Good morning. Good morning, everybody. Thank you for joining us. Happy to introduce the management of Varonis, CFO, Guy Melamed, David Gibson, Head of Strategic Programs. This is a fireside chat, but by all means, feel free to raise your hands if there are any questions. Gents, thank you so much for joining us.
Thanks for having us.
Maybe for those investors slightly less familiar with Varonis, can you give maybe a quick overview of the company?
Varonis offers a SaaS solution to protect AI and the data that powers it. We've been doing data security for a long time, making sure we can identify what's important, automatically lock it down, monitor it for threats. More recently, we've added additional pillars to our technology. One is because we had such a front-row seat to so many breaches, and we saw most of them were getting in via phishing. We added email protection and phishing protection. More recently, complete security for the AI stack, where we can get a complete inventory of every AI technology, see all the risks through scanning, as well as automated red teaming and pen testing, offer runtime protection and guardrails to make sure the right things are going in and out, and then automate compliance and third-party risk management. We've been around for a couple of decades now.
Been public since 2014. Guy, you want to fill in anything I missed?
The only point I want to talk about is our move to SaaS, the transition was announced early 2023. We are basically in the very late innings of this. We completed the transition in the definition that we provided when we did the investor day in Q1 2023, when we just started the transition. We're at 89% SaaS of ARR, announced an end of life for the on-prem that will happen December 31st, 2026. We will be a fully SaaS company at the end of this year, and that has tremendous benefits. We have kind of transformed the value that we can provide our customers, the SaaS offering, and I think this is an important point that a lot of times gets missed.
There've been a lot of companies that have done transitions, and in many cases, the on-prem subscription was still superior in its functionality, and therefore they kind of dragged the transition. For us, that is completely the opposite. The SaaS is in orders of magnitude a better product than what the on-prem subscription product is, the functionality, the value, the efficiency, what it requires from the customer. We are basically talking to customers about outcomes. We will do the stuff for you. You don't have to manage it yourself as it was on the on-prem subscription side. That is gathering a lot of traction, which is why we were able to move so quickly. It also kind of made us focused on ripping off the Band-Aid and calling the end of life.
Yeah
At the end of 2026. That's kind of where we are in terms of the transition, which is an important part of the story.
If we go back and reflect on 1Q results, I think everybody probably liked what they saw. Maybe if we double-click on that, what would be the key takeaways from 1Q results, I think also in light of that migration and some of the steps that you've taken late last year?
We talked a lot throughout 2025 about the fact that we're putting a lot of emphasis on converting customers, and the comp plan was designed that way. In essence, anything that reps were able to get above the conversion price. If you had $100K of on-prem and you could convert a customer, and just as an example, to $130K in 2025, that $30K above the renewal amount went towards their quarter retirement. When we were done with the transition in 2025 and being able to kind of shift away from focusing on the conversions because we were in the last leg. In 2026, the commission is back to comping them if they sell to new customers and if they sell upsells to existing SaaS customers.
They're not making anything on the conversion, anything towards their quarter retirement, and that allows them to focus on what they know how to do best. I think when you look at the results in 2026 Q1, we saw really healthy growth in new customers. That was very encouraging because when you think about where we are in the journey, we always believe that we can tap into new markets with the MDDR offering and the SaaS offering and go towards new customers that we didn't tap in the past. On the flip side, there were two acquisitions that we made recently, Atlas and Interceptor, and we can talk more about those.
They didn't have significant, any material ARR when you think about Atlas, for example, we only closed in February of this year, so there was only one month left. What was really encouraging is the discussions and the conversations and the level of interest from customers, which gives us a lot of belief that we can, for the second part of this year, can start seeing those pipeline convert into material ARR. I think the fact that we could hit on the new customer side in Q1, and we see the path to actually increase our up-sell with the large base of SaaS customers was really encouraging.
Got it. You've mentioned historically, and I think that also kind of writes well with AI, but conversations that you've been having with your customers about AI, how's that influencing your business product roadmap as 2026 unfolds and, without a doubt, beyond. Have you seen any change as AI is beginning to impact the business? If we'll take everybody back to late February, early March, Claude, Anthropic, OpenAI, some potential concerns about structural risk to the cybersecurity market, how would you think about it from where we sit right now?
I think it's definitely picked up in the last six, nine months. We started monitoring Copilot and ChatGPT Enterprise and Salesforce Agentforce over the past two years or so. Atlas gives us visibility into the entire AI stack. We saw that as needed because over the last six, nine months, almost everybody is starting to create their own agents, starting to deploy LLMs in their own infrastructure, building AI applications, whether those are RAG systems or different chatbots for different business purposes. Security, when we talk to them, not only are they interested in the problems that we've been talking to them about with Copilot for quite a while, where if you don't lock down your data, people will stumble onto stuff through Microsoft 365 Copilot and the different agents.
Now they're starting to worried about what are the agents doing, and these systems are spinning up so quickly, how do I know what somebody's doing with Claude Code when they're spinning up their own MCP servers, their own agents, their own tools? Are they downloading OpenClaude? Are they going to different shadow AI systems? The world started moving really, really quickly, all of these concerns lead them to saying, "I need better controls around the AI stack, but that's also only going to get me so far." Once the AI starts touching the data, I need some controls there, too. A lot of what's happening is we get to have the same conversation that we've been having for a while around protecting data, but with this new pressure on top of it.
The new use case of on top of protecting data, we have to control AI. I can talk more about why you need both sides of the coin. Really, you need both. I think the cool thing is that customers are realizing that as we talk to them. It's like, Yeah, I can't do one without the other.
I want to add one thing that is critical in understanding and way less technical. I think what the biggest difference with AI is that you can now, if you're not sorted from a data perspective and a security perspective in the right way, you can now be exposed without the real intent of employees within the organization to be malicious. If you go to whatever box you're using, and you ask for information, and now you have access to that information, you shouldn't have it in the first place.
You shouldn't have it, yeah
Even if you didn't intend to have something malicious, you could be receiving sensitive information that could be critical from the organizational's perspective. That's very different than the world a year or two ago, where you actually needed malicious intent, because it was extremely difficult to get to those types of files. That scares a lot of people in a lot of the conversations that we're having today, and that's why it's top of mind, and they're talking to us about it.
If that's the case, really reflecting longer term, in terms of seat-based, the way that you charge your customers versus consumption-based as AI becomes more ubiquitous, what's the thinking along these lines?
So even-
Still early days or?
No, even today, a lot of our products are on usage-based, when it comes to some of the platforms that are kind of focused on that. We really try to simplify it for the customer. We're already there when you think about some of the platforms. It's not anything material from our perspective.
Got it. Guy, can you remind us what SaaS ARR growth excluding conversions is and why we should also be focused specifically on that metric?
Absolutely. I'll start with the second part of why it's important, and then I can talk about the numbers. When you think about the importance of it, I would say that throughout 2025, there was a lot of confusion within the investor community and obviously from a lot of the analysts that wanted to know what is the right growth rate. How does this business look like if you exclude the conversions? What we did in Q4 is basically lay out Q4 of 2025. We laid out what things would look for 2026, excluding the conversions. We laid out the guidance for what we expect would be the breakdown of growth rate excluding conversions.
The importance of that is that at the end of this year, where SaaS ARR is going to equal ARR because we're going to be 100% SaaS, that's really the front leading torch of how this business would look. I think that one of the points that we were really happy with in Q1, we finished with 29% SaaS ARR excluding conversion for the quarter. The other part is that the full-year guidance was raised to be 20%-21%. 20% on the low end, and we talk a lot about our belief that this business can grow for several years at a 20-plus% growth rate.
I think it was an important focus for us, and we wanted to be very transparent with investors and analysts and give them that focus for 2026 so they can see how the business is growing, excluding the conversion part.
Along these lines, what expectations are currently embedded in your ARR guidance into 2026? Maybe can you first dive just really high-level philosophy and maybe then touch on organic net new SaaS, and the conversion guidance separately from that?
I'll walk you through the logic and what I've been very clear about over the last couple of months. Our guidance philosophy has been very clear for many years. Our starting point is always set in a responsible way, and our expectation is to be able to increase it throughout the year. When you think about SaaS ARR excluding conversions, when you think about free cash flow, when you think about ARR contribution margin, which is the metric that tracks the expense side, even though we're not guiding on it, but all of those points are under that same philosophy. The one component that I was very clear about in terms of having a bull case and a bear case, basically just putting the guardrails of where we want to be within the year, was the conversion number.
The bear case was the $50 million, the bull case was the $75 million, but there was no expectation from our end, and I was very clear from day one that this is not a starting point, and we want to increase it throughout the year. To distinguish between SaaS ARR excluding conversion and the actual conversion number, we laid out the conversion number as an annual target. We're not updating it, we're not guiding it on a quarterly basis, and it's not because we don't expect conversions to happen in Q1 or Q2. The reason we're not giving a number to it is twofold. First reason is a lot of the conversions move throughout the year, so there's a lot of volatility, and the expectation is that a lot of the conversions will happen in Q4 because that's the largest renewal quarter.
We're also seeing some of the customers within the first part of the year asking to move the conversion for the second part of the year. We didn't want to guide on something that is volatile, and a lot of it is for the last part of the year. The second part is that we didn't want to put a focus on something that is a one-time thing that would be basically done at the end of the year. We put those guardrails as $50 million-$75 million. We feel good about being in those ranges. We took the base case of the midpoint from our assumption perspective and trying to focus investors on what really matters, which is SaaS ARR excluding conversions, which is really what the growth rate of this company is expected to be from an internal perspective in the years ahead.
One of the encouraging metrics back in 1Q is the number of new logos, new customers, and in typically the weakest quarter of the year, just typical 1Q seasonality. What has been driving that motion?
I think it's the product, the platform. The offering itself, both the SaaS offering and the MDDR offering, is very compelling when you go to a customer, and you say, "We'll do everything for you. All you need to do is pay." That's been resonating really well. I think the other part of it is just the fact that reps last year had to focus on the conversions cannibalized their time. Now that they obviously follow the comp plan, and you have to put the incentives in the right place. Now that they're focused on new customers and existing, and they don't have the conversions to focus on, we have other functions within the organization that are dealing with the conversions. It frees their time to do what they know best, which is acquiring new logos and then selling to the existing SaaS base.
Got it. Questions from the audience before we proceed?
Guy, you talked about some of the benefits of transitioning to SaaS. Can you talk a bit about one, two things. First, the impact on your costs and on your R&D. Secondly, the customer buying behavior uplift you expect as they gain access to a lot of those products.
I'll repeat the question for the script. The first question is, what's the benefit and the leverage within the SaaS model? I'll address that. When we built the model and when we took expectations in terms of the SaaS offering from a gross margin perspective, we made assumptions. I can tell you that the internal assumptions and the actual results were much better than what we thought they would be. The SaaS offering was built in a very efficient way that gives us a lot of confidence in our long-term model and generating leverage within our financial model going forward. If I even put aside the gross margins and I look at the other departments within the organization, there are a lot of benefits that we can see later on as you scale on a fully SaaS platform. One of it is the R&D.
Not having to maintain two types of code can generate tremendous opportunity from a leverage perspective. If you look at the R&D as a percentage of ARR, it is actually on the higher end, and there are a lot of benefits that we can see there post being fully SaaS. Also when we look at support or look at the sales and marketing, the actual installation of the eval for SaaS is much easier and way more efficient than doing it under the on-prem. We do see a lot of leverage in the model. If you look at the ARR contribution margin and look at the free cash flow throughout the first couple of years of the transition, they were tracking way better than our internal expectation that we laid out in March of 2023 when we did the investor day.
If you just think about free cash flow as an example, there aren't a lot of companies that during the early days of the transition are able to generate cash. We showed continuous improvement over those years. When you think about the ARR contribution margin, we were technically close to the low end of our five-year model two years ahead of schedule. We not only proved to ourselves, but I think we proved to investors that all we're talking about leverage in the SaaS model is actually coming to fruition. Obviously, when you think about 2026, there's a bit of a headwind because of that $30 million-$50 million of on-prem subscription customers that will not convert. We talked a lot about those. They're mostly single-threaded customers in a vertical of the federal business that will not move to SaaS.
It's okay for us to have it as a one-time and move on, as opposed to having this over multiple years as a headwind. I think as we complete the transition, we see the path for a lot more leverage in the model. I think that's a testament to how the platform was built and the different benefits within the different departments. The second question.
It was really about how you see your customer-
Expansion within the base. What is the expansion within the base? I'll answer it in two ways. I'd say that one of the lessons that we have learned post Q3 of 2025, which was obviously a disappointing quarter for us, was that the customers that were left to convert, we just need to get them over. We are very focused on converting them, even if it's at a flat rate, because we believe that once we get them to SaaS, there's so many more platforms for us to show that we can extract more dollars from them over time. That has been a big shift post Q3. I think it worked really well in the early years and even when you look at Q2 of 2025. We got the uplifts.
I think in Q3, we talked about it in the Q3 earnings call that the focus will be to get customers over as quickly as possible, and that's part of the reason we announced the end of life. The end of life announcement for the on-prem subscription generated urgency within customers that we saw in Q4 last year. Even the expectation for this year is the conversations that we're having with customers is how we get you over as quickly as possible because now there's a deadline. I can tell you that when we analyze the customer lifetime value, it significantly increased with the SaaS offering.
I see the ASPs have gone up over the last couple of years pretty significantly because we're selling the platform itself as one SKU as opposed to multiple line items as we did four or five years ago. The ASPs have come up, but that also focuses us on how can we extract more dollars from them. We also have the expectation that NRR will increase over the next couple of years because the focus is on the value proposition, and that is significantly larger than what it was years ago.
Thank you.
Guy, you've recently acquired Alltrue.ai. You've launched the Atlas AI security platform. Talk to us about how that platform is maybe differentiated from some of the other solutions out there. What about the feedback thus far? If we think about a customer like ServiceNow, why would they be using such a solution?
I'll start, and then David, you talk more to the customers, and I know it comes up in every conversation, so I'm sure you have more feedback. The one thing I can tell you from a numbers perspective is that when we close the transaction in Q1, which was literally in February, it doesn't leave a lot of time to actually have any meaningful contribution from an ARR perspective for the quarter, and it wasn't. What was interesting to see is how the pipeline and the conversations with customers was building in a very positive way. I think that was a clear indication for us that it's top of mind for customers, and as I said before, the hope and expectation is that this can actually translate to more meaningful ARR contribution in the second part of the year.
Yeah.
A question on following up on the NRR comment you made. Where is that metric at, and what is a reasonable target to think about in terms of where it could go to steady state?
When you look at the NRR over the last couple of years, it's actually come down. We finished the year at 110 in 2025. The expectation that we have is that as reps can free up their time, don't cannibalize the time on the conversions, and then they can go back to the base and sell the additional platforms. Our expectation is that that NRR number can go up. We obviously have internal plans and expectations of where that number should be. I'd say that at a starting point, we want it to be higher than the 110 that we reported in 2025. I think the reason that that number was what it was is because a lot of their focus was on the conversions themselves. By the way, that 110 was only for SaaS ARR. Basically, SaaS customers.
It's not the total number because obviously that was skewed. That's the right metric because when you're 100% SaaS at the end of this year, that's the only thing that matters.
Do you feel confident that that 110 is a baseline that you can build on?
I think that all the indications that we're looking at in terms of the conversations that we have with customers, the focus of the sales reps and looking at everything that they're doing, with a comp plan that incentivize them on new business and selling to an existing SaaS customer only without the focus on the conversions, the expectation and belief is that we can get it higher.
Data security is also an area where there's always lots of noise from private players, emerging private players. Specifically as we think about the DSPM and the many tuck-in acquisitions that we've seen around throughout 2023, 2024, 2025, without a doubt. What are you hearing from your customer conversations, specifically on this market?
I'd say that you're right. There has been a lot of noise, a lot of activity. We've definitely benefited from that, right? We get more RFPs, get pulled into more deals. There's similar noise now on the AI market, right? There are a lot of players that are coming in. To answer your earlier question on what are those conversations like. People are really impressed with the completeness of the functionality with Atlas. Also our strategy of coupling the AI security with data security. Like DSPM vendors kind of do a little piece of what our data security platform does, and that's kind of our mission in sales, is to help people understand that DSPM is really not what you need to secure data.
Pieces of AI technology like inventory alone, runtime protection alone, pen testing alone, these things make less sense if they're separate than if they're together.
Together. Yeah.
Right. Atlas has all of these pieces integrated together, and that's a huge benefit that people, as they go through our POC process with that, they really get to appreciate. Having the AI security connected to the data is kind of a mic drop moment for folks.
Understood. Final question.
Yeah.
Josh.
One of the things that people are worried about in the SaaS world is this seat-based versus usage-based model. Can you talk a little bit about how you envision your company in that next world, which might be a usage-based model?
This came up in part of Shaul's questions. We already have a lot of the platforms that are usage-based. We very much try to mimic it with what makes the most sense for the customers. In that sense, it's not something that worries us much. I'd say that from a platform perspective, the vast majority of our upsell is selling additional platforms already. We feel very good with what we have to offer to customers to allow them to see more benefits and be better protected.
How many deals now are happening with Atlas as part of that?
Atlas, the Atlas acquisition happened in February of this year. It obviously didn't have enough time to have meaningful contribution. They didn't have any ARR when we acquired them, and they didn't have any material contribution in Q1 because it was kind of really early, really late within the quarter. From all the conversations in the pipeline that we are building, we feel very confident and believe that we can start seeing some contribution in the second part of the year.
That's a usage-based model.
Sorry, go ahead.
Is that a usage-based model?
Usage. Atlas is nice because it's kind of per AI system or agent, right? Any of that change, we're already protected from that. One of the things that Atlas is doing is it's changing the application stack is really collapsing, right? People are accessing more data stores through these agents and things and different AI applications like, for example, databases. They're potentially becoming collaborative. In the old world, it was like your application and your DBAs. Now it's normal users accessing databases via these agents, and they don't have any Database Activity Monitoring, many of them, right? It's pulling in another pillar for us. Database Activity Monitoring is something that, it's kind of a new market for us that we've entered into. Plus all the different additional coverage, right, into Snowflake, into Databricks, into Gemini, into all these different places.
It's actually a kind of a cool conversation now when we add in the AI.
All right. With that, gentlemen, we're on the hour. Thank you so much, David, Guy.
Thank you.
Appreciate it.