Varonis Systems, Inc. (VRNS) Earnings Call Transcript & Summary

Excited to be hosting the management team from Varonis here, David Gibson, SVP of Strategic Programs and CFO, COO, Guy Melamed.

Thanks for having us.

Thank you for being here. I appreciate it. I want to jump right into the discussion and maybe just to kind of level set with everyone. I think most folks here are very familiar with the story. We've been public for 12 years. But at the risk of maybe starting to high level. For those who are newer to the story, Guy and David, maybe you can give us a quick overview on how the core value proposition of the business has essentially been turbocharged in the AI era?

Yes. So Varonis started in the data security space, as everybody is familiar with. And these days, enterprises have data in many different places, on-prem, in the cloud and SaaS applications. And we've been helping them protect that for a long time. And when I say protected, -- we find all the important data, lock it down, monitor the heck out of it. And that's kind of the core value there. You talked about the turbo charging. -- as we've expanded the offering in data security in the AI security and e-mail security. It gives the story a lot more. It gives us a lot more to talk about. And I would say probably the highlight is people are definitely in the building phase of AI, people have agent, the agent population is exploding. People are doing much more with AI than they ever have. . And in order to get value out of AI, they need to connect it to data. And we've seen a lot of stuff in the news about Mythos and hugging face and I think people are realizing that in order to protect data in the age of AI, there's much more control that's needed, understanding what AI they have, where there are risks, where it might be misbehaving and then what's happening, how is it touching data? How is that going? What could it do? How do we make sure we're limiting our exposure there. And so there's a lot more, I think, attention on all these problems, and Varonis is in a unique position to help organizations solve these problems.

I want to add to that, if I may, just from 1 of the important items that is worth emphasizing, we announced a transition to SaaS at the beginning of 2023. -- and we are really going to be 100% SaaS by the end of this year. This transition has been a very interesting ride. But in terms of the value proposition to our customers, it's been providing automated value to customers in the way they've never received before. And I think 1 of the items that have shifted kind of the way customers think about our product is that in the past, we would give them the solution, but they had to manage it. And that was extremely difficult, especially in this environment where the hacking environment is increasing by the day. And with AI today, you don't even need malicious intent from an employee in order to access sensitive information. In the past, they had to try and find where that sensitive data is if they wanted to access it today, all they need to do is go into the chat box. And if that's open to everyone who got a salary increase on steer if that information is open to everyone in the company, they'll get it within seconds. So the whole environment has changed. And with our offering, and there are many companies that have gone through similar transitions many of them had similar offerings on the SaaS and the on-prem. So they could kind of drag that transition for a longer period of time. Our SaaS offering is in orders of magnitude better than the on-prem subscription offering, which is part of the reason we wanted to rip off the Band-Aid and we called -- we announced the end of life on the on-prem subscription, which the data is at the end of this year. So when we think of kind of the evolution with our customers and how they see the value now, you don't give them the software and you let them manage it. You basically say we're talking about outcomes. We will make sure you don't have a data breach. We'll make sure that you don't have any fines, we'll make sure that you can utilize your AI in the most efficient way. And when we talk about all of those components, and we can talk a little bit more about the NDDR later if you'd like, but basically kind of changes the whole value proposition and the simplicity of our offering as well.

So you just finished out your second quarter reported results about 6 weeks ago. So just from the standpoint of some of the commentary around the SaaS transition, the momentum building, key milestones around end of life. Would love to kind of get a look back and a recap of the highlights of 2Q. And as you're thinking about the remainder of the year, expectation setting in terms of certainly, financial guidance, but also customer behavior in the environment that we're in right now, buying behavior and then certainly the portfolio expansion that has happened over the course of the last year in e-mail and database monitoring and AI. I would love to have you unpack some of that as part of the Q2 recap and what we're expecting or what you're expecting for the rest of the year?

We completed an acquisition in Q1 of 2026 of Atlas, which is basically kind of the AI component and David can talk more about the capabilities and how much value it provides customers. And we have seen kind of that starting to pick up in terms of kind of the leading indicators that we're looking at. We saw nice contribution in Q2, but not anywhere close to where we think it could be. When we track kind of the meetings and the conversations that are coming up on this subject with our customers, it's definitely coming up almost every conversation. So definitely something that we expect will have a larger contribution in the second part of the year. I think the Q2 results were healthy. We actually wanted to do even better than the print that we provided. We did talk about some of the noise that was impacting kind of -- it wasn't so much the noise itself, it was the timing of when things came out that generated some promotion. But the way we started Q3 and kind of the pipeline and some of those deals that we were able to close gave us the confidence not just to look at the full year guidance with the actual beat of the Q2 number, but actually raise on top of that, some of the deals we were already able to close. We're tracking in a healthy way. Just to keep in mind, we are back-end loaded similar to other enterprise businesses, but we have a good start for the quarter, and we feel good not only with kind of where we are, but also in terms of the pipeline that we have built, we've gone upmarket. And when we look at kind of where we can land within those larger customers, the value that we can provide and the platform offering has expanded significantly, which gives us the ability to land larger deals but also go back to those customers and sell them additional licenses later. So MDDR has somewhat become kind of the glue. It's offering and its simplicity and the value that it provides customers is definitely something that has made the whole conversation with new customers much easier. And we saw very healthy growth on the new customer side. So definitely something that gives us confidence going into the second part of the year.

If I can double click on something that you said. So some of the press speculation around change of control, created promotion and noise in some of your selling conversations, right? So just to be abundantly clear, how much of this transaction activity or deal slippage was realized in the quarter. And to what extent have you successfully recaptured some of that now that a lot of the noise has died down in your third quarter?

So we were able to close some of it before we actually reported on the Q2 results. And that was part of the reason that we were able to raise our guidance above the beat. I want to be very clear, our guidance philosophy for Q3 hasn't changed even with that raise. So it wasn't like we were stretching on the guidance side, and we kept the same conservative guidance approach that we have done in the past. But the fact that we were able to close some of the deals already going into the reporting date gave us the confidence. We do expect that much of those slippage deals will close this quarter.

Third quarter is also an important period for public sector activity, U.S. Fed. in terms of their fiscal year ends. I think you all have worked pretty hard to get your accreditations into the government in order to be able to have a more robust presence in the federal government. Can you give us kind of a time series of your success in Fed ramp, Gov Cloud, DoD type certifications, where you are and how we should generally think about what you have embedded from a public sector business activity standpoint. And I think it's an important conversation simply because last year was challenging for anybody who is selling into the federal government basically up until earlier this year because of some of the dog activities and things like that. So now that we're fully lapped over some of that noise from the buying the buyer perspective, how are you coming to the table with the right certifications and what do you have sort of embedded or anticipated in your third quarter outlook?

We have FedRAMP moderate. And I -- let me start from the headline. We haven't done as good as we expect to do on the federal business over the last couple of years. the potential is there, the opportunity is there, the need is there. We haven't cracked the code yet in the right way. It doesn't mean we don't want to continue to try. But I think what we -- we made some changes this year, nothing from an optimistic perspective on the federal business is baked into any of the guidance. . So we have low expectations. And hopefully, we can do better. But let's see the numbers first, and then we can give color on that. But that's -- that doesn't change the opportunity itself. It's not that the product isn't needed there. There's sensitive information in the federal market that we need to cater to. We have customers that are already -- so we do know that some of the customers that are on-prem will not convert. And that's baked into the number that we provided at the beginning of the year that we know will churn, that's fine. We want to be 100% SaaS. We understand the additional costs associated with managing 2 types of code, and we just don't want to be there. We want to be where we can provide the most value to our customers. So we have definitely made the investments on the federal market. We want to see some of the returns kind of take place. We haven't gone through the FedRAM certification being high yet. But if we see that the opportunity is worthwhile, we can reconsider that.

You've been talking about and evangelizing and providing a solution for the data security problem before it was cool. And now it's just -- now it is in everyone's consciousness, right? So can you talk about the levers of growth and growth acceleration here? And perhaps historically, where there was a tie into, hey, an organization is moving to Microsoft 365 and they need to protect their data estate and data sprawl around those systems. Can you talk about how you sort of benefited from the ascendant in that migration. And then beyond that, the growth and proliferation of other data stores where there's critical enterprise data and how the business in the R&D capacity and the support for these new data stores has expanded in so far as hey, you are supporting and monetizing Snowflake environments and data environments. And I know these things have been a very healthy stream of announcements for you in terms of reducing your dependence on the Microsoft ecosystem, so to speak. So I wanted to get a flavor in sense from you on how much of that has been powering this incremental demand for your core value proposition?

Yes. The -- I think -- the headline is that if you've got an enterprise data store, chances are, we support it, and we've probably been supporting it for a while. And when we say support it, the depth of our visibility is pretty significant. We're talking about what's the important data inside it? How is it controlled, like who guys access to stuff and then who's using it. And that's really kind of what goes into the visibility that we have. With that visibility, we're able to see data in harm's way, understand how to fix it safely. And that's where the automation in our SaaS solution has really helped because we can then go fix stuff safely without customers having to do stuff. And then we monitor it and we're able to monitor it where they don't even have to look at the alerts. We can call them if -- that's our job is that we call them if there's something that we think they need to know. That's the MDDR service, right, within SLA. So the way that this has really helped us is through our kind of quarterly process that we go through, we call it a quarterly business review with every customer. We want to meet with them at least once a quarter. and go through, here's what we've done over the last 90 days. Here are the things that we found 90 days ago, the things that we fixed here are the ones that we plan to do next quarter, right? And by the way, here's we understand you have snowflake. We understand you have data breaks. You've got a new RAG system that's making use of these databases. Whatever the data store is, we can have that conversation and kind of earn the right to do a risk assessment on some of these other data stores. These days, it usually also includes like an AI assessment as well with Atlas -- there's so much more. We talk about the database activity monitoring, we can talk about e-mail, but any 1 of these solutions can be then part of our conversation, and we can do a risk assessment and see prove the value. And I think the interesting thing is all of these data stores are controlled a little differently. There's no like standards. Some of them have masking. Some of them have different kinds of groups. Some of them have different entitlements. You've got to even just the AWS and Azure and Google Cloud, right? The permissions like AWS and Google have a lot of similarities, but Azure is very different. There's the more places you have data, the harder it's becoming for security teams to really understand how it's controlled. So being able to have 1 pane of glass that can cover all these data stores and perform these functions becomes very strategic. And then again, when you couple it with AI, that's where it's very differentiated for us. There's really nobody out there that has control over both the AI side and the data side like we do.