All right. Good afternoon, everybody. Thank you so much for joining us. My name is Hamza from Morgan Stanley, and with me, it is my pleasure to have the team from Varonis. We have Guy Melamed and Brian Vecci, Field CTO, Guy being the CFO and the COO of Varonis. Before I begin, just a brief housekeeping point for important disclosures. Please see the Morgan Stanley Research Disclosures website at www.morganstanley.com/researchdisclosures. With that, Guy, Brian, thank you so much for joining us.
Thanks for having me.
Thank you.
All right. Let's jump right in. Brian, it seems like data protection is more important than ever. Maybe just briefly explain why that is and sort of Varonis's place in that.
Sure, so we live in a world where there's data everywhere, and it's growing very quickly. That's been true for a long time, but these days, enterprises really struggle with visibility. They don't know what kind of data they have in which places, and it's not just in their data centers now. It's in a variety of hyperscalers in the cloud, SaaS applications, collaborative stores like Microsoft 365, Google, and Box. They struggle to know what they have, where it is, what's important. They struggle with ensuring that only the right people have access to what they're supposed to, and they struggle with making sure that as all of these cloud platforms are connected together and they're trying to leverage the benefits of generative AI, that they don't end up introducing more risk and exposing data.
So what Varonis does is give them visibility, automatically telling them where they've got sensitive data and who and what's got access to it. We watch how all of that data is being used by human and non-human accounts, by generative AI tools and third-party applications. And then we give them the automation to safely lock things down and the visibility to monitor things effectively. So if anything ever goes wrong, whether it's an insider threat, an attack like ransomware, or just a mistake, that they can quickly identify it and quickly and conclusively investigate and respond to it. That's really what data security is. It's making sure that that data is properly protected and monitored. And we do that in all of the places that our customers and enterprises have data, and we get them to these outcomes automatically.
Yeah, and maybe to bring you in a little bit, Guy, as well. One of the things you've been talking about is every organization is trying to figure out how to deploy generative AI applications in the enterprise, and obviously, before you do that, you have to make sure your data is prepared, so what's been the momentum there more recently?
I think one of the interesting things we hear a lot of stories with customers that try to implement the AI, and then they realize how vulnerable they are. One very small example is a company that started rolling out AI and then realized that employees were putting in the Copilot a question of who got a raise in 2024, and they got the full list of information, which is pretty scary when you think about it, so AI is really putting this spotlight on a problem that always existed, but in a way, is just exemplified with the AI because now it's easy to do, and that's definitely something that we can help with. We talked about the fact that in Q4, we started seeing Copilot contribute more in terms of our sales and started having a meaningful contribution.
I think one of the interesting parts is that we have Copilot together with the MDDR, which is making it really simple. The value proposition is huge. The whole conversation with customers is much easier. Now it's not about what the different functionality is. What we had during the on-prem subscription life where we had multiple SKUs, now it's, we're going to protect you. What platform do you need? MDDR is about us helping you make sure you're protected. And the whole conversation is much easier, and it's resonating really well.
No.
Yeah.
Guy hit on it. Yeah. People want to use the AI tools, and they need Varonis before they can.
I wanted to give Guy a break because we'll grill him soon enough. Maybe speaking of which, Guy, so one of the things Varonis has also been doing in the last couple of years is they've been embarking on the SaaS transition. Obviously, a much significant product improvement, as well as there's financial implications as well. You initially had targeted that the SaaS transition would be complete by 2027, where 70%-90% of the total ARR would be on your SaaS product. You're two years ahead of that plan. You're expecting to be within that threshold this calendar year. So one, maybe explain to us why you were able to do it so quickly and what it means when you onboard a customer to SaaS. What is the lifetime value potential of that customer versus on-prem?
Very good questions. I think when you look at kind of the evolution, and I think people sometimes forget that we only announced the transition at the beginning of 2023 and laid out kind of the five-year plan in our Investor Day at the time. We talked about a five-year plan, and we're able to cut it by one year at the end of 2023 and cut it by another year at the end of 2024. And the reason it's moving so quickly is because the product is so much better. The MDDR is not offered under the on-prem subscription offering. And when you look at the landscape and you look at the fact that the risk is increasing by the day and the environment, hacking and ransomware and everything, the events are happening, increasing exponentially. Customers don't have enough headcount to deal with the problem.
They're not getting an increase in headcount in the same rate that the environment and the risk is increasing. They don't want to deal with it. And also, the expertise of the security personnel isn't catching up because it's so challenging to do that. And that's why MDDR is resonating so well. So when you look at kind of the SaaS offering, when we look at the amount of updates and significant upgrades that we have come out with over the last two years, it's pretty safe to say that it's more than kind of the amount of updates that we had with the on-prem over 10 years. So it really allows us to cater to kind of the needs of customers. They don't need to deal with the headcount. They don't need to buy the hardware. It's on us. We help them with that.
And that's been resonating really well, helped in reducing the sales cycles that are shorter on SaaS versus the on-prem subscription. But I think what's even more interesting, and I think that kind of gets sometimes lost in the weeds when we talk to investors, is that once we get customers to SaaS and you're showing them the value with the MDDR, they'll come back and buy more, and they'll be protected. They'll ask to be protected on additional platforms that are not covered in that first initial sale or in that first initial conversion. So we talked about NRR at the end of 2024 being 105%, but we also said that the NRR of our SaaS customers, when you look at kind of the denominator being customers that bought SaaS in 2023 or converted in 2023, that NRR was much higher, significantly higher than the 105.
So we kind of talked in Q4 about the fact that we believe we can go back to that 20+% growth rate. And if you kind of assume that we've converted all of our customers and if you only use that NRR for SaaS customers plus what we had with new customers, we'd already be at 20+% growth rate. So that gives us a lot of confidence that once we get customers over, and that's part of the reason we're kind of trying to move as quickly as we can, we can increase that customer lifetime value significantly. We've already seen ASPs go up with SaaS. When we talked about that in Q4, that the ASPs went up 20%. And that's SaaS to SaaS. Q4 of 2024 versus Q4 of 2023.
So it doesn't even bake in any of the hardware and the additional SaaS to on-prem price list increase. So ASPs have gone up. We're seeing the NRR of SaaS be significantly higher than the 105%. And overall, kind of all the feedback that we're getting from customers on the MDDR and the SaaS offering is that it's helping them with a problem that they cannot solve otherwise.
That's a great point. I want to make sure I sort of double-click on that. So you're saying we know the on-prem to SaaS uplift has been, I believe, 20%-30% in that range, which I would say is even low compared to what you could charge for, it seems like. But just the SaaS for SaaS, when the customer onboards on SaaS, even those ASPs are going up 20% once they onboard.
When you look at the ASP of SaaS to SaaS on the new customers in 2024 versus 2023, we saw a 20% increase. That's happening for two reasons. One, we're going up market, and two, some of them are buying kind of the larger platform, but even when you look at the fact that we're landing larger ASPs, the amount of platforms that aren't covered in that first initial sale or in that conversion is so significant. The richness of the platform allows us to feel very confident with kind of our ability to go back to the customer and sell additional platforms. The customer lifetime value on SaaS is significantly higher than the on-prem subscription. You see that with both kind of the sales and marketing as a percentage of ARR that has come down significantly.
You see that with kind of the free cash flow that has increased significantly from the day we announced the transition, and that's during kind of the years where you're investing the most in order to transition, so we feel very good with those data points and the fact that the technology was built in a way that generates a ton of efficiency, and I think we can continue to improve on that in the years ahead.
I think that customer lifetime point that you make is a very important one because I think one of the debates has been in the last couple of quarters in particular is, yes, we've seen the ARR growth of Varonis accelerate in the last 18-24 months or so, but the conversion timeline has been pulled forward as well, and the implication would be that it's largely conversion-driven, which may be true, but the reason for that is you want to get all the customers on the SaaS product, and to what extent is that coming at the expense of existing term license upsell?
I will say this very delicately. The whole conception that we are growing because of the conversion, if anyone looks at the results in Q4 and the data that we have provided, I don't know how you hold that thesis. In our opinion, the conversions are not only not helping us grow, they're actually slowing us down because it takes time. The reps are focused on those conversions with customers. And if we didn't convert them, they can spend time on selling to new customers or doing the upsell. So one thing to keep in mind is that if you're an on-prem subscription customer, none of our reps are trying to upsell to you until they get them over to SaaS. So in a way, we're getting that uplift from on-prem to SaaS, but we've only gotten to 53% SaaS of ARR over a two-year period.
That's about a third of our customers over a two-year period. When you do that on an extrapolation basis, you see that the rest of the customers are either kind of in position to be converted or you're not upselling to them. When you look at NRR being 105 and you're looking at the ARR being at 18%, do one minus the other, you see that the majority of the growth is coming from new customers. I've never believed that I would hear our Sales force say that it's easier to sell to new customers than get a customer to convert. That gives us a lot of confidence that if we can get through the transition, and I think there's a lot of lessons we've taken from 2024 that we're going to implement in 2025. A, we're dealing with the conversions ahead of time.
We're talking now to customers that are up for renewal in Q4. We're not waiting for Q2 or Q3 to have those types of conversations. We've increased the headcount in terms of the supporting functions that help on the conversions. We want to be ahead of the game. We're focused on our legal team. We increased the headcount there to deal with the documentation and the whole checklist that are required when you move from on-prem to SaaS. So I think there's a lot of things we've learned in order to make sure that we can get customers to convert in a smoother and easier way.
I think it makes a lot of sense, and I mean, typically when we see companies go through a SaaS transition, it usually takes four or five years to get to half of your ARR base being SaaS, and you guys have been able to do it in just a couple of years, so it's quite remarkable. Maybe to bring Brian into the conversation as well, I mentioned you're charging the SaaS product at about a 25% uplift versus the on-prem, which I would say relative to the ROI that you're getting, probably fairly low.
I would agree.
So maybe just explain to us, what are some of the productivity or the ROI improvements that you do see when a customer moves to SaaS?
A big part of it is SaaS is just a better way to deploy enterprise software. Customers don't have to worry about deploying and maintaining the infrastructure it takes to run Varonis. That means database servers and analysis servers. All of that goes away. In fact, the biggest reason or the biggest impediment to a self-hosted customer getting the full value of everything that all of the promise of the Varonis platform is almost always environmental issues. They have a database server that is sized inappropriately or there's some connectivity problem. All of that goes away. And a data point that supports that is that we've seen customers that have moved to SaaS see a 90% reduction in the number of support tickets that they open. So even though they're using the product, they have far fewer issues because we can handle everything on the back end.
It's also just more functional. Gone are the days where a customer would license Varonis by module that was based on capability. Now we license it by you've got Varonis for Microsoft 365, you get all of the relevant capabilities. Varonis for NAS and Windows, you get all of the relevant capabilities, which means there's nothing getting in their way of realizing all of the value that we talk about when we sell the outcomes of your data is going to be better protected. We also have capabilities that never existed in the self-hosted platform. MDDR would be impossible in a self-hosted world. We can only offer that because of the automation that we were able to build and the fact that we have the visibility into our customer environments on the back end. We built automation for 365 that never existed in the self-hosted world.
Visibility and automation for Microsoft Copilot never existed in the self-hosted world. So it's a much better product that takes far fewer resources from a customer perspective to run and maintain. That means the TCO goes down, but the value goes way, way up. So to your point, the ROI is massive.
Just one more point on the MDDR. We truly believe that the MDDR is the glue that kind of puts everything together. The fact that you provide value with the MDDR can help you actually sell and protect additional platforms because if a customer sees the value and they're protected on A, B, or C platform, why wouldn't they want to be protected on platform D, E, and F? So we've definitely seen that happen. I will also say that when we look at kind of the MDDR, we talked about the fact that we expect every customer eventually, every customer should have MDDR. It's going to take time, but that's kind of the direction we believe our customer base should be going.
Just to add on to that, the MDDR service itself becomes more valuable the more platforms you have Varonis monitoring. An attacker, a threat actor, can find a login and password sitting in a file in someone's OneDrive and then use those credentials to move to your Amazon or your Salesforce environment. With MDDR, we're going to see that because we're watching all of that for our customers.
Just maybe a question on the landscape, the competitive landscape. So I mean, it does feel like every other week you hear about a new data security company, either getting funding or getting acquired. So there hasn't been more attention on this category, I think, ever. Maybe the first question on the competitive side, because you mentioned their name around Microsoft. Microsoft has a product called Purview. I think any investor who's gone to any of these industry conferences, they'll see that you and Microsoft partner pretty closely together. So maybe just if you could explain in that data governance, data protection lifecycle, what does Varonis do? What does Microsoft do when you do partner on some of these Copilot deployments?
So it's important to note we're on the Azure Marketplace, and Microsoft reps can retire quota on Varonis deals. We're a very tight partner with Microsoft. We have been for a couple of decades now. We integrate directly with Purview. One of the challenges that a lot of organizations face with the capabilities that are under the umbrella of Purview is it can take a lot of work to make sure that all of that data is properly tagged and labeled so that Purview applies. Very few, if any, of the capabilities that you get as a Microsoft customer using Purview overlap with what Varonis does. So we're filling in security gaps.
And because we integrate with Purview and we automate all of the manual work it takes to make sure that your data is properly protected for Purview, customers get more value out of Purview, and they close gaps, and we do all of the work for them. So that's one of the reasons we're considered such a strong partner with Microsoft. We use Purview. Our customers use Purview. We encourage them to do it. And the great thing about using Varonis is because we can automate the exposure and monitoring and alerting problems that customers have, once they've got us in place very quickly and with very little effort, now they're ready to use Copilot for 365 without having to do a lot of manual work.
Maybe a guide question for you is, I mean, there's been a lot of attention on this category. A lot of companies who are scaling to tens of millions of ARR, no one that's anywhere close to the size of Varonis, but all that attention to the category, what has that done from both an opportunity standpoint versus a competitive standpoint?
It's a very good question. I think when we look at kind of where we are today compared to where we were a year or two ago, we're definitely seeing the TAM increase significantly, and actually, for the first time in our history, we're seeing other companies that are putting marketing dollars to work that we can benefit from, so I think overall, when we look at the opportunity, it's actually grown for us. When you look at kind of the level of investment that we have guided to in 2025, we definitely want to put money to work in order to capture the larger opportunity that we see, but we're still doing it in a very responsible way.
So if you look at the ARR contribution margin, we're showing improvement on the guidance in 2025 versus the actual results in 2024, just being roughly in that 17.5%, but way ahead of kind of the schedule, the target that we gave during the Investor Day of that 20% for 2027. So I think it's very clear that from an ARR contribution margin perspective and from a free cash flow perspective, we're ahead of schedule. And if we wanted to, if we were only focused on those metrics, we can even improve them. But at the same time, we want to put money to work that can help us grow in the years ahead and make this growth and the opportunity that we see be capitalized the right way.
Maybe just one more question, and then I'll open up to the audience. From a go-to-market perspective, has there been any change from a sales compensation perspective this year to really incentivize the SaaS transition? And then related to that, anything that you're doing in the channel differently as well?
So anyone that has followed us remembers that in 2024, we kind of made some changes and put more focus on the new customers from a commission perspective. That's still the focus because we see kind of the new customers as the fuel that can help us grow on the customer lifetime value over our journey. What we did make in terms of changes in 2025 is put some emphasis, carrots and sticks, on the conversion side. We want our reps to focus on kind of on both cylinders, getting customers converted, but also focusing on the new customers. It was very well received during our Sales Kickoff in January. So I think there's a tremendous opportunity for the reps to do the right thing and get compensated the right way for it.
Any questions from the audience? Probably a bit sleepy after lunch. Maybe a question on the public sector side. Obviously, it's a big topic. Maybe if you could remind us again what percentage of the business roughly is coming from U.S. Federal or just public sector in general and anything you've seen?
The federal business hasn't been a major contributor for us. We're in the mid-single-digit % out of total ARR. We definitely believe that we can do better. We changed leadership at the end of Q3. We definitely believe that when you look at kind of the opportunity and you look at the problem that needs to be solved, it's just as a problem for the federal customers as it is for the enterprise business customers, if not more, when you think about the sensitivity of data that's out there. We've tried to focus and kind of increase and kind of be tied more to budgets there. Still early to see how that progresses throughout the year. Q3 is obviously the largest quarter, so we need to wait and see. We're definitely focused on trying to capitalize more in that area.
You mentioned profitability a few times too. I mean, yeah, the free cash flow we've seen obviously inflect quite positively in the last couple of years. One of the things I've also been impressed by is the gross margin, which has been pretty healthy despite the higher SaaS mix. So what's driving that? And are there any other areas of efficiency you're finding a lot of companies are using generative AI internally to drive those efficiencies? So if you could maybe talk about that a little bit.
I'd say the number one driver of the efficiency and the gross margin and also the free cash flow that has been way better than I'd say what investors initially anticipated is the way the platform, the SaaS platform, was built. It took years of experience and history under the on-prem subscription, took whatever was good and implemented that as part of the SaaS, and took what was challenging and made it better. But it was built in a very efficient way that allows us to keep very healthy gross margins. I think the MDDR as a whole can not only help in doing the upsell, but we expect it and hope that it can help on improving our renewal rate that is strong already to make it even better.
At the end of the day, the targets that we gave in the Investor Day for the gross margins for 2027 were in that 80% gross margin range. We've done better than that so far. We do expect it to come down a bit from the levels we currently are at just because of the investments we're making, but we feel very good with kind of the numbers we put out there in 2023.
Any questions? I'll grab one more time. Okay, I can keep going. From a macro standpoint, obviously, you've had a couple of years now selling the SaaS product. Can you just comment on pipeline coming into 2025 versus 2024 or prior years?
I think the problem is severe, and potential customers are dealing with challenging times where the environment and the risk of losing data from people kind of logging in from the outside is significant. But they also have the risk of people from within the organization taking data and giving it to competition. When we look at kind of the environment, we talked a lot over the last, I'd say, a year or two on the fact that kind of the macro, I'd say the word that describes it most is stabilization. We have seen, and we called it out. I think we were one of the first companies that called out at the end of 2022. We talked about the fact that we saw sales cycles increase, more deal scrutiny, and kind of the macro kind of coming down a bit.
But since then, I'd say the word to use is stabilization. The one thing that helps us is the SaaS offering because sales cycles on SaaS are shorter than the on-prem subscription. The value proposition is greater. Companies can save on the hardware and save on the headcount, so the total cost of ownership for them is lower. And that's what's in a way helping us. So going into 2025, when we look at the guidance that we've provided, we kept the same philosophy that we had in 2024, which means taking the net new ARR and adding that to the closing ARR number for the year prior. And that's the starting point for our midpoint guidance. So in 2025, that's similar to what we did in 2024, and that puts us at that $741 million midpoint number.
We obviously would be happy to update that guidance throughout the year if we can execute the way we think we can. And I think there's a lot of cylinders that we can hit on, whether it's new customers, whether it's the existing customers' conversions, whether it's new territories that we're making investments in, whether it's verticals that we haven't had huge success in the past that we think we could do better. So I think there's a lot of drivers for our growth. We just need to execute on them the way we think we can.
You mentioned the sales cycle point a couple of times. Just if you're comfortable disclosing, what are the sales cycles on the on-prem versus the SaaS product today?
So on the on-prem subscription, it's anywhere from three to nine months, and on the larger deals, up to 12 months. We have mentioned that the SaaS sales cycles are significantly lower. We didn't lay out the numbers, but you can assume that they're pretty significantly reduced. And it makes sense because if the whole conversation now is about, "We're going to help you, we're going to help you with the MDDR, and we'll do a lot for you," the whole conversation becomes way simpler than what we would have done in the on-prem subscription, which is lay out each functionality of each SKU. And that's received very well by both the Salesforce and the customers.
You recently raised some capital. You announced a share buyback recently as well. But just on the capital allocation strategy, could you talk a little bit about M&A versus buyback, how you're thinking about balancing?
Absolutely. So really, three components of capital allocation that we constantly analyze. The first is investing in a business. I think we've shown our commitment to making the right investments, but doing it in the right way. If you look at the 2025 budget and kind of even when you look at it through the guidance, you see that from a dollar perspective, it's kind of the highest investments that we've had, mostly focusing on the R&D and the sales and marketing, but also partially on the MDDR and customer success. So we're definitely putting money to work because we see the opportunity. So that's element number one. Element number two is the M&A side. The second convertible gives us a lot of dry powder that we can put to work. I wouldn't say that we're going to go and acquire in crazy numbers.
I wouldn't say that the risk profile of the company has changed with the way we're looking at M&A, but we're definitely looking more at technologies that can help speed our time to market. So in that conversation the analysis of buy versus build, time to market is definitely a critical component. And the strong balance sheet that we have gives us the flexibility to put money to work. So that's the second element. But again, without changing really the risk profile, we're not going to go and acquire in crazy numbers. Definitely looking at the R&D side kind of on the smaller side of things. And the third element of capital allocation is buyback, which we announced recently. We constantly evaluate what makes sense at any given time. And I'm glad that we're kind of focusing on all three.
The strong balance sheet we have gives us the flexibility to do so.
All right. Last question. So you talked a lot about that. You talked about higher lifetime value on the SaaS product, a category that seems to be inflecting in terms of demand. What is the confidence level from your standpoint of getting back to 20% plus ARR growth post the SaaS transition? You're going 18% today. So how are you feeling about that?
Again, when you look at the NRR for SaaS customers and you see that it's significantly higher than the 105, and you see that the SaaS offering is resonating way easier, way better with new customers, which allowed us to grow new customer ACV by 50% in Q4. When you look at those two elements and you look at the fact that you're landing at larger numbers, but you can also upsell to those existing customers and the customer lifetime value is significantly larger on SaaS versus what it was in on-prem subscription, it gives us a lot of confidence that we can go back to that 20+%. Obviously, growing between 50%- 20% isn't bad, but we're putting time, resources, focus to go back to that 20+% growth. And I think we have the opportunity out there has never been greater.
It's on us to capitalize on it and take advantage of it.
15%-20% is definitely well above market. But with that, Guy, Brian, thank you for coming. It's always a privilege and an honor to host you guys, and we hope you come back again. Thanks very much.
Thank you.
Thank you very much.