Varonis Systems, Inc.

Greetings and welcome to the Verona Systems Inc. 4th Quarter 2023 Earnings Conference Call. At this time, all participants are in listen-only mode. A brief question and answer session will follow the formal presentation. If anyone should require operator assistance during the conference, please press star zero on your telephone keypad. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Tim Peirce of Investor Relations. Thank you, Mr. Peirce. You may begin.

Thank you, operator. Good afternoon. Thank you for joining us today to review Varonis' fourth quarter and full year 2023 financial results. With me on the call today are Yaki Fidelson, Chief Executive Officer, and Guy Melamed, Chief Financial Officer and Chief Operating Officer of Varonis. After preliminary remarks, we will open the call to a question and answer session. During this call, we may make statements related to our business that would be considered forward-looking statements under federal securities laws, including projections of future operating results for our first quarter and full year ending December 31st, 2024. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned Forward-Looking Statements and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation for the most directly comparable GAAP financial measures is also available in our fourth quarter 2023 earnings press release and investor presentation, which can be found at www.veronis.com in the investor relations section. Lastly, please note that a webcast of today's call is available on our website in the investor relations section. With that, I'd like to turn the call over to our chief executive officer, Yaki Fidelson. Yaki?

Thanks, Tim, and good afternoon, everyone. Thank you for joining us to discuss our fourth quarter and full year 2023 performance. Today, I would like to review our fast transition progress and discuss key drivers of our business in 2024, and how we are positioned to capitalize on them. One year ago, we discussed our initial excitement on Voroni SaaS. At the time, we talked about how we had invested heavily for years to build a world-class cloud native SaaS offering, which allowed our customers to secure their data automatically. We simplified our packaging to include automation that we know our customers need. We had confidence in our product, our team, and our plan, but it was early and we had a lot to prove. Despite ongoing macro challenges, TASERR grew from several million dollars in 2022 to approximately $125 million at the end of 2023. We are proud of the momentum we have achieved so far and how that set us up for 2024 and beyond. Our fourth quarter results reflect the sustained momentum of our SaaS platform, and I'm happy to announce that SaaS ARR represents approximately 23% of total company ARR at year-end. This progress gives us the confidence to accelerate our transition timeline. which we now expect to complete by the end of 2026, a year earlier than our initial . Fourth quarter SAS mix came at 66%, with a fall guidance of 60%. ARR grew 17% year-over-year to $543 million, and we generated $54.3 million of free cash flow in 2023, up from half a million dollars last year. The macro environment remains stable during Q4, and we continue to see a high level of deal scrutiny with multiple levels of approval. Overall, we are excited by the progress of our SaaS transition against this headwind. Guy will review our Q4 results and our 2024 guidance in more detail. We are still in the early innings with our transition to SaaS delivery model and the benefits we expect to realize are just getting started. But Q4 and 2023 overall marked a strong step in the right direction, and I'm very grateful to the entire Voronis team for how they have executed so far. Turning now to our strategic priorities for 2024, of course, Continuing our transition to SaaS will be a primary focus. And to briefly remind you, there are three key benefits our SaaS platform provides to our customers. Customers can achieve automated outcomes, which means we can ensure that data is protected with very little effort. SaaS is quicker to deploy and operationalize because of significantly lower infrastructure and personnel investment. And SAS is easier to maintain and upgrade. Additionally, there are three key benefits that we realized. They are shorter cell cycles, larger initial length, and margin benefits over time. We started to see evidence of these benefits in 2023 and expect them to continue in 2024. In addition to executing on our SAS transition, the dangerous threat environment is creating increased awareness for data security. Within that backdrop, we see three additional drivers. Our new managed data detection and response service, which we call MDDR, the adoption of enterprise-generated AI like CorePilot and Einstein, and increasing compliance requirements such as the new SEC disclosure rule around cyber events. With that, Let's tackle the overall environment and each of these drivers in more detail. Our foundation for innovation has been simple, to follow the data and automate. With SAS, we have been able to innovate much faster. We have gone wider with more coverage of enterprise data stores. And we have gone deeper, adding more automation so that our customers can achieve The business outcome is very little effort, but this is just the beginning. One year ago, we introduced proactive incident response, which provides our SAS customers with assistance from our world-class incident response team. Today, we are introducing the next evolution of this offering with the world's first managed data detection response service, which comes with an SLA and 24 by 7 coverage. Varonis MDDR is a paid service that takes responsibility of managing Varonis out of our customer's hands and places it with us. Customers will no longer have to monitor the Varonis alerts. Instead, our teams will leverage behavioral analysis, machine learning automation, and our unique metadata telemetry to protect them. We introduced this service because no security team or such team And MDDR builds upon the automation enabled by our SaaS platform and maximizes the return on investment. Another driver for us in the year ahead will be the impact of generative AI in large language models. We spent some time last quarter discussing what the stairwind means for Voronis. But to briefly review, generative AI represent both opportunity and risks for companies. The growth of AI has the potential to generate significantly more data and also significantly more risk, which in turn increases the need for automated data security. Without robust data security strategy, AI will reveal sensitive data to the wrong machines and people. Most generated AI tools utilize existing access controls which leaves organizations overexposed to this threat. Companies will also need to ensure that sensitive data is not being used when training LLMs. And hackers will leverage these tools to craft better phishing emails, create malware, or even search for data once inside an organization. Simply put, generative AI is forcing organizations to take a hard look at their data and they are realizing that access control must be correct to ensure sensitive data can be exposed. These are core use cases for Voronis. In support of this, two weeks ago, we announced a strategic partnership with Microsoft to help companies safely harness the power of Microsoft CoPilot. This integration helps customers improve their Microsoft 365 data security posture before, during, and after deploying CorePilot. As a result of increasing risks and regulation, we are seeing data security become more of a priority. Varonis is in a unique position to capitalize on this as we help organizations protect their data like a bank watches its money. Banks spot financial crimes by analyzing financial transactions. Varonis spots cyber crimes by analyzing data transactions. Our customers have Voronis watching the data and the infrastructure close to it, which limits the likelihood of damage. In addition to watching data usage, we lock in sensitive data, visualize access to it, and automatically lock it down. This allows companies to realize more value from their data, leverage it safely, and keep it protected. The world has never been more reliant on data than it is today, And if you dissect every major breach, the one common threat is that nobody was watching the data. Take for an example what happened at the large ride-sharing company with a very sophisticated security stack, but no data security platform. A group of teenagers was able to bypass the multi-factor authentication, access file shells, and steal critical data. It wasn't until the hacker posted messages in Slack but they knew they were breached. The biggest threats can come from insiders. Think about Wikileaks, Snowden, and the Pentagon breach. These breaches highlight the damage that can happen when insiders have access to far too much data. When the perimeter fails and you have a rogue insider, we are best positioned to catch it. Data breaches And the danger of ransomware used to be something we had to explain. And today, every organization knows that they are at risk. The increasingly dangerous threat environment has led governments to enact regulation. For example, the Security and Exchange Commission rule, which took effect in December, required public companies to disclose cybersecurity breaches in a form 8K within four business days after determining it has a material impact on the business. It also puts more structure into how they disclose their cybersecurity risk management strategy and governance while also detailing management in the board roles and expertise in handling these risks. This increased scrutiny on U.S.-listed public companies has raised awareness for cybersecurity, and we believe Veronix is well-positioned to help companies comply with these regulations. With that, I would like to briefly discuss a couple key customer wins from Q4. A real estate company with 5,000 employees became a new customer this quarter. The organization had an executive mandate to find sensitive data across its hybrid environment. During the risk assessment, our team discovered over 250,000 records containing PII and thousands of employment contracts and mortgage documents that were open to everyone in the organization. Our incident response team even stopped multiple data breaches attempts. This customer evaluated Voronis and two other vendors, but ultimately, Veronis was the only one who could automatically ensure their data was protected. As a result, they purchased Veronis SaaS package for Windows, Microsoft 365, Edge, AWS, and S3. We continue to see strong interest from customers wishing to convert to Veronis SaaS. One example is a large municipal government that became a Veronis on-prem subscription customer in 2018. They were leveraging our software to find and protect sensitive data and to monitor abnormal user behavior in a single department. The success this organization had protecting their on-prem environment enabled our team to win the mandate for the broader municipal organization. This quarter, they converted to Veroni SaaS and expanded from just 500 users to 25,000 users. SAS is the ideal fit for them because of automated remediation, improved scalability, and infrastructure saving. They purchased SAS package for Windows, Microsoft 365, Active Directory, and Exchange Online, which will allow them to protect their data without training their security teams. about a month ago, we had our first kickoff event here in New York. With the amount of changes and magnitude of innovation we had in 2023, it was important for us to bring our team together. And I cannot speak enough about the level of energy and enthusiasm during the event. I would like to thank our team for their tireless effort as none of this would be possible without them. We are excited about the reception of our SaaS platform and the momentum of our business. Leave me optimistic as I look ahead, not only to 2024, but also beyond as we approach our $1 billion ARR target. With that, let me turn the call over to Guy.

Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. We are pleased with our fourth quarter results which reflect the strong adoption trend of Rona SaaS against the challenging but stable macro backdrop. Our SaaS transition continues to gain momentum, and after just one year in the transition, SaaS now represents approximately 23% of our total company ARR. As a result of this momentum, we now expect to complete our SaaS transition in 2026, which is one year earlier than previously outlined. As a reminder, our transition will be considered complete when 70% to 90% of total company's ARR is coming from SAS. In the past, we've described the transition as occurring in two phases. Phase one began when we introduced the product and is the phase where we focus on selling SAS to our new customers. Phase two of the transition, which is converting our installed base of on-premise subscription customers to our SAS platform, is planned to begin in earnest during the second half of this year. We expect that the ramp-up of this phase will not be linear and anticipate growing momentum in each quarter of 2024 and further accelerating in 2025 and 2026. We ended the year with ARR of $543 million, which increased 17% year-over-year, and we generated $54.3 million of free cash flow in 2023, up from half a million dollars last year. These metrics illustrate our ability to drive top-line growth, margin leverage, and cash flow generation even in the first year of transition. Our fourth quarter SaaS mix represents 66% of new business and net new upsell ARR versus our guidance of 60%, which led to a full-year SaaS mix of 57% versus our guidance of 55%. we again saw more of our existing customers converting to our SaaS offering. In the fourth quarter, we had approximately $15 million in conversions of existing customers, impacting our Q4 revenue. To be clear, this $15 million represents the renewal amount that was previously booked as on-prem subscription, but which converted to SaaS during the quarter. Because SaaS revenues are recognized randomly, When these $15 million worth of customer renewals convert from on-prem subscription to SaaS, it causes a headwind to our reported revenue and operating margin. The $15 million revenue impact from this quarter does not include the uplift that we realized from these conversions, which is accretive to ARR and free cash flow. We ended the year with approximately 4,950 subscription customers, which was up 14% year over year. our dollar-based net retention rate for subscription customers was 107% at the end of 2023, adjusting for FX. Turning now to our fourth quarter results in more detail. As a reminder, ARR, free cash flow, and ARR contribution margin are the leading indicators for this transition. The shift from on-prem subscription licenses, where approximately 80% of the deal's value is recognized up front, to a SaaS delivery model, with fully ratable revenue recognition, will cause initial headwinds on the traditional income statement metrics. As we said previously, the faster we progress through the transition, the more headwinds we will experience to our traditional income statement metrics. We view these headwinds in a positive light. In the fourth quarter, we continue to see deal scrutiny with multiple levels of approval, which are still impacting our results. But if I had to describe the environment in one word, I would use the same word I used last quarter, which is stabilization. Q4 total revenues were $154.1 million, up 8% year over year. During the quarter, as compared to the same quarter last year, we had approximately a 16% headwind to our year over year revenue growth rate, as a result of having increased SaaS sales in our bookings mix, which are recognized randomly, versus the upfront recognition of our on-prem subscription products. Subscription revenues were $129.2 million, and maintenance and services revenues were $24.9 million, as our renewal rates were, again, over 90%. Moving down the income statement, I'll be discussing non-GAAP results going forward. Gross profit for the fourth quarter was $136.4 million, representing a gross margin of 88.5% compared to 89.9% in the fourth quarter of 2022, despite significant revenue headwinds, which were largely offset by SAS platform efficiency. Operating expenses in the fourth quarter totaled $109.2 million. As a result, the fourth quarter operating income was $27.2 million, or an operating margin of 17.7%. This compares the operating income of $26 million, or an operating margin of 18.2% in the same period last year. During the quarter, as compared to the same quarter last year, we had approximately a 10% headwind to our operating margin as a result of having increased share sales in our bookings mix, which are recognized fully ratable versus the upfront recognition of our on-prem subscription products. Fourth quarter ARR contribution margin was 13.4%, up from 4.5% last year. The significant leverage improvement, even during the early stages of the transition, reflects our ability to drive strong incremental margin while growing ARR and transitioning to SAS. During the quarter, we had financial income of approximately $8.1 million, driven primarily by interest income on our cash, deposits, and investments in marketable securities. Net income for the fourth quarter of 2023 was $34.3 million, or 27 cents per diluted share, compared to net income of $26.1 million, or net income of 21 cents per diluted share for the fourth quarter of 2022. This is based on $126.1 million and 126 million diluted shares outstanding for Q4 2023 and Q4 2022 respectively. End of December 31st, 2023, we had $744.8 million in cash, cash equivalent, short-term deposits, and marketable securities. For the 12 months ended December 31st, 2023, we generated $59.4 million of cash from operations, compared to $11.9 million generated in the same period last year. And CapEx was $5.1 million compared to $11.4 million last year. I will now briefly recap our full year 2023 results. Total revenues grew 5% to $499.2 million in 2023 as compared to 2022 We had approximately a 12% headwind to our year-over-year revenue growth rate as a result of having increased SaaS sales in our booking mix, which are recognized ratably versus the upfront recognition of our on-prem subscription products. Our full-year operating margin was 5.8% compared to 6.2% for 2022. In 2023, as compared to 2022, we had approximately a 10% headwind to our operating margin as a result of having increased SaaS sales in our booking mix, which are recognized fully runnable versus the upfront recognition of our on-prem subscription product. Turning now to our 2024 guidance. We continue to take a responsible approach to our guidance philosophy, which includes factoring in the continuation of long deal cycles and multiple layers of deal scrutiny throughout 2024. Our commitment to balancing top-line growth margin leverage and cash flow generation has not changed. While at the same time, we also see an opportunity to invest in order to capture the longer-term opportunity that we see and capitalize on the secular tailwinds that Yaki discussed. These investments are already baked into our guidance, which shows our ability to invest in the business while generating improvements in our North Star metrics. When we launched this transition, we committed to being transparent and also to providing metrics that accurately measure the health of the business. As we turn our attention towards the final phase of this transition, our main focus is now completing this transition, which means SAS is 70% to 90% of total ARR. In an effort to provide metrics that help you monitor our progress throughout the next phase, we will be providing SAS revenue and also SAS as a percentage of total ARR on a quarterly basis. At the same time, this will be the final time that we provide SAS mix as that metric measures the progress of phase one of the transition. Going forward, we expect the vast majority of new customers to purchase our SAS offering. For the first quarter of 2024, we expect total revenues of $111 million to 115 million, representing growth of 3% to 7%. Non-GAAP operating loss of negative 15 million to negative $13 million, and non-GAAP net loss for basic and diluted share in the range of negative 10 cents to negative 9 cents. This assumes 110.1 million basic and diluted shares outstanding. In the full year 2024, we expect ARR of $617 million to $625 million, representing growth of 14% to 15%. Free cash flow of $17 million to $75 million. Total revenues of $536 million to $546 million, representing growth of 7% to 9%. Non-GAAP operating income of $7.5 million, to $12.5 million, non-GAAP net income per diluted share in the range of $0.11 to $0.13. This assumes 127.7 million diluted shares outstanding. In summary, we are excited by the progress of our SAS transition, which is benefiting our three North Star metrics, ARR, free cash flow, and ARR contribution margin. The momentum of our transition coupled with the tailwinds of NDDR, the adoption of generative AI, and increased data-centric regulation, gives us confidence as we finish the initial stage of the transition and look to grow new customers and convert existing ones to our SaaS platform in 2024 and beyond. With that, we would be happy to take questions. Operator?

Thank you. We will now be conducting a question and answer session. If you'd like to ask a question, please press star 1 on your telephone keypad. Confirmation still will indicate that your line is in the question queue. And you may press star 2 if you would like to remove your question from the queue. For participants using speaker equipment, it may be necessary to pick up your handset before pressing the star key. In the interest of time, we ask that you please limit to one question. One moment, please. Thank you. Our first question comes from the line of Matt Hedberg with RBC. Please proceed with your question.

Greg, thanks for taking my questions. First off, congrats on the results. The SaaS momentum is impressive, but equally interesting is the free cash flow, and it's great to see both of those. I guess for one question, Yaki, can you talk a bit more about the specifics of the Microsoft partnership? I know there were some news releases this past quarter. Maybe a little bit more about the go-to-market functions in the channel. If there's any way to think about sort of the momentum, maybe the pipeline generation that Microsoft is generating. Thanks.

It's still early innings, but essentially, co-pilot for Microsoft is a tremendous productivity opportunity for organizations, but coming with a lot of risk. So what happened is that the co-pilot for business is going to digest Any data that they can get, and the data that they can get is access control, is related to access control. This is the security model that they are using. And without a product like us, 90% of the data on average that a user can access is not relevant for them. So think what will happen. They will create at a staggering rate high-value information product, completely out of policy, not labeled, that you don't know where they are. And this is massive risk. So they recognize that in order to close the blast radius automatically, you need us. And the other thing, if a tool like that is in the hands of a bad actor, it can inflict massive damage on organizations. So we are teaming with them. We are teaming with their sellers in order to make sure that we will be the foundation of getting a good control over the data before you are going to unleash these tools. It's important to understand that it's still early innings. They are still not in mass distribution with this product. It's coming up in every conversation, but we think that as they're going to release it, an organization will really understand the power of this and also the risks that come with it, But you really need to make sure that they are ahead of the risk, and we are well positioned to do very well. We are very excited about the opportunity.

Thanks, Jackie.

Thank you. Our next question comes from the line of Saqib Khalil with Barclays. Please proceed with your question.

Okay, great. Hey, guys. Thanks for taking my question here and echo the congrats on the quarter. Yagi, maybe for you, a little bit of a higher level question. You know, SaaS transitions in other areas of software have often expanded the total addressable market. And understanding that it's still early here in Varonis' transition, what are some of the anecdotes that you can see out there where you think your SaaS products are expanding significantly a customer spending on data protection. I think you mentioned a couple of customer examples, but I know you spend a lot of time with customers. Do you see some of that TAM expansion starting here with the move to SaaS?

Of course, and it's very tangible. So the way that you see it, it's really stemming from the value proposition. First, it's just tremendous amount of automation, and with ease, we can cover many more data repositories, but also with the MDDR, the automation, the threat detection response, the classification, the data protection. We can do so much more for customers. So if they buy our product now, we can really take all the, not all, but a lot of the operational load on us and make sure that they have a world-class security team that is completely oriented to data. And the expansion of the TEM in terms of innovation and, you know, you will also see it with the with what we are going to release in the future, but you see they're very aggressive, if you will, release cycles, and you see now, you know, Snowflake and more coverage. Is organization going to have more critical data repositories, and they will hit the critical mass in the marketplace? We are going to protect it. Just in terms of the value today, if you have Varonis, most probably you will not have a data breach, and you will not have a data breach automatically without without any effort. You just need to buy the platform. So it's from everywhere, from the value, from the way that you can expand, from the data repositories, our coverage, our automation. It's just increasing our time drastically. And also in terms of innovation, it's much easier for us to take a thought and to make it a commercial reality and really distribute it to the marketplace. We are very excited about our ability to innovate and the situation that is related to data. You see things like co-pilot. With co-pilot, you will have more connectors and stuff like that. So it's definitely expanding the need.

Makes sense. Thanks, guys.

Thank you. Our next question comes from the line of Hamza Fotowalla with Morgan Stanley. Please proceed with your question.

Great. Thanks for taking my question. Yaki, question for you. We're obviously seeing a lot of focus on the companies getting their data prepped for these generative AI deployments. Big focus on data security and governance around that. I'm just curious, as you're having more conversations with your customers and prospective customers, how often is that coming up for Varonis, and how do you expect that conversation to ramp throughout the year and ultimately drive more sales for your business. Thank you.

Thanks for the question. So it's really coming up with every single conversation. And I think that if you will take almost every CISO and ask them, you know, what is your main objective? They will tell you that the lion's share of the objective is to avoid a data breach. And the other part is to make sure that the infrastructure, obviously, you know, the application, you have uptime. Everything can really deliver service. And for us, With all the SAS, we really can make sure that you will, most probably you will not have a data breach. God forbid you have a data breach, the potential damage will be very small and we'll get to the root cause super fast. The reality today in organizations, they dissect every breach. You guys understand extremely well. It's almost always about the data. This organization has a very sophisticated, modern security stack. A lot of very smart people that manage security, but they bypass the perimeter and they don't see anything. It's all about the data. Then they need to bring an IR company. They pay them sometimes, you know, sometimes it's millions of dollars, and they can't say what damage happened on the data layer. This is a world that is upside down, and people understand it. Constantly they spend more on security, and they have more data breaches. And the way that you can, you know, and the way that a credit card issuer can't give you fraud detection without seeing the transaction, or you will never do business with the bank that can provide the ledger and can tell you if you have other identities or devices on your account, you know, it's the same with data. So we definitely see that organizations understand it and definitely things like co-pilot accelerate it because they, it's really, it's like ransomware, it's exposing the, it's exposing the problem. You know, ransomware, if one out of, thousands of organizations will get it or hundreds of organizations, I think that everybody will get CoPilot. So CoPilot is going to really expose the blast radius. So we feel that it can be over time, a very good opportunity for us. And we're also excited that we are joining forces with Microsoft.

Thank you.

Thank you. Our next question comes from the line of Brian Essex with JP Morgan. Please proceed with your question.

All right. Good afternoon. Thank you for taking the question. I guess maybe for Guy, would you mind unpacking your net dollar retention rate a little bit? And how might we think about that and the, I guess, factors that go into calculating that, whether it's customer growth, cross-sell, up-sell, and how might we expect that to drive kind of a better traction as we look into fiscal 24th?

Absolutely. When you look at kind of NRR in 2023, there were basically two factors that had an impact. The first one was the friction related to the transition in the first six months of the year. If you remember, we started the year, we're sitting here today at 23% SAS mixed out of total ARR and that only happened in one year. But, you know, we had to go through a lot and the first six months definitely had an impact in terms of the friction there. And the second factor was the macro environment, which we talked a lot about in terms of longer sales cycles and deal scrutiny. And that's definitely kind of the second factor that impacted NRR. I think as we look at kind of the opportunity, both with a customer lifetime value that we're generating with our existing customers, converting them to SaaS, that generates a tremendous opportunity for us to continue to sell to them and make them better protected on additional platforms. We're very excited about that. It's happened, kind of the whole conversion in 2023 happened in a natural way and it's been very, extremely encouraging for us. We believe that can accelerate in 2024. But even in terms of new customers, you look at the land, they're larger lands with the SAS offering and with the simplicity of the product and the fact that we are now offering the MDDR, which is really a game changer for us in terms of the offering to our customers, in terms of having them better protected in a much easier way. All of those are an opportunity for us to grow our NRR into larger and higher levels.

That makes sense. Congrats on the progress. Thanks very much.

Thank you. Our next question comes from the line of Joel Fishpin with Truist Securities. Please proceed with your question.

Thanks for taking the question, and again, good, strong execution. It was a good segue, the previous question of mine. I wanted to, Guy, I wanted to ask about the MDDR offering. Can you just give us a little color on how that will be priced and then, you know, what do you think the adoption curve looks like in terms of time to revenue?

It's a very good question. When you look at kind of our offering to date, we've offered the proactive incident response team for quite some time now. And the reception, the way customers have received it, has been extremely positive. So all we're doing right now is charging for the service that we've provided for quite some time. And I think as you look at kind of the MDDR, we expect it to generate a healthy uplift in terms of the ASP and what we can generate from our customers. So we don't expect us to become a service company. We believe that over time we can generate MDDR that is in licensed software margins. we feel that not only is it extremely beneficial for our customers, but it can also help with increased and improved renewal rates over time. It can help with the opportunity to upsell additional platforms that a customer would see the value and would want to be protected on multiple platforms. And at the same time, it's so appealing for customers that it can actually help with closing rates. So I think The MDDR has an option on all of those fronts. The way we've structured the comp plan in 2024 makes it a no-brainer for our reps to introduce it to our customers. So I expect the adoption to be extremely healthy this year. And I think it's a benefit for our customers, but also a significant benefit for us as an organization.

Thank you very much.

Thank you. Our next question comes from the line of Andrew Nowinski with Wells Fargo. Please proceed with your question.

Great. Thank you for taking the question. And congrats on a nice quarter. So I wanted to ask about total ARR guidance. You guys have outlined so many different positive growth drivers tonight. The mix of your SAS revenue is 23%. I think it's the fastest pace we've seen over the last four quarters. You're getting that 25% to 30% price uplift on SaaS. You're getting larger lands, as you mentioned. You've got the new integration, of course, with Microsoft and the MDR service. But your outlook for ARR implies a fairly steep deceleration. Given those growth drivers, why would we expect a deceleration in your ARR growth this year?

So when you look at kind of the math, and I think that the numbers that you look at, I completely understand the math that you're doing, and it makes sense. I think when you look at the prepared remarks, we had extremely bullish tone, and I do want to reconcile that with the guidance that we've provided. So, you know, as you look at us sitting here today, we've never had so many things working in our favor. You know, apart from the everyday increasing breaches that we've seen, happened for years, there's additional drivers and tailwinds that we've really never seen before. Yaki talked about the co-pilot, there's the cybersecurity SEC regulation, and also what we believe is a game changer for us, which is the MDDR, which we just introduced. But you have to remember, our sales cycles are three months on the shorter end and up to 12 months on the larger deals. So when you look at kind of us sitting here right now and looking at the philosophy that we've guided for in the past for many, many years, it's not something that we have done in the past to bake in positive assumptions into our guidance without seeing the data that supports it. So, you know, it's really a starting point for the year. We're sitting here in February, and there's a long year ahead of us. We believe that we will see those trends that I've talked about kind of work in our favor over the year. And as we have done in the past, we'll be happy to update our guidance as the year progresses. But as I mentioned, there's a lot of things that are working in our favor that we haven't seen in the past.

Yeah, it certainly seems like that. All right. Thank you very much. Thank you.

Thank you. Our next question comes from the line of Fatima Bulani with Citi. Please proceed with your question.

Thank you. Good afternoon. Thank you for taking my questions. Guy, this one's for you. I was hoping you could help unpack for us how much of the expected operating margin degradation that you're anticipating this year is more due to the fact that the transition is actually accelerating because you did pull forward that timeline. So, you know, certainly we appreciate the mechanical P&L impact of that. but just how much of that degradation on a year-over-year basis is tied to this sort of mechanical artifact versus some of your comments and the prepared remarks pertaining to a desire to reinvest in certain parts of the business. I believe you said some organic reinvestment. So just some directional help on that front would be great. Thank you.

That's a very good question, and I think it's a combination of some of the accounting in terms of – the cloud costs and the way they're recognized in terms of the expense in a radical way versus kind of the ARR where you recognize it up on the day of the sale. But there's also this understanding that there's a tremendous opportunity ahead of us and we want to take advantage of it. So when you look at kind of our philosophy over the last couple of years, we've been very focused on the top line growth and wanted to make sure that we show margin leverage and free cash flow generation. I think as we sit here today, We feel extremely confident about kind of the guidance that we provided during the investor day in March of 2023, about a 20% ARR contribution margin by 2027. So kind of when you look at the progression in terms of free cash flow, we've shown improvement from 22 to 23. And even in the guidance of 2024, there's a significant improvement there as well. ARR contribution margin moved significantly from 2022 levels to 2023 levels and the 2024 guidance as an improvement as well. So I think some of the investments that we're making today are ahead of what we want to see as a return to the ARR top line growth of kind of that 20 plus percent. So I think we're definitely making the investments to take advantage of a larger opportunity And we believe that with the tailwinds that we've talked about, there's a tremendous opportunity for us to take advantage of.

Thank you.

Thank you. Our next question comes from the line of Roger Boyd with UBS. Please proceed with your question.

Great. Thank you for taking the question. Congrats on the quarter. Guy, I want to go back to the conversion math. You converted a little over 30 million. from term license to SaaS this year, really without any sort of formal go-to-market behind it. Apologies if I missed this. I think you noted that you're expecting that to accelerate, but any rough-cut assumptions on what you're expecting in terms of conversions in 2024? And alternatively, kind of the puts and takes here around renewal timing, the sales ramp-up, which you noted will be kind of skewed towards the back half of the year. Thanks.

Absolutely. We finished 2023 with 23% SaaS sales, out of total ARR, so at $125 million. And our assumptions for 2024 is that we will finish at 46% SAS percentage out of total ARR. That basically means $285 million of SAS by the end of 2024, so a significant increase. That basically means 160 million of SAS ARR in 2024 a significant increase versus the 120 million of SaaS that we have generated in 2023. So obviously our assumptions are that there will be some significant increase in the conversions themselves, but also that the percentage of SaaS sold to new customers would be pretty significant as well. I think the overall understanding and the feedback that we're getting from our customers is that they prefer the SaaS offering because it's a better product. And in terms of from a commission perspective, our reps retire quota on anything on top of that renewal. So on the uplift that they get from an existing customer in that conversion, that goes towards their quota retirement. So it's actually a win-win. It's a win-win for our customers and it's a win for our sales team. And that's the best way to kind of incentivize. And that's why the 2023 has been a great surprise in the level of conversions that we saw. And our expectation is for an acceleration in 2024, which would bring us to that $285 million of SaaS by the end of this year.

Very helpful. Thank you. Thank you.

Thank you. Our next question comes from the line of Chad Bennett with Craig Hallam. Please proceed with your question.

Great. Thanks for taking my questions. Guy, maybe just a prior question. When you talked about the MDDR opportunity and the ASP difference, is there any way to kind of quantify kind of how material that uplift is or just the deal size difference you see?

in mddr versus you know a traditional sas deal so it's very early still but i can tell you that even uh as we sit here today and we just uh spoke to our sales teams about it during the sko that we had a couple of weeks ago we've already seen that they've adopted it in a in a very healthy and positive way we've actually seen some of the quotes where they go back and get an uplift I don't want to put a number quite yet just because it's so early, but the MDDR does allow us to generate a pretty significant and nice uplift, but at the same time, provide customers the value with less of a need of people to actually be protected. And at the end of the day, that's the best thing, the win-win with our customers.

The win-win is that... There is, you know, many customers that using managed security service providers and at times get little value in terms of data breaches, and they can be completely protected with us. So there are budgets for it. And the other thing, in order to get the most from the MDDR, you need a good footprint of the platform. As much as you have more licenses with us, if you will, more bundles, you get You get more value. And regarding our AI capabilities, we invested tremendous effort with Athena AI, not just for our customers, but also for our analysts. We are selling software. So we build robots and interfaces to make sure that the people that provide incident response and professional services can be much, much, much more productive. And we learn very fast. You know, the system learn what they are doing repeatedly. and really build the robots behind it. So we think that this offering has tremendous opportunity, tremendous attachment to budgets. It's a driver to buy more bundles. It's just the beginning, but we think that it's something that is very unique and the first managed detection response that is data-oriented.

And obviously, as we go through the year and we Just to touch on that, as we go through the year and kind of the sample size becomes much more meaningful, we'll be happy to provide more color about what we see in terms of the MDDR and the uplift that we see.

And then maybe just one quick follow-up. Just now that we've kind of been through a full year of the SAS transition and we have a decent amount of critical mass in that business and deal flow and whatnot, maybe if you're Yaki, just in terms of, I know the 25 to 30% uplift on deals on conversion, but just are you seeing, you know, is there any quantification of new data repositories or new use cases now that you are, you know, you have seen a pretty good volume of SaaS deals that, you know, maybe outside of the Microsoft ecosystem, you know, you're realizing more of these

opportunities uh from a data repository use case standpoint is there is there two or three that you know are significant yeah the three things that we are doing extremely well is making sure that only the right people can access the the right data that robotic remediation of access control without breaking any b any business processes which is the holy grail of data protection threat detection and response that is data oriented and then obviously a very accurate classification of data and to give it context. And then we are doing it on every repository. You know, we have this amazing product for Salesforce, Salesforce and Box and Google. But we are going now into the IaaS world and, you know, with AWS, all the databases, all the RDS and, you know, S3 and, you know, and in Azure, Azure Blob. And we're just moving very, very, very fast really to make You know, to do everything we have done with on-prem data, with storage and these biggest NAS devices of the world and the unstructured and then went to application and same structure, then email and these SaaS applications. And now this data repository is in AWS and Azure, and we will move very fast. And everywhere we go, we bring these three use cases. But the other thing is also, as you have more data, you have more enrichments. Because if you look at most of the breaches, almost all of them always go from one, they're coming in, they try to get credentials, they are becoming a user, and then they are moving from one data repository to the other. And we are really in the best position to make sure that organizations don't have data breach, and we are doing it automatically. And now, even in the places that they need to put some effort, we are taking it We just need to help us set it up, and someone needs to answer the phone. This is the level of automation we are getting to, and any repository that we are going to protect, this is the level of protection we will get.

Got it. Thank you much.

Thank you. As a reminder, in the interest of time, we ask that you please limit to one question. Our next question comes from the line of Jason Adder with William Blair. Please proceed with your question.

Yeah, thank you. Good afternoon, guys. Just wanted to ask, in terms of the conversion process, you know, in practice, how does it work with your existing customers? Do you wait for the term expiration, you know, kind of a little bit ahead of that to try to convince people to switch over to the SaaS version? How much incentives do you provide for them? I know you have a 25 to 30% price uplift. That doesn't seem like much of incentives to me if I'm a customer. So what are some specific things that you're doing as you think about 2024, especially second half, where you talked about accelerating some of the activity with the existing customer base?

So, Jason, I'd start by saying that that 25%, 30% uplift is actually a significant incentive for our customers to convert because the total cost of ownership saves them money. So, yeah, they pay more on our price list. But at the end of the day, they save on the hardware and they save on the people and they're getting a much, much better product. And especially with the MDDR, it could save them even more in terms of the offering. So it's definitely an incentive. As we look at our offering and when we look at kind of the renewals, we really take the cue from our customers. Some customers want to wait until the renewal period, and then they would talk about the conversion. Sometimes they don't want to wait. They have a renewal that's ahead of time, but they want SaaS and they want it now. We work with our customers to make sure that they would be protected in the way that they feel most comfortable. I can tell you that getting a renewal on the on-prem subscription side is a pretty automatic process. You know, you ask for the renewal, you get the PO. There's not too much conversation going on. Obviously, you want to position in terms of the upsell, but just getting a pure renewal is pretty straightforward. Getting a conversion requires understanding what types of offering would make the most sense to them. Kind of talking about the price uplift, but how it saves the money over the TCO in general. So there's more of an effort there. It's not happening automatically, but it's a much better product. It's providing better protection to our customers. And the fact that we can convert them sets them up for additional upsell opportunity because they'd be protected on additional platforms. And they'd see the value and they would want to purchase more. So it's a win-win and it's time very well spent from our perspective. And that's why we're so focused on that. Obviously, as you look at kind of the seasonality, we have historically way more renewals happening in the second part of the year. That's why we talked about the phase two and the conversions happening, accelerating towards the second part of the year for obvious reasons. But we also see the conversions accelerating within the year. So every single year, we expect to have more conversions in dollar terms as this picks up. But I think as we sit here today, and with our expectation of getting to $285 million of SaaS by the end of this year, we're expecting customers to convert at a higher pace than we saw in 2023. Great. Thank you.

Thank you.

Thank you. Our next question comes from the line of Joe Gallo with Jefferies. Please proceed with your question.

Hey, guys. Thanks for the question. You guys have launched many new products recently. Snowflake protection, you've upgraded protection for Salesforce as you bolster DA Cloud. Can you just talk qualitatively about the traction you're seeing in DA Cloud and then quantitatively, you know, any metrics or size or growth profile, and then just how we should think about the mix as a percentage of ARR over time from DA Cloud. Thanks.

Joe, if you remember, for quite some time now, we're looking at our SaaS offering as a whole. And we're definitely seeing that in terms of the conversations with customers where they not only buy the SaaS offering on the platforms that we used to have on-prem, but they're also talking about additional platforms that we have through the polarized acquisition and the offering there. So I think overall, the adoption, as we saw it in Q4, was healthy. It's definitely helping in terms of the conversations. Obviously, we think we can do much better. And we've talked about the fact that it takes time to introduce new products until they kind of take off, as we saw with the Office 365 and the automation engine. But We're very happy with the progress so far, and we believe that we can increase it in 2024. Our reps are very much in line with this. They understand the benefits there. Our customers are asking about it and talking to us about it. So overall, we're happy with the progress so far.

Thanks.

Thank you. Our next question comes from the line of Srinath Kothari with Baird. Please proceed with your question.

Yeah, thanks for taking my question. Congrats on the great execution. So, Yaki, you talked about the sales kickoff event early on the call and the level of energy during the event. So, just one follow-up to the previous question about the second half ramp for Phase 2 regarding the Salesforce incentives specifically. Of course, so far, The AR uplift from SaaS kind of naturally was a momentum due to higher commissions. And as of yet, you had not implemented any additional monitoring incentives for selling SaaS. So can you elaborate on the conversion go-to-market motion around adjusting this Salesforce incentive dynamics related timelines? And also, how does these incentives kind of drive incremental OPEX, which you're tying into your margin guidance framework and assumptions for post-op and second half?

So I'll take this question. In terms of the incentives for 2024, we've definitely seen some very positive momentum on the conversions in 2023. And we talked a lot about it throughout the year on the fact that it's happening in a natural way. We had discussions internally of whether it makes sense to incentivize the conversions in 2024. And I can tell you that with the momentum and the fact that it's happening in a natural way, we didn't see any reason to, at this current stage, to put additional dollars to work from a commission perspective because what the reps are actually benefiting from is the uplift on the conversion. So anything on top of that renewal amount goes towards their quota retirement, and we've definitely seen some healthy uplift. There's a 25%, 30% uplift, but if that conversion – requires additional users, additional licenses, additional platforms, then those increases are actually higher than that 25, 30%, and that's very beneficial for our reps. So we didn't start with any incentives in 2024 related to that. Obviously, if we see a need to accelerate on that and put money to work there, we will, but I currently don't see any need to do that because the way the structure is happening, is benefiting our customers and it's benefiting our Salesforce with those uplifts. I think as we increase those uplifts, the magnitude in dollar terms throughout 2024, and I talked about kind of phase two accelerating within the year. And also as we see that phase two accelerating within the years themselves, where every single year actually has more of conversions versus the previous year. I think it puts us in a very good position to upsell to those customers, provide them a product that is much better because the SaaS offering is a better product than the on-prem subscription offering. And with the MDDR offering, I think that's an actual game changer for us because it provides value where customers don't necessarily need to have the same teams in place. They can have less people and be better protected. and we can benefit from that and provide the protection to our customers that we could provide in the past. So I think all of those are positives that we want to take advantage of.

Very helpful. Thanks a lot, Guy.

Thank you.

Thank you. Our next question comes from the line of Eric with JMP Securities. Please proceed with your question.

Yeah, thanks for taking the question. On the MDDR service, did you say that you would or you would not need to add additional people? Is that just going to be using the IR team that you have? And if you look longer term, what type of penetration do you think you can get with that across your customer base?

In terms of the penetration, we will communicate as this thing is moving forward. But in terms of people, obviously, when we have the service, we need more people. But the productivity profile of an IR team using our AI from the cloud is just significantly better. You know, you're talking about it can be 5x more productive. So this is the key for us. The key for us is to make sure that we are using the software to provide to many customers a premium service with an SLA, with a very strict SLA, and they will have for them a world-class analyst. Partially analyst, it will be a robot. So this is the way that it works. The software is augmenting people to be much, much more productive.

And I want to give some additional color on kind of the expense side as we look at this. Obviously, our expectation in terms of the investments are already baked into our guidance So we definitely built in some additional investment in customer success IR, but we have provided the proactive incident response team for a couple of years now. Now we're just charging for it, so we can actually benefit from it in terms of margins. So as I mentioned before, we're still a software company. We don't see us changing that, and we expect that MDDR over time will have software-like margins.

Okay, very good. Thank you.

Thank you. Our next question comes from the line of Brian Colley with Stevens. Please proceed with your question.

Hey, guys. Thanks for taking my question here. So I'm curious if you've seen any uptick in the pipeline that's directly related to customers they're looking to enhance their data security before deploying Gen AI. So, you know, I realize it's still early, but just trying to try to see what you all think in terms of how Gen AI could, you know, impact the growth rate.

What we can say with a lot of confidence, with a lot of confidence that it comes up almost in every conversation. People understand that it's a big opportunity with a lot of risks and they need to be ahead of it. If we need to do, you know, you never know, but the way that we think that it's going to move forward and with these tools will be in the hands of many end users will just be, you know, people will just realize it on a daily basis. And, you know, God forbid if it's going to bad actors, but it's definitely coming up with every conversation. This is, you know, AI comes with security risks, security risks for data risks. The number one is this overexposed data in terms of excessive access control, and we are uniquely positioned to solve this problem.

Got it. Thank you.

Thank you.

Our next question comes from the line of Rudy Kessinger with DA Davidson. Please proceed with your question.

Hey, thanks for squeezing me in. Guy, I know you're not giving exact color, but it's $15 million in converted ARR, a good kind of starting point for Q1. And then with your sales reps, you're giving them quota relief on the uplift amount on renewals. Does that impact their ability to focus on net new customers and new deals? And how are you factoring that into your guidance?

I'll start with a second part of your question. I think we've been extremely focused on acquiring new customers. The SaaS offering allows us to tap into markets and verticals and customers that we've never had the opportunity to sell to. I can tell you that the way the 2024 comp plan is set up is that account managers will not be able to make significant money if they don't sell to new customers. So that's been at the forefront of our philosophy over the last couple of years. And I can tell you that in 2024, we've actually doubled down on the importance of the new customer acquisitions. In terms of the conversions, we want to convert our customers as well because there's a lot of leverage with a SaaS offering for us from a financial perspective. And the SaaS offering is a much better product and provides the opportunity to update that product in a much more seamless way. So there's a benefit for us. And it's a much better product for our customers. So I'm not sure that $15 million is the right starting point. You have to remember that there is a seasonality within our business where Q4 is the largest quarter of the year. And then in dollar terms, Q1... historically has been the lowest in terms of in dollar terms. So it starts with a small dollar term quarter in Q1 and then it picks up throughout the year. So that needs to be baked into consideration. But I think a good starting point should expect kind of the same progression of Q1, Q2, Q3 and Q4 that we saw in 2023 as a starting point for 2024 as well. Just in dollar terms, the actual dollar terms that we expect to get to with our SAS offering by the end of this year is expected to be significantly higher than the 125 we finished with. We want to get the guidance assumes $285 million at the end of this year. Thank you.

Our next question comes from the line of Rob Owens with Piper Sandler. Please proceed with your question.

Great. Thanks for taking my question. I want to drill down a little bit on some of your comments there, noting that the net new subscription numbers ticked down year over year, and frankly, it ticked down for the last four years. So to that end, was it the way the Salesforce was incentivized with quarter retirement? Is it churned? Because I know in some of your comments earlier, Guy, you did talk about friction with regard to the SaaS change, or is this just more sales cycle and timing around the shift to SaaS? Just curious for color, I guess, in terms of new customer acquisition throughout the year.

I think no matter how you look at the business, there are strong underlying trends, and I think our philosophy in terms of new versus existing has been very much kind of a mix of both. with our existing customers, there's definitely kind of an increased customer lifetime value that we're seeing with the SaaS offering. But as I mentioned before, the new business opportunity has never been greater for us. And that's why in 2024, we've kind of structured our comp plan where account managers will not be able to make significant money if they don't sell to new customers. I think it's important to note that it's not a simple Excel where we put in a 25, 30% uplift and you plug it in and you get the PO. Renewals happen in an automatic way when you get that on-prem subscription renewal. But when you try and convert a customer, you have to talk to them about the benefits, you have to talk to them about the cost. It's an exercise that requires time.

It is a different contract in terms of the different security review. Through this transition, there are just so many moving parts. I will tell you that. In terms of the value proposition, it's completely different. I think that the common ground is the logo. It's order of magnitude in terms of the automation, the way it works. The overall platform is a fraction of the support ticket, the self-hosted versus the SaaS. Sitting here today, I will tell you that it's so far moving much faster than we anticipated, but it You need to do it with great, great attention to details. There are just so many things to do in order to make sure that it will work right, that you will cater to the customers. You need to daily focus on it, just to have laser focus on the way you're doing it.

And just to touch on kind of the new customer ads, I think it's still early, but SaaS does open up kind of opportunity for us to new markets and new customers that we haven't been able to sell to before. As you look at kind of the ASB, they're higher when we sell to our new customers through SAS offering, which is very healthy. And I think that as you look at kind of the years ahead, the SAS offering allows us, will allow us to continue to take advantage and generate additional fuel that will support the growth of this business in the years ahead.

All right. Thanks for the color. Thank you.

Thank you. Our final question comes from the line of Josh Tilton with Wolf Research. Please proceed with your question.

Hey, guys. This is Patrick on for Josh. Just a quick clarification one for me. With the transition timeline being moved up a year, does that change the way we should think about the path to the 2027 long-term targets provided at the analyst day? And are you all now targeting Rule 40, exiting the transition now in 2026, and what should the composition of that look like? Thanks.

When we laid out kind of the plan in March of 2023, we talked about the transition lasting five years. We're bringing that one year shorter, and we're very happy about that. We're actually not changing that $1 billion target, and that's still at 2027, but I think we're extremely excited to reduce the whole transition period and cut it by one year to four years. So the rest is kind of staying intact.

Great. Thanks.

Thank you. There are no further questions at this time, and I would like to turn the floor back over to Tim Peirce for closing comments.

for the interest in Varonis.

We look forward to meeting with all of you at the conferences this quarter.

Goodbye. This concludes today's teleconference. You may disconnect your lines at this time. Thank you for your participation.