Are we live? Good to go? Great. Well, thank you guys so much. Good afternoon. Thank you for attending Citi's Global Tech Conference. My name is Mark Zhang. I support Fatima Boolani with the Citi software research coverage. And today I have the pleasure of you know, having Varonis here with us. To my left is David Gibson, SVP of Strategic Programs, and to his left is Guy Melamed, CFO and COO extraordinaire. So thank you guys for coming and you know, all your time. Might as well just you know, jump right into it. Maybe just a quick overview for those who aren't familiar with what you guys do and what Varonis's you know, mission.
Can you just maybe give a quick summary on, you know, the state of the union, you know, what you guys do, who you are, and you know, what your capabilities and solutions solve for?
Certainly. So Varonis sells software that protects data. We have a SaaS-based solution that helps people understand their data, meaning what's important, who's got access to it, who's using it, where is it at risk? And then we use automation to lock down the risks that we can see with that new visibility, as well as monitor how it's being used, so we can detect threats to data and stop them automatically, like an insider, like a Snowden or a Teixeira, who was the insider with the Pentagon breach recently, or an external attacker, like a ransomware or any other sophisticated attacker that may be after data.
Gotcha. Okay. Perfect. Now, I guess, you know, it sounds, you know, obviously, you guys protect data, play in cybersecurity space. But, you know, cybersecurity is a broad landscape, and it's getting broader every day. Can you maybe, you know, help, just frame exactly where you play in the cybersecurity space? You know, what does your solution help, you know, maybe protect against? Who are the threat actors who, you know, basically, you know, target and protect, you know, your customers against?
Certainly. It's interesting, you know, if you talk to any cybersecurity professional, of course, they would say, we protect data. If you ask them, like, "Is protecting data important to you?" But if you really think about the history of security, most of the technologies really didn't start with data, right? The metaphor was more about keeping the bad guys out, kind of starting with a firewall, a network-based kind of, you know, keep the bad guys from the internet out or from the endpoint. When you look, these traditional approaches that people have been trying to keep the bad guys out didn't start with data. So our approach has always been to focus on where the biggest concentrations of data live in or, in an organization, and these days, they don't really live on an endpoint.
They live in massive data stores, in data centers, and in the cloud. For the most part, the security technologies have been adjacent to these, haven't really directly interrogated these data stores in a way that we have. That's really where our approach differentiates, is to look inside these massive datasets to find what's important. So regulated data, sensitive information, information that might be financial records or credentials, like passwords in, in clear text, right? Or keys in clear text, like the kind that really exacerbated the Uber breach.
Mm-hmm.
And then see who can touch them. You know, if you go to many organizations and you ask them, "Show me all the data somebody can touch," that's a, that's a very hard mission, right? Who can touch them? Who's using them? And so it starts there with understanding that approach, right, of, of how is the data laid out and how is it protected. And from there, we can automate a lot of the remediation tasks, like locking things down, and then also use the same technology to make sure that people are using the data correctly.
Gotcha. No, that's, that's great. And it's great that you actually mentioned, you know, real-world experience, whether it's for Uber and other, you know, data breaches. But any other sort of examples you could maybe give a sense of, you know, a full chain of whether it's from an attack to, you know, I guess like remediation to, you know, how to basically get back to, you know, I guess like, run, I guess, like, you know, run state, you know, back to, I guess, like, you know, back to, normalization.
Certainly. So when we start with organizations, and we have some of these conversations about where do you store your critical data, and how confident do you feel about how well it's protected, that usually leads to a risk assessment. This is a core part of our selling motion, where we will light up our SaaS solution and map a data store for them or a couple of data stores. And invariably, what we see is what people kind of knew was probably true to begin with. Yeah, there is... way too many people have way too much access to data. And there are some surprises where sensitive data is stored, how people are using it. And if you think about the way attacks work today, you know, there's a huge threat landscape. There's all sorts of endpoints, there's all sorts of cloud applications.
There are just an innumerable amount of ways that an attacker could get in, and it's almost impossible to tell where an attack is gonna come from, but you know where it's going... It's always going to the data, right? So really getting a handle on the data, what happens if an endpoint, you know, misses something? What happens if you have a vulnerable server? What happens if you have an insider, like a Snowden? What's going to protect you then? Our risk assessments light up that kind of situation and illustrate how we can get back to that state you mentioned. We now have a blueprint. Once we do this risk assessment, here are the highest concentrations of sensitive data that are most exposed, and you don't have to live with that.
Our automation automatically addresses these risks, and that's one of the things that's really appealing about our platform, is the amount of results, the amount of outcomes you get without effort, because a lot of security teams are stretched pretty thin these days.
Right. Right. Yeah, that sounds, you know, like a unique offering and very competitive in the market. So maybe if I am a security analyst today, if I don't use Varonis, what are my alternative options? What else do I use?
Sure. So, let's broaden it from just a security analyst. I can talk about that specific use case, too-
Sure
... but just security teams. You know, it's not like they're not trying to secure data, to lock down data. Nobody would say that they're not trying. It's just that the amount of risks that are being generated every day are almost immeasurable and certainly irreparable manually. You know, with cloud repositories today, I don't know how many people here use Teams or Microsoft 365, or Box, or Google Drive. These platforms have made it so easy for end users to collaborate without any help or any guidance from IT. I think of it as a party with no parents home, right? That there's just, you know, chaos happening. In the time that we've had this conversation, there's been more risk generated by end users than we could count.
Yeah.
Right? So the idea that you can address some of these risks without specific automation that was built for it has just become kind of a non-starter for folks. So people have started with native technologies, point solutions, other security technologies that eat around the problem, but don't address it head-on.
Mm-hmm. Gotcha. And then to that point, can you maybe give a sense of, you know, what the competitive landscape looks like? Who you compete against, how do you differentiate yourself, you know, when it comes to maybe a platform vendor, like a Microsoft.
Mm-hmm.
You know, obviously, Microsoft is a 300-pound gorilla or 800-pound gorilla that, you know, is threatening everyone. Do you guys see sort of, you know, a threat from them as well, and how do you sort of differentiate yourself from this?
Well, we're a Microsoft partner, and we have actually a great synergy with Microsoft now.
Mm-hmm.
One of the ways that people are trying to protect data is to try to prevent sensitive data from being emailed out, or being saved to a USB key, or being printed. And for that, Microsoft has a nice technology called Purview Information Protection, and the idea is that you put labels on these files that shouldn't be printed or you shouldn't be sent, right, or should be encrypted, and that happens automatically, and that provides a layer of protection. With Varonis, people are able to actually get the right labels on the right files-
Mm-hmm
... far more quickly, without even requiring users to put a label on the files at all. And so that helps the story, that kinda... It's a better-together story there.
Mm-hmm.
So more and more, I think, as our platform has matured and as the ecosystem has developed, our place in it is becoming clearer, and how we help with other technologies like Microsoft is becoming clearer.
Gotcha. Okay, now that's great. And, you know, now that the platform is maturing, and, you know, you guys actually recently starting to talk more about your new model transition to SaaS. Maybe we'll get Guy more involved here as well. But maybe can you give a sense of, you know, what this transition entails? What kind of modes of delivery, you know, you've had and what, I guess, like, essentially, is net new with the SaaS model transition?
I think start from the important part. SaaS is a better product, and we're getting a lot of positive reactions from our customers on how the product is so much better, and we're getting very positive reaction from our sales force. So that's been a very interesting kind of. As we track through the transition, and we're very early in it, this is only our third quarter, we feel very good about where we are. When we talked about the time frame for the transition, we talked about a five-year period. We talked about phase I, where we target new customers, selling them SaaS, and then we expected that to be anywhere between one to two years.
And then, as we get close to ending that part, we would start targeting phase II, which is converting our existing customers from self-hosted to SaaS. And we talked about phase II being anywhere between three to four years. So the aggregate transition expected to be five years, and we defined a transition to be complete when we have anywhere between 70%-90% of our ARR coming from SaaS. Now, what's great is that at the end of Q2, we already reached about approximately 10% of our ARR coming from SaaS, which is great progress for us. And we talked about the fact that at the end of the year, we will have to reevaluate our time frame.
Because what's actually happening is that phase II, our existing customers, in a very natural way, are requesting to convert to SaaS. Our reps make money on anything they get on top of the renewal, so it works for them, it works for our customers. As I said before, it's a better product, so it's a win-win for us. Win-win for everyone.
Gotcha. You say it's a better product, but can you maybe give a sense of, you know, why that SaaS product is different or better from the previous version, for customers? You know, does it drive just greater adoption, just greater, you know, sales motion? I mean, you mentioned greater sales motion, but anything else that, you know, we should keep in mind as you're going through this transition?
So several elements. The first element is that in this environment where so many, the threat landscape is evolving by the minute-
Mm-hmm.
Your ability to provide updates and upgrades in an instantaneous way through SaaS is something you can't do through your on-prem subscription offering. So Log4j, which was one of the biggest breaches that took place last year, you had to go to every single customer and make sure that they downloaded the update and that they installed it. And that's a process that is tedious for the customer and tedious for our sales organization. With the SaaS offering, you find an attack in one part of the globe, and you can make sure that all of your customers are protected within minutes as you distribute it to your entire customer base.
So the time to install the product is shorter, the value that customers get is much higher, and the automation, as part of the SaaS, is much, much greater.
Gotcha. Okay. No, that makes sense. And I guess, like, through the SaaS transition, and even from the beginning, do we need to see more investments from you guys, whether from a sales force capacity standpoint or from a capability standpoint, you know, that needed to be done to facilitate this transition?
So first of all, the vast majority of our sales force are embracing this transition, and this is very different than what we saw in 2019 when we moved from perpetual to on-prem subscription, and we saw some resistance. We're not seeing any resistance in this transition, and part of it is because it's so much simpler to sell it, and it's so much easier to provide value to customers. When we look at our sales force, the one thing that we feel very good about is our ability to extract more dollars from customers through the SaaS offering. So the customer lifetime value can increase because we're selling the platform, we're providing the automation, and with that automation, customer satisfaction goes up, and their desire to protect additional platforms increases.
So they will come back and buy more. That works well in showing that value. One of the things that we changed with the SaaS offering is doubled down on consolidation of SKUs, which means that we had bundles when we offered in 2022 through our on-prem subscription. We had gold, silver, and platinum bundles.
Mm-hmm.
We saw that that worked very well with simplification to our sales force and simplification for our customers. So when we introduced SaaS, we consolidated SKUs into one SKU, and now we're selling the platform. And that's been received very well by sales force and customers.
Gotcha. I guess, given our state of the economy and the macro headwinds, have you seen any impact from macro on your transition to SaaS?
When we gave guidance at the beginning of the year, we took into consideration macroeconomic deterioration. I can say that in Q2, it was very similar in terms of macro to Q1, so we didn't see that deterioration. Our guidance for the second part of the year does assume deterioration, even though we didn't see it in Q2. When we built the guidance, there were two factors. It was the macro component that we just talked about and the fact that we were going through a transition. Every time you go through a transition, there is this... Usually, the first six months of the transition are the most challenging part, where your reps are trying to clean through the pipeline, which was originally introduced as on-prem subscription, but now they're trying to sell SaaS.
So they're introducing another concept to a deal in flight, and that generates some turbulence. With our sales cycles being 3-9 months and up to 12 months on the larger deals, the vast majority of that pipeline has been cleaned. And that's why it kind of feels that we're past the challenging part of the transition.
Mm-hmm.
Still a lot of things to do, and we wanna make sure that we can provide a lot of value to our customers, but at least from introducing quotes that have been originally introduced as on-prem subscription, we're through the vast majority of that.
Gotcha. And I guess once you're completely through the SaaS transition, does this change your competitive positioning in cybersecurity at all? Does it change sort of your, you know, value that you bring. It changes your value that you bring to your, you know, customers, but does this also, you know, open up your competitive landscape?
So I think it's widened our moat. The advances that we've made in our SaaS technology, in many ways, it's now light years ahead of our self-hosted offering. The automated value, the kind of robotic value proposition that we now offer, we really are allowing customers to define the rules of the road, what should be permitted, and then we automatically enforce the rules of the road. So people don't have access to data that they shouldn't have or no longer need, without them having to go through the manual effort of cleanup. These kinds of values across such a wide array of data platforms is enormous value. Then if you couple that with an offering that we call proactive incident response-
Mm-hmm.
where we're able to be a set of eyes on glass, we're able to watch the alerts on behalf of our customers, do some initial triage and investigation, and give them a call if we think there's a threat that they really need to know about. That kind of no-touch value has been very well received as well, and I believe widens the gap between us and anybody that would be nipping or trying to nip at our heels.
Gotcha. No, that makes sense. Maybe just on the financial impact of the transition, from our understanding, the revenue recognition for SaaS is different from your prior model. Can you describe how it works and what's changed, and what's the sort of KPIs that we should look forward to?
So over the last, let's say a year and a half, we've talked about ARR being the leading indicator for us. And it especially is the case during a transition, because the way revenue is recognized in SaaS is it's ratable. And with the on-prem subscription, we would recognize 80% of the deal when we ship the license, and then 20% over the term of the deal, which was over a one-year period, usually. That's why revenue is a lagging indicator during the transition, and when we did our Investor Day in March, we talked about the three North Stars: ARR, free cash flow, and ARR contribution margins. Those are the indicators that will allow investors to identify the health of the business.
When you look at the ARR, the revenue recognition can change, but the ARR is the same amount, so that's why it becomes the leading indicator. Free cash flow, we've increased our free cash flow projections significantly in the last earnings call and raised it from $20-$25 million to $40-$45 million for the year. We're very much focused on increasing our free cash flow generation, and I think we're very well positioned to do that. And when you look at the ARR contribution margin, which is ARR minus non-GAAP operating expenses, you can see that we have started to show leverage even in the initiation of the transition, which is, you know, it's not that simple to do.
I think in terms of the cost structure, we kept it very much intact, even with the investments that we had to make, and are very focused on those three KPIs.
Gotcha. It's interesting you mentioned free cash flow margins, ARR contribution, but you left out operating margins and operating income. Is there a reason why operating income isn't a good indicator?
So the only thing in terms of the operating The problem with the operating margin is that it takes into consideration revenue. So when revenue is a lagging indicator, and if you try to, you're gonna see headwind the quicker the transition takes place. So let's take Q2 as an example. We saw more conversions take place in Q2. We called it out in Q1 in terms of increased pipeline. We didn't see it happen yet in Q1, but we called it out that the pipeline is increasing, and if customers do convert, there will be pressure on revenues and operating margin. But we see that as a good thing. And that's exactly what happened in Q2. Revenue was lower than expected, but we were very happy with the results.
The operating margins are impacted by the revenue, and that's why we looked at ARR contribution margin as kind of the right way to look at things.
Gotcha. And then, you know, just maybe delving a little bit into the recent performances as you're going through the transition. You guys have, you know, clearly outperformed on the, you know, ARR aspect and also the transition per, you know, mix percentage. But, you know, we haven't seen maybe as strong of an uplift on your full year guidance, you know, as your mix or adoption rate, you know, may suggest. So maybe can you square, you know, the new and upsell mix, which is now expected to be 50% versus 35% previously, and I guess, like, maybe a little bit more prudence on the ARR guide? Is that more so caution on your part, and if there's any, you know, other just delta we should, you know, keep in mind?
First of all, we increased our ARR full year guidance by $8 million-
Mm-hmm. Yeah.
- which was, for us, it was more than what we expected to do in Q2. I think we felt very good with the results that we came out with. But our we take the numbers that we give the street very seriously. So we kept the same philosophy where we give out numbers, and we wanna make sure that we can achieve against those numbers. We increased our free cash flow pretty significantly as well. As you mentioned, the SaaS mix went up pretty significantly as well, and we expect 45% in Q3 and expect 50% in Q4. So when we look at where we are today, we're in a much better position today than we were when we just introduced the SaaS offering.
We feel that we're very well positioned for the second part of the year.
Gotcha. Okay. And then just in terms of the transition between phase I, phase II, you know, obviously, we're still, you know, in phase I, but any sense of, you know, what ending are we in through this transition? When should we start, I guess, like, you know, you've mentioned, you know, the one to two years, but given your, you know, strong results of customer adoption, is there any sense of, you know, there, there's pull forward of the timeline, you know, anything in terms of just, like, upside to the transition pace?
So I'd say that the feedback that we've been getting from investors has been that everyone's very surprised that we got to 10% of SaaS out of ARR at the end of Q2. And when you look at kinda completing a transition, we define that, as I said, previously, as being anywhere between 70%-90%, and we just started. In the last earnings call, we talked about the fact that we will revisit the timeline at the end of the year because it is happening quicker.
Yeah.
I can say that overall, we've been very happy with the progression and the adoption and the fact that we're providing more value to customers.
Gotcha. And then just on the timeline for phase II, this seems obviously longer than phase I. Any sort of specific, you know, details to call out, you know, now that you're in phase II, going into your existing customers and transitioning them to SaaS, why does that maybe take longer? Shouldn't existing customers see the value that SaaS brings, and shouldn't that transition be faster?
Well, they see the value, and that's why they're coming to us and asking to convert. But you have to remember that when we sell on-prem subscription, we sell up to three-year deals. So you'd still have customers that bought on-prem subscription, and that they would wait for that three-year to go by in order to convert. We've definitely seen customers that come to us before the three-year period and wanna switch prior, but some of them would just wait, because they have the allocated hardware, and they did that investment, and that's part of the reason that phase II is longer than phase I.
Gotcha. And are you seeing any potentially pushback from existing customers that want to stay on-prem, and how do you address sort of, you know, the, you know, reluctance to go to SaaS, even though, you know, there's a lot of value there?
You know, it's. There's not really any objection per se. It's a, it's a better product, as Guy said, and, it's easier to install, it's easier to maintain. It, you know, the upgrades aren't there, and you get more value more quickly. So there are not really any, like, functional objections that I feel like we need to overcome. We have talked a little bit about some of the feature parity, but as I mentioned, SaaS, in most respects, is ahead of the self-hosted, so.
Mm-hmm. Gotcha. Okay. Okay, and then I guess, like, you know, now that we're four or five years down the line into the transition, 75—you've achieved 75%, 90% SaaS, what does where, where we're almost look like from a financial standpoint, from a go-to-market standpoint, from just, you know, your mission standpoint?
So we laid out during the Investor Day kind of the five-year plan, and we talked about our desire to get to $1 billion of ARR by 2027, which kind of coincides with the five-year transition. We also talked about ARR contribution margin being when we get to 2027 to be 20%. And I think when you look at kind of the leverage that we have in the model as we transition to SaaS, there's a lot of benefits that we can gain, whether it's maintaining only one type of code through the R&D department, and instead of having R&D that is high 20s percentage out of the ARR, it can come down to, let's say, approximately 20%. So there's a lot of leverage coming out of there.
There's leverage in the support and professional service department, and there is leverage in the sales and marketing department selling SaaS, just because of the way you sell SaaS in comparison to on-prem subscription. So I think that as we laid out kind of the framework for this transition, we believe that this company can completely change the offering that we have to provide and the value that we provide the customers through the SaaS offering, and that will allow us to generate more leverage, more free cash flow, and increase our ARR contribution margin.
Gotcha. Yeah, that sounds terrific. You know, seems like the demand is there. And I think to your point, there's existing customers asking you guys for SaaS today. So why not, you know, roll out, I guess, like, you know, phase I, phase II together? Why focus more so phase I first, selling new, and then moving on to the existing? Is it just more so friction in the sales motion, confusion on the customer side? Just why not just, you know, flood doors open, open it up to, you know, existing as well currently?
This has to be a more measured transition because there's costs associated with SaaS. You have to make sure that everything is working properly, you have to make sure that you're providing value to customers the way we have provided value in the past. So this is not a perpetual to on-prem subscription transition that in five quarters, you go from less than 5%, on-prem subscription to 99%. We talked about the fact that this won't be at the same pace, but yet again, we're still very happy that it's happening quicker than we initially anticipated.
Mm-hmm
... as we kinda enter the second part of the year-... we'll see how Q3 and Q4 progress. We've already baked into our guidance an $8 million conversion in Q3 and $10 million conversion in Q4. So that's already a much larger number than we initially anticipated when we started the year, and that's happening in a natural way, which is great. So we're not in phase II yet, but we're seeing it happen in a natural way so far.
Gotcha. Yeah, no, that's terrific to hear, and, you know, we certainly like to see ARR beats and revenue misses. So maybe just moving beyond the, you know, SaaS transition, just on, I guess, like the other pieces of your business, especially federal. Federal seems like a very large opportunity for you guys. What are sort of the hurdles that you need to maybe clear before you start, you know, seeing more federal opportunities come to fruition? I know obviously, there's FedRAMP that you may need to achieve. So any in some, in terms of timeline of achieving FedRAMP and, you know, what the opportunity could look like once you have achieved it.
So let's talk about FedRAMP first. We talked about the fact that in Q3, where it's federal weighted, in terms of the quarter, that's part of the reason that the SaaS mix is coming down, because we expect federal sales to be headwind to the SaaS mix. We're investing a lot of time, money, and resources in order to get FedRAMP, and we hope to be ready for the next next year's cycle. We have a great federal team. We've been investing in order to build the business there. Our federal business, as of now, is mid-single-digit % out of ARR, so there's a lot of room to grow. The offering is there. Federal customers need the product. That's very obvious.
Mm-hmm.
When you look at all the breaches that have taken place in that space. And we need to get to the right people within the organization. We have the right team in place. It just takes time, and that's-
Right.
We'll obviously give updates at the end of this quarter.
Mm-hmm.
-because the end of September is the end of the cycle for the federal budget cycle. So we'll update at the end of this quarter.
Sure. So maybe, to put... I guess, like, you know, frame the federal opportunity, who is serving, I guess, like, that federal space today? Are they using a Varonis, I guess, you know, substitute that, you know, you could go in and look to displace, or is this, you know, net new dollars from the federal budgets that, you know, you would like to, you know, capture?
I think if when we go in and do a risk assessment, with no matter who it is and what area of government it is, we generally see the same issues that we see in other organizations, where there's sensitive data in places that are surprising and far more people have access to it. And if you ask somebody to tell you, "Show me all the sensitive data that Teixeira accessed over the past 90 days," that would be hard. So I think that, there's without us, there are these gaps that are very tough to solve. I mean, and if you look at the Pentagon breach, they did everything right at the perimeter, right?
Mm-hmm.
You know, Teixeira worked in a Sensitive Compartmented Information Facility, a SCIF, which is essentially, you know, a like a trailer that has no RF going out of it, right? You're not bringing any devices in or out, right? It's the most perimeter defense that you can possibly have, but still, what happened? You had far more access to data than probably you should have, and not enough beeped when there was this kind of, you know, excessive access as would be necessary to stop the breach.
Gotcha. No, that makes sense. So there's about three minutes left. Want to poll the audience for any questions, you know, before we wrap up. Otherwise...
Now that you have SaaS products, have you been able to reach new customers that you weren't able to reach before?
The answer is yes. There's been a lot of customers that want to use the SaaS offering, and it opens a whole new avenue, a whole new greenfield opportunity of customers that we couldn't target before, and now through SaaS, we can target them.
Great. And then maybe just a quick check-in on DA Cloud. How does maybe the success so far in SaaS translate over to DA Cloud? Understand that piece is still small, but, you know, what's the traction there, and the expectations going forward?
So we're looking at Varonis SaaS as one big component. We're not breaking out the Varonis SaaS versus DA Cloud. The one thing that we've talked a lot about is that it takes time for new products to kind of gain traction, and we've seen that with the Office 365 and the automation engine. Until kind of the reps feel comfortable selling it, it allows us to go wider and deeper, and it's an offering that we believe can generate a lot of traction with our existing customers and new customers.
Gotcha. Okay, we have about one minute left. You know, would definitely want to, you know, leave some time for David and Guy to maybe make their final, you know, statement to the audience. What, what's the one or two key messages you guys want everyone to take away from, Varonis and what you guys are doing?
I'd say that it's an exciting time. Varonis is going through a transition that allows customers to be better protected, and there's a lot of benefits for us as an organization while we do so. So ARR, free cash flow, and ARR contribution margins are the three KPIs. They're the North Stars through the transition to check the health of the business. We've tried to be very transparent with the amount of information that we provide, so investors and analysts can track through the transition, and that's why we gave kind of the SaaS mix being approximately 10% out of our ARR at the end of Q2. So I think that what I would like to end with is that we are in a very interesting position.
The offering that we have today can provide a lot of value to our customers, and we hope to continue to execute in the quarters ahead.
Yeah. Good. David, any last words, 20 seconds on the shot clock?
What he said.
Perfect. All right, I think, that does it for the session. Thank you guys so much for attending, and enjoy the rest of the conference.