Varonis Systems, Inc. ($VRNS)

All right. Good morning, everyone. Thank you for joining us. My name is Brian Essex. I'm JPMorgan's mid-cap large-cap software analyst. With me today, I'm very happy to have ones. We have Guy Melamed, the CFO and COO. And then we have David Gibson, SVP of Strategic Programs on the end here.

Good morning.

David, thank you for joining us. We appreciate it.

Thanks for having us.

Maybe a great place to kick off is on the results of the quarter. Would love to understand maybe just a quick summary in terms of like where the outperformance came from? And how are you managing the outlook given what we've seen in 1Q as well as second quarter so far.

So you're right, Q1 was definitely a good start for the year. We were very happy with the performance. It was very much driven by new customers, definitely saw a very nice growth there in terms of the number of customers. And this was something that we talked a lot about with kind of the move during the transition to the part in 2026, which is really kind of the last leg of the transition and the fact that the reps now can focus on what they know best, which is selling to new customers and upselling to existing SaaS customers. This was something that they had to -- they really didn't have that opportunity in 2025 when they were focused on the conversions as well. So in 2026, this was a change that we made that I think kind of helps us go back to basics and something that we're happy with kind of the results that we saw in Q1, and I hope we can continue to see that in the quarters ahead. But overall, from a conversion perspective, I think we're kind of tracking as expected. New customer, as I mentioned, was healthy. I think we can -- one of the interesting parts of the quarter was the contribution that wasn't material in dollar terms, but in terms of conversation and focus and desire of customers to know more about the Atlas acquisition that closed actually in February, so it didn't really have a chance to have an impact in the quarter itself, but definitely generating a ton of momentum from a pipeline perspective. David can talk more about what [ he ] is hearing with customers. But I think those are kind of the frameworks of the quarter for people to understand.

Very helpful. Where do things land out in terms of quota attainment versus maybe what you planned? And how aggressive are quotas given that you're just coming off with the transition?

Just to give some background, very similar to other software companies, Q1 is the smallest in dollar terms for the year, and Q4 is usually the largest quarter in dollar terms. So Q1 is still, I'd say, a smaller sample. But when we look at the attainment, it was very encouraging. It was better than previous year from a percentage perspective in terms of being on track of reaching their number. We -- I wouldn't say we were aggressive. I think we're very fair in kind of the way we position commission. In the essence, the highlight that we trying to make sure that we live by is that we win together and lose together. So reps that do the right thing and can achieve in the proper way can make money. But it's never a layout. So we definitely try to balance that. And I think that the results in Q1 were encouraging.

Yes. And from a hiring perspective, given what you saw in the first quarter and maybe we've seen so far, how do you feel about hiring for the year? And what is the plan? How mature are the reps? And how do you think about building out that organization to get you more better market penetration capability.

So we're definitely hiring in the right spots and in the right locations. There are places that we feel that we're underpenetrated. We're also managing out the underperformers. And I think that's always been the case to make sure that you don't have people that aren't delivering what they should be delivering and just sitting on the payroll. So it's always kind of a managing -- a balancing act, and I think we've done that well so far. The expectation and planning from our perspective is to continue to increase the headcount, but it will be done in a measured way. And obviously, taking into consideration what are the growth rate expectations and making sure that we can -- overall hiring percentages should be below the top line growth.

Got it. And then maybe, David, on your end in terms of customer conversations. It's been really interesting. I've been hearing a little bit more frequently with companies and partners and industry participants. I've talked to over the past couple of weeks that after Mythos came out, people just freaked out. How would you describe from a macro perspective and a demand perspective, has that had a meaningful impact on your pipeline? And how are companies thinking about spending on the Varonis platform now versus maybe last year when it wasn't such a material issue.

So I think Mythos was quite a marketing event, and it got people's attention on the fact that AI is going to help find vulnerabilities for both good guys and bad guys. And so what are we going to do to defend that. The cyber adverse areas are becoming more and more sophisticated all the time. I don't think it necessarily changes what people will do, but how quickly they might do it has changed with the awareness of what's happening there. And it's not just Mythos, right? It's all sorts of frameworks and models that are going to be good at this. What I think is bigger, though, is the desire to implement AI for different business processes. That is more active, I would say, in our conversations is how are we going to connect our AI systems and the ones that we want to build safely to data. And that's been really the most exciting thing for me over the past few months is how many conversations we're having about AI security and the data security because I believe these are 2 halves to what is the problem of our time.

And I think we've hit on before in previous conversations that data security can be a bottleneck in terms of adoption of generative AI technology within an organization. Where are your customers along that journey? Are they still -- I mean, we've heard a lot of cases that we're still in the experimentation phase of adopting generative AI, but hearing more use cases where you're starting to get a little bit more influence towards moving to production. What are you seeing across your customer base in terms of like where they are in that scale of or that continuum of adoption?

I would say they're all over the map. But over the past 6 to 9 months, the momentum has clearly changed. AI has stopped being a curiosity and is now a necessity. It is existential I think, for organizations to really survive and compete now that they adopted. But what -- it could kill you if you go too fast and it can kill you if you go too slow, right? So it's a tricky time, but more companies -- first of all, every SaaS vendor now has an AI component, right? So people have to assess the third-party risk. What are you doing with their data, what models are you using? Are you training on our data? There's a whole litany of problems that -- and questions that they're asking, but they're also starting to see people create their own agents. Co-Pilot studio is now available if you have copilot and people are creating agents. What are these doing? Yes, we want more advanced functionality. So let's start doing the scheduling, start building the tool age. People are realizing that the number of agents is going to start creeping up and potentially creeping up very quickly. And these agents are nondeterministic right, meaning you can give them the same instructions multiple times, and they'll do a different thing each time. Very hard to scope them, very hard to predict them. We have to watch what these agents are doing. We have to understand the intention of the agents, what were they trying to do, and we need to understand the downstream effects on the data that they're touching. So the biggest problem is how do we connect to the AI systems to our data safely. Right now, if you -- when you ask where people are, I think we see about 3% of the data that people have is connected to AI, right? So that is -- there's a long way to go there, but there's some urgency. If you think about how good AI has gotten at coding, and you think about, well, why is that? Well, it's got this whole library of the Internet, open source code, right, to go train on, right? It's only as good as the data that it's trained on.

Got it. Super helpful. Maybe Guy, I want to ask you on the conversions. It seems as though you're taking a little bit more of a, I don't know, approach of flexibility in terms of pricing with conversions. I know before you've talked about this uplift that you get from conversions, it seems as though maybe the or the intention has been get them converted and then worry about the uplift later. How should we think about the mechanics of that and how you're managing pricing and uplift and attach for customers that do come over and convert?

You're right. I think the way we have treated the conversions definitely changed post Q3 of 2025. I think when we look some of the lessons learned from that quarter is that some of the customers that were left in the bucket that haven't been converted where, apart from being federal and state and government that some of them will never move to SaaS. They are the single-threaded customers that wouldn't necessarily rush to convert the SaaS, and we have kind of changed our mindset as to the fact that we would like to get customers to move even at a flat rate. And then show them value with the understanding that we can get additional uplifts. That's definitely been the case in Q4 and Q1, and I expect that to continue for the rest of the year. The framework that we have provided to The Street in terms of the conversions is really a bear case and a bull case, having kind of that $50 million on the lower end and $75 million on the upper end. I expect that we will be somewhere in between. We're using the base case of the midpoint there. It's not a framework that is similar to the other KPIs and guidance that we provide that is usually a starting point, and we expect to do better on the conversion, it really should fall somewhere in between. That's the expectation from our perspective. And I think that the other thing that is really important to note is that the announcement of the end of life that happened in Q3 did generate a sense of urgency in the conversations that we're having with customers. So the fact that we kind of did that has helped us convert in Q4 of last year. And I think that the conversions that we're expecting to see this year are definitely influenced by that announcement where customers need to understand. Are they staying with the on-prem or are they building a plan with us on how to move to SaaS. And we've definitely seen some of the customers that wouldn't that urge to move with the announcement, building a plan with us on how to do it.

And how do you think about -- you guys had guided to no conversions expected in 1Q and you had some and you have this cohort of customers that are yet to convert you got government quarter in 3Q, you've got a lot of renewals in 4Q. Where are your customers' mindset on that conversion path, given the seasonality that you might expect in 3Q and 4Q?

So I want to be very clear. The fact that we haven't guided on a quarterly basis on the conversions themselves. It doesn't mean that we're not expecting to see [indiscernible]. And the reason we haven't guided on the conversions on a quarterly basis is, one, we want to make sure that investors are focused on the right metrics. And SaaS ARR, excluding conversion is the metric this year to focus on the conversions can fluctuate. And therefore, we didn't want to put a number out there that could distract and generate a lot of noise. We are expecting a good portion of the conversions to happen towards the end of the year. There's definitely conversations with customers even if they are up for renewal. We saw that in Q1, and I think that's going to happen in Q2 where customers that are up for renewal and are thinking about converting still want to take another quarter or 2 just to be ready from a budgetary perspective or just kind of the process of getting them converted and they would focus on doing it in Q4. So if I had to break down kind of the seasonality of the conversions throughout 2026. I would say that Q3 is probably the quarter that would have the lowest conversions because of that federal state and government customers that would -- you would see that impact there. And the expectation is that a very large portion of the conversions will actually happen in Q4.

Got it. And then maybe more from a macro perspective, we're hearing a lot about spending outside of traditional security budgets. That could be other parts of an organization that have AI initiatives that maybe need to think about security. But their CSOs are saying, okay, I'll run that for you, but you pay for it. You've also got certainly post Mythos in GPD 55. I think you've got some emergency spend being tapped, and there's a greater sense of urgency, like are you seeing that within your customer base? And within those categories, are you seeing any meaningful upside surprise from spending from your customers or if you have that kind of visibility?

I know I've probably done more demos around AI in the past couple of months, then than anything else and certainly the volume is unlike anything I really remember in terms of the activity there. I think that the -- one of the interesting things is just we have a broader audience of that are vested and interested in making sure that people can deploy AI safely and also keep themselves the fact that attackers are using AI and that the -- seeing all the combinations of fishing and fishing attacks. We've seen a lot of the Internet-connected SaaS application, a vulnerabilities. There's some pretty sophisticated attacks going on. But I think the biggest thing is that the -- what I mentioned before is that in order to compete the AI must be deployed and security is now partnering with business units to make that happen, right? So there are more stakeholders. There's, I think, a little bit more urgency around, okay, what we knew -- what -- we need to drive faster, so we need better breaks, right? So this is just a -- just to use a very simple analogy. And so what's going to give us the confidence that we can drive more quickly.

Got it. I want to touch on Altru and Atlas really quick. And I think you referenced that Atlas upside, not in guidance, but what do you anticipate we could see for ARR contribution over the next rest of the next year or so.

Again, it's very early still to kind of put a number to it, but there's a lot of encouraging signs in terms of the conversations and the meetings and the evals that customers are wanting to have through this product. I think it's very much the understanding that you cannot be protected from an AI -- with kind of the AI evolution without kind of software that can help you do that, and that's why we're seeing so much interest. As you mentioned, it's not part of the guidance. That's part of what we expect would be some of the uplift. And I think the expectation is that some of this pipeline that we're generating can close in the second part of the year. So not all of it is going to have that much of an impact in Q2. I think it would be more of an H2 impact. but definitely encouraging in terms of the conversations and something that we're keeping a close eye to make sure that we can monitor it properly.

Got it. Any insight around ServiceNow and how they became a partner or a customer and what the rationale was and how that might influence or be an indicator of traction for the rest of the year.

So first of all, ServiceNow is a phenomenal company, and we've been in touch with them for quite some time. We've had very -- we had a lot of discussions on how we can help them, they can help us. And I think there's a lot to the partnership that can evolve. So we're extremely happy to have sold the additional licenses to ServiceNow, and this was an expansion of them already being an existing customer. And I think there's a lot of a lot of things that can work in the future that could help both companies.

Got it. I want to touch next on FedRAMP in the federal business. Obviously, federal source of -- a little bit of frustration in the third Q. But now that you've hit -- you've achieved FedRAMP authorization, how is the pipeline looking? You have a good amount of visibility, particularly into 3Q and how meaningful of a contributor to ARR do you think that business could be?

I'll be very careful when I talk about upside from the federal business. But I would say that, first of all, from a guidance perspective, we don't have any upside baked in, and there's no optimistic assumptions. We definitely believe that we can help solve that problem. But from a numbers perspective, we first want to see the contribution. Yes, there's a pipeline and there's deals that we hope we can close, but I would love to talk about them post closing and not preclosing, if I may. And from a -- again, from a guidance perspective, it is important to emphasize that for the most -- what we haven't baked in any optimistic assumptions on federal.

Got it. Maybe for David. I want to talk a little bit about DSPM, particularly on the competitive front. It seems like everybody has it, and not all DSPM is created equal. But in general, I would love to hear what you're seeing from a competitive standpoint, whether it's from larger vendors like a Microsoft purview or some of the smaller vendors like Sierra or a big ID. Where do you guys fit in? And how are your win rates versus the peers compared to maybe last year?

Sure. So I would say, from a DSPM perspective, I think what's become pretty clear is DSPM as a subset of a data security platform or a data security strategy. It's visibility only. and it's usually limited visibility. It's usually a sample of data on a schedule. And so when we see -- the good news is I think it's generated opportunities for us. We've seen definitely more RFIs and RFPs where we had I would say that the conversations now are shifting more towards the AI front, more towards the database activity monitoring more towards our platform plays. When we do see RFPs for DSPM, we generally will see, of course, it's an RFP, it's a competitive situation that's what it is by nature. So we'll see any of the DSPM players, the Sierra, big ID. And usually, if there's a data security component, we have a very good shot of winning if we execute. the use cases that are security-centric, complete scanning, always current based on activity, the threat detection, the automatic remediation of any issues that we find. These are big differentiators from a security perspective. And so I would say this is one area, of course, where we'll compete. The platform play, our coverage really help us. I think that if we can just asked a question, tell us about what's going on with AI and we start to bridge into that conversation. And it's interesting if we talk about AI and you're going to connect it up to databases, what's monitoring your databases? Well, we have a solution for that now too. It's -- the platform strengths start to really benefit us and change those kind of sort of tactical competitive scenarios.

Got it. Super helpful. Maybe I also want to ask about e-mail. It seems like traction has been pretty robust on the platform. Like how are your customers linking an e-mail purchase to the rest of the platform? And who are you seeing competitively on that side of the business?

Sure. So it's interesting that -- the way we got into e-mail security is since we came out with SaaS and our managed data detection, MDDR service managed data detection response service, we've had a front [indiscernible] dozens of breaches a day. And we about most of them, about 7 out of 10, we detected at the identity layer, 2 out 10, we detected data and 1 other tenant at the network layer. But didn't -- it doesn't matter where we detected it. When we started to say, okay, what was the point of entry here? How do they get into the first place. Most of the time, it was identity compromised through phishing. So we started to ask how can we keep attackers farther from the data. And we looked at all the different solutions out there, and we found one that was head and shoulders above the others and it's called next we acquired it, and it's a very natural extension, right? If you think about how it connects with our managed data detection and response service. It's kind of natural when people -- when we're detecting, hey, somebody -- you got fished, right? Like we could have stopped that. The headline, I think, is it's a 15-minute install. We do a 2 month or so look back of all the e-mails in your environment, and we find stuff that your other solutions. So whether that's an abnormal or another solution, there are many kind of API-based e-mail security solutions out there, cast. There are many of them out there. But so we can kind of show that there's evidence that it's got better efficacy and it's connected to our platform. So we have some leverage there. It can start to make a lot of sense. So it's a pretty easy thing when, "Hey, at worst, it's an assessment of your e-mail systems. If we don't find anything great, but we always do.

To emphasize what David said, though, it has to be seen in the context of the platform. This is not e-mail security as a stand-alone that was never the intention. And when you look at the offering, it works really well with the MDDR and the platform protection.

And you mentioned identity. How important is it to link identity to ownership of the data? And how do you see that evolving, given that I think some of the identity vendors, at least one is talking about moving into the data space a little bit. How do you see the way that you're partnering with some of the identity vendors to link the data to ownership of that data?

Well, we got there from the data side, right? So we've always had some. If you're monitoring a Windows for environment, you have to see what -- how they logged in an active directory, for example, right? You have to see the active director groups. But we've broadened our coverage of the identity space. So we see not just the configurations, but also the authentication telemetry. It's been really, really valuable. Usually, when an attacker has an identity, they try to move laterally and get more identities, authenticate to different systems. So it's been a very natural extension for us to have that telemetry from a threat detection standpoint. And our -- because we've been watching identity and data for so long, we have really good detection metrics there. I see it as a natural thing for people to start talking about because they're realizing in an agentic world, the identity model is completely different. How are we going to track what accounts are these agents authenticating with? Do they have their own identities? Are they acting on behalf of the user, how do we track that? When we have multiple agents, how do we attenuate their permission. So we can make sure that we're not exploding our blast ratings with each of these agents. So identity telemetry monitoring identities is an essential part of the AI and data security stack. We've always had that -- it's almost the glue between the layers.

Got you. Guy, I wanted to ask you a question on fundamentals. How should we think about free cash flow guidance this year as well as where margins are relative to some of the long-term targets that you previously talked about particularly for fiscal '27. I think there's an ARR target and some profitability targets. Maybe help us bridge the gap? And how valid are those? How valid is that target model at this point? Is that off the table or still in play?

So let's talk about when we initiated the targets in Q1 of 2023, just when we announced the transition to SaaS, we built those 5-year plans in terms of ARR, free cash flow. -- an ARR contribution margin. I think most of the investors were really skeptic about our ability to generate free cash flow in the early years of the transition. And when usually you're investing the most. And I think we were extremely happy. I think it has to do with the way the SaaS platform was built to actually be able to show free cash flow improvements over the last if you look at the last couple of years from 2023, we've year-over-year, progressed very nicely. And if you look at the AR contribution margin, at the end of 2025, we were basically on the cusp of reaching the long-term model on the lower end of it, but actually being 2 years ahead of schedule. So I think from an indication perspective, we have done everything in the right way and have been able to prove that we can generate free cash flow and improve that over time and get to the operating margin levels that we wanted to be in. Obviously, with kind of the announcement of the end of life on the understanding that some of the customers will not convert. There is a bit of a headwind, which is reflected in the 2026 numbers, but the expectation is that in 2027, as we are basically 100% SaaS ARR we kind of go back to the levels. And I think that from a modeling perspective, there's a ton of leverage in the model that we can benefit from. We've already showed some of that ability in the first couple of years of the transition, but I think that you can see it even further once we're done with the last leg of the transition. So we see the path of how to get to the -- both the top line number and DARR contribution numbers and free cash flow. Obviously, they all go hand in hand, but the expectation is that if we execute in the right way, we see the path of getting there.

Got it. And then maybe on the capital allocation front, I mean, you've been pretty acquisitive over the past couple of years. We also announced a share repurchase agreement. -- how do you think about utilization of that agreement as well as allocation of capital as we kind of work our way through the rest of the year?

There are 3 components that we always constantly evaluate in terms of capital allocation. One is putting back in the business. The second one is the M&A side. And the third one is giving back the investors through the buyback. I think we've done a good job of managing those components. We made the tuck-in acquisitions when we felt that it could generate ROI in the years ahead and both the e-mail security and Atlas are definitely components that can help us post the $1 billion ARR mark. So we're definitely happy with those acquisitions. We constantly evaluate. I wouldn't say that there's -- from an acquisition perspective, we're looking in the same framework that we were looking in, in a year or 2 ago. So we're definitely trying to digest them and make sure that we can execute on them in the right way. But if something comes in, there is a small tuck-in that would make sense in terms of the road map. And obviously, it would be in that constant discussion of build versus buy, what is quicker, what's the better ROI, does it make sense, we will evaluate. But I would say that the framework is, I would say, less on the M&A side from our perspective right now and more on making sure that we can execute in the right way. And from a buyback perspective, I think we -- the announcement that we made was definitely a testament to our belief in where this company can be in the years ahead.

And on that buyback, I mean, is that active now? Is that on a grid? Or is it more opportunistic in nature? So we put the buyback plan at $150 million and gave 12 months. We did the vast majority in -- by the end of Q1. So with obviously definitely constantly evaluating whether another plan is -- should be put in place and what is the best capital allocation. So we do that analysis on a daily basis.

And maybe 1 more minute left. I want to see if there are any questions from the audience to get you with. Maybe 1 to follow up on that. You guys were 1 of very few companies where management bought shares in the company recently in the active market. Maybe the -- any insight behind that, what drove that and how management team overall might think about additional acquisitions of shares?

Someone told me once a very interesting sentence and the sentence goes as follows. There are many reasons to sell shares. There's only 1 reason to buy shares.

So that's well put. Awesome. With that, I think we're about out of time. So Guy, David, thank you very much for joining us. We really appreciate it.

Thank you very much.