Varonis Systems, Inc. (VRNS) Q1 2020 Earnings Report, Transcript and Summary

Greetings, and welcome to the Varonis Systems, Inc. First Quarter 2020 Earnings Conference Call. [Operator Instructions]. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, James Arestia, Director of Investor Relations. Thank you. You may now begin.

Thank you, Operator. Good afternoon. Thank you for joining us today to review Varonis' first quarter 2020 financial results. With me on the call today are Yaki Faitelson, Chief Executive Officer; Guy Melamed, Chief Financial Officer and Chief Operating Officer. After preliminary remarks, we will open up the call to a question-and-answer session. During this call, we may make statements related to our business that will be considered forward-looking statements under federal securities laws, including projections of future operating results for our second quarter ending June 30, 2020. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned Forward-Looking Statements, and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation for the most directly comparable GAAP financial measures is also available in our first quarter 2020 earnings press release, which can be found at www.varonis.com in the Investor Relations section. Also, please note that an updated investor presentation as well as the webcast of today's call are available on our website in the Investor Relations section. With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Faitelson. Yaki?

Thanks, Jamie, and good afternoon, everyone. Thank you for joining us. I'm happy to speak with you today and discuss our first quarter results and our current operating environment in more detail. First and foremost, I hope that everyone and their loved ones are safe and healthy. COVID-19 has rapidly evolved to a global crisis with a clear human and economic impact, and our thoughts are with everyone who has been affected. Obviously, this earning call is being held under circumstances different from any we have encountered before. I'm very proud of the global Varonis team, which has been both resilient and adaptable and our leadership, which is committed to running the business for the long term. Before we discuss the quarter and current operating environment, I first want to outline some of the measures we have taken over the past 2 months. Our top priority is the safety and welfare of our employees. Our offices have been closed since mid-March, and our colleagues are working remotely. A good number of our employees already operated this way, so the adjustment has been as smooth as a change like this can be. It is the same for interaction with customers and prospects. All meetings are taking place virtually. In many instances, particularly with existing customers, this is nothing new. Our risk assessment will include the 90-minute installation of our software can easily be done virtually. And while we would certainly prefer face-to-face meeting, the power of our findings as well as what we are able to reveal about the threats in today's environment are just as comparing when convey remotely. Lastly, in addition to keeping our people safe and quickly adapting to the new working conditions, we are taking thoughtful and prudent steps to manage the business. Like everyone, we don't know when or exactly how we can expect life to return to normal for what the new normal may look like. As we have always said, we seek to tie our level of investment with the revenues that we achieved. And giving the greater uncertainty we face, we are actively managing expenses across the business. This includes implementing a higher decrease with the exception of key sales positions. In the beginning of April, we reduced employee salaries across the organization, with senior management and the highest compensated employees seeing the largest reduction. The Board of Directors also believe it is appropriate that the cash retainers be reduced. In addition, we have taken further measures to examine all projects and activities and are taking cost savings actions. These were not easy decisions. But I'm inspired by the collective response from our colleagues, which reflects the strength of our culture and the team's commitment to the company. Despite these challenges, business [Technical Difficulty] continue and I'm pleased to announce that after one year, our transition to a subscription company is complete. 98% of our license revenues in the first quarter were from subscriptions. And today, more than 95% of our revenues are recurring compared to less than 40% at the end of 2019 before we formally started the transition. Specific to the first quarter, we had a strong start in January and February and saw a continuation of the momentum we showed throughout 2019. In mid-March, however, as the impact of the pandemic became more pronounced, closing deals became more difficult, which led to the shortfall in our revenues versus guidance we provided in February. This trend was across the board. And it was not specific with certain customer size, vertical or geographies. Given how much the world is changing day-to-day, I think it is most relevant to discuss our current operating environment and why I believe we remain well positioned to capitalize on the substantial market opportunity we see. Let's start with the current environment. As you know, we founded Varonis to help customers protect their sensitive data. And today, this is more critical than ever. We know that crises create optimal condition for cybercrimes. And we protect data and infrastructure against hackers and home employees who wants to take advantage of companies when they are most vulnerable. In addition to these potential threats from mid actors, companies around the world now have the majority of their employees working from vulnerable home network and sometimes even unsecured home computers, accessing critical on-prem data stores and infrastructure through the VPN as well as cloud stores like Office 365 and Teams. Our customers and prospects understand elevated risk associated with so many employees working remotely, which is driving strong interest in our unique capabilities around threat detection and protecting data and infrastructure. Simply put, we believe our platform is a must have in this new environment, providing unparalleled data protection, alerting and investigation capabilities. Security is one of the most dispensable areas of technology spend and our solution that help mitigate the threat of a breach or even a total shutdown are one of the most important part of the security stack, and we are encouraged by what we see in our pipeline. First, our sales reps have conducted an unprecedented number of remote risk assessment and evaluation over the last few weeks. As organizations are eager to improve visibility into a remote worker access, we have also seen a significant increase in traffic to our website, driven primarily by organic search as well as tremendous uptick in the use of our platform by existing customers. At the same time, we have had a record number of participants in our webinars and other online activities. And lastly, our system engineers as well as our forensics and incident response teams, which help customers protect their data and investigate alerts and potential threats to their data and infrastructure has never been busier. Our ability to help organization address challenges with remote work, as prospects and customers more attentive than they have ever been. While it is hard to predict the timing of when this increased pipeline will be monetized given the near term disruption, we are cautiously optimistic and believe that the demand for our solution remained as strong as ever. Before I turn the call over to Guy, I want to talk about the enormous opportunity we have in front of us and how it has been further accelerated by the subscription position that has made it easier for customers to consume more of our platform and be better protected. We continue to see new customers by an average between 4 to 5 licenses in the initial deal compared to 2 or 3 licenses under the perpetual model. Equally important, the number of license in upsell is increasing as our existing customers continue to buy more adoption of the greater number of licenses, driving much better outcome for our customers. And the growth in this number over the course of 2019 and Q1 is further evidence of the value of consuming Varonis as a platform play. Even with this meaningful increase in adoption rates, we remain significantly underpenetrated within our customer base, which represents a significantly go forward opportunity for the company. Given that we have completed our subscription model transition, our risk assessment can be done virtually and because all our license are under a common code base. It is now both frictionless than ever for customers who have licenses, we closely analyze the risk exposure and license usage for all of our customers, and we see a path for each of them to materially increase the number of license they purchase to get optimal protection from our platform. We started Varonis to help customers solve some of their largest data protection programs. And these problems have only intensified this COVID-19. We know that this pandemic has made life challenging for everyone for both our customers and our employees by the past few weeks and months, a reminder that we are all in this together. Empowered of the dedication of our employees, particularly their willingness to go above and beyond for our customers in this unprecedented time. With the value we continue to provide our customers and the trust they place in us, I'm fully confident that we can emerge from this stronger than ever. With that, let me turn the call over to Guy. Guy?

Thanks, Yaki. Good afternoon, everyone. I want to thank you all for joining today and echo Yaki's opening comments that I hope everyone is safe and well. I plan to spend the majority of the prepared remarks today discussing how we are managing the business during this turbulent time. After that, I'll recap our first quarter results and discuss our financial guidance for the second quarter before we open for Q&A. It's clearly a different world from when we spoke with you 12 weeks ago and outlined our expectations for 2020. Our view for the last couple of years, which was reiterated in the earnings call in February, was that growth and profitability are equally important to us. The balance of those 2 pillars was at the forefront of any strategic decision we made as a company. And although we expect to ultimately return to that philosophy, simply put things have changed for now, and I want to provide a bit more color on how we think about the business. Let's start with revenue. On that side, 3 components drive the business: One, lending new customers. Two, expanding with existing customers. And three, recurring revenues, which this year includes subscription renewals in addition to maintenance on perpetual licenses. On the first point, while the pipeline from new customers is healthy, at the end of Q1, we saw it become more challenging to monetize, and we expect that to continue in the near term, which is reflected in our Q2 guidance. As mentioned earlier, we continue to see new customers adopt 4 to 5 licenses on average as we did throughout 2019. On the expanding side, the level of engagement we have seen over the past month from our existing customers is unprecedented. As you know, we have a land and expand model. And to give you a sense of the opportunity with our installed base, here are a few data points. As of March 31, 55% of our customers with 500 employees or more had purchased 4 or more licenses compared to 45% a year ago and 21% purchased 6 or more licenses compared to 14% a year ago. The strong growth in these metrics confirms how we are unleashing the potential of the platform in addition to demonstrating the remaining opportunity we have within our base. Please keep in mind that this is different than the product family numbers we reported regularly. And instead, focusing on the number of individual licenses out of the 26 licenses we currently have to offer our customers. And finally, the recurring portion of our revenue base, which has significantly increased as a result of the completion of our subscription transition allows us to move through this time of uncertainty from a much stronger position than even a year ago. ARR at the end of Q1 grew 59%, and renewal rates of maintenance of perpetual licenses continue to be above 90% and remain healthy. And to provide additional color this quarter, our dollar-based net retention rate, which is calculated based on using a denominator of ARR from all subscription customers as of the same prior year period and the numerator of that same set of subscription customers as of the end of the current period is more than 105% and higher still when looking at the important subset of our enterprise customers. Taken together, our recurring revenues have more than doubled over the last 5 quarters to more than 95% in Q1 2020. To say that these results exceeded even our most aggressive hopes, when we initiated this transition in 2019, is a huge understatement. Given the near-term change in our expectations regarding top line growth, we have acted quickly and thoughtfully in the last several weeks, with a greater focus on the bottom line. Doing so will allow us to continue to operate efficiently at lower expense levels, while strategically positioning us to quickly reaccelerate growth when the time comes. Yaki discussed some of the measures we have implemented as part of our expense reduction across the board, which include opportunistic hiring, salary reduction and challenging our teams to innovate and be as effective as possible given current operating constraints. We believe that successfully navigating a dynamic environment requires decisiveness and adaptability, the same skills that were critical in taking this business from a subscription mix of 7% to 98% in just 5 quarters. I'll now turn to our results. Total revenues for Q1 were $54.2 million. First quarter license revenues were $20.8 million, which included $20.4 million of subscription revenues or a 98% subscription mix. Maintenance and services revenues were in line with our expectations at $33.4 million. Looking at the business geographically, North America revenues were $37.9 million or 70% of total revenues. In EMEA, revenues were $14.6 million, representing 27% of total revenues. Rest of world revenues were $1.7 million or 3% of total revenues. Turning back to the income statement, I'd like to point out that I'll be discussing non-GAAP results going forward. Gross profit for the first quarter was $45 million, representing a gross margin of 83.2% compared to 86.5% in the first quarter of 2019. This reflects the impact from the coronavirus as well as higher mix of subscriptions revenue. Operating expenses in the first quarter totaled $62.5 million. As a result, our operating loss was $17.4 million or an operating margin of negative 32.2% for the first quarter compared to an operating loss of $11.1 million or an operating margin of negative 19.8% in the same period last year. I'd also like to point out that despite the shortfall in revenues, our first quarter operating loss came in just below the low end of our guidance. This is a result of our generally lean operations, moderately lower expenses due to COVID-19 and our disciplined and proactive approach to operating in this new environment that we discussed above. During the quarter, we had financial income of approximately $214,000, primarily due to interest income. Our net loss was $17.4 million for the first quarter of 2020 or a loss of $0.56 per basic and diluted share compared to a net loss of $11.1 million or a loss of $0.37 per basic and diluted share for the first quarter of 2019. This is based on 30.9 million basic and diluted shares outstanding for Q1 2020 and 29.8 million basic and diluted shares outstanding for Q1 2019. We ended the quarter with $126.3 million in cash, cash equivalents, marketable securities and short term deposits, which despite the impact of the transition last year, are at healthy levels. The strength of our balance sheet provides meaningful support in the current business environment. Through the quarter, we generated $3.9 million of cash from operations compared to generating $14.1 million of cash from operations in the same period last year. As a reminder, we are collecting on annual contract value amounts under subscription, and therefore, we continue to see a short-term impact on cash flows. However, once we begin to see a subscription renewal contract ramp, which have a lower cost, we expect to generate significantly more cash from operations. We ended the quarter with 1,605 employees, an 11% increase from the first quarter of 2019. As already mentioned, we expect headcount to remain approximately constant or to decrease slightly in the near term. Moving to our guidance for the second quarter. We expect total revenues of $56 million to $58 million. We expect our non-GAAP operating loss to range between negative $11 million to negative $10 million and non-GAAP net loss per basic and diluted share in the range of $0.36 to $0.34. This assumes a tax provision of $400,000 to $600,000 and 31.5 million basic and diluted shares outstanding. The low end of our Q2 revenue range assumes that the government-mandated or recommended shelter-in-place orders currently in effect will remain in place for the remainder of the quarter. Here are some additional points to consider. First, while the front-loaded revenue recognition aspects of our business is a current headwind, it should also allow us to rebound more rapidly compared to ratable revenue recognition model. Second, please keep in mind that the Q2 2019 subscription mix was 56% and the higher subscription mix we anticipate this year will result in a headwind to revenue. Third, we expect that CapEx in 2020 will be slightly lower than what we provided in the last earnings call in the range of $8 million to $12 million as part of the measures we discussed above. And lastly, we handle foreign exchange rate by entering into hedging contracts. And while 2020 is already fully locked, we took advantage of the currency volatility and locked in our hedging for most of 2021 at more favorable rates. In summary, we have not shied away from challenges in the past, and this time is no different. The company is thoughtfully, decisively and actively responding to the near term volatility, which will not only allow us to weather the storm, but will also prepare us to reaccelerate growth when the time comes. Thanks for joining us today, and we hope you and your loved ones remain safe and healthy. With that, we will be happy to take questions. Operator?

[Operator Instructions]. Our first question comes from the line of Brent Thill with Jefferies.

I was just curious if you could give us a view of what is happening in April? And are you seeing things stabilize from demand at the end of March? And then just secondarily, if you could just comment on the renewals from last year as you entered your first big renewal cycle in the new model.

Thanks for the question. So we had a very solid April, and we saw completely different purchasing patterns than we saw in March. So the way that -- what happened to us is that in the last 2 weeks of March, we saw a tremendous uptick in pipeline, but customers were slow to buy because they were trying to set up working remotely, getting more VPN capacity and configure applications in the cloud that they can work but they needed our software. We saw a lot of usage of this software. And as I said, massive amount of -- of massive amount of pipeline. After the -- adding the capacity of the VPN and they have the cloud environment. They had what we call it just this acute stationary risk. People accessing these VPNs from unsecured network, sometimes compromised machines, completely different access patterns. The cloud is great with 365 and Azure, but with a rush to configure these application and workloads, introduced a tremendous amount of risk. And this environment is just heaven for cybercrime. So after these 2 weeks, we started to enter April, we keep seeing this record in pipeline but our customers started to buy and just bought more and more as the months progressed. And as I said, we had a very solid April. And overall, we saw a very healthy and strong renewal rates.

So just to add on that, I want to give some color and data points on what Yaki just said. When you look at the shelter-in-place, it really couldn't have started at a worse time for us. Because similar to other enterprise software companies, we're a back-end loaded. And around March 15, everyone kind of switched to work-from-home, which caused disruptions. And as a result, we didn't see the typical quarter end purchasing patterns but at the same time, as Yaki said, there was a huge disconnect because our pipeline was significantly increasing. And then April came, customers started signing POS. We closed some of the March slip deals, and business was up for the month, which, when you think of that, it was despite the material headwind from the subscription transition. So we're encouraged by the month. But remember, April is still a small part of the quarter. But overall, we're optimistic. In terms of the renewal rates, we provided this quarter kind of for the first time NRR. And we wanted to provide a sense of the expansion within our base. And this is kind of a theme we've been discussing for a long time. So we wanted to give as much information about the business as possible, given kind of the operating environment. And we mentioned that NRR was greater than 105%. And while this is a small sample, we're pleased with what we're seeing.

Our next question comes from the line of Matt Hedberg with RBC Capital Markets.

Given the higher levels of work-from-home, I imagine your supportive collaboration products like Microsoft Teams, in particular, is super relevant these days. Can you talk a little bit about how that might be a demand driver for you guys? I guess that product in particular, it seems like it's the right product at the right time, the right support of the right product.

Matt, yes, Teams is massive for us. So it's a product that pushes collaboration. But essentially, it walks like a client on top of a OneDrive and SharePoint online. So it's very hard to manage permissions. You are overexposed, there are a lot of critical data. But not only -- so everything in 365. So SharePoint Online, Exchange, OneDrive and Teams are huge for us, and Teams really it's opening up critical data right and left. But the other thing that works very well is everything that's related to Azure. So what you see is that there are many workloads, and a lot of these machines are connected to the on-prem and to the on-prem domain. And you have this RDP open for the world. And you see a lot of attacks from there that's going from the cloud to the on-premises. So everything that's going with 365, Teams is a huge driver and also the workloads in Azure are very strong demand drivers for Varonis. We've just seen more demand for our cloud support than ever, and we just feel that we are even more relevant in the cloud than on-Prem data.

That's great. And then maybe just kind of along the same line of question, but taking a step back, looking high level, I have to imagine, obviously, COVID is a terrible situation, but out of this, I have to imagine CIOs executives, board members, et cetera, all have a new importance on data governance, in particular. Have you seen -- and it seems like you've had record virtual meetings. But have you seen a lot of like net new inbound from folks that maybe you never even thought would call, but it just seems like it's -- your product overall is well suited for this environment?

The product overall in these three use cases is working extremely well. And what we see is that just massive increase in traffic to the website, primarily from organic search. So this is something that people understand. I think what is happening every time in this kind of environment, people are looking at the overall security and data protection, processes and technologies that they have and they're thinking, what we really need to do in order to be protected. Because if you look at it, there are record amount of ransomware and attacks. This is heaven for cybercrime. Everybody are very nervous in online. Clicking on things, they shouldn't click. There are a lot of configurations that people are doing very fast. New technologies that they need to adapt and we are extremely relevant in this environment. So everything that we see is this data on-prem and in the cloud, regulation with very sharp teeth and a lot of very sophisticated cybercrime that it's very easy for them to bypass traditional security, and then you need very advanced analytics in order to be protected. This is something that we really benefit from. So we just see it will be in the short term, it will hard to know how long it will take us to monetize this pipeline, but we see a record of pipeline and also, we see tremendous uptick in the usability of the product. And the other thing that we see clearly is that customers with many licenses get a lot of automation and a lot of benefits and they're really realizing it. So for us, it's -- in the short term, we don't know how long it will take to monetize it. But so far, we had a very positive April. And you also see that it's -- every deal has a lot of scrutiny, but are champions the people that -- using Varonis, they take it through the approval process, and we see that many times, even with a lot of scrutiny, they know how to justify it and when the customer is online.

Our next question comes from the line of Saket Kalia with Barclays.

Yaki, maybe first for you. You talked a little bit about how the pipeline was building here, particularly with so many risk assessments done, could you just maybe shed a little bit more light on what products you're seeing particular interest in? And maybe just broad brushes, what percentage of the time does a risk assessment actually ultimately result in driving business?

Okay. Saket, so first, it's very important to understand that in Varonis, what we count as pipeline is always risk assessment. Most of our deals coming through risk assessment through these POCs. Thankfully, all the products are working, but we definitely see a big uptick in everything related to 365 and Edge. So Edge is supporting the Edge streams, which is VPN, proxy and DNS, and extremely critical from working remotely from everything that related to the kill chain in terms of how you access remotely, are you doing reconnaissance, infection, and exfiltration of data and everything that related to 365 and protecting data and accessing everything else that Varonis is doing. And it just -- it depends on the teams, but a lot of our veteran teams closing very high percentage of these risk assessments. But as I said, in the short term, in this COVID crisis, I don't know how this -- how we are going to monetize it in the short term. But I can tell you that this is a record amount of POCs and customers are using it. And also in the 3 use cases in data protection, privacy and compliance and threat detection and response, they are looking for quality and a lot of automation, and this is something we are doing. They understand that they don't have visibility. Everybody experienced just a lot of attacks. There is a lot of configuration and data small data is all over the place. And we just see that not only they are testing it, they just -- they are using the product extensively, and there is a lot of appetite to expand.

Got it. That makes sense. Guy, maybe for my follow-up for you. Listen, the 98% mix was great to see. I guess the question is, could that number perhaps ebb and flow in the future as the perpetual business perhaps returns or maybe not? Or do you sort of expect this to stay in this range going forward? If I could sneak in a housekeeping question as well, Guy, just because I'm getting it from some investors. Can you also just talk about what the customer count was this quarter? And how you're thinking about disclosing that metric going forward?

Sure, Saket. So I'll start from your second question on the customer account. We have more customers now than we did at the end of 2019. And while attrition is not an issue, as we mentioned last quarter, we're no longer disclosing the new customer adds, simply because it's not helpful in judging kind of the progress against our strategy of engaging large enterprises. So that's in relation to that. In terms of the subscription mix, coming in at 98% in Q1 was a great number for us. We guided at the beginning of the year for 90 plus percent. We said at the beginning of the year that we won't change kind of the guidance from quarter-to-quarter. So we're leaving that at 90 plus percent. But kind of as you can see, the perpetual license is really becoming insignificant for us, and that's how we plan for it to continue.

Our next question comes from the line of Melissa Gorham Franchi with Morgan Stanley.

Good to hear from everyone. Yaki, you said April was a pretty solid month, and you did say that there were some deals that slipped from March. But for the deals that weren't just slipped deals, did you see any sort of emergency spending as enterprises were looking to shore up maybe their threat detection capabilities to secure remote workers? Or was this healthy activity in April really just projects that were kind of already in the pipe and budgeted for?

First, it's important to remember that April is still a small sample, but it was both. It was both, but a lot of projects that were budgeted, they added to -- they decided to add 365 or the dls capabilities, some Edge. So definitely, the risks that come from working from home with this increased VPN capacity and a lot of traffic in 365 with all the applications and workload in Azure, they just want to make sure that they are protected. So it's just -- it's everything.

And Melissa, I just want to add on that. When you look at April, one thing to remember is that even with a significantly higher subscription mix, kind of going from approximately 30% subscription mix in April 2019 to really close to 100% in April 2020, we still saw year-over-year growth in license sales. So just like Yaki said, it's still a small sample. It's still a small number for the quarter, but we're very pleased, particularly in this environment.

Okay. Great. And then a follow-up for you, Guy. You mentioned that there was going to be a hiring freeze in place. I'm just wondering if that is just contingent on the shelter-in-place requirements happening and if we shouldn't return to normal at the end of the year, second half of the year, is that hiring freeze potentially, would that potentially be lifted?

So in the prepared remarks, we talked about opportunistically hiring, and we're thinking of hiring quota-carrying reps because we want to be ready to reaccelerate growth when the time is right. And we've always tried to kind of tie our level of expenses to the level of revenue that we expect to achieve. So we kind of -- we're very focused on the top line, but we're also focusing on the bottom line, but ready to reaccelerate when the time is right.

Our next question comes from the line of Alex Henderson with Needham & Company.

This is Roger Boyd on for Alex. I was wondering, you made some very nice comments on risk assessment activity and remote upsell of the platform to existing customers. Can you talk a little bit about your shelter-in-place and your ability to close and implement new business remotely?

Yes. For us, most of the risk assessment is being done remotely. So this is nothing new. So now it's a -- this is in terms that -- this is business as usual for us to install on-prems or in the cloud, in Azure, AWS. So this is really how we run our risk assessment, and it doesn't change anything. And so far, we prefer many times to meet customers face-to-face, but so far, we also find that the remote meetings are also very effective. So for us, by and large, it's business as usual.

Okay, great. And then quickly, looking at EMEA. I'm just wondering what the effects of the current macro environment were in that geography. It seemed like they were kind of delayed in their adoption of subscription. I'm wondering if that's just continue to show that headwind or more effects of COVID or anything worth calling out in Europe?

As Guy said, we are close to 100% subscription, and it's also happening in EMEA. We are now a subscription business. This is how we sell and the EMEA teams are adopting it. And so far, in April, we also saw very good results in EMEA.

Our next question comes from the line of Gur Talpaz with Stifel.

Okay, great. Yaki, you mentioned the notion of frictionless deployment in upsell in the prepared remarks. I was hoping you could expand a bit on that. I mean, what are you seeing in terms of your ability, not just to deploy initial failure but to actually upsell in this environment?

No, we see that -- we just see that one -- so on everything that we are doing, the customers want to have everything. So just think about the enrichment that we are giving with our alerts. You want to understand what is critical data and you want to understand if they're coming from VPN, how they are surfing the Internet after and if they want to download a payload. So we see attacks coming from on-prem to the cloud, from the cloud to the on-prem, same with data protection and compliance. You have files on file shares and NAS devices, but the same content is on your OneDrive and SharePoint Online and in your inbox. So we just see that in order to make sure that you want to have one standard. So to be protected and to have very good detections and to be in compliance, you need to be on all the platforms. So for us with the subscription, it's much easier to sell the platform, and we just see -- we think that over time, we believe that we are going to have tremendous results with the overall customer lifetime value. So we can say that we have all the evidence that this is the full-blown platform play now, and customers are buying, and they have a clear path how they are going to buy more and more. It also makes sense to spend much more time with our customers, just the conversation. They are much more attentive. The solution becoming just more strategic, and we have very good ability to demonstrate what we call automated value. So without a lot of effort, bring a lot of value to key data protection and cybersecurity initiatives for our customers.

That's helpful. And Guy, given the mix of business and where we're at today, have you contemplated a pathway for legacy license customers to migrate to subscriptions and have you thought about what that migration might look like over the next few quarters or years?

So if you're talking about existing customers buying kind of additional licenses, they're doing that already as part of the subscription transition. We don't go back to our existing customers and try and convert their legacy license to subscription. What we simply do is offer them the additional licenses, and they just continue to buy. And one of the KPIs that we introduced this quarter is the number of customers, 500 users and above,that have 4 or more licenses and 6 or more licenses and the numbers have increased really nicely over the last year. On the 4 plus licenses, it went from 45% in Q1 2019 to 55% this quarter and on the 6 plus licenses, 6 licenses or more, it went from 14% to 21%. And that's really a nice increase that shows how customers are utilizing and really unleashing the potential of the platform, but it's also showing how much more we can sell within our existing customer base.

Our next question comes from the line of Shaul Eyal with Oppenheimer.

I hope everybody is fine. Yaki, ASP trends, solid, any unusual discounting worthy of note? Or steady as we go?

No. At this point, no. We see a lot of scrutiny for deals, but they're getting up and within the organization many times, we win. And when we win, we feel that customers are realizing the value. So obviously, on the day-to-day, you feel the COVID, but there is nothing special that we need to report.

Shaul, just one thing to note. And at the beginning of 2019, we introduced a concept from a commission perspective where the reps could make significantly more towards the quarter retirement if they sell at better discounts, but they get penalized if the discount is higher. And that's definitely helping in having the reps do the right thing, both for them and for the company. So just to give that color.

Got it. Got it. Fair enough. And while, Guy, maybe on foreign exchange. So for this quarter, you actually -- did you have a little bit of a gain or probably a little bit of a headwind, given some of the really swings that we have seen, some in the second, third week of March, specifically the U.S. dollar versus the shekel. And I think -- were you able to lock down some of those recent weak rate for the second half of the year?

So the answer is yes. We locked, and that was part of the prepared remarks, we were able to take advantage of some of those spikes in currency and the volatility that was taking place there. But we actually locked 2021. Our 2020 foreign exchange, our hedging was already closed when we kind of entered the year, and it was part of our guidance already in the first place. So the volatility helped us in some favorable rates for 2021.

Our next question comes from the line of Chad Bennett with Craig-Hallum.

So Guy, just going back to the NRR percentage, just to make sure we're clear on it. The 105%, that's a combination of both maintenance and subscription recurring on a dollar basis?

So first of all, it's higher than 105%, but let me start by the definition. The definition is that we use the denominator of ARR from all subscription customers as of the same prior year period and a numerator of that same set of subscription customers as of the end of the current period. So this number doesn't include maintenance of perpetual. So this is purely a metric that tries to show kind of the expansion within our base of selling subscription.

So I'm just curious, when we've highlighted over the last year, the penetration and attach rate of different product families, and you introduced, obviously, another metric today. I guess I would have thought that percentage would be a heck of a lot higher than 105%.

So one thing you need to remember, Chad, is that the NRR number, as it is right now, is a very small sample. It only includes really one full quarter of rolling this globally, which was Q1 2019 and part of the pilot that we did in the second part of 2018. And while it's a small sample, we're pleased with what we're seeing.

Follow-up. Just in terms of the weakness you saw in the last couple of weeks of March. I think you mentioned it was a combination of slip deals. I guess, what was the other piece of that equation? Were there customers, whether it was net new or existing that are just pulling back spend in general and that hurt you also?

Like I said before, I think the problem that we had with kind of the last 2 weeks of March, was really had to do with kind of the shelter-in-place coming at really the worst time for us. This -- the end of Q1 wasn't a typical quarter end purchasing pattern for us, it was -- there was a disconnect between the pipeline that we saw that was growing and really the purchasing patterns. But as we discussed before, in April, we started seeing things come back and customers started signing, and we saw some of the slip deals close.

The customer was scrambling just to make sure that they are set up to work remotely. And at the same time, this came out into this tremendous amount of risk. And as they -- as we got deeper and deeper into April, we brought more -- to keep some of these projects that were set up by April, some customers just rushed to buy because they needed to be protected. It was all kinds of purchasing pattern.

Our next question comes from the line of Jason Ader with William Blair.

Guys, work-from-home clearly creates a lot of compliance holes. But with organizations in crisis mood, do you think we could see some of these companies push compliance down the priority list in the short-term unit, even if they view it in the long-term is a more strategic priority?

It's hard to tell now, but a lot of what we are doing is around the cybersecurity and data protection. So compliance is -- compliance sometimes what it does, it just highlight the risk that you have and you need to mitigate. What's happening in this environment is that there are so many cybercrimes. You have hackers, you have a lot of APTs and malware. I think that you can see that the tremendous uptick in ransomware. And another thing that you see is many rogue employees. People are afraid that they will get fire, so they are going and accessing data that they shouldn't and doing things that are sometimes doesn't make sense with the organization's data. So everything is driving demand. And still, if you have a data that belongs to your employees, to your business partners, to your customers, you need to protect it in order to be in business. So we don't think that postponing any compliance with regulation will be -- will soften our demand because the merit behind it, the reason that customers are doing it is more evident than any other time.

Okay, great. And the sales cycles at this point, do you -- Guy, as you contemplate guidance, did you assume a longer sales cycle? Or just maybe a little bit more background on how you came up with the forecast this quarter because obviously, you have a good pipeline.

So yes, when we took into consideration and building the guidance, we did take into consideration the higher scrutiny that's taken place with every deal, and slower sales cycle. We didn't see anything in Q1. But obviously, there were some of the deals that we -- that moved to Q2. So we're closely monitoring it, and we did take that into consideration in our Q2 guide.

Our next question comes from the line of Erik Suppiger with JMP Securities.

How has COVID-19 affected your ability to work with channel partners? Has it made much of a difference there?

No. I think that most of our partners can -- we work remotely, doing the meetings remotely. We're doing the installations remotely. So there is no change there.

Our next question comes from the line of Mark Schappel with Benchmark.

Most of my questions have been answered. Just one, Yaki, what do we expect on the product development front this year as far as new releasing?

We are not talking about within the capacity of the call, but we are constantly innovating. And thematically, we just want to make sure that we're bringing more automation, have coverage of more -- of coverage of more platforms and reducing friction with the ability to provide value to our customers. This is very interesting environment for us that we see that now there is almost just direct correlation with the value that we bring to customers and the time we spend with them and their ability to buy more and more and expand with us the new streams to the cloud, to classify all the data to do all the compliance reporting. So regarding what we are doing is just to make sure that they can realize more value with that.

Our next question comes from the line of Daniel Ives with Wedbush Securities.

Yes. So in this environment, I mean, maybe just talk about going after existing customers. And just in terms of -- from a license perspective, from 4 to 6, 6 to 8 versus new logos? I mean obviously, so much more challenging new logos, disburtions in the raw base. Can you just talk about that just tactically?

Yes. Both are a priority for us but there are several things that happened. One, everything we are doing in the last two years became significantly more relevant in the next 2, 3 years. Then we changed the subscription. So we give a path to our customers really to consume significantly more -- significantly more licenses. We also built a very strong and deep customer success practices to make sure that customers can realize value, we call it value PBRs every 3 months to understand where the customer is, to map all the organization, make sure that we provide value to all the stakeholders. So it's everything, but we have this big install base that is underpenetrated, that means that we will protect it in the cloud, and we need to make sure that we are protecting them from APTs and cybercrime. So it's make a lot of sense to spend time with the base and take them to 6, 10, 15 licenses. But at the same time, it's also very important for us to bring new customers, but we want it to be the right customers. Thousand and above employees with good structures that in terms of the overall customer lifetime value, make a lot of sense for us to spend time with them. So these are -- both strategies are working very well for us, but it needs to be the right customer, and we are aiming for very high customer lifetime value.

Okay. And just a quick follow-up. So just from like a day-to-day, as a management team in this untrusted environment. I mean do you find the sort of roll up the sleeves, walking customers through in June calls is just accelerating. Like can you maybe just talk about from your perspective in terms of this environment, like just day-to-day, when it comes to customers getting over the goal line, especially when you can't do in person meetings?

Yes, I think that it's all come to delivering value to our customers. Our first priority is to make sure the team and everybody is safe, but then it's all about giving value to the customers and making sure they understand what we do. And then once they buy it, to make them very successful. So this is what we are doing. And so far, we're doing it remotely, and it's working very well.

And Dan, we got some very nice notes from customers during the crisis, during the shelter-in-place time, where customers said that they've been 20 years in IT, and they've never seen a supplier walking so closely and helping. And we're really trying to help as much as we can.

Our next question comes from the line of Rishi Jaluria with D.A. Davidson.

Two quick ones here. First, I wanted to maybe touch on the dialing back of investments and the hiring freeze. Maybe you can help us better understand why you're making that decision, given you're well capitalized. There's a big opportunity ahead. I think kind of general thinking is once offices start to open and things start to return little bit to normal, you should be able to bounce back quickly. So why not keep a foot on the accelerator at the very least in product on the R&D side? And then just as a quick follow-up. Wondering if you're seeing any changes in behavior from customers, be it looking for extending payment terms or restructuring our contracts?

In terms of the hiring, as Guy said, on a case-by-case basis, we hire, we have good capacity within the company. But this is a business partisan, management philosophy, you always need to make sure that your expenses are tied to your revenues. And we just -- there are some unknowns here, and it's -- we just want to see what's going on. So -- and we just want to see that we understand what's going on, that we have the right productivity gains. Once we have more clarity, we are going to expand. And we believe that in the short-term that we are going to do it, it's not going to harm anything, not investment in the products or the productivity gains and our ability to take market share or develop new products. But we just want to really understand how the top line is going to work and how this COVID situation is going to play out. I think that there is just a lot of unknown. And we have very good and strong capacity within the company. And we feel that this is the right decision. In places that we feel that we need to hire, we are going to hire. We're just going to be very prudent.

In terms of your second question, really, the partnership with our customers is really at the forefront for us. But there's also a need to balance with running the business. So I think we're doing a good job of trying to work with customers when needed without impacting the business and keeping the partnership the right way.

There are no further questions in the queue. I'd like to hand the call back to James Arestia for closing remarks.

So thank you all for your interest today. We hope everyone stays safe and well, and we look forward to speaking with you soon. Have a good night.

Ladies and gentlemen, this does conclude today's teleconference. Thank you for your participation. You may disconnect your lines at this time, and have a wonderful day.