My own time, yes. You have any good to start? Okay. Excellent. Okay. Well, hey, is it morning? It's still morning. Yeah. Good morning, everyone. Welcome to day one of the Barclays TMT conference. My name is Saket Kalia. I cover software here at Barclays. Honored to have the team with us here from Varonis. We've got Guy Melamed, CFO and COO. Also have Brian Vecci, Field CTO at Varonis. We've got about 30 minutes today. There's gonna be a lot to talk about. I promise it's gonna be a fun session. Let's take 20 to 25 minutes to kinda run through some fireside chat with the team, and then we'd love to make this interactive. So if you've got a question, just pop up your hand and we'll make sure we get it asked for the benefit of the webcast.
So, with that, Guy, Brian, thanks so much for being with us here today.
Thanks for having us.
Thank you.
Thanks for putting us in front of Jerome Powell's speech and announcement. Like, there's a lot of competition going on, so.
I would rather be here,
so staying with us.
I wanna jump right into last quarter, right, because there's so much to talk about there. Guy, you said something interesting in the last call, which was Varonis is really becoming two separate businesses right now. There's the SaaS business and then the on-prem, the on-prem business. Talk to us a little bit about why those two businesses feel so separate right now in terms of their performance.
So it's true. And we talked a lot about the fact that, we started talking about it throughout the transition, but obviously after the Q3 results, it's very clear that there's the Varonis SaaS business that is performing well, doing good on the new business, doing well on the upsell. And there's the on-prem subscription business, which obviously in Q3, the renewal rates of the on-prem subscription business were below our expectations. And I think that obviously overshadows and puts a bit of a cloud on the overall performance. But it is important to remember that the core business and where we're headed, the forward-looking business is the SaaS business and the rearview mirror business is the on-prem subscription.
I think the reason it's so distinct right now, you can see it on the renewal rate, but the value proposition is significantly different between the on-prem and the SaaS. And I think that is an important emphasis that investors need to understand 'cause we got a lot of questions of end of life when we announced the end of life of on-prem. Why'd you do it so quickly? And why wouldn't you drag it on for a longer period of time? We said all along that we don't wanna be monitoring and maintaining two types of code. We wanted to make sure that we are 100% SaaS, and we said that all along. This was actually the first quarter that we got the 76% SaaS of ARR, which is how we defined completing the transition.
Correct.
We talked about it during the investor day in Q1 of 2023, and we talked about completing the transition anywhere between 70%-90%, and the expectation and the intention was to announce the end of life during our sales kickoff in January of 2026, so just coming up, and announcing it to be at the end of next year, but with, obviously, the Q3 results, we kinda pushed it up a quarter. That's the only thing we did, pushed it up by one quarter, and the reason we pushed it up a quarter is because, obviously, investors want to know how much of the non-SaaS business is going to be converted, and our intention, and we can talk more about that later, but our intention is to kinda break the business into two, the SaaS business and the non-SaaS business.
And they would wanna see what is the expectation on the conversion. What is that gonna be for 2026? If we announce the end of life next quarter, every investor would rightly so ask us, how did we quantify the end of life into that expectation if we're just announcing it now? And that's part of the reason we wanted to announce it a quarter early. We have about roughly 175 today non-SaaS ARR. A third of it, approximately $60 million, are up for renewal in Q4. So with the announcement of end of life and with everything that's going on, we would have a much better data point that we can extrapolate and give color for 2026 with all the information out there. And that was the logic behind it.
Got it. Very helpful, very helpful data point. I mean, I wanna follow on that a little bit. You know, Guy, it felt like the higher than expected churn. It was clearly a surprise for all of us, and it kinda felt like it was a little bit of a surprise for the team as well, particularly given what I think were healthy renewal rates in the on-prem business in the first half of the year, and it sounds like there wasn't really one common theme around why some of those customers didn't renew, but you know, as we get further and further from the sun, right, like, what have you kinda seen as you've gone back and looked at those customers that had churned and whether there was anything common or what drove it, or was it a fluke?
I mean, who knows, right? So what's your kinda postmortem on it?
A lot of the postmortem that we have done is confirming what we talked about during the earnings call, in the Q3 announcement, and I can walk you through the three components, but you're right that the Q1 and Q2 renewal rates were actually improving, so when we look at the renewal rates, there was no indication we are back-end loaded like any other enterprise business, and about 50% of our business closes in the last two, three weeks, and that's been historically the case. That obviously was the case in Q3 as well, so when we tracked all of the information throughout the quarter, there was nothing there that would signal the lower renewal rates as we saw them kinda at the end of the quarter.
The three components that contributed to the underperformance on the renewal rate of the on-prem subscription were, one, many of the customers that didn't renew were single-threaded, meaning they bought us for an auditing tool, they bought us for a specific use case, and then if they don't renew, they're not exposed from a cybersecurity perspective the same way they would be exposed if they didn't renew on the SaaS front, so that was one component that we saw. What is important to note is that in Q1 and Q2, those single-threaded customers did convert and did renew, so this was when we talked to customers in Q3 and obviously after the quarter end, and we were trying to figure out why they didn't renew.
That definitely came up as, like, we had you for an auditing tool and really nothing happens if, and that's part of the reason we wanna move everyone to SaaS because the value proposition is significantly better and much more meaningful in the value that we can provide. The second component had to do with the fact that our sales team didn't perform in the best possible way. Taken into consideration, some of those customers were single-threaded and some of the quotes that were put in front of them probably weren't presented in the right way. We obviously addressed that going forward and we're all over the sales team in order to make sure that doesn't happen in the future.
And the third component that we saw was the fact that the deal scrutiny kinda increased as we watched it in the last two weeks. When you combine all of those three components together, I don't think I can quantify what were the dollar amounts in each and every component.
Of course.
But that was what was related to the non-federal business. There was also a bit of an underperformance on the federal side.
Right.
that contributed to the overall performance of the business, and the federal business, if I had to break down why it underperformed there, I would say that DOD probably didn't help. I don't think it was the main reason, but it definitely didn't help us. I think the second component had to do with the timing of the FedRAMP certification. We got the FedRAMP certification in May, and I think if it didn't help us, if anything, it hurt us because there were deals in flight as part of the desire to get them as on-prem, that once you have the FedRAMP certification, you're trying to switch them to SaaS, and then that generates turbulence within the conversation.
Right.
with customers and sales cycles within the federal business are somewhat longer. so adding that component definitely didn't help. and then the third component is the way the sales team handled that. I think that we could have done a much better job from a sales team's perspective. so those were the three components on the federal side. and we covered kinda the three components that were on the non-federal side.
Very clear, very helpful. Brian, maybe this question is for you 'cause I know you spend a lot of time with customers.
I do.
You know, for the on-prem subscription customers that didn't renew.
Mm-hmm.
Are they still interested in adopting Varonis SaaS over time, or are they considering other vendors? I mean, DSPM is a very hot space right now, right? Like, is that playing into it at all?
Yeah, so this goes to a lot of what Guy was just saying. There are many reasons that some of these customers did not renew. For many of them, they were not using Varonis as a security tool, and that's really important when you ask the question about the broader DSPM and broader data security space. It's if they were using Varonis for what we think of as single-threaded or a more tactical use case. Oftentimes Varonis as a solution within the customer was owned by infrastructure or security. We didn't even know who the CISO was. They bought us to do something, they're leveraging a Varonis capability that was not part of their security portfolio, and so when we say that, it's if they were not renewing Varonis. It's not that they were going to another security tool.
It's that maybe the data store that they were using Varonis to audit is going away, or they're using a more administrative or tactical or point tool that we would think of. This speaks to one of the things that we've been saying about the SaaS conversions in general over the last few years, is that for some of these kinds of customers, single-threaded customers, customers that were using us for a single use case or on a single data store, converting them to SaaS is almost a completely new sales cycle.
Yeah.
Because now we have to sell Varonis as a security platform to a security team that might not even know who we are. To answer your question directly, yes. Many of these customers we are still talking to, some of them have already converted to SaaS. Some of them, because the data store that Varonis was, it's an On-premises file system that might be going away, we're gonna have to re-engage with them, for their cloud stores, but we didn't see any change in competitive win rates. That said, DSPM is a very hot space.
Yep.
There's a lot of investment there. One of the things we've been telling everybody, including you for the last few years, is when you ask about data security as a priority, we've been saying it's moving up the stack. Data security is becoming more and more and more important, especially in the Generative AI world, and when that happens, of course, there's a lot of investment in the space. There's lots of new players. It's great that there are other people now doing marketing for the market that we built. So what we've seen is it's made the market bigger. There is more competitive noise, but specifically with the customers in Q3, we didn't see a change in competitive win rates for all of the reasons that Guy had laid out.
It's not that these customers were not renewing Varonis and going to another competitive security product. We just didn't see that.
Got it. Understood. That's very helpful on the competitive win rates, and I do agree that this market does seem to be getting bigger. Guy, maybe the follow-up question here is, have you ever kinda talked about what percentage of the base is, quote-unquote, "single-threaded"? Right? Like, what's the risk that we kinda have as what percent of the base is on security, what percent is single-threaded as we think about just what the incremental risk might be?
So it's a very good question, but I do wanna point out that that single-threaded did renew and convert in Q1 and Q2.
Sure.
It's very hard to kinda, I'll tell you, from a quantification perspective, and we obviously looked at what that percentage is for what's left in that 175. It's not a small portion. It's less than the majority, but not that far from it. With that said, we wanna see how Q4 behaves, and then we'll have a much better denominator to, and it's not just the two weeks.
Absolutely.
In Q3, and then we can really identify, was this like a one-time thing, or is this something in terms of changing trend? From a guidance perspective in Q4, we assumed lower renewal rates on the on-prem subscription than what we saw in Q3, and we also assumed that there would be some additional churn because of the end-of-life announcement, so from a guidance perspective, we did take a very conservative approach, and the way we're thinking about it for 2026 is,
was that the question?
That was. That's why I'm smiling.
Okay.
Great.
So in terms of 2026, the way we're thinking about it is we wanna make sure that investors look at the strength of the business and they don't have any noise that interrupts what is working and what is not. And we have this $175 million of non-SaaS ARR. As I mentioned, about a third of it is up, roughly $60 million is up for renewal in Q4. We're talking to every single customer in order to try and figure out whether they will move to SaaS or will they not move or what's the plan to move to SaaS. We already know not all of them are gonna move to SaaS.
Sure.
That's, I think, is very clear. Especially within the federal business, within the DOD, there are customers that will not move to SaaS. And that's okay. But from a guidance perspective and a focus perspective, I think the right way to look at the business going into 2026 is what is the SaaS growth rate? So if we guide on SaaS only, not including any conversions, and we give a number on the SaaS number, quarter over quarter, what's the expectation? What is the yearly SaaS growth rate? And we talked in the past about our belief that we can grow 20%+ for some time.
So if we give a SaaS number that doesn't include the conversions and then give the conversions on a quarterly basis on top, I think that puts the focus on what investors really should care about, the forward-looking business, not the rearview mirror. It gives the visibility and also gives the investors the ability to know how much of the conversions impacted your growth rate on a quarterly basis within the last year of 2026.
Which then it makes a ton of sense because then presumably that can give you a basis for modeling into 2027, right?
Yep.
When 100% of the business will be SaaS, presumably.
Exactly.
Very interesting, and that idea of kinda separating out the conversions, I think, would be very helpful for what it's worth. Brian, I wanna move over to you for a second. I mean, one of the pushbacks that I get sometimes is, you know, going back to sort of the DSPM market is, well, you know, there's these startups like Cyera that are doing.
Mm-hmm.
That are doing really well, etc. And, I mean, I'm and you talked about really the win rate not changing, but, you know, how much of that is a factor right now, you know, from a just a competitive standpoint?
There's a lot of noise. There's a lot of discussion. We're in a lot more RFPs and we're in a lot more deals that we weren't in five years ago because five years ago, Varonis was a self-hosted security platform that supported file systems. These days, we're a cloud-first, cloud-native security platform that supports all of the hyperscalers, databases, SaaS applications, file systems. And the big separator for us versus the entire DSPM market, whether it's a public company that acquired one or a private company, is we're doing so much more than just discovery. And we're doing it not just on cloud databases. We're discovering data in places. But then what matters from a security perspective, which is why we call ourselves a security platform and not just a DSPM vendor, what matters are security outcomes.
We talk a lot about outcomes because no matter what you do from a discovery perspective, unless you can actually secure the data, lock it down, and do it automatically, because there is no CISO out there that has unlimited headcount to actually go solve the problems that we find, and unless you can actually monitor data in a useful way, just like your credit card is gonna text you as soon as there's any fraud, Varonis is gonna call you as soon as any data gets accessed inappropriately. Those capabilities are critical from a security perspective. They're critical to deploy Generative AI.
So while it's great that there's a lot of noise in the space and a lot of investment, we mentioned that, that there's a lot of marketing growing the market that we created, we haven't seen a change in competitive win rates because our sales execution, the way we go to market, the way we engage with a customer starts with a risk assessment. And that means we're deploying our technology at scale on real data, which nobody else can do. This is why we win. When I say the competitive win rates haven't changed, when we go in and execute our sales process properly, the win rates are very high.
I think that idea of being a security vendor versus a DSPM point solution is.
Yeah.
It's an interesting nuance. Guy, I wanna kinda move beyond sort of last quarter's on-prem discussion and talk about that phase-out of on-prem in 2026. You know, one of the things that I think Varonis has done really well in the past, not just through this transition but prior transitions, has been sort of, you know, turning knobs a little bit, whether it's on pricing or if it's on Salesforce compensation, to really bring about different behavior from, you know, from your team as well as from customers. As you think about kind of that end-of-life for on-prem by the end of 2026, open-ended question, are there any changes that you're making from a pricing or sales comp perspective ahead of that?
We start thinking about comp plan about nine months before the actual time we start implementing it. We spend a lot of time every single year. You're right. In every year, we have some tweaks. In 2025, this was actually the first year that we decided to compensate on the conversions. We didn't do that in 2023. We didn't do that in 2024 in the same way we did it in 2025. The reason we did it in 2025 is because we just wanted to be done with the transition. We didn't wanna drag the transition. By the way, that's part of the reason we were surprised with the Q3, 'cause it's counterintuitive to what you were.
It's intuitive.
To what you were thinking.
Yep.
And especially when the reps can get paid on it. In 2026, it is clear, and we're obviously in the final stages of finalizing the program that we will not be compensating on conversions the way we've done in 2025 because the one thing that is important to emphasize, and I've talked a lot about this, so if I sound like a broken record, I apologize, but the cannibalization of time for the reps on focusing on the conversion is actually a headwind for them.
There's an opportunity cost to that time, right?
There's an opportunity cost. And it's not a technological challenge. It's a documentational challenge. It's a conversational challenge, on making sure that you go through all the security checklists, moving from on-prem to SaaS. All of that takes time and focus from the reps. We want in 2026 to go back to basics where the reps can actually make money by selling to new customers and selling to the base. That will be the main focus. That's the what's what we've been working on over the last, I'd say, six months in terms of thinking about the comp plan. I think Q3 actually emphasized our focus on going back to basics.
And I think that with their ability to go back to basics and sell to new customers and actually have the opportunity to do an upsell now for a SaaS customer that when you think about the denominator, you have a wide range of SaaS customers that you can go back and sell additional licenses. And Brian could talk about some of the platforms that we're seeing in terms of conversation. And it goes back to some of the acquisitions that we have done that generate a ton of opportunity from selling to the base additional platforms. The focus of the comp plan will be on those. We obviously still will have about 17%. We guided to 83% SaaS of total ARR. So we'll have roughly 17% of non-SaaS that we still wanna get over.
Yep.
But the focus will be on the bread and butter, new and existing.
And that is the gift that keeps on giving, right, in terms of SaaS and lifetime value. That makes a ton of sense. You know, we've focused so much on the different parts of the moving parts of the ARR line. Brian, you've brought up a couple of times just on one of the secular themes in data security, and that is how to secure data in an AI or a Copilot-driven world.
Mm-hmm.
So, maybe for you, you know, again, knowing how much time you spend with customers, how much is Varonis coming up in Copilot discussions? And one of the questions I get sometimes is, well, hey, is Microsoft Purview like a competitor or are they a friend here? Maybe address that as part of the answer.
There's, I mean, Microsoft put out a press release earlier this summer that Copilot security is powered by Varonis. We consider the set of capabilities that Microsoft offers through Purview to be critical for infrastructure security, but you can't really secure your data without us. We integrate deeply with Purview, and part of that announcement was in continued enhancements and more research and development together with Microsoft to make that integration deeper. We've moved beyond just the public APIs as an ISV vendor. There's going to be a lot more capabilities within the Purview stack that are powered by Varonis, so Microsoft and Varonis customers can move more quickly to the security outcomes that we're talking about, which allows them to deploy Copilot more quickly, to make that as simple as possible.
The enterprises that are deploying Copilot for 365 widely and quickly with a minimum of friction and a minimum of risk are using Varonis to do it in an integration along with the capabilities that Microsoft provides. We don't compete with Microsoft. We just make everything that they do a lot easier, and you can realize the value of both platforms much more quickly.
Got it. Got it. Maybe just to stay with you, Brian, I mean, you know, I think there were some other, and Guy brought up some acquisitions earlier, right? You know, I think one of the areas that we've kind of entered is database activity monitoring, which I think came through the Cyral? Pronounced that right?
Cyral.
The Cyral acquisition, as well as Varonis Interceptor, which I think came through the SlashNext acquisition. Maybe for, you know, 'cause we, you know, I would say that we certainly, I think about this as a data security leader, but these are new markets from what I can tell. Maybe the question is, who are you displacing in those instances for?
The database activity monitoring market is interesting because databases are obviously a big and important data store. Every enterprise has databases. We've been doing database security in cloud stores through AWS, their relational database system, as well as Snowflake and Databricks. However, a lot of big companies have a lot of On-premises databases and the legacy tools like Imperva and IBM Guardium that they're using for database activity monitoring. This goes back to the single-threaded use case for Varonis. Those products are being used very tactically to check a box that, yes, I'm monitoring some of these databases. What we have learned, as we've entered this market, is a lot of companies are very eager to displace those products with a more modern solution. The Cyral acquisition and the integration of Cyral database activity monitoring into the Varonis platform is now allowing us to disrupt that space.
So whether you've got a database On-premises or a database in the cloud, whether it's in a managed or an unmanaged database, basically, if you've got data, we can secure it. And the monitoring is a key part of that because once Varonis is monitoring a data store, we can detect a threat. Just like you get a bank statement with a credit card, we can detect threats there. We can also build really useful and safe and surgical automation in ways that other products couldn't because now it's part of a broader platform.
Right.
Really similar. You mentioned SlashNext and Varonis Interceptor. That's really exciting for us because our managed data detection and response, MDDR, is a key part of the value proposition of Varonis. Almost all new SaaS customers are taking MDDR because why wouldn't you? I've got a technology platform, a security platform that's classifying data and monitoring it and locking it down and alerting me when something goes wrong. But now you have a global team of Varonis experts that are gonna call you if we see anything that you might've missed. It's all in service of minimizing the time to detection and time to response for a threat. However, when we're in these investigations, often, in fact, the majority of the time when we're trying to come to a conclusion about what happened, guess what? Data breaches often start with an email, a business email compromise.
Somebody gets phished or spearfished. And our investigation, we get to a point where, okay, here's where the phishing happened, and now we'd have to go look at another tool, a secure email gateway, or ecosystem tools built into whatever email provider they might be using, like with Microsoft Exchange. We're not displacing necessarily those products. However, Varonis Interceptor is a next-generation AI-based phishing detection, impersonation detection, business email compromise detection. So when you think about Varonis as a security platform, specifically when it comes to threat detection, what we wanna do is move left. What that means is if you think about the steps that a threat actor takes to get access to and steal data, very often one of the very first steps is email phishing.
Right.
We're now there with that technology, and the huge advantage that Varonis has and Varonis Interceptor provides our customers is not just that we have a best-in-breed next-generation email security tool, but it is part of our broader platform, so now you've got Varonis monitoring and detecting phishing on your email stores while we are classifying it, while we are connecting that telemetry and that automation to everything else and all the other data that we're monitoring.
Yeah.
We want, you know, if you wanna protect data, Varonis does it, whether you're talking about emails or databases or files or SaaS applications, whether it's On-premises or in the cloud, we wanna be everywhere.
Well, you know, as I put myself into Guy's seat, I mean, that only helps support that net revenue retention on the SaaS side, right? And, you know, talked about back to basics on that part of the business, so that certainly helps. Guy, maybe just to wrap up your last couple of questions. You know, we've talked so much about the ARR base and growth. I definitely wanna hit on profitability as well because I think that's been great to see as part of the transition.
Listen, we're seeing a little bit of compression in the ARR contribution margin this year for various reasons, but maybe you can talk about some of the puts and takes that are driving that and how to think about that balance between growth and profitability from here, particularly in the context of some of your long-term targets.
I think that's a great question. And I think when you look at our focus on the cost structure and the generation of cash, we have done a job I'm really proud of when you think about where we are today in comparison to where we were a couple of years ago, especially if you go back to, I'm going back again to that investor day. We talked about our desire to get to 18%-22%, roughly in that 20% range, at the end of 2027. And if you look at where we've progressed, we're literally, like, there.
Yeah.
Obviously, when you look at some of the on-prem subscription renewal rate that is not going to come, I think that will have an impact on the 2026. But the benefit is that it quickly comes back at 2027. When you don't have to maintain two types of code and you don't have to have the same level of investment in supporting the tickets that the on-prem subscription has 'cause the ticketing support tickets on the on-prem subscription side is significantly larger than what we see on the SaaS side. So there.
Sure.
There are a lot of benefits within the model that are beneficial for investors and us as well in getting away from the on-prem subscription. So, in 2026, we're gonna keep, you know, obviously, we're not gonna go crazy from an expense perspective, but if you're getting some renewals that are not coming, it will impact your ARR contribution margin, but you'll see it come back very quickly with vengeance in 2027. That's the plan.
I go back to where we started, right, with two companies, you know, two companies right now inside of Varonis, but really by the end of 2026, that two goes down to one, right?
By the end of December 31st, 2026, we are 100% SaaS. There is nothing left that is non-SaaS ARR. That's the plan. That's why we call it the end of life, and that's the right thing for us, obviously for the customers and also for the investors.
I couldn't think of a better way to end than that, so Guy, Brian, thanks so much for the time. Really enjoyed it.
Thank you very much.
Yeah.
Thanks.