Greetings and welcome to the Varonis Systems, Inc. Third Quarter 2024 Earnings Conference Call. At this time, all participants are in listen-only mode. A brief question-and-answer session will follow the formal presentation. [Operator Instructions]. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Tim Perz, Investor Relations. Thank you. You may begin.

Thank you, operator. Good afternoon. Thank you for joining us today to review Varonis' third quarter financial results. With me on the call today are Yaki Faitelson, Chief Executive Officer, and Guy Melamed, Chief Financial Officer and Chief Operating Officer of Varonis. After preliminary remarks, we will open the call to a question-and- answer session. During this call, we may make statements related to our business that would be considered forward-looking statements under federal securities laws, including projections of future operating results for our fourth quarter and full year ending December 31, 2024. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned forward-looking statements, and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation for the most directly comparable GAAP financial measures is also available in our third quarter 2024 earnings press release and our investor presentation which can be found at www.varonis.com, in the Investor Relations section. Lastly, please note that a webcast of today's call is available on our website in the Investor Relations section. With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Faitelson. Yaki?

Thanks, Tim. And good afternoon, everyone. Thank you for joining us today to review our third quarter results. Today, I would like to discuss our SaaS transition progress and the key drivers of our business. First, as I often do on these calls, I would like to remind you why Varonis exists and the problems we solve. Next to its people, data is the most valuable asset of any business, so it is the primary target for bad actors and cyberattacks. Most organizations focus on securing endpoints and perimeters, but leave many gaps for cyberattacks on their data. With the expansion of the cloud and the emergence of generative AI, productivity and collaboration have improved, but the risk of overexposing sensitive data has greatly increased. Since the inception of our company, we have taken a data-first approach to security, which allows our customers to locate their sensitive data, visualize who has access to it, lock it down, and detect and respond to threats on it. Now with the automation of our SaaS platform, our customers can spend less time and effort protecting their data. Our Managed Data Detection and Response offering, which we call MDDR, saves them even more time, and makes them much more protected. Simply put, Varonis allows organizations to use AI and collaborate in a much safer way. Turning to our third quarter results, ARR grew 18% to $610 million dollars and SaaS ARR now represents approximately 43% of total ARR or approximately $260 million, which reflects the growing momentum of our SaaS platform and our MDDR offering as well as a small contribution from Gen AI. Year-to-date, we generated $88.6 million dollars of free cash flow vs. $46 million last year. While our federal business underperformed our expectations, our strong performance this quarter was led by…

Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. When looking at the quarter, this was our strongest performance across the business since embarking on the SaaS transition. These results reflect the strong adoption trends of Varonis SaaS and MDDR coupled with a small contribution from Gen AI. Our performance this quarter gives us increased confidence as we look to close out the year, and our SaaS transition continues to gain momentum with SaaS now representing 43% of our total company ARR. We saw strong contribution from both new logos and existing customer conversions, including conversions from perpetual maintenance customers, and many of the secular tailwinds we have noted this year, are continuing to have a positive impact on our business. Our enterprise business was the driver of our strong performance this quarter, with strong new business activity, healthy conversions and very early contributions from Gen AI to our reported metrics. Our federal business, however, underperformed our expectations by several million dollars. We have decided to make changes to the management team of our federal business and believe those changes, coupled with our expectations for FedRAMP authorization next year, will better position us to capture that market opportunity going forward. Looking at the quarter in more detail, the key drivers were again SaaS and MDDR. Our SaaS platform and MDDR offering together eliminate the two biggest pushbacks of, one, not wanting hardware and, two, not having the headcount to manage the platform or respond to alerts. The automation of our SaaS offering, together with the simplicity of the story, continue to drive positive momentum and shorter sales cycles when compared to the on-prem subscription deals. As we have said for a few quarters, Gen AI continues to come up in nearly every customer conversation, but this was the…

[Operator Instructions]. The first question is from Matt Hedberg from RBC.

Congrats on the results. Yaki, there's a lot of left unpacked. It's hard to think about one question here, but I guess if I were to focus on one, I couldn't help but hear you talk about Gen AI, although early, positively impacting results. I guess I just wanted to put a finer point on what aspects of the portfolio are contributing to customer Gen AI spending. And if we look forward another couple of years, how do you think the products that attribute to Gen AI spending could expand over time?

It's primarily now related to Copilot and you see it a lot on the 365, but eventually obviously you have Einstein in Salesforce and you have it for GitHub and there are – there's this type thing that is going to be part of every walk of life. The reality is that, at the beginning, we saw just these small POCs in the hands of IP that immediately exposed the problem, the data security problem. You have this massive blast radius. But what we're starting to see now is that more knowledge workers are using it. And once they are using it, solving the problem becomes almost inevitable. So you just see that people get to a lot of critical data they don't need to get, generating a lot of critical data they shouldn't generate outside of policy, starting to just using the wrong intent and it's just extremely dangerous in terms of losing the critical data. So, at the beginning, it was on the PS/POC stage, but now when knowledge workers are demanding it and they are trying to buy it and you're just starting to hit critical mass within organizations that are using the product, they generate a lot of urgency to buy a protection for Gen AI and Copilot mainly and it's just working extremely well for us. We just – an unbelievable solution to solve it automatically.

The next question is from Hamza Fodderwala from Morgan Stanley.

Yaki, you and Guy teased us a bit with a lot of the Gen AI contribution commentary, but didn't quite size the opportunity, at least today. I know it's early innings, but we're seeing some of the problems in terms of over-permissioning and data leakage with Copilot. You've had some customer case studies already where customers are using Varonis for Gen AI. There's a Gen AI readiness program with some of your partners like ePlus. So, there seems to be some momentum there. I'm just curious, if you're not willing to give sort of ARR revenue contribution today, what percentage of your pipeline would you say is Gen AI related customers coming to you and trying to prepare themselves for Gen AI going forward?

Hamza, we've been talking about Copilot for about a year now. This time is slightly different. I think you kind of noted that and here's why. This quarter, we finally started to see some deals close. But as he says and as we've talked a lot about it, it's still early on which is why we're not baking in any material amounts closing into our Q4 guidance. But the fact that we started to see deals close this quarter gives us increased confidence that we should benefit as Gen AI adoption increases. And as Yaki mentioned, it's not just around the Microsoft Copilot. It also includes the internally built LLMs, Salesforce Einstein and others. When we look at the pipeline, it comes up really in every conversation with our customers. A lot of our customers are talking to us about it. But again, this quarter, we started to see some deals close, but it's still a very small amount and immaterial amount for the quarter.

But it's front and center in every conversation. We believe that, over time, it will be inevitable that it will be in the hands of any knowledge worker. It's just the productivity gains are tremendous. And once enough people are using it within the organization, it's exposing many times the data security problem. The fact that data is overexposed, the fact that you can use these robots in a malicious intent, and it's very, very dangerous. But we believe that it's going to be a big part of the future of IT and we are well positioned to protect organizations and make sure that the community is secure.

The next question is from Saket Kalia from Barclays.

To Matt's earlier point, a lot to unpack, particularly in Gen AI, but maybe I could switch gears a little bit. Guy, I've gotten the question from investors just around how much of the net new ARR, generally through this process, has come from conversion. And of course, that isn't something that we disclose, but I think that what a lot of people are trying to figure out is how does demand look excluding that conversion activity. So is there a way that you can talk to us about that qualitatively just as we think about sort of base net new ARR next year plus any conversions, plus a lot of the other good things that you talked about with Gen AI?

Saket, I think one of the biggest misconceptions, and we've talked a lot about this during a lot of the conversations that we've had with investors, is this conception that the conversion, you just plug it in the Excel and it happens very quickly and very easily. When you look at what drove the momentum and the strength this quarter, it definitely came from the SaaS platform and the MDDR. We continue to see shorter sales cycles on SaaS and very strong new logo activity, which was really driven by the MDDR offering. And that's really because the SaaS value proposition eliminates the two biggest pushbacks of customers. And we've talked a lot about it, one being not wanting to buy hardware, and the second that they don't have enough people to support the solution. Without the conversions, we wouldn't have gotten to 43% of total ARR being SaaS or approximately $260 million, but the conversions take time. And conversions are – you have to talk about the legal elements of it with the customer and it takes time to flip them. It's not a plug and play. But at the end of the day, provides more value to our customers. That's why we do it. That's why our customers are buying SaaS and converting to SaaS. But at the end of the day, what drove the momentum this quarter and also last quarter when you look at kind of the commentary that we gave last time is the new logos, the MDDR offering, and that's really what's driving the business.

The next question is from Brian Essex of J.P. Morgan.

Great to see the profitability and cash flow here so early on still in the transition phase. Maybe, Yaki, I think last quarter we caught up – in terms of talking about the transition, I thought you had a great analogy where I don't know if it was either you or Guy talked about stage one of the transition was the carrot phase and then phase two was the stick and then you said that carrot phase is going so well, you don't feel like you need to use the stick. Is that still the case? How much visibility do you have in that transition pipeline and how smoothly is it going for those existing customers that you're converting over now? How much runway do you have left with those easier converts if I can maybe put it that way?

In terms of the overall value proposition and our ability to get to outcomes, the SaaS is second to none. The reality is that bad actors many times are not breaching in, they are logging in. Once you have an identity, there is no perimeter anymore and we are your best bet. So a data centric data security platform is the first thing you need to do and the last thing that really will save you. So anytime our customers are tasting the value, the automated outcomes that we provide, it's a game changer. You have stuff that's related with all the remediation robots and the MDDR. We just released the MDDR and what we just catch on a weekly basis is mind blowing even to us and our ability to automate everything and also with the way that we are covering more data and user repositories just elevate the whole value proposition. So once customers taste it and understand just the regular value of a high quality SaaS architecture, but primarily these automated outcomes, that they can get most of the value literally doing nothing automatically generates a lot of appetite due to conversion.

One thing to add, and I think it's a very good question in terms of kind of value proposition and kind of the commentary that we gave about the fact that many of our customers are asking for SaaS and wanting to switch to SaaS because it's a much better product, but if we take a step back for a second and when you look at kind of when we announced the transition, we're just under two years into the transition and we expect to be at approximately 50% of the business coming from SaaS. That's a huge milestone for us. So when you look at kind of the progress that we have had through this transition, it's been extremely healthy. We're very happy with the progress that we are. And you noted correctly, we're doing that with significant generation of cash flow. When you look at the free cash flow, upping our guidance and getting to levels that are very healthy, we're very happy with that. We think we can continue on that path and do better, but we're very happy with the progress we've had so far.

The next question is from Joel Fishbein from Truist Securities.

Good quarter. Yaki, you mentioned on the call that the federal business underperformed. I'm just curious there whether or not that was sort of self-inflicted execution or if there's something going on there. It's been a good area of business. I know you're still on track for FedRAMP. I'd love to get a little bit more color there. Really appreciate it.

So that's a great question. I'll take that. The federal business did underperform by several million dollars. But let's keep things in perspective, that vertical accounts for mid-single digit percentages out of total ARR. So when we look across the remaining 95% of the business, this was the best quarter we've had since the start of the transition and that momentum was driven by continued strength in the enterprise segment. If federal did what it was supposed to do, this would have been a picture perfect quarter for us. So after several years of underperformance from the federal business, we decided to bring in a new management team and we believe that these changes coupled with the expectation for FedRAMP authorization next year will better position us to capture that market opportunity going forward.

The next question is from Fatima Boolani of Citi.

Guy, I wanted to double back on an earlier question with respect to some of the conversion momentum that you're seeing in the base. Understand that it's not like flipping a switch, but I'm curious to understand how much of your install base has actually converted. And as a related question, how much of your install base has actually converted? And as a related matter, is your guidance for SaaS ARR mix for the full year at 48% still intact?

Again, when we look at kind of where we are from SaaS out of total ARR, getting to 43% was definitely – you can't get to that percentage without having existing customers converting. Our Q3 conversion was very similar in dollar terms to the Q2 conversion amount. So, again, it's the same commentary that we gave in Q2, the strength of the quarter came from new business, the MDDR and the fact that we're seeing shorter sales cycles on the SaaS offering. And when we look at kind of where we want to end, we talked about 48% kind of finishing the year. We're looking now to be in that 49% SaaS mix at the end of the year. And we think that even that metric gives us a lot of confidence to deliver in the same manner we've delivered on other metrics to Wall Street.

The next question is from Roger Boyd from UBS.

I know there's a variety of ways you're monetizing MDDR, but are we getting to a point where you might be able to quantify the size of that business? Or alternatively, any color you can give on the typical uplift you see to ACV when you do bring that into customer engagements?

Roger, one of the things that we've talked a lot about is our desire to be able to extract more dollars from our customers through the MDDR offering. It's part of a bundle, basically. And there are multiple ways to buy the MDDR. If you want to buy it separately without additional licenses that we have as part of the bundle, you will pay a higher price. But what we wanted to see and what is actually happening is that many of our customers are actually buying more of the platform and getting MDDR at a reduced price. For us, it doesn't really matter. We want to provide the value. And we think that if they consume more of the platform, they get a much better value for money. And at the end of the day, it allows us to increase our ASPs. So at the end of the day, everyone wins here. When we look at kind of the adoption of MDDR, we only had two full quarters. But don't forget, we introduced it at the beginning at the beginning of the year. So January was the first time it was introduced to our Salesforce. Very well adopted by our customers, very well adopted by the Salesforce, because it's a no brainer. It helps on the sale cycles. It helps on the conversation, the value that is provided to customers is great. We haven't quantified because we're providing a lot of color in terms of the numbers. And I think that MDDR at the end of the day needs to be with every single customer we have. We've talked a lot about that. It doesn't happen overnight. But at the end of the day, it's something that can help all of our customers.

The next question is from Andrew Nowinski from Wells Fargo.

I just want to get a better understanding of how you're defining a material impact from Gen AI. Are you guys measuring it based on the number of new logo adds you get when they tell you they're buying Varonis for an LLM support? Or can existing customers that roll out an LLM also have an impact on your ARR? I guess I'm just trying to understand how you define a material impact and what that might look like.

We are analyzing every POC, looking at the pipeline and understanding very well, methodically, why customers and prospects are buying the product. And many times we just we see in what we call a risk assessment that when they're using Copilot, it's just exposing the problem in a big way. And we also see that our customers just many times expediting the purchasing process in lockstep with their intent to release the Copilot product to more and more knowledge workers. This is really how we see it. And before it was very contained in the IT department, but as time goes by, we just see that once they release it to a broader population, they need to understand that they must make sure that only the right people can access the right data. They need to be able to audit activity. They need to make sure that they contain the queries themselves Queries that make sense because, if not, these tremendous tools will inflict a lot of damage.

One thing to add, when we look at kind of the Copilot, we talked a lot about it. We have it as a separate SKU. We have it as part of the MDDR. And we've talked a lot about the fact that, when customers have the Office 365, they have a lot of protection that can help them with the Copilot. The copilot has additional functionality, but the true value in dollar terms is selling Copilot to new customers. When we quantify materiality, we quantify it in dollar terms. When we looked at kind of the Copilot SKUs sold in Q3 as a standalone, it didn't have a material impact. But as I said before, there is difference, and that was part of our prepared remarks. We did see deals closed that were related to Copilot in a way that gives us increased confidence that it will become a tailwind in the near and medium term future.

The next question is from Joseph Gallo with Jefferies.

I appreciate the federal commentary earlier, but anything else to note on the overall business environment? And then just any expectations for a 4Q budget plus? Just trying to understand your 4Q guide where net new ARR is relatively similar to your 3Q. So just trying to understand if there's anything else we should be aware of.

When we look at the philosophy of guidance, that really hasn't changed. That's why we didn't bake in any additional Gen AI contribution. We've always been under kind of the assumption, and our philosophy has always been, that we don't bake in any positivity until we see it translate into data. And that's why we're kind of staying with the same philosophy for Q4. In terms of budget flush, it's not something that we've seen in the past. There is the regular seasonality within the business where Q4 is the largest quarter of the year, and we expect that to be the same this year. But we haven't seen any changes in terms of budget flush when we move to SaaS. If we see anything, we'll obviously provide commentary post-quarter.

The next question is from Jason Ader with William Blair.

I just wanted to see if you had any early thoughts on 2025. I know you're not providing any specific guidance, but just maybe can you help us think through the impact of the SaaS transition on 2025 relative to elements like revenue growth, operating margin. Operating margin was down this year from last year, primarily, I would assume, from the SaaS transition. Will it stabilize, you think, in 2025? Could it go down more? And then on the revenue growth side, same thing. It actually probably outperformed probably what most people expected this year. But what are some guideposts for 2025, and how should we be thinking about that?

Jason, I'll start by re-emphasizing the three North Stars, which are ARR, ARR contribution margin and free cash flow. I think looking at regular standard financial statement metrics that relate to revenue and operating margin through a transition are very misleading because of the ratable recognition of revenue through SaaS versus the upfront recognition of the on-prem subscription. So I would highly, highly, highly recommend not looking at revenue and the regular operating margin because it really is not reflective of anything within the business. When I look at the ARR contribution margin, it was actually moving very nicely throughout this year. We're showing nice leverage compared to 2023. And when we look at kind of our commitment, we've talked about our desire to continue to grow, but also from an ARR contribution margin, show improvement and generate more cash. And I think when you look at the free cash flow generation, it's been progressing really nicely. We believe that obviously that's one of the essence of having a company want to generate healthy free cash flow. In terms of the 2025 color, we'll provide more color as we finish Q4. Obviously, Q4 is the largest quarter of the year. We're very focused and we feel good getting into the quarter and we'll provide additional color on 2025 as we see kind of the trends in Q4. But overall, we're entering Q4 with strong pipeline and believe that we can do well.

The next question is from Rob Owens with Piper Sandler.

Just a quick one from me. I think you called out in your prepared remarks a small asset purchase that you made during the quarter. Could you elaborate on that?

We bought just a small team of programmers that can help us accelerate the roadmap. We have many exciting new products and features in the roadmap and this was just shortening time to market. Just a very small acquisition that help us accelerating the roadmap.

And just to give some color from the financial statement side, as Yaki said, we purchased code. So this is a small technological tuck-in. And as Yaki mentioned, helps shorten our time to market. From a cash flow perspective, the asset purchase at max totaled $6.7 million. And on the income statement, the full amount is expensed immediately. So you will see that amount of acquired in-process research expense within the non-GAAP R&D expense line item. We don't expect any ARR or material expense because of the very small size of the asset purchase.

The next question is from Joshua Tilton from Wolfe Research.

One for me, I guess. It's clearly a positive that you guys are calling out contributions from Gen AI. And I guess we can interpret that as Copilot adoption is possibly going a little bit more mainstream in the enterprise than it was maybe 12 months ago. And I guess my question is, it feels like prior to this AI hype cycle and this want or need to adopt some type of Copilot strategy, that you guys lived on this very secluded island when it came to competition. I think part of the reason why we all love the story is because there was really no competition for your core offering, especially when it was on-prem. And I guess my question is, as you see Copilot adoption become more mainstream, more customers want to deploy this technology, look for ways to secure their data. It just feels like the competitive landscape is getting increasingly more noisy. And I'm curious how you think about the fact that there are so many companies coming after the data security market, the data security opportunity as you had in 2025 and maybe how that changes the competitive positioning that you once had as an on-premise business.

At this point, we see no change to the competitive landscape. We sell our products through POC, we analyze each and every one and we know we have a competition. But what we do see is that there is just a lot of noise, a lot of awareness around data. Most breaches are data breaches. And this whole notion that organizations spend an arm and a leg on security and constantly have breaches that are more sophisticated in attacking data is just a losing proposition. I think that what you see is that data security becoming front and center and organizations understand that they need data security. It's a very complex problem to solve. You have massive volumes of data with a lot of data stores and you need to integrate and you need to marry them with a lot of additional streams in order to really solve the problems, to make sure that only the right people can access the data, to understand if you have any abnormal behavior and to find critical assets. And this is something that we are experts in doing extremely well. But at this point, there is no change whatsoever to the competitive landscape.

The next question is from Rudy Kessinger from D.A. Davidson.

Similar to Saket, I get a lot of questions from investors just on the conversions and contribution towards growth. Guy, you said in response to a question earlier, you converted about the same amount in Q3 as you did in Q2. If I look at the numbers here, the step down in your term and perpetual ARR was about $5 million higher Q2 to Q3 than Q1 to Q2. So it looks like from those numbers you converted a good chunk more. So I'm curious how gross retention has been trending and how it was in Q3 versus Q2 in prior quarters just as you started to lean into the conversion notion more to your existing customers.

When we look at our renewal rates, they're consistently over 90%. So we're happy with what we're seeing there. I can tell you that when you look at kind of the conversions, we have seen more conversions happen from our customers that own maintenance of perpetual and that's part of the reason you're seeing that revenue increase because, in a way, there's no headwind when you convert the maintenance of perpetual to SaaS. When you look at the maintenance and services line items, and when you look at the decline there, the majority of that decline in that line item is actually coming from conversions. So when you look at our conversions, I think we're happy with customers converting, but again, I can't emphasize this enough. When you look at what drove the momentum in this quarter, it was new customers, it was the MDDR. We're very happy with the way our new customers are adopting MDDR and the way our Salesforce is selling to new customers. And we saw growth in the new customers, a very healthy dollar increase with our customers.

The next question is from Shrenik Kothari from Robert W. Baird.

Congrats on great execution. Guy, you mentioned about the upsized convertible notes offering and the strategic flexibility it provides. And with M&A being one potential avenue – and, Yaki, please feel free to chime in – any specific areas in your product portfolio or market segments that you might be eyeing that align with your core data security focus. Specifically, would you be focusing on certain technologies that complement your existing offerings, expand overall reach, or provide new capabilities, either in context of competitive dynamics or not, if you can provide some sense there.

I think that we just build a very unique asset with this data security platform that can take all the activities, a lot of telemetry, and really support production that will provide the automated outcomes. And with that, it just opens up a lot of the logical extension. There is just a lot of meat on the bone to do very, very interesting things that provide a lot of value. They have great engineering organization and a lot of capacity there. But we're also shrewd business people and we look at opportunities and we see something that makes sense. So, a good team that can help us accelerate our roadmap, we will consider.

To add some more on in terms of the convert and kind of how we look at it, obviously, our 2020 convert was coming due in August 2025. So, we obviously didn't want to wait for the last minute and decided to opportunistically raise in a really favorable convertible market. But as Yaki mentioned, the convert really allows us to be more offensive as we've talked about the fact that our opportunity has never been bigger than it is today. But we did not think that doing a deal is a necessity to achieving our $1 billion ARR target. Rather, this sets us up to grow at healthy levels way beyond the $1 billion of ARR. with additional capital allocation flexibility. But I think that what's very important to note is that this allows us to look at slightly larger M&A, but nothing crazy or changing the risk profile of the business. So just want to emphasize that.

There are no further questions at this time. I would like to turn the floor back over to Tim Perz for closing comments.

Thanks for joining us today. We appreciate the interest in Varonis and look forward to speaking with everybody at the conferences this quarter.

This concludes today's teleconference. You may disconnect your lines at this time. Thank you for your participation.