go to the Microsoft Copilot readiness page, right there on the page, it says, organizations struggle with oversharing. They don't have a solution for it, but they acknowledge that you should be very cognizant of this, and you should review your settings and permissions before you use Copilot. We have the advantage of if you want to solve that problem, you need us. This has been a problem for a very long time, to your point. This is now a problem that's becoming even more top of mind. We're going up the priority stack because of it.

I'll come back to that in a second. But the other risk Yaki was talking about was the external risk from threat actors and the fact that Copilots will pretty quickly become a pretty lucrative target for people looking for data inside of the network. Can you just put a little more detail behind that? And how are you thinking about that?

I want everybody to remember the first time you used ChatGPT and how it made all of the information on the Internet up until 2021. So much more accessible to you. You could just ask it any question. Now imagine you could go into a company as a hacker or an insider threat and say, tell me all of the employee information, summarize everybody's 401(k), show me all of the PII that might be accessible that I might be able to monetize. Tell me -- can you tell me about the source code. Can you show me intellectual property. You can just ask questions. And if the data isn't secured, Copilot is going to be a hacker's best friend.

How does Varonis specifically address that issue?

We make sure the data is secured. So Copilot and other tools like Copilot use what we call the access control. So the permissions of the user that is using it. Roger, if you went and asked Copilot to summarize all of the data of specific companies, maybe that you're doing research on. It's going to use whatever you have access to, all of the files and e-mails and team chats, everything that you personally have access to, it's going to go out and learn from it in order to produce new content for you. The problem is, if you have access to too much, if half the data in the company is open to everybody in the company, just imagine the amount of risk. Suddenly, that data is accessible, not just by somebody who's actively looking for it, but by an AI that's going to go out and find it for you.

What are the alternatives for customers if they are recognizing this problem, they don't buy Varonis. I mean Microsoft has their own information protection platform. How do you think about the competitive environment here? And if you're not using Varonis, how do you wrangle down over permission data?

We know because we do so many risk assessments that companies that aren't using Varonis are not solving this problem. What they're doing is they're using perimeter-based or DLP-based tools to try to block data from being center shared or they're focusing on endpoints like devices, phones, things like that, but they are not securing the data. They're using adjacent technologies that don't solve these problems. When we say we don't have any direct competition, we know that because nothing does what Varonis does, if it did, we would do a risk assessment, we wouldn't see so much data exposed to so many people who don't need it.

Maybe to bring Guy into the conversation, but instead of directly monetizing AI with specific SKUs, the messaging has very been much around your ability to address these risks will just become a tailwind of the overall business. Is that the right way to think about it? And at a minimum, it sounds like adoption of Copilot, generative AI applications could at a minimum be a marketing beneficiary for -- or a benefit to Varonis.

So I think we can absolutely benefit and monetize AI. We're just doing it in a slightly different way. And we're not selling it as a separate SKU because one of the things that we've seen over the years is that we have a wealth of products. And we got to a point where we had 40-plus SKUs and that became slightly too confusing for customers and reps. So in 2022, we actually offered bundles and consolidated those SKUs into one SKU that encompasses whether it was 6, 7, 10, 12 individual SKUs, and that worked really well. And then in 2023, when we announced our transition to SaaS, it was an opportunity to double down on that consolidation. And through the SaaS offering, we don't sell individual licenses. So you sell the Varonis platform for Windows, the Varonis platform for Office 365. And by doing that, we've seen both reps and customers really enjoy that change because it simplifies the conversation. And it really makes customers better protected. And with the AI, we decided to put it as part of the platform sale because it makes the product better. It provides customers higher -- really higher customer satisfaction when you think about it, it works better and then their ability to come back and purchase additional platforms that aren't protected goes up significantly. I just want to add one thing to kind of the conversation about AI and the whole risk assessment. So I think it's important to note that the risk assessment is part of that visual sale and is a significant component in our selling motion, and it's really critical to understand that because the risk of data being exposed to everyone in the organization is out there. It's been out there for many, many years. I think that risk is increasing by the day. And if we go to customers -- potential customers and tell them that they have millions of files that are open to everyone in the company, they kind of move on in life because what do you do with that? And if I told people in the room that on average, they have a couple of million files that are open to everyone in the company, what do you do? You go make coffee in the standout side and rightly so because you don't identify those files. But if I could actually show each and everyone in this room, the list of top 2024 PICs, long and short, a list that you prepared that is open to everyone that has access to the company's Wi-Fi. And through that Wi-Fi, they can access to that file, Guess what, we would get the PO. So that's why we work very closely in that visual selling process. The same goes with the AI and making sure that customers understand how vulnerable they are and they can identify files that they knew should be protected or should not be accessed by everyone in the company, and they can recognize them and they could see that people that have access to them shouldn't have access and that kind of changes the whole conversation.

Sticking with Copilot, if it's primarily drawing from Microsoft 365. Can you just talk about where you are in terms of customer penetration for Microsoft 365 use cases, which is SharePoint and OneDrive. I think at the Analyst Day earlier this year, you called out about $100 million in those use cases, but how do we think about that opportunity? And do you think something like Copilot adoption could help improve that penetration?

So the Office 365 has definitely become a driver. If we go back to when we introduced it took a couple of years for both the reps to fully understand how to sell it. But once they kind of understood that, it started to become a driver for us, and it's continued to be a driver for us. But as you mentioned in the Investor Day in March, we actually showed how small that percentage is out of the overall kind of opportunity. So it was really low single digits and that hasn't changed much. So when you think about our opportunity with that platform, it's extremely significant for us. We want to make sure that we capitalize on that, but we have a long ways to go in terms of our ability to sell that to potential customers. And even to our -- some of our existing customers that don't have it yet.

The question I get on Varonis go back years is what budget do you pull from? And historically, it's been some areas like DLP or the SIM -- we're starting to see budgets get created for generative AI -- are you -- I guess this is very early, but are you starting to see line items for something like generative AI security.

It's very, very early but [ Guy's ] point to, you think -- directionally, yes, but it's still very, very early. We still don't see generally a budget for Varonis, but data security specifically, partly because of generative AI, partly because of privacy and compliance use cases partly because of we're seeing more data protection projects overall are becoming far more common.

The other element, Yaki, mentioned was the opportunity for Varonis to use generative AI and AI internally to improve your product, your customer experience. Can you give a summary of what's going on that front? How we should think about that impacting margins?

Yes. So we recently launched Athena AI, which is a generative AI, large language a model-based set of functionality within the product itself. And to Guy's point, it makes our platform easier to use. It increases customer satisfaction. The boys did demo well. You can just ask Athena. Show me all of the HR data that's open to people outside of the company. And seconds later here you go. And if you get an alert like Brian's account is assessing data like it might be ransomware, the AI assistant will say, here's why this might be happening. Here's what you should go do next. You should look at this tool, and this tool, and this configuration and -- it's basically -- it's a SOC analyst and expert walking you through the investigation response and recovery. So it makes the entire platform easy to use. Our customers love it. It's -- it's still really early, but really exciting.

Roger, I think there's another point that is important to note. When you think about where we are in our journey in transitioning to SaaS, we're only 3 quarters in. And the whole transition is happening quicker than what we initially anticipated. We talked about the fact in our Investor Day that we plan for it to be a 5-year journey. We also talked in the last earnings call about the fact that with the SaaS increasing 5% out of total ARR in one quarter alone. And when you do that extrapolation, it makes a lot of sense to revisit that time line at the end of this year. But I think what investors still don't fully understand is the fact that this AI offering is only part of the SaaS. So when you think about a product that's been out for 3 quarters only, this is, in a way, an inflection point in the fact that this is making the Varonis SaaS product much better than the on-prem subscription solution that we had. And if this is -- how it looks in 3 quarters, how is it going to look in a year or 2 years with the amount of development and updates and upgrades that we put into the SaaS offering. So when you think of where we are today and where we want to get to, the desire is to protect customers and protect their data through the SaaS offering. And it is much easier for us to do through the SaaS offering, and it will get -- it will become a much, much better product over time with a much bigger difference compared to the on-prem subscription.

Very interesting. And a good segue, actually, I wanted to touch on the quarter and go back to that transition. But Q3 was pretty good from a high-level perspective. Can you just kind of run through what were the highlights and to front-load you a little bit, just really good contraction with conversions happening to get a quicker pace than you were probably expecting. Just what's happening with that? And why does that make you excited about the SaaS transition?

Again, going back to the Investor Day, we broke out the transition into 2 phases. Phase 1, focusing on new customers and selling to them, and we expected that to take anywhere between 1 to 2 years. And then as we get close to the end of Phase I, start focusing on Phase II, which would be converting our existing customer base into SaaS, and we expected that to take anywhere between 3 to 4 years. For a total transition period of 5 years. What we've actually seen this year has pleasantly surprised us with a natural conversion. We're not forcing it. We're not incentivizing reps, so there's no commission incentive apart from the uplift, anything that they sell with SaaS on top of the renewal goes towards their quota and the price list of SaaS for the same products sold is 25%, 30% higher. But what's actually happening is that some of our existing customers, because of the fact that we're not selling individual licenses, have to buy more than the same number of SKUs that they had previously, which makes kind of the uplift higher than that 25%, 30%. But there's no specific incentive for our reps to sell and convert the existing customers, and with that natural evolution -- natural occurrence of conversions, it's extremely encouraging because customers want it because it's a better product and reps are getting kind of that uplift towards their quota. So the fact that it's happened so well this year. And if you look at Q3, it actually increased significantly compared to what we saw in Q1 and Q2 is a great indicator and very encouraging for us that once we put the focus on that Phase II, then that can actually happen at a much better pace. So if you think forward on how Phase 2 should look like, I think it will happen sometime through 2024. I don't expect it to be in the first part of the year necessarily, but more towards the mid- to second part of the year, as we think about it now, and then every single year, I would expect it to accelerate compared to the previous year. So I don't see it as a linear progression because one of the things to keep in mind is that we're selling 3-year deals. So if you have a customer that just bought your on-prem subscription or did an upsell and has a 3-year contract, some of them will wait until the end of that period in order to convert. Now some of them could reallocate the hardware that they purchased for the Varonis software allocated to other things, and then we'll be more than happy to assist in an earlier conversion, but it's just to keep in mind that some of our customers would rather wait. And one of the things that we've insured in our 2019 transition, and we make sure that we put in the forefront of this transition is that the customers go first. We want to make sure that we keep them happy. We know that it's a much better product, but we'll make sure that we align in terms of the time line that works for them. So I think that's the 1 kind of element to keep in mind on the Phase II. But if you look at Q3, some of the other positive elements that we saw apart from the conversion is the fact that we're selling to newer customers. And the selling of SaaS to newer customers opens up additional verticals, additional opportunities, additional markets and additional customers that didn't want to buy the Varonis product before. Because what SaaS does really well is eliminate 2 of the most biggest objections that we got. One of them was we don't want to buy hardware. And the second one, we don't have enough people to support the platform. And SaaS eliminates those 2 objections completely. So definitely encouraging when you look at the Q3 quarter in terms of new customers, in terms of the existing customers' conversions. But I would also add Free cash flow, operating margin leverage, definitely points that give us a lot of confidence that even through a transition, we're able to maintain our cost structure in a very healthy way and continue to generate more and more free cash flow, which is something that we put out there as a north star.

Yes. That makes a lot of sense. And maybe just to add on to that. You've talked about this uplift you get when you convert from term to SaaS. And you listed a couple of the reasons why you feel like that's an appropriate amount. The fact that it lowers cost of ownership for customers, it's easier to manage the cloud management pain. But what have you seen play out so far in terms of the uplift you're recognizing? And again, the other point of as you move to SaaS, maybe you need to take some additional SKUs.

Same number of licenses, apples-to-apples, we see that 25%, 30% uplift, which gives us a lot of confidence in the pricing that we put out there. But as I mentioned before, we're definitely seeing some of our existing customers needing to buy a larger part of the platform in that conversion, whether it's additional users, whether it's additional modules because we're not selling those individual licenses anymore, and that allows us to recognize a much higher uplift than that. Now again, it's still on a smaller scale. We need to see how this evolves. But overall, I can tell you that we feel pretty good with our pricing model and the confidence that we have in that uplift and the fact that customers would be willing to pay more, just because, as you mentioned, the total cost of ownership is low. So overall, they're in a better position, we're in a better position, and that's when it works well when it's a win-win.

How do you think about the opportunity of the installed base conversions and everybody can do that math of multiplying the current term base by the upsell. But how do you think about that opportunity versus the new logo opportunity and the fact that a SaaS product should give you an opportunity to win customers, you hadn't typically had an opportunity with, in the past?

That's a very good question. And the way we have thought about it. And I think it's a good reflection when you kind of look at the comp plan because you align the comp plan with what's important from a strategic perspective is that there's a large portion of the commission in order for reps to focus on new business. Obviously, selling to existing customers is not as much as a lift as selling to new customers, but in order to support the growth going forward, you want to make sure that you bring in new fuel that would allow us to sell them and upsell them over the next couple of years. So the way we have structured the comp plan in 2023 is that significant portion of the commission is focused on acquiring new logos. And I think that's been working well. And when I think about 2024, there's not going to be any change in that focus because we want to make sure that we can bring in those new logos and address customers that we couldn't address before. Now that doesn't mean we don't want to upsell to our existing customers, we will, and we don't want to convert them, we will do that as well. But there has to be a good balance. The majority will still come from our existing base when you look at kind of the new sales, but overall, we want to make sure that we focus on the new logos as well.

Yes. I'm going to turn to a question from the audience real quick. It's a common question. But what is -- I think it's an overall platform question, but maybe we can talk about it in the generative AI context, too. But what is the risk that Microsoft just pushes further into this market adds the capabilities that you've been doing well for a while. It's been a question that I've gotten about Varonis for years. But if you want to talk about generative AI specifically, I think there's still some shortcomings with the products that they offer to help you...

They're focused very much on DLP, and Purview certainly useful, but Microsoft themselves says, if you want to get the most out of purview, you need Varonis. And that's why we're on the Azure marketplace. And we have automation tied to Purview Information Protection and automatically labeling files. Microsoft doesn't have technology right now that solves the problems that we solve. And we've been doing this for a long time. This is the problem that we were built to solve. So we have a very strong type of -- very strong partnership with Microsoft, and we'll continue to work with them closely.

And just to add to that, one of the things that we have done with the acquisition of Polyrize at the end of 2020 is try and address additional platforms that we didn't address before. So when you think about kind of the Varonis for Salesforce, Varonis for Google Docs, Varonis for AWS. Those are additional platforms because at the end of the day, we want to protect data wherever it resides. And I think that's what -- that's the goal, that's the mission, and that's what we plan to do going forward.

It's a good point. On DA Cloud, we're starting here in partners that are being more successful in that product. And I'd love to get your kind of view on what progress you've seen? And really to what extent has the introduction of Varonis SaaS kind of help make that sale a little bit easier?

So if it goes back to the Office 365 conversation that we just had. Reps don't adopt a new product just off the bat. It never happens, it takes time for them to understand the ins and outs and the positioning. And that's why when we talked about DA Cloud, we started talking about it last year, we said that we see a tremendous opportunity of having it a driver going forward, but we know that under the evolution of Varonis in the past, it takes time for them to adopt. . As time goes by and as they see the conversations with customers are very successful and customers are interested, it makes them more focused and more confident in selling that. And that's why I think you're kind of getting that feedback from the sources that you're talking to. So I think when you look at where the -- we're not -- we don't call DA Cloud anymore, it's part of the Varonis SaaS product. But when you think about the ability to protect additional applications that we didn't have before and the fact that we want to have 1 dashboard that provides the same visibility that's what we're aiming for. And I think that's where we plan to get to with the sale of those platforms.

You also can't estimate the amount of R&D that's gone into those that set of products and the functionality there, it's better than it was 6 months ago, which is better than it was a year ago. So we continue to have more visibility and more automation, which makes it more valuable.

Maybe last question or maybe two more. But as you think about Phase II and expanding the SaaS transition to the installed base, where are you from an investment capacity standpoint? Is there anything you'd have to consider as you think about a broader Phase II rollout? Or you do you feel pretty comfortable with the operational ability you have today?

So we talked about the fact that when we sell Varonis SaaS today, for new customers, it's a better product already. And for most of the existing customers, it's already performing in a better way. Obviously, the amount of updates that we have come out with under the SaaS offering has been significantly higher than anything we've come out with the on-prem in a combination of 2 to 3 years combined. So I think that as you look at next year, every single update will make the product better, it's already performing in a better way than some of the on-prem subscription as we sit today. But I don't see that as a deterrent in terms of the Phase II that we want to focus on. And I think eventually, we get to a point, not next year and not in 2025, but eventually, you get to a point where you have one source of code and you're not maintaining two types of code. And that provides tremendous leverage, not just in R&D, but in some of the other departments as well.

Yes. Very good. I think we're all about up in time. Thank you, gentlemen, both for being here, a good conversation. Thank you all for joining.

Thank you.

Thanks very much.