Research team here at Citi, and very excited to host you all on day one of the Citi TMT Conference. I am very excited to have Varonis on stage with me. To my left, CFO, COO Guy Melamed, and to his left, David Gibson. Guy, I want to start the conversation at the highest level. This year has been very interesting from the standpoint of macro gyrations, right? At the macro level, you had those dynamics playing out. Internally, you've had several compounding layers of changes take effect for the business. I'm wondering if we can set the stage with sort of what have you been experiencing in the macro, how the business has reacted, and then just from a micro perspective, some of the sales organizational and incentive dynamics that have evolved, the SaaS transition, which we will certainly get into.
We'd love to kind of start there and bifurcate the conversation between macro dynamics and micro dynamics.
First of all, good to be here. There's a lot to digest in that question, and I'll try and cover at a high level as much as possible. We can dig in further with anything not covered. I think when you look at where we are today, the fact that we have moved to SaaS or are really at the late stages of the transition, we should be done at the end of this year, two years earlier than initially planned, is a testament to the technology and the offering and the evolving market. When we look at the landscape from a risk perspective and what customers need to face, their biggest challenge is that the hackers and the sophistication of hackers, and even the inside threat, the amount of employees within the organization that try and take data and give it to competition is increasing by the day.
With that level of sophistication, our SaaS offering and the Managed Data Detection and Response (MDDR) offering that we can talk more about has really changed the game for those customers. They no longer need to operate the software and need to make sure that they're taking care of that risk. We're helping them mitigate that risk. A lot of the MDDR is covered by AI. 80% of the alerts are covered in an automated way, and we have those technical personnel that overlook and make sure that anything that looks strange or abnormal, we can then notify the customer and let them know that they need to look into it further. With us, obviously, we help them do that as well. I think when you look at the environment, the SaaS and the MDDR has been a significant change in our favor.
I'd say that Copilot and AI in general has been the second item that is really changing the landscape. When you look at AI today and the fact that Microsoft is trying to push Copilot and all of the other big companies are pushing the AI, I think AI, that train in the sense of it will change the world. We don't know when that point will take off, but there's definitely that focus. Employees are asking for it more. What is happening for organizations is that they realize how vulnerable they are if they don't take care of their data before they roll it out. We've received frantic phone calls from customers that rolled out Copilot and realized that employees went into the chat box and wrote who got a salary increase in 2024 and got that information within seconds.
Because now, if you didn't take care of who has access to what type of information, AI doesn't know to distinguish between what's sensitive, what isn't sensitive, what you should be having access to, and what you shouldn't. It gives you whatever you're exposed to. If you don't take care of it, you'll have those catastrophic moments. I wouldn't say that AI or Microsoft Copilot has been fully adopted. I think many of us from conversations with customers, either it's rolled out on a subsidiary or a small group, but there are way more conversations on starting to roll it out to the entire organization. We can talk about the partnership with Microsoft that has warmed up significantly. We signed an agreement. There's a press release that came out July 3 that talks about the intention of a go-to-market together and building maybe technological capabilities that would cater to customers.
I think when you look at where we stand today, there are a lot of interesting things. We can talk about the acquisition that was announced yesterday. We can dig into that. There are a lot of things that we're very excited about.
To recap from Q2, what are some of the key messages that you want to really emphasize and how you're thinking about the remainder of the year? Naturally, in the context of some of the things you talked about, SaaS and MDDR and the transition coming to its full fruition by the end of the year, what are some of the more tactical elements and more memorable highlights from Q2?
To kind of tie to your first question, the part that I didn't answer on the macro, I think when we look at the macro, we've seen macro be very steady. What is actually working in our favor is that the sales cycles for SaaS are shorter than the sales cycles for the on-prem subscription. There's still that deal scrutiny. There are additional requirements to put pen to paper. I think with the SaaS offering and with the savings that we can offer our customers with a move to SaaS, where they don't need to manage the hardware and where they can reduce their headcount with the MDDR offering, that has really helped. It is very fitting to this environment, really.
When I look at how Q2 ended and the continuation of what we see for the rest of the year, it was a very strong quarter from a new customer perspective and from an existing customer perspective. When we look at all the metrics, we're seeing that the customer lifetime value is increasing with our SaaS offering. We're seeing that our SaaS customers are talking about what they would buy in addition to their initial first purchase. We talked about net retention rates (NRR) of our SaaS offering continuing to be much better than the reported NRR that we disclosed at the end of 2024. I think when we look at Q2, it was very much a continuation of Q1. We're set up for a healthy Q2, for a healthy H2, sorry.
I think that when we look at what we have to offer with the PolyRise acquisition and with the additional offerings, once you get customers to SaaS and you've taken care of that red tape bureaucratical challenge of just moving them to a SaaS agreement and going through the SaaS checklist and taking care of all of that stuff, which I think we're doing much better in 2025 compared to what we have done in 2024, I think when you look at all of those elements, we're very excited for the second part of the year.
Can you give us a reminder on just from a metrics perspective, how much of the base is now full-fledged on Varonis SaaS? How much more of a transition effort remains? We're all familiar with the notion that the sales team has been very hard at work and their time has been very occupied in porting and forklifting customers over to the SaaS. There are all these behind-the-scenes legal and procurement things that us as investors don't necessarily see that can gum up the machine, if you will, for transition, right? Can you give us a sense of sort of, numerically and quantitatively as best you can, where we are on the entire install base having moved and what might be some of the remaining hurdles?
At the end of Q2, we increased the SaaS mix guidance to 82%. We expect to finish the year with an 82% SaaS mix. Within three years, moving very, very quickly. One thing that's important to note is that Q4 has always been the largest quarter for us, where the largest amount of renewals are in play. One of the lessons we have learned from last year is that we're having conversations with those customers that are up for renewal in Q4. We started those conversations in Q1, earlier than usual, in terms of the benefits of SaaS, why it's a much better product. The reception that we're getting is very, very good. Customers are excited to move to SaaS. Throughout, there's still a lot of the base that we need to convert. From a commission perspective, this is the year of transition.
As we exit the year with an 82% SaaS mix, which is the guidance, or if we can do better than that, that doesn't leave a lot of customers to convert. One element that is actually worth talking about is that a lot of the ones that haven't converted are state and government. We received our FedRAMP certification in the last couple of weeks, which was a lot of effort to get. It was a big investment, both from a monetary perspective and from a time perspective. It was definitely worth it from our perspective because now we can go to our state and government customers and show them that they can move to SaaS with that FedRAMP certification. I think that probably kicks in. I'm not sure it kicks in this quarter. I think it probably was a bit late to the cycle.
We're still trying and we're still working on that. If I look at the ability to convert those customers to SaaS, I think that will be part of what we focus on next year. If I look at the enterprise business, we're very much in conversations with the ones that haven't converted. I think that we've been extremely focused on moving as quickly as we can. The reception of our customers has been great.
Learning lessons for the sales team from last year was, hey, don't wait till Q4 to talk about conversions in Q4. Sales team is talking about conversions in Q1 when your renewal pipeline is the chubbiest in Q4. All the T's have been crossed, all the I's have been dotted. Just from that standpoint, with the sales team having the reps on, really evangelizing and educating the customer much, much earlier on the benefits of the transition. The flip side of that, that naturally opens up their time to actually generate new pipe and build new pipeline, right? I'm wondering if you can shed a little bit of light on or comment on how new pipeline generation has trended over the course of this year. After having learned what we learned last year that, hey, sales team is having to take a lot of cycles to talk about conversions.
They're not actually going out prospecting or they don't have the bandwidth to go out to prospect. Just new deal, new logo, net new business pipeline generation activity.
I think probably one of the biggest challenges for investors to understand was how the conversion is cannibalizing the time of our sales force. I know that when we sit here and when we talk about conversions and the adoption, it wasn't a challenge from a technological perspective. Switching customers to SaaS, the way that technology has been built, taking all the experience that we've had over the last 20 years and kind of implementing it into the SaaS platform has made the platform efficient, easy to use. We can see it in the leverage. We can see it in the free cash flow. All the metrics that are hit have actually done better than what we initially expected.
The time to get a customer to start a conversation about a new contract and start doing SaaS checklists and making sure that from a security perspective, everything's in place, that was taking way more time than just getting a PO for a renewal. When we thought about where should we put our focus on, we wanted to make sure that we don't kind of stay in that limbo stage for too much longer. We have seen new customers over the last, I'd say, two years work really, really well. We see not only an increase in the ASP, but also see an increase in the number of new customers that we can acquire. I think one point to note is that the move to SaaS actually increased our TAM 3X.
The offering, our ability to not only sell it in different markets, but sell it to customers that probably wouldn't buy under the on-prem subscription offering. The ease of use of it has really increased our opportunity dramatically. Now, when you go to a customer and you talk about the MDDR offering, basically telling the customer, you know, this is the platform. We have a team that manages any abnormal behavior, and we can help you with that is a completely different conversation than selling you the software and kind of letting you deal with it yourself. I think with the move to SaaS and with the MDDR offering, and the MDDR offering has only been in place since the beginning of 2024. I know a lot of people kind of think that it's always been there, but it's been by far the fastest adopted platform Varonis has ever had.
There's no close second, really, when you think about how it's been adopted. I think when you look at all of those offerings, our ability to sell to new customers has increased significantly with the SaaS and MDDR compared to what we had in the past. We see it in the numbers. We see it in the trends. When we get customers over, we can now go back to the base and start upselling them in the same manner and in the same way we have done when we had on prem- subscription.
The setup for us of continuing to sell to new customers in the same way and getting to our existing customers with all the trends that we're seeing where we can continue to upsell to them is part of the reason we want to move as quickly as we can on the SaaS offering conversions and not get stuck in that transition. That's really the setup.
Just as a point of clarification and even a reminder for us, MDDR has been deployed as a carrot to get customers over to SaaS, right? As opposed to independently and individually monetizing MDDR, it is a powerhouse offering in and of itself, but it just makes the whole SaaS platform usage sing, right? Where is kind of the philosophy on that? I know there's been some evolution there, right? How should we think about, to ask it more simply, how should we think about the direct monetization of MDDR because it is such an important layer on top of the SaaS platform usage?
I am not sure the phrasing you used is the exact accurate way I would use. It's definitely used as a carrot, but we are able to monetize on the MDDR offering. It just really depends how you count the dollars. Whether if I give you the MDDR, but you're buying a more comprehensive platform, you're paying more dollars. The ASPs are going up, but on the MDDR, there's no specific SKU associated with that. It's really hard to distinguish what exactly is driving the increase in spend. Honestly, as long as we can provide our customers the right service, they're happy, and they're increasing their spend, it doesn't really matter what it's associated with. We are seeing our existing customers spending more with us, buying additional platforms, getting the MDDR.
The way we have structured the MDDR is that if you buy the larger platform, you get the MDDR at a reduced price. If you want to buy MDDR as a standalone, you'd pay a much higher price. The way we set it up was really to cater our customers to buy the more comprehensive platform. It helps us with the way we structure the alerts and make sure that we have a much larger view as to what's happening in their environment. We're happy to see that that's actually the path that most of the customers have taken.
Just to kind of continue on this thread, clearly still a good chunk of the base needs to be moved over. Let's talk about the install base that actually has graduated and migrated over to the promised land of SaaS, right? Can you talk about some of the buying behavior and, more specifically, just to put some numbers and sort of model-related context around it? As we sit here, what should be the driving forces for SaaS net retention rate expansion and overall SaaS ARR growth acceleration? Is it, hey, SaaS customers are buying more product to secure data sprawl and data classification pain points for existing workloads? Are you enjoying, or are these customers now so much more easily able to jump to completely new solutions to tackle completely new environments?
Between more of the same versus more new capabilities being added, what are going to be the most sensitive drivers to SaaS NRR growth and SaaS ARR expansion?
Maybe I'll talk about the numbers and David can give some color because he's talking to so many of the customers in what their journey is. When we look at our total NRR and we talked about the reported number for 2024 was 105%. I think part of the reason that that number has come down is because of the time it takes to convert and the fact that it was really cannibalizing the time of our reps. When we look at the SaaS NRR, not taking into consideration any of the uplifts that relate to the conversions, but just customers that were on SaaS at the end of 2023, what they bought throughout 2024, we see that the SaaS NRR is significantly higher than the reported 105%. That gives us the confidence.
When you look at kind of the ARR growth, we've talked a lot about our desire and focus on getting back to that 20+% growth rate. We're at 19% ARR growth right now. If we can continue selling to new customers the way we have over the last year or two, and I think there's no reason we couldn't when we look at the opportunity and we look at the SaaS NRR being significantly higher than that 105%. In simple math terms, that really helps us get there. From a numbers perspective, we feel very good about kind of the desire to go back to that 20+%. The trends of the SaaS NRR being significantly higher than the reported one gives us the confidence to get there.
Yeah, from my perspective, my experience with our SaaS customers is they are delighted. We have kind of a routine. Here are the data stories that we're protecting for you. Here are the things that we found and fixed because there's so much automated remediation built into the platform. Here are the threats that we've detected and stopped for you without you having to do anything but take a phone call from us. We know you've been talking to you. We know you have data over here. We know you have data over here. Being able to expand the coverage there is a big opportunity. We're doing this regularly and routinely. In addition to that, I'm usually reviewing our customers or reviewing our roadmap, you know, some of the short-term roadmap that's coming up. Like some of the things that we've now announced, like the database activity monitoring.
Now we've announced email security. There's so much eagerness for some of the functionality that we've added and that we continue to release. I feel like both the breadth and the depth and the functionality are big opportunities for us. Customers are really, really excited, as am I, about what we're offering and what value we're able to provide for them.
I think it's a good plug to maybe talk about the acquisition.
Yeah, fantastic. That's actually great minds think alike. You'd historically been very selective on M&A. I think PolyRise was your first foray into doing M&A, and that was five years ago. We've now seen two deals this year, right? Generally, M&A philosophy and thesis, how that mindset has shifted, right? Why come out guns blazing into email security?
First of all, I think we're still very selective. This acquisition was a long time in the making, and it was done after a lot of testing of that technology and comparing it to the other options that are out there from a technological perspective. If you want to touch maybe on kind of the logic and.
Yeah, you know, we've talked a lot about our MDDR, our Managed Data Detection and Response. What we found, and I think there's some stats, the vast majority of breaches, I think at least over 60% start with a compromised identity, and about 90% involve a compromised identity at some point. We've seen that the way that identities are often compromised is phishing, email compromise. We see with our current MDDR offering, we see and stop what happens after people get phished every day. We're able to detect, we're seeing what they do. They have usually a pretty familiar playbook to us by now, and our threat models fire, and we're able to contain the breach there. We ask, what could we do to stop the attack sooner? How could we actually stop the person from reacting to that phishing email?
As Guy said, we spent a long time testing the technologies out there, and hands down, SlashNext had the best detection rates for the phishing emails, not just the text space, but the images. A lot of people get phished with barcodes now. They also have a really interesting sandbox technology that they'll basically take a hyperlink and then detonate it, right, in a safe way. Really excited about the technology and the tuck-in there for us to make sure that we can stop those breaches sooner. I just think it makes total sense because of our vantage point, which admittedly is, I think, unique, right? We see we have a front row seat to so many of these breaches so that we can see what we need to stop them sooner.
If I can add, in a technological way, but for in a non-technological knowledge, one of the things that we have noticed is that many times with that phishing attempt, AI is used. Whether someone is impersonating someone else, you can now get a DocuSign link to sign a document, and you feel you know that person, but in essence, there's an attempt now to get your credentials, and once your credentials, they go after the data. Our MDDR offering with SlashNext is, you have no idea how excited the MDDR team was with the announcement yesterday because they are seeing how much of those attempts start with phishing, and it gives kind of a full view to our customers on who's trying to get in, how is this happening, and gives basically customers better protection.
I know it's very early. The ink was just dry yesterday. How should we conceptualize the monetization path for SlashNext? Is this something that's going to be positioned akin to the way you're handling MDDR, right? Or is this going to get just baked into the rest of the portfolio? What are the initial ideas or thought processes?
We will start selling SlashNext, and obviously it would be kind of under the Varonis name as a separate SKU at first. I think later down the line, we'll get to a point where it's combined as part of the platform. Initially, we will start with offering it to existing customers that can now switch in a rip and a replace, which is very straightforward, but also allows us to try with some new customers. We are going to cater to both. I think one point to emphasize, and we obviously put out updated guidance from the expense side. From a free cash flow perspective, we kept our free cash flow in place, where basically the SlashNext acquisition has approximately $15 million of headwind to our initial numbers when you look at the impact for the year.
I think that part of what we have done throughout the year with a strong balance sheet, with a strong really kind of improvement on the free cash flow side, we were able to reiterate the free cash flow numbers for the year. There is no real material impact on the top line from the SlashNext acquisitions. We expect to roll it out pretty quickly. I'd say within Q4, early Q1, that's kind of the timeframe. This is not something that will take a year, two, three years for us to try and monetize. It is definitely something that we want to roll out relatively quickly. We obviously need to see how this is adopted. We want to implement it into the Varonis platform. All of that is in the making. The actual expense increase is not that significant. We took approximately 100 employees with the SlashNext acquisition.
For the most part, they are based in the U.K.. We are extremely excited to welcome them to the Varonis family. We are actually even more excited to see how this moves forward with the additional offering that we now have for our customers.
I'm glad you brought this up just from an OpEx perspective. I think one of the things that stood out to me is the intention around reinvesting into the business, expanding the go-to-market organization, feet on the street, et cetera. This whole notion of stepped-up investments. What you are seeing is a healthy environment. I want to get a better sense of, in a priority sequence, what's given you the confidence to say, hey, yes, we don't want to sit on the sidelines. We want to step up to the plate here and reinvest, especially from a sales capacity and go-to-market standpoint.
I think when we analyze the market, we analyze the opportunity, we analyze the trends, we analyze the KPIs, what's healthy, where we are, and we have actually realized that there's a much bigger opportunity ahead of us, which gave us the confidence to put money to work. When you think about kind of the investments that we have made, we've shown leverage in, I would say, one of the biggest positive feedbacks we've got from investors is how happy they are with kind of the leverage and the ARR contribution margin increasing so significantly. Think about it, that when we rolled out the SaaS transition and we did the investor day in Q1 of 2023, we talked about a range of a 20% ARR contribution margin. We gave that range of 18%- 22%, 20% roughly. We're on the run rate of 17%.
Two years ahead of schedule with the most significant investments of the SaaS move. During a SaaS transition, we were able to show significant improvement on the free cash flow, which I think is a clear testament as to how the technology was built in such an efficient way. I think that we wanted to put money to work both on the R&D side, both on the sales and marketing side to increase our foot in the ground, but also come up with additional platforms that we can cover, go wider and deeper. That's really kind of the way we're thinking about it. When you think about the SlashNext acquisition, this is not like going from swimming to cycling. This is kind of being in the same lane, just helping our customers be better protected.
I don't think this is moving away from our core desire to protect data wherever it is. This is really kind of the framework that we've put in front of us. I think when you look at kind of the healthy balance sheet, the healthy improvement on margins, the way we put money to work, we don't want to miss the larger opportunities. We want to make sure that we can continue to grow post that $1 billion mark in healthy levels. That's why we're making some of those investments. I think that overall, we're able to combine top line improvement, bringing some of it to the bottom line, generating significantly more free cash flow, and kind of trying to hit on all of those cylinders in a prudent way.
I'm going to ask you a tough question on the devil's advocate side. Clearly, the market environment is hot. I like to say that you guys were thinking about data security before it was cool, right? The time is now. There is a lot of market validation for numerous reasons why this is such a pernicious problem. To your point about investments and the confidence in reinvesting in the business because the signals are so attractive, the competition isn't taking it asleep either, right?
From the standpoint of what's happening in the competitive backdrop between, you know, someone like a Zscaler last night that's talking about a $400 million data security franchise within the confines of their platform, how should we think about some of those competitive dynamics that have changed and have evolved to ultimately not, to make sure that your reinvestments in the business are protected and not eroded away by some of this, you know, rising competitive dynamic? I would love to hear what customers are saying to you because it seems like everybody has a data security story now, right? How are customers navigating the FUD on that?
Yeah, you're absolutely right. There's been more activity than I've ever seen around data security. I think we're in a really powerful position because of how long we've been protecting data and how much we've learned about how to do it right, do it at scale, and do it continuously. When we look at our approach and how we're able to identify what's important, identify where it's at risk, and then monitor how it's being used, and most importantly, get people to real outcomes, fix the risks automatically, monitor the heck out of it, and stop threats wherever sensitive data is stored. Make sure you can use AI safely. Make sure that you can avoid getting phished or the insider threat or ransomware or all these serious attacks, and also be compliant. I'm just being mindful of the time.
We have a huge, a huge river between us and anybody that's coming behind us.
Anything to add, Guy?
When we go to a customer, we want to make sure that they don't get any fines because of a sensitive file that's open to everyone in the company. We want to make sure that they can roll out AI if they desire. I don't think that's going to be a question in two, three years. If companies don't implement AI, whatever form it is, they're not going to have employees. They're going to move to competition. I think that train is definitely at our focus. We want to make sure that you don't get breached. When you think about giving customers, I'll do it very quick.
When you give customers the ability to know not only how many files are open to everyone in the company, but what's sensitive and what isn't, who's touching what, and not just showing them that they have a problem, but helping them fix the problem, that's the biggest differentiator. We don't show you how exposed you are. We help you fix it.
My last one for you, 20%+ ARR growth. When we think about weighting factors like the number of protected workloads, the upselling motion, the new logo ads, how would you sequence those in terms of the most consequential impact to the path in exceeding 20% growth and hitting and breaching the billion dollar ARR milestone?
When I look at the tailwinds that we have, and we have many new customers, our investments in some of the territories that we haven't had significant presence, we didn't even talk about that. We're making some significant investments in Australia and India and Japan and Singapore, and all of that takes time, but definitely something that we're putting money to work. We look at the additional platforms that we have. There are so many things that are working in our favor. We see the opportunity in a way that we have never seen it before. We know we need to execute on it. We understand the responsibility. We're working hard in order to achieve it. I think that we'll obviously give updates throughout the journey, but we're very excited in where we are right now.
We're watching and we're tuning in. Great place to put a pin in our conversation. Thank you so much. Always a good discussion with you.
Thank you.