All right. Good morning, everyone. Thank you for joining us. My name is Brian Essex. I'm JP Morgan's mid-cap, large-cap software analyst. With me today, I'm very happy to have Varonis. We have Guy Melamed, the CFO and COO, and then we have David Gibson, SVP of Strategic Programs on the end here.
Good morning.
Hi, David. Thank you for joining us. We appreciate it.
Thanks for having us.
Maybe a great place to kick off is, you know, just on the results of the quarter. Would love to understand, you know, maybe just a quick summary in terms of like, you know, where the outperformance came from and, you know, how are you managing the outlook given, you know, what we've seen in 1 Q, as well as, you know, second quarter so far.
You're right, Q1 was definitely a good start for the year. We were very happy with the performance. It was very much driven by new customers. Definitely saw very nice growth there in terms of the number of customers and this was something that we talked a lot about with kinda the move during the transition to the path in 2026, which is really kinda the last leg of the transition and the fact that the reps now can focus on what they know best, which is selling to new customers and upselling to existing SaaS customers. This was something that they really didn't have that opportunity in 2025 when they were focused on the conversions as well.
In 2026, this was a change that we made that I think kinda helps us go back to basics and something that we're happy with, kinda the results that we saw in Q1, and I hope we can continue to see that in the quarters ahead. Overall, from a conversion perspective, I think we're kinda tracking as expected. New customer, as I mentioned, was healthy. I think we can. One of the interesting parts of the quarter was the contribution, that wasn't material in dollar terms, but in terms of conversation and focus and desire of customers to know more about the AllTrue.ai acquisition closed actually in February, so didn't really have a chance to have an impact in the quarter itself, but definitely generating a ton of momentum from a pipeline perspective.
David can talk more about what he's hearing with customers, but I think those are kind of the frameworks of the quarter for people to understand.
Very helpful. Where do things land out in terms of quota attainment versus maybe what you planned, and how aggressive are quotas given that you're just coming off of the transition?
Just to give some background, very similar to other software companies, Q1 is the smallest in dollar terms for the year, and Q4 is usually the largest quarter in dollar terms. Q1 is still, I'd say, a smaller sample, but when we look at the attainment, it was very encouraging. It was better than previous year from a percentage perspective in terms of being on track of reaching their number. We, I wouldn't say we were aggressive. I think we're very fair in kinda the way we position commission. In the essence, the highlight that we try to make sure that we live by is that we win together and we lose together.
Reps that do the right thing and can achieve in the proper way can make money, but it's never a layup. We definitely try to balance that, and I think that the results in Q1 were encouraging.
Yeah. From a hiring perspective, given what you saw in the first quarter and maybe we've seen so far, you know, how do you feel about hiring for the year, and what is the plan? You know, how mature are the reps, and how do you think about building out that organization to get you more, you know, better market penetration capability?
We're definitely hiring in the, in the right spots and in the right locations. There are places that we feel that we're under-penetrated. We're also managing out the underperformers, and I think that's always been the case to make sure that you don't have people that aren't delivering what they should be delivering and just sitting on the payroll. It's always kind of a managing, a balancing act, and I think we've done that well so far. The expectation and planning from our perspective is to continue to increase the headcount, but it will be done in a measured way and obviously, taking into consideration, what are the growth rate expectations and making sure that we can, overall hiring percentages should be below the top -line growth.
Got it. You know, maybe David, on your end in terms of customer conversations, you know, it's been really interesting. I've been hearing a little bit more frequently with companies and partners and, you know, industry participants I've talked to over the past, you know, couple of weeks that, you know, after Mythos came out, people just freaked out. How would you describe, you know, from a macro perspective and a demand perspective, you know, has that had a meaningful impact on your pipeline? How are companies thinking about, you know, spending on the Varonis platform now versus, you know, maybe last year when it wasn't such a material issue?
I think Mythos was quite a marketing event. It got people's attention on the fact that AI is gonna help find vulnerabilities for both good guys and bad guys. What are we gonna do to defend that? You know, the cyber adversaries are becoming more and more sophisticated all the time. I don't think it necessarily changes what people will do, but, you know, how quickly they might do it has changed with, you know, with the awareness of what's happening there. It's not just Mythos, right? There's all sorts of frameworks and models that are going to be good at this.
What I think is bigger though is the desire to implement AI for different business processes. That is more active, I would say, in our conversations, is how are we going to connect our AI systems and the ones that we want to build safely to data. That's been really the most exciting thing for me over the past few months, is how many conversations we're having about AI security and the data security, because I believe these are two halves to what is the problem of our time.
I think we've, you know, we've hit on before in previous conversations that, you know, data security can be a bottleneck in terms of adoption of generative AI technology within an organization. Where are your customers along that journey? I mean, we've heard a lot of cases that we're still in the experimentation phase of adopting generative AI, you know, hearing more use cases where, you know, you're starting to get a little bit more influence towards moving to production. What are you seeing across your customer base in terms of like where they are in that scale of or that continuum of adoption?
I would say they're all over the map. Over the past six to nine months, the momentum has clearly changed. AI has stopped being a curiosity and is now a necessity. It is existential, I think, for organizations to really survive and compete now that they adopt it. It, you know, it could kill you if you go too fast, and it can kill you if you go too slow, right? It's a tricky time, but more companies, first of all, every SaaS vendor now has an AI component, right? People have to assess the third-party risk. What are you doing with their data? What models are you using? Are you training on their data?
There's a whole litany of problems that, and questions that they're asking, but they're also starting to see people create their own agents. You know, Copilot Studio is now available if you have Copilot, people are creating agents. What are these doing? Yeah, we want more advanced functionality, so let's, you know, let's start doing the scheduling, start building the toolage. People are realizing that the number of agents is going to start creeping up and potentially creeping up very quickly.
Right.
These agents are non-deterministic, right? Meaning you can give them the same instructions multiple times, and they'll do a different thing each time. Very hard to scope them, very hard to predict them. We have to watch what these agents are doing. We have to understand the intention of the agents, what were they trying to do, and we need to understand the downstream effects on the data that they're touching. The biggest problem is how do we connect, you know, to the AI systems to our data safely? Right now, if you know, when you ask where people are, I think we see about 3% of the data that people have is connected to AI, right?
That is. There's a long way to go there, but there's some urgency. You know, if you think about how good AI has gotten at coding, and you think about, well, why is that? Well, it's got this whole library of the internet, open -source code, right, to go train on.
Right.
Right? It's only as good as the data that it's trained on.
Got it. Super helpful. maybe, Guy, I wanted to ask you on the conversions. It seems as though you're taking a little bit more of a, I don't know, flexibility in terms of price with conversions. I know before you've talked about this uplift that you get from conversions. It seems as though maybe the incent or the intention has been get them converted and then worry about, you know, the uplift later. How, how should we think about the mechanics of that, and how are you managing pricing and uplift and attach for customers that do come over and convert?
You're right. I think the way we have treated the conversions definitely changed post Q3 of 2025. I think when we look at some of the lessons learned from that quarter is that some of the customers that were left in the bucket that haven't been converted were, apart from being federal and state and government, that some of them will never move to SaaS. There are the single-threaded customers that wouldn't necessarily rush to convert to SaaS. We have kind of changed our mindset as to the fact that we would like to get customers to move even at a flat rate and then show them value with the understanding that we can get additional uplifts.
That's definitely been the case in Q4 and Q1, and I expect that to continue for the rest of the year. The framework that we have provided to the street in terms of the conversions is really a bear case and a bull case, having kinda that $50 million on the lower end and $75 million on the upper end. I expect that we will be somewhere in between. We're using the base case of the midpoint there.
It's not a framework that is similar to the other KPIs and guidance that we provide, that is usually a starting point, and we expect to do better on the conversion. It really should fall somewhere in between. That's the expectation from our perspective. I think that the other thing that is really important to note is that the announcement of the end of life that happened in Q3 did generate a sense of urgency in the conversations that we're having with customers.
The fact that we kinda did that, has helped us convert in Q4 of last year, and I think that the conversions that we're expecting to see this year, are definitely influenced by that announcement, where customers need to understand, are they staying with the on-prem or are they building a plan with us on how to move to SaaS. We've definitely seen some of the customers that weren't that urged to move with the announcement at building a plan with us on how to do it.
How do you think about, you know, you guys had guided to no conversions expected in 1Q, and you had some, and you have this, you know, cohort of customers that are yet to convert. You got, you know, government quarter in 3Q, you've got a lot of renewals in 4Q. Where are your customers' mindsets on that conversion path given, you know, the seasonality that you might expect in 3Q and 4Q?
I wanna be very clear. The fact that we haven't guided on a quarterly basis on the conversions themselves doesn't mean that we're not expecting to see conversions.
Sure.
The reason we haven't guided on the conversions on a quarterly basis is, one, we wanna make sure that investors are focused on the right metrics, SaaS ARR excluding conversion is the metric this year to focus on. The conversions can fluctuate, therefore, we didn't wanna put a number out there that could distract and generate a lot of noise. We are expecting a good portion of the conversions to happen towards the end of the year. There is definitely conversations with customers, even if they're up for renewal.
We saw that in Q1, and I think that's gonna happen in Q2, where customers that are up for renewal, and are thinking about converting still wanna take another quarter or two just to be ready from a budgetary perspective or just kind of the process of getting them converted, and they would focus on doing it in Q4. If I had to break down kind of the seasonality of the conversions throughout 2026, I would say that Q3 is probably the quarter that would have the lowest conversions because of that federal, state, and government, customers that would you would see that impact there. The expectation is that a very large portion of the conversions will actually happen in Q4.
Got it. Maybe more from a macro perspective, you know, we're hearing a lot about spending outside of traditional security budgets. That could be other parts of an organization that have AI initiatives that maybe need to think about security, but their CISOs are saying, "Okay, I'll run that for you, but you pay for it." You've also got, you know, certainly post-Mythos and GPT-5.5, I think you've got some emergency spend being tapped. There's a greater sense of urgency. You know, are you seeing that within your customer base? Within those categories, are you seeing any meaningful upside surprise from spending from your customers or, you know, if you have that kind of visibility?
I know I've probably done more demos around AI in the past couple of months than, you know, anything else, and certainly, the volume is unlike anything I really remember in terms of the activity there. I think that one of the interesting things is, we have a broader audience of folks that are vested and interested in making sure that people can deploy AI safely and also keep themselves, you know, the fact that attackers are using AI, and that they're, you know, seeing all the combinations of phishing and vishing attacks. You know, we've seen a lot of the internet-connected SaaS application, you know, OAuth vulnerabilities. There's some pretty sophisticated attacks going on.
I think that the biggest thing is that what I mentioned before, is that in order to compete, you know, the AI must be deployed, and security is now partnering with business units to make that happen, right? There are more stakeholders. There's a, I think a little bit more urgency around, okay, what we need to drive faster, so we need better brakes, right? This is just a very, just to use a very simple analogy. What's gonna give us the confidence that we can drive more quickly?
Got it. I wanna touch on AllTrue and Atlas really quick. And I think you referenced it, you know, Atlas upside not in guidance, but, you know, what do you anticipate we could see for ARR contribution, you know, over the next rest of the next year or so?
Again, it's very early still to kind of put a number to it, but there's a lot of encouraging signs in terms of the conversations and the meetings and the evals that customers are wanting to have through this product. I think it's very much the understanding that you cannot be protected from an AI with kind of the AI evolution without kind of software that can help you do that, and that's why we're seeing so much interest.
As you mentioned, it's not part of the guidance. That's part of what we expect would be some of the uplift, and I think the expectation is that some of this pipeline that we're generating can close in the second part of the year. Not all of it is gonna have that much of an impact in Q2. I think it would be more of an H2 impact. Definitely encouraging in terms of the conversations and something that we're keeping a close eye to make sure that we can monitor it properly.
Got it. Any insight around, you know, ServiceNow and, you know, how they became a partner, or a customer and, you know, what the rationale was and how that might influence or be an indicator of traction for the rest of the year?
First of all, ServiceNow is a phenomenal company and we've been in touch with them for quite some time. We've had a lot of discussions on how we can help them, they can help us and I think there's a lot to the partnership that can evolve. We're extremely happy to have sold the additional licenses to ServiceNow, and this was an expansion of them already being an existing customer. I think there's a lot of things that can work in the future that could help both company.
Got it. I wanna touch next on FedRAMP and federal business. Obviously federal, you know, source of a little bit of frustration in the 3Q, but now that you've hit, you know, you've achieved FedRAMP authorization, how is the pipeline looking? Do you have, you know, a good amount of visibility, particularly in the 3Q? You know, how meaningful of a contributor to ARR do you think that business could be?
I'll be very careful when I, when I talk about upside from the federal business. I would say that first of all, from a guidance perspective, we don't have any upside baked in, and there's no optimistic assumptions. We definitely believe that we can help solve that problem, but from a numbers perspective, we first wanna see the contribution. Yeah, there's pipeline and there's deals that we hope we can close. I would love to talk about them post-closing and not pre-closing if I may. From a, again, from a guidance perspective, it is important to emphasize that, for the most we haven't baked in any optimistic assumptions on federal.
Got it. Maybe for David. Wanted to talk a little about, you know, DSPM, particularly on the competitive front. It seems like everybody has it, not all DSPM is created equal. In general, would love to hear, you know, what you're seeing from a competitive standpoint, whether it's from, you know, larger vendors like a Microsoft Purview or some of the smaller vendors, you know, like a Cyera or a BigID. You know, where do you guys fit in and how are your win rates versus the peers compared to, you know, maybe last year?
Sure. I would say, from a DSPM perspective, I think what's become pretty clear is DSPM is a subset of a data security platform or a data security strategy. It's visibility only, and it's usually limited visibility. It's usually a sample of data on a schedule. When we see, the good news is, I think it's generated opportunities for us. We, you know, we've seen definitely more RFIs and RFPs, or we had I would say that the conversations now are shifting more towards the AI front, more towards the database activity monitoring, more towards our platform plays. When we do see RFPs for DSPM, we generally will see, of course, it's an RFP, it's a competitive situation, that's what it is by nature.
We'll see any of the DSPM players, Cyera, BigID. Usually if there's a data security component, we have a very good shot of winning if we execute. The use cases that are security-centric, complete scanning, always current based on activity, the threat detection, the automatic remediation of any issues that we find, these are big differentiators from a security perspective. I would say this is one area, of course, where we'll compete. The platform play, our coverage really help us. I think that if we can just ask a question, you know, "Tell us about what's going on with AI," we start to bridge into that conversation, it's interesting if we talk about AI and you're gonna connect it up to databases, what's monitoring your databases? Well, we have a solution for that now too.
It's the platform strengths start to really benefit us. Change those kind of sort of tactical competitive scenarios.
Got it. Got it. Super helpful. Maybe also wanted to ask about email, you know, it seems like traction's been pretty robust on the platform. Like, how are your customers linking an email purchase to the rest of the platform? Who are you seeing competitively on that side of the business?
Sure. It's interesting that the way we got into email security is since we came out with SaaS and our Managed Data Detection, MDDR service, Managed Data Detection and Response service, we've had a front row seat to dozens of breaches a day. We, you know, about most of them, about seven out of 10, we detect at the identity layer. You know, two out of 10 we detect at data, and one out of 10 at the network layer. Doesn't matter where we detected it, when we started to say, "Okay, you know, what was the point of entry here? How'd they get in in the first place?" Most of the time it was identity compromise through phishing.
We started to ask, how can we keep attackers farther from the data? We looked at all the different solutions out there, and we found one that was head and shoulders above the others. It was called SlashNext. We acquired it. It's a very natural extension. If you think about how it connects with our Managed Data Detection and Response service, it's kind of natural when people, you know, when we're detecting, "Hey, somebody, you got phished. It's, like, we could have stopped that. The headline I think is it's a 15-minute install. We do a two-month or so look back of all the emails in your environment, and we find stuff that your other solutions missed.
Whether that's an Abnormal, you know, or another solution, there are many kind of API-based email security solutions out there. Mimecast. There are many of them out there. You know, so we can kind of show that there's evidence, that it's got better efficacy, and it's connected to our platform, so we have some leverage there. It can start to make a lot of sense. It's a pretty easy thing when, hey, at worst it's an assessment of your email systems.
If we don't find anything, great, but we always do.
Yeah.
To emphasize what David said though, it has to be seen in the context of the platform. This is not email security as a standalone. That was never the intention. When you look at the offering, it works really well with the MDDR and the platform protection.
You mentioned identity. You know, how important is it to link identity to ownership of the data, and how do you see that evolving given that I think some of the identity vendors, at least one, is talking about moving into the data space a little bit? How do you see the way that you're partnering with some of the identity vendors to link the data to ownership of that data?
We got there from the data side, right? We've always had some, you know, if you're monitoring a Windows environment, you have to see what, how they logged in in Active Directory, for example, right? You have to see the Active Directory groups. We've broadened our coverage of the identity space, so we see not just the configurations, but also the authentication telemetry. It's been really valuable. Usually when an attacker has an identity, they try to move laterally, get more identities, authenticate to different systems. It's been a very natural extension for us to have that telemetry from a threat detection standpoint. Our, because we've been watching identity and data for so long, we have really good detection metrics there.
I see it as a natural thing for people to start talking about because they're realizing in an agentic world, the identity model is completely different. How are we going to track, you know, who, what accounts are these agents authenticating with? Do they have their own identities? Are they acting on behalf of a user? How do we track that? We have multiple agents, how do we attenuate their permissions so we can make sure that we're not exploding our blast radius with each of these agents? Identity telemetry, monitoring identities is an essential part of the AI and data security stack. We've always had that. It's almost the glue between the layers.
Gotcha. Guy, I wanna ask you a question on fundamentals. You know, how should we think about, you know, free cash flow guidance this year, as well as where margins are relative to some of the long-term targets that you'd previously talked about, particularly for fiscal 2027? I think there's an ARR target and some profitability targets. Maybe help us bridge the gap and, you know, how valid are those, how valid is that target model at this point? Is that off the table or still in play?
Let's talk about when we initiated the targets in Q1 of 2023, just when we announced the transition to SaaS, we build those five-year plans in terms of ARR, free cash flow and ARR contribution margin. I think most of the investors were really skeptic about our ability to generate free cash flow, in the early years of the transition, and when usually you're investing the most.
Right.
I think we were extremely happy. I think it has to do with the way the SaaS platform was built to actually be able to show free cash flow improvements over the last if you look at the last couple of years from 2023, we've year-over-year progressed very nicely. If you look at the ARR contribution margin, at the end of 2025, we were basically on the cusp of reaching the long-term model, on the lower end of it, but actually being two years ahead of schedule. I think from an indication perspective, we have done everything in the right way and have been able to prove that we can generate free cash flow and improve that over time and get to the operating margin levels that we wanted to be in.
Obviously, with kind of the announcement of the end of life on the understanding that some of the customers will not convert, there is a bit of a headwind which is reflected in the 2026 numbers. The expectation is that in 2027, as we are basically 100%, SaaS ARR, we kind of go back to the levels. I think that from a modeling perspective, there's a ton of leverage in the model that we can benefit from. We've already showed some of that ability in the first couple of years of the transition, but I think that you can see it even further once we're done with the last leg of the transition. We see the path of how to get to the both the top line number and the ARR contribution numbers and free cash flow.
Obviously, they all go hand in hand. The expectation is that if we execute in the right way, we see the path of getting there.
Got it. Maybe on the capital allocation front, I mean, you've been pretty acquisitive, over the past, you know, couple years, but you also announced a share repurchase agreement. You know, how do you think about, you know, utilization of that agreement as well as allocation of capital as we kind of work our way through the rest of the year?
There are three components that we always constantly evaluate in terms of capital allocation. One is putting back in the business, the second one is the M&A side, and the third one is giving back the investors through the buyback. I think we've done a good job of managing those components. We made the tuck-in acquisitions when we felt that it could generate ROI in the years ahead. And both the email security and Atlas are definitely components that can help us post the $1 billion ARR mark.
We're definitely happy with those, with those acquisitions. We constantly evaluate. I wouldn't say that there's from an acquisition perspective, we're looking in the same framework that we were looking in a year or two ago, we're definitely trying to digest them and make sure that we can execute on them in the right way. If something comes in that is a small tuck-in that would make sense in terms of the roadmap, obviously it would be in that constant discussion of build versus buy, what is quicker, what's the better ROI, does it make sense, we will evaluate. I would say that the framework is, I would say, less on the M&A side from our perspective right now.
More on making sure that we can execute in the right way. From a buyback perspective, I think we, the announcement that we made was definitely a testament to our belief in where this company can be in the years ahead.
On that buyback, I mean, is that active now? Is that on a grid, or is it more opportunistic in nature?
We put the buyback plan, at $150 million, and gave 12 months. We did the vast majority, in by the end of Q1. We're obviously definitely constantly evaluating whether another plan should be put in place, and what is the best capital allocation. We do that analysis on a daily basis.
You know, maybe we got one more minute left. I wanna see if there are any questions from the audience to hit you with. Maybe one to follow up on that. You guys were one of very few companies where management bought shares in the company recently in the active market. You know, maybe any insight behind that, you know, what drove that and, you know, how management team overall might think about, you know, additional acquisitions of shares?
Someone told me once, a very interesting sentence, the sentence goes as follows: There are many reasons to sell shares. There's only one reason to buy shares. So.
That's well put. Awesome. With that, I think we're about out of time. Guy and David, thank you very much for joining us. We really appreciate it.
Thank you very much.