Varonis Systems, Inc.

telephone keypad. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Tim Pertz, Investor Relations. Thank you. You may begin.

Thank you, Operator. Good afternoon. Thank you for joining us today to review Varonis' third quarter financial results. With me on the call today are Yaki Fidelson, Chief Executive Officer, and Guy Malamed, Chief Financial Officer and Chief Operating Officer of Varonis. After preliminary remarks, we will open the call to a question and answer session. During this call, we may make statements related to our business that would be considered forward-looking statements under federal securities laws, including projections of future operating results for our fourth quarter and full year ending December 31st, 2024. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned Forward-Looking Statements, and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation for the most directly comparable GAAP financial measures is also available in our third quarter 2024 earnings press release and our investor presentation, which can be found at www.veronis.com in the investor relations section. Lastly, please note that a webcast of today's call is available on our website in the Investor Relations section. With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Feidelson. Yaki?

YAKI FEIDELSON Thanks, Tim, and good afternoon, everyone. Thank you for joining us today to review our third quarter results. Today, I would like to discuss our SaaS transition progress and the key drivers of our business. as I often do on these calls, I would like to remind you why Voronis exists and the problem we solve. Next to its people, data is the most valuable asset of any business, so it is the primary target for bad actors and cyber attacks. Most organizations focus on securing endpoints and perimeters but leave many gaps for cyber attacks on their data. With the expansion of the cloud and the emergence of generative AI, productivity and collaboration have improved, but the risk of overexposing sensitive data has greatly increased. Since the inception of our company, we have taken a data-first approach to security. which allows our customers to locate their sensitive data, visualize who has access to it, lock it down, and detect and respond to threats on it. Now, with the automation of our SaaS platform, our customers can spend less time and effort protecting their data. Our managed data detection and response offering, which we call MDDR, saves them even more time and makes them much more protected. Simply put, Varonis allows organizations to use AI and collaborate in a much safer way. Turning to our third quarter results, ARR grew 18% to $610 million, and SaaS ARR now represents approximately 43% of total ARR, or approximately $260 million, which reflects the growing momentum of our SaaS platforms and our MDDR offering, as well as a small contribution from GenAI. Year-to-date, we generated $18.6 million of free cash flow versus $46 million last year, while our federal business underperformed our expectations Our strong performance this quarter was led by our enterprise business with healthy contribution from new logos growth and conversion activity from both on-prem subscription and perpetual maintenance customers. Guy will review our results and our updated guidance in more detail shortly. Our SaaS transition continues to gain momentum because of the many benefits our customers realize. As a reminder, they are. Customers achieve automated outcomes, which means they ensure data is protected with very little effort. SaaS is quicker to deploy and operationalize. We significantly lower infrastructure and personnel investments, and SaaS is easier to maintain and upgrade. Additionally, the three key benefits we continue to realize are shorter sales cycles, larger initial length, and margin benefits over time. This quarter, we continue to see more proof of these benefits in our SAS transitions and MDDR offering, as well as very early contribution from generative AI solutions. At the beginning of the year, we introduced MDDR, the first managed service for monitoring and protecting critical data built on top of our SAS platforms, and therefore, only available to our SAS customers. It protects data in a more automated way This offering is so important for an organization because the threat environment grows more dangerous by the day, and when a breach happens, every second counts. Security teams are stretching and struggle to see and respond to threats as quickly as they must with today's threat actors. With MBDR, we address the problem for them. leveraging our unique telemetry, user behavior analysis, and use of experience, building highly accurate threat models to detect and stop potential data breaches. While we have been selling MDDR for only two full quarters, customers are seeing immediate and impactful benefits, and MDDR is becoming a key driver of new business wins and SaaS conversions. As we previously said, we believe that MDDR is a game changer and that we are just scratching the surface of this opportunity. Another term that we have discussed is the impact of generative AI in large language models. These topics remain top of mind and a key theme in our discussion with prospects and customers. The productivity benefits of Gen AI are well understood and companies are rapidly starting to understand the related risks. As a reminder, the usage of AI makes it easier to create and access data which benefits employees but makes the job of an insider threat or outside attacker much easier. Generative AI tools utilize native access controls to determine which data is available to the identity and that is using the prompt. These controls must be optimized or generative AI tools will create immense risk for organizations, increasing the risk of cyber attacks. Voronis help organizations mitigate these risks. by ensuring that only the right people have access to the information that they need to do their job, and monitoring what they do access, either directly or through AI. Once the bad actor bypasses perimeter control, Voronis can automatically lock out the compromised user or machine, preventing damage from happening. In the third quarter, Gen-AI has a small positive impact to our reported metrics. It is very early, so we are taking a measured approach with regard to our expectations around Gen-AI contribution to our results, but the behavior we are seeing from customers give us additional confidence that we should see momentum grow as its adoption increases. With that, I would like to briefly discuss a couple key customer wins from Q3. A large medical company became a Voronis customer this quarter. This organization is subject to many state privacy and data regulation and wanted to better protect its data after it suffered multiple ransomware attacks. They were focused on visualizing the risk automatically locking their data down and being able to monitor it as they continue to grow through M&A. They also wanted to ensure their data was protected when deploying Microsoft Co-Pilot prior to bringing in Varonis. The team unsuccessfully tried to lock down their data using a DLP solution. Our risk assessment revealed over 40% of their sensitive data was open to every employee, including 60,000 files shared with anyone on the internet. Ultimately, they purchased the Voronis SaaS hybrid package with MVDR, Voronis for Co-Pilot, GitHub, Salesforce, and databases. This will allow this customer to safely adapt Microsoft Co-Pilot automatically reduce overexposures at scale and meet its regulatory requirements. We also saw continued strong demand with existing customers looking to convert the Voronis SaaS with mDDR protection. One example of this was a large insurance company that has been a perpetual licensed customer since 2015. Using Varonis to audit user access activity for its on-prem Windows environment, this organization was looking to change their data classification window while locking down their overexposed data in their unmonitored Microsoft 365 environment. A risk assessment in Microsoft 365 identified 40,000 files with social security numbers that were open to all employees. It also uncovered 10 terabytes of unlabeled files in OneDrive after failing to protect their data with their existing DLP and SIM vendors that ultimately purchased the Voronis SaaS hybrid package with mDDR and Voronis for databases. In addition, to automatically locking down their data at scale, Varonis MDDR will proactively monitor their hybrid environments. In summary, the sustained momentum that we saw from our SaaS platforms and MDDR this quarter leaves us excited as we head into the fourth quarter. We are confident in our ability to capitalize on the tailwind of MDDR, GenAI, and increasing data-centric compliance regulation to capture our significant market opportunity. With that, let me turn the call over to Guy. Guy.

Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. When looking at the quarter, this was our strongest performance across the business since embarking on the SaaS transition. These results reflect the strong adoption trends of Verones SaaS and MDDR, coupled with a small contribution from GenAI. Our performance this quarter gives us increased confidence as we look to close out the year, and our SaaS transition continues to gain momentum with SaaS now representing 43% of our total company ARR. We saw a strong contribution from both new logos and existing customer conversions, including conversions from perpetual maintenance customers, and many of the secular tailwinds we have noted this year are continuing to have a positive impact on our business. Our enterprise business was the driver of our strong performance this quarter, with strong new business activity, healthy conversions, and very early contributions from GenAI to our reported metrics. Our federal business, however, underperformed our expectations by several million dollars. We have decided to make changes to the management team of our federal business and believe those changes, coupled with our expectations for FedRAMP authorization next year, will better position us to capture that market opportunity going forward. Looking at the quarter in more detail, the key drivers were again SAS and MDDR. Our SAS platform and MDDR offering together eliminates the two biggest pushbacks of one, not wanting hardware, and two, not having the headcount to manage the platform or respond to alerts. The automation of our SaaS offering, together with the simplicity of the story, continued to drive positive momentum and shorter sales cycles when compared to the on-prem subscription deal. As we have said for a few quarters, Gen AI continues to come up in nearly every customer conversation, but this was the first quarter where it began to contribute to our results. We believe Gen AI is still very early in the adoption curve, which keeps us measured in our expectations around the timing and sizing of its contribution to our results. This quarter gave us additional confidence that we should benefit from this tailwind as its adoption increases over time. The strong Q3 performance, coupled with our healthy pipeline, allows us to raise our full-year ARR guidance. Because it is still very early in its adoption, we're not assuming material GenAI contribution in our updated guidance. As we look ahead to the fourth quarter, we anticipate converting more customers to our SaaS platforms. Pricing continues to be in line with our price list increase of 25% to 30%, and in some cases, we see deal sizes increase in access of that as customers consume more of the platform upon conversion to SaaS. We expect that the ramp-up of this phase will not be linear, and momentum should grow each quarter, with SaaS conversions showing further acceleration in dollar terms in 2025 and 2026. In the third quarter, ARR grew 18% year-over-year to $610 million, and year-to-date, we generated $88.6 million of free cash flow, which was up from $46 million generated over the same period last year. These metrics demonstrate our commitment to balancing top-line growth with improving cash flow generation during the transition. Turning now to our third quarter results in more detail. As a reminder, the leading indicators of our transition are the three north stars, ARR, free cash flow, and ARR contribution margin. As we have said many times, the faster we progress through the transition, the more headwinds we will experience to our traditional income statement metrics. But we view these in a positive light. The macro environment remains stable. while SAS and NBDR are resonating well, and we feel increasingly confident in the trajectory of the business following our third quarter results. Q3 total revenues were $148.1 million, up 21% year over year, reflecting our strong performance as well as a higher contribution from perpetual maintenance converting to SAS. During the quarter, as compared to the same quarter last year, we had approximately a 5% headwind to our year-over-year revenue growth rate as a result of having increased SaaS sales in our booking mix, which are recognized ratably versus the upfront recognition of our on-prem subscription products. In the third quarter, SaaS revenues were $57.8 million. Term license subscription revenues were $68.8 million, and maintenance and services revenues were $21.5 million, as our renewal rates were, again, over 90%. Maintenance and services revenues declined by 13% year-over-year, with a majority of the decline driven by perpetual maintenance customers converting to our SaaS platform. Moving down the income statement, I'll be discussing non-GAAP results going forward. Gross profit for the third quarter was $125.8 million, representing a gross margin of 85% compared to 87.3% in the third quarter of 2023. Gross margin continues to be strong, and the year-over-year change is due to the revenue headwind associated with a higher mix of SAF sales, increased headcount to support the transition, and increased hosting costs, Operating expenses in the third quarter totaled $116.7 million. This includes approximately $6.7 million of acquired in-process research and development expenses within the R&D expense line due to a small asset purchase made during the quarter. As a result, third quarter operating income was $9.1 million, or an operating margin of 6.1%. This compares to operating income of $4.9 million or an operating margin of 4% in the same period last year. During the third quarter, as compared to the same quarter last year, we had approximately a 4% headwind to our operating margin as a result of having increased staff sales in our booking mix, which are recognized radically versus the upfront recognition of our on-prem subscription product. This quarter, ARR contribution margin was 15%, up from 11.1% last year. The significant leverage improvement, even during the transition, reflects our ability to drive strong incremental margins while growing ARR and transitioning to SAS. During the quarter, we had financial income of approximately $9.7 million, driven primarily by interest income on our cash, deposits, and investment in marketable securities. Net income for the third quarter of 2024 was $13.8 million, or 10 cents per diluted shares, compared to net income of $10.4 million, or 8 cents per diluted share for the third quarter of 2023. This is based on 134.7 million and 126.7 million diluted shares outstanding for Q3 2024 and Q3 2023, respectively. As of September 30th, 2024, we had $1.2 billion in cash, cash equivalent, short-term deposits, and marketable securities, $332.3 million of which is included within long-term marketable securities. Our liquidity position also reflects $394.1 million of net proceeds from the successful issuance of convertible notes in early September, which strengthens our already healthy balance sheet. For the nine months ended September 30th, 2024, we generated $90.9 million of cash from operations compared to $49 million generated in the same period last year. And CapEx was $2.3 million, compared to $2.9 million last year. Turning now to our updated guidance in more detail. For the fourth quarter of 2024, we expect total revenues of $162 million to $167 million, representing growth of 5% to 8%. Non-GAAP operating income of $20 million to $22 million, and non-GAAP net income per diluted share in the range of 13 cents to 14 cents. This assumes 135 million diluted shares outstanding, which includes 6.8 million shares related to the issuance of convertible notes maturing in 2029. For the full year 2024, we now expect ARR of $635 million to $639 million representing growth of 17% to 18%. Free cash flow of $95 million to $100 million. Total revenues of $554.4 million to $559.4 million, representing growth of 11% to 12%. Non-GAAP operating income of $20.6 million to $22.6 million. non-GAAP net income per diluted share in the range of $0.26 to $0.27. This assumes 134.9 million diluted shares outstanding. In summary, when looking at the quarter, this was our strongest performance across the business since embarking on the SAS transition. This strength was driven by Verona SAS, the strong reception to MDDR, and the secular tailwind benefiting our business. The growing demand for Ronis is strengthening our ARR performance and cash flow generation. And these tailwinds position us to unlock meaningful value for our customers, our company, and our shareholders. With that, we would be happy to take questions. Operator?

Thank you. We will now be conducting a question and answer session. Each person will be allowed to ask one question and no follow-up. If you would like to ask a question, please press star one on your telephone keypad. A confirmation tone will indicate your line is in the question queue. You may press star two if you would like to remove your question from the queue. For participants using speaker equipment, it may be necessary to pick up your handset before pressing the star keys. One moment, please, while we poll for questions. The first question is from Matt Hedberg from RBC. Please go ahead.

Hey, guys, thanks for taking my questions. Congrats on the results. Yaki, there's a lot to unpack. It's hard to think about one question here, but I guess if I were to focus on one, you know, I couldn't help but hear you talk about Gen AI, although early, positively impacting results. I guess I just wanted to put a finer point on what aspects of the portfolio, you know, are contributing to customer Gen AI spending. And if we look forward another couple of years, I mean, how do you think the products that attribute to Gen AI spending could expand over time?

Hi, Matt.

So it's primarily now related to co-pilot, and you see it a lot on the 365, but eventually, obviously, you have Einstein in Salesforce, and you have it for GitHub, and I think that it's going to be part of a every walk of life. The reality is that at the beginning, we saw just these smaller POCs in the hands of IT that immediately exposed the problem, the data security problem. You have this massive blast radius. But what we're starting to see now is that more knowledge workers are using it. And once they are using it, just solving the problem becomes almost inevitable. So you just see that people get to a lot of critical data they don't need to get, generating a lot of critical data they shouldn't generate outside of policy, starting to just using the wrong intent, and it's just extremely dangerous in terms of losing the critical data. So, you know, at the beginning it was on the PSTOC stage, but now when knowledge workers are demanding it, and they are trying to buy it, and you're just starting to hit critical mass within organizations that are using the product, they generate a lot of urgency to buy a protection for Gen AI and co-pilot mainly, and it's just working extremely well for us. We just have an unbelievable solution to solve it automatically.

The next question is from Hamza Fadarwala from Morgan Stanley. Please go ahead.

Yeah, good afternoon. Thanks for taking my question. Yaki, you and Guy teased this a bit with a lot of the Gen AI contribution commentary, but didn't quite size the opportunity, at least today. I know it's early innings, but we're seeing some of the problems in terms of over-permissioning and data leakage with Copilot. You've had some customer case studies already. where customers are using Varonis for Gen AI. There's a Gen AI readiness program with some of your partners like E+, so there seems to be some momentum there. I'm just curious, if you're not willing to sort of give an ARR revenue contribution today, what percentage of your pipeline would you say is Gen AI-related customers coming to you and trying to prepare themselves for Gen AI going forward? Thank you.

Tamza, we've been talking about co-pilot for about a year now. This time is slightly different. I think you kind of noted that. And here's why. This quarter, we finally started to see some deals close. But as you said, and as we've talked a lot about it, it's still early on, which is why we're not baking in any material amounts closing into our Q4 guidance. But the fact that we started to see deals close this quarter gives us increased confidence that we should benefit as Gen AI adoption increases. And as Yaki mentioned, it's not just around the Microsoft Copilot. It also includes the internally built LLMs, Salesforce Einstein, and others. When we look at the pipeline, it comes up really in every conversation with our customers. A lot of our customers are talking to us about it. But again, this quarter, we started to see some deals close, but it's still a very small amount, an immaterial amount for the quarter.

But it's front and center in every conversation. We believe that over time it will be inevitable that it will be in the hands of any knowledge worker. It's just the productivity gains are tremendous. And once enough people are using it within the organization, it's just exposing many times a day the data security problem, the fact that data is overexposed, the fact that you can use this these robots in a malicious intent, and it's very, very dangerous. But we believe that it's going to be a big part of the future of IT, and we are well-positioned to protect organizations and make sure that they can use it in a secure way.

The next question is from Sajid Kalia from Barclays. Please go ahead.

Okay, great. Hey, guys, thanks for taking my question. You know, to Matt's earlier point, a lot to unpack, particularly in Gen AI, but maybe I could switch gears a little bit. Guy, I've gotten the question from investors just around how much of the net new ARR generally through this process has come from conversion. And of course, that isn't something that we disclose. But I think that what a lot of people are trying to figure out is, how does demand look excluding that conversion activity? So is there a way that you can talk to us about that qualitatively, just as we think about sort of base net new ARR next year, plus any conversions, plus a lot of the other good things that you talked about with Gen AI?

The fact is, I think one of the biggest misconceptions, and we've talked a lot about this during a lot of the conversations that we've had with investors is this conception that the conversion, you just plug it in the Excel and it happens very quickly and very easily. When you look at what drove the momentum and the strength this quarter, it definitely came from the SaaS platform and the MVDR. We continue to see shorter sales cycles on SaaS. and very strong new logo activity, which was really driven by the MDDR offering, and that's really because the SaaS value proposition eliminates the two biggest pushbacks of customers, and we've talked a lot about it, one being not wanting to buy hardware, and the second that they don't have enough people to support the solution. Without the conversions, we wouldn't have gotten to 43% of total ARR being SaaS or approximately $260 million, but the conversions take time, And conversions are, you know, you have to talk about the legal elements of it with a customer, and it takes time to flip them. It's not a plug and play. But at the end of the day, it provides more value to our customers. That's why we do it. That's why our customers are buying SaaS and converting to SaaS. But at the end of the day, what drove the momentum this quarter, and also last quarter, when you look at kind of the commentary that we gave last time, is the new logos,

the MDDR offering, and that's really what's driving the business.

The next question is from Brian Essex of JP Morgan. Please go ahead.

Hi, good afternoon. Thank you for taking the question. Great to see the profitability and cash flow here so early on still in the transition phase. You know, maybe, Yaki, I think last quarter we caught up in – In terms of talking about the transition, I thought you had a great analogy where I don't know if it was either you or Guy talked about, you know, stage one of the transition was the carrot phase and then phase two is the stick. And then you said that carrot phase is going so well, you don't feel like you need to use the stick. Is that still the case? I mean, how much visibility do you have into that transition pipeline and how smoothly is it going for those existing customers that that you're converting over now, how much runway do you have left with those easier converts, if I can maybe put it that way?

In terms of the overall value proposition and our ability to get to outcomes, the SAS is second to none. The reality is that bad actors many times are not breaching in their logging. And once you have an identity, there is no perimeter anymore. And we are your best bet. So a data-centric data security platform is the first thing you need to do and the last thing that really will save you. So anytime our customers are tasting the value, the automated outcomes that we provide, it's a game changer. You have stuff that's related with all the remediation robots and the mddr you know just you know released the mddr and what we just catch on on a weekly basis it's mind mind blowing even to us and our ability to automate everything and also with the way that we are covering more data and user repositories just elevate the whole value proposition. So once customers taste it and understand just the regular value of a high-quality SaaS architecture, but primarily these automated outcomes that they can get to most of the value is literally doing nothing automatically, it generates a lot of appetite to do the conversions.

One thing to add, and I think it's a very good question in terms of value proposition and the commentary that we gave about the fact that many of our customers are asking for SaaS and wanting to switch to SaaS because it's a much better product. But if we take a step back for a second, and when you look at when we announced the transition, we're just under two years into the transition, and we expect to be at approximately 50% of the business coming from SaaS. That's a huge milestone for us. So when you look at kind of the progress that we have had through this transition, it's been extremely healthy. We're very happy with the progress that we are. And you noted correctly, we're doing that with significant generation of cash flow. So when you look at the free cash flow, upping our guidance and getting to levels that are very healthy, we're very happy with that. We think we can continue on that path and do better.

But we're very happy with the progress we've had so far.

The next question is from Joel Fishbane from Truist Securities. Please go ahead.

Thanks for taking my question and good quarter. Yaki, you mentioned on the call that the federal business underperformed. I'm just curious there, you know, whether or not that was sort of self-inflicted execution or if there's something going on there. It's been a good area of business. I know you're still on track for FedRAMP. I'd love to get a little bit more color there. Really appreciate it.

So that's a great question. I'll take that. The federal business did underperform by several million dollars. But let's keep things in perspective. That vertical accounts for mid-single-digit percentages out of total ARR. So when we look across the remaining 95% of the business, this was the best quarter we've had since the start of the transition, and that momentum was driven by continued strength in the enterprise segment. If federal did what it was supposed to do, this would have been a picture-perfect quarter for us. So after several years of underperformance from the federal business, we decided to bring in a new management team, and we believe that these changes, coupled with the expectation for FedRAMP authorization next year, will better position us to capture that market opportunity going forward.

Great. Thank you.

The next question is from Fatima Bulani of Citi. Please go ahead.

Oh, good afternoon. Thank you for taking my questions. Guy, I wanted to double back on an earlier question with respect to some of the conversion momentum that you're seeing in the base. You know, understand that it's not like flipping a switch, but I'm curious to understand how much of your install base has actually converted. And as a related matter, is your guidance for SAS ARR mixed for the full year at 48 still intact? Thank you.

So again, when we look at kind of where we are from SaaS out of total ARR, getting to 43% was definitely, you can't get to that percentage without having existing customers converting. Our Q3 conversion was very similar in dollar terms to the Q2 conversion amount. So again, as the same commentary that we gave in Q2, the strength of the quarter came from new business, the MDDR, and the fact that we're seeing shorter sales cycles on the SaaS offering. And when we look at kind of where we want to end, we talked about 48% kind of finishing the year. We're looking now to be in that 49% SaaS mix at the end of the year. And we think that even that metric gives us a lot of confidence to deliver in the same manner we've delivered on other metrics to Wall Street.

The next question is from Roger Boyd from UBS. Please go ahead.

Great. Thanks for taking the questions. I know there's a variety of ways you're monetizing MDDR, but are we getting to a point where you might be able to quantify the size of that business or alternatively, any color you can give on the typical uplift you see to ACV when you do bring that into customer engagements? Thanks.

Roger, one of the things that we've talked a lot about is our desire to be able to extract more dollars from our customers through the MDDR offering. It's part of a bundle, basically, and there are multiple ways to buy the MDDR. If you want to buy it separately without additional licenses that we have as part of the bundle, you will pay a higher price. But what we wanted to see and what is actually happening is that many of our customers are actually buying more of the platform and getting NBDR at a reduced price. For us, it doesn't really matter. We want to provide the value, and we think that if they consume more of the platform, they get a much better value for money. And at the end of the day, it allows us to increase our ASPs. So at the end of the day, everyone wins here. When we look at kind of the adoption of MDDR, we only had two full quarters, but don't forget we introduced it at the beginning of the year. So January was the first time it was introduced to our sales force. Very well adopted by our customers, very well adopted by the sales force because it's a no-brainer. It helps on the sales cycles. It helps on the conversation. The value that is provided to customers is great. We haven't quantified it because, you know, we're providing a lot of color in terms of the numbers, and I think that MDDR, at the end of the day, needs to be with every single customer we have. We've talked a lot about that. It doesn't happen overnight, but at the end of the day, it's something that can help all of our customers.

The next question is from Andrew Nowinski from Wells Fargo. Please go ahead.

Okay, thank you for taking the question. I just want to get a better understanding of how you're defining a material impact from Gen AI. I mean, are you guys measuring it based on the number of new logo ads you get when they tell you they're buying Varonis for an LLM support? Or can existing customers that roll out an LLM also have an impact on your ARR? I guess I'm just trying to understand how you define a material impact and what that might look like.

Thanks for the question. We are analyzing every POC, really looking at the pipeline and understanding very well methodically why customers and prospects are buying the product. And many times we see in what we call a risk assessment that when they're using co-pilot, it's just exposing the problem in a big way. And we also see that our customers are just many times expediting the purchasing process in lockstep with the intent to release the co-pilot product to more and more knowledge workers. This is how we see it. And, you know, before it was very contained in IT departments, but as time goes by, you just see that once they release it to a broader population, they need to understand that they must make sure that only the right people can access the right data. They need to be able to audit activity. They need to make sure that they maintain the queries themselves, queries that make sense, because if not, these tremendous tools will inflict a lot, a lot of damage.

One thing to add, when we look at kind of the co-pilot, and we talked a lot about it, we have it as a separate SKU. We have it as part of the MBDR. And we've talked a lot about the fact that when customers have the Office 365, they have a lot of protection that can help them with the co-pilot. The co-pilot has additional functionality. But the true value in dollar terms is selling co-pilot to new customers. And when we quantify materiality, we quantify it in dollar terms. So when we looked at kind of the co-pilot SKUs sold in Q3 as a standalone, it didn't have a material impact. But as I said before, there is difference, and that was part of our prepared remarks. We did see deals closed that were related to co-pilot in a way that gives us increased confidence that it will become a tailwind in the near and medium-term future.

Thank you. The next question is from Joseph Gallo with Jefferies. Please proceed with your question.

Hey, guys. Thanks for the question. Appreciate the federal commentary earlier, but anything else to note on the overall business environment? And then just any expectations for a 4Q budget plus? Just trying to understand your 4Q guide where net new ARR is relatively similar to your 3Q. So just trying to understand if there's anything else we should be aware of. Thanks.

So when we look at the philosophy of guidance, that really hasn't changed. And that's why we didn't bake in any additional Gen AI contribution. We've always been under kind of the assumption and our philosophy has always been that we don't bake in any positivity until we see it translate into data. And that's why we're kind of staying with the same philosophy for Q4. In terms of budget flush, it's not something that we've seen in the past. There is the regular seasonality within the business where Q4 is the largest quarter of the year, and we expect that to be the same this year. But we haven't seen any changes in terms of budget flush when we move to SAS.

If we see anything, we'll obviously provide commentary post-quarter.

Thank you. The next question is from Jason Adder with William Blair. Pleased to see with your question.

Thank you. Good afternoon, guys. I just wanted to see if you had any early thoughts on 2025. I know you're not providing any specific guidance, but just maybe can you help us think through the impact of the SAS transition on 2025? relative to elements like revenue growth, operating margin. Operating margin was down this year from last year, primarily, I would assume, from the SaaS transition. Will it stabilize, you think, in 2025? Could it go down more? And then on the revenue growth side, same thing. I mean, it actually probably outperformed probably what most people expected this year. But what are some guideposts for 2025, and how should we be thinking about that?

So, Jason, I'll start by kind of reemphasizing the three North Stars, which are ARR, ARR contribution margin, and pre-cash flow. I think looking at regular standard financial statement metrics that relate to revenue and operating margin through a transition are very misleading because of the radical recognition of – of revenue through SaaS versus the upfront recognition of the on-prem subscription. So I would highly, highly, highly recommend not looking at revenue and the regular operating margin because it really is not reflective of anything within the business. So when I look at the ARR contribution margin, it was actually moving very nicely throughout this year. We're showing nice leverage compared to 2023. And when we look at kind of our commitment, we've talked about our desire to continue to grow, but also from an ARR contribution margin, show improvement and generate more cash. And I think when you look at the free cash flow generation, it's been progressing really nicely. We believe that obviously that's one of the essence of having a company want to generate healthy healthy free cash flow. In terms of the 2025 color, we'll provide more color as we finish Q4. Obviously, Q4 is the largest quarter of the year. We're very focused and we feel good getting into the quarter and we'll provide additional color on 2025 as we see kind of the trends in Q4. But overall, we're entering Q4 with a strong pipeline and believe that we can do well.

Thank you. The next question is from Rob Owens with Piper Sandler. Please proceed with your question.

Yeah, thanks for taking my question, and just a quick one from me. I think you called out in your prepared remarks a small asset purchase that you made during the quarter. Could you elaborate on that?

Yeah, we bought just a small team of programmers that can help us accelerate the roadmap. We have many exciting new products and features in the roadmap, and this was just a shortening time to market, just a very small acquisition that helped us accelerate.

And just to give some color from the financial statement side, As Yaki said, we purchased code, so this is a small technological tuck-in. And as Yaki mentioned, it helps shorten our time to market. From a cash flow perspective, the asset purchase at max totaled $6.7 million. And on the income statement, the full amount is expensed immediately. So you will see that amount of acquired in-process research expense within the non-GAAP R&D expense line item. We don't expect any ARR.

or material expense because of the very small size of the asset purchase.

The next question is from Joshua Tilton from Wolf Research. Please go ahead.

Hey, guys. Thanks for sneaking me in here. One for me, I guess, it's clearly a positive that you guys are calling out a contribution from GenAI, and I guess we can interpret that as co-pilot adoption is possibly going a little bit more mainstream in the enterprise than it was maybe 12 months ago. And I guess my question is, it feels like prior to this AI hype cycle and this want or need to adopt some type of co-pilot strategy, that you guys kind of lived on this very secluded island when it came to competition. I think part of the reason why we all left the story is because, you know, there was really no competition for your car offering, especially when it was on prems. And I guess my question is, as you see co-pilot adoption become more mainstream, more customers want to deploy this technology, look for ways to secure their data. It just feels like the competitive landscape is getting increasingly more noisy. And I'm curious how you think about the fact that there are so many companies coming after the data security market, the data security opportunity as you head into 2025, and maybe how that changes the competitive positioning that you once had as an on-premise business.

At this point, we see no change to the competitive landscape. You know, we sell our product through POC. We analyze each and every one. And we know we have a competition. But what we do see is that there is just a lot of knowledge, a lot of awareness around data. Most data, most breaches are data breaches. And this whole notion that organizations spend an arm and a leg on security and constantly have breaches that are more sophisticated and attacking data is just a losing proposition. So I think that what you see is that data security becomes front and center and organizations understand that they need data security. It's a very complex problem to solve and you have massive volumes of data with a lot of data stores and you need to integrate and you need to marry them with a lot of additional streams in order to really solve the problems, to make sure that only the right people can access the data, to understand if you have any abnormal behavior and to find critical assets. And this is something that we are expert in doing extremely well. At this point, there is no change whatsoever to the competitive landscape.

The next question is from Rudy Kessinger from DA Davidson. Please go ahead.

Thanks for taking my question. I get a lot of questions from investors just on the conversions and contribution towards growth. Guy, you said in response to a question earlier, you converted about the same amount in Q3 as you did in Q2. If I look at the numbers here, the step down in your term and perpetual ARR was about $5 million higher. Q2 to Q3, then Q1 to Q2. So it looks like from those numbers, you converted a good chunk more. So I'm curious how gross retention has been trending and how it was in Q3 versus Q2 and prior quarters, just as you started to lean into the conversion motion more with your existing customers.

When we look at our renewal rates, they're consistently over 90%.

So we're happy with what we're seeing there. I can tell you that when you look at kind of the conversions, we have seen more conversions happen from our customers that own maintenance of Perpetual. And that's part of the reason you're seeing that revenue increase because in a way there's no headwind when you convert the maintenance of Perpetual to SaaS. When you look at the maintenance and services line items and when you look at the decline there, the majority of that decline in that line item is actually coming from conversion. So when you look at our conversions, I think we're happy with customers converting. But again, I can't emphasize this enough. When you look at what drove the momentum in this quarter, it was new customers, it was the MDDR. We're very happy with the way our new customers are adopting and the way our sales force is selling to new customers. And we saw growth in the new customers and very healthy dollar increase with our customers.

The next question is from Shrenik Kosari from Robert W. Baird. Please go ahead.

Thanks a lot for taking my question. Congrats on great execution. So, Guy, you mentioned about the upsized convertible notes offering and the strategic flexibility it provides. And with M&A being one potential avenue, right, and Yaki, please feel free to chime in, any specific areas in your product portfolio or market segments that You might be eyeing that kind of aligned with your core data security focus. Specifically, would you be focusing on certain technologies that complement your existing offerings, expand overall reach, or kind of provide new capabilities, either in context of computer dynamics or not, if you can just kind of provide some sense there.

I think that, you know, just

build a very unique asset with this data security platform that can take all the activities, a lot of telemetry, and business software production that provide the automated outcomes. And with that, it just opens up a lot of logical extension. There is just a lot of meat on the bone to do very, very interesting things that provide a lot of value. We have a great engineering organization and a lot of capacity there. but you know we also shoot business people and we look at the opportunities and we see something that makes sense with a good team that can help us say you know accelerate our roadmap we will we will consider to add some more on in terms of the convert and and kind of how we look at it um obviously um our 2020 convert was coming due in august 2025

So we obviously didn't want to wait for the last minute and decided to opportunistically raise in a really favorable convertible market. But as Yaki mentioned, the convert really allows us to be more offensive as we've talked about the fact that our opportunity has never been bigger than it is today. But we did not think that doing a deal is a necessity to achieving our $1 billion ARR target. Rather, this sets us up to grow at healthy levels way beyond the $1 billion of ARR with additional capital allocation flexibility. But I think that what's very important to note is that this allows us to look at slightly larger M&A, but nothing crazy or changing the risk profile of the business.

So I just want to emphasize that.

There are no further questions at this time. I would like to turn the floor back over to Tim Pertz for closing comments.

Thanks for joining us today. We appreciate the interest in Varonis and look forward to speaking with everybody at the conferences this quarter.

Goodbye.

This concludes today's teleconference. You may disconnect your lines at this time. Thank you for your participation.