Varonis Systems, Inc. (VRNS) Q3 2020 Earnings Report, Transcript and Summary

Greetings. Welcome to Varonis Systems' Third Quarter 2020 Earnings Call. At this time, all participants are in a listen-only mode. A question-and-answer session will follow the formal presentation. [Operator Instructions]. Please note this conference is being recorded. I will now turn the conference over to your host, James Arestia, Director of Investor Relations. Thank you. You may begin.

Thank you, operator. Good afternoon. Thank you for joining us today to review Varonis' third quarter 2020 financial results. With me on the call today are Yaki Faitelson, Chief Executive Officer; and Guy Melamed, Chief Financial Officer and Chief Operating Officer. After preliminary remarks, we will open the call to a question-and-answer session. During this call, we may make statements related to our business that would be considered forward-looking statements under federal securities laws, including projections of future operating results for our fourth quarter ending December 31, 2020. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned Forward-Looking Statements and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call, which excludes, stock-based compensation and associated payroll tax, FX gains and losses and the amortization of debt discount and issuance costs related to our convertible notes issuance in May. A reconciliation for the most directly comparable GAAP financial measures is also available in our third quarter 2020 earnings press release, which can be found at www.varonis.com in the Investor Relations section. Also, please note that an updated investor presentation, as well as a webcast of today's call are available on our website in the Investor Relations section. With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Faitelson. Yaki?

Thanks, Jamie, and good afternoon, everyone. Thank you for joining us to discuss our third quarter 2020 results. We're extremely pleased with our results and I want to give you an update on our business in the current operating environment, and talk about how we expect the market trends we are seeing to continue to benefit Varonis over time. I'm also excited to announce our agreement to acquire Polyrize and explain how it will expand the Varonis Data Security Platform to cover additional cloud applications and infrastructure. Finally, I will turn the call over to Guy to discuss our third quarter financial results in more detail. The team continues to execute well in this virtual environment. With significant customer engagement and inbound interest, companies understand that the elevated risk they face in a work-from-home world are here to stay. Sensitive and regulated data is more exposed than ever before. Remote employees use unsecure computers to access critical data in Teams, Office 365 and on-prem for VPN. Companies face an ever increasing number of advanced persistent threats from external bad actors and hackers who seek vulnerable targets. At the same time, insider threats are growing as our customer report a higher number of alerts warning from employees accessing sensitive data in abnormal ways. Our ability to address this risk is unmatched and our platform continue to resonate with new customers who are buying more licenses in their initial purchase and with existing customers who consume more licenses over time. We all understand that a data-centric approach to security is critical. And as a result, we continue to take greater share of the available security spend. The path to double-digit license per customer has never been clearer. And I want to highlight three important wins in Q3 that demonstrate the enormous opportunity in front of us. One example of a large initial commitment by a new customer is a U.S. hospital that purchased 10 licenses in their initial deal. Doing the onset of COVID, they experienced a huge increase in targeted phishing attack and our assessments successfully demonstrated our ability to address the risks inherent in the hybrid environment: The Varonis deployment, including DatAdvantage and Data Classification for multiple on-prem and cloud platforms, as well as DatAlert. We are also pleased with the performance of our federal business this quarter. For example, a government agency with thousands of users became a Varonis customer, after they discovered sensitive PII can be open to every employee for months, a material vulnerability. This was a key driver in the purchase of subscription for 12 licenses they are deploying enterprise-wide to identify PII. Remediate overexposed permissions and stop exfiltration of sensitive data across on-prem data centers and Office 365. In most instances, these new customers were able to quickly realize the value for our platform, which results in greater lifetime values through healthy renewals and future license upsells and cross-sell. We also know that we remain significantly underpenetrated within the existing customer base. And the team is just -- is focused on closing expansion opportunities with those customers so they see even more value from our platform. A good example of this in Q3 was a large technology company that initially purchased four licenses in December of 2019 to protect their own-prem data stores. They had a multiyear plan to move to Office 365 but this was accelerated due to COVID during the risk assessment, DatAlert also caught a brute force attack, which was resolved by our incidence response team. Knowing Varonis would meet their needs, they purchased subscription for seven additional licenses and they now have a total of 11 licenses to protect their data and alert them on threats in Office 365. All of these examples illustrate the strong adoption and customer engagement trends that combined with healthy pipeline leave us well-positioned for strong close to 2020 and beyond. We know that our continued innovation will further differentiate our platform. And we are very excited about the acquisition of Polyrize. Polyrize is our first acquisition. And we believe that their technology, which fits nicely in our strategy, to follow the data to accelerate product development and reduce time to market in the cloud application they support. Their software maps and analyze the relationship between users and data in number of cloud data stores, including Google Suite, Salesforce, Okta, GitHub, Slack, Amazon S3 and others. We plan to incorporate these capabilities into our platform, thereby allowing us to introduce new licenses, which in turn will expand our addressable market. We've seen tremendous momentum with Office 365 in Azure, and we believe expanding to other data stores in the cloud, addresses a growing pain point for customers allowing us to offer a more unified view of the organization's security posture. Polyrize is based in Israel, and we are happy to have them join the Varonis family. As we said last quarter, we believe that the current environment has cemented the need for our platform. We know that continued innovation and executions are critical. And this is where we are focused as we close 2020 and capitalize on the long-term opportunity in front of us. With that, let me turn the call over to Guy. Guy?

Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. I hope you and your families are safe and healthy. We had a strong third quarter, the subscription transition is finished. And our results demonstrate that the demand for our platform combined with the power of the subscription model is accelerating revenue growth and driving operating leverage. With that, let's discuss the quarter. To remind you, our focus as we manage the business is threefold. First, landing new enterprise customers; second, expanding with existing customers; and finally, strong renewals of both subscription and maintenance of perpetual licenses. On the new customer front, we continue to see the average number of licenses on the initial purchase be more than 5 compared to the 2 to 3 licenses customers thought under the perpetual model. This trend is resulting in greater lifetime value through healthy renewals and future license upsells. Specifically, as of September 30th, 60% of our customers with 500 employees or more purchased 4 or more licenses, up from 50% a year ago, while 26% of our customers purchased 6 or more licenses, up from 17% a year ago. The rapid growth in these metrics underscores the logic behind our transition and is another confirmation that we are unleashing the potential of our platform, which is also reflected in ARR of $261.1million, a 46% increase as of the end of Q3. At the same time, renewal rates of maintenance of perpetual licenses continued to be above 90%. As a result, more than 98% of our Q3 revenues were recurring in nature, which provides visibility into future revenues. Turning now to our third quarter results. Total revenues grew 17% to $76.8 million and included a 99% subscription mix compared to 74% a year ago, and was well ahead of the midpoint of our revenue guidance of 6% growth. Subscription revenues grew 89% year-over-year, and were $44.1 million. Maintenance and services revenues were $32.3 million and reflect the strong renewal rates I just referenced. Looking at the business geographically, North America revenues grew 21% to $57.1 million, or 74% of total revenues. In EMEA, revenues grew 7% to $17.8 million, representing 23% of total revenue. Rest of world revenues were $1.8 million, or 2% of total revenues. Turning back to the income statement, I'd like to point out that I'll be discussing non-GAAP results going forward. Gross profit for the third quarter was $67 million, representing a gross margin of 87.2% compared to 87.6% in the third quarter of 2019. Operating expenses in the third quarter totaled $63.9 million. Operating income was $3.1 million on an operating margin of 4% for the third quarter, compared to an operating loss of $4.7 million on an operating margin of negative 7.2% in the same period last year. Our Q3 operating margin was again well ahead of our guidance, which was negative 4% at the midpoint. During the quarter, we benefited from a meaningful outperformance on the top-line driven by larger new customer adoption and existing customer expansion, COVID-related cost savings primarily due to travel and marketing activities, and continued prudent management of expenses across the business. Looking ahead, we do expect both employee travel and in-person marketing events to gradually resume and we will continue to invest responsibly to support the growth of the business. During the quarter, we had financial expense of approximately $733,000 primarily due to interest expense on our convertible notes partially offset by interest income. Net income was $2.1 million for the third quarter of 2020, or earnings of $0.06 per diluted share, compared to a net loss of $4.8 million, or a loss of $0.16 per basic and diluted share for the third quarter of 2019. This is based on the 35.4 million diluted shares outstanding for Q3 2020 and 30.4 million basic and diluted shares outstanding for Q3 2019. We ended the quarter with $325.6 million in cash and cash equivalents, marketable securities and short-term deposits. For the three months ended September 30, 2020, we used $2.7 million of cash from operations compared to using $13.6 million of cash from operations in the same period last year. We ended the quarter with 1,629 employees, an 8% increase from the third quarter of 2019 and an increase of 55 net new employees from the second quarter of 2020. As we have said, we expect to continue hiring to support the growth of the business with a particular focus on sales and R&D. Before I discuss guidance, I want to welcome the Polyrize team to Varonis. We are excited about the potential of their technology and are working to integrate their capabilities into our platform. In Q4 2020, and for fiscal 2021, we do not expect the acquisition will contribute revenues, ARR or any material expenses. Moving to guidance for the fourth quarter of 2020. We expect total revenues of $82 million to $85 million. We expect non-GAAP operating income to range between $5 million to $6 million and non-GAAP net income per diluted share in the range of $0.10 to $0.13. This assumes 35.4 million diluted shares outstanding. Let me provide a bit more color on guidance before we open for Q&A. First, similar to last quarter, the low end of our guidance again considers the possibility of broader macroeconomic volatility for the foreseeable future, given the potential direct and indirect effects of COVID. Second, we will continue to be thoughtful in the rate and pace of our investments and we'll balance investing for growth with our plan to show non-GAAP operating margin expansion and cash flow generation. Third, I want to remind everyone that the subscription mix in Q4 will be more apples-to-apples, as this was 82% in Q4 2019. As a result, ARR percentage growth will naturally be impacted. In summary, we're pleased with the third quarter, which further demonstrates the demand for our platform and the power of the subscription model at an increasingly larger scale. Thanks for joining us today. And we hope you and your loved ones remain safe and healthy. With that, we will be happy to take questions. Operator?

Thank you. [Operator Instructions]. Our first question is from Saket Kalia with Barclays.

Hey, guys. It's Saket Kalia from Barclays. Yaki, maybe first for you. You've talked a lot about multiple licenses per customer as part of both subscription licensing and just a heightened security environment post COVID. Can you just maybe speak anecdotally about product usage from some of these multi-product customers? And are you finding that usage is sort of following that greater adoption? Does that make sense?

Yes, it makes complete sense, and it's a great question. Definitely, we see there is correlation between the amount of products that customers have and how much value they get and their ability to buy more. And it really works very well for us. I think that what we see in the marketplace is that slowly, but surely, customers understand that this approach of data-first is the right approach for security. In the 3 use cases that we are catering is data protection, threat detection and response. In compliance and privacy, we see a lot of automation, a lot of automation in classifying the data, automation in remediation, in visibility and in forensics and the ability to identify abnormal behavior and to have this high fidelity alerts. So one thing we see is that much more usage within the customer -- and what I mean about usage is automated usage. So they don't need to spend a lot of time and they get a lot of this ongoing value, and we are seemingly -- and more and more seemingly integrated within their day-to-day processes, and they are buying more. And this has also worked extremely well for us in the cloud and 365. And Azure will just stay tremendous for the business. We can spend more time with our customer, and they are just buying more. So the overall model is working, and their move to subscription really supported it and they can buy more and more licenses and just the business become more predictable and the ability -- value and the predictability of customers and the ability for them to buy more is really working very well.

Got it. That's really helpful. Guy, maybe for my follow-up for you. You noted the subscription transition here is largely complete, particularly on the top-line. Could you maybe talk about anything that we should be thinking about the margin trajectory here as more of the business becomes recurring?

Absolutely. So first of all, we're extremely pleased with the Q3 results. And as you mentioned, Q3 has a larger portion of renewals that get into place, and that obviously helps with the margins. Our philosophy really hasn't changed. We want to continue to invest. There's obviously a significant opportunity ahead of us in the market, and we want to capitalize on that. So we'll keep investing in R&D since we've seen such a tremendous ROI there. But at the same time, we want to show year-over-year margin expansion, and we plan to kind of balance between the top-line growth and bringing some of it to the bottom-line.

And Saket, we are going to do it gradually. We're trying to do everything that we said. But remember, we are always following the data. And when you have more platforms that meet the use cases that we are catering to, there is just tremendous opportunity. And this is what we see now with COVID, really with the cloud adoption and all these security threats that we are uniquely solving for. So we are going to balance it, but we believe that we have a great future, and a lot of it is by very predictable innovation, do the same to other platform, and we are going to capitalize on the opportunity, but also being very mindful to margin.

Our next question is from Sterling Auty with JPMorgan. Please proceed.

So I think one of the big questions on investors' minds going into those earnings across all software companies is the ability to attract new customers. You mentioned your ability to sell more into those new customers. But I'm just kind of curious, what you saw in terms of pipeline generation, close rates and the typical metrics around bringing new customers in, beyond just being able to sell more to them with each deal you did?

So, we saw the -- it's our ability to build pipeline, and this COVID environment was very strong. All the demand generation channels are working very well for us. The market is very attentive. We also see that we have very good ability to attract new customers in the right size. We are going upmarket, the right customer -- the customers in the right size, but we also obviously need to balance it because we have this tremendous customer base that is untapped, that meets so much of our products. And with this transition to subscription, we were able to unlock the potential of the platform and the marketplace, the customers and the prospects need more and more from our customers -- from our products. So it makes sense for us to spend more time with our customers. So, on both ends of, just acquiring new customers and gaining share in the market, but also making sure that our customers are using the product and buying more because it's correlated, it’s one-to-one, is they have more licenses. In Varonis, it's really 1 plus 1 equals 5. So they have more licenses. They have more automation. They have more enrichment for their learning, and they get more value. So both sides of the model work very well.

I appreciate that. I think that definitely hits the question. Just one follow-up on the acquisition. Can you give us a little bit more color, maybe number of employees and exactly the technology, I wasn't 100% clear, what it actually brings to the table that Varonis doesn't already do within the platform?

I have talked about the technology and about the market. We see tremendous momentum with Office 365 and Azure, and it's primarily related to adoption. So we build the technology and then just the organizations are adopting the cloud, and it's worked very well to -- these 3 use cases that we are catering to. And then obviously, we're starting to see a lot of adoption of other cloud application, infrastructure. So the cloud is just a massive opportunity for us. And part of our roadmap was to do everything that we are doing to any place that you have users and the data and infrastructure elements, that you need to understand the permissions and activity and this acquisition is really accelerating drastically the time to market. And what this company is doing very well. They have the ability to go to any cloud platform and infrastructure and give you the permission modeling and connect very fast and take events. So we can take this technology and go wide and deep into the cloud for Salesforce and Google and Box that we are already supporting, obviously, in AWS and S3 and GitHub. So you're starting to see this -- a lot of many users with a lot of critical data on this data store. And what we are doing on-prem and with 365 and Azure can work very well there. So we really believe that it's increasing drastically the overall addressable market. It's a natural fit for us, and we are very excited.

And just to add on that, one of the things that I mentioned in the prepared remarks, apart from being very excited about the technology and the potential. This is a technological tuck-in. So we don't expect any contribution from a revenue perspective in Q4 or 2021. But we are very happy to welcome the Polyrize team to the Varonis family.

Our next question is from Brent Thill with Jefferies. Please proceed.

Just on the demand environment, I'm curious if you could just help us color what Q3 kind of looked like in Q2? And there's been some concern that maybe we saw an initial surge from the work-from-home, now we're moving to the work from anywhere. What you're seeing in terms of just overall demand trends and the signs that are leaving you comfortable that this isn't just a short-term burst?

Yes. So for us, we never benefited from anything that is short-term and always benefiting from the overall long-term. I think what happens is that, is what I said, I think that this approach of data-first is something that organizations understand extremely well. And for us, in terms of demand, our ability to close business, it just worked very well. It worked better and better as the year progressed, and we hope that it will continue. We believe that this slowly and surely, it's just -- it’s becoming a standard. If you have a modern enterprise and you want to protect your data in your core infrastructure, you need Varonis. You need Varonis to -- for data protection. You need Varonis for forensics. You need Varonis for very sophisticated alerts to classify the data, for privacy and for your compliance requirements. And we just -- we believe that every day, it's becoming more and more standard, and it's something that every organization understand that they need to serve. So for us, in the overall demand environment as the year progressed, it just become better.

And just to add some data points to support that. When we look at the 3 pillars on the new customers, the fact that new customers are buying now under the subscription model more than 5 licenses and that's compared to purchasing under the perpetual model between 2 to 3 is a great indication. That's been very consistent. We're very happy with that. When you look at the renewals rate, they're very strong, and when you look at the existing customers, the fact that we can sell more to our base and just looking at the KPI of number of licenses for companies with more than 500 employees that have purchased 4 or more licenses, going from 50% last year to 60% this year and on the 6 plus licenses going from 17% to 26% this year is really an indication of how much more we can sell to the base, but how we're truly selling the platform.

That's great. And just a quick follow-up. In the 26% that are buying 6 or more, is there 1 or 2 modules that are standing out? Which ones are showing kind of the bigger uptick?

It's all of them. Without a doubt, the Office 365 and Azure are exploding, but it's everything. And it's all about automation. And automation in these 3 use cases and customers are buying more licenses, they are getting more automation and much more value. So just once -- just when they buy, or they keep buying more. So this is the key for us. We know that if we get to customers to 4, 5 licenses, usually, they will get to many, many more.

Our next question is from Matt Hedberg with RBC Capital Markets. Please proceed.

Yaki, it was really good to hear. I think you started out the script saying significant inbound interest. And I know you talk a lot about Office 365 and Azure but I'm wondering if you can talk more specifically about Teams, in particular. We continue to think and hear from some channel context that Teams is driving a lot of deals, pulling you guys into deals maybe at an accelerating rate. So I'm wondering if you can talk specifically about Teams and then also support of other collaboration tools like Slack and Atlassian?

So what’s happened -- at the end of the day, there is always this conflict, there is tension between productivity and security, mainly with everything that's related to data protection. Team is a client on top of OneDrive and SharePoint online, using Exchange online and you use it a lot, and it's in the hands of the end user which is generating tremendous amount of care. So you have a lot of data. They also have -- don't forget the on-prem is also exploding. So you have this data all over the place. And yes, this is why we did this acquisition because we see adoption with more and more data store and on top of them, collaboration tools, and they have a lot of critical data and we can add a lot of value. There is a lot of value in GitHub. There is a massive amount of volume in S3. And what we are doing to the on-prem data repository in the 365 and core infrastructure in the cloud like Azure you can go to many, many more platforms, and this is what we are following. We’re following the data, and we just believe that this digital transformation for the cloud is opening a tremendous opportunity for Varonis. And also it's going to change the security landscape. A lot of -- it's just going to be -- with time we believe that it's going to be much more data-first and core infrastructure first, and there are good chances that we are going to tremendously benefit from it.

That's great. And then maybe as a follow-up, another thing that I picked up that you mentioned, federal did well. I know that's been an issue for you guys for years, and you've been making steady progress, but it's really good to hear you guys call that out with the large government agency this quarter. I'm curious, can you talk a little bit more about maybe what's driving that federal interest today? Is there anything that's changed in that environment? And maybe just any sense on how penetrated you guys are from a federal perspective on a vertical basis?

Federal, they had a good quarter. North America overall had an outstanding quarter. We started to have a very nice business in federal. We have great teams. In the federal space, we have a lot of critical data. This is unstructured. So we are extremely relevant, but we are in the early innings. We believe that we can build a big business and it's just a big opportunity for us. We're definitely in the [ideation].

Our next question is from Rob Owens with Piper Sandler. Please proceed.

I was hoping you could touch a little bit more on Polyrize. I believe this is your first acquisition. And does this change your strategy a little bit where you will look for tuck-ins moving forward? And I appreciate the fact that this does accelerate time to market relative to the cloud opportunity. So I guess the question is, now that you’ve built a platform, will we see be more opportunistic in terms of making small tuck-ins moving forward? Or was this more of a one-off type of thing?

No. It depends on the opportunity, so first one. And we're always looking at opportunities. We always want to do the right thing. So the right thing for the business. If they will -- if we will have -- we'll find the right opportunity that can shorten time to market and bring good time to the company, it's something that we will do. We are just very pragmatic people. We don't have any -- we are not religious about it. We just want to do what is right for the business side for our customers. And this was just a natural step.

And just to add on that, when we looked at acquisitions to-date that there have been technological tuck-ins. And you're right that this is the first acquisition. And we expect that any future acquisition would be, again, technological tuck-in.

And then second, hoping you could touch on Europe a little bit. And I think you mentioned last quarter how Europe still lagged the transition, you were happy with the pipeline. If you look at the growth rate, though, it's still down in the single-digits. So I was just hoping for an update on that front.

We grew 7%. Remember that Europe were 6 months after North America in adopting the subscription model. So the flywheel is not completely in motion. We have a very good team in Europe, great customers. It's just a big market for us, great channel partners, and we believe that it's an excellent -- a huge market for us, and we'll do very well there.

Our next question is from Shaul Eyal with Oppenheimer. Please proceed.

Yaki, another question on the Polyrize acquisition. It seems to be a nice strategic extension to everything you've been doing in recent years. My question is as follows: If Varonis has 26 licenses under 6 product families, give or take, might be off, how many modules is Polyrize adding to the mix? Is there a specific family they align with or is it a standalone new one?

So it's both. But mainly, we can run the same play of the products that we have to most of the data stores that they are supporting. To some data stores, we can do classifications. To other, you can't. Forensics and alerting, you can do for everyone. The data protection works a bit different but they have a very good coverage. And it will be a lot of new content. How we are going to package it for our customers? We will make sure that we get the revenues, the economics work very well, and it's easy for our customers to buy. But yes, it's a lot of more content, a lot of new products.

Just to emphasize there, Shaul. In terms of the additional licenses that are with Polyrize that we later on plan to sell, they cover platforms that we don't cover. So the licenses are not instead of existing licenses that Varonis has to offer, it's on top of, and that's part of the reason that we see the TAM expanding with this acquisition.

And Yaki or Guy, maybe also going back to the macro. So some countries, specifically in Europe, are heading into another round of lockdowns. Have you seen any ramp-up in demand or at least elevated interest in recent weeks that could replicate the incremental short-cycle we've seen back in April and May? Or do you think that CISOs, CTOs feel comfortable with the current security infrastructures they have currently at hand?

So far -- it's an unknown, but so far, what we see is just very good demand overall.

Our next question is with Hamza Fodderwala with [JPMorgan]. Please proceed.

This is Hamza Fodderwala from Morgan Stanley. Yaki, maybe the first question for you. I wanted to see if you could expand on the prior comments on longer term demand, especially as we see more cloud and digital transformation. So you spoke a little bit about that. But are you having some of those conversations with customers already as they think about their security architectures longer term, moving to a more decentralized work environment? Are they starting to think about making those changes? And how is Varonis sort of fitting into that longer-term CISO conversation?

So what we see is that customers understand that it's all about the data and the core infrastructure. And we see more and more C-level talking about it, and we see that they are not looking with this prism. It's very strategic. Where is the critical data, what users are doing, have the right profile of usability and then they also concern that they have this new data repositories that usually, it will take them 5 years to get to a certain adoption level and really accelerating now. So we just see that the organizations are very worried about the protection of the digital assets. They understand now how it is. You have these -- all of these platforms, and it's very hard for the security teams and the compliance teams to get control over them. They need a lot of automation. And when they realize what we are doing, we're just becoming more and more strategic. So we are almost alone in this market. It's a big market, but it's just realizing how they need to protect the enterprise and what they need to do. And we just see that slowly but surely more budget is going to order. Small boards are asking for a solution like ours, CISOs, compliance officers and data privacy officers understand that they need a platform like Varonis, and it's becoming very strategic, and they are willing to spend more money on it, and they are having a multi-year strategic plan around it, how they are going to deploy it. How they are going to cover all the information states, and I believe that we are going to benefit tremendously.

Our next question is from Jason Ader with William Blair. Please proceed.

I wanted to ask you about structured data. Today, you don't support structured data with your platform and just wondering if that is something on the roadmap. Do you think it's necessary or important for you to support structured data over time? Any comments would be helpful.

We are not discussing roadmap and -- but we believe that unstructured data is much more we can really -- it's very exposed. Don't forget that SharePoint and others, we support semi-structured data. But in the cloud, with anything that is exposing API we can do the 3 use cases that we are doing now to unstructured data. So we will see and what our customers need and what are the needs of the platform. And if there is a need, this is something that we are going to address. We're always doing what is right for our customers within -- as long as it's part of our intellectual property and more.

And then just a quick follow-up, not related, but I wanted to ask you about data privacy and some of the new compliance mandates around the world? And whether you're seeing an increase in pipeline or interest in using Varonis for that type of a use case?

No, we definitely see it. But more than anything else, this regulation and all the compliance demand, what they are doing, they are just going to boards and management teams and tell them, in order for you to manage an organization in this digital world, you need to make sure you have the right protections in place. And if you don't have them, the outcome can be just a disaster. So you just see more business understanding how they need to treat the data, how they need to protect data in an environment that you need to collaborate in order to maximize the value of the data, and we just benefit from it. We just really benefit from everything that's going on from the cloud, from the explosion of data, from the fact that data is on many systems and repositories and from regulation that's saying you need to protect the enterprise, you need to protect the information because without it everything can collapse.

Our next question is from Gur Talpaz with Stifel. Please proceed.

Yaki, we've seen a sharp growth in ransomware over the past several months. Have you seen this as a driver for the business? And have you seen customers looking to push Varonis into more data stores because of this?

Yes, but in a much more holistic way, I think what happened with this ransomware, is that it's really -- a lot of them are very sophisticated APTs. They are coming in or bypassing your EDR and many times they’re exfiltrating data, they take data out and then they are threating you that they are going to release data. So it's help us with everything, with anything that we are doing on the data stores, on-prem and in the cloud, is everything we are doing with active directory in Azure AD and with our Edge product and obviously also Classification, you just want to make sure that you are protecting the critical data. But yes, without a doubt and what happens is that many times you have these APTs, advanced persistent threats, customers don't know that they are there. I think with ransomware that it's announcing that the key is to encrypt as much as data as you can and then ask for ransom. So we can't get a better marketing campaign than this. And the way that it's working now is exfiltrating the data. You have these knocks for this cyber criminals that they have support organizations that you can talk to them and they can direct you exactly what to do in order to pay the ransom and get your data back. So I think that what happened is that, customers really in broad respects understand very well that this is something that can happen to them. And the traditional security solutions are very limited in solving these things, and they need to be ahead of the problem and invest in order to solve it and we benefit from it.

That's helpful. And then building on that a little bit, can you talk about the demand environment for Varonis Edge, especially if you think about customers coming up for renewal and as they kind of think about the risk environment with more users working from home?

No, no. The work-from-home is just helping us because people are accessing data through VPN, home computers, and unsecured networks at home, and there is just much more cyber crime. So they just understand that bad things can happen. You have this cloud workloads and cloud applications that organizations opened in a rush and they don't have all the configurations in place. So they need us and many of them realize that they need us badly. And we just -- it's always like that with us. There is something happened and customers first reacting very fast, but then they really understand what they need to do with the resources that I have, what is the priority, and we just see that gradually we become a higher and higher priority for organizations. And they understand that this is something that they need to do in order to protect the information products, which in this environment, it's the lifeblood of the business.

Our next question is from Chad Bennett with Craig-Hallum. Please proceed.

Guy, did you speak about net expansion NRR number in the call?

So we mentioned last quarter that we will provide it on an annual basis. To remind you, the number that we had last quarter was greater than 120%, and we're really extremely happy with Q3 numbers. We're seeing continued expansion within our base. And we'll provide more color in the next quarter's earning call.

Okay. And then just maybe related to that or a prior question. Just on the net new versus expansion. Just -- I know you haven't broken that out for a while now. But is -- has that mix dramatically changed the last few quarters or the last couple of quarters even relative to what it has been historically from a bookings or ARR standpoint?

So strategically, when you think about the last couple of years, we have a much larger base. So we wanted to have a much larger impact coming from our existing customers. And by the way that cost of generating revenue from existing customers is “cheaper for us”. So that's actually in plan with our strategy, our new customers, as we talked about in the prepared remarks and as we talked about in some of the other questions, we're going up-market. So we're focused on getting the right new customers into place. And the fact that they're consuming the platform, the fact that they're buying more than 5 license is a great indication that they are consuming the platform, but it also shows us that the path to double-digit licenses on average per customer has never been clear. So everything is kind of working as we planned, and we want to continue doing that.

Once they moved to subscription, the company changed drastically. So we had this platform and then market realized that they need the platform. We changed the model that they can consume it. They started to buy. They're buying big, they're buying more. So we are very focused on getting the right customers, sell them the right set of licenses, make sure they realize value then in a very predictable way they are buying more. So really the strategy and the effort economy, if you will, between the land and expand and the market penetration is working according to the plan, and we just need to cater just the attention for both class of customers. But we just became much more strategic for our customers and the current customers and the new customers just over time, and it's just changed the amount of time that we are spending with them and just the output of these engagements.

Just maybe one, last one for me. Just on the license -- initial deal license expansion, again, it's playing out exactly like you guys thought it would and maybe even more accelerated than you thought. But just going from initially 2 to 3, 2 to 4 and then now to 5, how would we compare and contrast initial deal size on a dollar basis or ASP? I don't need the exact number just relative to that license expansion.

So that's a great question. When we look at the expansion and getting to more than 5, that's actually better than what we initially expected when we thought about moving to a subscription model. So that is extremely encouraging. We're very happy with that, and that's been kind of consistent over the last couple of quarters. We haven't really talked about ASPS, but I can tell you that on the new customer front, the discount levels that we're providing have actually stayed very consistent, which is showing us that we're not selling more licenses for a higher discount, but staying firm and doing well in driving higher initial purchase.

Our next question is from Erik Suppiger with JMP Securities. Please proceed.

On Polyrize, can you comment when you would be introducing the products? It sounds like you said revenue -- there won't be revenue in fiscal '21, but will you be introducing some new modules in '21? And can you comment how many people were at Polarize?

In terms, yes, well into these licenses and in 2021, we are working tirelessly on the integration and make sure that it will be a very successful acquisition.

And in terms of the headcount, they have less than 20 people. And as you mentioned, from a revenue perspective, we don't expect any contribution in Q4 or in 2021, but we're extremely excited of moving together with them and introducing additional platforms later on.

Okay. And then you've clearly been able to navigate the pandemic and COVID very effectively. But what challenges has the pandemic posed? Are you finding that there are logistics issues with working with companies that work from home? Or what are some of the challenges that you faced if there are any?

We always worked virtually with our customers, hold installations or mod installation. We have a management team that is many years together. So our ability -- we have shorthand -- our ability to communicate is a very efficient one. But just the COVID environment is out. People are hurting -- less travel. So there is definitely -- it's definitely here. But it also has -- it benefits because it's just really cemented the need for a solution like Varonis and with just the data all over these repositories, organizations understand that they need us. And they -- many times, they understand that they need to move fast and all this transformation for just the modern digital enterprise is just happening very fast and Varonis is benefiting from it. So it's coming from both ends, but there are challenges, but we feel that we are that we are attacking them heads on and there is a lot of success.

Our next question is from Joshua Tilton with Berenberg. Please proceed.

Just really quick. It seems as if the acquisition is going to result in more overlapping functionality with SailPoint. Is that the right way to think about it? And if so, do you expect more competition with SailPoint in the future, especially as you move up-market?

No. It's not. There is no -- SailPoint -- maybe don't understand from where is the confusion, but we don't see SailPoint as a competitor. It’s just about the relationship between users and data. And making sure that we’re considered for data protection, for detection and response and the compliance needs that’s related to data in core infrastructure, and they are just accelerating the core, but we’ve existing sales to more rare applications and infrastructure.

Our next question is from Daniel Ives with Wedbush Securities. Please proceed.

So when you think about hiring on the sales side, quarter over the next 6 to 12 months, without giving numbers, I mean just talk about your thoughts there. I mean just clear given how you're doing. Is there an acceleration there or just strategically hiring, just given what you're seeing with the success in the field?

So -- hi, Dan, when we thought and we talked about kind of the hiring plans after Q1, we talked about continuing to hire on the sales front, but kind of hold off in terms of hiring in some of the other departments just because we didn't really see how the market was evolving. But when Q2 came, we started to see both the pipeline and the results improve and kind of how we go up and the priority of our customers and showing good results. We talked about it last quarter that we want to continue to hire in some of the other departments to take advantage of the opportunity. And I think the results in Q3 that we're very happy with. The 17% top-line growth versus kind of the midpoint guidance of 6%, just reemphasize that. We want to capitalize on this long-term opportunity. Obviously, we're going to do it in a very measured way, balancing both top-line and bottom-line. But we want to continue to hire to capitalize on it. So I -- you should expect hiring mostly in sales and marketing and the R&D department.

Guy, when is the webinar for how to successfully move to a subscription transition? Are you going to start at that date?

I'll send you again.

We have reached the end of our question-and-answer session. I would like to turn the conference back over to James for closing remarks.

So thank you all very much for your interest today. We hope everyone stays safe and healthy, and we look forward to speaking with everyone more this quarter. Have a good night, and thank you again.

Thank you. This does conclude today's conference. You may disconnect your lines at this time, and thank you for your participation.