Varonis Systems, Inc. (VRNS) Earnings Call Transcript & Summary

Good morning, everyone. Welcome to Day 2 of the Barclays Tech Conference. My name is Saket Kalia. I cover software here at Barclays. Honored to have the team with us here from Varonis. We've got Guy Melamed, Chief Financial Officer and Chief Operating Officer, right? And we've got Brian Vecci, Field CTO. We've got about 30 minutes together. Let's spend the first 20 or 25 minutes just going through some fireside chat with the team, which I know is going to be fun. And then we would love to make this interactive. Anyone that's got any question, just pop up your hand. I think we've got a mic runner in the back. So Guy, Brian, thanks so much for being with us here today.

Thank you.

It won't be a conference without you guys.

Guy, maybe just to start -- can we -- just to make sure we're kind of level set for everybody in the room. What were some of the key points that you wanted to make sure investors took away from the Q3 earnings, which I thought was very eventful given everything that's happening here. Just maybe if you could summarize for us.

So for those that don't know, we announced the transition to SaaS at the beginning of this year, and we're 3 quarters in. We talked about kind of 3 North Stars that would be the indication of how the business is performing. One was ARR; second was free cash flow; and the third one is ARR contribution margin. When you look at how quickly the transition has been taking place, it's been extremely encouraging. It's actually exceeded our expectations. I think the overall theme and the reason for that is because SaaS is a better product. So customers are embracing and wanting to buy the SaaS product, be better protected. We're seeing existing customers convert at a higher pace than we really thought. We can talk more about that later. But I think the overall kind of highlight was the fact that we got to a point where 15% of our ARR is now coming from SaaS, and that was a 5% increase, which caused a lot of questions from investors because when you kind of just do the extrapolation of that 5% going forward, the calculation is pretty obvious that the 5-year plan that we laid out in the Investor Day should be revisited at the end of this year. And we told the investors we'll revisit that kind of time frame. So I think the 15% ARR coming from SaaS was a highlight. The fact that existing customers are converting at a much larger pace than we really -- without really focusing on it, it's happening in a natural way, which is extremely encouraging. And I think when you look at the cost structure, we've been able to keep the cost structure and the level of expenses in a very, very healthy way, generating free cash flow at meaningful levels. We're guiding now to $40 million to $45 million of positive free cash flow and that's compared to about flat last year. So even during a transition, and the first part of it is where you make kind of the larger investments, we're able to control the cost and generate cash in a meaningful way. So I think those are kind of the highlights.

Yes, absolutely. And I always look back to those 3 North Stars that you laid out at the Analyst Day, has been so consistent ever since. So it's really good to hear. Brian, maybe you can add some customer color to that because I know you spend a lot of time with customers. As you speak to them, that are either converting to SaaS or maybe opting for SaaS versus on-prem as new customers. What are the biggest selling points in your view for SaaS versus on-prem? And if it's sort of -- maybe the follow-on question to that is, is SaaS changing how they use the tools as well?

So it's important to remember, we're a security software company. And what we're really selling is an outcome of your data is more secure, you're better protected by reducing the time it takes to detect and respond to a threat and you're more compliant. So the reason customers choose SaaS is that you can get to those outcomes much -- with much less friction, much more easily, much more quickly. It deploys much faster. You can just -- you don't have to go to your infrastructure team and ask for servers and for databases, even for the risk assessment. It's a better product. There's more automation and then it's easier to use. It's much more scalable. It's easier to operate from a customer perspective, and that's borne out by an 85% reduction in support tickets for our SaaS customers versus self-hosted ones. There's also a lot more functionality that just doesn't exist in the self-hosted version, an AI SOC assistant, automation in Microsoft 365, there are platforms that we support and SaaS that we simply don't support in the self-hosted world. So it's a better product, it's easier to use. The TCO is lower because you don't have to spend as much money on hardware and databases and operations, you see lower support. So you add all that together, there's very few, if any reasons for a new customer to choose the self-hosted versus SaaS. It's kind of one very specific reason and that would be if they're Fed because it's not yet FedRAMP. Otherwise, they're just choosing SaaS. And as Guy said, many of our existing customers are coming to us and saying, "I want this. We're not shy about the benefits of this". So they're coming to us and saying, let's transition.

It feels like a very organic type of transition. Really customer-driven as opposed to sort of imposed upon your customers. That's great to hear. Guy, maybe for you, maybe with just to preface that this is a tough macro for really all of my coverage of companies. But nonetheless, I'm curious kind of what your observations are on SaaS from just a new logo perspective. right? I mean do we find that SaaS is making it easier to land new logos or perhaps expand the types of new logos that you work with? What are you seeing on SaaS from a new logo perspective is maybe the question?

I think you're right. When you look at the macro environment, we're seeing longer sales cycles and more deal scrutiny. Just to remind you, we were kind of one of the earlier companies that called it out and people were trying to figure out are we different than the others, but when we track the KPIs that we very closely track all the time, it was very clear to us last year that we're kind of heading into a tougher macro environment. And I think that's been very consistent since. I think when you look at Q3, the word that I used is stabilization. We saw Q3 from a macro perspective kind of not getting worse. But on the flip side, I think the tailwind is the SaaS offering and the fact that it allows us to target customers that we weren't able to target before, whether it's through platforms that we didn't cover before, not under SaaS, whether it's Google Docs or Salesforce or AWS or there's a list of platforms that we support under SaaS that we don't have under the on-prem subscription offering. So that opens up a whole new kind of TAM that we didn't have before. And when you think about the ease, especially in this environment, people don't want to buy the hardware, and they don't want to have additional people in their security team in order to support software. So as Brian said before, the total cost of ownership, even though the SaaS pricing is 25%, 30% higher, apples-to-apples, if you buy the same number of licenses, the total cost of ownership for the customer is lower and you're getting a better product. And I've also mentioned that when you think about kind of Q3, one of the more important points to think of is that it's a bit of an inflection point when you look at the AI that came out as a SaaS offering. The product that came out that we announced as part of the Varonis SaaS offering that will be implemented as part of the package is only offered on the SaaS, not offered under the on-prem subscription. And this is only 3 quarters in. So when you look at kind of the level of development and the investments that we're making with R&D, how is this SaaS product going to look in a year's time, 2 years' time? We're definitely trying to evolve to a point where in this scary environment where hacking is happening on a daily basis, and every hacking attempt is becoming more and more malicious, we have the platform to try and help customers be protected. And I think through the SaaS offering, it allows us to target new markets and new customers that we weren't able to target before.

Yes, absolutely. And AI is a topic I definitely want to spend some time on a little bit later. But Brian, maybe for you. Maybe we could touch on the competitive landscape a little bit. We've started to see some security vendors talk about this idea of sort of data security posture management over the past year or 2. And maybe the question is, have you seen any change competitively? And maybe as an extension to that, can you just talk about what maybe makes Varonis' solutions sort of different here from some of the other companies that are talking about sort of DSPM?

The right way to think about DSPM is it is a subset of what we do. If the acronym DSPM had existed in 2007, 2008, it would have been a good way to describe what we were doing in on-premises file systems, which none of the DSPM vendor support today. DSPM is interesting in that it's a kind of a new class of product, but it starts to describe a portion of what we've been doing from the beginning. To answer your question, we haven't really seen much change in the competitive landscape beyond the fact that now that we support so many other SaaS platforms like Google and Box and GitHub and Salesforce, [ AIX ] in the cloud like AWS and Azure, we're now playing in spaces that we didn't play before, so we're running up against other adjacent categories. You've asked me in the past about DLP and about CASB, the conversations are the same. These are adjacent categories that -- going back to what we're actually delivering, we're delivering an outcome. DSPM doesn't deliver these outcomes. It doesn't reduce the time it takes to detect and respond to a threat. It doesn't offer the automation in all of the places that we offer it, you can't solve the same problems. That's a longer way of saying we're still not seeing direct competition. There's nobody that does what we do. But we are -- because we're a platform-based approach and we offer so much functionality in so many places, we run up against the noise of adjacent categories, if that makes sense.

It does. It does definitely feels like a more holistic solution though here, right?

The number of CSOs that say, "I want to take a platform-based approach to security" is -- has been increasing over the last few years. For the obvious reasons, you don't want a dozen different point tools that don't solve any of these problems versus a platform that does.

For sure, for sure. Guy, maybe back to you, I think it was going back to sort of the 15% of ARR coming from SaaS. I think one of the surprises this year to all of us was just the amount of on-prem conversions to SaaS, right, from some of your existing customers. I think the guide, and you correct me here if I'm wrong, implies about $30 million in conversions in 2023. Even though we're not fully yet incentivizing customers or salespeople to really drive that conversion. And so again, it goes back to that idea of this being very organic. Maybe the question for you guys, what's driving that? And how are these customers kind of changing their usage once they convert from on-prem to SaaS?

The simple answer, it's a better product. And that's what's driving the conversions. As you mentioned, we're not focused. This was part of Phase 2, so we're not focused on Phase 2. When we laid out the plan, the 5-year plan in March during our Investor Day, we talked about Phase 1 taking anywhere between 1 year to 2 years. And then as we get close to the completion of Phase 1, we'll focus on Phase 2, which should take 3 to 4 years for a total transition period of 5 years. And we talked about completing a transition when we get to 70% to 90% of our ARR coming from SaaS. But as you've mentioned, during this year, we've seen a very gradual progress in the amount and the number of customers that are converting because they want to be better protected and because it's a better product. We haven't put any focus on -- from a commission perspective on that Phase 2. So the reps, they only get the uplift when they convert an on-prem subscription to SaaS. Anything above that renewal period goes towards their quota, but they don't get the actual renewal amount towards their quota, which is -- which means that all of this is happening in a natural way. If I think about next year, the one thing kind of to keep in mind is that Q4 is our largest renewal quarter. So we kind of want to see how Q4 behaves and we have a couple of options of how to look at 2024. I can say that I don't feel that strongly that we would have to compensate reps next year on the focus on Phase 2 if it is happening in a natural way because there are carrots and sticks and you don't want to throw money where you don't need to in terms of the focus and the cost structure. So we'll see how Q4 kind of evolves. But I think 2 things kind of to keep in mind is that we know what needs to be done when we start putting that focus and the second thing is that we don't see Phase 2 happening in a linear way. It won't be linear within the years, and it also won't be linear within the year itself. It takes some time. Renewals, we start working on anywhere between 6 to 9 months before the renewal date. So it takes some time from the moment you put that focus in until you can start seeing that change. But I think the overall dollar amount should increase year-over-year. And as we put more and more focus on it, we should expect an acceleration towards kind of the -- in the years ahead.

Yes. Yes, absolutely. Maybe just to put a bow on this topic, Guy, of on-prem to SaaS conversions. Remind us of the economics that you see when an on-prem subscription customer moves to SaaS. We're talking about lower TCO for the customer. Talk to us a little bit about the ARR uplift that you've been seeing so far.

So the ARR, when you compare apples-to-apples, the same number of licenses, the same number of users, we have seen an uplift of 25% to 30%. What is actually very interesting is that when you get a customer to convert from on-prem subscription to SaaS, we have moved from individual licenses under the SaaS offering. So for those that remember kind of the history of Varonis, we entered 2022 with 40-plus SKUs. And it got to a point where the richness of the platform became a bit of a challenge in terms of conversations that reps had to have with customers because it became more confusing. So in 2022, when we -- as part of the on-prem subscription sales, we offered bundles that would kind of consolidate licenses to one SKU, whether it's 7, 12, 15 licenses, and that worked really well under the on-prem subscription because it simplified the conversation with the customer and then you were talking about outcomes and not individual licenses. So the move to SaaS actually gave us the opportunity to double down on that. And when we initiated the SaaS offering, we no longer offered those individual licenses to be purchased separately. You're buying Varonis for Windows. Varonis for Office 365, and you're including what is the equivalent of 7 or 12 licenses. You cannot buy it individually.

Selling more of an outcome, basically, right?

You're selling the outcome. So what that means is that if you have a customer that is converting from on-prem subscription to SaaS, in many cases, they actually have to increase the number of "licenses" in order to move to SaaS, which means that when we see customers convert and having to consume more of the platform, we're getting a price uplift that is higher than 25%, 30%. Now I know you, you want to know what that number is. But I -- we still haven't broken out that number just because it's so early in kind of the process. But I can tell you that from our perspective, the 3 quarters have given us a lot of confidence in our price list and our ability to get that uplift even above that 25%, 30% price list uplift apples-to-apples.

Right. I mean -- so really, maybe said another way, the 25% to 30% uplift is a base case, right? I mean as customers sort of adopt more of the platform, there was just more value that they can achieve.

We always said at Varonis that more is more. So the more you can consume, the higher the customer satisfaction and the higher your desire to be protected under additional platforms. So once you get that outcome, and that's all we're talking about with customers, the outcome. We're not talking about individual applications within the license. We're talking about how we can protect you and what platforms -- what additional platforms you should consume in order to be protected there.

Got it. Got it. Guy, I want to shift over to some financial questions here. And maybe just starting from just an expense perspective or an FX perspective, I know that we have some of our R&D team, a big part of the R&D team out of Israel. And of course, the dollar strengthened against the shekel, right? Maybe there's a little bit of movement there, but generally strengthened against the shekel I know that we have a hedging strategy here that's been very helpful in the past. But can you just maybe give us a sense for how you're thinking about movements in the shekel just from an expense perspective in 2023 and going into 2024?

So it's funny because when you asked the question and I looked at it this morning, the rate has been all over the place. It has gone up and gone down. Very, very volatile. We have a hedging strategy that we very closely monitor and the whole intention of the hedging strategy is to eliminate any volatility within the currency. And I think we've done a very good job of taking advantage of the rates where in 2024, you shouldn't expect any headwind or tailwind. So it's pretty much flat. We've been able to actually extend that post-2024 a bit as well. So overall, the hedging strategy is working very well, and you can kind of view the company on an operating margin perspective based on its normal organic software sales behavior. So we've done a good job there.

Absolutely, absolutely. And maybe just to close the loop on this point around expenses. I mean I think Varonis has just been super consistent in balancing growth and profitability just over the years. And I think that you're starting to see some margin benefits from the efficiencies in your SaaS product, whether that's go-to-market or R&D, whatever the case may be. Can you just walk us through some of these dynamics from an expense or margin perspective? And how you're thinking about margins here as we progress further into the SaaS transition?

So obviously, when you talk about margins, the first thing to kind of pay attention to is the gross margin. And I think when you look at kind of the behavior of the gross margins on a non-GAAP basis and you kind of compare it year-over-year, you can see that the strength and the health of those margins is extremely encouraging. It's actually been better than our initial expectation when we announced the transition. Now it doesn't mean that you don't continue to invest and you increase your customer success so you can focus on the transition and the conversion of existing customers and you get them to value and -- all of that is still as part of our plan. But I think where we stand today gives us a lot of confidence on the gross margin compared to where we were a year ago. When you look at some of the other departments, I think there's a lot of leverage to be taken advantage to as we move through this transition. It's enough to look at the R&D. When you look historically at the R&D at Varonis as a percentage of ARR, I think we've been on the larger investing companies as a percentage of ARR, and we were in that top 20%. And very much because of the desire to put out a platform that would be well received by customers to the standard that they've been used to. So those investments, and we talked about $100 million of investments in the last 2 years in 2022 and 2021 alone, just to get the SaaS offering out the door the way it did and there's still investments that need to be made in R&D. But I think that over time, as we moved to one code, we stopped kind of supporting both the on-prem subscription and the SaaS. And that doesn't happen next year or the year after it happens, it takes some time. But thinking ahead, you get to a point where you can generate significant leverage in the R&D department just by maintaining the SaaS offering, and you go down to the low 20% out of ARR and that in itself can generate some significant benefits for the company and provide value to shareholders. So that's the R&D side. And then you look at the sales and marketing side, the whole process of doing a risk assessment -- and I've talked for years about the fact that the Varonis sale is visual. You can talk hypothetically about millions of files open to everyone in the company. But until you see a file that you can identify that is open to everyone in the company, you don't go and buy the software. So we're still in that visual selling process, but it's easier to do it with SaaS compared to the on-prem subscription. So even there, I think that over time, you can generate some leverage. And -- we talked about the -- Brian talked about the support tickets, which are significantly lower under SaaS versus on-prem subscription, professional services is easier. There's a lot of things that you can benefit from a leverage perspective with a SaaS offering. So I think over time, when you kind of get to scale and you get to a point where your SaaS mix out of total ARR becomes the majority, you can start really benefit from that leverage. But I think when you look at where we've been historically, we've been very confident with anywhere from 150 basis points to 300 basis points improvement year-over-year. This year, it's actually significantly higher. But I also want to preface and put it out there, we don't want to get to operating margin leverage too quickly because there's a tremendous opportunity that we want to take advantage of. And it's a much larger opportunity sitting here today than what it was 1 year or 2 or 3 years ago. So we still want to invest. We still want to grow. We still want to capture market share and get to that $1 billion ARR target that we talked during the Investor Day. And I think over time, we're committed to improving operating margin and increasing our free cash flow, but we want to do it in a gradual and very thoughtful way.

Absolutely, absolutely. Just investing for that opportunity and how that opportunity is bigger now than it has been in prior years. I think it's a natural segue into really the Gen AI opportunity here, Brian. Maybe the question for you is how are customers talking to you about the increased importance of Varonis as they roll out new AI products like a Microsoft Copilot, for example? Where does Varonis fit in?

The #1 reason that customers are not deploying -- not bonus customers, but any organization is not deploying Copilot right now is privacy and security. One CISO said -- of a bank that, I don't want users on my trading floor using Copilot to find employee 401(k) data, which is exactly what will happen if you have millions of files open to everybody in the company, which is exactly what happens when we do a risk assessment. So if you want to use Copilot and you don't want to expose yourself to risk, you need Varonis. Every conversation about generative AI, whether we're talking about productivity tools like Copilot or Salesforce Einstein or companies training their own LLMs on their own data, it's all about data. You need to secure that data to make sure that insiders and outside attackers can't use these tools to get access to data that they shouldn't. You also want to make sure that your models aren't being trained on data like employee information or sensitive customer data that they're not supposed to see so that you don't expose yourself. So companies are obviously very driven right now to deploy generative AI-based tools and get the benefit of them, the productivity benefits, the ability to monetize their data, but they don't want to put themselves at risk. We are a critical part of getting value out of generative AI. I was in a meeting with a 7,000-user manufacturing company. I took them through the risks that they're going to see with Copilot. I got halfway through my presentation, stopped for a moment and said, does any of this track? Does this make some sense? And there's a room of about 12 people on their security team, their CISO all the way down to privacy and end-user experience, and they just paused and laughed and said, "This resonates." It speaks to we're unique in what we do. Everybody knows they have this problem. Until we show it to them, they don't realize they can solve it and they can solve it quickly and automatically. You have the risk assessment in a couple of days.

Right, right. So really, I think the tool here could maybe help customers actually realize the benefits of AI in a really secure way, right, from a [indiscernible] security perspective.

[ You're at risk ]. If you don't have Varonis, you're running the risk of using something like Copilot and exposing employee data, customer information, intellectual property to people inside and outside the company that have absolutely no organizational need to see it, which means you're putting yourself at risk.

Guy, maybe the follow-on question for you on that is, how do you think about AI as a revenue opportunity here for Varonis?

I think we can monetize AI at Varonis. But I think we're going to do it slightly differently. One of the options that did come up is offering the AI functionality that's now part of the Varonis platform as a separate SKU. But since we're trying to consolidate and talk about the outcomes, we felt that we want to keep it as part of the package, provide way more value to our customers, and that would obviously impact, with customer satisfaction, it could impact renewal rates. It could impact the desire of those customers to protect additional platforms, like Windows, they moved to Office 365 and they moved to other platforms that they haven't protected before. So I think with the AI as part of that platform sale, it provides us the ability to monetize through the sale of additional licenses and higher customer satisfaction throughout -- across the board.

Got it. Got it. Brian, back to you just on this topic. I mean, as I think about that, really, you were enabling the Gen AI providers, right, to really deliver their solutions to their customers in a more secure way. What's the dialogue like with some of those guys that are providing those Gen AI tools like the Copilot, for example?

Extremely tight. We're a very close partner with Microsoft and with Salesforce and with Amazon. We're available on all 3 marketplaces for good reason. Microsoft doesn't have the technology that we do to secure data in the way that they do. And they say -- and we integrate with them. So if you want to, for instance, use Microsoft Purview to do blocking and encryption and all of the perimeter controls that they offer, Microsoft says you're much better able to do this with Varonis. And that's why we're available in the Azure marketplace. Same thing with Salesforce. We're available on the Salesforce app store and the AWS marketplace. So we have very tight partnerships with all of the platform providers because we do something unique. And if you want to get -- if you want to enable generative AI-based tools, you need us to make sure that your data is secure.

Got it. Got it. on, maybe in the last minute or 2 that we've got here. As we think about sort of this multiyear model that was so helpful that you gave at Analyst Day, how should we be thinking about some of the puts and takes as we think about sort of modeling '24, any of the macro assumptions that you've seen here? Anything you want us to know as we think about next year?

In March, during the Investor Day, we talked about the assumptions from a macro perspective, where we see softness in 2023, and we expect that softness to continue in 2024. That assumption still holds true. So our expectation for next year is that the sales cycles continue to stay at the levels that we've seen this year with more deal scrutiny. But I think we're kind of past that challenging part of the transition, which we talked about, which was the first 6 months. I think the other important element to think about in 2024 is that, yes, we are committed to improving our operating margin and generating higher free cash flow levels, but we still want to invest in levels that would allow us to capitalize the larger opportunity that we see today. So I think when you look at kind of the levels of expense that we had in 2023 and kind of the commitments of that 150 basis points to 300 basis points improvement year-over-year is a starting point. That's kind of where we've been in the past. Obviously, throughout the year, we've -- in the past, we've shown our ability to do better, but I think that's a good starting point. And I think the Phase 2 should start throughout the 2024 year, but I don't think it kind of gets off the bat in Q1 in a crazy way because it does take that time.

It won't be late or too early, to your point, right? It'll be just right?

It would accelerate throughout the year, and then it would accelerate from the years ahead as well, but we definitely want to take advantage of the opportunity. We feel very good about where we are. There are a lot of tailwinds that are happening on many fronts that we want to capitalize on. But just remember that we've never been the type of company where a breach happens and you see a spike the next day in our revenue. We're part of that thoughtful process. So when you look at kind of the SEC regulation that's going into place that makes a lot of CFOs very focused on cybersecurity, which they've never been focused that way before. I think that could be a tailwind for the years ahead, not necessarily for 2024, but definitely part of where we want to take advantage of the market.

Got it. I couldn't think of a better way to end there. Guy, Brian, thanks so much for the time. Shame on me, I didn't call up my buddy, Tim Perz, Head of Investor Relations. Any questions that we got there, Tim's your man. Guys, thank you so much for your time.

Thank you.