Varonis Systems, Inc. (VRNS) Earnings Call Transcript & Summary

So thanks again for coming. Guy and David from Varonis. And this is a good room. So hopefully, there will be some -- I love it when there's participation. Odi, you know Varonis, you can ask some questions, but we'd love to keep this interactive. I'll kick it off. But save your questions up. I'll leave some time at the end for that. So thanks, everybody, for joining us as we get into the back half of this day 1.

Let's maybe start, Guy, with you. You guys delivered a really strong quarter, I thought, really beat all metrics. You raised the '24 outlook. I want to get -- the stock, I just think, is a really interesting opportunity here because I think there's been a lot of enthusiasm in the stock for quite some time based on all the products you guys have developed. But maybe just start out with some of the demand trends that you're seeing. Like I said, it was a beat and raise quarter. You've always got a bit of a conservative stance to guidance and outlook, which has proved successful over the years. But just level set us on what you're seeing from a buying environment perspective.

First of all, thanks for having us. It's always great to be here. And you're right, Q3 was a very strong quarter. We talked about it, the enterprise business was very strong. We felt like we were hitting on all the cylinders from new business, to upsell, to conversion, to being able to extract more from new customers. The MDDR was working well. We got the 43% SaaS ARR. The one thing that didn't work that well in Q3 was the federal business. We talked about that. That was a bit of a headwind for us in the quarter. But I think we are trying to take advantage of a much larger opportunity. We're in a place that we've never been before where the MDDR, that offering was only introduced at the beginning of this year. And people sometimes forget, and we started to transition to SaaS only at the beginning of '23. So everything is kind of happening very quick, but happening at a pace that we're very happy with. So the value that we're providing to customers with the MDDR is great. In a way, we're saving them on headcount. The SaaS is obviously saving them on the -- on their need to buy the infrastructure. So the hardware is on us. And basically, what we're telling to our customers is that with the MDDR offering, all they need to do is pay, we'll take care of everything else. So that's been very well received. We talked about the fact that we think that MDDR should be really with every single customer. And you'll appreciate this. But if you go back, what, 8 years when DatAlert came out, and this is pretty historic and a different era, that was the message at the time. DatAlert is coming out. We think every single customer should have DatAlert and people looked at us and said, what are you talking about? Now it's the essence of the platform. We think that MDDR is a game changer for us in how it can help us simplify the conversation when we sell. And I think that was one of the drivers for the new customers increasing and being able to extract more dollars from those new customers. And overall, we're very happy with where we are.

The fact that you led with MDDR, I think when I talk to investors, it's like, well, tell me about Gen AI. Tell me about -- which is important for you guys. But the fact that you led with that, I think, to me, speaks to the opportunity for that. And Gen AI and Copilot, that's great. But it really is about in terms of like monetizing the platform today, MDDR. I'm going to double-click, David, with you on that. But I just always find it just so ironic that the government -- and I know there's FedRAMP steps that the fact that like that they're not using Varonis to a greater extent, I mean, I see it as a real opportunity.

It's on us. I think we didn't do a good job there. And I think we made some changes there. And I think that the opportunity is great. The need for the product is -- it's essential. When you think about the fact that data can be taken out and so much harm can be done when it gets to the wrong hands, it's a no-brainer. So I think the softness that we had in the federal business had nothing to do with competition or market-fit or any of those. It was just -- we changed the leadership, and we're hoping to take advantage of that going forward.

Okay. Great. Let's double-click on MDDR, David Gibson, SVP of Strategic Programs. What was your title when you guys went public? Was that -- it's evolved over the years a little bit.

I've had a lot of titles...

A lot of hats, but yes, well, you're actively involved with DatAlert and DatAdvantage and now MDDR. Talk about why did Guy mention that before other products? Like what are customers saying of why that is such a game changer?

Well I think in general, it's important to remember the history, what happened with DatAlert, right, and how that came out. And it really did become the glue for our products because you get one -- we get really good alerts in one place and then why wouldn't you want to have them in another place. And one of the things that was an offshoot of DatAlert was our IR team. We -- as we got closer to security and more strategic when it came to security, especially with ransomware and all the attacks and data, it became apparent that customers needed help. They needed experts to call when they saw an alert on our software or any other software they had, and we could add value there. So our IR team was formed in around 2017. It became really popular, really sticky. And it was a really great value-added service around that. But when we came out with SaaS, we really turned the model on its head because prior to SaaS, customers would need to call us when they had a problem. With SaaS now, we could proactively watch their alerts. And this has been a game changer just in and of itself because we're -- even if you give a customer 2-hour head start on a cyber incident, that's huge, right? In today's world, we're moving so quickly. And so when we came out with SaaS, we came out with that proactive IR. And then MDDR kind of augments that in a pretty big way. One, it has an SLA. So if we see ransomware, for example, we have 30 minutes to call them, right, and we also have built in transparency into our dashboards, our platform, so you can, at any time, see what our incident responders are looking at, what they've closed and why, what were the steps, which is a level of transparency that you don't get even with other managed detection services, much less nobody really has a managed data detection and response service. So -- and then I guess the last thing that's really important is because we're in SaaS, and we have these -- like the best analysts in the world. And if you think about it in terms of like the frequency of alerts that they deal with every day, it just dwarfs any average customer, right? There's just more activity there, and we can train using AI, we can do more automation to automate more of the steps that these best-in-class IR analysts are taking every day, making it more efficient. So if you add all that together, it's like we now have customers that will come see us at different shows and conferences and say, I looked at the dashboard. It's like you escalated 3 things to me over the past 3 months, right? And I see all the other alerts that you closed and how you optimize it and why? And it's just such a...

Not only an ROI, but it's making them feel more secure.

Yes. I mean, ultimately, nobody wants a breach, right? And if we're helping them protect -- prevent breaches, limit the scope and the contrast to customers that don't have us is so stark, right. A lot of times, if a breach happens, call in a very expensive IR service and the best they can tell you is patient zero, right, we don't know what data was taken, right? And just to even try to piece that together, it's -- and with us, most likely, you're starting to have a much reduced chance of a breach. The impact of the breach is much smaller. And if anything is accessed, we know exactly what that was. So you can determine materiality in a much more rapid pace and hopefully avoid it altogether.

I mean we could spend this whole conversation on just this. But I want to go back maybe to Guy. The SaaS transition has certainly been a key focus for you guys. And we think SaaS becomes half the mix within the next quarter or 2. I mean it feels like that's where it's going to happen. Can you talk about some of the progress that you've been making in SaaS and where you see that going in '25 and '26?

When we announced the transition, we talked about a 5-year plan, and we defined the transition to be complete when we get anywhere between 70% to 85% SaaS of ARR. As you mentioned, we expect -- we talked about 49% at the end of the year. Let's just assume we'll be roughly in that 50% mark by year-end. That puts us in a very good position to be after 2 years. And sometimes people kind of forget that we only started 2 years ago or less than 2 years ago. So when we look at 2025 and 2026, we want to move as quickly as we can because it's a better product, the value that we provide customers is much greater. It really is a no-brainer in that sense. But converting those customers over does require attention. And if anything, I think the -- probably one of the biggest misconceptions that we're getting from investors is that they don't fully understand how much additional bureaucracy is involved when you convert a customer from on-prem to SaaS. If you get a renewal that is an on-prem subscription -- an on-prem subscription customer, just providing a renewal could be a very simple exercise. When you try and convert them, you're actually changing contracts from an on-prem subscription contract to a SaaS contract. And therefore, there's additional legal department involvement, which puts obviously additional bureaucracy into it. We're going to do it. We're going to focus on converting our customers because of the value that we can provide them. But I think investors sometimes underestimate how much time it takes and how much it puts more pressure on the sales cycle in terms of the timing of our conversions. And when we come out with NRR, and that's a metric that we give out annually, when we come out with that number, [ Nick, ] when we report Q4 results, I've been very clear in conversations where NRR is not going to be a huge number. Last year, it was 107% on a constant currency basis. We expect that number to actually be lower than that. That's because of the time it takes us and the effort that's put in, in converting our existing customers, which means that when you look at kind of where's -- what's the driver of our growth being today at 18% ARR, it really is coming from new customers. So we obviously want to improve the NRR, and I think we have kind of the playbook to do it. But when you take that critical mass of customers and you're trying to convert them, that paperwork and that documentation and that -- it's not a technological issue. There's no issues in converting them from a technological perspective. It's just the fact that there's more paperwork involved in switching. And I said -- like I said before, we're going to do it, but it's just -- it takes some time.

What -- can you talk about some of the pricing uplift you're seeing when that's been successful? And to what extent has that been a driver of your growth thus far?

So the SaaS price list is 25%, 30% higher than the on-prem subscription when it's like to like the same number of licenses. We've seen very good momentum with our pricing where that 25%, 30% is holding nicely. And in some cases, when customers are actually converting and are consuming more of the platform, that could actually be slightly higher. But I think one thing to keep in mind, we've only converted about 1/4 of our base. So we still have a long ways to go. We obviously are focused on that. But when you look at that 25%, 30% uplift over 2 years almost and only 1/4 of them have been impacted, that means that you can see how much the contribution of the conversion is actually impacting your total growth.

It feels like that -- I mean that -- as the transition accelerates, I think we think there's probably some natural acceleration of the business. But it's interesting, only 1/4 of the business has actually converted thus far. I mean when you're talking to customers, David, especially when MDDR comes into the conversation, the 25% to 30% like-for-like is what you noted. I mean is that -- I mean, is that where the conversation starts? Or is that where it's sort of like, well, that's just to kind of get in the door and then we talk about further expansion beyond that?

I think that it's a core component of any new SaaS deal certainly and certainly is a core component of any upsell or transition opportunity. It's a big value-add. It's -- there's so much value add. The comparison between our self-hosted software, right, whether it's perpetual or on-prem subscription and what we've done in SaaS, though, there's a lot of things that we highlight. There's so much more automation in terms of the remediation. There's more -- there's so much more coverage that we have today than we did. I think we've come out with so much coverage just in the past few years. And there's -- I think the automated protection, the ease of use, the threat modeling that we have, it's -- there's so much to talk about and there's so much to like. And the fact that the customers don't have to manage the infrastructure is obviously a big benefit as well.

Yes. The other thing that stood out to me, I think you guys talked about having some success with Copilot in 3Q. You didn't quantify it.

I said it was an immaterial...

Immaterial...

But still closed a couple of deals.

How do you -- so I guess like double-click on that, like a year from now, like could it be 5% of ARR? Could it be -- is it -- like what could drive further adoption there?

We think AI is the real thing and the fact that it can actually -- it's here to stay, I think. I think everyone is kind of just starting to taste the impact of AI. We're definitely seeing the impact that AI has on risk and data being exposed. Think about it, if you had someone from the outside take over credentials, they had to search in the past to find the sensitive information. Now they just click whatever they're looking for and they get it in seconds. And you also have risk from within the organization, if they're searching for whatever they're sniffing around to find out they'll get the information if the sensitive information is not put in place the right way. So we've seen situations where people ask who got a salary increase last year, and they get the full list of employees within the organization. They got a salary increase. It's pretty scary...

Why would you not take that -- in terms of like what's the resistance to it? Is it just copilot...

I think -- but the one thing to note, and we've been very consistent in our -- in kind of the way we've looked at AI is that it takes time to be fully adopted within the organization. And I was -- I started getting asked about AI a year ago. And we said, listen, we're not seeing the full adoption within the organization. We're seeing it still adopted within certain groups within the organization. And until it gets to a point where it's adopted by everyone, not everyone is going to see the catastrophe coming. Some of the organization are preparing for it. So we're hearing the conversations. In Q3, we actually started seeing deals close, but again, it wasn't in a material number. Very hard for me to quantify how does this move forward from an impact perspective, but we do believe that it will have a major impact on -- as a tailwind for the business. Just very hard to know if it's 1 quarter away, 2 or 3 quarters away, but we definitely -- from a guidance perspective, we didn't bake any of AI into Q4. And obviously, as we finish the year being -- Q4 being the largest quarter of the year, we'll give more color in terms of the expectation for next year.

David, the -- we've been talking about competition for a decade. And like it felt like the market wasn't -- maybe it wasn't ready for Varonis a decade ago, right, in terms of like data governance, data security, and you guys were really evangelizing a category. Today, it feels like a lot of people are talking about your market. Could you talk about the competitive dynamics? And like now that you see probably more people in bake-offs, what are your win rates against maybe some younger companies that are coming at it like from maybe a different perspective?

Yes. We definitely have a lot more companies out there that are talking about data security, the focus on data, certainly from when I started, it's night and day. So that's nice because we don't have to evangelize the problem nearly as much as we had to before, if at all, really. Now I think we're being pulled into more opportunities because of that. There are more RFPs, more activity in general. And the good news is even though some of the players have changed, the song remains the same. It's -- when we go in and look at a sizable amount of production data with any kind of security lens trying to get to a security outcome, we're still alone. right? We -- I feel really good when there are a lot of paper tigers, right, out there, a lot of people that are marketing to it. But when it comes down to actually getting something done with respect to security, that's when we stand out. So whether it's a DSPM technology or stand-alone classification, they're doing a good job of talking about data and talking about the problem, but we have a really good shot.

I always think it's like the granularity that you guys get to is far superior. And then from a classification perspective, I think that's where you guys excel even versus some of the up and comers.

Yes. I think in terms of -- when you look at the problem at scale and how frequently data changes to keep up with today's environments and then to actually make sure it's locked down and to watch it for all kinds of threats and then automatically respond to those, wrap an MDDR service around that. That kind of depth -- sometimes it takes a little while for people to think through all of the advancements that we've made for so long in service of protecting data. But if we do a good job at the risk assessment, then we're going to start to understand that.

Yes. Guy, one of the questions that I get from people really across the software landscape is how do we think about '25 guidance? And you guys obviously haven't guided to '25 yet. You typically take a pretty conservative stance to start the year and end up beating throughout the year. Could you remind us about how you thought about ARR coming into this year from like a net new perspective and how that might help us think about some of the building blocks for '25?

Absolutely. When we guided for 2024 ARR number, we took the net new ARR that we achieved in 2023, and that was our starting point for the guidance for 2024. And obviously, in Q1, Q2 and Q3, we did much better. So it was nice progression, and we've accelerated our ARR to 18% this year at the end of Q3. So when you think about kind of -- and obviously, we're not guiding to 2025, we want to see how Q4 ends, but that assumption and the way we did the same methodology that we used in 2024 could make sense when we think about 2025 as a starting point.

Yes. That's kind of how we thought about our 2025 estimates. And candidly, it was pretty close to where we were before, but it feels like that's a pretty it's the right approach in this environment, but I think -- I thought that was a helpful framework. And then revenue follows from a lag perspective, what I think about it.

Revenue is a lagging indicator. We talked a lot about the fact that you can't really understand the health of the business through revenue. When you have such a big difference in the way you recognize on-prem subscription where 80% is recognized upfront versus SaaS that is ratable. So throughout the transition, we talked about 3 North Stars: ARR, ARR contribution margin and the free cash flow. And I think when you look at kind of the progression of ARR contribution margin, we talked in the Investor Day at the beginning of '23, we talked about an ARR contribution margin being 20% by the end of 2027. We're at 15% today. So we're really moving very nicely ahead of schedule. Free cash flow, we raised our guidance in the last earnings call to $95 million to $100 million. So -- and that's versus roughly $50 million of last year. So progression on both the expense side and the cash generation are extremely healthy, and they're an indication that we're not just focused on growing, but we're focused on growing in the right way where we bring some of it to the bottom line. Now granted, we don't want to put aside any of the opportunity, and we want to continue to invest. And if you look at Q3 net new hires, it was actually one of the largest numbers we've had in a long, long time, the additions that we brought in. So we're definitely investing in the business to capture the market opportunity. But we also want to make sure that we do it in the right framework and the right way. And ARR contribution margin and free cash flow are an indication that it's working well.

That's great. I'm going to ask one more and then we'll see if there's one from the group. How should we think about the strategic rationale and potential use of the convertible bond that you guys issued? I believe it was in September, was it September. Yes. Talk to us about that. What does that imply? Or how do you kind of think about that?

So our first convert that we took out in 2020 was -- is coming due in August of '25. So obviously, taking that into consideration, we want to take advantage of a favorable convertible market. But the essence of the convert, which now that we have it in place, gives us a lot of flexibility in kind of treating the first convert. But really, the biggest thought process behind the convert was M&A. We want to make sure that we have enough dry powder to use when the time comes and find the right opportunities that can help us grow the business. Now we're not changing the risk profile of the company. We're not going to go out and buy in crazy numbers. But there's definitely -- from an R&D tuck-in acquisition perspective, there's definitely a lot of things that we're looking at that could make sense and speed our time to market. Now we don't think that the M&A is necessary in order to get to the $1 billion. It's more like how do we continue to grow post that $1 billion mark. And in that build versus buy conversation, time is of the essence. We're standing today, and I talked about this before, the opportunity has never been greater. So we want to make sure that we take into consideration the time it takes to produce some of the stuff. And if we can make some shortcuts with M&A, we'll do it.

Yes. We'll see if there's a question out in the room here. Thanks Michael.

You guys talked about most of your growth coming from new logos, right? The 18% ARR growth versus the 107% NNR. For the new logo piece, when you guys win a new logo, is it typically -- there's nothing there. It's a homegrown solution? Or is there -- is it a competitive displacement? And just to follow up on Matt's question, do you guys talk about a competitive win rate?

So most of the time, when we go in and we do a risk assessment, we typically see a lot of sensitive data that's in unexpected places and also in harm's way, open to too many people, right, overly exposed. We also see that most organizations are blind to what's happening on their data as it happens. Think about it just a bank analogy, if you're -- it's like running a bank without a ledger, right, or a credit card without a record of the transactions. So in that sense, there's really no other company, no other technology that solves some of those problems and can automatically reduce the risk that's around data. There are adjacent technologies sometimes that we can retire that do little pieces or little point solutions, point auditing tools, point permissions tools, point classification technologies. point AD security things. There are some things that we can take out. But for the most part, it's a new technology. And I think the good news is the more that people talk about data security through the lens of DSPM or just data security in general, the more people are paying attention to it and more -- expecting a little bit more to focus on that.

And then you wanted to -- just a little bit more color on win rates. I think you said...

Yes, you guys talked about [indiscernible]

If they're testing any kind of production data with any kind of scale, it's rare for us to not win that.

And one more thing to add, and we talked a lot about the fact that -- and we talked about it in Q2 and mentioned it as well in Q3, with the MDDR, we've actually seen sales cycles for SaaS shortened compared to what they were on the on-prem subscription side. So that's a very healthy kind of trend that we hope can continue.

Have you talked -- my head is like spinning with this week. Guy I can't recall, who talked about MDDR is still early. Have you talked about number of customers that have adopted it or any sort of...

We haven't broken out the adoption of it, but we said it was really the fastest adopted -- I call it platform because we're not selling a service, we're selling a platform, but it's the fastest adopted platform that we've ever had.

Yes. You've got some rapid adoption of other products, too. So -- maybe with just 90 seconds to go, there's -- what I've liked about Varonis is it feels like there's a series of S curves that you guys are always sort of like -- you don't have to hit them all. You're trying to hit a number of them concurrently, though. Maybe, David, from your -- you talk to customers every day, like when we're sitting here a year from now, you're going to be like, Matt, like I was really surprised that x happened from a customer. Like what do you think that -- what do you think that could be that positive surprise with sort of all the irons that you have in the fire today?

Well, I think there is an increased focus on data and data security. I think AI, for example, has added a new focus, a new light on the problems that we've been solving for a long time. So there are a lot of forces like between the DSPM markets, right, the other marketing and between AI that are putting a new spotlight on data. And that is going to naturally lead, I think, to something that's going to solve the problems around it, right, something that automatically can protect data at scale, something that can watch the data for them and protect them from breaches where they just have to pay, right, they don't have to add staff. There's -- I think there's a lot of pressure on the problem right now. And we'll see how it plays out, but I think we're in a really exciting spot.

And then maybe, Guy to close, you've kind of helped us think about an ARR framework. You mentioned you're investing in the business. How do we think about kind of balancing growth and profitability when we think about like ongoing margin expansion?

The opportunity, as I said, has never been greater. So we want to continue to grow. At the same time, we want to show improvement year-over-year. Now it can move sometimes from one quarter to the other. If we see something that is -- we feel is worth investing in the short term that can help us in the long term, we'll take that into consideration. But the framework of that 20% ARR contribution margin is an aim that we're trying to get to still stands intact. So that's kind of the framework.

Well, this is -- I think the 10th year we've done this now. You passed your 10th -- I forgot it was in February. So congrats on the first 10 years of a public company and best of luck for the remainder of this year. Thanks again for the time.

Thank you very much.

Thank you.

Thanks guys.