Excited to be hosting the management team from Varonis here, David Gibson, the Senior VP of Strategic Programs, and CFO, COO Guy Melamed.
Thanks for having us.
Thank you for being here. I appreciate it. I want to jump right into the discussion and maybe just to kind of level set with everyone. I think most folks here are very familiar with the story. You've been public for 12 years, b ut at the risk of maybe starting too high level for those who are newer to the story, Guy and David, maybe you can give us a quick overview and how the core value proposition of the business has essentially been turbocharged in the AI era. Guy?
Yeah. Varonis started in the data security space, as everybody's familiar with. And these days, enterprises have data in many, many different places: on-prem, in the cloud, and SaaS applications, a nd we've been helping them protect that for a long time, a nd when I say protect it, we find all the important data, lock it down, monitor the heck out of it, a nd that's kind of the core value there. You talk about the turbocharging. As we've expanded the offering in data security, in the AI security, and email security, it gives the story a lot more, gives us a lot more to talk about. I would say probably the highlight is people are definitely in the building phase of AI. The agent population is exploding. People are doing much more with AI than they ever have.
In order to get value out of AI, they need to connect it to data. We have seen a lot of stuff in the news about Anthropic and Hugging Face. I think people are realizing that in order to protect data in the age of AI, there is much more control that is needed, understanding what AI they have, where there are risks, where it might be misbehaving, and then what is happening, how is it touching the data? How is that going? What could it do? How do we make sure we are limiting our exposure there? There is a lot more, I think, attention on all these problems, and Varonis is in a unique position to help organizations solve these problems.
Guy-
I want to add to that, if I may, just from one of the important items that is worth emphasizing. We announced a transition to SaaS at the beginning of 2023, and we are really going to be 100% SaaS by the end of this year. This transition has been a very interesting ride, but in terms of the value proposition to our customers, it has been providing automated value to customers in a way they have never received before. I think one of the items that have shifted kind of the way customers think about our product is that in the past, we would give them the solution, but they had to manage it. That was extremely difficult, especially in this environment where the hacking environment is increasing by the day.
With AI today, you do not even need malicious intent from an employee in order to access sensitive information. In the past, they had to try and find where that sensitive data is if they wanted to access it. Today, all they need to do is go into the chat box, and if that is open to everyone who got a salary increase last year, if that information is open to everyone in the company, they will get it within seconds. The whole environment has changed. With our offering, and there are many companies that have gone through similar transitions, many of them had similar offerings on the SaaS and the on-prem, so they could kind of drag that transition for a longer period of time.
Our SaaS offering is in orders of magnitude better than the on-prem subscription offering, which is part of the reason we wanted to rip off the Band-Aid. We announced the end of life on the on-prem subscription, which the date is the end of this year. When we think of kind of the evolution with our customers and how they see the value now, you do not give them the software and you let them manage it. You basically say, we are talking about outcomes. We will make sure that you do not have a data breach. We will make sure that you do not have any fines. We will make sure that you can utilize your AI in the most efficient way.
When we talk about all of those components, we can talk a little bit more about the Varonis MDDR later if you would like, but basically it changes the whole value proposition and the simplicity of our offering as well.
You just finished out your second quarter reported results about six weeks ago. From the standpoint of some of the commentary around the SaaS transition, the momentum building, key milestones around end of life, would love to get a look back and a recap of the highlights of 2Q. As you are thinking about the remainder of the year, expectation setting in terms of certainly financial guidance, but also customer behavior in the environment that we are in right now, buying behavior, and then certainly the portfolio expansion that has happened over the course of the last year in email and database monitoring and AI. Would love to have you unpack some of that as part of the Q2 recap and what we are expecting or what you are expecting for the rest of the year.
We completed an acquisition in Q1 of 2026 of Atlas, which is basically the AI component, and David can talk more about the capabilities and how much value it provides customers. We have seen that starting to pick up in terms of the leading indicators that we are looking at. We saw nice contribution in Q2, but not anywhere close to where we think it could be. When we track the meetings and the conversations that are coming up on this subject with our customers, it is definitely coming up almost in every conversation. Definitely something that we expect will have a larger contribution in the second part of the year. I think the Q2 results were healthy. We actually wanted to do even better than the print that we provided.
We did talk about some of the noise that was impacting, it was not so much the noise itself, it was the timing of when things came out that generated some commotion. The way we started Q3 and the pipeline and some of those deals that we were able to close gave us the confidence not just to look at the full year guidance with the actual beat of the Q2 number, but actually raise on top of that. Some of the deals we were already able to close. We are tracking in a healthy way. Just to keep in mind, we are back-end loaded similar to other enterprise businesses, but we have a good start for the quarter, and we feel good not only with where we are, but also in terms of the pipeline that we have built.
We've gone up market, and when we look at where we can land within those larger customers, the value that we can provide and the platform offering has expanded significantly, which gives us the ability to land larger deals, but also go back to those customers and sell them additional licenses later. MDDR has somewhat become the glue. Its offering and its simplicity and the value that it provides customers is definitely something that has made the whole conversation with new customers much easier. We saw very healthy growth on the new customer side. Definitely something that gives us confidence going into the second part of the year.
Guy, if I can double-click on something that you said. Some of this press speculation around change of control created commotion and noise in some of your selling conversations, right? Just to be abundantly clear, how much of this transaction activity or deal slippage was realized in the quarter, and to what extent have you successfully recaptured some of that now that a lot of the noise has died down in your third quarter?
We were able to close some of it before we actually reported on the Q2 results. That was part of the reason that we were able to raise our guidance above the beat. I want to be very clear. Our guidance philosophy for Q3 hasn't changed, even with that raise. It wasn't like we were stretching on the guidance side. We kept the same conservative guidance approach that we have done in the past, b ut the fact that we were able to close some of the deals already going into the reporting date gave us the confidence. We do expect that much of those slippage deals will close this quarter.
Third quarter is also an important period for public sector activity, U.S. Fed, in terms of their fiscal year ends. I think you all have worked pretty hard to get your accreditations into the government in order to be able to have a more robust presence in the federal government. Can you give us a time series of your success in FedRAMP, GovCloud, DoD-type certifications, where you are, and how we should generally think about what you have embedded from a public sector business activity standpoint? I think it's an important conversation simply because last year was challenging for anybody who was selling into the federal government, basically up until earlier this year, because of some of the DOGE activities and things like that.
Now that we are fully lapped over some of that noise from the buyer perspective, how are you coming to the table with the right certifications and what do you have embedded or anticipated in your third quarter outlook?
We have FedRAMP moderate. Let me start from the headline. We have not done as good as we expect to do on the federal business over the last couple of years. The potential is there, the opportunity is there, the need is there. We have not cracked the code yet in the right way. It does not mean we do not want to continue to try, but I think we made some changes this year. Nothing from an optimistic perspective on the federal business is baked into any of the guidance. We have low expectations, and hopefully we can do better. But let us see the numbers first, and then we can give color on that. But that does not change the opportunity itself. It is not that the product is not needed there. There is sensitive information in the federal market that we need to cater to. We have customers there already.
We do know that some of the customers that are on-prem will not convert, and that is baked into the number that we provided the beginning of the year that we know will churn. That is fine. We want to be 100% SaaS. We understand the additional costs associated with managing two types of code, and we just do not want to be there. We want to be where we can provide the most value to our customers. We have definitely made the investments on the federal market. We want to see some of the returns take place. We have not gone through the FedRAMP certification being high yet. But if we see that the opportunity is worthwhile, we can reconsider that.
You have been talking about and evangelizing and providing a solution for the data security problem before it was cool, and now it is in everyone's consciousness, right? Can you talk about the levers of growth and growth acceleration here and perhaps historically, where there was a tie into, hey, an organization is moving to Microsoft 365, and they need to protect their data estate and data sprawl around those systems. Can you talk about how you sort of benefited from the ascendance and that migration, and then beyond that, the growth and proliferation of other data stores where there is critical enterprise data, and how the business and the R&D capacity and the support for these new data stores has expanded insofar as, hey, you are supporting and monetizing Snowflake environments and Databricks environments.
I know these things have been a very healthy stream of announcements for you in terms of reducing your dependence on the Microsoft ecosystem, so to speak. I wanted to get a flavor and sense from you on how much of that has been powering this incremental demand for your core value proposition.
Yeah. I think the headline is that if you have an enterprise data store, chances are we support it, and we have probably been supporting it for a while. When we say support it, the depth of our visibility is pretty significant. We are talking about what is the important data inside it, how is it controlled, who has access to stuff, and then who is using it. That is really kind of what goes into the visibility that we have. With that visibility, we are able to see data in harm's way, understand how to fix it safely. That is where the automation in our SaaS solution has really helped because we can then go fix stuff safely without customers having to do stuff. Then we monitor it, and we are able to monitor it where they do not even have to look at the alerts.
We can call them if that is our job, is if we call them if there is something that we think they need to know. That is the Varonis MDDR service with an SLA. The way that this has really helped us is through our kind of quarterly process that we go through. We call it a quarterly business review. With every customer, we want to meet with them at least once a quarter and go through, "Here is what we have done over the last 90 days. Here are the things that we found 90 days ago, the things that we fixed. Here are the ones that we will plan to do next quarter." "By the way, we understand you have Snowflake. We understand you have Databricks.
You have a new RAG system that is making use of these databases." Whatever the data store is, we can have that conversation and kind of earn the right to do a risk assessment on some of these other data stores. These days, it usually also includes an AI assessment as well with Atlas. There is so much more. We talk about the database activity monitoring. We can talk about email. But any one of these solutions can be then part of our conversation, and we can do a risk assessment and see, prove the value. I think the interesting thing is all of these data stores are controlled a little differently. There is no standard. Some of them have masking, s ome of them have different kinds of groups. Some of them have different entitlements. Even just the Amazon Web Services and Azure and Google Cloud, right?
The permissions like Amazon Web Services and Google have a lot of similarities, but Azure's very different. The more places you have data, the harder it's becoming for security teams to really understand how it's controlled. Being able to have one pane of glass that can cover all these data stores and perform these functions becomes very strategic. Then again, when you couple it with AI, that's where it's very differentiated for us. There's really nobody out there that has control over both the AI side and the data side like we do.
Guy, when I think about your financial outlook for the year from a SaaS ARR perspective, you talk about total ARR, but you also talk about SaaS ARR, and that's explicitly for the reason around you have been going through a migration process, right, in terms of moving your install base. So when I think about the 28%-33% SaaS ARR growth ZIP code, and I think about the absolute explosion of data on a two-vector basis, right? Your data stores, the number of them are proliferating, but then also the data within them is exponentially growing. How can investors and how should investors reconcile kind of a 30% SaaS ARR growth rate with data growth that is a multiple of that? So how are you levered, and how do you continue to be levered to data growth, and capture that upside in the data that you are protecting?
One of the biggest misconceptions we had to deal with last year was the fact that many of our investors thought that we were growing because of the conversions. We constantly said that there was nothing further from the truth, that it was cannibalizing the time of our reps because they had to deal with conversions, not so much from a technological challenge, but from a documentational perspective. They had to go through a SaaS security checklist. The procurement got involved in any conversion, and legal, and there was a lot of, I'd say, confusion. Then at the end of last year, we started providing SaaS ARR, excluding conversion as a metric, in order to show everyone not only just how we're growing, but how we expect to grow post-transition.
When you look at the numbers that we have provided, we've talked a lot about our desire to continue to grow 20-plus percent over the next couple of years. I was very happy that during the year, we were able to raise our full year guidance and start with a two handle, and I think that we are set up nicely. Obviously, we need to execute, but we are set up nicely from a pipeline perspective to continue to capitalize on this huge opportunity. When you break down what David was saying, and to address your question heads on, the market opportunity today for us has never been greater. The platform has grown in orders of magnitude compared to what it was several years ago.
When you look at the DAM offering, there is a billion dollars of ARR that is with two vendors that is mostly concentrated in several hundred customers. The Cyral acquisition that we had last year is trying to address that. When you look at the Atlas, that is a whole new opportunity. When you look at Interceptor, that combined with the MDDR offering, is generating a lot of opportunity for us that we would like to capitalize on. So when you look at the numbers and when you look at the opportunity, we stand behind our desire to continue to grow 20%-plus in the years ahead. I think we are managing that opportunity in the right way. We have gone through a transition and still generated free cash flow.
improved those levels, and there are not a lot of companies that, during a transition, during the early stages of a transition, can still increase their free cash flow, especially because there is so much investment in the first period of the transition. I think we were trying to manage the top-line growth and the operating margin. We look at the ARR contribution margin just because of the revenue headwind on the transition itself, b ut I would say that we see this opportunity, and we want to take advantage of it, and we feel that the platform is at a place where it could allow us to take care of that opportunity. Obviously, we need to execute on it, but the opportunity is there.
Guy, just sticking with you. Calendar 2026, a lot of the, let us just call them distractions from last year are no longer in play, right? The average salesperson is now unencumbered from having to deal with the paperwork from a conversion standpoint. That has been very clear. You have been very consistent about that message. So excuse me. From an intrinsic level, with those distractions gone, the market sort of coming your way in terms of the recognition of data security being a problem that is amplified in the era of AI. Can you talk about the impact you are seeing on some internal metrics?
So certainly we can see it in the financials, but anything you can comment on as it relates to, okay, you take away these negative overhangs on the sales force in terms of what is cannibalizing their attention, and hey, it is accelerating sales cycles by XYZ percent, or the funnel has grown by XYZ percent. Anything internally that makes your eyes light up in terms of then underwriting your confidence that the path to $1 billion in ARR is very well within reach.
Over the last period, we have gone up market and have been able to increase our ASPs, but not only land with larger deals. We were able to actually go back to those customers and show them value and then sell them additional platforms. When we track pipeline on the larger scale customers, we are seeing that grow, and that is definitely giving us confidence. We do not have those gigantic deals that are the monster deals that are unpredictable. We have seven-figure deals at a good density that gives us confidence that we are set up for a strong second part of the year, especially with Q4. That is you do not only take advantage of the pipeline that you generate, it is also a quarter where you are building pipeline within the quarter that you can capitalize on. I think we obviously need to execute in the right way.
From a pipeline perspective, from a leading indicators perspective, we feel good with where we are in order to take advantage of the opportunity. I think that once you are done being 100% SaaS and there is no noise in the system, and you are not managing two types of code, and you are a fully SaaS company, then the whole kind of posture of the company changes, and then you are kind of beyond that stage. I think we are already there in terms of being so far along the transition, but there is kind of that desire to be 100% SaaS by the end of the year, which we want to achieve.
Another thing that is actually dramatically different in calendar 2026 versus calendar 2025 is that you are literally in brand-new categories, right? Database activity monitoring was not a domain you were playing in last year. Email security was not a domain you were playing in last year. AI security proper was not a space. So, when you layer on those factors and some of your commentary around, hey, seven-figure pipeline build and density gives you a lot of confidence. Anything you can share in terms of early reads on attach rates to these newer adjacencies that you have brought into the portfolio, and, again, probably a small sample size, but upsell or ACV uplift kind of ranges as a customer who is now a full SaaS customer in classic Varonis capabilities. When they add Interceptor, when they add DAM, you are seeing sort of a very attractive uplift or attach.
The incidents of attach and then the uplift on each of those new pillars.
One thing I've never done before, and I don't plan on changing my behavior, is never talk about optimistic assumptions until we have enough of a sample size that gives us the confidence to talk about it externally. We obviously have our assumptions, and when we look at some of the ASP growth that we've seen over the last couple of years, it's stemming from the platform offering. The additional offering that we now have doesn't have enough of the material impact for me to come out and say, "Oh, it would have an impact on ASP's growth that is double digits," whatever percentage that is. I'll stay away from that.
But I will say that overall, when we look at kind of the reception of our customers, and how much they're interested in the Atlas offering and how much they're talking about the impact it can have on their company, it's definitely giving us a lot of comfort and confidence to kind of look at the second part of the year in a positive way. When we look at growth rates and additional ASP, and this is an important distinction that I want to clarify, yes, there is an assigned dollar amount for each product within the price list. But we have moved in a direction to try and simplify the sales process for both our sales team and our customers. I'd say four or five years ago, we had 43 SKUs, and you would go on every single SKU, and it was challenging.
Challenging for the customers, it was challenging for the sales force. On-prem subscription was an opportunity to kind of bundle things together, and we doubled down on that with the SaaS offering, and now we don't even have the option to buy it la carte. Now you buy it as a single SKU. You either buy the smaller platform or the more comprehensive platform, but you buy it as one SKU. I think that has been a great change that's really simplified the whole selling process. We want to continue to move in that direction, s o if you look next year or how we're thinking about kind of the price list, we want to have more of a condensed SKU. But for now, all of the new products came in with separate SKUs just because they're so new.
Trying to understand the full mechanics of what the impact is, I don't care if that product adds X percent or Y percent as long as I can show an increase in ARR on the full contribution of that customer. I'll give you an example with the MDDR, the offering, if you buy the more comprehensive product, you get the MDDR at a reduced price. If you buy the more basic platform, you have to pay for the MDDR more. We wanted customers to go with the first option, because the more they consume, the better it works, the more value they get, and we're actually really glad that that's what they did. So do I quantify MDDR as an X contributor? No, because whole ARR increased, and then it becomes stickier, and the value that you can provide them going forward goes up.
We're thinking about it more holistically than on a dollar-by-dollar perspective.
A lot of the momentum and again, the criticality of the pain points that you're solving, it has absolutely attracted a lot more entrants and competitors in the space, right? Whereas five to seven years ago, you pretty much had the market to yourself. You worked hard to educate on the problem, and you did have the market to yourself. The landscape certainly looks different today. David, I wanted to get your perspectives on how the landscape has shifted and what do your run-ins and RFPs look like today versus three years ago? Because a lot of vendors are talking about data security kind of in their own image, right? How do you combat, who do you see the most, and how do you now combat that? Because maybe your battle five years ago was inertia and DIY, right? Now it's a different problem.
Sure. I think it depends on, as we've broadened the platform, we've come up against competitors in data security like DSPM, DAM, some of the compliance, governance.
In AI, there's a whole bunch of people, a whole bunch of vendors that are in that space. With email, now we have a whole new suite of competitors. I would say it varies. I'd say, to use your words, data security is now cool. There are a lot of people that are doing pieces of it. I feel like when people see, when we have an RFP, our job is to kind of help people if they aren't asking all the right questions to kind of fill out, ask them about that, "Have you thought about this functionality, this functionality, this functionality?" But generally, more and more, we're really in a good spot because people are looking to secure AI, and they're looking to secure their data.
Guy and David, my last question for the both of you is, what is one thing that you're consistently hearing or interfacing that you feel is either misunderstood or maybe underappreciated by the investor community? Guy?
I think it was mostly last year, going back to the growth rates and how the company would grow post-transition. I think with the changes we made in Q4 of last year and giving additional metrics and additional color, I think a lot of that confusion has gone away, and it's definitely noticeable in conversations that we have with investors.
Great. Well, we'll cap it there. Thank you very much, team.
Thank you.
I really appreciate your time.
Thanks very much.