Greetings. Welcome to Varonis Systems' third quarter 2020 earnings call. At this time, all participants are in a listen-only mode. A question and answer session will follow the formal presentation. If anyone should require operator assistance during the conference, please press star zero on your telephone keypad. Please note this conference is being recorded. I will now turn the conference over to your host, James Arestia, Director of Investor Relations. Thank you. You may begin.
Thank you, operator. Good afternoon. Thank you for joining us today to review Varonis' third quarter 2020 financial results. With me on the call today are Yaki Faitelson, Chief Executive Officer, and Guy Melamed, Chief Financial Officer and Chief Operating Officer. After preliminary remarks, we will open the call to a question and answer session. During this call, we may make statements related to our business that would be considered forward-looking statements under federal securities laws, including projections of future operating results for our fourth quarter ending December 31st, 2020. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned forward-looking statements, and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission.
We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call, which excludes stock-based compensation and associated payroll tax, FX gains and losses, and the amortization of debt discount and issuance costs related to our convertible notes issuance in May. A reconciliation for the most directly comparable GAAP financial measures is also available in our third quarter 2020 earnings press release, which can be found at www.varonis.com in the investor relations section.
Also, please note that an updated investor presentation, as well as a webcast of today's call, are available on our website in the investor relations section. With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Faitelson. Yaki?
Thanks, James. Good afternoon, everyone. Thank you for joining us to discuss our third quarter 2020 results. We are extremely pleased with our results, and I want to give you an update on our business and the current operating environment and talk about how we expect the macro trends we are seeing to continue to benefit Varonis over time. I'm also excited to announce our agreement to acquire Polyrize and explain how it will expand the Varonis Data Security Platform to cover additional cloud applications and infrastructure. Finally, I will turn the call over to Guy to discuss our third quarter financial results in more detail. The team continued to execute well in this virtual environment. With significant customer engagement and inbound interests, companies understand that the elevated risk they face in a work-from-home world are here to stay.
Sensitive and regulated data is more exposed than ever before, as remote employees use unsecured computers to access critical data in Teams, Office 365, and on-prem through VPN. Companies face an ever-increasing number of advanced persistent threats from external bad actors and hackers who see vulnerable targets. At the same time, insider threats are growing as our customers report a higher number of alerts, warning of fraudulent employees accessing sensitive data in abnormal ways. Our ability to address this risk is unmatched, and our platform continued to resonate with new customers who are buying more licenses in their initial purchase and with existing customers who consume more licenses over time. They all understand that a data-centric approach to security is critical, and as a result, we continue to take greater share of their available security spend.
The path to double-digit license per customer has never been clearer, and I want to highlight a few important wins in Q3 that demonstrate the enormous opportunity in front of us. One example of a large initial commitment by a new customer is a U.S. hospital that purchased 10 licenses in their initial deal. During the onset of COVID, they experienced a huge increase in a targeted phishing attack, and our assessment successfully demonstrated our ability to address the risks inherent in their hybrid environment. Their Varonis deployment, including DatAdvantage and data classification for multiple on-prem and cloud platforms, as well as DatAlert. We were also pleased with the performance of our federal business this quarter. For example, a government agency with thousands of users became a Varonis customer after they discovered sensitive PII had been open to every employee for months, a material vulnerability.
This was a key driver in their purchase of subscription for 12 licenses they are deploying enterprise-wide to identify PII, and remediate overexposed permissions and stop exfiltration of sensitive data across their on-prem data centers and Office 365. In most instances, these new customers were able to quickly realize the value of our platform, which results in greater lifetime values through healthy renewals and future license upsells and cross-sells. We also know that we remain significantly under-penetrated within the existing customer base. The team is just as focused on closing expansion opportunities with those customers so they see even more value from our platform. A good example of this in Q3 was a large technology company that initially purchased four licenses in December 2019 to protect their on-prem data stores. They had a multi-year plan to move to Office 365, but this was accelerated due to COVID.
During the risk assessment, they DatAlert also caught a brute force attack, which was resolved by our incident response team. Knowing Varonis would meet their needs, they purchased subscription for seven additional licenses, and they now have a total of 11 licenses to protect their data and alert them on threats in Office 365. All of these examples illustrate the strong adoption and customer engagement trends that, combined with healthy pipeline, leave us well-positioned for a strong close to 2020 and beyond. We know that our continued innovation will further differentiate our platform, and we are very excited about the acquisition of Polyrize. Polyrize is our first acquisition, and we believe that their technology, which fits nicely in our strategy to follow the data, will accelerate product development and reduce time to market in the cloud application they support.
Their software maps and analyze the relationship between users and data in a number of cloud data stores, including G Suite, Salesforce, Okta, GitHub, Slack, Amazon S3, and others. We plan to incorporate these capabilities into our platform, thereby allowing us to introduce new licenses, which in turn will expand our addressable market. We've seen tremendous momentum with Office 365 and Azure, and we believe expanding to other data stores in the cloud addresses a growing pain point for customers, allowing us to offer a more unified view of their organization's security posture. Polyrize is based in Israel, and we are happy to have them join the Varonis family. As we said last quarter, we believe that the current environment has cemented the need for our platform.
We know that continued innovation and executions are critical, and this is where we are focused as we close 2020 and capitalize on the long-term opportunity in front of us. With that, let me turn the call over to Guy. Guy?
Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. I hope you and your families are safe and healthy. We had a strong third quarter. The subscription transition is finished. Our results demonstrate that the demand for our platform, combined with the power of the subscription model, is accelerating revenue growth and driving operating leverage. With that, let's discuss the quarter. To remind you, our focus as we manage the business is threefold. First, landing new enterprise customers. Second, expanding with existing customers. Finally, strong renewals of both subscription and maintenance of perpetual license. On the new customer front, we continue to see the average number of licenses on the initial purchase be more than five, compared to the two to three licenses customers bought under the perpetual model. This trend is resulting in greater lifetime value through healthy renewals and future license upsells.
Specifically, as of September 30th, 60% of our customers with 500 employees or more purchased four or more licenses, up from 50% a year ago, while 26% of our customers purchased six or more licenses, up from 17% a year ago. The rapid growth in these metrics underscores the logic behind our transition and is another confirmation that we are unleashing the potential of our platform, which is also reflected in ARR of $261.1 million, a 46% increase as of the end of Q3. At the same time, renewal rates of maintenance of perpetual licenses continue to be above 90%. As a result, more than 98% of our Q3 revenues were recurring in nature, which provides visibility into future revenues. Turning now to our third quarter results.
Total revenues grew 17% to $76.8 million, included a 99% subscription mix, compared to 74% a year ago, was well ahead of the midpoint of our revenue guidance of 6% growth. Subscription revenues grew 89% year- over- year, were $44.1 million. Maintenance and services revenues were $32.3 million, reflect the strong renewal rates I just referenced. Looking at the business geographically, North America revenues grew 21% to $57.1 million, or 74% of total revenues. In EMEA, revenues grew 7% to $17.8 million, representing 23% of total revenue. Rest of world revenues were $1.8 million, or 2% of total revenues. Turning back to the income statement, I'd like to point out that I'll be discussing non-GAAP results going forward. Gross profit for the third quarter was $67 million, representing a gross margin of 87.2%, compared to 87.6% in the third quarter of 2019.
Operating expenses in the third quarter totaled $63.9 million. Operating income was $3.1 million, or an operating margin of 4% for the third quarter, compared to an operating loss of $4.7 million, or an operating margin of negative 7.2% in the same period last year. Our Q3 operating margin was again well ahead of our guidance, which was negative 4% at the midpoint. During the quarter, we benefited from a meaningful outperformance on the top line, driven by larger new customer adoption and existing customer expansion, COVID-related cost saving, primarily due to travel and marketing activities, and continued prudent management of expenses across the business. Looking ahead, we do expect both employee travel and in-person marketing events to gradually resume, and we will continue to invest responsibly to support the growth of the business.
During the quarter, we had financial expense of approximately $733,000, primarily due to interest expense on our convertible notes, partially offset by interest income. Net income was $2.1 million for the third quarter of 2020, or earnings of $0.06 per diluted share, compared to a net loss of $4.8 million or a loss of $0.16 per basic and diluted share for the third quarter of 2019. This is based on 35.4 million diluted shares outstanding for Q3 2020 and 30.4 million basic and diluted shares outstanding for Q3 2019. We ended the quarter with $325.6 million in cash and cash equivalents, marketable securities, and short-term deposits. For the three months ended September 30th, 2020, we used $2.7 million of cash from operations compared to using $13.6 million of cash from operations in the same period last year.
We ended the quarter with 1,629 employees, an 8% increase from the third quarter of 2019, and an increase of 55 net new employees from the second quarter of 2020. As we have said, we expect to continue hiring to support the growth of the business with a particular focus on sales and R&D. Before I discuss guidance, I want to welcome the Polyrize team to Varonis. We are excited about the potential of their technology and are working to integrate their capabilities into our platform. In Q4 2020 and for fiscal 2021, we do not expect the acquisition will contribute revenue, ARR, or any material expenses. Moving to guidance for the fourth quarter of 2020. We expect total revenues of $82 million-$85 million.
We expect non-GAAP operating income to range between $5 million-$6 million and non-GAAP net income per diluted share in the range of $0.10-$0.13. This assumes 35.4 million diluted shares outstanding. Let me provide a bit more color on guidance before we open for Q&A. First, similar to last quarter, the low end of our guidance again considers the possibility of broader macroeconomic volatility for the foreseeable future, given the potential direct and indirect effects of COVID. Second, we will continue to be thoughtful in the rate and pace of our investments and will balance investing for growth with our plan to show non-GAAP operating margin expansion and cash flow generation. Third, I want to remind everyone that the subscription mix in Q4 will be more apples to apples as this was 82% in Q4 2019.
As a result, ARR % growth will naturally be impacted. In summary, we're pleased with the third quarter, which further demonstrates the demand for our platform and the power of the subscription model at an increasingly larger scale. Thanks for joining us today, and we hope you and your loved ones remain safe and healthy. With that, we will be happy to take questions. Operator?
Thank you. Our first question is from Saket Kalia with Barclays. Please proceed.
Okay, great. Hey, guys. It's Saket Kalia from Barclays. How you doing?
We're good.
Awesome. Yaki, maybe first for you. You've talked a lot about multiple licenses per customer, as part of both subscription licensing and just a heightened security environment post-COVID. Can you just maybe speak anecdotally about product usage from some of these multi-product customers, and are you finding that usage is sort of following that greater adoption? Does that make sense?
It makes complete sense, and it's a great question. Definitely, we see a direct correlation between the amount of products that customer have and how much value they get and their ability to buy more, and it really works very well for us. I think that what we see just in the marketplace is that slowly but surely, customers understand that this approach of data-first is the right approach for security. The three use cases that we are catering in, data protection, threat detection and response, and compliance and privacy, we see a lot of automation. A lot of automation in classifying the data, automation in remediation, in visibility, and in forensics, and the ability to identify abnormal behavior and to have these high-fidelity alerts.
One thing that we see is that much more usage within the customer, what I mean about usage is automated usage. They don't need to spend a lot of time, they get a lot of this ongoing value, we are seemingly, and more and more seemingly integrated within their day-to-day processes, they are buying more. This has also worked extremely well for us in the cloud, you know, 365 and Azure were just tremendous for the business. We can spend more time with our customer, they are just buying more. The overall model is working, they moved to subscription, really supported it, they can buy more and more licenses and just the business become more predictable and the usability value and the predictability of customers and the ability for them to buy more is really working very well.
Got it. That's really helpful. Guy, maybe for my follow-up for you noted the subscription transition here is largely complete, particularly in the top line. Could you maybe talk about anything that we should be thinking about the margin trajectory here as more of the business becomes recurring?
Absolutely. First of all, we're extremely pleased with the Q3 results. As you mentioned, Q3 has a larger portions of renewals that get into place, and that obviously helps with the margins. Our philosophy really hasn't changed. We want to continue to invest. There's obviously a significant opportunity ahead of us in the market, and we want to capitalize on that. We'll keep investing in R&D since we've seen such a tremendous ROI there. At the same time, we want to show year-over-year margin expansion. We plan to kind of balance between the top line growth and bringing some of it to the bottom line.
Saket, we are going to do it gradually. We're going to do everything that we said. Remember, we are always following the data. When you have more platforms that need the use cases that we are catering to, there is just tremendous opportunity. This is what we see now with COVID, really, with the cloud adoption and all these security threats that we are uniquely, solving for. We are going to balance it. We believe that we have a great future, and a lot of it is by very predictable innovation, do the same to other platform, and we are going to capitalize on the opportunity, but also being very mindful to model.
Got it. Very helpful. Thanks, guys.
Thank you.
Thank you.
Our next question is from Sterling Auty with JPMorgan. Please proceed.
Yeah, thanks. Hi, guys. I think one of the big questions on investors' minds going into this earnings across all software companies is the ability to attract new customers. You mentioned your ability to sell more into those new customers, I'm just kind of curious what you saw in terms of pipeline generation, close rates, and the typical metrics around bringing new customers in beyond just being able to sell more to them with each deal you did.
Hi. Yeah, our ability to build pipeline in this current environment was very strong. All the demand generation channels are working very well for us. The market is very attentive. We also see that we have very good ability to attract new customers in the right size. We are going upmarket, the customer in the right size. We also obviously need to balance it because we have this tremendous customer base that is untapped, that needs so much of our products. With this transition to subscription, we're able to unlock the potential of the platform and the marketplace. The customers and the prospects need more and more from our products. It makes sense for us to spend more time with our customers.
On both ends of just acquiring new customers and gaining, sharing the market, but also making sure that our customers are using the product and buying more because it correlates. It's one to one. If they have more licenses, in Varonis, it's really one plus one equals five. They have more licenses, they have more automation, they have more enrichment for their learning, and they get more value. Both sides of the model work very well.
No, I appreciate that. I think that definitely hits the question. Just one follow-up on the acquisition. Can you give us a little bit more color, maybe number of employees and exactly the technology? I wasn't 100% clear what it actually brings to the table that Varonis doesn't already do within the platform.
I will talk about the technology and about the market. We see tremendous momentum with Office 365 and Azure, it's primarily related to adoption. We build the technology, the organizations are adopting the cloud, it's worked very well to these three use cases that we are catering to. Obviously we're starting to see a lot of adoption of other cloud application infrastructure. The cloud is a massive opportunity for us. Part of our roadmap was to do everything that we are doing to any place that we have users and the data and infrastructure elements that you need to understand the permissions and activity. This acquisition is really accelerating drastically the time to market.
What this company is doing very well, they have the ability to go to any cloud platform and infrastructure, and they give you the permission modeling and connect very fast and take events. We can take this technology and go wide and deep into the cloud for Salesforce and Google and Box that we are already supporting, obviously, and AWS and S3 and GitHub. you know, you're starting to see this, a lot of many users with a lot of critical data on this data store and what we are doing on-prem and with 365 and Azure can work very well there. We really believe that it's increasing drastically the overall addressable market. It's a natural fit for us, and we are very excited.
Just to add on that, one of the things that I mentioned in the prepared remarks, apart from being very excited about the technology and the potential, this is a technological tuck-in, so we don't expect any contribution from a revenue perspective in Q4 or 2021. We are very happy to welcome the Polyrize team, the Varonis family.
Understood. Thank you.
Thank you.
Thank you.
Our next question is from Brent Thill with Jefferies. Please proceed.
Good afternoon. Just on the demand environment, I am curious if you could just help us color what Q3 looked like in Q2, and there has been some concern that maybe we saw an initial surge from the work from home, now we are moving to the work from anywhere. What you are seeing in terms of just overall demand trends and the signs that are leaving you comfortable that this is not just a short-term burst?
Yeah. For us, we never benefited from anything that is short-term and always benefiting from the overall long-term. I think what happens is what I said, I think that this approach of data first, it's something that organizations understand extremely well. For us, in terms of demand, our ability to close business, it just worked very well. It worked better and better as the year progressed, and we hope that it will continue. We believe that just slowly and surely it's just becoming a standard. If you have a modern enterprise and you want to protect your data and your core infrastructure, you need Varonis. You need Varonis for data protection, you need Varonis for forensics, you need Varonis for very sophisticated alerts to classify the data for privacy and for your compliance requirements.
We believe that every day it's becoming more and more standard, and it's something that every organization understand that they need to solve. For us, in the overall demand environment, as the year progressed, it just become better.
Just to add some data points to support that. When we look at the three pillars, on the new customers, the fact that new customers are buying now under the subscription model, more than five licenses, and that's compared to purchasing under the perpetual model between two to three, is a great indication. That's been very consistent. We're very happy with that. When you look at the renewals rate, they're very strong. When you look at the existing customers, the fact that we can sell more to our base, and just looking at the KPI of number of licenses for companies with more than 500 employees that have purchased four or more licenses.
Going from 50% last year to 60% this year, on the 6+ licenses, going from 17%- 26% this year, is really an indication of how much more we can sell to the base, but how we're truly selling the platform.
That's great. Just a quick follow-up. In the 26% that are buying six or more, is there one or two modules that are standing out? Which ones are showing the bigger uptick?
It's all of them. Without a doubt, the Office 365 and Azure are exploding, but it's everything. It's all about automation. The automation in these three use cases, and customers are buying more licenses, they're getting more automation and much more value. Just when they buy more, they keep buying more. This is the key for us. We know that if we get customers to four or five licenses, usually they will get to many, many more.
Thank you.
Our next question is from Matt Hedberg with RBC Capital Markets. Please proceed.
Hey, thanks for taking my question, guys. Congrats on a really strong quarter. Yaki, it was really good to hear, I think you started off the script saying significant inbound interest, and I know you talk a lot about Office 365 and Azure, but I'm wondering if you could talk more specifically about Teams in particular. We continue to think and hear from some channel context that Teams is driving a lot of deals, pulling you guys into deals, maybe at an accelerating rate. So I wonder if you could talk specifically about Teams and then also support of other collaboration tools like Slack and Atlassian.
What happened, at the end of the day, there is always this conflict, this tension between productivity and security, mainly with everything that's related to data protection. Team is a client on top of OneDrive and SharePoint Online, and it's using Exchange Online, and when you use it a lot, and it's in the hands of the end user, it's generating tremendous amount of chaos. You have a lot of data, and also don't forget that the on-prem is also exploding. You have this data all over the place. Yes, this is why we did this acquisition, because we see adoption of more and more data stores, and on top of them, collaboration tools, and they have a lot of critical data, and we can add a lot of value. There is a lot of value in GitHub.
There is massive amount of value in S3. What we are doing to the on-prem data repositories in 365 and co-infrastructure in the cloud, like Azure, you can do to many more platforms, and this is what we are following the data. We just believe that this digital transformation for the cloud is opening a tremendous opportunity for Varonis, and also it's going to change the security landscape. With time, we believe that it's going to be much more data first and co-infrastructure first, and there are good chances that we are going to tremendously benefit from it.
That's great. Maybe as a follow-up, another thing that I picked up that you mentioned, Federal did well. I know that's been an issue for you guys for years, and you've been making steady progress, but it's really good to hear you guys call that out with the large government agency this quarter. I'm curious, can you talk a little bit more about, maybe what's driving that Federal interest today? Is there anything that's changed in that environment? Maybe just, any sense on how penetrated you guys are from a Federal perspective on a vertical basis? Thanks.
Yeah. Federal, they had a good quarter. North America overall had an outstanding quarter. We're starting to have a very nice business in Federal. We have great teams. In the Federal state, we have a lot of critical data, which is unstructured, so we are extremely relevant, but we are in the early innings. We believe that we can build a big business, and it's just a big opportunity for us. We're definitely in the right direction.
Thanks, Yaki.
Thank you.
Our next question is from Rob Owens with Piper Sandler. Please proceed.
Great. Thanks for taking my question. I was hoping you could touch a little bit more on Polyrize. I believe this is your first acquisition. Does this change your strategy a little bit, where you will look for tuck-ins moving forward? I appreciate the fact that this does accelerate time to market relative to the cloud opportunity. I guess the question is, how did you build the platform? Will we see you be more opportunistic in terms of making small tuck-ins moving forward, or was this more of a one-off type of thing?
No, it depends on the opportunity. First one, and we're always looking at opportunities. We always want to do the right thing for the business. If we'll find the right opportunity that can shorten time to market and bring a good time to the company, it's something that we will do. We are all just very pragmatic people. We are not religious about it. We just want to do what is right for the business, right for our customers, and this was just a natural fit.
Just to add on that, when we looked at acquisitions to date, they have been technological tuck-ins, and you're right that this is the first acquisition. We expect that any future acquisition would be, again, technological tuck-in.
Thanks for the color, Guy. Second, hoping you could touch on Europe a little bit. I think you mentioned last quarter how Europe lagged the transition. You were happy with the pipeline. If you look at the growth rate, though, it's still down in the single digits. I was just hoping for an update on that front. Thanks.
Rob, it grew 7%. Remember that Europe were six months after North America in adopting the subscription model, so the flywheel is not completely in motion. We have a very good team in Europe, great customers. It's just a big market for us, great channel partners, and we believe that it's an excellent, huge market for us, and we'll do very well there.
Thank you.
Thanks.
Our next question is from Shaul Eyal with Oppenheimer. Please proceed.
Thank you. Good afternoon, guys. Congrats on the solid performance. Yaki, another question on the Polyrize acquisition. Seems to be a nice strategic extension to everything you've been doing in recent years. My question is as follows: If Varonis has 26 licenses under six product families, give or take, I might be off, how many modules is Polyrize adding to the mix? Is there a specific family they align with, or is it a standalone, new one?
It's both. Mainly, we can run the same play of the products that we have to most of the data stores that they are supporting. To some data stores, you can do classifications, to others, you can't. Forensics and alerting, you can do for everyone. The data protection works a bit different, but they have very good coverage, and it will be a lot of new content. How we are going to package it for our customers, we'll make sure that we get the revenues, the economics work very well, and it's easy for our customers to buy. Yes, it's a lot of more content, a lot of new products.
Just to emphasize, Shaul, in terms of the additional licenses that are with Polyrize that we later on plan to sell, they cover platforms that we don't cover. The licenses are not instead of existing licenses that Varonis has to offer, it's on top of, and that's part of the reason that we see the TAM expanding with this acquisition.
Got it. Understood. Thanks for that color. Yaki or Guy, maybe also going back to the macro. Some countries specifically in Europe are heading into another round of lockdowns. Have you seen any ramp-up in demand or at least elevated interest in recent weeks that could replicate the incremental short cycle we've seen back in April and May? Or do you think that CISOs, CTOs feel comfortable with the current security infrastructures they have currently at hand?
Far, it's an unknown, but so far what we see is just a very good demand overall.
Got it. Thank you. Good luck. Congrats.
Thank you.
Our next question is by Hamza Fodderwala with JPMorgan. Please proceed.
Hi, this is Hamza Fodderwala from Morgan Stanley. Thank you for taking my question. Yaki, maybe the first question for you. I wanted to see if you could expand on the prior comments on longer term demand, especially as we see more cloud and digital transformation. You spoke a little bit about that. Are you having some of those conversations with customers already as they think about their security architectures longer term, moving to a more decentralized work environment? Are they starting to think about making those changes, and how is Varonis sort of fitting into that longer term CISO conversation?
What we see is that customers understand that it's all about the data and the core infrastructure. We see more and more C-level talking about it, and we see that they are not looking at it piecemeal. It's very strategic. Where is the critical data, what users are doing, have the right profile of usability. They also concerned that they have these new data repositories that usually it will take them five years to get to certain adoption level, and it's really accelerating now. We just see that the organizations are very worried about the protection of the digital assets. They understand now how it is. You have all of these platforms, and it's very hard for the security teams and the compliance teams to get control over them.
They need a lot of automation, when they realize what we are doing, we're just becoming more and more strategic. We are almost alone in this market. It's a big market, but they're just realizing how they need to protect the enterprise and what they need to do. We just see that slowly but surely, more budgets going toward us, more boards are asking for a solution like ours. CISOs, compliance officers, and data privacy officers understand that they need a platform like Varonis, and it's becoming very strategic, and they are willing to spend more money on it. They are having a multi-year strategic plan around it, how they are going to deploy it, how they are going to cover all the information at stakes, and I believe that we are going to benefit tremendously from it.
Got it. That's it for me. Thank you.
Our next question is from Jason Ader with William Blair. Please proceed.
Thank you. Hey, guys. I wanted to ask you about structured data. Today, you don't support structured data with your platform, and just wondering if that is something on the roadmap. Do you think it's necessary or important for you to support structured data over time? Any comments would be helpful. Thanks.
We are not discussing roadmap, but we believe that unstructured data is just much more of it, and it's very exposed. Don't forget that SharePoint and others, we support semi-structured data. In the cloud, with anything that is exposing API, we can do the three use cases that we are doing now to unstructured data. We will see and what our customer need and what are the needs of the platform. If there is a need, this is something that we are going to address. We're always doing what is right for our customers using, as long as it's part of our intellectual property umbrella.
Okay, thanks. Just a quick follow-up, not related, but wanted to ask you about data privacy and some of the new compliance mandates around the world, and whether you're seeing an increase in pipeline or interest in using Varonis for that type of a use case.
No, we definitely see it. More than anything else, this regulation and all the compliance demand, what they are doing, they are just going to boards and management teams and tell them, "In order for you to manage an organization in this digital world, you need to make sure you have the right protections in place. And if you don't have them, the outcome can be just a disaster." You just see more business understanding how they need to treat the data, how they need to protect data in an environment that you need to collaborate in order to maximize the value of the data, and we just benefit from it.
We just really benefit from everything that's going on, from the cloud, from the explosion of data, from the fact that data is on many systems and repositories, and from regulation that's saying you need to protect the enterprise, you need to protect the information because without it, everything can collapse.
Got it. Thank you, guys.
Thank you.
Our next question is from Gur Talpaz with Stifel. Please proceed.
Okay, great. Thanks for taking my questions. Yaki, we've seen a sharp growth in ransomware over the past several months. Have you seen this as a driver for the business, and have you seen customers looking to push Varonis into more data stores because of this?
Yes, in a much more holistic way. I think what happened with this ransomware is that a lot of them are just very sophisticated APTs. They are coming in, they are bypassing your EDR many times, they're exfiltrating data, they take data out, they are threatening you that they are going to release data. It helps us with everything, with anything that we are doing on the data stores, on-prem and in the cloud, with everything we are doing with Active Directory and Azure AD and with our Edge product and obviously also classification. You just want to make sure that you are protecting the critical data. Yes, without a doubt. What happens is that many times, Gur, as you know, you have these APTs, advanced persistent threats, customers don't know that they are there.
The thing with ransomware that it's announcing that it's there, the key is to encrypt as much as data as you can and then ask for a ransom. We can't get a better marketing campaign than this. The way that it's working now is exfiltrating the data. You have these NOCs for these cybercriminals, that they have support organizations that you can talk to them, and they can direct you exactly what to do in order to pay the ransom and get your data back. I think that what happened is that customers, really and prospects understand very well that this is something that can happen to them, and traditional security solutions are very limited in solving these things, and they need to be ahead of the problem and invest in order to solve it, and we benefit from it.
That's helpful. Then maybe building on that a little bit, can you talk about the demand environment for Varonis Edge, especially as you think about customers coming up for renewal and as they kind of think about the risk environment with more users working from home? Thank you.
The work from home is just helping us because people are accessing data through VPN, home computers, and unsecure networks at home, and there is just much more cybercrime. They just understand that bad things can happen. You have these cloud workloads and cloud applications that organizations opened in a rush, and they don't have all the configurations in place, so they need us, and many of them realize that they need us badly. It's always like that with us. There is something happen and customers first reacting very fast, but then they really understand what I need to do with the resources that I have, what is the priority?
You just see that gradually we become a higher and higher priority for organizations, and they understand that this is something that they need to do in order to protect the information products, which, in this environment, is the lifeblood of the business.
Many thanks, Yaki.
Thank you.
Our next question is from Chad Bennett with Craig-Hallum. Please proceed.
Great. Thanks for taking my questions. Guy, did you speak about a net expansion or NRR number in the call?
We mentioned last quarter that we will provide it on an annual basis. To remind you, the number that we had last quarter was greater than 120%, and we're really extremely happy with Q3 numbers. We're seeing a continued expansion within our base, and we'll provide more color in the next quarter's earning call.
Okay. Maybe just related to that or a prior question, just on the net new versus expansion. I know you haven't broken that out for a while now, has that mix dramatically changed the last few quarters or the last couple of quarters, even relative to what it has been historically from a bookings or ARR standpoint?
Strategically, when you think about the last couple of years, we have a much larger base. We wanted to have a much larger impact coming from our existing customers. By the way, that cost of generating revenue from existing customers is cheaper for us, quote unquote. That's actually in plan with our strategy. Our new customers, as we talked about in the prepared remarks and as we talked about in some of the other questions, we're going upmarket. We're focused on getting the right new customers into play, and the fact that they're consuming the platform, the fact that they're buying more than five licenses, a great indication that they are consuming the platform. It also shows us that the path to double-digit licenses on average per customer has never been clearer.
Everything is kind of working as we planned, and we want to continue doing that.
With the move to subscription, the company changed drastically. We had this platform, and then market realized that they need the platform. We changed the model that they can consume it. They started to buy. They are buying big. They are buying more. We are very focused on getting the right customers, sell them the right set of licenses, make sure they realize value, then in a very predictable way, they are buying more. Really, the strategy and the effort economy, if you will, between the land and expand and the market penetration is working according to the plan. We just need to cater just the attention for both class of customers.
We just became much more strategic for our customers and the current customers and the new customers just over time, and it's just changed the amount of time that we are spending with them and just the output of these engagements.
How, just maybe one last one for me. Just on the license initial deal, license expansion, again, it's playing out exactly like you guys thought it would and maybe even more accelerated than you thought. Just going from initially two to three, to four, then now to five, how would we compare and contrast initial deal size on a dollar basis or ASP? I don't need the exact number, just relative to that license expansion.
That's a great question. When we look at the expansion and getting to more than five, that's actually better than what we initially expected when we thought about moving to a subscription model. That is extremely encouraging. We're very happy with that, and that's been kind of consistent over the last couple of quarters. We haven't really talked about ASPs, but I can tell you that on the new customer front, the discount levels that we're providing have actually stayed very consistent, which is showing us that we're not selling more licenses for a higher discount, but staying firm, and doing well in driving higher initial purchase.
Got it. Thanks. Nice job, guys.
Thank you.
Our next question is from Erik Suppiger with JMP Securities. Please proceed.
Yeah, thanks for taking the question, and congrats on a good quarter. On Polarize, can you comment when you would be introducing the products? It sounds like, you said revenue. There won't be revenue in fiscal 2021, but will you be introducing some new modules in 2021? Can you comment how many people were at Polarize?
In terms, yes, we'll introduce licenses in 2021. We are working tirelessly on the integration and make sure that it will be very successful acquisition.
In terms of the headcount, they have less than 20 people. As you mentioned, from a revenue perspective, we don't expect any contribution in Q4 or in 2021. We're extremely excited of moving together with them and introducing additional platforms later on.
Okay. You've clearly been able to navigate the pandemic and COVID, very effectively. What challenges has the pandemic posed? Are you finding that there are logistics issues with working with companies that work from home? What are some of the challenges that you faced, if there are any?
We always worked virtually with our customers, all the installations are remote installation. We have a management team that is many years together, so our ability, we have shorthand. Our ability to communicate is a very efficient one. Just COVID environment is hard. People are hurting or less travel. It's definitely here. It also has its benefits because, it just really cemented the need for a solution like Varonis and with just the data all over these repositories, organizations understand that, they need us and, many times they understand that they need to move fast. All this transformation for just the modern digital enterprise is just happening very fast, and Varonis is benefiting from it. It's coming from both ends, but there are challenges, but we feel that we are attacking them heads on, and there is a lot of success.
Very good. Thank you.
Our next question is from Joshua Tilton with Berenberg. Please proceed.
Hey, guys. Thanks for taking my question. Just really quick. It seems as if the acquisition's gonna result in more overlapping functionality with SailPoint. Is that the right way to think about it? If so, do you expect more competition with SailPoint in the future, especially as you move up market?
No. There is no SailPoint. I don't know, maybe I don't understand from where is the confusion, but we don't see SailPoint as a competitor. It's just about the relationship between users and data and making sure that we can cater for data protection, threat detection and response, and the compliance needs that related to data and core infrastructure. They are just accelerating the core Varonis use cases to more applications and infrastructure.
Thank you. That was it for me.
Our next question is from Daniel Ives with Wedbush Securities. Please proceed.
Yeah, thanks. When you think about hiring on the sales side, quarter over the next 6 to 12 months, without giving numbers, can you just talk about your thoughts there? I mean, just clearly given how you're doing, is there an acceleration there or just strategically hiring, just given what you're seeing with the success in the field?
Hey, Dan. When we thought and we talked about, kind of the hiring plans after Q1, we talked about continuing to hire on the sales front, but kind of hold off in terms of hiring in some of the other departments, just because we didn't really see how the market was evolving. When Q2 came, we started to see both the pipeline and the results improve and kind of how we go up, and the priority of our customers and showing good results. We talked about it last quarter, that we wanna continue to hire in some of the other departments to take advantage of the opportunity. I think the results, in Q3, that we're very happy with, the 17% top-line growth versus kind of the midpoint guidance of 6%, just reemphasize that. We want to capitalize on this long-term opportunity.
Obviously, we're gonna do it in a very measured way, balancing both top line, and bottom line. We want to continue to hire to capitalize on it. You should expect hiring mostly in sales and marketing and the R&D department.
Hey, Guy, when's the webinar for how to successfully move to a subscription transition? Are you gonna send us the date?
I'll send you again.
Okay, cool. Thanks.
Thank you.
We have reached the end of our question and answer session. I would like to turn the conference back over to James for closing remarks.
Thank you all very much for your interest today. We hope everyone stays safe and healthy, and we look forward to speaking with everyone more this quarter. Have a good night, and thank you again.
Thank you. This does conclude today's conference. You may disconnect your lines at this time, and thank you for your participation.