This is my Varonis. We should have that theme song. I should be a walkout song.
Oh, somebody did that.
Yeah, we need to do that. Well, I feel like you're my Varonis. I went running with Yaki in Central Park. Dave reminded me before the IPO. And I'll tell you, if you know Yaki, you can just see him. You know, we're running and he's, you know, he's gone. It's like five in the morning and it's dark and he's gone within like a minute. And I don't see him and I'm just like, I don't know where I am. And he's just like, just keep running. So we, you know, we do like five miles in the park and he's, you know, he's probably been there for a half an hour. And then he's like, okay, now for the cool down, we're going to run barefoot through Central Park, right? And I'm just like, he's like, he's like, it's very therapeutic.
I'm like, I don't, I don't, I'll trust you on that. I will wear my shoes for that part. But anyway, I've known you guys forever. So thanks again for coming, Guy and David from Varonis. And this is a good room. So hopefully there will be some. I love it when there's participation. Odie, you know Varonis, you can ask some questions, but we'd love to keep this interactive. I'll kick it off, but save your questions up. I'll leave some time at the end for that. So thanks everybody for joining us as we get into the back half of this day one. Let's maybe start, Guy, with you. You guys delivered a really strong quarter. I thought, you know, really beat all metrics. You raised the 2024 Outlook. You know, I want to get the stock.
I just think is a really interesting opportunity here because I think, you know, there's been a lot of enthusiasm in the stock for quite some time based on all the products you guys have developed. But maybe just start out with some of the demand trends that you're seeing. You know, like I said, it was a beat and raise quarter. You've always got a bit of a conservative stance to guidance and outlook, which has proved successful over the years. But just level set us on what you're seeing from a buying environment perspective.
First of all, thanks for having us. It's always great to be here. And you're right, Q3 was a very strong quarter. We talked about it that the enterprise business was very strong. We felt like we were hitting on all the cylinders from new business to upsell to conversion to being able to extract more from new customers. The MDDR was working well. We got the 43% SaaS of ARR. The one thing that didn't work that well in Q3 was the federal business. We talked about that. That was a bit of a headwind for us in the quarter, but I think we are trying to take advantage of a much larger opportunity. We're in a place that we've never been before where, you know, the MDDR, that offering was only introduced at the beginning of this year.
People sometimes forget, you know, and we started the transition to SaaS only at the beginning of 2023. Everything's kind of happening very quick, but happening at a pace that we're very happy with. The value that we're providing to customers with the MDDR is great. In a way, we're saving them on headcount. The SaaS is obviously saving them on their need to buy the infrastructure. The hardware is on us. Basically what we're telling to our customers is that with the MDDR offering, all they need to do is pay. We'll take care of everything else. Yeah, that's been very well received. We talked about the fact we think that MDDR should be ready with every single customer.
You'll appreciate this, but if you go back, what, eight years when DatAlert came out, and this is prehistoric and in a different era, that was the message at the time. DatAlert's coming out. We think every single customer should have DatAlert. And people looked at us and said, what are you talking about? Now it's the essence of the platform. We think that MDDR is a game changer for us in how it can help us simplify the conversation when we sell. And I think that was one of the drivers for the new customers increasing and being able to extract more dollars from those new customers. And overall, we're very happy with where we are.
You know, the fact that you led with MDDR, I think, you know, I think when I talk to investors, it's like, well, tell me about Gen AI. Tell me about, you know, which is important for you guys. But the fact that you led with that, I think to me speaks to the opportunity for that, and Gen AI and Copilot, that's great, but it really is about, in terms of like monetizing the platform today, MDDR. I'm going to double click David with you on that, but I just always find it just so ironic that the government, and I know there's, you know, FedRAMP steps, that the fact that like that they're not using Varonis to a greater extent, I mean, I see it as a real opportunity.
It's on us. I think we didn't do a good job there. I think we made some changes there, and I think that the opportunity is great. You know, the need for the product is essential. When you think about the fact that data can be taken out and so much harm can be done when it gets to the wrong hands, it's a no-brainer, so I think the softness that we had in the federal business had nothing to do with competition or market fit or any of those. It was just we changed the leadership and we're hoping to take advantage of that going forward.
Okay, great. Let's double click on MDDR. David Gibson, SVP of Strategic Programs. What was your title when you guys went public? It's evolved over the years a little bit.
I've had a lot of titles.
A lot of hats, but yeah.
A lot of hats.
You're actively involved, I remember, with DatAlert and DatAdvantage and now MDDR. Talk about why, you know, why did Guy mention that before other products? Like what are customers saying of why that is such a game changer?
You know, I think in general, it's important to remember the history, you know, what happened with DatAlert, right, and how that came out. It really did become the glue for our products, you know, because you'd get one, we'd get really good alerts in one place and then, yeah, why wouldn't you want to have them in another place? One of the things that was an offshoot of DatAlert was our IR team. We, as we got closer to security and more strategic when it came to security, especially with ransomware and all the attacks on data, it became apparent that customers needed help. They needed experts to call when they saw an alert on our software or any other software they had, and we could add value there. Our IR team was formed in around 2017. It became really popular, really sticky.
You know, it was a really great value-added service around that. But when we came out with SaaS, we really turned the model on its head because prior to SaaS, customers would need to call us when they had a problem. With SaaS now, we could proactively watch their alerts. And this has been a game changer just in and of itself because we're, even if you give a customer a two-hour head start on a cyber incident, that's huge, right? In today's world, we're moving so quickly. And so when we came out with SaaS, we came out with that proactive IR, and then MDDR kind of augments that in a pretty big way. One, it has an SLA. So if we see ransomware, for example, we have 30 minutes to call them, right? And we also have built-in transparency into our dashboards, our platform.
So you can, at any time, see what our incident responders are looking at, what they've closed and why, what the steps were, which is a level of transparency that you don't get even with other managed detection services, much less, you know, nobody really has a managed data detection and response service. So, and then I guess the last thing that's really important is because we're in SaaS and we have these like the best analysts in the world, you know, and if you think about it in terms of like the frequency of alerts that they deal with every day, it just dwarfs any average customer, right? There's just more, you know, more activity there. And we can train, you know, using AI, we can do more automation to automate more of the steps that these best-in-class IR analysts are taking every day, making it more efficient.
So, you know, if you add all that together, it's like we now have customers that will come see us at different shows and conferences and say, you know, I looked at the dashboard. It's like you escalated three things to me over the past three months, right? And I see all the other alerts that you closed and how you optimized it and why. And it's just such a.
Not only an ROI, but it's making the company more secure.
Yeah, I mean, ultimately nobody wants a breach, right? And if we're helping them protect, you know, prevent breaches, limit the scope and the contrast to customers that don't have us is so stark, right? A lot of times if a breach happens, call in a very expensive IR service and the best they can tell you is Patient Zero, right? We don't know what data was taken, right? And just to even try to piece that together, and with us, most likely, you know, you're starting to have a much reduced chance of a breach. The impact of the breach is much smaller. And if anything is accessed, we know exactly what that was. So you can determine materiality in a much more rapid pace and hopefully avoid it altogether.
I mean, we could spend this whole conversation on just this, but I want to go back maybe to Guy. The SaaS transition, you know, certainly been a key focus for you guys. And, you know, we think, you know, SaaS becomes, you know, half the mix within the next quarter or two. I mean, it feels like that's where it's going to happen. You know, can you talk about some of the progress that you've been making in SaaS and where you see that going in 2025 and 2026?
When we announced the transition, we talked about a five-year plan, and we defined the transition to be complete when we get anywhere between 70%-85% SaaS of ARR. As you mentioned, we expect we talked about 49% at the end of the year. Let's just assume we'll be roughly in that 50% mark by year-end. That puts us in a very good position to be after two years, and sometimes people kind of forget that we only started two years ago or less than two years ago, so when we look at 2025 and 2026, we want to move as quickly as we can because it's a better product. The value that we provide customers is much greater. It really is a no-brainer in that sense, but converting those customers over does require attention.
And if anything, I think probably one of the biggest misconceptions that we're getting from investors is that they don't fully understand how much additional bureaucracy is involved when you convert a customer from on-prem to SaaS. If you get a renewal that is an on-prem subscription, an on-prem subscription customer just providing a renewal could be a very simple exercise. When you try and convert them, you're actually changing contracts from an on-prem subscription contract to a SaaS contract. And therefore, there's additional legal department involvement, which puts obviously additional bureaucracy into it. We're going to do it. We're going to focus on converting our customers because of the value that we can provide them. But I think investors sometimes underestimate how much time it takes and how much it puts more pressure on the sales cycle in terms of the timing of our conversions.
When we come out with NRR, and that's a metric that we give out annually, when we come out with that number, when we report Q4 results, I've been very clear within conversations where NRR is not going to be a huge number. You know, last year it was 107% on a constant currency basis. We expect that number to actually be lower than that. That's because of the time it takes us and the effort that's put in in converting our existing customers, which means that when you look at kind of what's the driver of our growth being today at 18% ARR, it really is coming from new customers. We obviously want to improve the NRR, and I think we have kind of the playbook to do it.
But when you take that critical mass of customers and you're trying to convert them, that paperwork and that documentation and that. It's not a technological issue. There's no issues in converting them from a technological perspective. It's just the fact that there's more paperwork involved in switching. And like I said before, we're going to do it, but it just takes some time.
Can you talk about some of the pricing uplift you're seeing when that's been successful? And to what extent has that been a driver of your growth thus far?
So the SaaS price list is 25%-30% higher than the on-prem subscription when it's like to like the same number of licenses. We've seen very good momentum with our pricing where that 25%-30% is holding nicely. And in some cases, when customers are actually converting and are consuming more of the platform, that could actually be slightly higher. But I think one thing to keep in mind, we've only converted about a quarter of our base. So we still have a long ways to go. We obviously are focused on that. But when you look at that 25%-30% uplift over two years almost, and only a quarter of them have been impacted, that means that you can see how much the contribution of the conversion is actually impacting your total growth.
It feels like that. I mean, as the transition accelerates, I think we think there's probably some natural acceleration of the business. But it's interesting, you know, only a quarter of the business has actually converted thus far. I mean, when you're talking to customers, David, you know, especially when MDDR comes into the conversation, you know, the 25-30% like for like is what you noted. I mean, you know, is that, I mean, is that where the conversation starts or, you know, is that where it's sort of like, you know, like, well, that's just to kind of get in the door and then we talk about further expansion beyond that?
I think that it's a core component of any new SaaS deal, certainly, and certainly is a core component of any upsell or transition opportunity. It's a big value add. You know, there's so much value add. The comparison between our self-hosted software, right, you know, whether it's perpetual or on-prem subscription and what we've done in SaaS, though, there's a lot of things that we highlight. There's so much more automation in terms of the remediation. There's so much more coverage that we have today than we did. I think we've, you know, we've come out with so much coverage just in the past few years, and there's, I think, the automated protection, the ease of use, the threat modeling that we have, there's so much to talk about and there's so much to like.
The fact that the customers don't have to manage the infrastructure is, you know, obviously, you know, a big benefit as well.
Yeah. The other thing that stood out to me, I think you guys talked about having some success with Copilot in 3Q. You didn't quantify it.
He said it was an immaterial.
Immaterial.
But still closed a couple of deals.
So I guess like double-click on that. Like a year from now, could it be, you know, 5% of ARR? Could it be, you know, is it like what could drive further adoption there?
We think AI is the real thing. And the fact that it can actually, it's here to stay, I think. I think everyone's kind of just starting to taste the impact of AI. We're definitely seeing the impact that AI has on risk and data being exposed. Think about it. If you had someone from the outside take over credentials, they had to search in the past to find the sensitive information. Now they just click whatever they're looking for and they get it in seconds. And you also have risk from within the organization. If they're searching for whatever they're sniffing around to find out, they'll get the information if the sensitive information is not put in place the right way. So we've seen situations where people ask who got a salary increase last year and they get the full list of employees within the organization.
They got a salary increase. It's pretty scary.
Why would you not take that in terms of like what's the resistance to, is it just Copilot?
No, I think, but the one thing to note, and we've been very consistent in our, in kind of the way we've looked at AI, is that it takes time to be fully adopted within the organization. And I started getting asked about AI a year ago. And we said, listen, we're not seeing the full adoption within the organization. We're seeing it still adopted within certain groups within the organization. And until it gets to a point where it's adopted by everyone, not everyone's going to see the catastrophe coming. Some of the organization are preparing for it. So we're hearing the conversations. In Q3, we actually started seeing deals closed, but again, it wasn't an immaterial number.
Very hard for me to quantify how does this move forward from an impact perspective, but we do believe that it will have a major impact as a tailwind for the business. It's just very hard to know if it's one quarter away, two or three quarters away, but we definitely, from a guidance perspective, we didn't bake any of AI into Q4. And obviously, as we finish the year, Q4 being the largest quarter of the year, we'll give more color in terms of the expectation for next year.
David, we've been talking competition for a decade. Like it felt like the market wasn't, maybe it wasn't ready for Varonis a decade ago, right? In terms of like data governance, data security, and you guys were really evangelizing a category. Today, it feels like a lot of people are talking about your market. Could you talk about the competitive dynamics and like now that you see probably more people in bake-offs, what are your win rates against maybe some younger companies that are coming at it like from maybe a different perspective?
Yeah, we definitely have a lot more companies out there that are talking about data security, the focus on data, you know, certainly from when I started. It's night and day. So that's nice because we don't have to evangelize the problem nearly as much as we had to before, if at all really. Now, I think we're being pulled into more opportunities because of that. There are more RFPs, more activity in general. And the good news is even though some of the players have changed, the song remains the same. When we go in and look at a sizable amount of production data with any kind of security lens trying to get to a security outcome, we're still alone, right? I feel really good when, you know, there are a lot of paper tigers, right, out there, a lot of people that are marketing to it.
But when it comes down to actually getting something done with respect to security, that's when we stand out. So, you know, whether it's a DSPM technology or standalone classification, they're doing a good job of talking about data and talking about the problem, but we have a really good shot.
I mean, I always think it's like the granularity that you guys get to is far superior. And then from a classification perspective, I think that's where you guys excel, even versus some of the up-and-comers.
Yeah, I think in terms of, you know, when you look at the problem at scale and how frequently data changes to keep up with today's environments and then to actually make sure it's locked down and to watch it for, you know, all kinds of threats and then automatically respond to those and, you know, wrap an MDDR service around that, that kind of depth, you know, sometimes it takes a little while for people to think through all of the advancements that we've made for so long in service of protecting data. But if we do a good job at the risk assessment, you know, then we're understanding.
Yeah, yeah. Guy, one of the questions that I get from people really across the software landscape is how do we think about 2025 guidance? And you guys obviously haven't guided at 2025 yet. You typically take a pretty conservative stance to start the year and end up beating, you know, throughout the year. Could you remind us about how you thought about ARR coming into this year from like a net new perspective and how that might help us think about some of the building blocks for 2025?
Absolutely. When we guided for 2024 ARR number, we took the net new ARR that we achieved in 2023, and that was our starting point for the guidance for 2024, and obviously in Q1, Q2, and Q3, we did much better, so it was nice progression, and we've accelerated our ARR to 18% this year at the end of Q3, so when you think about kind of, and obviously we're not guiding to 2025, we want to see how Q4 ends, but that assumption and the way we did the same methodology that we used in 2024 could make sense when we think about 2025 as a starting point.
Yeah, that's kind of how we thought about our 2025 estimates. And you know, [audio distortion] was pretty close to where we were before, but it feels like that's a pretty, it's the right approach in this environment. But I thought that was a helpful framework. And then revenue follows from a lag perspective. What do you think about?
Revenue is a lagging indicator. We talked a lot about the fact that you can't really understand the health of a business through revenue when you have such a big difference in the way you recognize on-prem subscription where 80% is recognized upfront versus SaaS that is ratable, so throughout the transition, we talked about three North Stars: ARR, ARR contribution margin, and the free cash flow, and I think when you look at kind of the progression of ARR contribution margin, we talked in the investor day at the beginning of 2023, we talked about an ARR contribution margin being 20% by the end of 2027. We're at 15% today, so we're really moving very nicely ahead of schedule. Free cash flow, we raised our guidance in the last earnings call to $95 million- $ 100 million. Yeah, and that's versus roughly $50 million of last year.
So progression on both the expense side and the cash generation are extremely healthy. And they're an indication that we're not just focused on growing, but we're focused on growing in the right way where we bring some of it to the bottom line. Now, granted, we don't want to put aside any of the opportunity and we want to continue to invest. And if you look at Q3 net new hires, it was actually one of the largest numbers we've had in a long, long time, the additions that we brought in. So we're definitely investing in the business to capture the market opportunity. But we also want to make sure that we do it in the right framework and the right way. And ARR contribution margin and free cash flow are an indication that it's working well.
That's great. I'm going to ask one more and then we'll see if there's one from the group. How should we think about the strategic rationale and potential use of the convertible bond that you guys issued? I believe it was in September. Was it September? Yeah. Talk to us about that. What does that imply or how do you kind of think about that?
So our first convert that we took out in 2020 is coming due in August of 2025. So obviously taking that into consideration, we want to take advantage of a favorable convertible market. But the essence of the convert, which, you know, now that we have it in place, gives us a lot of flexibility in kind of treating the first convert. But really the biggest thought process behind the convert was M&A. We want to make sure that we have enough dry powder to use when the time comes and find the right opportunities that can help us grow the business. Now, we're not changing the risk profile of the company. We're not going to go out and buy in crazy numbers.
But there's definitely, from an R&D tuck-in acquisition perspective, there's definitely a lot of things that we're looking at that could make sense and speed our time to market. Now, we don't think that the M&A is necessary in order to get to the billion dollars. It's more like how do we continue to grow post that $1 billion mark. And in that build versus buy conversation, time is of the essence. You know, we're standing today, and I talked about this before, the opportunity has never been greater. So we want to make sure that we take into consideration the time it takes to produce some of the stuff. And if we can make some shortcuts with M&A, we'll do it.
Yeah. We'll see if there's a question out in the group here. Oh. No participation. Thanks, Michael.
Thanks.
Oh, I think it's working now. I heard you tell me.
Thanks. You guys talked about most of your growth coming from new logos, right? The 18% ARR growth versus the 107% NRR. For the new logo piece, when you guys win a new logo, is it typically there's nothing there, it's a homegrown solution, or is it a competitive displacement? And just to follow up on Matt's question, do you guys talk about a competitive win rate?
So most of the time when we go in and we do a risk assessment, we typically see a lot of sensitive data that's in unexpected places and also in harm's way, open to too many people, right, overly exposed. We also see that most organizations are blind to what's happening on their data as it happens. Think about it, just a bank analogy. If you're, you know, it's like running a bank without a ledger, right, or a credit card without a record of the transactions. So in that sense, you know, there's really no other company, no other technology that solves some of those problems and can automatically reduce the risk that's around data. There are adjacent technologies sometimes that we can retire that do little pieces or little point solutions, point auditing tools, point permissions tools, point classification technologies, point AD security things.
There are some things that we can take out, but for the most part, it's a new technology. And I think the good news is, the more that people talk about data security through the lens of DSPM or just, you know, data security in general, the more people are paying attention to it and more expecting a little bit more to focus on that.
You wanted just a little bit more color on win rates. I think you said.
If they're testing any kind of production data with any kind of scale, you know, it's rare for us to not win that.
One more thing to add. We talked a lot about the fact that, and we talked about it in Q2 and mentioned it as well in Q3. With the MDDR, we've actually seen sales cycles for SaaS shortened compared to what they were on the on-prem subscription side. That's a very healthy kind of trend that we hope can continue.
Have you talked? My head's like spinning with this week. I can't recall. Have you talked about MDDR? Still early? Have you talked about the number of customers that have adopted it or any sort of?
We haven't broken out the adoption of it, but we said it was really the fastest adopted. I call it platform because we're not selling a service, we're selling a platform, but it's the fastest adopted platform that we've ever had.
Yeah. You've had some rapid adoption of other products too. So yeah. Maybe with just 90 seconds to go, you know, there's what I've liked about Varonis. It feels like there's a series of S curves that you guys are always sort of like, you know, you don't have to hit them all. You're trying to hit a number of them concurrently though. You know, maybe David, from your, you talk to customers every day, like, you know, when we're sitting here a year from now and you're like, Matt, like I was really surprised that X happened from a customer. Like, what do you think that, what do you think that could be that positive surprise with sort of all the irons that you have in the fire today?
I think there is an increased focus on data and data security. I think AI, for example, has added a new focus, a new light on the problems that we've been solving for a long time. So there are a lot of forces like between the DSPM markets, right, the other markets and between AI that are putting a new spotlight on data. And that is going to naturally lead, I think, to, you know, something that's going to solve the problems around it, right? Something that automatically can protect data at scale, something that can watch the data for them and protect them from breaches where they just have to pay, right? They don't have to add staff. You know, there's, I think there's a lot of pressure on the problem right now.
We'll see how it plays out, but I think we're in a really exciting spot.
Then maybe guide to close. You've kind of helped us think about an ARR framework. You mentioned you're investing in the business. How do we think about kind of balancing growth and profitability when we think about like the ongoing margin expansion?
The opportunity, as I said, has never been greater. So we want to continue to grow. At the same time, we want to show improvement year over year. Now it can move sometimes from one quarter to the other. If we see something that we feel is worth investing in the short term, that can help us in the long term, we'll take that into consideration. But the framework of that 20% ARR contribution margin is an aim that we're trying to get to still stands intact. So that's kind of the framework.
This is, I think the 10th year we've done this now. You passed your 10th, I forgot it was in February. Congrats on the first 10 years of a public company and best of luck the remainder of this year.
Thanks again for this program.
Thank you very much.
Thank you.