Varonis Systems, Inc.

Greetings. Welcome to the Verona Systems, Inc. Second Quarter 2021 Earnings Conference Call. At this time, all participants are in a listen-only mode. A question-and-answer session will follow the formal presentation. If anyone should require operator assistance during the conference, please press star zero on your telephone keypad. Please note this conference is being recorded. I will now turn the conference over to your host, Jamie Orestia, VP of Investor Relations. Thank you. You may begin.

Thank you, operator. Good afternoon. Thank you for joining us today to review Varonis' second quarter 2021 financial results. With me on the call today are Yaki Fidelson, Chief Executive Officer, and Guy Melamed, Chief Financial Officer and Chief Operating Officer of Varonis. After preliminary remarks, we will open the call to a question and answer session. During this call, we may make statements related to our business that would be considered forward-looking statements under federal securities laws, including projections of future operating results for our third quarter and full year ending December 31st, 2021. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned Forward-Looking Statements, and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation for the most directly comparable GAAP financial measures is also available in our second quarter 2021 earnings press release, which can be found at www.varonis.com in the investor relations section. Also, please note that all common stock and per share data have been retroactively adjusted for the impact of the three-for-one stock split effective March 15th, 2021. Lastly, please note that an updated investor presentation, as well as a webcast of today's call, are available on our website in the investor relations section. With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Feidelson. Yaki?

Thanks, Jamie. Good afternoon, everyone. Thanks for joining us to discuss another strong quarter as we continue building on the momentum for Q1 and the end of 2020. With the backdrop of the current environment, I want to focus today on two topics. First, why data protection is such a hard problem for organizations to solve, but is only becoming harder with the digital transformation. And second, why our platform and technology offer a durable competitive advantage. I will then turn the call to Guy to discuss our Q2 results and guidance. Let's start with the threat landscape. Simply put, Companies of all sizes and industries are facing high-profile attacks on a daily basis. This is not surprising as organizations put sensitive data in more places and access it in more ways, making it harder to lock down data and detect threats. Hackers are taking advantage of this new environment, and with the rise of cryptocurrency, the theft of data has never been easier to monetize. Companies also face growing risks from rogue insiders and ransomware, giving that the average employee has access to 17 million files on their very first day of employment, most of which aren't relevant for them. As we have been saying for many years, security of the perimeter and endpoint is critical but insufficient. Perimeters are hard to define and even harder to monitor. Endpoints are interchangeable. In reality, most data is moving to centralized sanctioned repositories, and as cybersecurity risks surge, companies are thinking more strategically about data protection and are increasingly turning to Varonis to help protect data where it lives. Data protection is an immensely difficult problem to solve, and in conversations with our customers and prospects, we ask three simple questions. One, Do you know where your important data is stored? Two, do you know that only the right people have access to it? And three, do you know that they are using it correctly? To keep data safe, you have to be able to answer yes to all these questions, but most organizations that turn to us can't answer yes to any of them. Let me drill into this a bit more. First, identifying important data take sophistication, giving the complexities of data storage. Second, to understand accessibility, most companies don't realize just how many millions of folders, files, records, and groups need to be analyzed to discern permissions, and how many functional relationships there are between them. And lastly, in terms of data usage, every system is different. Many lack fidelity or granularity, In all our important contexts, without the significant enrichment that we offer, companies can't build a baseline of normal user behavior. Furthermore, when we show our customers that by integrating data importance, access and usage, they can finally understand and safely reduce risk in a holistic way that can't be achieved with only one of these dimensions, the uniqueness of our solution becomes clear. For data to be secure, we need to be able to answer yes to all three questions all the time. This is why our platform and underlying technology provide such a durable competitive advantage and why we believe we have a 15-year head start. Data has always been a primary focus and we start by building context around it where it's stored, what it contains, who can access it, and from where. Automation and machine learning connect these dots to build visualization of risks and profile of normal usage. When we show companies how our platform provides best-in-class threat detection while automatically fixing the damage that a single compromised user or system can do, what we refer is reducing the blast radius to become a top priority. Our subscription offerings which aligns perfectly with customer demand for our platform, is why we say that more is more at Voronis. Customers buy a larger number of licenses upfront and under the perpetual model, realize greater automated value, and in turn, not only renew, but extend their deployments. Let me provide a few examples of some key customer wins from this quarter. One of the country's largest Fortune 500 insurance company and financial services provider became a Voronis customer in Q2. We were initially brought in after an internal audit uncovered the risk of fines for regulatory non-compliance. But a risk assessment also found 65% of the folder were open to all 40,000 employees and 40% of the sensitive data was exposed. proving that we could classify their sensitive data for multiple regulation and immediate open access issues in three weeks. They purchased 10 licenses, and we are already discussing additional data advantage licenses, as well as edge to further strengthen their deployment. At the same time, we remain under-penetrated with our existing customer base, and the team had another strong quarter closing substantial expansion opportunities. A great example of this is a North American healthcare company, which was concerned with the potential leakage of patients' data as they migrated to the cloud. While there has been long-time Voronis customers with a focus on protecting their on-prem data, in Q2, they purchased the entire Office 365 suite, edge and automation engine, doubling the number of licenses from eight to 16. Building trust doesn't happen overnight. And extension examples like this one reflect the confidence we have instilled in our customers after helping solve their most urgent data protection problems over the last 15 years. In summary, we founded Varonis because we recognize that enterprise capacity to create and share data far exceeded its capacity to protect it. This has never been truer than it is today. Because we have aimed to keep pace with the relentless growth and complexity of data, we believe that our platform is uniquely positioned to address the data protection challenges facing all companies, providing Varonis an enormous opportunity to capitalize on the market opportunity we see while deepening our competitive mode.

With that, let me turn the call over to Guy. Guy.

Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. We are once again extremely pleased with our second quarter results as we continue to capitalize on both the short and longer term opportunities we see. Financial highlights in Q2 include 33% total revenue growth year over year, driven by strong ARR growth of 39% to $328.2 million. Demand for our platform continues to be driven by both new customer acquisitions where the average new customer is now buying approximately five to six licenses and continued expansion from our base of existing customers. As we discussed last quarter, these trends continue to dramatically increase customer lifetime value. As of June 30th, 2021, 68% of our total customers with 500 or more employees purchased four or more licenses. up from 58% a year ago and 48% two years ago. At the same time, 35% of our total customers with 500 or more employees purchased six or more licenses, up from 24% a year ago and more than double the 16% we had two years ago. The strong growth of these KPIs validates the demand to consume more of our platform while also illustrating the continued opportunity we see to get every Varonis customer to a double-digit number of licenses, much like the customer examples Yaki just provided. The path to this number has never been clearer than it is today, as we know that customers who land with a higher number of licenses, which is exactly what our subscription model allows for, see more value upfront through automation, leading them to consume even more of the platform with additional purchases. All of this significantly increases our customer lifetime value compared to the perpetual model. Turning now to our second quarter results in more detail. Total revenues grew 33% to $88.4 million. Subscription revenues grew 70% to $58.1 million. Maintenance and services revenues were $30 million, as our renewal rates remained strong at over 90%. Looking at the business geographically, we again saw strong revenue growth across North America and EMEA. In North America, revenues grew 34% to $61.6 million, or 70% of total revenues. In EMEA, revenues grew 31% to $24.5 million, or 28% of total revenues. Rest of world revenues were $2.3 million, or 3% of total revenues. Turning back to the income statement, I'll be discussing non-GAAP results going forward. Gross profit for the second quarter was $76.9 million, representing a gross margin of 86.9% compared to 86.5% in the second quarter of 2020. Operating expenses in the second quarter totaled $75.8 million. As a result, second quarter operating income was $1.1 million or an operating margin of 1.2%. This compares to an operating loss of $4 million or an operating margin of negative 6% in the same period last year as we continue to drive operating margin leverage. During the quarter, we had financial expenses of approximately $918,000, primarily due to interest expense on our convertible note. Net loss for the second quarter of 2021 was $771,000, or a loss of one cent per basic and diluted share, compared to a net loss of $4.7 million, or a loss of five cents per basic and diluted share for the second quarter of 2020. This is based on $106.4 million and $94.5 million basic and diluted shares outstanding for Q2 2021 and Q2 2020, respectively. We ended Q2 with $813.7 million in cash, cash equivalent, marketable securities, and short-term deposits. For the six months ended June 30, 2021, we generated $11.1 million of cash from operations compared to negative $10.8 million in the same period last year. We ended the second quarter with 1,870 employees. an increase of 76 net new employees from the first quarter of this year. Consistent with the demand environment, our net hiring has been strong for the last four quarters, triggered by the digital transformation which we recognized mid-last year. We believe these continued investments in innovation and capacity will allow us to capture the opportunities we see in the market.

Moving to our guidance.

For the third quarter of 2021, we expect total revenues of $96 million to $98 million, representing growth of 25% to 28%. We expect non-GAAP operating income of $3.5 million to $4.5 million and non-GAAP net income per diluted share in the range of $0.01 to $0.02. This assumes 118.9 million diluted shares outstanding. For the full year, we're raising our guidance and now expect total revenues of $375 million to $379 million, representing growth of 28% to 29%. We now expect non-GAAP operating income of $10 million to $13 million and non-GAAP net income per diluted share in the range of $0.03 to $0.05. This assumes 116.8 million diluted shares outstanding. In summary, we are extremely pleased with our results this quarter. Looking at the pipeline, the demand environment, and the market increasingly coming to us, we are confident in our ability to capitalize on the opportunity we see as reflected in our guidance.

Thanks for joining us today, and with that, we would be happy to take questions. Operator?

At this time, we will be conducting a question and answer session. If you would like to ask a question, please press star one on your telephone keypad. A confirmation tone will indicate your line is in the question queue. You may press star two if you would like to remove your question from the queue. For participants using speaker equipment, it may be necessary to pick up your handset before pressing the star keys. Due to time constraints, we request that everyone please limit themselves to one question per person. One moment, please, while we poll for questions. Our first question is from Sterling Audie of JP Morgan. Please state your question.

Yeah, thanks. Hi guys. So this is the second straight quarter that ARR growth was just over 39%. And I think we talked about in the beginning of the year that ARR growth and revenue growth should normalize, you know, for the full year. But I guess what I'm asking is looking at the back half of the year, it would indicate a pretty significant slowdown in ARR growth to get down to where you're guiding revenue growth. So what is it that you're factoring into the guidance for that slowdown? Because it seems like there's a lot of momentum with government deals, commercial deals, and even international.

So first of all, we're really pleased with our Q2 results. I think the contribution and the strong momentum we're seeing the last couple of quarter combined with the pipeline we see and really the market coming to us gave us the confidence to raise full-year guidance by approximately 10 million but the guidance philosophy really hasn't changed we want to continue to guide in a responsible way at the same time we feel very good about the second part of the year and we're very excited for for what we have ahead so

I think we feel very confident about the second part.

Our next question is from Matt Hedberg of RBC Capital Markets. Please state your question.

Hey, guys. Thanks for taking my question, and congrats really on a very strong quarter here. Yaki, I'm wondering, you didn't talk about it, I don't think, in your prepared remarks, but I'm wondering if you could talk about the integration status on polarized markets. And remind us how you expect to monetize that as really you wire up additional cloud data stores.

Hi, Matt. It's still early stages, but we're really hitting all the internal milestones, and we are extremely happy with the initial interest. Without a doubt, the initial interest is, you know, by 2020. by far exceeding all our expectations regarding actually all the platform that they support. We go on the team significantly. We put massive investment in this part of the business. Our most senior executive in technology side, David Bass, our CTO and head of engineering, he's personally responsible, and it was just an organic part of our roadmap. We just saw that it's a very interesting dynamic to understand regarding the market. We just saw that the data keeps exploding on-prem, but a lot of this sanctioned repository is what we call a lot of applications going to going to the cloud and in the cloud what you see is a lot of the data protection that you see with file system obviously we have just huge success with office 365 and you see the same with box with google you know where you have obviously a octa zoom salesforce is a is huge a s3 in aws just a Big, big, big challenges. And this is a big blind spot for the CISO. If you think about it, this is where the critical data is. And the three use cases are big there. It's very hard to make sure that the right people can access the right data. Virtually impossible to understand what people are touching, to do forensics, to get to root cause, and to understand what is critical. And also, these applications are interconnected. And you see a lot of lateral movement. So this year, we don't think that we'll have a material revenue contribution, but we think that it will be big, both these prospects and customers. So, you know, it's a SaaS solution. It's in the... It's in the cloud, but we believe that it's increasing drastically the total available market and our ability to sell licenses to customers. One thing we see in Veronique that's more is more. You sell more licenses, you get more to automated value, then customers are buying more, and we definitely see a clear path to get to customers. high double digit licenses within our customer base. So we are very excited about the opportunity and definitely it's a short term the time to market in organic part of our roadmap.

Our next question is from Brent Phil of Jefferies. Please state your question.

Hey guys, you have Joe on for Brent. Really appreciate the question. Just kind of want to follow up with Sterling's question and ask it a different way, but how should we think about incremental ARR seasonality as we move throughout the year? Any reason it would be less pronounced versus last year? I know 2Q is relatively similar to 1Q in terms of incremental ARR at it.

So there's two parts to that question, and I'll try and address it from the two angles. In terms of seasonality of the business, not so much the ARR. I'll touch on that in a second. The seasonality of the business is very much the same. where Q1 is the lowest quarter, Q4 has historically been our largest quarter in dollar terms. I think when you look at the ARR and the revenue, apart from the fact that, you know, ARR grew 39%, the revenue grew 33%, which we're very happy with, when we talked about kind of those metrics converging, I think you need to look at that on the recurring revenue component, really on a 12-month trading basis. And the revenue recurring component is the subscription and the maintenance. And when you kind of look at those two, they're very much closer. And I think when we look at the second part of the year, we have very strong momentum. We have very strong pipeline. And we feel very confident going into the second part of the year.

Our next question is from Saket Kalia of Barclays. Please state your question.

Great. Hey guys, thanks for taking my question here. Maybe this is something for both of you to tag team, but, you know, Yaki, Guy, I was wondering if you could just kind of talk a little bit more about the increasing number of licenses per customer, right? It feels like that's been a theme for several quarters now. Why do you think that's happening? And maybe as part of that specifically for you, Guy, how do you think about that sort of increasing licenses per customer vis-a-vis a metric like net revenue retention? Sorry, there's a lot there, but does that make sense?

Yes. So thanks for the question. So I think in terms of just number of licenses, it's just very interesting what is happening. So obviously because of COVID, you see this explosion in, you know, everybody walks from home and you have this many laptops, but what's happening is that you can't define a perimeter anymore. You still have data on-prem, people accessing, and it's growing. This is very important to understand. And just tremendous adoption of Office 365 and other SaaS applications that they are really geared towards collaboration that creates a massive... security, massive security challenge. And what happens also with the function data repository is that you're starting to have less and less data on the endpoint. And, you know, everything is much more like your phone and everything connected to the central repositories. So if you really want to protect your digital assets and protect it in the most efficient way, you need to go from first protect the digital assets and then go, you know, obviously to the network and active directory and then to the endpoints itself. This is the most viable way to protect your data. And this is something that slowly but surely in the last two years, organizations understand more and more. So the one thing that is really driving it that you want more coverage, you want to make sure that you're protecting 365 and you want to make sure that you're on Azure AD and then you have all the virtual machine there, you know, Windows and Unix and all of these good stuff. You must make sure that it's protected. So this is one thing that is happening. The other thing that's happening is automation. You want to classify the data automatically. You want to make sure that you're doing automated remediation, which is very important. And also, you need a lot of enrichment. So if something is happening, you have an alert, you really want to understand immediately what happened and get to the root cause. And these are three things that we're definitely doing very well. And the other thing that happens is that We see like 365 that really exploding for a socket. We also see it with other SaaS applications, you know, from obviously Slack and Salesforce to GitHub and, you know, Box and Google and stuff like Okta and Zoom. You have a lot of data, a lot of collaboration and tremendous amount of risks. And a lot of the SaaS application, you have the data protection problem. You have the insider threat problems and APT problems and also configuration problems. You can do just one mistake because it's so much geared towards collaboration, and you open the system to the public Internet, and this is why everything that's going with data advantage cloud, based on the polarized acquisition, you know, it's just we believe that this is something that can be, you know, big and maybe even bigger than everything that related to 365. So I think what is happening, again, gradually, is that if you want to protect your data, you need a solution like Voronis. And because of the fact that we have such a moat and it's just, you know, almost uncontested, you need to get to us. So this is what happened. And we see it in the reliable way that we can close deals and people with time are just buying more and more, really a standardization play.

And just to add on that from a numbers perspective, I think the KPI that we provide on customers with 500 employees or more that have four or more licenses and six or more licenses, the growth there is really, really strong. Going from 58% to 68% and going from 24% on the six or more to 35% is a great indication that we're selling the platform. We also talked about the fact that new customers are buying in their first initial purchase between five to six licenses, and that's approximately double the amount that they purchased under the perpetual model. And when you kind of combine these things together, when we announced the transition, we were hoping for a three-year break-even based on the price list. And when we look at kind of the behavior of those new customers, when we're selling kind of that double number of licenses to new customers, we're able to reduce the time to break even significantly. So that's very encouraging. But on top of that, The fact that they're consuming more of the licenses is actually providing them more value, and then later on they come back and buy even more. So all of that is kind of working for us very, very well.

Our next question is from Rob Owens of Piper Sandler. Please state your question.

Hi, guys. Ben Schmidt on for Rob. Thanks for taking my question. Wondering if you can talk a bit about the contract value boost. that we should expect from adoption of the new Data Advantage cloud licenses. And related to that, as we think about more data moving to the cloud, can you just talk about how much of your business you think these cloud data stores could become?

It's still early stages, you know, and everything is very initial, but we believe that, you know, now we just see traction growing You know, but this is, you know, it's very preliminary. We see traction around all the repositories that we are covering, and just what we see that is also interesting, but the data is just going on-prem, and in the cloud and more SaaS applications going to the cloud. And you have a lot of them, but several that are core usually are interconnected. And these are the ones, you don't need to cover everything that you need to cover. So we just believe that this footprint with time will increase within our customer base and we can get more of these customers. But we still need to see how we sell it, how customers will buy. These are initial status, but everything we see now

is very, very encouraging.

Our next question is from Mike Sikos of Niedermann Company. Please state your question.

Hi, team. Thanks for taking the question here. I did want to ask about, I guess in the final comments for the prepared remarks, there was a comment around pipeline and your ability to execute and capitalize on this. And I did Just want to frame it. So my understanding here is that if you have a new customer coming on and taking more of the solutions up front, we're talking about five to six of these different licenses. So the offering itself is more consumable today. They realize value that much quicker, and then they're coming back and growing. And alongside that dynamic, you guys are also taking the time to make sure you're investing both in your platform as well as in your sales and marketing go-to-market motion. Are all these different factors playing into the strong pipeline that you guys are talking to? And maybe the other additional point, can you help us better understand the strength of that pipeline? Are customers going through their sales cycles quicker as a result of this as well? Anything there would be incremental. Thank you.

Thanks. What we see primarily is just the quality of the pipeline because of the offering and the market condition. So, you know, we just have overall better coverage. You know, enterprise sales always take time, but we just see that in a much more predictable way, we can go, you know, upmarket this customer, you know, 1,000 to 50,000 users. and lend the large deals and once we sell to the customer enough licenses up front usually we can sell them more and more with time because i think that there is this gradual realization that you know you need to protect your data where it lives this is where it's vulnerable and this is how you're doing it with varonis and also that data protection And threat detection and response and compliance and privacy really stemming from the same problem and you need the same platform. And this is what we see, just better quality of pipeline. We definitely see that CISOs and even much more boards and the management team just looking at the digital assets and saying how we are going to protect it. And once you do it and we are there, we can run with a high level of confidence a sales campaign that we know how it will end. And usually we also have very good visibility to the overall customer lifetime value. In terms of just the quality of both of these metrics, the quality of both of these metrics really increased drastically.

And just to add some color on that from a numbers perspective, when we look at kind of the comparison between the perpetual model and the subscription model, and we talked about kind of that three-year break even, probably easier if I give some sort of a simple example just to kind of break down how we're enjoying that higher customer lifetime value. If you take a customer that bought, let's say, a $120,000 perpetual deal, with a 20% maintenance on that deal, you would get 20K in year two and year three, which would kind of add up to $160,000 overall dollars from that customer over a three-year period. And we priced subscription as 45% of that first initial purchase. So let's say 54,000, which gives you that three-year break even. But because we've sold double the number of licenses to that new customer, and the discounts have really stayed firm, you're able to sell, let's say, roughly around 100K in that year one, but now instead of getting $20,000, which is that maintenance of perpetual, we're getting the same revenue stream, and we have the ability to expand because we're providing more value to that customer. So that's really the beauty of the model and why this model is so powerful and allows us to have that break-even period significantly less than three years.

Our next question is from Hamza Fadarwala of Morgan Stanley. Please state your question.

Hey, guys. Thanks for taking my question. Just wanted to maybe get a little bit more color on the pipeline as it relates to federal heading, you know, in Q3 in particular. Just an update on, can you give us any sort of rough sense of, how much of your sales are coming from that vertical and how that pipeline has been coming together after some recent product announcements and some go-to-market initiatives there?

Yes, hi. We are entering the quarter with a good pipeline. We have a great team in place, and we're positioned to do very well. Obviously, this is the quarter... for this is the quarter that the federal doing a lot of business. And, you know, we again, we positioned to do very well. And obviously, we are going to update on the November call.

And the federal has been roughly mid single digits out of total revenue. We have a great team, like Jackie said, and we believe that that percentage can be higher. But it's it's still to date has been in that range. I know other companies had a much larger component of their business coming from federal, and we believe we can continue to expand there.

Our next question is from Chad Bennett of Craig Hallam. Please state your question.

Great. Thanks for taking my questions. Nice job on the quarter again. So just maybe now that we're maybe in our second year-ish of kind of scale net expansion in the business, maybe I'm cutting you short, but just are we at a point, just because you're seeing so rapid license expansion, whether it's up front or just on cross-sell, up-sell, are we to the point where we might be seeing kind of co-terming or early renewals that may either good or bad impact kind of billings for a quarter positively or negatively, or is that not a real issue at this point in the model transition?

So we don't really provide any color on the billing, and I wouldn't say that we've experienced any changes that are related to billings being pulled into the quarter. I will say that every renewal is an opportunity to upsell, but we are seeing many customers that aren't even waiting for that renewal period and are expanding and therefore co-terming their deal and extending that, and that's been very positive for us. But we see that continuing because the more licenses we sell, as we said before, the more value the customer is benefiting and the more automation they're getting with the product, the happier they are, and therefore they're coming back and buying more.

Our next question is from Shal Eyal of Talon. Please state your question.

Thank you. Hi, good afternoon, guys. Good job. Yaki, I wonder, you gave an example of a Fortune 500 company in your prepared remarks. And is some of that acceleration has to do with you guys going higher within the enterprise? And, you know, even the enterprise could be categorized into, let's say, A couple of buckets, employees with 5,000, 10,000 and above. But does it have something to do with that as well, the nice acceleration that we're seeing? I know you've indicated that enterprise sales are a little longer. That's understood. We all get that. But could it be that this acceleration is also hinged on that?

We definitely, you know, going up market, we always sell to large accounts. But now, you know, they understand very well what we do. They use the product. So we definitely go there and, you know, can reliably go there and know that many times, you know, in a predictable way, we are winning the business. But also, you know, customers with 2,000, 3,000, 5,000 users just buying more and more. The thing that the most important trend that we see is once you have, you know, licenses, you're just buying more and you get this automated value. So just the overall customer lifetime value is increasing and we just see an expansion of the platform of the use cases.

So, you know, it's just a bit of everything.

Our next question is from Dan Ives of Wedbush Securities. Please state your question.

Yeah, thanks. Can you just geographically just talk about U.S. versus Europe in terms of penetration, different trends that you're seeing there, especially when it comes to expansion of license deals?

Obviously, the U.S. is a much bigger business for us, but the overall trends, we see the overall trends the same. If you have critical data You know, someone wants to steal it, and as a data-driven enterprise, your capacity to create and share information really far exceeded your capacity to protect it. And this is something that everyone understands. So just in terms of the opportunity, you know, we definitely see that we can get to, you know, double-digit licenses within the customer base. All the platforms that we cover is where they run the business, and it's very important. that if you want to protect your data, you need Varonis. And this is just a gradual process that is happening in the last few years and works very well for us, but it's just happening worldwide.

Our next question is from Mark Chappelle of Benchmark Company. Please state your question.

Hi, thank you for taking my question. Nice job on the quarter. Yaki, I realize that data protection cuts across all industries, but are you seeing certain verticals accelerate their adoption of data production more so than others over, say, the last couple of quarters?

It stays fairly the same. We also see that other verticals that may be harder to close large deals are really starting to participate. We just saw a digital transformation that has a lot of benefits but can have a lot of diminishing returns if the data is not protected. So we just see these, you know, everything that is happening is, you know, it's gradual, it's a gradual process, really pushing organizations to think about how they need to protect their data, and you really need a trust foundation in order to function as an organization with critical data, you know, intellectual property, customer data, business partners data, employees data, and this is something that Varonis enables organizations. And, you know, we just see it across all verticals, and, you know, just across verticals, we just see that gradually it's becoming a top priority.

Our next question is from Jonathan Rookhaver of Baird. Please state your question.

Yeah, hi, good afternoon. So ransomware has been a rising threat back there for several years, and we know it's a clear use case for Varonis. So I'm wondering if you can just, you know, talk about that use case in light of the increasing number of vendors that tout capabilities to protect against ransomware, including, you know, EDR vendors, XDR and SIM vendors. Just, you know, what are the competing technologies you see the most, and how does Varonis perform relative to those different approaches?

Thanks for the question. So, you know, ransomware is a form of malware that comes in and encrypting your data. You try to sometimes encrypt the data on the local disk, but with time you see less and less data on local disk, and then it's going to the shell repository. And where these files reside on file shells, on file servers and NAS devices, and also on collaboration platforms like Like 365, SharePoint, and OneDrive. So the way that it works, if you are able to bypass the endpoint, which is not such a hard task because you can bypass the EDR, or you have a machine that is not patched, or a machine open to the internet, or just some VDI that you can't put an endpoint, there are a million ways to get in, then the problem that you have is the blast radius. So as we said, in most organizations that don't have Voronis, sometimes 90% of the files that the random employee can access is not relevant for them. And this is what they need. They don't need to do anything special. They just need to take the permissions that you have to encrypt massive amount of data. So once they bypass the perimeter, we're really the only game in town. Nothing else will help you. So we sit on this data repository and any abnormal behavior, see what is going on. So what we are doing immediately, we detect it, we can stop the overall encryption, and then we can tell you what critical data you need to restore. And also with our edge product, we can help with the infiltration and exfiltration of data, because you see, they take the data out, and then they starting to threaten you that they are going to release it and usually releasing it in piecemeal. This is how it works. So, you know, there is the outer layer, which is, you know, you have so many endpoints and so many places that you need to protect one misstep and they are in. And then you have the data itself. So we are taking the data that they will want to encrypt and we want to steal. And this is what we are protecting. So this is something that organizations understand, and we definitely see that we are top priority for this ransomware. The other thing also to understand the way that the market's working, sometimes, you know, you see some kind of an attack, and then there is a lot of noise, and everybody say, you know, we can protect, and you see these emergency spending. But with time, when the dust is really settling and organizations are doing this deep thinking of, what i need to do in order to be protected where is the biggest a a bank for my back what is the biggest return on investment they usually come to us and this is something that we saw you know as you saw that the really the market evolved in the last four years every time something like that happened in the short short term we benefit but sometimes less than other companies but over time we benefit much more we benefit from this we benefit from stuff like you know, GDPR and HIPAA and all the other regulation. So this is definitely a trend that we see that, you know, something external is happening. All the market is alert. There is the immediate reaction, but then there is just the ongoing reaction. And this ongoing thoughtful reaction, this is something that we believe is benefiting us in a big way and elevating us in the priority and really with time. putting us in the place that, no, it's a Voronis first. I want to protect my data. I need Voronis. Because when everything's said and done, if you look at most of the security solutions out there, they are in order to protect data. You have all these vectors in order to protect data. So we're just starting to, you know, in the last four years, we see this realization. Let's start from the data itself. Let's make sure that My data is protected. And as organizations are using more and more repositories, they need the same protection on these data repositories. So this is really what we see. And definitely, we believe that everything that happened with ransomware is accelerating the understanding that you need Varonis. And we also see that we had tremendous value in terms of ransomware protection to our customers that has the licenses that related to ransomware protection.

Our next question is from Shebly Seyrafi of FBN Securities. Please state your question.

Yes. Thank you very much. So I want to drill down on the growth margin line. It keeps increasing on a year-to-year basis. How much of that is because more and more customers are buying more and more licenses? And what are some of the other factors impacting the increase in gross margin? And also related to this, last year you finished with a gross margin near 89%. Do you expect a similar kind of pattern this year as well?

So the margin expansion is obviously, it's benefiting from strong renewals and the fact that selling to existing customers is quote-unquote cheaper. So we've talked a lot about the fact that we're committed to kind of year-over-year margin expansion, and you can see that in the years prior to that transition. We're very happy with the margin expansion as we sit here today, kind of the 450% basis points expansion. But at the same time, we want to continue to focus on the opportunity we have ahead. And that's why we're making the necessary investments, but still bringing some of it to the bottom line. So I think we've done a very good job of balancing growth and profitability. And we expect to continue to show margin improvements in the second part of the year and in the years ahead.

Our next question is from Eric Steppager of JMP Securities. Please state your question.

Yeah, thanks for taking the question and congrats and good quarter. First off, just on the point of ransomware, can you give us a sense for how much of a topic of discussion that is for your new accounts? Is that literally every account coming at it? Are they looking at Varonis as a tool for protecting against that, or how critical of a selling point is that? And then I've got a follow-up question.

You know, ransomware is like a commercial for Voronis. Think about what it does. It's coming in, bypassing the endpoint, then exposing the excessive access control, and without you knowing it, sometimes encrypting millions of files and just stealing them, taking them out of the organization. So you understand that, customers understand that they can easily bypass the perimeter, then they can go in, and you have this, what we call the blast radius, there is so much excessive access control and lack of alerting and auditing, and they can encrypt your data and then steal it. So I will not say that it's ransomware per se, but what ransomware does is really show you the problem. I need to protect my data, I need to protect it where it lives, I need to be able to alert on any abnormal behavior, then understand completely what happened, get to a root cause and do very effective forensics and get to the time to resolution very fast. I need a lot of automation. So I need automatically, you know, making sure the right people can access the right data. I need to make sure I'm on all the platforms, then understand what happened and from where. And this is something that we are doing extremely well. So ransomware is just, you know, it's another APT. You also need to understand that ransomware is just one kind of malware. A lot of these malwares are coming in a very stealthy way and you don't see them. So I think what happens is that also organizations understand that this is something that can happen. So it's just another... Just another event that organizations understand that it's happening. Also, I think what folks that enterprises understand is the level of sophistication. There are many drivers, but a lot of it is just also cryptocurrency. Many things that are happening is because of incentives. Cryptocurrency is very prevalent now, and it lets you monetize cybercrime easily. A lot of state actors level of cyber crime is really spilling into the commercial space. And if you have critical data, someone wants it, and you also have cyber insurance, and many times they are getting paid easier there than a few years ago. So there are just a lot of stuff that are really happening. that folks understand that if you have critical data, someone wants it. There are many ways to get in, and you need something like Voronis. And again, it's part of this gradual process that organizations understand that they need it. And we believe that eventually it will be inevitable.

If you want to protect your data, you need a platform like Voronis.

Our next question is from Roger Boyd of UBS. Please state your question. Sure.

Oh, terrific. Thanks for taking my question. Congrats on this quarter. I guess I'm curious, you spent the last couple of years starting to focus more on the larger enterprise. And I'm wondering with the introduction of Polyrise and that being a fast delivered solution, does that change the opportunity you see with maybe the mid market or SMB or is the focus still on the high end of enterprise for the time being?

When we talk about the high end, we talk 1,000 plus. So it's not that we are telling, you know, 20,000 and about 1,000 plus, which is a massive market. But yes, we can sell only, you know, Anybody that files emails and has critical business data with some kind of collaboration and sharing, they need Voronis. But, you know, we just want to make sure that we can really scale in the most efficient way. And what we are doing is moving the needle. We have an extremely good inside sales team. They're doing very well for us. They are critical for us. But by and large, when we're talking about the lion's share of the revenues, we are going to the enterprise. And this is really the overall sales motion. But we can sell to everyone, and we are expanding the inside sales team. They're very important for us and doing an amazing job, and we are adding a lot of value to smaller organizations.

Our final question is from Andrew Smith of Barenberg Capital Markets. Please state your question.

Hi, guys. Just understanding that it's very, very recent, was there any benefit at all to ARR from Data Advantage Cloud this quarter? Thanks.

No. No. It's early stages. And we also think that this year they will not have a material contribution. But, you know, usually before we sell a product, we know. We see the interest. We see how it works. We understand. install it in Voronis. We understand how the marketing efforts are working. And we also see the exposure within the customers when you install it on Google and install it on Box and Salesforce and Slack. You just see the tremendous exposure and the dangers from the lateral movement. And we strongly believe that it's the biggest blind spot that CISOs have today. I just think that there is so much so much damage that when you see these breaches that organizations are experiencing and they even don't know. So we strongly believe that there is tremendous opportunity there and what we have done with 365 we can do with these SaaS applications. And we also think that with time, you will have more and more critical data with these SaaS applications. They will be interconnected. And we are very excited about what we can do with SaaS. And we also think that our mode, our technological mode, You know, this functional relationship between users, data, permissions, content is very relevant there. And the data on-prem is not going anywhere. And we can really be the task foundation of this digital transformation and just make sure that organization can realize all the tremendous productivity benefits without the downside of data breaches, stealing data, insider threat, compliance problems, and so on.

And just to add from an ARR perspective, like Yaki said, there was no contribution coming from DA Cloud. But the fact that ARR grew 39%, and when you look at kind of Q1 and Q2, both of them grew 39%. But we see Q2 ARR is a much stronger 39%. That's really due to the fact that Q1 ARR growth was against the weaker comp. And if you remember, we had kind of the shelter in place in the last two weeks of Q1 2020 and that had an impact on our results. So this quarter ARR as a whole is really a strong indication of the demand environment and the execution we had this quarter.

We have reached the end of the question and answer session. I will now turn the call back over to Jamie Orestia for closing remarks.

So thank you everyone for joining the call today and for your interest and please don't hesitate to reach out with questions and we look forward to speaking with you this quarter. Have a good night.

This concludes today's conference. You may disconnect your lines at this time. Thank you for your participation and have a great day.