Well, hey, good morning, everyone. Welcome to day two of the Barclays Tech Conference. My name is Saket Kalia. I cover software here at Barclays. I'm honored to have the team with us here from Varonis. We've got Guy Melamed, Chief Financial Officer and Chief Operating Officer, right? And we've got Brian Vecci, Field CTO. We've got about 30 minutes together. Let's spend the first 20 minutes or 25 minutes just going through some fireside chat with the team, which I know is gonna be fun. And then we'd love to make this interactive. Anyone that's got any questions, just pop up your hand. I think we've got a mic runner in the back. So Guy, Brian, thanks so much for being with us here today.
Thank you.
Thanks for having us.
Wouldn't be a conference without you guys. Guy, maybe just to start, can we just make sure we're kinda level set for everybody in the room, what were some of the key points that you wanted to make sure investors took away from the Q3 earnings, which I thought was very eventful, given everything that's happening here? Just maybe if you could summarize for us.
So for those that don't know, we announced the transition to SaaS at the beginning of this year, and we're three quarters in. We talked about kind of three North Stars that would be the indication of how the business is performing. One was ARR, second was free cash flow, and the third one is ARR contribution margin. When you look at how quickly the transition has been taking place, it's been extremely encouraging. It's actually exceeded our expectations. I think the overall theme and the reason for that is because SaaS is a better product. So customers are embracing and wanting to buy the SaaS product, be better protected. We're seeing existing customers convert at a higher pace than we really thought, and we can talk more about that later.
But I think the overall kinda highlight was the fact that we got to a point where 15% of our ARR is now coming from SaaS, and that was a 5% increase, which caused a lot of questions from investors, because when you kinda just do the extrapolation of that 5% going forward, the calculation is pretty obvious: that the five-year plan that we laid out in the Investor Day should be revisited at the end of this year, and we told investors we'll revisit that kinda timeframe. So I think the 15% ARR coming from SaaS was a highlight. The fact that existing customers are converting at a much larger pace than we really... Without really focusing on it, it's happening in a natural way, which is extremely encouraging.
I think when you look at the cost structure, we've been able to keep the cost structure and the level of expenses in a very, very healthy way, generating free cash flow at, at meaningful levels. We're guiding now to $40 million-$45 million of positive free cash flow, and that's compared to about flat last year. So even during a transition, and the, the first part of it is where you make kind of the larger investments, we're able to control the cost and generate cash in a meaningful way. So I think those are kind of the highlights.
Yeah, absolutely. And I've always looked back to those three North Stars that you laid out at the Analyst Day. Been so consistent ever since, so, it's really good to hear. Brian, maybe you can add some, some customer color to that, because I know you spend a lot of time with customers.
I do.
As you speak to them, you know, that are either converting to SaaS or maybe, you know, opting for SaaS versus on-prem as new customers, what are the biggest selling points in your view, you know, for SaaS versus on-prem? And is it sort of... Maybe the follow-on question to that is, is SaaS changing how they use the tools as well?
So it's important to remember, you know, we're a security software company, and what we're really selling is an outcome of: your data is more secure, you're better protected by reducing the time it takes to detect and respond to a threat, and you're more compliant. So the reason customers choose SaaS is that you can get to those outcomes much with much less friction, much more easily, much more quickly. It deploys much faster. You can just... You don't have, you don't have to go to your infrastructure team and ask for servers and for databases, even for the risk assessment. It's a better product. There's more automation in it. It's easier to use. It's much more scalable. It's easier to operate from a customer perspective, and that's borne out by an 85% reduction in support tickets for our SaaS customers versus self-hosted ones.
Wow!
There's also a lot more functionality that just doesn't exist in the self-hosted version. An AI, you know, SOC assistant, automation in Microsoft 365. There are platforms that we support in SaaS that we simply don't support in the self-hosted world. So it's a better product. It's easier to use. The TCO is lower because you don't have to spend as much money on hardware and databases and operations. You see lower support. So you add all that together, there's very few, if any, reasons for a new customer to choose the self-hosted versus SaaS. It's kind of one very specific reason, that would be if they're Fed, because it's not yet FedRAMP.
Yeah.
But otherwise, they're just choosing SaaS. And as Guy said, many of our existing customers are coming to us and saying, "I want this." You know, we're not shy about the benefits of this.
Yeah.
So they're coming to us and saying, "You know, let's transition.
Feels like a very organic type of transition-
Absolutely.
really customer driven, as opposed to sort of, you know,
Yeah
... imposed upon your customers. That's great to hear. Guy, maybe for you, you know, maybe with just a preface, that this is a tough macro for really all of my coverage companies. But nonetheless, I'm curious kind of what your observations are on SaaS from just a new logo perspective, right? I mean, do we find that SaaS is making it easier to land new logos or perhaps, you know, expand the types of new logos that you work with? What are you seeing on SaaS from a new logo perspective, is maybe the question.
I think you're right. When you look at the macro environment, we're seeing longer sales cycles and more deal scrutiny. Just to remind you, we were kind of one of the earlier companies that called it out, and people were trying to figure out, are we different than the others? But, you know, when we tracked the KPIs that we very closely track all the time, it was very clear to us last year, that we're kind of heading into a tougher macro environment. And I think that's been very consistent since. I think when you look at Q3, the word that I use is stabilization.
Yep.
You saw Q3 from a macro perspective, kind of not getting, not getting worse. But on the flip side, I think the tailwind is the SaaS offering, and the fact that it allows us to target customers that we weren't able to target before, whether it's through platforms that we didn't cover before, not under SaaS. Whether it's, Google Docs or Salesforce or, or AWS, or there's a list of platforms that we support under SaaS that we don't have under the on-prem subscription offering. So that opens up a whole new kind of TAM that we didn't have before. And when you think about the ease, especially in this environment, people don't want to, buy the hardware, and they don't wanna have additional people in their security team in order to support, a software.
So as Brian said before, the total cost of ownership, even though the SaaS pricing is 25%-30% higher, apples to apples, if you buy the same number of licenses, the total cost of ownership for the customer is lower, and you're getting a better product. And I've also mentioned that when you think about kind of Q3, one of the more important points to think of is that, it's a bit of an inflection point when you look at the AI that came out as a SaaS offering. The product that came out, that we announced as part of the Varonis SaaS offering, that will be implemented as part of the package, is only offered on the SaaS, not offered under the on-prem subscription, and this is only three quarters in.
So when you look at kind of the level of development and the fact and the investments that we're making with R&D, how is this SaaS product gonna look in a year's time, two years' time? We're definitely trying to evolve to a point where in this scary environment, where hacking is happening on a daily basis, and every hacking attempt is becoming more and more malicious, we have the platform to protect—try and help customers be protected. And I think through the SaaS offering, it allows us to target new markets and new customers that we weren't able to target before.
Yeah, absolutely. And AI is a topic I definitely want to spend some time on a little bit later. But Brian, maybe for you, maybe we could touch on the competitive landscape a little bit.
Mm-hmm.
You know, we've started to see some security vendors talk about this idea of sort of data security posture management over the past year or two, and maybe the question is: Have you seen any change competitively? And maybe as an extension to that, can you just talk about what maybe makes Varonis' solution sort of different here from some of the other companies that are talking about sort of DSPM?
The right way to think about DSPM is it is a subset of what we do. If the acronym DSPM had existed in 2007, 2008, it would have been a good way to describe what we were doing in on-premises file systems, which none of the DSPM vendors support today. DSPM is interesting in that, you know, it's a kind of a new class of product, but it starts to describe a portion of what we've been doing from the beginning.
To answer your question, we haven't really seen much change in the competitive landscape beyond the fact that now that we support so many other SaaS platforms like Google and Box and GitHub and Salesforce, IaaS in the cloud, like AWS and Azure, we're now playing in spaces that we didn't play before, so we're running up against other adjacent categories. You've asked me in the past about DLP and about CASB. The conversations are the same. These are adjacent categories that going back to what we're actually delivering, we're delivering an outcome. DSPM doesn't deliver these outcomes. It doesn't reduce the time it takes to detect and respond to a threat. It doesn't offer the automation in all of the places that we offer it. You can't solve the same problems. That's a longer way of saying we're still not seeing direct competition.
There's nobody that does what we do, but we are—because we're a platform-based approach and we offer so much functionality in so many places, we run up against the noise of adjacent categories, if that makes any sense.
It does. It does. Definitely feels like a more holistic solution, though, here, right?
The number of CISOs that say, "I wanna take a platform-based approach to security," has been increasing over the last few years.
Yeah.
For the obvious reasons: you don't want a dozen different point tools that don't solve any of these problems versus a platform that does.
For sure. For sure. Guy, maybe back to you. I think, you know, I was going back to sort of the 15% of ARR coming from SaaS. I think one of the surprises this year to all of us was just the amount of on-prem conversions to SaaS, right? From some of your existing customers. I think the guide, and you correct me here if I'm wrong, implies about $30 million in conversions in 2023, even though we're not formally yet incentivizing customers or salespeople to really drive that conversion. And so again, it goes back to that idea of this being very organic. Maybe the question for you guys, what's driving that, and how are these customers kind of changing their usage once they convert from on-prem to SaaS?
The simple answer: it's a better product, and that's what's driving-
Right
... the conversions. As you mentioned, we're not focused. This was part of phase II, so we're not focused on phase II. When we laid out the plan, the 5-year plan in March, during our Investor Day, we talked about phase one taking anywhere between one year to two years, and then as we get close to the completion of phase I, we'll focus on phase two, which should, which should take, three to four years for a total transition period of five years. And we talked about completing a transition when we get to 70%-90% of our ARR coming from SaaS. But as you've mentioned, during this year, we've seen a very gradual progress in the amount and number of customers that are converting...because they want to be better protected, and because it's a better product.
We haven't put any focus on, from a commission perspective, on that phase two. So the reps, they only get the uplift, when they convert an on-prem subscription to SaaS. Anything above that renewal period goes towards their quota, but they don't get the actual renewal amount towards their quota, which means that all of this is happening in a natural way.
Right.
If I think about next year, the, the one thing kind of to keep in mind is that Q4 is our largest renewal quarter. So we kind of want to see how Q4 behaves, and we have a couple of options of how to look at 2024. I can say that, I don't feel that strongly that we would have to compensate reps next year on the focus on phase II, if it is happening in a natural way. Because, there are carrots and sticks, and you don't want to throw money where you don't need to-
Yeah
...in terms of the focus and the cost structure. So we'll see how Q4 kind of evolves. But I think two things kind of to keep in mind is that we know what needs to be done when we start putting that focus. And the second thing is that we don't see phase II happening in a linear way. It won't be linear within the years, and it also won't be linear within the year itself.
Right.
It takes some time. Renewals, we start working on anywhere between six-nine months before the renewal date. So it takes some time from the moment you put that focus in until you can start seeing that change. But I think the overall dollar amount should increase year-over-year, and as we put more and more focus on it, we should expect an acceleration towards kind of the in the years ahead, so.
Yeah. Yeah, absolutely. Maybe just to put a bow on this topic, Guy, on-prem to SaaS conversions. Remind us of the economics that you see when an on-prem subscription customer moves to SaaS. We're talking about lower TCO for the customer. Talk to us a little bit about the ARR uplift that you've been seeing so far.
So the ARR, when you compare apples to apples, the same number of licenses, the same number of users, we have seen an uplift of 25%-30%. What is actually very interesting is that when you get a customer to convert from on-prem subscription to SaaS, we have moved from individual licenses under the SaaS offering. So for those that remember kind of the history of Varonis, we entered 2022 with 40+ SKUs, and it got to a point where the richness of the platform became a bit of a challenge in terms of conversations that reps had to have with customers because it became more confusing.
So in 2022, when we, as part of the on-prem subscription sales, we offered bundles that would kind of consolidate licenses to one SKU, whether it's seven, 12, 15 licenses, and that worked really well under the on-prem subscription because it simplified the conversation with the customer, and then you were talking about outcomes and not individual licenses. So the move to SaaS actually gave us the opportunity to double down on that.
Mm.
When we initiated the SaaS offering, we no longer offered those individual licenses to be purchased separately. You're buying Varonis for Windows, Varonis for Office 365, and you're including what is the equivalent of seven or 12 licenses. You cannot buy it individually. So-
Selling more of an outcome, basically, right?
You're selling the outcome.
Yep.
So what that means is that if you have a customer that is converting from on-prem subscription to SaaS, in many cases, they actually have to increase the number of, quote-unquote, "licenses"-
Mm
... in order to move to SaaS, which means that when we see customers convert and having to consume more of the platform, we're getting a price uplift that is higher than 25%-30%. Now, I know you want to know what that number is, but we still haven't broken out that number just because it's so early, in kind of the process. But I can tell you that from our perspective, the three quarters have given us a lot of confidence in our price list and our ability to get that uplift even above that 25%-30% price list uplift apples to apples.
Right. Right. I mean, so really, maybe said another way, the 25%-30% uplift is a base case, right? I mean, as customers sort of adopt more of the platform, there's just more value that they can-
We've always said at Varonis-
Uh, achieve
... that more is more. So the more you can consume, the higher the customer satisfaction and the higher your desire to be protected under additional platforms.
Right.
Once you get that outcome, and that's all we're talking about with customers, the outcome. We're not talking about individual applications within the license.
Mm.
We're talking about how we can protect you and what additional platforms you should consume in order to be protected there.
Got it. Got it. Guy, I want to shift over to some financial questions here, and maybe just starting from just an expense perspective or an FX perspective. You know, I know that we have some of our R&D team, a big part of the R&D team, out of Israel, and of course, the US dollar strengthened against the shekel, right? Maybe there's a little bit of movement there, but generally strengthened against the shekel. I know that we have a hedging strategy here that's been very helpful in the past, but can you just maybe give us a sense for how you're thinking about movements in the shekel, just from an expense perspective, in 2023 and going into 2024?
So it's funny because when you asked the question, and I looked at it this morning, the rate has been all over the place.
It has, I know.
It's gone up and gone down. Very, very volatile.
Yeah.
We have a hedging strategy that we very closely monitor, and the whole intention of the hedging strategy is to eliminate any volatility within the currency, and I think we've done a very good job of taking advantage of the rates, where in 2024, you shouldn't expect any headwind or tailwind, so it's pretty much flat. We've been able to actually extend that post-2024, a bit as well. So overall, the hedging strategy is working very well, and you can kind of view the company on an operating margin perspective based on its normal organic software sales behavior. So we've done a good job there.
Absolutely. Absolutely. And maybe just to close the loop on this point around expenses. I mean, I think Varonis has just been super consistent in balancing growth and profitability just over the years, and I think that you're starting to see some margin benefits from the efficiencies in your SaaS product, whether that's go-to-market or R&D, whatever the case may be. Can you just walk us through some of these dynamics from an expense or margin perspective, and how you're thinking about margins here as we progress further into the SaaS transition?
So obviously, when you talk about margins, the first thing to kind of pay attention to is the gross margin. And I think when you look at kind of the behavior of the gross margins, on a non-GAAP basis, and you kind of compare it, year-over-year, you can see that the strength and the health of those margins is extremely encouraging. That's actually been better than our initial expectation when we announced the transition. Now, it doesn't mean that you don't continue to invest and you increase your customer success, so you can focus on the transition and the conversion of existing customers and you get them to value and all of that is still as part of our plan.
But I think where we stand today gives us a lot of confidence on the gross margin compared to where we were a year ago. When you look at some of the other departments, I think there's a lot of leverage to be taken advantage to as we move through, this transition. It's, you know, it's enough to look at the R&D. When you look historically at the R&D, at Varonis, as a percentage of ARR, I think we've been on the larger, investing companies as a percentage of ARR, and we were in the, top 20%. And very much because of the desire to put out a platform that would be, well-received by customers to the standard that they've been used to.
So those investments, and we talked about $100 million of investments in the last two years, in 2022 and 2021 alone, just to get the SaaS offering out the door the way it did. And there's still investments that need to be made in R&D, but I think that over time, as we move to one one code, and we stop kind of supporting both the on-prem subscription and the SaaS, and that doesn't happen next year or the year after it happens-
It's time, right?
It takes some time. But thinking ahead, you get to a point where you can generate significant leverage in the R&D department just by maintaining the SaaS offering. And you go down to the low 20% out of ARR, and that in itself can generate some significant benefits for the company and provide value to shareholders.
Sure.
So that's the R&D side. And then you look at the sales and marketing side, the whole process of doing a risk assessment. And I've talked for years about the fact that the Varonis sale is visual. You can talk hypothetically about millions of files open to everyone in the company, but until you see a file that you can identify that is open to everyone in the company, you don't go and buy the software. So we're still in that visual selling process, but it's easier to do it with SaaS compared to the on-prem subscription. So even there, I think that over time, you can generate some leverage. And we talked about the Brian talked about the support tickets, which are significantly lower under SaaS versus on-prem subscription. Professional services is easier.
There's a lot of things that you can benefit from, from a leverage perspective with a SaaS offering. So I think over time, when you kinda get to scale and you get to a point where your SaaS mix out of total ARR becomes the majority, you can start really benefit from, from that leverage. But I think when you look at where we've been, historically, we've been very confident with, you know, anywhere from 150 basis points to 300 basis points improvement year-over-year. This year, it's actually significantly higher.
But I also want to preface and put it out there, we don't want to get to operating margin leverage too quickly because there's a tremendous opportunity that we want to take advantage of, and it's a much larger opportunity sitting here today than what it was a year or two or three years ago. So we still wanna invest, we still wanna grow, we still wanna capture market share and get to that $1 billion ARR target that we talked during the Investor Day. And I think over time, we're committed to improving operating margin and increasing our free cash flow, but we want to do it in a gradual and very thoughtful way.
Absolutely. Absolutely. You know, just investing for that opportunity and, and how that opportunity is, is big, bigger now than it, it has been in prior years, I think is a natural segue into really the generative AI opportunity here, Brian. Maybe the question for you is: How are customers talking to you about the increased importance of Varonis as they roll out new AI products, like a Microsoft Copilot, for example? Where does Varonis fit in?
The number one reason that customers are not deploying, not Varonis customers, but any organization is not deploying Copilot right now, is privacy and security. One CISO said of a bank that, "I don't want users on my trading floor using Copilot to find employee 401(k) data," which is exactly what will happen if you have millions of files open to everybody in the company, which is exactly what happens when we do a risk assessment... So if you want to use Copilot and you want, you don't want to expose yourself to risk, you need Varonis. Every conversation about generative AI, whether we're talking about productivity tools like Copilot or Salesforce Einstein, or companies training their own LLMs on their own data, it's all about data.
You need to secure that data to make sure that insiders and outside attackers can't use these tools to get access to data that they shouldn't. You also want to make sure that your models aren't being trained on data like employee information or sensitive customer data that they're not supposed to see, so that you don't expose yourself. So companies are obviously very driven right now to deploy generative AI-based tools and get the benefit of them, the productivity benefits, the ability to monetize their data, but they don't want to put themselves at risk. We are a critical part of getting value out of generative AI. I was in a meeting with a 7,000-user manufacturing company. I took them through the risks that they're going to see with Copilot, got halfway through my presentation, stopped for a moment and said: "Does any of this track?
Does this make some sense?" And there was a room of about 12 people on their security team, their CISO, all the way down to privacy and end user experience, and they just paused and laughed and said, "This resonates." It speaks to we're unique in what we do. Everybody knows they have this problem. Until we show it to them, they don't realize they can solve it, and they can solve it quickly and automatically. We had the risk assessment in a couple of days.
Right. Right. So really, I think the tool here could maybe help customers actually realize the benefits of AI in a really secure way, right?
And not put them at risk.
From a security perspective.
Yeah. If you don't have Varonis, you're running the risk of using something like Copilot and exposing employee data, customer information, intellectual property to people inside and outside the company that have absolutely no organizational need to see it, which means you're putting yourself at risk.
Guy, maybe the follow-on question for you on that is, how do you think about AI as a revenue opportunity here for Varonis?
I think we can monetize AI at Varonis, but I think we're going to do it slightly differently. One of the options that did come up is offering the AI functionality that's now part of the Varonis platform as a separate SKU. But since we're trying to consolidate and talk about the outcomes, we felt that we want to keep it as part of the package, provide way more value to our customers, and that would obviously impact with customer satisfaction. It could impact renewal rates, it could impact the desire of those customers to protect additional platforms. And like Windows, they move to Office 365, and they move to other platforms that they haven't protected before. So I think with the AI as part of that platform sale, it provide...
It provides us the ability to monetize through the sale of additional licenses and higher customer satisfaction throughout across the board.
Got it. Got it. Brian, back to you just on this topic. I mean, as I think about that, really, you are enabling the Gen AI providers, right, to really deliver their solution to their customers in a more secure way. What's the dialogue like with some of those guys that are providing those Gen AI tools, like the Copilot, for example?
Extremely tight. We're a very close partner with Microsoft, and with Salesforce, and with Amazon. We're available on all three marketplaces for good reason. You know, Microsoft doesn't have the technology that we do to secure data in the way that they do, and they say... We integrate with them. So if you want to, for instance, use Microsoft Purview to do blocking and encryption and all of the perimeter controls that they offer, Microsoft says you're much better able to do this with Varonis, and that's why we're available on the Azure Marketplace. Same thing with Salesforce. We're available on the Salesforce App Store and, the AWS Marketplace. So we have very tight partnerships with all the platform providers because we do something unique.
If you want to enable generative AI-based tools, you need us to make sure that your data is secure.
Got it. Got it. Guy, maybe in the last minute or two that we've got here, as we think about sort of this multi-year model that was so helpful that you gave at Analyst Day, how should we be thinking about some of the puts and takes as we think about sort of modeling 2024, any of the macro assumptions that you've seen here, anything you want us to know as we think about next year?
In March, during the Investor Day, we talked about the assumptions from a macro perspective, where we see softness in 2023, and we expect that softness to continue in 2024. That assumption still holds true. So our expectation for next year is that the sales cycles continue to stay at the levels that we've seen this year with more deal scrutiny. But I think we're kinda past that challenging part of the transition, which we talked about, which was the first six months.
Yeah.
I think the other important elements to think about in 2024 is that, yes, we are committed to improving our operating margin and generating higher free cash flow levels, but we still wanna invest in levels that would allow us to capitalize the larger opportunity that we see today. So I think when you look at kinda the levels of expense that we had in 2023 and kinda the commitment of that 150 basis points-300 basis points improvement year-over-year as a starting point, that's kinda where we've been in the past. Obviously, throughout the year, in the past, we've shown our ability to do better, but I think that's a good starting point.
I think the phase II should start throughout that 2024 year, but I don't think it kinda gets off the bat in Q1 in a crazy way, because it does take that time.
Won't be linear to your earlier point, right?
It won't be linear. It would accelerate throughout the year, and then it would accelerate from, from the years ahead, as well. But we definitely want to take advantage of the opportunity. We feel very good about where we are. There are a lot of tailwinds that are happening on many fronts, that we, we want to capitalize on, but just remember that we've never been the type of company where a breach happens, and you see a spike the next day in our revenue. We're, we're part of that thoughtful process. So when you look at kinda the SEC, regulation that's going into place, that makes a lot of CFOs very focused on cybersecurity, which they've never been focused that way before, I think that could be a tailwind for the years ahead.
Mm.
- not necessarily for 2024, but definitely part of where we want to take advantage of the market.
Got it. Couldn't think of a better way to end there. Guy, Brian, thanks so much for the time. Shame on me, I didn't call out my buddy, Tim Perz, head of Investor Relations. Any questions that we got there, Tim's your man. Guys, thank you so much for the time.
Thanks very much.
Thank you.