Varonis Systems, Inc. Aktie

All right. Good morning, everyone. Thank you for joining us. My name is Brian Essex. I'm JPMorgan's mid-cap, large-cap software analyst. With me today, I'm very happy to have Varonis. We have Guy Melamed, the CFO and COO. And then we have David Gibson, SVP of Strategic Programs on the end here.

Good morning.

David, thank you for joining us. We appreciate it.

Thanks for having us.

Maybe a great place to kick off is on the results of the quarter. Would love to understand, maybe just a quick summary in terms of like where the outperformance came from? And how are you managing the outlook given what we've seen in 1Q as well as second quarter so far.

So you're right, Q1 was definitely a good start for the year. We were very happy with the performance. It was very much driven by new customers, definitely saw very nice growth there in terms of the number of customers. And this was something that we talked a lot about with kind of the move during the transition to the part in 2026, which is really kind of the last leg of the transition and the fact that the reps now can focus on what they know best, which is selling to new customers and upselling to existing SaaS customers.

This was something that they had to -- they really didn't have that opportunity in 2025 when they were focused on the conversions as well. So in 2026, this was a change that we made that I think kind of helps us go back to basics and something that we're happy with kind of the results that we saw in Q1, and I hope we can continue to see that in the quarters ahead.

But overall, from a conversion perspective, I think we're kind of tracking as expected. New customer, as I mentioned, was healthy. I think we can -- one of the interesting parts of the quarter was the contribution that wasn't material in dollar terms, but in terms of conversation and focus and desire of customers to know more about the Atlas acquisition that closed actually in February, so it didn't really have a chance to have an impact in the quarter itself, but definitely generating a ton of momentum from a pipeline perspective. David can talk more about what he's hearing with customers. But I think those are kind of the frameworks of the quarter for people to understand.

Very helpful. Where did things land out in terms of quota attainment versus maybe what you planned and how aggressive are quotas given that you're just coming off of the transition?

Just to give some background, very similar to other software companies, Q1 is the smallest in dollar terms for the year, and Q4 is usually the largest quarter in dollar terms. So Q1 is still, I'd say, a smaller sample. But when we look at the attainment, it was very encouraging. It was better than previous year from a percentage perspective in terms of being on track of reaching their number.

We -- I wouldn't say we were aggressive. I think we're very fair in kind of the way we position commission. And in the essence, the highlight that we try to make sure that we live by is that we win together and we lose together. So reps that do the right thing and can achieve in the proper way can make money, but it's never a layup. So we definitely try to balance that. And I think that the results in Q1 were encouraging.

Yes. And from a hiring perspective, given what you saw in the first quarter and maybe we've seen so far, how do you feel about hiring for the year? And what is the plan? How mature are the reps and how do you think about building out that organization to get you more better market penetration capability?

So we're definitely hiring in the right spots and in the right locations. There are places that we feel that we're underpenetrated. We're also managing out the underperformers. And I think that's always been the case to make sure that you don't have people that aren't delivering what they should be delivering and just sitting on the payroll.

So it's always kind of a managing -- a balancing act, and I think we've done that well so far. The expectation and planning from our perspective is to continue to increase the headcount, but it will be done in a measured way and obviously, taking into consideration what are the growth rate expectations and making sure that we can -- overall hiring percentages should be below the top line growth.

Got it. And then maybe, David, on your end in terms of customer conversations, it's been really interesting. I've been hearing a little bit more frequently with companies and partners and industry participants I've talked to over the past couple of weeks that after Mythos came out, people just freaked out. How would you describe from a macro perspective and a demand perspective, has that had a meaningful impact on your pipeline? And how are companies thinking about spending on the Varonis platform now versus maybe last year when it wasn't such a material issue?

So I think Mythos was quite a marketing event, and it got people's attention on the fact that AI is going to help find vulnerabilities for both good guys and bad guys. And so what are we going to do to defend that? The cyber adversaries are becoming more and more sophisticated all the time. I don't think it necessarily changes what people will do, but how quickly they might do it has changed with the awareness of what's happening there. And it's not just Mythos, right? There's all sorts of frameworks and models that are going to be good at this.

What I think is bigger, though, is the desire to implement AI for different business processes. That is more active, I would say, in our conversations is how are we going to connect our AI systems and the ones that we want to build safely to data. And that's been really the most exciting thing for me over the past few months is how many conversations we're having about AI security and the data security because I believe these are 2 halves to what is the problem of our time.

And I think we've hit on before in previous conversations that data security can be a bottleneck in terms of adoption of generative AI technology within an organization. Where are your customers along that journey? Are they still -- I mean, we've heard a lot of cases that we're still in the experimentation phase of adopting generative AI, but hearing more use cases where you're starting to get a little bit more influence towards moving to production. What are you seeing across your customer base in terms of like where they are in that scale of that continuum of adoption?

I would say they're all over the map. But over the past 6 to 9 months, the momentum has clearly changed. AI has stopped being a curiosity and is now a necessity. It is existential, I think, for organizations to really survive and compete now that they adopt it. But what -- it could kill you if you go too fast and it can kill you if you go too slow, right?

So it's a tricky time, but more companies -- first of all, every SaaS vendor now has an AI component, right? So people have to assess the third-party risk. What are you doing with the data? What models are you using? Are you training on their data? There's a whole litany of problems and questions that they're asking, but they're also starting to see people create their own agents. Copilot Studio is now available if you have Copilot and people are creating agents. What are these doing? Yes, we want more advanced functionality. So let's start doing the scheduling, start building the toolage.

People are realizing that the number of agents is going to start creeping up and potentially creeping up very quickly. And these agents are nondeterministic, right, meaning you can give them the same instructions multiple times, and they'll do a different thing each time. Very hard to scope them, very hard to predict them. We have to watch what these agents are doing. We have to understand the intention of the agents, what were they trying to do, and we need to understand the downstream effects on the data that they're touching.

So the biggest problem is how do we connect to the AI systems to our data safely. Right now, if you -- when you ask where people are, I think we see about 3% of the data that people have is connected to AI, right? So that is -- there's a long way to go there, but there's some urgency. If you think about how good AI has gotten at coding and you think about, why is that? Well, it's got this whole library of the Internet, open source code, right, to go train on, right? It's only as good as the data that it's trained on.

Got it. Super helpful. Maybe, Guy, I want to ask you on the conversions. It seems as though you're taking a little bit more of a, I don't know, approach of flexibility in terms of pricing with conversions. I know before you've talked about this uplift that you get from conversions, it seems as though maybe the intention has been get them converted and then worry about the uplift later. How should we think about the mechanics of that and how you're managing pricing and uplift and attach for customers that do come over and convert?

You're right. I think the way we have treated the conversions definitely changed post Q3 of 2025. I think when we look at some of the lessons learned from that quarter is that some of the customers that were left in the bucket that haven't been converted where apart from being federal and state and government that some of them will never move to SaaS. They are the single-threaded customers that wouldn't necessarily rush to convert to SaaS. And we have kind of changed our mindset as to the fact that we would like to get customers to move even at a flat rate and then show them value with the understanding that we can get additional uplifts. That's definitely been the case in Q4 and Q1, and I expect that to continue for the rest of the year.

The framework that we have provided to TheStreet in terms of the conversions is really a bear case and a bull case, having kind of that $50 million on the lower end and $75 million on the upper end. I expect that we will be somewhere in between. We're using the base case of the midpoint there. It's not a framework that is similar to the other KPIs and guidance that we provide that is usually a starting point, and we expect to do better on the conversion, it really should fall somewhere in between. That's the expectation from our perspective.

And I think that the other thing that is really important to note is that the announcement of the end of life that happened in Q3 did generate a sense of urgency in the conversations that we're having with customers. So the fact that we kind of did that has helped us convert in Q4 of last year. And I think that the conversions that we're expecting to see this year are definitely influenced by that announcement where customers need to understand, are they staying with the on-prem or are they building a plan with us on how to move to SaaS. And we've definitely seen some of the customers that weren't that urged to move with the announcement, building a plan with us on how to do it.

And how do you think about -- you guys have guided to no conversions expected in 1Q and you had some and you have this cohort of customers that are yet to convert. But you got government quarter in 3Q, you've got a lot of renewals in 4Q. Where are your customers' mindsets on that conversion path given the seasonality that you might expect in 3Q and 4Q?

So I want to be very clear. The fact that we haven't guided on a quarterly basis on the conversions themselves doesn't mean that we're not expecting to see conversions. And the reason we haven't guided on the conversions on a quarterly basis is, one, we want to make sure that investors are focused on the right metrics and SaaS ARR, excluding conversion is the metric this year to focus on. The conversions can fluctuate. And therefore, we don't want to put a number out there that could distract and generate a lot of noise.

We are expecting a good portion of the conversions to happen towards the end of the year. There is definitely conversations with customers even if they are up for renewal. We saw that in Q1, and I think that's going to happen in Q2 where customers that are up for renewal and are thinking about converting still want to take another quarter or 2 just to be ready from a budgetary perspective or just kind of the process of getting them converted, and they would focus on doing it in Q4.

So if I had to break down kind of the seasonality of the conversions throughout 2026, I would say that Q3 is probably the quarter that would have the lowest conversions because of that federal, state and government customers that would -- you would see that impact there. And the expectation is that a very large portion of the conversions will actually happen in Q4.

Got it. And then maybe more from a macro perspective, we're hearing a lot about spending outside of traditional security budgets. That could be other parts of an organization that have AI initiatives that maybe need to think about security, but their CISOs are saying, okay, I'll run that for you, but you pay for it. You've also got certainly post Mythos and GPT 5.5, I think you've got some emergency spend being tapped and there's a greater sense of urgency. Like are you seeing that within your customer base? And within those categories, are you seeing any meaningful upside surprise from spending from your customers? Or if you have that kind of visibility?

I know I've probably done more demos around AI in the past couple of months than anything else. And certainly, the volume is unlike anything I really remember in terms of the activity there. I think that one of the interesting things is just we have a broader audience of folks that are vested and interested in making sure that people can deploy AI safely and also keep themselves the fact that attackers are using AI. And seeing all the combinations of phishing and vishing attacks. We've seen a lot of the Internet-connected SaaS application OAuth vulnerabilities. There's some pretty sophisticated attacks going on.

But I think the biggest thing is that the -- what I mentioned before is that in order to compete, the AI must be deployed and security is now partnering with business units to make that happen, right? So there are more stakeholders. There's, I think, a little bit more urgency around, okay, what do we -- we need to drive faster, so we need better breaks, right? So this is just a very -- just to use a very simple analogy. And so what's going to give us the confidence that we can drive more quickly.

Got it. I want to touch on AllTrue and Atlas really quick. And I think you referenced that Atlas upside not in guidance, but what do you anticipate we could see for ARR contribution over the next -- rest of the next year or so?

Again, it's very early still to kind of put a number to it, but there's a lot of encouraging signs in terms of the conversations and the meetings and the evals that customers are wanting to have through this product. I think it's very much the understanding that you cannot be protected from an AI -- with kind of the AI evolution without kind of software that can help you do that. That's why we're seeing so much interest.

As you mentioned, it's not part of the guidance. That's part of what we expect would be some of the uplift. And I think the expectation is that some of this pipeline that we're generating can close in the second part of the year. So not all of it is going to have that much of an impact in Q2. I think it would be more of an H2 impact, but definitely encouraging in terms of the conversations and something that we're keeping a close eye to make sure that we can monitor it properly.

Got it. Any insight around ServiceNow and how they became a partner or a customer and what the rationale was and how that might influence or be an indicator of traction for the rest of the year?

So first of all, ServiceNow is a phenomenal company, and we've been in touch with them for quite some time. We've had very -- we've had a lot of discussions on how we can help them. They can help us. And I think there's a lot to the partnership that can evolve. So we're extremely happy to have sold the additional licenses to ServiceNow, and this was an expansion of them already being an existing customer. And I think there's a lot of things that can work in the future that could help both companies.

Got it. I want to touch next on FedRAMP and federal business. Obviously, federal source of a little bit of frustration in the third Q. But now that you've hit -- you've achieved FedRAMP authorization, how is the pipeline looking? Do you have a good amount of visibility, particularly into 3Q? And how meaningful of a contributor to ARR do you think that business could be?

I'll be very careful when I talk about upside from the federal business. But I would say that, first of all, from a guidance perspective, we don't have any upside baked in and there's no optimistic assumptions. We definitely believe that we can help solve that problem. But from a numbers perspective, we first want to see the contribution.

Yes, there's pipeline and there's deals that we hope we can close. But I would love to talk about them post closing and not pre-closing, if I may. And from a -- again, from a guidance perspective, it is important to emphasize that for the most -- we haven't baked in any optimistic assumptions on federal.

Got it. Maybe for David. I want to talk a little bit about DSPM, particularly on the competitive front. It seems like everybody has it and not all DSPM is created equal. But in general, I would love to hear what you're seeing from a competitive standpoint, whether it's from larger vendors like a Microsoft Purview or some of the smaller vendors like Cyera or a BigID, where do you guys fit in? And how are your win rates versus the peers compared to maybe last year?

Sure. So I would say from a DSPM perspective, I think what's become pretty clear is DSPM is a subset of a data security platform or a data security strategy. It's visibility only, and it's usually limited visibility. It's usually a sample of data on a schedule. And so when we see -- the good news is I think it's generated opportunities for us. We've seen definitely more RFIs and RFPs where we had -- I would say that the conversations now are shifting more towards the AI front, more towards the database activity monitoring, more towards our platform plays.

When we do see RFPs for DSPM, we generally will see -- of course, it's an RFP, it's a competitive situation. That's what it is by nature. So we'll see any of the DSPM players, Cyera, BigID. And usually, if there's a data security component, we have a very good shot of winning if we execute. The use cases that are security-centric, complete scanning, always current based on activity, the threat detection, the automatic remediation of any issues that we find. These are big differentiators from a security perspective. And so I would say this is one area, of course, where we'll compete the platform play, our coverage really help us.

I think that if we can just ask a question, tell us about what's going on with AI, and we start to bridge into that conversation. And it's interesting if we talk about AI and you're going to connect it up to databases, what's monitoring your databases? Well, we have a solution for that now, too. It's -- the platform strengths start to really benefit us and change those kind of sort of tactical competitive scenarios.

Got it. Super helpful. Maybe I also wanted to ask about e-mail. It seems like traction has been pretty robust on the platform. Like how are your customers linking an e-mail purchase to the rest of the platform? And who are you seeing competitively on that side of the business?

Sure. So it's interesting. The way we got into e-mail security is since we came out with SaaS and our managed data detection MDDR service, managed data detection response service, we've had a front row seats to dozens of breaches a day. And we -- about most of them, about 7 out of 10, we detected the identity layer. 2 out of 10, we detected data, 1 out of 10 at the network layer.

But it doesn't matter where we detected it. When we started to say, okay, what was the point of entry here? How did they get in the first place? Most of the time, it was identity compromised through phishing. So we started to ask how can we keep attackers farther from the data? And we looked at all the different solutions out there, and we found one that was head and shoulders above the others. And it's called SlashNext. We acquired it, and it's a very natural extension, right?

If you think about how it connects with our managed data detection and response service, it's kind of natural when people -- when we're detecting, hey, somebody -- you got fished, right? Like we could have stopped that. The headline, I think, is it's a 15-minute install. We do a 2-month or so look back of all the e-mails in your environment, and we find stuff that your other solutions missed. So whether that's an abnormal or another solution, there are many kind of API-based e-mail security solutions out there, Mindpass, there are many of them out there.

But -- so we can kind of show that there's evidence that it's got better efficacy and it's connected to our platform. So we have some leverage there. It can start to make a lot of sense. So it's a pretty easy thing when, hey, it works it's an assessment of your e-mail systems. If we don't find anything great, but we always do.

Yes. To emphasize what David said, though, it has to be seen in the context of the platform. This is not e-mail security as a stand-alone. That was never the intention. And when you look at the offering, it works really well with the MDDR and the platform protection.

And you mentioned identity. How important is it to link identity to the ownership of the data? And how do you see that evolving given that I think some of the identity vendors, at least one is talking about moving into the data space a little bit. How do you see the way that you're partnering with some of the identity vendors to link the data to ownership of that data?

Well, we got there from the data side, right? So we've always had some -- if you're monitoring a Windows environment, you have to see what -- how they logged in an Active Directory, for example, right? You have to see the active directory groups. But we've broadened our coverage of the identity space. So we see not just the configurations, but also the authentication telemetry.

It's been really, really valuable. Usually, when an attacker has an identity, they try to move laterally, get more identities, authenticate to different systems. So it's been a very natural extension for us to have that telemetry from a threat detection standpoint. And our -- because we've been watching identity and data for so long, we have really good detection metrics there. I see it as a natural thing for people to start talking about because they're realizing in an Agentic world, the identity model is completely different.

How are we going to track? What accounts are these agents authenticating with? Do they have their own identities? Are they acting on behalf of a user? How do we track that? When we have multiple agents, how do we attenuate their permissions so we can make sure that we're not exploding our blast ratings with each of these agents. So identity telemetry, monitoring identities is an essential part of the AI and data security stack. We've always had that. It's almost the glue between the layers.

Got you. Guy, I want to ask you a question on fundamentals. How should we think about free cash flow guidance this year as well as where margins are relative to some of the long-term targets that you previously talked about, particularly for fiscal '27. I think there's an ARR target and some profitability targets. Maybe help us bridge the gap and how valid are those -- how about is that target model at this point? Is that off the table or still in play?

So let's talk about when we initiated the targets in Q1 of 2023, just when we announced the transition to SaaS, we built those 5-year plans in terms of ARR, free cash flow and ARR contribution margin. I think most of the investors were really skeptic about our ability to generate free cash flow in the early years of the transition and when usually you're investing the most.

And I think we were extremely happy. I think it has to do with the way the SaaS platform was built to actually be able to show free cash flow improvements over the last -- if you look at the last couple of years from 2023, we've year-over-year progressed very nicely. And if you look at the ARR contribution margin, at the end of 2025, we were basically on the cusp of reaching the long-term model on the lower end of it, but actually being 2 years ahead of schedule.

So I think from an indication perspective, we have done everything in the right way and have been able to prove that we can generate free cash flow and improve that over time and get to the operating margin levels that we wanted to be in. Obviously, with kind of the announcement of the end of life and the understanding that some of the customers will not convert, there is a bit of a headwind, which is reflected in the 2026 numbers. But the expectation is that in 2027, as we are basically 100% SaaS ARR, we kind of go back to the levels.

And I think that from a modeling perspective, there's a ton of leverage in the model that we can benefit from. We've already showed some of that ability in the first couple of years of the transition, but I think that you can see it even further once we're done with the last leg of the transition. So we see the path of how to get to the -- both the top line number and the ARR contribution numbers and free cash flow. Obviously, they all go hand in hand. But the expectation is that if we execute in the right way, we see the path of getting there.

Got it. And then maybe on the capital allocation front, I mean, you've been pretty acquisitive over the past couple of years. You also announced a share repurchase agreement. How do you think about utilization of that agreement as well as allocation of capital as we kind of work our way through the rest of the year?

There are 3 components that we always constantly evaluate in terms of capital allocation. One is putting back in the business. The second one is the M&A side. And the third one is giving back to investors through the buyback. I think we've done a good job of managing those components. We made the tuck-in acquisitions when we felt that it could generate ROI in the years ahead and both the e-mail security and Atlas are definitely components that can help us post the $1 billion ARR mark. So we're definitely happy with those acquisitions.

We constantly evaluate. I wouldn't say that there's -- from an acquisition perspective, we're looking in the same framework that we were looking in a year or 2 ago. So we're definitely trying to digest them and make sure that we can execute on them in the right way. But if something comes in that is a small tuck-in that would make sense in terms of the road map, and obviously, it would be in that constant discussion of build versus buy, what is quicker, what's the better ROI? Does it make sense? We will evaluate.

But I would say that the framework is, I would say, less on the M&A side from our perspective right now and more on making sure that we can execute in the right way. And from a buyback perspective, I think we -- the announcement that we made was definitely a testament to our belief in where this company can be in the years ahead.

And on that buyback, I mean, is that active now? Is that on a grid? Or is it more opportunistic in nature?

So we put the buyback plan at $150 million and gave 12 months. We did the vast majority in -- by the end of Q1. So -- and we're obviously definitely constantly evaluating whether another plan is -- should be put in place and what is the best capital allocation. So we do that analysis on a daily basis.

And maybe I got one more minute left. I want to see if there are any questions from the audience to get you. Maybe one to follow up on that. You guys were one of very few companies where management bought shares in the company recently in the active market. Maybe any insight behind that? What drove that and how management team overall might think about additional acquisitions of shares?

Someone told me once a very interesting sentence and the sentence goes as follows. There are many reasons to sell shares. There's only one reason to buy shares.

That's well put. Awesome. With that, I think we're about out of time. So Guy, David, thank you very much for joining us. We really appreciate it.

Thank you very much.

Greetings, and welcome to the Varonis Systems, Inc. First Quarter 2026 Earnings Conference Call. [Operator Instructions]. Please note, this conference is being recorded. I will now turn the conference over to your host, Tim Perz. Please go ahead.

Thank you, operator. Good afternoon. Thank you for joining us today to review Varonis' First Quarter 2026 financial results. With me on the call today are Yaki Faitelson, Chief Executive Officer; and Guy Melamed, Chief Financial Officer and Chief Operating Officer of Varonis.

After preliminary remarks, we will open the call to a question-and-answer session. During this call, we may make statements related to our business that would be considered forward-looking statements under federal securities laws, including projections of future operating results for our second quarter and full year ending December 31, 2026. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned forward-looking statements and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission.

We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly, any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation for the most directly comparable GAAP financial measures is also available in our first quarter 2026 earnings press release and our investor presentation, which can be found at varonis.com in the Investor Relations section.

Lastly, please note that a webcast of today's call is available on our website in the Investor Relations section. With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Faitelson. Yaki?

Thanks, Tim, and good afternoon, everyone. We appreciate you joining us to discuss our first quarter 2026 results. Our Q1 results reflect our strong performance as we execute on the growing need to secure data and safely enable the usage of AI. In Q1, SAC, excluding conversion, increased 29% year-over-year to $522.6 million in total fast CRR, including conversion, was $683.2 million. I will review our results and our guidance in more detail shortly.

We continue to see strong demand from both accelerating new logos and existing customers because companies understand that they must secure their data in their AI stack. Varonis helps them do that with minimal effort because of the automation built into our platform. In Q1, we saw continued adoption of MVDR and AI-related products, as well as traction in securing cloud environment. Early feedback on our renewal product driven by acquisitions over the last year, including database activity monitoring Interceptor and Atlas reinforces our belief that these offerings are a strong fit to our platform and can help drive ARR growth over time.

Now I would like to take a step back from our near-term results and discuss. While we believe we are best positioned to help companies safely adapt the and prevent data breaches. Varonis founded on the belief that managing and protecting data would be impossible without automation. That belief is even more important today as customer work to adapt the securely. The security model of the last 30 years was not built with AI in mind. Many organizations want to capitalize on the productivity gains from AI, but are only connected a small portion of their data to AI because of security concerns. Companies want to connect more of their data to take advantage of the productivity gains but need the right guardrails in place to confidently move faster.

When we look at what's standing in the way of broader AI adoption, we see 3 barriers securing the data itself, securing their eye systems and agents that touch that data in fighting a high-powered adversaries. The first barrier is securing the data and making sure only the right data is accessed by the right agents and systems. AI pushes existing access controls to their limits because many systems and agents inherit user access that is far too broad. One classic example of this is an employee asking an AI chatbot a basic question and getting confidential information that they should not have access to such a salary data, financial records or intellectual property in a response. This is content a human mistake had access to but was less likely to found without AI.

Previously, a human employee had to log in, navigate, download and take action, there was friction because it took time and effort that reduces risk. In the Agent word, an agent can access a huge amount of your data estate in second agents can move fast, behave unpredictably and maximize privileges by design. And if an agent doesn't have permissions, it will try to get them, connecting agents and models to data is what blocking organizations from safely adopting AI faster. They need remediation at scale and to understand abnormal behavior, visibility alone is not enough.

The second barrier is securing the systems themselves. In Q1, Varonis found the vulnerability called Repom, which allowed attackers to bypass safety controls in Microsoft core pilot personnel. The vulnerability if exploited, would give the attacker access to everything in the core pilot personality session itself could access, including pumps, conversation history and all of the data consumer assist could access.

The third barrier is fighting the AI-powered adversary. We have already seen examples of this, including last year when attackers used cloud code to breach a major organization with minimal human involvement or earlier this year when alone unskilled attackers use the eye to scale an attack across 600-plus firewalls in 55 countries, an attack that would have previously required a team of experts to execute a high-powered fishing doesn't just target humans. It targets agents to.

Agents can read emails, slack and p messages, one human clicking on maliciously is one comprimise identity. An army of agents can multiply the attack surface. The three barriers together overexposed data, unsecured systems, AI-powered adverse series create a create a dangerous environment and companies must build foundational controls that operates at the speed and scale of the starting from the inside out. Varonis do just that by securing the data itself using the automated fine fixed and alert approach. The first piece is signed.

Now what we have across the entire data store structured, unstructured semi structure and application data, classified for sensitivity, context and staleness, so you know what should and should not be connected to -- the second is fixed, rightsized permissions, label data and [ Maski ] manual process can work anymore. The remediation must be automated and AI-driven. And finally alert monitoring and what is accessing your data and detect abnormal behavior quickly to stop breach before it happens.

This is the basis for AI detection and response. Security and data security are intertwined with one another. You need an inventory of a remodel agent and pipeline running in your environment and you need access posture to know what data they can touch, what permissions they have and where they are vulnerable. You need the runtime guardrails to block malicious inputs before they reach the model, preventing sensitive data from leaking outputs and restricting tool use. Finally, you must fit a high-powered adversary, the volume and speed these attacks demand automation. This level only work if they are connected. AI inventory and runtime protection is significantly more meaningful when you know what sensitive data they access and what data they are trained on. guardrails that leverage the same accurate classification and labeling applied to enterprise data store, reduce friction and increase control.

We knew it would be impossible for humans to control data risk without tremendous automation, only AI can defend AI risk. When you press your brakes, you feel safe driving faster. When you have the right guardrails, data and AI become a force multiplier, not a breach waiting to happen. With that, I would like to briefly discuss a couple of key customer wins from Q1. This quarter, a global technology company with over 50,000 employees became a Varonis customer. They needed to quickly and safely roll out the AI tools and also wanted to better protect customers and company, proprietary intellectual property data with compliance requirements and perform forensics analysis in an event of a breach. During the risk assessment, our MDD R team, detected multiply active threats.

We also identified risks in Salesforce and Microsoft 365 and provided an operational plan to fix these risks with intelligent automation. Our ability to provide these outcomes and safely enable the usage of AI or the key reasons why we were selected over several DSPMpoint solutions. They ultimately purchased Varonis for AWS, Salesforce, Google Cloud platform and Google Drive as well as Varonis SaaS for hybrid with MDR and Varonis for core pilots. We also continue to see existing customers expand into new use cases as they consolidate point tools and utilize the breadth of our platform.

In Q1, ServiceNow, a global leader of workflow automation, expanded its Varonis investment to cover internal AI systems and e-mail security, including protection and guess advanced fishing and social engineering attacks used by high-powered adversaries. In summary, AI is forcing companies to prioritize data and AI security. And Varonis is uniquely positioned to help with our unified platform that allows customers to put the right guardrails in place in order to accelerate the high deployment spend. With that, let me turn the call over to Guy. Guy?

Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. Our first quarter performance represents a strong start to 2026 and we are excited by the momentum we are seeing in the business. Demand was healthy across both new logos and existing customers, and we are excited to raise our full year guidance after our strong start to the year. As a reminder, we are focusing on SaaS ARR growth, excluding conversions, which reflects our ability to add new SaaS customers and also expand with existing ones as this is the primary growth driver of our business in the years ahead.

In the first quarter, SaaS ARR, excluding conversions, increased 29% year-over-year to $522.6 million and total SaaS ARR was $683.2 million. In Q1, we had $11.3 million of conversion ARR, and we finished the quarter with approximately $83.7 million of non-SaaS ARR remaining. This quarter, we generated $49 million of free cash flow down from $65.3 million in the same period last year, which reflects the previously communicated headwind from the end-of-life announcement of our on-prem platform and also includes approximately $12.6 million of acquisition-related costs related to the accounting treatment of our acquisitions. Adjusting for the acquisition-related costs, free cash flow would have been approximately $61.6 million in Q1. We remain on track to achieve our full year free cash flow guidance.

Now I'd like to recap our Q1 results in more detail. In the first quarter, total revenues were $173.1 million, up 27% year-over-year. SaaS revenues were $161.1 million. Term license subscription revenues were $6.9 million, and maintenance and services revenues were $5.2 million. Our SaaS renewal rate was over 90%. Moving down to the income statement. I'd be discussing non-GAAP results going forward. Gross profit for the first quarter was $134.9 million, representing a gross margin of 77.9% compared to 80.2% in the first quarter of 2025. Our gross margin continues to be healthy and in line with our long-term target set at our Investor Day. Operating expenses in the first quarter totaled $136.3 million.

As a result, first quarter operating loss was $1.4 million or an operating margin of negative 0.8%. This compares to an operating loss of $6.5 million or an operating margin of negative 4.7% in the same period last year. First quarter ARR contribution margin was 14.1%, down from 16.7% last year. This is in line with our expectations. And as a reminder, is impacted in 2026 and due to the end of life for our self-hosted platform.

During the quarter, we had a financial income of approximately $5.7 million driven primarily by interest income on our cash deposits and investments in marketable securities. Net income for the first quarter of 2026 was $7.5 million or net income of $0.06 per diluted share compared to net income of $0.7 million or $0.00 per diluted share for the first quarter of 2025. This is based on 132.8 million and 136.7 million diluted shares outstanding for Q1 2026 and Q1 2025, respectively. As of March 31, 2026, we had $900 million in cash, cash equivalents, short-term deposits and marketable securities.

For the 3 months ended March 31, 2026, we generated $55 million of cash from operations compared to $68 million generated in the same period last year and CapEx was $5 million compared to $2.3 million in the same period last year. During the first quarter, we repurchased 5,355,445 shares at an average purchase price of $24.67 for a net total of $132.1 million. As a reminder, we will provide quarterly SaaS ARR, excluding conversion guidance for this year only. We are doing this because of the difficulty in modeling the year-over-year growth rates due to the impact of conversions in 2025 and 2026. We are also providing a bridge to quarterly total SaaS ARR in our investor deck, which again assumes 0 conversions from a guidance perspective for the upcoming quarter.

For the full year 2026, we will provide annual guidance for both SaaS ARR, excluding conversions and total SaaS ARR. For more information, please see our earnings deck in our Investor Relations website, which includes a more detailed breakdown of our financial guidance. For the second quarter of 2026, we expect SaaS ARR growth of 24% to 25%, excluding conversion, total revenues of $175 million to $178 million, representing growth of 15% to 17% and non-GAAP operating loss of negative $1 million to breakeven and non-GAAP net income per diluted share in the range of $0.00 to $0.01 a -- this assumes 131.1 million diluted shares outstanding. For the full year 2026, we now expect total SaaS ARR of $814 million to $845 million, representing growth of 27% to 32%. This represents SaaS ARR growth of 20% to 21%, excluding conversions.

Free cash flow of $100 million to $105 million, total revenues of $731 million to $737 million, representing growth of 17% to 18%, and non-GAAP operating income of $7 million to $9 million; non-GAAP net income per diluted share in the range of $0.11 to $0.12. This assumes 132.1 million diluted shares outstanding. In summary, we are excited by the strong start to the year and continue to see healthy momentum from both accelerating new customer wins and expansion within our installed base. Our Q1 results, coupled with the underlying drivers of our business give us the confidence to raise our full year guidance for total SaaS ARR growth to 27% to 32%. In addition, we increased our guidance for SaaS ARR growth, excluding conversion to 20% to 21%, and we believe we can sustain this level of growth as a fully SaaS company. With that, we would be happy to take questions. Operator?

[Operator Instructions]. And our first question comes from Saket Kalia with Barclays.

Okay. Great. and nice start to the year. Absolutely. Maybe a question for both of you. I think one of the thoughts this year has been that Varonis sales teams could spend more time now on new business rather than on both new business and conversions as they did last year? Guy, maybe for you, can you expand on how that's looking the first quarter into that new model? And Yaki for you, where are you having that success in driving new business?

You're right. We talked a lot about the fact that the conversions from on-prem subscription to SaaS, we're cannibalizing the time of the reps and that in 2026. The way we've structured the commission plan and the way we focused our reps is to go back and focus on upselling SaaS customers with additional products and going into new TAMs and selling new products and selling our SaaS offering to new customers. And we saw an acceleration in the new customer contribution, which we're extremely happy with.

And it very much fits with what we were trying to achieve and the strength of the platform. So our sales force is able to go and with the simplicity of the SaaS offering, sell to customers that we wouldn't be able to sell before, and that's worked really well in Q1, and we expect that to continue in the year ahead.

In terms of what's in the market, the reality that for organizations to realize the value from AI from others and agents, they need to connect their organization and information into it. They are as good as the data. And this is the biggest problem that we see for our organization. We call it the 3% paradox. It's very hard for them to securely connect the data. So the NBD becoming DCI detection and response. Automated remediation of excessive permissions is the holy grail.

If not, just agents will create and lead a massive amount of information that they should never touch. And you also see just a lot of attacks that are AI based, and this is hitting on all cylinders with the value proposition of the platform. You need just foundational security that is automated, but it needs to be security. It can be just partial discovery. It's scale. And I just -- it's every data type structure, unstructured application in the cloud. and on-prem, this works very well for us and we see that it's driving the business.

Our next question comes from Rob Owens with Piper Sandler.

I want to build on Socket's question a little bit and just drill down into the selling efforts. And I know in the prepared remarks, you talked about accelerating new logos and expansion. Anything you can do to quantify that for us or give us a sense of how and where that's trending.

So just in terms of the conversion, we see that just the organizations need to convert all the data stores and definitely AI small urgency around it because what happened essentially, and it's happened very fast, that is text stack, if you will, that organizations have is changing completely before we had a user that is accessing data through a user interface to a file system or just through a user interface to an application and it changes completely starting to have an agent that is accessing in robotic speed. Many times by using tools from any kind and the store customers and prospects understand that they need to understand what they have and to protect this data immediately because before in the model, you had a lot of friction.

User needs to be malicious or to do just a growth mistake in order to get the information they shouldn't get. The agents will get to it immediately. So what happened fairly fast is that the most important security controls are moving to 2 places to the agents and to the data, and this works very well for Varonis.

And Rob, just to quantify in terms of the new customer contribution, we saw, as we mentioned in the prepared remarks, an acceleration in the actual total number of new customers, it was pretty significant from our end. And what we also think and believe is when we look at the contribution from some of the new products, even though Atlas only closed in February. We saw some nice contribution there, nothing too material, but definitely something that gives us the confidence that we can continue to sell that at an accelerated pace throughout the year and that's not baked in the guidance.

So when we look at the Q1 behavior, it was definitely kind of driven by the new customer side with a lot of opportunity throughout the year from an upsell opportunity with some of the products that we have that isn't baked in the numbers that we put out there.

Moving next to Meta Marshall with Morgan Stanley.

This is Abhishek Marley on for Meta Marshall. As on the quarter. I was wondering if we could get an update on the Microsoft CoPilot partnership and whether there are any channels that are driving new customers there?

So Microsoft copilot is one of them, but what we see is that the organization needs is control plan for every from just a lot of just models and coal pilot and just so much technology so much innovation that is just happening in neck break speed, and we are protecting everything with the acquisition of Atlas.

We have the ultimate control plan for agents protein pipeline, and we protect every data type. And what happened is that I think that what is important to understand is that the overall velocity you have these agents, the taxiing data, you need to be ahead of them in your remediation. You need to understand any abnormal behavior. If weather forecasting agent is accessing HR records in EM in the morning, you better know about it, and you will be amazed how often things like that are happening.

So CoPilot is one of them, but we definitely see that in order for these AI agents and models to be useful, they need to be connected to data. And the only way that you can do it is in a secure way and it's just slowly but surely, we are becoming the foundation for our organization to adapt the incur.

Next, we have Joshua Tilton with Wolfe Research.

Congrats on a pretty solid quarter. I have one, it's more of a clarification. And I think maybe you addressed it in the beginning, I'm not sure if I heard you correctly, but I was kind of under the impression that the free cash flow guidance for the year is the way it was because there was an assumption around churn because you guys are basically guiding to no conversion or some assumption that some of these remaining on-premise customers would convert, and then you have a quarter where you did convert some customers that the free cash flow guidance for the year kind of stayed the same. So I'm just wondering why the free cash flow guide isn't moving up as you actually execute on converting customers, but I'm assuming we're assumed to churn originally in the guidance?

Let me clarify that. When we gave guidance on the full year numbers, we assume the bear case scenario and a bull case scenario on the conversions, which was $50 million to $75 million. we are on track to achieve those numbers, and that's part of our free cash flow guide. It's not that the free cash flow guide assumes 0 conversions. It assumes that midpoint range, that base case scenario of that $50 million to $75 million. And we're actually, when we look at the Q1 conversion numbers, they were actually on track, and we felt very good with the numbers that we were able to convert in Q1. So the actual reduction that we announced last quarter on the free cash flow side was on the delta, the expectation of churn with the announcement of the end of life.

And that was the headwind that we were talking about, but it was still baking in that 50 to 75, and we feel very good with that guidance for the year on the free cash flow side and still assuming to be within that base case scenario of conversions for the year.

We'll take our next question from Roger Boyd with UBS.

Great on the quarter. For Yaki or for Guy, you mentioned enterprises prioritizing AI security. I think this has been kind of the bull case around Varonis for a while now. I'd love to get your sense of like did something change this quarter? And how did that actually manifest as you look at kind of on a monthly basis throughout the quarter. Would you characterize demand from enterprises as ramping throughout the quarter and guide just any sense of what you're seeing through April and how that kind of factors into the guide for -- I think it was kind of flat net new SaaS ARX conversions.

I think that what you mainly see just from a border marketing, obviously, everybody has just investing in tooling and understanding how they can just derive real value from it. And there are obviously some use cases that are unbelievably strong, but the realization that we see is that they get -- they understand that they need to connect data securely and to make sure that these agents can work like employees, they need to make sure that they can connect it to all the universe of knowledge that the organization has. This is something that is just very hard to do because what happened that before if you have excessive access control or data was exposed, the users need to be malicious in order to get to it, the agent for get it immediately by design and making many times all efforts to remove very important security controls.

So more than anything else, what you see is that just slowly but surely just an understanding that you need to secure the system and the data that have it. And this is something that works very well for us. We see more strategic conversation. We definitely see that organizations understand that they need to look at everything. Even when you look at databases, historically, databases was DBA's accessing databases and you have what we call connection pool. But now with agents. They can access it like a collaboration. So a lot of the way that these edition models consume information is something that puts the security in a high security purity.

And I'd like to address the second part of your question. When we look at the Q2 guide, it really is kind of just following the same responsible guidance philosophy, and we're really excited with the start to the year. and the performance that we had in Q1, and we feel very good about Q2 and the pipeline that we have for the rest of the year. So it really is just keeping the same philosophy guidance.

Moving on to Matt Hedberg with RBC Capital Markets.

Congratulations on the results. Obviously, a lot of moving parts here. I guess there's a lot of uncertainty in the market, whether it's the Iran war, maybe demand trends in the Middle East or even some of the head count reductions that we've seen out there from customers in different verticals. I'm just kind of curious, if that's starting to creep in any customer conversation and Guy have -- is SANR trending up? It sounds like renewals are strong, but I'm kind of curious on the SaaS MRR side.

Just in terms of just conversation with organization, it was primarily about just data NAI security. If you look at our pricing scheme and models, so much of it is just based on the volume of data, data store. And for us, it's just the identities that are accessing data. So this reduction in head count is not something we are feeling in effecting our pricing in any way. But our team is tremendous and I want to thank them that during this content, we're able to maintain the right productivity levels, and we were just in front of customers, helping them secure the data.

And from an NRR perspective, obviously, we provide the NRR on an annual basis. But in talking about the trends, we feel very good about our ability to go back to customers, SaaS customers and sell them additional licenses. And we talked a lot about the being able to finish the transition quickly and have our sales force focus on selling additional products, and it's definitely something that we saw in Q1.

And we believe that we can actually continue and do even better throughout the year with a platform offering that we have. So when we look at the trends and when we look at the conversations and when we look at the pipeline and look at and track the meetings, it's definitely trending in a positive way, and we feel very good with our platform ability to go back and have the sales force focus on what they know how to do best, which is sell to new customers and upsell to our existing SaaS customers.

We'll go next to Brian Essex with JPMorgan.

Great to see a Q1 beat and raise and such an uncertain macro. I guess I wanted to poke on the non-SaaS ARR remaining, and it was great to see that you had $11.3 million of conversion business in the quarter, and you guided to I wanted to understand what the composition of that outperformance was -- and then of the remaining $83.7 million of non-SaaS ARR. Can you help us understand what the composition of that cohort is, have the weaker or single-threaded customers churned off? Have we seen like a front-loaded churn rate and maybe it's higher quality? Or maybe just to give us a sense of your level of confidence in that portion of business that may convert over.

Brian, there's a lot of unpack. I'll try and tackle them one by one. I'll start with the conversion guidance. We said at the beginning of the year, that we're giving a base case scenario, a bull and a bear case range basically that $50 million to $75 million. We stand with that number and feel good about our ability to get to the conversions we saw very healthy conversions in Q1. And the reason we didn't guide for any numbers on a quarterly basis. It's not that we don't expect conversions to happen. We just didn't guide for them. And there are 2 reasons for that.

Reason #1 is we want to focus investors on what matters the most, which is SaaS ARR, excluding conversion, which is a KPI that puts the emphasis on how this business would go post transition. And we don't want to put too many numbers out there that would confuse everyone. We know that there's a lot of moving parts during this transition. And keep in mind that the end of this year, SaaS ARR would be ARR we will -- with the announcement of end of life, we're condensing everything, and this will be very, very simple. And there's only 3 quarters to kind of go through with the moving parts. So that was reason number 1 of not putting a number on the guidance from a conversion perspective.

And the second reason is that there are a lot of customers that kind of fluctuate on their conversion period. And some of the customers in Q1 where the renewal was up for renewal on the on-prem subscription side, will convert later on in the year. So we're definitely seeing those numbers kind of move and we didn't want to put a number out there that would confuse investors and analysts. And that's why we're just giving that full year range of 50 to 75, and we feel very good with that number. In terms of the single threaded breakdown. We saw that continue in the same trends that we have seen in the past. And if you remember, the focus of those on-prem subscription customers that will not convert was mostly on the federal and state and government customers.

That was the cohort that we felt would be impacted the most by not moving to SaaS, and we still think that is the case. So when we look at the numbers of that single threaded that converted, they continued to convert at the same rate that we have seen in the past. So we felt very good about that as well. I hope I answered all of your components to the question. But really, just the highlight of my answer is that we felt good with the conversions in Q1, and we feel good with what's yet to be converted for the rest of the year.

And Richard Poland with Wells Fargo has our next question.

On the cash flow, I just wanted to clarify 1 point. I think you called out $12 million to $13 million of acquisition-related costs that seem to affect the cash flow side of things, but obviously not the non-GAAP operating income. I just wanted to see if there's anything for the remainder of the year with respect to some of those acquisition-related costs and is it a scenario where we should try to back that out for a cleaner, I guess, year-over-year compare?

So the biggest impact, obviously, was in the Q1 numbers, and that's why we broke it out. Obviously, we're still -- we remain on track to achieving the full year free cash flow guidance, and we want to emphasize that and highlight that. But for a visibility perspective, we wanted to highlight that $12.5 million headwind coming from the accounting treatment of the acquisitions, and that's mostly the all true that took place in February, we wanted to put that out there so investors can understand the apples-to-apples comparison, and that's why we highlighted that.

We'll go next to Mike Cikos with Needham & Company.

Congrats on the quarter here. I just wanted to come back to the commentary, whether it's the press release or the prepared remarks here, but it seems like the company is being more assertive as far as what the sustainable growth is for this company ex conversions, citing that 20% to 21% growth, if I'm just looking at the trend rate here last quarter was 32%, more 29%. We're guiding to 24 to 25 million this coming quarter. Can you just give us a better indication of what gives you the confidence to be putting that full out there today, just to help throw the lines for some of the longer-term investors who are looking at this asset post conversion.

So first of all, you're right. When you look at kind of the full year guidance, we went from '18 to '20 to kind of having the low end, starting with a 2 handle, and we feel very good about that, and we feel -- we believe we can continue that growth rate. We talked for a long, long time about our ability to continue to grow 20-plus percent with the platform that we have and with our ability to sell to new customers and go to the base and sell to upsell to existing SaaS customers.

And I think that when you look at the trends that we've had in Q1 -- they give us the confidence when you look at the environment out there, being able to accelerate with new customers is definitely something that we feel very good about and gives us the confidence. And when we see how our existing SaaS customers are receptive to additional licenses and the platform offering that we have, we definitely believe that there's a lot for us from a customer value perspective, customer lifetime value perspective to go back and we've seen how many of the customers consume more and more -- and that's part of the reason that we feel very good about that noted it in our Q1.

Moving next to Joseph Gallo with Jefferies.

Can you just talk a little bit more about Atlas initial traction feedback? And who you're competing with? Is it against pure plays? Or are people trying to do this themselves to use the platform. And then if at all, did the Ultru.ai acquisition contributes to ARR this quarter.

We see just a lot of a lot of momentum around Atlas in terms of the overall interest in terms of the AI life cycle. We strongly believe that it's the most comprehensive product out there, but he also has a massive force multiplier with the Varonis platform. So the key is how you connect everything to data. Atlas is your best way to manage and models and pipelines and then connected to Varonis is what will give you the ability to use AI in a secure way. So there is just a lot of noise in the market. But at this point, no one has just on the actual pipeline, tools and models, no one has something that is so comprehensive and the sales motion is together with everything that we have.

I want to clarify that when we acquired Alt, there was no ARR that was added as part of the acquisition. So really, if you remember, the transaction closed in February, and it's not that we expected that it would have a significant impact and it didn't have a significant impact in Q1, but there were definitely early signs that were encouraging in terms of conversations and in terms of some of the evals that were put in and even some several POs that we were able to get. But again, nothing significant that impacted the quarter from an ARR perspective.

However, and as Yaki mentioned, the conversations and the pipeline that we're seeing is definitely giving us the encouragement and the expectation that we would see all to contribute more throughout the remainder of the year. And as I mentioned before, that is not part of our guidance. We didn't bake in any optimistic assumptions with all true selling throughout the year. But it's the upside ability and the conversations that give us the confidence to actually see that happen in Q2, Q3 and Q4.

The initial conversations and more so the results from the POCs are very encouraging.

Our next question comes from Shaul Eyal with TD Cowen.

Congrats on the solid performance and guidance. a supply chain attacks remain a major threat, especially when sensitive data moves beyond your original provider. As you look at your platform today, do you believe your supply chain security capabilities are sufficient? Or is this an area where you plan to invest and expand. And maybe a second one, what are you displacing given some of those big logos that you just announced one of them earlier on the call?

So in terms of supply chain China attacks, this is how bad actors are getting in and with that's much, much easier for them to get in and interceptor is doing an unbelievable job, but -- and we believe that what we have in terms of the fishing sandbox and all the assets that we have with the browser extension and the mobile devices. We are just in the best position in the market, but as attacks becoming more sophisticated we keep investing in it.

And we -- and I think that this is in terms of just overall fishing, spearfishing and wishing a tax of this nature. This is how adversaries will get in, and we are extremely well positioned and it's also worked unbelievably well with our MVDR. And in terms of just replacement, it can be just database activity monitoring other point solutions that related to D SPM. But what we started to see this quarter is that AI security and overall AI budget starting to move slowly towards the platform.

Our next question comes from Rudy Kessinger with D.A. Davidson.

I'm curious, I want to dive in on the makeup of the SaaS and Rx conversions up 31% year-over-year. Was that primarily driven by higher new logo contribution or similar expansion rates on a larger renewal pool. And then also, how did the composition at Nuvera look relative to recent quarters in terms of the workloads that you're protecting, specifically maybe in Microsoft or the Azure ecosystem versus everything else.

I'll start and then Yaki can provide some color. When we look at the contribution in Q1, it was definitely driven by new customer acquisitions, and that's why we highlighted the acceleration on the new logo side. But as I mentioned before, we saw very encouraging signs in terms of our platform ability and our additional upsell opportunity throughout the year and our ability to go back to SaaS customers and sell to them additional licenses, both the SaaS offering that we have and some of the additional tuck-in acquisitions that we have made. So I think when we look at the holistic view of that -- the new customer was the encouraging part and the upsell was definitely there, and we think that it can actually do better throughout the year.

In terms of just the Microsoft ecosystem is a very small part of the data. We are doing very well with all the SaaS applications, AWS, GCP, as you data on-prem databases everywhere. So it's just AI consume data wherever it lives and we protect it. But overall, Microsoft is starting to be a small portion of the entire information state that organizations have.

Moving next to Jason Ader with William Blair.

Yes. Thank you. Can you guys talk a little bit more about the kind of the broader competitive landscape I know that some of the cyber guys have some overlap with what you're doing and you have some of these start-ups. Maybe just talk through if you're seeing different players than you normally have seen. Are you seeing more people at the table during bake-off? I mean you had a strong new customer acquisition quarter. Were those competitive deals versus what you've seen in the past? Just some more kind of specifics on the competitive landscape would be great.

Yes. So obviously, now we just the platform is so much broader now. But if you look at what they call the DSP market, this is not data security. We have a comprehensive data security platform that provides automated outcomes. So there is in the market data discovery tools that doing something that 20x what called sampling this partial classifications. We see them from time to time. But when customers are POs versus just data security and AI is pushing data security because you need to do automated remediation understand abnormal behavior to data and understand the identity component there is we just usually crushed them immediately.

On the interceptor, this is sometimes we can see just companies like abnormal or proof point. But primarily, we sell it with the platform in the database activity monitoring, we're replacing the incumbent like Imperva and improving guardian. So this is really the dynamics that we see. But what happens is that the platform is starting to address more and more use cases. And what we're starting to see that is interesting, we can take budget point solution, but we're also starting to get budgets on this AI, you know digital consummation and security is such a key fundamental component out of it and these organizations but pushing AI out and those standard first and foremost, they need to secure the data and have the observability to what's going on in the life cycle of the IP, and this is another source of budget.

Moving next to Jonathan Ruykhaver with Cantor Fitzgerald.

Yes. I'm curious, Yaki, to hear your thoughts on where you see the boundary between Varonis and identity vendors, particularly given the convergence we're seeing between identity and data security strategies, there does seem to be a question related to who ultimately owns that control and governance player around AI agents. So any color on how that strategy might be resonating any customer feedback or color on adoption of identity -- of your identity solutions would be helpful.

Thanks for the question. I think what happened early on is that organizations thought that they can use identity solutions to solve the problem, but fail. The identity is critical. You need to provision an identity, understand how they are going to use it. The identity itself, if you can see what data is touching -- and if there is any abnormal behavior and exactly what are the tools they are using, you have -- you are very limited in the value that you will get and you can provision identity in the right way and then the agent to use the wrong tools and will access the wrong data and it will end in a catastrophe.

So I think what we benefited from in Q1 was actually the understanding that the identity provisioning is very important but limited and what you need to do is really to manage this whole thing from inside out. One side is the data on 1 side is the pipeline and tools. And obviously, we coexist organization both of them, but to get the value, you need to connect it to data. And the only way to do it to get the benefit without the downside is to do it in a secure way. You need very good breaks in order to drive fast in this AI.

And next, we have Erik Suppiger with B. Riley. Erik, your line is open. Okay. Hearing no response, we'll go next to Todd Weller with Stephens.

Just a question on the expansion opportunity. Could you talk about the relative opportunity between data workload expansion versus cross-selling the new products you have? And then from a workload type perspective, what do you see driving kind of the strongest growth?

So I will start on the end. The workflow is everything. So if you really think about what applications are accessing and users are accessing to do their job. This is what the agent needs to access in order to be useful. So most data in organizations and a lot of the time in order to really to build this data state and derive good conclusion, they also take a lot of historical data. So the overall data estate becoming very super critical, even data that is stale. So it's really everything.

What I do essentially, it really drives to protect or it really drives to protect all data. And with that is whatever data you want to connect to your system, this is how we can expand. And I also think that some use cases that were a bit more compliance driven like database activity monitoring becoming just a top priority for security risks because the consumption changed with the AI usage. So this is really what we see. The data is everywhere, and these technologies are accessing all the data. in just a neck break speed and you need to be ahead of it with robotic value proposition.

We'll go back to Erik Suppiger with B. Riley.

Yes. Apologize for that. Congratulations on a nice quarter. So in your conversations with customers, how much of your new ARR is driven by the traditional threat of outsiders Xltrading data versus how much of your discussion is focused on AI and securing agents? And then on the former -- has the news that came out of anthropic about enhanced capabilities for vulnerability, identifying vulnerabilities, has that made a difference in terms of some of the discussions with customers, are they more looking at securing data in a more urgent manner in terms of some of these vulnerabilities coming out?

I think that what -- I think what the security concerns regarding information that we had with humans becoming -- it's the same concerns. But just if you will think what happened in the agent or that the probability that something will happen just in cases orders of magnitude, it's very easy. They start to deploy agents especially something happened that really triggered the need for organizations understand it.

In general, with everything that is happening with these models that finding vulnerabilities organizations understand that many times because you can find the vulnerability, it can be easier for bad actors to come in and then when they are coming in, essentially, what they want is data. If you had a breach on an touch any day, nothing happened if data was taken, you have what we call the lasting damage. So it's just -- everything works together, but it just amplifies the need to secure all data. And also, there is an understanding that means this needs to be completely automatic.

Moving next to Shrenik Kothari with Robert W. Baird.

Congrats on the solid quarter. So you sounded especially encouraged by the accretion in the new customer contribution in the quarter driven by new logo with a lot of upsell expansion opportunities still in front of you. So just as the fee is spending more time on true new and upsell rather than conversion, like how should we think about the current mix between the new one expansion? And over time, like in supporting your durable 20% plus organic growth, algo that you talked about, what does the steady-state balance of those new versus expansion look like?

The ability to go to new customers with our SaaS offering is very clear to us, and we have seen it throughout the transition. But obviously, where reps had to focus on the conversion. We talked a lot about the cannibalization of time. And as we kind of move past the transition, they can go back and focus on the new customer sell. And we've definitely seen that with the offering we have, we can reach new customers that we didn't have the opportunity to do it before. If you look longer term, the expectation is that the platform that we have, the majority of the ACV should come from the existing base.

We definitely see that opportunity as a significant one with the offering that we have. And when you have such a large base and when you think about the run rate that we have, we're expected to finish the year just under $850 million. That's a big base of customers, thousands of customers that you can go back and sell them additional products and protect them in a way that will give them the comfort to use AI and be able to address the needs. So if you look longer term, we definitely believe that the contribution from existing SaaS customers should drive growth.

But again, with a focus on new customers and when you look at the comp plan, we made sure that reps would focus on both new customers and existing SaaS customers and that's how they can make the most amount of money because we believe that, that should drive our trajectory and growth in the years ahead.

And moving next to Junaid Siddiqui with Truist Securities.

Great. I just wanted to ask, what are you seeing from customers that are adopting Atena AI, specifically, what are you seeing, how quickly are they adopt? How quickly is the adoption ramping up post deployment? And what's distinguishing customers who embed athena into their daily workflows versus those where usage stalls after initial enablement? And is that -- are you seeing any change in deal sizes or close rates or post sale expansion versus customers that are not using it?

Part of the product. And this is the key that you need to -- you are able to use it in just natural language without any enablement, and it works very well for our customers. And big part of the platform and then the automated outcome is what we call not touch value, a lot of the value just from the remediation and [indiscernible] automated classification, everything is happen automatically. And when you need to do something you can do it, but just talking to the platform, it works very well, but is part of day-to-day usage of the part.

We'll go next to Fatima Boolani with Citi

Guy, I wanted to ask you about ARR contribution margin and how we should think about the linearity of that over the course of the year, understanding the absent flows of how conversions are trending. But maybe if you can help us map it back to the Bowling Bear case as you framed it for conversions and the relationship to ARR contribution against what our appearing to be very responsible organic OpEx investments.

Absolutely. We talked about the conversion kind of breakdown behavior throughout 2026. And the expectation is that a big part of the churn on the on-prem side will be related to Q3 because if you remember, that's the quarter with the largest federal and state government. So the expectation was that a lot of the conversions would actually happen in Q4 towards the end of the year. Obviously, we will try to convert many of them before, and we're focused on that. But if you look at kind of the behavior throughout the year, I think it will be somewhat back-end loaded from a yearly perspective.

And as such, the ARR contribution margin will look -- will kind of even out throughout the year with the contribution that you see on the conversion itself. So that's kind of the framework to think about that's the way to think about generally kind of the profile there. And also, if you look at the actual season regular seasonality of SaaS sales, we do have a significant portion of our sales that take place in Q4. So when you look at that as well, you can see that from a cost perspective, they are somewhat, I'd say, for the most part, relatively flat. And therefore, when you look at the profile margin in previous years, you would see that the biggest contribution does take place in Q4, and I expect that to be the case in 2026 as well.

This now concludes our question-and-answer session. I would like to turn the floor back over to Tim Perz for closing comments.

Thanks again for the interest in Verona. Please reach out if you'd like to call back. We look forward to seeing everybody at the investor conferences this quarter.

Goodbye. Ladies and gentlemen, thank you for your participation. This does conclude today's teleconference. You may disconnect your lines, and have a wonderful day.

All right. Welcome, everybody. While we get situated, I'll read the disclosures real quick. For important disclosures, please see the Morgan Stanley research disclosure website at morganstanley.com/researchdisclosures. If you have any questions, please reach out to your Morgan Stanley sales representative.

I'm Meta Marshall. I cover cybersecurity here at Morgan Stanley. We're delighted to have Varonis, Guy Melamed, CFO; Brian Vecci, CTO.

All right. Perfect. Maybe just to kind of start with in terms of -- just those who are kind of less familiar with Varonis or kind of data security in general, just kind of giving an overview of the company.

So where I'd start is almost all aspects of cybersecurity touches on data. Nobody breaks into a bank to steal the pens, they're after money. Nobody gets access to an account, an identity, an API these days, an agent, your infrastructure unless they're really after data. Companies face when it comes to data because they have so much not just in data centers these days, but in various cloud platforms, all of the hyperscalers, the applications, all of the AI workloads that they're building. They face a lot of regulatory risk. What do I have? Where is it? Are all the right controls in place, a lot of reputational risk. They don't want to be on the front page of the Wall Street Journal because they got breached.

And they need to do more with less. They need to be able to automate fixing all these problems. And that means they face a lot of operational risk, not just in protecting data, but in making sure that they can do all this effectively. So we have an automatic security platform that answers all those questions, helps them implement controls safely, quickly, automatically, and if you're a CISO, what that means is, if you're a Varonis customer, we stop breaches, we stop you from getting fined. We make it really easy to automate all of the workloads that you need to automate from a security perspective. We minimize how long it takes to detect and respond to threats. If you do all that really well as a CISO, you're doing a very, very good job and you can deploy AI safely and quickly, which is at or near the top of everybody else's priority list.

I can always give the nontechnical answer. Sometimes it's easy to think of us. We're trying to do to cybersecurity, what the credit card companies were trying to do to fraud detection. And when you think about credit card fraud, all of us, when we travel, we get this text message, is this you? Yes, no. And the credit card companies have become really good at identifying what is abnormal. And the reason they have become so good in detecting what is outside of the spectrum is because they know everything about us. They know what we buy, where we travel, who we're eating with.

And by having that full set of information, they can identify if there is behavior that is out of the norm. We do the exact same thing with data because we see who opens files, who moves files, who deletes files. And by having that full visibility, we can identify if someone is opening way more files than they usually open or if they're deleting files that they shouldn't even have access to. And whether it's someone from the outside that's taking over their credentials in order to get access to data or that employee is about to leave and now they're kind of getting ready for that next job and they want to take some of that sensitive information. It doesn't really matter what the reason is. We can help those customers be protected.

And as Brian mentioned, there are really 3 things that we try to do. One is ensure that you don't have a cyber attack and you can be protected. Second thing is that you won't have any fines that are related to sensitive information that you're not guarding the right way. And the third thing is just the implementation of AI. We can help the organization be better protected towards that implementation because it's becoming really scary with the data that's going out there.

Got it. I mean I wanted to kind of jump to that next. We've highlighted before that data security becomes increasingly important with AI. You're having an expansion of the attack surface, different types of data that you didn't even think were critical before, are critical before. In the past, you've talked about AI being a net positive for you because it's just easier than ever for bad actors to use AI to create attacks. Just what are you kind of seeing in terms of the marketplace in terms of either attack velocity or just -- or customers being concerned about kind of AI security?

When you ask a customer about not just AI security, but AI in general, if the word data isn't in the first 15 words of their answer, they're probably just making it up and they don't know what they're talking about. AI security and data security are incredibly tightly related, and it's not just because it makes the job of the attacker easier. It makes the job of the defender even more complicated than it's ever been. Guy talked giving you an example of somebody using your credit card and a credit card company detecting fraud.

Well, with data security, we need to make sure that not only is the data monitored, but the attack surface is much bigger because it's not just one user, it could be one user that's interacting with 1,000 agents. What are those agents actually doing? What infrastructure is out there? So for AI security, which is really what you asked about, companies generally want to do a few things.

They want to inventory what AI workloads are out there. What models are they using, whether they're foundation or fine-tuned? What agents are out there? How are models and agents, end users and applications and data stores and code libraries all interacting with each other because that's what happens in an AI world. I prompt one tool or one application or one agent, and now it's talking to MCP servers. It's talking to large language models. It's talking to other agents. It's talking to my code libraries. It's talking to my data stores and other applications. Usually some combination of all of the above.

So in inventory, managing the security posture are all of the pathways, the configurations, all of the things that a smart person is going to take advantage of is everything set properly? Are all the access controls set properly? Are you watching how things are using? Do you have the right guardrails in place so that people don't put sensitive information into prompts or that models don't return sensitive information? Do you -- can you prove that you're compliant?

Because we're talking about security, security and compliance are very tightly related. There's the EU AI Act. There's the NIST RMF framework for AI. There's all these controls that companies now want to put in place so that they can safely deploy it. So this is what Varonis does, especially with the recent acquisition of AllTrue, we can now offer those capabilities in a depth and a breadth that nobody else can, which means if you're concerned about AI and you're not talking to us, you're missing a trick.

Yes. I mean -- maybe what you described is like this is already what Varonis does. And so -- but investors are always kind of obsessed with what is the AI security versus kind of what are the other pieces? Is it just -- it should be a tailwind for the entire business? Are there kind of areas where we should see -- or product sets where we should see kind of more attention be paced to with AI?

I'll give a qualitative answer. I'll let Guy talk about anything quantitative. But we just announced the acquisition of a company called AllTrue that does AI inventory, AI posture management, AI red teaming, AI compliance monitoring and LLM gateway and guardrails. That is additive to the capabilities that we had for securing underlying data stores and infrastructure and monitoring and securing AI tools like ChatGPT and Microsoft Copilot.

We now have the ability to do inventories in new places to scan and secure models, to scan and secure code libraries, to scan and secure and monitor agent usage and the interactions between them. Those capabilities really matter, and that is -- we announced the acquisition a few weeks ago. And customer response -- I think someone from AllTrue said that we've done more demos in 2 weeks than they did in the history of the company before that. The demand is off the charts.

Okay. Got it. Data security is also just an area where we've seen a lot of start-ups, particularly kind of labeled as DSPM. How do the increasing number of competitors influence either just customer sales cycles or the journey of customers finding their way to Varonis?

It's nice that there's lots of other investment -- there's lots more investment money out there doing marketing for the problems that we solve, which wasn't always the case. It's kind of like we were screaming into the void for a lot of years and now everybody has finally caught up that data security is a really big issue. So it's been additive. It's really helped us get into a lot more conversations. That said, it means that we're in a lot more fights. The DSPM market has been -- it was created -- I would argue that we created it 20 years ago, and it didn't exist, and we were the only ones in the space for a long time.

But even now, the players that are out there are only doing pieces of what we do because if you're a start-up, you're really only going to do this in the cloud, and you're really only going to do this. And by this, I mean the visibility that they offer in cloud stores that are relatively easy to connect to. We go into deepwater, and we don't just do this in the cloud. We do this on-prem. We do this not just in databases. We do this in files, and we offer far more mature capabilities. And by that, I mean, we automate things that the other DSPM tools can't. We detect things that the other DSPM tools can't. To answer your question, we are now in many more fights because there's nobody that touches us in coverage anymore. Varonis for files, sure, Varonis for databases, sure, Varonis for the hyperscalers, sure. Varonis for SaaS applications, yes, Varonis for AI.

So there is nobody that's going to do anything related to data security or privacy where they offer out an RFI or an RFP. We're not -- we're going to be part of all of those conversations now. We're in a lot more fights because there's a lot more players in the space. But when we execute our sales process properly, our capabilities and the matureness of our platform means that our win rates have remained really high.

And just to add to that, the vision for Varonis for many, many years has been to provide the customers one pane of glass, one dashboard that can allow them to be better protected on whatever platform they're using. And when you think about -- and we get this asked a lot about kind of supply consolidation and how -- where is the space going? And when you look at kind of some of the acquisitions that we have made, all of them are targeted to provide way more visibility on way more platforms. The e-mail security, we got a lot of questions about that. Are you going into that space? It's part of the MDDR offering.

This is not a stand-alone offering, and now we're just focusing on e-mail security. That's not the intention. That's not the case. But when you think of e-mail together with the MDDR offering and when you think about the AllTrue acquisition with the platform that we have to offer, it makes it way more interesting and 1 plus 1 is not equal 2. That's been the premise of how we thought about kind of the road map, and I think we're kind of moving in that direction.

Got it. I'll circle back to some of the kind of platform building or the acquisitions that you guys have done in a little bit. But Guy, maybe just recapping Q4 earnings just in terms of -- you had some higher conversions than you were expecting. Just kind of level setting where you were encouraged kind of coming out of Q3.

It's a very good question. Going into Q4, when we announced the end of life, we had about $180 million of non-SaaS ARR that we wanted to convert. And I know the #1 question we got throughout the quarter was how much of that number will be converted. We were able to convert roughly approximately $65 million of non-SaaS ARR in Q4. I think part of the reason that number was so high was because of the end-of-life announcement. It generated urgency within our customers, and it allowed us to have that type of conversation of be moving and what's the path to move to SaaS. And then now we are able to give kind of a range for 2026 on what we expect will be converted.

And we put a bear case scenario and a bull case scenario, and I think we fall somewhere in between. But in a very, very high level, that $180 million going into Q4, 1/3 already converted, 1/3 is expected to convert and another 1/3 is going to churn. And that 1/3 is mostly focused on kind of the federal and state type customers. So that vertical and those type of customers are the ones that are probably going to be impacted the most. That would have happened no matter what. If we would have dragged this transition over several years, those customers eventually would have kind of churned.

We're just kind of speeding things up because I think when you think about the risk of the organization and the fact that the difference between the on-prem subscription value proposition and the SaaS value proposition is night and day. Some of the other companies that have kind of stuck with the transition for many years and weren't rushing to get customers over didn't have that big of a difference between what they were offering on the on-prem and the SaaS side. For us, there has been a leap in terms of the functionality in SaaS. And in orders of magnitude, it's a better product than the on-prem subscription. So kind of dragging it doesn't help the customers and it doesn't help us, and it doesn't help the financial kind of structure and model from a leverage perspective.

So when we look at where we are going into 2026 compared to where we were when we announced the end of life, we now have guardrails of what we expect to see on the conversion side. And I think they are much better than what they were when we announced the end of life in Q3. So I think part of it definitely has to do with the announcement of the end of life and the urgency it generated for our customers.

Got it. There's a lot of additional disclosures you gave around your business in Q4. Just where do you think investors should be focused on from a metric standpoint as we head into this calendar year?

Everything and anything we got asked -- no, no, everything and anything we got asked in 2025 was how would the business grow post transition? Are you only growing because of the conversion? Can you give us metrics about SaaS growth, excluding conversions? And we opened the [ kimono ] and gave everything in Q4. And then the first couple of questions we get is why is total ARR x percent growth, which is counter to everything we were asked about. So I think that the focus is exactly where investors wanted it to be. We're giving the numbers. We're giving the conversion number on a quarterly basis.

We're showing what is the growth ex conversions. And I think that looking at a business or a part of the business that will be 0 at the end of this year, which is the non-SaaS ARR is not the focus. So honestly, like we have the base -- the bull case and the bear case, getting another $5 million of conversions will have an impact, but they're not as significant as how the business is growing on the SaaS side. That should be the focus. That should be where investors that have asked us all year long for that type of information and now we've provided it, that's where the focus should be.

You should always know investors always want something slightly different than what you...

Yes. We gave everything you asked [indiscernible] I think we were trying to be as transparent as it could be on this thing.

Yes. Maybe I want to take it back to just discussions that have happened over the past couple of weeks around AI and security and just this idea that cyber can be vibe coded, which I think generally misses kind of the competitive moats that you guys have. But just how -- I can give my own response, but you can give a much more intellectual response.

I think you summarized it very well. The technical moats that we have, and they are many and growing means that there's -- listen, I spend my time in front of customers. I don't know anybody that's thinking about vibe coding security period. I don't think anybody that thinks that's a serious -- there are tools. There are certainly software. There are some types of software that are going to be -- that are under a threat.

But the ones that are unique platforms in the ways that Varonis is, there's nothing that does everything that we do in the ways that we do it in all of the places, like the depth and breadth of not just the coverage and the automation, and we are using modern tools to help build our technology even faster. It's not to say that -- I think you summarized it well. I'm going to leave it at that. Yes, we don't see it as a threat to our business. We see that there are AI tools that are going to help us innovate even more quickly. But Varonis and data security as a whole, I don't think is under attack.

Okay. Got it. I want to dive a little bit more into AllTrue, which you just kind of mentioned. Just how does this fit into the strategy and particularly given you've done kind of a number of these like smaller acquisitions over the last couple of years?

I think AllTrue, which is now Varonis AI Atlas is it extends our visibility into places, and I'm restating some of the things I said before, but it's really important. The AI inventory now where it's not just the data stores and the supporting infrastructure, it's also the models and the code libraries and the agents themselves, including their interactions and behavior, along with the automation to fix those problems because that's key to what we do as well as the behavior analytics, connecting that into what we do from a threat detection standpoint and the best-of-breed data classification and posture management that we do already.

It's a bit of a game changer because if you're any kind of organization that is either building, thinking about building or has built any AI workloads and at this point, everybody is in that boat, you need this level of visibility. And if you would ask me that question a month ago, that would have been my answer. Now because we have a month of runway of putting this in front of customers, and I've been able to see the reaction from CISOs who have said, not only do I need this, I need this yesterday. What I just -- what you just showed me is light years in front of what anybody else can do.

And our road map includes connecting it into the Varonis data classification and behavior analytics, which lets us not just secure AI, but secure and monitor AI with the context for intent, meaning we know exactly what data and why it's important and how the data is flowing and we understand behavior in a way that's unique. So the breadth of visibility that AllTrue adds for us, the ability to do things like AI red teaming, I can throw the Varonis AI at your model now, and it will test for things like jailbreaking and bias and prompt injection. The ability to do so much more by just -- with less people, with fewer man hours, but just by extending the Varonis platform, it's a real game changer for us.

I guess, Guy, part of the decision to end of life was almost to just kind of focus salespeople around selling the broader platform. You have multiple other categories that you've talked about expanding into as you've done kind of some of these smaller acquisitions, AllTrue kind of being the latest one of these. Just how are you seeing kind of that process of getting salespeople to kind of focus on selling the broader platform now that they're kind of done with the conversion piece?

So in 2025, our commission plan was focused on obviously selling to new customers, existing customers, but also getting through a large part in dollar terms of the conversion. And we were compensating reps on the conversion side. So we talked a lot about the fact that the conversions were actually cannibalizing the time of the reps because they had to deal with a lot of the paperwork and the bureaucratic checklists related to moving customers from on-prem to SaaS.

In 2026, back to basics, reps will not be making money on the conversions. They will be making money on selling to new customers and selling to existing SaaS customers. And I think that's an important component that generates the focus where it should be. And that's part of the reason that we just want to be done with that process being 100% of SaaS out of ARR by the end of this year. But having throughout this year, the focus on kind of the right elements.

Got it. I mean from a -- just from a technical standpoint, you're obviously talking about customers want all of these different areas that you guys have extended the platform into. But just -- is there early evidence of really being effective at selling kind of the greater breadth of products?

So keep in mind, the Interceptor SlashNext acquisition was closed in September. AllTrue was closed a couple of weeks ago. So it's still early stages. But from all the conversations that we're having with customers, we feel very good with those acquisitions and where they can take us in the years ahead.

What I'll also say is it's very easy for the sales force to sell. The story is very -- doesn't change. Varonis will find. We'll tell you what data is out there and what's important, all the context, we'll fix. We'll do that automatically. We'll alert when something goes wrong. Now we do that for your e-mail in ways that you couldn't before. Now we do that for AI in ways that you couldn't before. Now we do that for databases in ways that you couldn't before. So for our sales force, it's not like they're changing their motion. It's just where else can we do those 3 things for you.

Got it. And just in terms of kind of this data-driven moat that you guys have, can you just talk about how the increasing amount of data that you guys are going to see and particularly as we start to do AI, how that moat kind of grows versus kind of the competitors in the space?

Yes. A big part of the technical moat we have is that philosophically, we are going into the deepest water, the biggest data stores. And it's not just the amount of data, it's the complexity of data. In a place like Microsoft 365, in order to really understand all of the context of the data that's there, you're not just scanning for what's sensitive. You're also looking at where that data is living. Everybody's OneDrive shares and SharePoint sites and team sites, and you're looking at all the shared links and the relationships between the identities and the directories and the data and the classification.

And so that's what we mean by deepwater. We have done that everywhere. And we don't use shortcuts where these other -- the start-ups and the other DSPM tools, they kind of have to because they were never built to scale in that way, which means they're really only giving you basic visibility and they're only doing it in places where they can take shortcuts. Philosophically, for us, we scan everything completely and we go into deepwater everywhere wherever you have data, that technical moat is key in a world where the amount of data isn't just growing, but the complexity.

We talk about -- it's not one user, it's one user plus 1,000 agents. It's not one data store. It's a galaxy of cloud data stores all connected together. It's not just one model, it's the 1.5 million models that somebody has access to in Hugging Face. It's -- there is -- the complexity is much higher and it is growing. So our technical moat that is built at a core of unraveling all of that complexity without taking shortcuts is going to serve us exceptionally well in a world where the amount of complexity related to the data is growing faster than it even was before.

Got it. And Guy, you mentioned kind of changes to the compensation structure around kind of changing what you're incentivizing. Are there other ways either through partnerships that should expand or other kind of channel expansion that can kind of help amplify the reach that Varonis has?

Yes, absolutely. I think that partners are very much interested in what we have to offer because of the value that we can provide customers. And we're trying to focus on the right partnerships, not necessarily the number. It's not the quantity, it's the quality. So we're definitely putting a lot of emphasis there. I think the marketplace, both Microsoft and AWS are good partners to ensure and they are interested, obviously, with kind of the consumption part of our selling.

So we're definitely focused on that. I will say, though, that we always want to make sure that we take our destiny in our own hands. So it's not like you outsource it and sit and not do much. So we're definitely focused on the outside sales team and the marketing campaigns that we're running together with the focus on breaching out with some of the channel.

And we spend a lot of time talking about kind of top line drivers as you do at these conferences. But just how does that kind of trickle down to the bottom line? And just how do you see the margin trajectory of the business over the next couple of years?

The conversation about margin, I think let's start from 2023. When we rolled out and when we announced the move to SaaS, we laid out a 5-year plan. We put kind of expectations from an operating margin, ARR contribution margin perspective and free cash flow perspective. People were somewhat skeptical in our ability to generate cash throughout the transition, especially in the early years. But we have done a great job of improving our -- not only the margins, but also the free cash flow and generating some significant cash in the early years where you have the most investment that relates to the transition.

And we were, I'd say, probably 2 years ahead of plan in getting to the numbers that we have in the model from a bottom line perspective and getting close from a free cash flow perspective. And the only impact that we have on free cash flow in 2026 is that component of customers that aren't converting, mostly that state and government, as I mentioned before, and that's roughly in that $30 million to $50 million bucket that instead of dragging that over multiple years is happening in 1 year of churn. And you don't want to kind of eliminate all your investments because of that one isolated event.

So in 2026, there is somewhat of a headwind related to that element only as you continue to invest, but there's no change in the philosophy. And I think we've actually been one of those companies that have always been focused on top line and bottom line and free cash flow generation. And we always believe in making investments that make sense from an ROI perspective, that philosophy hasn't changed. And we've been very focused in kind of getting to that model. And I think that the path for that model, the 2027 numbers is still there. We see how we can get there. And we feel very good with the cost structure.

And there's also some benefits to the bottom line that can happen post transition, post that 100% SaaS of ARR at the end of this year that we will benefit from in 2027. So ripping off the band-aid has an isolated impact on the free cash flow. I want to remind everyone that our guidance philosophy hasn't changed either. We have guided for top line, bottom line and free cash flow in the same way that we have guided in the past, which means that we -- that's the starting point, and we hope we can do better than that.

I would say the only KPI and the only metric that we have guided in a different philosophy is the conversion number with a bull case and a bear case and the expectation is that we will be somewhere in between. But all the rest of our guidance, including the free cash flow is the starting point for the year with a hope and desire that we can do better than that and progress throughout the year with better numbers.

Got it. And then just the last question. Obviously, it's become more of a discussion point of late around stock-based compensation. Just how are you guys thinking about stock-based compensation? Is there a need to kind of rebalance stock-based compensation, cash compensation? Just what are those discussions you're having?

If you go back several years and analyze stock-based compensation, there are really 3 metrics that we look at. One is obviously the dilution side. The other one is stock-based compensation out of total ARR. And if you look back, that percentage has actually come down dramatically over the last couple of years, and we've made a conscious effort to ensure that we're kind of thinking of it holistically. And the third component is the stock-based compensation in dollar terms. And I think if you look at kind of the elements that we have focused on, we have done a good job.

We obviously put a buyback in place of $150 million, and that also offsets some of the dilution. And I think we -- for obvious reason, I think we put that plan in place because we believe that it's the right time to do that. That will offset some of the dilution. But if you look at some of the metrics on stock-based compensation out of total ARR, we have reduced that percentage significantly over the last couple of years.

Got it. All right. Well, Guy and Brian, thanks so much for spending some time with us, [indiscernible].

Thanks very much.

Thank you very much.

Greetings, and welcome to the Varonis Systems Fourth Quarter 2025 Earnings Conference Call. [Operator Instructions] As a reminder, this conference is being recorded.

It is now my pleasure to introduce Tim Perz, Investor Relations. Please go ahead.

Thank you, operator. Good afternoon. Thank you for joining us today to review Varonis' Fourth Quarter and Full Year 2025 Financial Results. With me on the call today are Yaki Faitelson, Chief Executive Officer; and Guy Melamed, Chief Financial Officer and Chief Operating Officer of Varonis. After preliminary remarks, we will open the call to a question-and-answer session.

During this call, we may make statements related to our business that would be considered forward-looking statements under federal securities laws, including projections of future operating results for our first quarter and full year ending December 31, 2026. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned, forward-looking statements, and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings.

These statements reflect Power views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call.

A reconciliation for the most directly comparable GAAP financial measures is also available in our fourth quarter 2025 earnings press release and our investor presentation, which can be found at varonis.com in the Investor Relations section. Lastly, please note that a webcast of today's call is available on our website in the Investor Relations section.

With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Faitelson. Yaki?

Thanks, Tim, and good afternoon, everyone. We appreciate you joining us to discuss our fourth quarter and full year 2025 results. Over the past year, we have talked about Varonis as a story of two companies. The first is our strong SaaS business, which reflects the present and future of our company and the second is our legacy on-prem business, which is serving as a headwind to our total company ARR growth. In simply, the headwind was especially pronounced, as a result, we are now disclosing additional metrics. The purpose of this to allow investors to understand all the drivers of our business, Guy will expand upon this later.

In the fourth quarter, our SaaS business continued its momentum and our decision to end of life our self-hosted platform combined who is the lesson we learned in Q3 led to a record number of conversions. In Q4, SaaS ARR was $638.5 million or 86% of total ARR. Q4 ARR increased 32% year-over-year, excluding the impact of conversion and total ARR increased 16% year-over-year to $745.4 million.

Now I would like to give you some additional color on last quarter decision to announce the end of life for our self-hosted deployment model and the decision to transition our business to be 100% staffed by the end of 2026. Prior to the introduction of Varonis SaaS, we believe our self-hosted software was the best way to secure data, but the downside of this software was that it requires significantly more resource to do so.

Our SaaS product is fully automated. It is different to our self-hosted solution, a self-driving car to a bicycle. You can get to the same destination in either method, but with one to do the majority of work yourselves and with the other, it gets you there automatically and with minimal effort. We can do this because we build our SaaS platform using world-class architecture, the newest technologies and the lesson we learned with securing data in large complex dynamic environment for thousands of customers. This allows us to protect our SaaS customers in ways that were not possible with our self-hosted solution. For instance, we can only provide MVDR to our SaaS customers because of the automation and centralized visibility within our platform. It is important to understand that for most other companies that underwent SaaS transition, the technological gap between their self-hosted and SaaS products was not as large as it is with our platform. This provides our SaaS customers with much higher satisfaction which leads to higher renewal rates when compared to our remaining self-hosted customers, many of which are what we call single credit customers. This means, they only use Varonis self-hosted platform for a single use case on one data store, and because they don't use the full data security platform -- they began to show a greater resistance towards paying a premium to move to Varonis SaaS in Q3.

In order to move quickly and maximize customer retention, we are focusing less on uplift for conversion of our remaining on-prem customers, we believe we can show even more value to SaaS to these customers and then have opportunities to upsell them in the future. In the fourth quarter, our decision to end of life, our self-hosted platform was a catalyst that caused many of our remaining self-hosted customers to convert to SaaS. We converted approximately $65 million or 1/3 of our remaining non-SaaS ARR in the quarter. And believe that between $50 million to $75 million of the remaining self-hosted customers will convert by the end of the year.

At the same time, we continue to see strong demand from both new and existing customers because they can secure data with minimal effort because of our automation. Part of SPM tools may be able to identify a portion of sensitive data, but no other tool can find sensitive data in a complete way, fixed misconfiguration at scale automatically, and alert and respond to threats, delivering automated outcomes like Varonis does. Within our SaaS portfolio, MDR and Copilot continued to show strong adoption trends and Varonis for cloud environments continued its momentum, which was driven by the investment we have made in our platform to expand our use cases and protect many more data platforms.

We are seeing this demand because customers realizing that visibility alone is not enough and classification without protection is liability. Automation is necessary to achieve real outcomes. That conversation with customers on our database activity monitoring and security products underscore our belief that these are strong fit for our portfolio in 2026. We expect our reps to put significantly more focus on new business and uplifting SaaS customers. Over time, we believe this focus will help us unlock the potential of this market.

Now I would like to step back from our near-term results and discuss why we believe we are best positioned to help companies safely adapt the eye and prevent data breaches. Varonis was founded on the belief that managing and protecting data will be impossible without automation. Over time, our growth has been fueled by the constant balance between productivity and security. Today, the emergence of AI is accelerating both the volume and complexity of data in an unprecedented rate. The scale of data growth is matched only by the AI ability to increase the sophistication of modern cyber threat. Cyber criminals are leveraging the AI agents to infiltrate organization with minimal human involvement, recent incidents such as Chinese state actors using Claude code to breach major corporations highlight the sensitivity and ease of these attacks. Most of these AI-powered attacks start with social engineering.

Attackers aren't hacking computers. They are hacking trusts and users can not tell what real or fake anymore. Cyber criminals are using AI without gardens. Companies want to adapt the AI as quickly but struggled to due to concerns over data security. The deployment of AI agent raises critical compliance questions. What does the agent has access to? Is that data is sensitive. If the agent behaving as expected. Most organizations struggle to answer these questions for human users and the challenge is amplified as they must now secure exponentially more AI agents.

Agents are nothing without data. The more data agents can access the more useful and more risky they become. They operate faster than humans, collaborate autonomously and maximize their privilege by design. AI security depends on data security. In addition, companies will need guardrails and controls around their AI agents and tool sets. To accelerate our ability to help companies safely adopt AI, Varonis announced today that it has acquired AllTrue, an AI security company acquisition strength Varonis ability to protect enterprise for emerging AI risk by combining AllTrue's end-to-end visibility and guardrails for AI Tool. With Varonis' ability to protect the underlying data and identities using by AI agents. AllTrue had end-to-end visibility and control across AI life cycle.

It inventories high components and infrastructure, lock it down, monitor AI tools and automate compliance. The acquisition reinforce our data first strategy and extended our platform to secure all AI systems and the data powering them. Our SaaS platform allows for much faster organic innovation integration of tuck-in acquisitions, which enhance our customer ability to stay ahead of bad actors. Since launching SaaS, we have gone wider and deeper hear customer stock breaches everywhere and we can now tap into more budgets than ever, including data and AI security, database activity monitoring and email security. We have unified unstructured semi structure and structure data security into a single platform, which is essential in an age of AI because AI uses or data types. When you combine Interceptor, which is our e-mail security offering with our SaaS platform and MVDR. It becomes a force multiplier, top sets, even faster and kicked factors even further from data.

With that, I would like to briefly discuss a couple of key customer wins from Q4. We continue to see strong demand from new customers and one example of this was a health care service organization that was performing a risk assessment during a multi-cloud migration and we realize that the native tools were insufficient to lock down their data. As a result, we launched a DSPM/RFP process and ultimately, choose Varonis after we immediately uncovered several hundred critical misconfiguration, many of which automatically sticks. Also identify over 900,000 exposed PII records and executive strategy materials for only simplicity, advanced and unified interface, automatic remediation of decisive against competitors and the ultimate purchase with NDVR for hybrid environments, Copilot, AWS, Azure and Google Cloud Platform. Also, UNIX and LINUX as well as universal database connector. In addition to strong new customer momentum, we continue to see existing customers realizing the benefits of SaaS. One example was a hospital system of 45,000 employees that originally bought Varonis to remediate overexposure of on-plan HIPAA data as they began the cloud migration process, they notice gaps in the ability of native tools to remediate overexposure and label data at sale. During our cloud risk assessment, we discovered over 0.5 million instances of Pipa and PII data open to everyone in the organization. our ability to identify and remediate these exposures led this customer to convert to Varonis SaaS with MVDR for hybrid environments, Copilot and data life cycle automation for Windows

In summary, we are excited by the performance of our SaaS business, which is being driven by the automated value proposition that we deliver to our customers on top of our scalable architecture. We look forward to continuing our momentum and ending the year as a fully SaaS company, which will unlock many more benefits as we capture our growing market opportunity, and we believe in the path to achieving our 2027 financial targets.

With that, let me turn the call over to Guy. Guy?

Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. We are excited by the momentum we are seeing in our SaaS business, which now accounts for the vast majority of our ARR. SaaS is both the present and the future of our business and the new disclosures we are making today are intended to enable investors to evaluate the progress of both our SaaS business and the end of life of our self-hosted business. We plan to disclose these additional metrics for the duration of 2026, after which we will be 100% SaaS and we will revert to more traditional metrics. You can find more on this in our investor deck.

In 2026, we will provide guidance for SaaS ARR, excluding conversions on a quarterly basis. Specifically, we will report the following on a quarterly basis: One, SaaS ARR; two, SaaS ARR, excluding conversion; three, conversions ARR; and four, non-SaaS ARR to help you understand how much conversion opportunity remains available. On an annual basis, we will disclose and also provide guidance for: One, SaaS ARR; and two SaaS ARR excluding conversion.

We will also continue to report subscription customer count and SaaS dollar-based net retention on an annual basis. Our intention is to provide you with the tools to understand the various drivers to our business and to illustrate how we believe our SaaS business can continue to grow at very healthy levels in 2026 and beyond. In the fourth quarter, SaaS ARR was $638.5 million or 86% of total ARR and SaaS ARR increased 32% year-over-year when excluding the impact of conversions. We are proud of our record number of ARR conversions in Q4, which totaled approximately $65 million, including the uplift. We believe that this result was driven by our lessons learned in Q3 and our decision to end of life our self-hosted platform. At the end of Q4, we had approximately $105 million of non-SaaS ARR remaining.

In 2025, ARR from new customers was approximately $80 million. We ended the year with approximately 6,400 subscription customers, which grew 14% year-over-year. Our dollar-based net retention rate for SaaS customers was 110% at the end of 2025. To be clear, this metric only includes customers that were SaaS customers in the prior year and, therefore, is reflective of the organic expansion of ARR within our SaaS customer base. We believe that this metric can trend higher over time as we put more focus on the upsell motion with our SaaS customers.

Our renewal rate for the year ending December 31, 2025, continue to be over 90%. Although our renewal activity from our non-SaaS customers was slightly below our historical levels, it was better than what we experienced in the third quarter. Our renewal rate disclosure going forward will be the SaaS renewal rate. This metric aligns with our new business model and how we view the business.

Now I'd like to recap our Q4 results in more detail. In the fourth quarter, ARR was $745.4 million, increasing 16% year-over-year. In 2025, we generated $131.9 million of free cash flow, up from $108.5 million in the same period last year. In the fourth quarter, total revenues was $173.4 million, up 9% year-over-year. SaaS revenues were $142.3 million. Term license subscription revenues were $21 million, and maintenance and services revenues were $10.1 million.

Moving down to the income statement, I'll be discussing non-GAAP results going forward. Gross profit for the fourth quarter was $138.7 million, representing a gross margin of 80%, compared to 84.4% in the fourth quarter of 2024. Our gross margin continues to be healthy and in line with our long-term targets at our Investor Day. Operating expenses in the fourth quarter totaled $134.1 million. As a result, fourth quarter operating income was $4.6 million or an operating margin of 2.6%. This compares to an operating income of $15.3 million or an operating margin of 9.7% in the same period last year.

Fourth quarter ARR contribution margin was 15.9%, and down from 16.6% last year. If our non-SaaS business would have renewed at historical levels this year, our contribution margin would have shown a significant improvement versus 2024. In 2026, we expect a lower ARR contribution margin and lower free cash flow due to the impact of the end-of-life announcement. While this announcement negatively impacts 2026 ARR contribution margin and free cash flow by $30 million to $50 million based on our guidance, we believe it will allow us to show a healthier financial profile beginning in 2027 due to the removal of our lower renewal self-hosted customer base.

During the quarter, we had financial income of approximately $9.6 million, driven primarily by interest income on our cash deposits and investments in marketable securities. Net income for the fourth quarter of 2025 was $11.1 million or net income of $0.08 per diluted share compared to net income of $23.9 million or net income of $0.18 per diluted share for the fourth quarter of 2024. This is based on 133.3 million diluted shares outstanding and 135.1 million diluted shares outstanding for Q4 2025 and Q4 2024, respectively.

As of December 31, 2025, we had $1.1 billion in cash, cash equivalents, short-term deposits and marketable securities. For the 12 months ended December 31, 2025, we generated $147.4 million of cash from operations compared to $115.2 million generated in the same period last year. And CapEx was $15.5 million compared to $6.7 million in the same period last year. During the fourth quarter, we repurchased 448,439 shares at an average purchase price of $33.45 for a total of $15 million.

I will now briefly recap our full year 2025 results. Total revenues increased 13% to $623.5 million. Our full year operating margin was negative 0.6% compared to 2.9% for 2024.

Turning now to our initial 2026 guidance. Apart from conversions, which we included a wide range to account for a pessimistic and optimistic scenario, our guidance was set using the same philosophy that we have used historically. As a reminder, our new KPI for this year is SaaS ARR growth, excluding conversions, which reflects our ability to add new SaaS customers and also expand with existing ones as this will be the primary growth driver of our business in the years ahead. In 2026, we will provide quarterly SaaS ARR, excluding conversion guidance for this year only. We are doing this because of the difficulty in modeling the year-over-year growth rate due to the impact of conversions in 2025 and 2026. We will also provide a bridge to a quarterly total SaaS ARR in our investor deck, which assumes 0 conversions for the upcoming quarter.

For the full year 2026, we will provide annual guidance for both SaaS ARR, excluding conversions and total SaaS ARR. We have provided a wide range of outcomes for the conversions of our non-SaaS ARR to staff ARR within our guidance framework in order to bridge that the RR excluding conversions, the SaaS ARR for modeling purposes. We believe this range of conversions captures a pessimistic and optimistic scenario with the midpoint representing our base case for 2026. From a modeling perspective, we have assumed no uplift for these conversions. The largest cohort of customers that we don't expect to convert to SaaS are federal and state government customers. As a reminder, we expect this to have a $30 million to $50 million headwind and the free cash flow and ARR contribution margin in 2026. For more information, please see our earnings deck on our Investor Relations website, which includes a more detailed breakdown of our financial guidance.

For the first quarter of 2026, we expect SaaS ARR growth of 27% to 28%, excluding conversions; total revenues of $164 million to $166 million, representing growth of 20% to 22%; non-GAAP operating loss of negative $11 million to negative $10 million and non-GAAP net loss per basic and diluted share in the range of $0.06 to $0.05. This assumes $118 million basic and diluted shares outstanding. For the full year 2026, we expect total SaaS ARR of $805 million to $840 million representing growth of 26% to 32%. This represents SaaS ARR growth of 18% to 20%, excluding conversions, free cash flow of $100 million to $105 million, total revenues of $722 million to $730 million, representing growth of 16% to 17%. Non-GAAP operating income of breakeven to $4 million; non-GAAP net income per diluted share in the range of $0.06 to $0.10. This assumes 134.2 million diluted shares outstanding.

In summary, we are continuing to see momentum across our SaaS business. This demand is coming from both new customers and existing SaaS customers looking to secure more of their data footprint with Varonis. We remain focused on executing on the many tailwinds we see ahead. With that, we would be happy to take questions. Operator?

[Operator Instructions] Our first question is from Matthew Hedberg with RBC Capital Markets.

Thanks for all the additional disclosures. I think it will be really helpful when we think about the stand-alone SaaS business on a go-forward basis. I think we're getting some inbound from some investors. And I think some of the confusion is around kind of the growth rate assumptions for this year. You're guiding for 18% to 20% SaaS ARR growth ex conversions. Yet if you look at sort of just like your exit rate SaaS ARR for '26 relative to kind of like the $745 million that you ended '25 with, it looks like closer to 10% growth. So I know there's some headwinds to conversions here and some churn assumptions. But maybe could you just help sort of like, again, sort of like square off like the 10% kind of total ARR guide with how optimistic you are on the SaaS...

Thanks, Matt, for the question. I think we had many conversations with investors throughout the last several months, and they've all asked for the SaaS growth ex conversions to really understand the true growth of the business and really we want to try and help everyone understand all of this better. So we're providing today more disclosures around our business to help you understand what drives our business in the present and in the future. Now the SaaS ARR, excluding conversions, is really the most important KPI which we're going to focus really on the ability to sign new customers and expand existing SaaS customers, and that's what's going to drive the business in 2026, 2027 and beyond. When we sit here today, we feel very good about guiding this growth rate of 18% to 20%, which really calls for $120 million of net new organic SaaS ARR versus the $109.5 million that we had in 2025, and that's our starting point.

So we're still keeping the same philosophy of guidance. This is our starting point. And we know what we need to do in order to continue throughout the year and increase that number going forward. So as a starting point, looking at the ARR would be extremely misleading because it takes into account the conversions, which are really the rear view mirror of this company. If you want to focus on the present and the future, the right thing to look at is SaaS ARR excluding conversion, and as a starting point with the same guidance philosophy, we're at $120 million versus $109.5 million in 2025.

Our next question is from Saket Kalia with Barclays.

Great. Echo the point earlier just on -- I appreciate the additional disclosure. I think it's I think it's really helpful. And to your point, really focuses on kind of what the future of the business will look like, right? That's fast part. And so for that reason, I just want to dig into that 18% to 20% growth excluding conversions, Guy, maybe the question is for you. Can we just talk about how much of that you think comes from new customers versus existing? And again, SaaS is the future, but just to make sure we're all squared away, -- can you touch on whether there's going to be any remnants of on-prem ARR at the end of 2016 as well?

So I'll start with the last part of your question. Our assumption is that we won't have any non-SaaS ARR at the end of the year. So basically, SaaS ARR at the end of 2026 is going to be equal ARR. For this year, if you want to focus on what is right for the business, what is driving the business in the present and in the future, the right metric to look at is SaaS ARR, excluding conversion. Now when you look at the performance in 2025, we had SaaS NRR of 110%, and we had approximately $18 million of new customers' ARR. When you look at our expectation going forward, we believe that with the fact that reps won't have to focus on the conversions, the way they focus on conversions in 2025, they can go back to selling to new customers and selling to existing customers, and we have so much more to sell. So our expectation is that the SaaS NRR can increase. And obviously, with the offering that we have, we can increase our sales to new customers. So as a starting point, I'm going back to that 18% to 20%. It's a good starting point that we feel very confident with where we sit here today and obviously, believe that we can increase that throughout the year.

Our next question is from Brian Essex with JPMorgan.

Thank you from me as well for all the additional color. I guess, I want to dig in a little bit to current period results, the 110% net dollar retention. How does that compare with prior periods? And then maybe you can also help us understand how much has Copilot in AI-driven some of the demand? Do you have maybe an attach or an exposure rate you can provide for the SaaS business attributable to that demand in the quarter?

So I'll take the first part of the question. When we look at the SaaS NRR, you have to remember that this only takes SaaS customers last year and compares what their ARR is a year later. So obviously, it's on a much larger base, and it's at 110, and we absolutely think that it was impacted with some headwind because reps had to focus their time on the conversions. Keep in mind that we had close to $190 million of conversions in 2025 alone. So that doesn't happen in itself. The reps had to focus on those conversions. And when we think about NRR, when you only take SaaS customers and look at the progression, that is actually an indication of how we can grow within our SaaS customer base going forward, and we actually believe that, that number can improve.

So again, when you look at kind of the mix between existing and new customers, I think that going forward, as we kind of went through the transition and there's not much of a non-SaaS ARR left, the reps can actually focus on acquiring new customers in a better way and can actually go back to the base and sell them additional products going forward.

My Copilot definitely was just a big driver, but AI in general, is a big driver because everything that's related to AI, these agents are as good as risky as the data that you can access. And definitely, the item left the station and the ability to understand the identity and the data that it can access is everything. So it's not just the conversion and Copilot. The other thing that we saw in the fourth quarter is just a lot, a lot of success with everything that's related to our other cloud repositories in AWS and Azure and also the database activity monitoring good pipeline is starting to sell the product and everything that is happening with the acquisition of SlashNext. It's important to understand that AI not just from the agency is a big problem, but also from bad actors. So everything that's related to compromise -- to get compromised from trusted sources it's something that the SlashNext acquisition, the product called Interceptor is doing extremely well. So definitely, in terms of the platform, we hit on all cylinders and also have a very good understanding the cohort of customers, as we explained before, that will not go to SaaS and with the 86% SaaS business. It's just at the end of it and the SaaS KPIs are extremely strong, and we are very, very happy where the platform is and how it will perform. And primarily, we believe that the whole AI revolution is a big tailwind to everything we on dose.

Our next question is from Rob Owens with Piper Sandler.

Great. I want to guess a little bit on go-to-market. I know there were some changes to the federal team back in Q3. Just curious as you entered the new fiscal year, any broader changes overall, where you are from a sales capacity perspective? And how you're feeling from a sales maturity perspective relative to the folks you have in those seats?

So there are two elements to that question that I want to address. One is in terms of the federal business, we're still focused on trying to sell. As you remember, our federal business is approximately 5% of total ARR, but we still see an opportunity there. We did make some adjustments in terms of our investments there. I will say that the second component that I want to address is the conversion. The non-SaaS ARR, we're actually making a good portion of that federal business that will not convert. And that's why we gave a range of more of a bear case and an optimistic range which is a really wide range, that $50 million to $75 million that will convert in 2026.

So when you look at the element and what is impacting kind of the conversion number, the assumption that we have had is that many of the federal and state and government customers might not convert and that was baked in that number. And the expectation is that we can go and sell to new customers in that federal space, but some of them will not move to SaaS with us.

But in terms of the coverage and capacity, we believe with the new products now building a good pipeline and that will kick in and we can have we believe that -- we can have strong productivity gains. We have now the sales motions that are touching to the budget in everything that related to social engineering and business email compromise in the e-mail space, and we have some others in the API and the broader extension, very good assets there, data activity monitoring most of the installed base of the incumbent wants to replace them. This is another one for us, we think the expansion of the data security, including the MVDR and now the AllTrue acquisition that really just finalizing the role vision to be end-to-end in the AI world. So we believe and we're starting to see that we will see a lot of budgets that are related to the iPhone security and AI. We really believe that we can be the foundation for acceleration in adoption of secure AI in -- within organizations. So we're really happy with where we are and the way that the pipeline is developing. And we think that in the next few quarters, we are going to reward.

SP1 Our next question is from Joshua Tilton with Wolfe Research.

I have two, one as a follow-up, one is not. I'll start with the nonfollow-up one. And that's -- when we look at kind of the benefit to SaaS from converting the on-premise base relative to kind of the dollars that you lost in on-premise business last year, it kind of feels that you -- the uplift that you were getting was below that 26% -- 25-ish percent blended rate that you've been communicating to us. Is there any way to help us understand like what you are actually getting from a conversion at uplift or what you're getting on uplift at a conversion and what we should expect that rate to be if you can sustain that for next year? And then I have a follow-up. .

So I want to focus the analysts and the investors on what's important. And what's important is SaaS growth ex conversions. We've been asked many times by investors recently to try and break it out and show what would be the growth rate because if you think about it, by the end of 2026, there will be -- the assumption is that there will be no non-SaaS ARR list. So the question that you're asking actually relates to 2026 only. Our assumption for 2026 is that from a modeling perspective, is that the conversions will come in flat. The intention is the breakdown on a quarterly basis, what is the SaaS growth ex conversion. So every single investor can understand what is the business -- how the business is performing, present and what is the driver for the business going forward. To us, the conversions are obviously an important factor, but they're not the driver. They are the rearview mirror that every investor, obviously, we care about getting as many customers over to SaaS as we can, but that's not the driver of the business.

The driver of the business is SaaS, ARR ex conversions. And that's why we spent a lot of time in order to break it out in what we hope is a very simplistic way for investors to be able to understand what is the growth rate of SaaS ARR ex conversions. We gave a range of what the expectation of the conversion is. And remember, at the end of Q3, we got asked every single investor asked us. What is the expectation to get the conversions over. We talked about $180 million -- approximately $180 million of non-SaaS ARR that are up for renewal, and we said that about 1/3 of them were up renewal in Q4. And we were able to get in Q4, including the uplift, approximately $65 million. So the non-SaaS ARR left has come down significantly. It's now approximately $105 million going into 2026. We're giving this range of $50 million to $75 million but our desire and the way management is focused in terms of the forward-looking health of the business is SaaS ARR, excluding conversions.

Not critical to understand that just the massive expansion we did in the platform, this is what will grow the business, the new licenses. This is not -- these are not the uplift. Selling new licenses and adding more value, covering more data, securing our customers end to end from a data breach, make sure that they can use the eye in the right way, make sure that they don't have a compliance fine and doing everything on an architecture with tremendous scale. You need to understand that the amount of data that we need to crunch in order to provide this value is massive, and this is -- the whole growth is driven by just the new licenses.

Our next question is from Jason Ader with William Blair.

Guy, can you help us understand the $30 million to $50 million headwind to contribution margin and free cash flow in 2026? I'm not sure I quite got that.

Yes. So first of all, I want to say that there's really no change from a philosophy perspective of how we are trying to run the business. We believe the business should grow on the top line in healthy levels, but also generate better margins and more meaningful cash flow over time. I think that's been the way we ran the business for many, many years, and there's really no change in the way we're thinking about that going forward. We're facing that $30 million to $50 million headwind from the end-of-life announcement in 2026. But what's important to note is that, one, the announcement of end-of-life actually generated a sense of urgency for customers to move. And we did see that in Q4.

The second thing that's important to note, that we would have had a headwind from the remaining self-hosted customers having a lower renewal rate that would have -- that would have really masked the strength of our SaaS business. And you can see that in the H2 2025 results and also in the 2026 guidance. And the third thing to keep in mind, is that if we didn't have the end-of-life announcement that cost of maintaining the same set of customers would have increased exponentially over time.

So when we look at this $30 million to $50 million headwind, that's really with a lower expected renewal rate for the non-SaaS business. But I think we've proven over time our ability to show better margins and cash flow, and we believe in our ability to continue to do that going forward. So when we think about the 2027 target, we really completed the transition 2 years ahead of schedule. But as we sit here today, we see a path to achieving the 2027 targets laid out in the Investor Day. So we feel confident with that.

Our next question is from Shaul Eyal with TD Cowen.

Yaki and Guy, thanks for the new disclosures. Yaki, you might have touched on that earlier, but want to go back to that topic jure in recent weeks, AI eating software. Maybe not so much in the security category, but definitely, we're seeing a guilty cyber-related names in recent days, so fast to look at today's performance. Can you offer us any investors, your viewpoint as to whether AI is augmenting security or whether there's room for concerns based on potential market disruption? And maybe also just a word about your current relations with Microsoft over the past quarter.

I think that in terms of the market itself, what -- and primarily our market, as I said before, AI is as good as risky as the data that it can access and you are going to see velocity that we have never seen before and also for bad actors, the ability just to get in to do everything that's related to the initial fraud to get identity, session tokens and so forth is going to grow. The ability to be a very sophisticated advanced consistent threat that don't need to call home, can talk with local LLM and agents talking to agents and also the just the human state. I think that definitely AI has tremendous impact on development cycles, but we believe that still complicated architecture and deep tech, we need a lot and lot of expertise -- and this is what we have and believe that even in this environment, we have a very strong moat. And we also believe that in order for organization to adapt AI, they need to make sure that they understand what the data can access and if it's behaved correctly, this is the core competency of Varonis and you need to do it in a tremendous scale.

And the second thing show that it needs to do and this related to the AllTrue acquisition, is you need to understand the actual agents of stemming from which tool, the intent of what they plan to do and also the pipeline, what data they are going to access. So in terms of AI, AllTrue starts from the beginning to make sure, okay, this is the tool, this is the intent and the pipeline, then massive force multiply with Varonis, what is the identity and the data that they can access and also then back from all to how agents talk to each other. So maybe an agent can ask another agent that has the permission to do something on easy has, and this is a big issue.

Regarding Microsoft, we have just a lot of synergy with them, and we're building pipeline together and feel comfortable about the partnership. So we feel comfortable about the partnership, but -- the one thing that we are very excited about is just where the platform is. If you look at the year ago, starting from where taxol starting with Interceptor with SlashNext taking the database activity market with the classification, the user behavior analytics, we have a lot of success on the cloud data stores and these data stores has tremendous scale and Varonis is -- doing the Varonis platform extremely well there. And now everything that we are doing to the Agentic AI and we combine it with our core strength. So we are very excited where the platform is where the platform is and the value that you can provide in the marketplace.

Our next question is from Meta Marshall with Morgan Stanley.

Great. Maybe building on that last answer that you gave. Just as you guys look at products that you can, now with more focus on kind of the core SaaS business, whether it's MDR, identity protection or database activity monitoring or the acquisition that you just announced, like what do you see as the biggest driver of upsells over the next year?

I think that all of them. I think that all of them, and it's also -- we created this data security market. Now it was very natural expansion to go to other places. So the database activity monitoring is a big market with just incumbents that we can replace. Everything that's related to social engineering and business email compromise, this is a type of product that every organization needs and where attacks are starting today. And we believe that in terms of multi-modality, the problem starting with trusted sources, and we have best solution for that. And if the organization in this stage, trying to use AI in order to survive in stride. And with all together with what we have is big force multipliers. So we're really excited about everything, and we're also excited about everything is integrated with everything else.

Our next question is from Roger Boyd.

I know this is not the focus point going forward. But I wonder if you could just unpack the rebound you saw in 4Q conversion rates. And -- as you look forward, I think you said $105 million of remaining on-premise software with the expectation that $50 million to $75 million of that converts with uplift. When I back out Fed and SLED, my gut reaction is that's pretty optimistic view on conversions going forward. So maybe just talk about kind of your confidence over the remaining commercial customer base there. And in terms of timing, just any sense of how quickly you get in front of this or if you expect it to be maybe more back half weighted?

So let's start with the fact that we converted in Q4 approximately $65 million. That's a really large number. You can see that in comparison to any of the other quarters, it's 50% higher than Q2. It's close to 60% higher than Q3. I think part of it was absolutely driven by the fact that we had the end-of-life announcement. That generated a sense of urgency with our customers and actually helped us get customers to convert.

In terms of 2026, we put a bear case in an optimistic case, and that those are the two ranges. I would say that in terms of guidance, the $50 million to $75 million is not expected that our expectation is to be within that range. Our base case is kind of that midpoint. We do expect some of the customers from the federal and state government to convert. So it's not like we're writing off every single customer, but I would say that the focus from kind of a perspective of a vertical that will that would convert at lower rates, it is that federal business, but it's not an expectation that none of them will convert. So we feel very good with that 50 to 75 range. And as you can see, that range is wide because there are a lot of uncertainties, but we do feel confident with that range itself. So our base case scenario is at midpoint -- and I think we can do a really good job of getting those customers over. Keep in mind, we got questions about the $180 million of SaaS ARR at the end of Q3, and so many of the investors wanted to get a number and wanted to get a range. And many of the investors that we talked to had an expectation that we won't get any, which we thought was a reasonable either. So I think when you look at the actual performance of Q4, the fact that we were able to convert such a large portion has to do with the end-of-life announcement and the urgency that, that generated within our customer base, and the expectation for 2026 is within those ranges of 50 to 75.

It's also critical to understand the -- in most other companies that they are doing the SaaS transition -- there is not a big discrepancy in features between the on-prem and the cloud. For us, it's something that is completely different in our cloud is moving extremely fast and we integrate the new acquisitions there. And these customers, as Guy said, is federal customers and some just local government customers and some customers that have hesitation and don't want to go to SaaS, just -- it's a huge, huge difference. And then when you have this growth business that is strong and profitable. And as Guy said, we believe that we can get to the 2027 goals reason this customer that will not convert to the 2027 goals that we outlined in the Investor Day. It's very important to understand that it's just something that is completely different. And not only that, with the way that we move and release features and the SaaS platform works, the discrepancy is growing and growing. And what will happen is that you will have small cohort of customers that will take just a lot of operational resources to do something that is just not relevant. So this is what you see from us. We just -- we are now 86% there, and we just want to be 100% there and make sure that we have this SaaS platform with high-quality SaaS metrics, and this is where we invest and this is how we move forward. And we just want to make sure that the last leg of conversions, anybody that we can convert will convert and fight for it, but folks do not go to the cloud, we need to end the class and

Our next question is from Fatima Boolani with Citi.

Guy, I wanted to just in the OpEx and free cash flow expectations. You've been very clear about a number of different factors that is impacting that trajectory. But I was hoping you could sort of recrystallize some of what you shared with respect to the end-of-life headwind, the ARR contribution compression as it relates to some of the nonrenewal assumptions as well as maybe some organic investments that you are making in growing your sales capacity and then also in the context of the AllTrue acquisition. So hoping you can stack rank the level of impact from an operating expense and free cash flow headwind perspective between the organic inputs and inorganic inputs, especially kind of given the number of acquisitions that you're absorbing into the cost base?

Absolutely. I'll start by the fact that when you look at the free cash flow progression, I think we've done a good job of increasing kind of that free cash flow number over the last couple of years. And when you look at the ARR contribution margin, we've actually increased it to levels that are just below the 2027 model that we laid out in our 2023 Investor Day. So I think from a profitability perspective, we have proven to investors that we have the path and we know how to improve and increase the top line growth with bringing some of it to the bottom line.

When you look at the 2026 numbers and especially when you look at some of the lower renewal rates for the non-SaaS business that have been below our historical levels. Obviously, when you think about renewals, they go directly to the bottom line. That's your pure profitability component, and they are way more profitable than the acquisition of new customers that have higher cost. So when you think about kind of the non-SaaS ARR that is not going to renew, that obviously has that headwind, and we talked about the $30 million to $50 million of headwind from that end-of-life announcement. But I think what's important to note is that if we didn't call that end of life, the impact would have been much higher. So if I have to break down kind of that headwind, I would say that for the most part, it relates to the lower renewal rate for that non-SaaS business. Obviously, the acquisitions have a cost. And when you think about the guidance, we didn't bake in any upside from those acquisitions. We saw very good momentum in Q4 with Interceptor, but we need to see how that progresses from 2026. So I think there's upside there for us. And the acquisition that we announced today, we feel good about our ability to capitalize on that as well. So from an expense perspective, we baked in those expenses as part of that guidance. Obviously, we didn't fully bake in any real upside for 2026, and we do believe that we can get there. So if you had to break down that headwind, I would say that for the most part, it comes from the renewals, but obviously, some of it is from the acquisitions themselves.

Our next question is from Mike Cikos with Needham.

Guy, you're perfectly clear on the M&A assumptions. So you're not assuming any revenue or ARR contribution from Cyril or Next, even though both those products lose last year? And then I guess the follow-up, given some of the changes that were announced following Q3 with the 5% headcount reduction, and the downsized federal team. Can you just help us take out your go-to-market organization today? At what is typical tenure of your sales reps? Or have there been any changes to incentives as we enter the new year?

Absolutely. So yes, when you think about kind of the assumptions that we had for guidance for 2026, we didn't bake in any real top line contribution from any of the acquisitions. That doesn't mean that we don't think we can generate activity and top line growth from them. But our starting point assumed a real modest contribution from them and nothing major, but we do feel that there's a path there, and we're seeing good momentum in conversation with customers. Keep in mind, the Intercept acquisition only closed in September. So it's a really short runway when we sit here today for a company that didn't have any material ARR, but we definitely see significant opportunity going forward.

In terms of kind of the rep profile. I think that one of the things that is interesting going into 2026 is that with those acquisitions, we actually do have an earmarked budget that we can go and replace which does change and simplify some of the go-to-market for the sale of those Interceptor and the acquisition. And it's definitely something that we need to see how that progresses, but we feel very good with that path. And when you think about the comp plan, for 2026. And I want to touch on the 2025 comp plan. I know many of the investors asked us a lot about it throughout the year. But in 2025, reps had a lot of ways to make money. They could sell to new customers, they could sell to existing customers, and they could make money from the conversion.

In 2026, they cannot retire quota on the conversions themselves. So their way to make money is by selling to new customers and selling to existing customers, and I want to put another caveat in, they can make money by selling to both, but they have absolutely no way of making big money if they don't sell to new customers. So there is a threshold from a new customer perspective for them to sell. And we believe that as we have gone through the non-SAP ARR and got to 86% and can go back to focusing on new customers and existing customer sales. And don't need to have the reps cannibalize their time by focusing on the conversions that actually opens up their ability to increase their productivity levels. And that's the way the comp plan was structured with no ability for them to make money towards their quarter retirement on the conversion side.

Our next question is from Rudy Kessinger with D.A. Davidson.

Great. So Guy, actually, again, as everybody in this call, I said I appreciate the new disclosures here. I actually want to dig into the SaaS net new ARR guidance, excluding the conversions, midpoint of about $121.5 million. Certainly hear your comments about reps were really bogged down and tied up with conversions last year. And yet you still did about $110 million of net new SaaS ARR excluding those conversions. And so if I consider the reps being much more freed up to really focus on SaaS expansion, new logos this year, the $121.5 million actually to me seems pretty conservative and are lower than it should be, if I assume you maintain at least 110% SaaS net retention rate.

So could you just maybe take a step further, like what are the assumptions in that $121 million figure around new logo contribution, net retention rate, et cetera? And just how conservative are those assumptions?

So you're absolutely right. We are guiding in a conservative way as a starting point for the year. And you're absolutely right that if you look at the -- at the net new SaaS ARR excluding conversions being at 109.5%, but also accounting for approximately $190 million of conversion ARR when you don't have that component, the conversion side, then you can go and sell to new customers and existing customers in a better way. So I agree with your statement, and I think that we fully understand what we need to do in order to execute and grow this business in the way that we believe we can grow the business. Sitting here today, we feel very comfortable with the guidance that we provided and know what we need to do in order to execute and improve it throughout the year. But the assumptions from an NRR perspective is that we actually can do better. There is a lot for us to sell going back to the base. And we think that we're selling to new customers bringing that time that with cannabis, they can actually go to many more new customers and sell to them as well. So I agree with your statement and that is our starting point for 2026.

If you look at our offering today versus just a year ago, we doubled the platform in terms of value. The focus needs to be to -- not on the conversions to create value and make sure that the data of our customers is protected in an automated way. This is our mission, and this is what we are going to do.

9

Our next question is from Joseph Gallo with Jefferies.

I really appreciate the question, and thanks for all the extra disclosures. Guy, can you just help me understand a little bit more the end-of-life headwind to free cash flow? I mean billings and ARR were really strong in 4Q. You're still guiding for ARR to grow in calendar '26. I'd imagine billings and bookings are growing. So just -- is there something different with the cash collections? And then just any more that you can kind of quantify on what the benefit for not having to support on-premise can be? Is that a few points to margin? And is that a '26-story or '27?

So Joe, I actually think that the free cash flow headwind is a much simpler story than anything else, honestly. When you think -- if you took the Renal rig, the historical renewal rate of the business, and baked it into the non-SaaS ARR, that is the delta. That is the headwind. And we're obviously not getting the same -- or at least the assumption is that we won't be getting the non-SaaS ARR at the same renewal rate historical levels, a, because we didn't see that in Q3; and b, we -- although Q4 renewal rates for the non-SaaS business were better than Q3, they were still below historical levels. And I think the end of life actually helped us get a lot of the customers converted. And the expectation is that the end-of-life announcement will actually help us get a lot of our customers converted in 2026. But as you can see, that $50 million to $75 million range from approximately $105 million denominator is not over 90% renewal. And I think it's a much simpler math -- and I know we're getting a lot of questions on it, but to me, it's a pretty straightforward calculation in terms of the headwind itself. So when I look at the actual kind of profitability profile for us as an organization, nothing really has changed.

We're not changing kind of the philosophy of investment. We're not trying to invest more in order to generate a lower top line growth rate. If you look at the trajectory from an ARR contribution margin perspective and you bake in the additional kind of loss on the headwind from the non-SaaS component, you would see that we would continue to grow in the same historical levels. But the announcement of the end of life, and I said this before and I probably want to reemphasize this, the announcement of the end of life actually helped us in three ways. One is generating that sense of urgency for customers to convert. The second one, and I think this is actually important to note if we would have kept the on-prem subscription going forward, and we would have had a renewal rate that is historically lower than or lower than our historical levels, then the growth rate would have been masked -- the total growth rate would have been masked by that component versus a really strong SaaS business. And that's why we spent so much time on breaking out the SaaS excluding conversions and putting the conversions as a separate bucket. Because that allows investors and analysts to actually see the 2 companies that Varonis is right now, the forward looking and the rearview mirror, which is that conversion component. And yes, we believe that announcing that end of life going to 2027 and beyond can actually generate benefits on the bottom line on savings, and that's why we feel confident with our 2027 model.

Our next question is from Junaid Siddiqui with Truist.

Guy, you've talked about MDDR having software-like gross margins over time. As it becomes a material contributor to your business, how do you envision gross margins? Do you anticipate any changes from the range that -- in that high 70s, low 80s?

No, we don't expect any material change there. The MDDR has been very well received by both our customers and our sales force and has been adopted very well. Keep in mind, we only introduced it in 2024, and it's been adopted in a very positive way. We still believe that every single customer should have MDDR. It's going to take time, but we're definitely feeling very good about the path that we have taken so far and what we -- what is lying ahead with MDDR as well.

But also, it's very important to understand that the MDDR is really the AI-based offer. It's just agentic offering and most of the alerts are being reviewed and closed by the AI agent developers, and this is the beauty of it.

There are no more questions at this time. I'd like to turn the floor back over to Tim Perz for any closing remarks.

Thanks, everybody, for the interest in Varonis. We look forward to meeting with you all later this quarter.

This concludes today's conference. You may disconnect your lines at this time. Thank you again for your participation.

Good morning, everyone. Welcome to Day one of the Barclays TMT Conference. My name is Saket Kalia, I cover software here at Barclays. I'm honored to have the team with us here from Varonis. We've got Guy Melamed, CFO and COO; I also have Brian Vecci, Field CTO at Varonis.

We've got about 30 minutes today. There's going to be a lot to talk about. I promise it's going to be a fun session. Let's take 20 to 25 minutes to kind of run through some fireside chat with the team. And then would love to make this interactive. So if you've got a question, just pop up your hand and we'll make sure we get it asked for the benefit of the webcast.

So with that, Guy, Brian, thanks so much for being with us here today.

Thanks for having us and thanks for putting us in front of Jerome Powell's deeds and announcements and there's a lot of competition going on.

I would rather be here.

Same with us.

Well, I want to jump right into last quarter, right, because there's so much to talk about there. Guy, you said something interesting in the last call, which was Varonis is really becoming two separate businesses right now. There is the SaaS business. And then the on-prem business. Talk to us a little bit about why those two businesses feel so separate right now in terms of their performance.

So it's true, and we talked a lot about the fact that we started talking about it throughout the transition. But obviously, after the Q3 results, it's very clear that there is the Varonis SaaS business that is performing well, doing good on the new business, doing well on the upsell. And there's the on-prem subscription business, which, obviously, in Q3, the renewal rate of the on-prem subscription business were below our expectations. And I think that obviously overshadows and puts a bit of a cloud on the overall performance. But it is important to remember that the core business and where we're headed, the forward-looking business is the SaaS business and the rearview mirror business is the on-prem subscription.

I think the reason it's so distinct right now, you can see it on the renewal rate, but the value proposition is significantly different between the on-prem and the SaaS. And I think that is an important emphasis that investors need to understand because we got a lot of questions of end of life when we announced the end of life of on-prem. Why did you do it so quickly and why wouldn't you drag it on for a longer period of time, we said all along that we don't want to be monitoring and maintaining two types of code. We wanted to make sure that we are 100% SaaS, and we said that all along.

This was actually the first quarter that we got the 76% SaaS of ARR, which is how we define completing the transition. We talked about it during the Investor Day in Q1 of 2023, and we talked about completing the transition anywhere between 70% to 90%. And the expectation and the intention was to announce the end of life during our sales kickoff in January of 2026. So just coming up and announcing it to be at the end of next year, but with -- obviously, with the Q3 results, we kind of pushed it up a quarter. That's the only thing we did, pushed it up by one quarter.

And the reason we pushed it up a quarter is because Obviously, investors want to know how much of the non-SaaS business is going to be converted. And our intention, and we can talk more about that later, but our intention is to kind of break the business into two, the SaaS business and the non-SaaS business and they would want to see what is the expectation on the conversion? What is that going to be for 2026? If we announce the end of life next quarter, every investor would rightly so ask us, how did we quantify the end of life into that expectation if we're just announcing it now. And that's part of the reason we wanted to announce it a quarter early. We have about roughly $175 million today non-SaaS ARR, 1/3 of it, approximately $60 million are up for renewal in Q4. So with the announcement of end of life and with everything that's going on, we would have a much better data point that we can extrapolate and give color for 2026 with all the information out there, and that was the logic behind it.

Got it. Very helpful data point. I mean I want to follow on that a little bit. It felt like the higher-than-expected churn. It was clearly a surprise for all of us. And it felt like it was a little bit of a surprise for the team as well particularly given what I think were healthy renewal rates in the on-prem business in the first half of the year. And it sounds like there wasn't really one common theme around why some of those customers didn't renew.

But as we get further and further from the sun, right, like what have you kind of seen as you've gone back and looked at those customers that have churned and whether there was anything common or what drove it or was it a fluke? I mean, who knows, right? So what's your kind of postmortem on that?

A lot of the postmortem that we have done is confirming what we talked about during the earnings call in the Q3 announcement. And I can walk you through the three components but you're right that the Q1 and Q2 renewal rates were actually improving.

So when we look at the renewal rates, there was no indication we are back-end loaded like any other enterprise business and about 50% of our business closes in the last two, three weeks. And that's been historically the case. That obviously was the case in Q3 as well. So we didn't -- when we tracked all of the information throughout the quarter, there was nothing there that would signal the lower renewal rates as we saw them kind of at the end of the quarter.

The three components that contributed to the underperformance on the renewal rate of the on-prem subscription where, one, many of the customers that didn't renew were single threaded, meaning they bought us for an auditing tool. They bought us for a specific use case. And then if they don't renew, they're not exposed from a cybersecurity perspective the same way they would be exposed if they didn't renew on the SaaS front. So that was one component that we saw.

What is important to note is that in Q1 and Q2, those single-threaded customers did convert and did renew. So this was -- when we talk to customers in Q3 and obviously after the quarter end, and we were trying to figure out why they didn't renew. That definitely came up as like we had you for an auditing tool, and really nothing happens if -- and that's part of the reason we want to move everyone to SaaS because the value proposition is significantly better and much more meaningful than the value that we can provide.

The second component had to do with the fact that our sales team didn't perform in the best possible way, taking into consideration some of those customers were single-threaded and some of the quotes that were put in front of them probably then weren't presented in the right way, and we obviously address that going forward, and we're all over the sales team in order to make sure that, that doesn't happen in the future.

And the third component that we saw was the fact that the deal scrutiny kind of increased as we watched it in the last two weeks. When you combine all of those three components together, I don't think I can quantify what would the dollar amount in each and every component. But that was what was related to the nonfederal business. There was also a bit of an underperformance on the federal side that contributed to the overall performance of the business.

And the federal business, if I had to break down why it underperformed there, I would say that Dodge probably didn't help. I don't think it was the main reason, but it definitely didn't help us. I think the second component had to do with the timing of the FedRAMP certification. We got the FedRAMP certification in May. And I think if it didn't help us, if anything, it hurt us because there were deals in flight as part of the desire to get them as on-prem that once you have the FedRAMP certification, you're trying to switch them to SaaS and then that generates turbulence within the conversation with customers and sales cycles within the federal business are somewhat longer. So adding that component definitely didn't help.

And then the third component is the way the sales team handled that. I think that we could have done a much better job from a sales team's perspective. So those were the three components on the federal side, and we covered kind of the three components that were on the nonfederal side.

Very clear. Very helpful. Brian, maybe this question is for you because I know you spend a lot of time with customers. For the on-prem subscription customers that didn't renew, are they still interested in adopting Varonis SaaS over time? Or are they considering other vendors? I mean DSPM is a very hot space right now, right? Like is that playing into it at all?

Yes. So this goes to a lot of what Guy was just saying, there are many reasons that some of these customers did not renew. For many of them, they were not using Varonis as a security tool. And that's really important when you asked the question about the broader DSPM and broader data security space is if they were using Varonis for what we think of as single threaded or a more tactical use case, oftentimes, Varonis as a solution within the customer was owned by infrastructure or security. We didn't even know who the CISO was. They bought us to do something, they're leveraging a Varonis capability that was not part of their security portfolio. And so when we say that, if they were not renewing Varonis, it's not that they were going to another security tool. It's that maybe the data store that they were using Varonis to audit is going away or they're using a more administrative or tactical or point tool that we would think of.

This speaks to one of the things that we've been saying about the SaaS conversions in general over the last few years is that for some of these kinds of customers, single threaded customer, customers that were using us for a single use case or on a single data store, converting them to SaaS is almost a completely new sales cycle. But now we have to sell Varonis as a security platform to a security team that might not even know who we are.

To answer your question directly, yes, many of these customers, we are still talking to some of them have already converted to SaaS. Some of them, because the data store that run us with it's an on-premise file system that might be going away, we're going to have to reengage with them for their cloud stores but we didn't see any change in competitive win rates.

That said, DSPM is a very hot space. There's a lot of investment there. One of the things we've been telling everybody, including you for the last few years, is when you ask about data security as a priority, we've been saying it's moving up the stack. Data security is becoming more and more important, especially in the generative AI world. And when that happens, of course, there's a lot of investment in the space. There's lots of new players. It's great that there are other people now doing marketing for the market that we built.

So it's -- what we've seen is it's made the market bigger. There is more competitive noise. But specifically with the customers in Q3, we didn't see a change in competitive win rates for all of the reasons that Guy had laid out. It's not that these customers were not renewing Varonis and going to another competitive security product, we just didn't see that.

Got it. Understood. That's very helpful on the competitive win rates. And I do agree that this market does seem to be getting bigger. Guy, maybe the follow-up question here is, have you ever kind of talked about what percentage of the base is "single-threaded"? Like what's the risk that we kind of have as -- what percent of the base is on security, what percentage is single-threaded as we think about just what the incremental risk might be.

So it's a very good question. But I do want to point out that, that single-threaded it did renew and convert in Q1 and Q2. So it's very hard to kind of -- I'll tell you, from a quantification perspective, -- we obviously looked at what that percentage is for what's left in that $175 million. It's not a small portion. It's less than a majority, but not that far from it.

With that said, we want to see how Q4 behaves and then we'll have a much better denominator, and it's not just the two weeks in Q3. And then we can really identify was this like a onetime thing? Or is this something in terms of changing in trends.

From a guidance perspective, in Q4, we assumed lower renewal rates on the on-prem subscription than what we saw in Q3, and we also assumed that there would be some additional churn because of the end-of-life announcement. So from a guidance perspective, we did take a very conservative approach and the way we're thinking about it for 2026 is -- was that the question?

That is -- that was -- that's why I was smiling.

That's great. So in terms of 2026, the way we're thinking about it we want to make sure that investors look at the strength of the business, and they don't have any noise that interrupts what is working and what is not. And we have this $175 million of non-SaaS ARR. As I mentioned, about 1/3 of it is roughly $60 million is up for renewal in Q4. We're talking to every single customer in order to try and figure out whether they will move to SaaS or will they not move or what's the plan to move to SaaS? We already know. Not all of them are going to move to that SaaS. That's, I think, is very clear, especially within the federal business, within the DoD, there are customers that will not move to SaaS, and that's okay.

But from a guidance perspective and a focus perspective, I think the right way to look at the business going into 2026 is what is the SaaS growth rate? So if we guide on SaaS only, not including any conversions, and we give a number on the SaaS number Quarter-over-quarter, what's the expectation, what is the yearly SaaS growth rate, and we talked in the past about our belief that we can grow 20-plus percent for time. So if we give a SaaS number that doesn't include the conversions and then give the conversions on a quarterly basis, on top, I think that puts the focus on what investors really should care of, should care about. The forward-looking business, not the rare-view mirror. It gives the visibility and also give the abilities to know the investors the ability to know how much of the conversions impacted your growth rate on a quarterly basis within the last year of 2026.

Which then -- it makes a ton of sense because then presumably, that can give you a basis for modeling into '27, right? When 100% of the business will be SaaS, presumably. Very interesting. And that idea of kind of separating out the conversions, I think, would be very helpful for what it's worth.

Brian, I want to move over to you for a second. I mean one of the pushbacks that I get sometimes is going back to sort of the DSPM market is, well, there's start-ups like Cyera that are doing really well, et cetera. And I mean -- and you talked about really the win rate not changing, but how much of that is a factor right now from just a competitive standpoint?

There's a lot of noise. There's a lot of discussion. We're in a lot more RFPs and we're in a lot more deals that we weren't in 5 years ago because 5 years ago, Varonis was a self-hosted security platform that supported file systems. These days, we're a cloud-first, cloud-native security platform that supports all of the hyperscalers, databases, SaaS applications, file systems. And the big separator for us versus the entire DSPM market, whether it's a public company that acquired one or a private company is we're doing so much more than just discovery, and we're doing it not just on cloud databases. We're discovering data in places.

But then what matters from a security perspective, which is why we call ourselves a security platform and not just a DSPM vendor, what matters are security outcomes. We talk a lot about outcomes because no matter what you do from a discovery perspective, unless you can actually secure the data, lock it down and do it automatically because there is no CISO out there that has unlimited head count to actually go solve the problems that we find. And unless you can actually monitor data in a useful way, just think your credit card is going to text you as soon as there's any fraud, Varonis is going to call you as soon as any data gets accessed inappropriately. Those capabilities are critical from a security perspective. They're critical to deploy generative AI.

So while it's great that there's a lot of noise in the space and a lot of investment. We mentioned that there's a lot of marketing, growing the market that we created. We haven't seen a change in competitive win rates because our sales execution, the way we go to market, the way we engage with the customer starts with a risk assessment. And that means we're deploying our technology at scale, on real data which nobody else can do.

This is why we win. When I say the competitive win rates haven't changed, when we go in and execute our sales process properly, the win rates are very high.

I think the idea of being a security vendor versus a DSPM point solution is an interesting nuance. Guy, I want to kind of move beyond sort of last quarter's on-prem discussion and talk about that phaseout of on-prem in '26. One of the things that I think Varonis has done really well in the past not just through this transition, but prior transitions, has been sort of turning knobs a little bit, whether it's on pricing or if it's on sales force compensation to really bring about different behavior from your team as well as from customers. As you think about kind of that end of life for on-prem by the end of '26, open-ended question, are there any changes that you're making from a pricing or sales comp perspective ahead of that?

So we started thinking about comp plan about 9 months before the actual the time we start implementing it. So we spend a lot of time every single year. And you're right, in every year, we have some tweaks. In 2025, this was actually the first year that we decided to compensate on the conversions. We didn't do that in 2023. We didn't do that in 2024 in the same way we did it in '25. And the reason we did it in '25 is because we just wanted to be done with the transition. We didn't want to drag the transition. By the way, that's part of the reason we were surprised with the Q3 because it's counterintuitive to what you were thinking and especially when the reps can get paid on it.

In 2026, it is clear, and we're obviously in the final stages of finalizing the program that we will not be compensating on conversions the way we have done in 2025 because we -- the one thing that is important to emphasize, and I've talked a lot about this. So if I sound like a broken record, I apologize. But the cannibalization of time for the reps on focusing on the conversion is actually a headwind for that.

There's an opportunity cost to that time, right?

Yes. There's an opportunity cost, and it's not a technological challenge. It's a documentational challenge. It's a conversational challenge on making sure that you go through all the security check place moving from on-prem to SaaS. All of that takes time and focus from the reps. We want in 2026 to go back to basics where the reps can actually make money by selling to new customers and selling to the base. That will be the main focus. That's what we've been working on over the last, I'd say, 6 months in terms of thinking about the comp plan. I think Q3 actually emphasized our focus on going back to basics. And I think that with their ability to go back to basics and sell to new customers and actually have the opportunity to do an upsell now for a SaaS customer that when you think about the denominator, you have a wide range of SaaS customers that you can go back and sell additional licenses and Brian can talk about some of the platforms that we're seeing in terms of conversation, and it goes back to some of the acquisitions that we have done that generate a ton of opportunity from selling to the base, additional platforms. The focus of the comp plan will be on those.

Obviously, we still will have about 17%. We guided to 83% SaaS of total ARR. So we'll have roughly 17% of non-SaaS that we still want to get over, but the focus will be on the bread and butter, new and existing.

And that is the gift that keeps on giving, right, in terms of SaaS and lifetime value? That makes a ton of sense. We've focused so much on the different parts of -- the moving parts of that the ARR line, Brian, you brought up a couple of times just on one of the secular themes in data security, and that is how to secure data in an AI or a copilot driven world. So maybe for you, again, knowing how much time you spend with customers. How much is Varonis coming up in copilot discussions?

And one of the questions I get sometimes is, Well, hey is Microsoft purview like a competitor or are they a friend here? Maybe address that as part of the answer.

I mean, Microsoft put out a press release earlier this summer that copilot security is powered by Varonis. We consider the set of capabilities that Microsoft offers through purview to be critical for infrastructure security, but you can't really secure your data without us. We integrate deeply with Purview, and part of that announcement was continued enhancements and more research and development together with Microsoft to make that integration deeper. We've moved beyond just the public APIs as an ISV vendor, there's going to be a lot more capabilities within the Purview stack that are powered by Varonis. So Microsoft and Varonis customers can move more quickly to the security outcomes that we're talking about, which allows them to deploy CoPilot more quickly.

To make that as simple as possible, the enterprises that are deploying copilot for 365 widely and quickly with a minimum of friction and a minimum of risk are using Varonis to do it in an integration along with the capabilities that Microsoft provides. We don't compete with Microsoft. We just make everything that they do a lot easier, and you can realize the value of both platforms much more quickly.

Got it. Maybe just to stay with you, Brian. I mean, I think there are some other -- and Guy brought up some acquisitions earlier, right? I think one of the areas that we've kind of entered is database activity monitoring, which I think came through the Cyral -- is that right? The Cyral acquisition, as well as Varonis Interceptor, which I think came through the SlashNext acquisition. Maybe for -- because we -- I would say that certainly, I can tell maybe the question is who are you displacing in those instances for...

The database activity monitoring market is interesting because databases are obviously a big and important data store. Every enterprise has databases. We've been doing database security in cloud stores through AWS, the relational database system as well as Snowflake and Databricks. However, a lot of big companies have a lot of on-premises databases and the legacy tools like Imperva and IBM Guardium that they're using for database activity monitoring, this goes back to the single-threaded use case for Varonis. Those products are being used very tactically to check a box that yes, I'm monitoring some of these databases.

What we have learned as we've entered this market is a lot of companies are very eager to displace those products with a more modern solution. The Cyral acquisition and the integration of Cyral database activity monitoring into the Varonis platform is now allowing us to disrupt that space. So whether you've got a database on-premises or a database in the cloud, whether it's in a managed or an unmanaged database, basically, if you've got data, we can secure it and the monitoring is a key part of that because once Varonis is monitoring a data store, we can detect a threat, just like you get a bank statement with a credit card, we can detect threats there. We can also build really useful and safe and surgical automation in ways that other products couldn't because now it's part of a broader platform.

Really similar. You mentioned SlashNext and Varonis Interceptor. That's really exciting for us because our managed data detection and response, MDDR, is a key part of the value proposition of Varonis. Almost all new SaaS customers are taking MDDR because why wouldn't you? I've got a technology platform, a security platform that's classifying data and monitoring it and locking it down and alerting them if something goes wrong, but now you have a global team of Varonis experts that are going to call you if we see anything that you might have missed. It's all in service of minimizing the time to detection and time to response for a threat.

However, when we're in these investigations, often, in fact, the majority of the time when we're trying to come to a conclusion about what happened, guess what, data breaches often start with an e-mail, a business e-mail compromise. Somebody gets phished or spearphished, and our investigation we get to a point where, "Okay, here's where the fishing happened and now we'd have to go look at another tool", a secure e-mail gateway or ecosystem tools built into whatever e-mail provider they might be using with Microsoft Exchange. We're not displacing necessarily those products.

However, Varonis interceptor is a next-generation AI-based phishing detection, impersonation detection, business e-mail compromise detection. So when you think about Varonis as a security platform, specifically when it comes to threat detection, what we want to do is move left. What that means is if you think about the steps that a threat actor takes to get access to and steal data, very often one of the very first steps is e-mail phishing. We're now there with that technology. And the huge advantage that Varonis has and Varonis Interceptor provides our customers is not just that we have a best-in-breed next-generation e-mail security tool, but it is part of our broader platform. So now you're -- you've got Varonis monitoring and detecting fishing on your e-mail stores while we are classifying it while we are connecting that telemetry in that automation to everything else and all the other data that we're monitoring.

We want -- if you want to protect data, Varonis does it, whether you're talking about e-mails or databases or files or SaaS applications, whether it's on-premises or in the cloud, we want to be everywhere.

Well, as I put myself into Guy's seat, I mean, that only helps support that net revenue retention on the SaaS side, right? And I talked about back to basics on that part of the business, so that certainly helps.

Guy, maybe just to wrap up your last couple of questions. We talked so much about the ARR base and growth. I definitely want to hit on profitability as well because I think that's been great to see as part of the transition. And listen, we're seeing a little bit of compression in the ARR contribution margin this year for various reasons. But maybe you can talk about some of the puts and takes that are driving that? And how to think about that balance between growth and profitability from here, particularly in the context of some of your long-term targets?

I think it's a great question. And I think when you look at our focus on the cost structure and the generation of cash, we have done a job I'm really proud of when you think about where we are today in comparison to where we were a couple of years ago especially if you go back to the -- I'm going back again to that Investor Day, we talked about our desire to get to 18% to 22%, roughly in that 20% range at the end of 2027 and if you look at where we've progressed, we're literally like there. Obviously, when you look at some of the on-prem subscription renewal rate that is not going to come, I think that will have an impact on the 2026. But the benefit is that it quickly comes back at 2027 when you don't have to maintain two types of code and you don't have to have the same level of investment in supporting tickets that the on-prem subscription has because the ticketing -- the support tickets on the on-prem subscription side is significantly larger than what we see on the SaaS side.

So there are a lot of benefits within the model that are beneficial for investors and us as well in getting away from the on-prem subscription. So in 2026, we're going to keep -- obviously, we're not going to go crazy from an expense perspective. But if you're getting some renewals that are not coming, it will impact your ARR contribution margin, but you'll see it come back very quickly with vengeance in 2027. That's the plan.

I go back to where we started, right, with two companies, two companies right now inside of Varonis, but really by the end of '26, that too goes down to one, right?

By the end of -- on December 31, 2026, we are 100% SaaS. There is nothing left that is non-SaaS ARR. That's the plan. That's why we call the end of life, and that's the right thing for us. Obviously, for the customers and also for the investors.

I couldn't think of a better way to end than that. So Guy, Brian, thanks so much for the time.

Thanks very much.

All right. We will get going here. Thank you all for joining. I'm Roger Boyd. I cover cybersecurity here at UBS. Very happy to have the team from Varonis here, Guy Melamed, CFO and COO; and Brian Vecci, who's Field CTO. So thank you guys for being here.

Thank you.

Cool. We're going to do some fireside chat. I've got the iPad here. So if you have questions, feel free to submit them, and we'll try to weave them in. But maybe to get started, I know many people are familiar with the story, but a broader audience here. For the investors who are less familiar, can you maybe start with a quick overview of the platform, history of the company and kind of the use cases you've addressed and the ones you've expanded to address?

Sure. So Varonis is founded because enterprises of all kinds, public, private, big, small and every vertical struggle to protect data. They struggle to understand what data they have and where it is and what the risk is associated with it, who and what's got access to it? How is it being used? Where is sensitive data living in places it's not supposed to be. So we started 20 years ago because answering any of those questions, let alone doing anything about it was basically impossible on even small data sets in the enterprise. And over the years, we've expanded our coverage to cover everything from databases and SaaS applications to file systems and collaborative platforms.

We reinvented our platform as a SaaS-first solution a few years ago. And so now Varonis is a SaaS company. And use cases are really visibility, understanding what data is where, reducing risk automatically and then minimizing how long it takes to detect and respond to threats. So catching threats quickly and minimizing any damage.

I think if I try and bring it home to the nontechnical folks, what we're trying to do is what the credit card companies did the fraud detection. Obviously, when people travel and they have a transaction that is abnormal, they get a text message. Is this you, yes or no? And the accuracy levels of those credit card companies is pretty amazing.

The reason those credit card companies can identify if this is an abnormal transaction is because they track every single purchase that you have. They know where you buy, where you travel, who you're eating within the restaurant. And based on kind of putting all those pieces together, they can identify what's abnormal. We do the exact same thing with data because we see who touches files, who opens files, who deletes files and what files are sensitive, we can identify if someone touches a file that they usually never touch from a laptop that is unidentifiable to the organization, from an IP that usually doesn't get accessed at a time that is abnormal. When you put all these pieces together, we can identify if something abnormal is happening. So that's what we are trying to do.

Cool. Well, we'll come back to the bigger picture, but I wanted to jump in and tackle 3Q. You guys announced the change of the subscription transition, what you're doing with the on-prem customer base. Can you kind of just remind us what's going on there? And what you've seen from that kind of on-prem customer base since kind of that announcement last month?

So we'll start with our announcement to move to SaaS. That was at the beginning of 2023. We talked about -- initially, we talked about a 5-year plan on getting over and completing the transition, and we defined the transition to be complete when we get anywhere between 70% to 90% of ARR coming from SaaS. I can say that the first part of the transition went really, really well. We lowered the period from 5 years to 4 years. And then when we gave guidance for this year, we kind of lowered it to 3 years. So transition was progressing really well.

In Q3, our on-prem subscription renewal rate didn't behave in the same fashion that we've seen. Historically, our renewal rates have been consistently over 90%. I will say that in Q1 and Q2 of this year, our renewal rates actually improved, which I think kind of threw us off. And what we actually saw is that in the last 2 weeks of the quarter in Q3, we started to see a lot of those customers that decided not to renew. We are in conversations with many of them. I think we can get some of them over to SaaS. But when we looked at what happened, there were basically 3 key elements that contributed to the underperformance on the on-prem subscription renewal rate.

One of them had to do with customers that were single threaded, meaning they bought us initially for a specific use case, an auditing tool. They didn't get the full value of the platform. And then if they don't renew, nothing really bad happens the next day. And that was something that we identified as an element that impacted Q3. I do want to note that when we looked at Q1 and Q2, those single-threaded customers did convert and renew. So this was something that we didn't see coming, and it had an impact in Q3.

The second element was sales execution. We did see some of the sales team that kind of reverted away from our game plan, including having QBRs with customers, making sure that they see the value, understanding what the benefits of SaaS are and what's the next step for them in their kind of journey with Varonis. And I think that in neglecting that -- those conversations with some of the on-prem subscription customers, it kind of generated additional friction that impacted those renewal rates.

And the third element that we saw was additional deal scrutiny in the last 2 weeks when you kind of just look at the environment. I don't know if we can distinguish this from a macro perspective or anything else, but it was definitely something that we saw and we wanted to call it out.

Sitting here today, looking at those 3 elements, they still are there. We haven't seen anything different in terms of the analysis that we have done, and we spent a lot of time in analyzing everything. One of the things that we did do is call the end of life of the on-prem subscription. We can talk more about that later. But we did that as an attempt. We only kind of pulled it up by 1 quarter. The plan was to announce it anyways at the beginning of 2026 during our SKO. But when we saw kind of the underperformance on the on-prem subscription renewal rate, we decided that we want to put it out there because obviously, investors would like to know what is the expectation for conversions in 2026. And I think it would be irresponsible to give them a number and announce the end of life at the same time and then have an additional point that can have an impact.

So we felt that if we are going to give a number and kind of some sort of expectation for 2026, then we have to do it where everything is out there and all the data is known, and we can see the behavior in Q4, which is a large denominator and then kind of have a much better understanding of how things could look next year.

Yes. Makes sense. I appreciate the color there. I want to go back to the time line, and we did this the other week. But when you go back to what you guys talked about in 2023 when you first laid out the transition, you were kind of projecting around $200 million in ARR from SaaS by 2025. And today, you're closer to $600 million. And obviously, transitions have been a big part of that. But I wonder if you could talk a little bit about what you've seen in the SaaS business ex conversions. I think it's kind of gotten lost in the debate over 3Q, but I think it has outperformed your expectations. But if you could give any color there.

So I'll start by saying that it definitely outperformed our expectations. Our ability to shorten the transition period from 5 years to 4 years and then from 4 years to 3 years is a testament to how well the transition was going. And I absolutely agree with you that the on-prem subscription renewal rate kind of put a cloud on a business that is performing really well. The SaaS business is really hitting on all cylinders, and we feel very good about that business, which kind of brings the point that we understand that in 2026, we need to ensure that investors see the strength of the business through the SaaS and not have any of the on-prem subscription renewal rate overshadow our performance.

So I think the focus in 2026 is going to be on providing the metrics to investors that allow them to see how the business is performing, how the business that is going forward is performing, not the one that's in the rearview mirror. And the rearview mirror is going to be done anyways by the end of 2026 because by December 31, 2026, we're going to have 0 non-SaaS ARR. So whatever impact we have on conversions, it's going to be short-lived. And we believe that we can drive this business on the SaaS front in a very healthy way.

Just to touch on that. You've talked about a SaaS net retention rate and the new logo growth, which is now almost all SaaS. Are there other metrics you're thinking about to help kind of frame the strength of this new business or...

So we're definitely playing around with what would make the most sense in providing color to investors. One idea that I think would make a lot of sense is just breaking out what is the SaaS number in each quarter, excluding conversions and then just putting that on top. And I think that would provide a lot of comfort to investors because I know in many cases, they wanted to know how the business is performing. This puts kind of the spotlight on the SaaS front, excluding conversions. And at the end of the day, when we have roughly $175 million of non-SaaS ARR with about 1/3 of it coming up for renewal in Q4, I think by the end of the year, we'll have a much better understanding of how 2026 is going to behave on that front, but that's not the focus.

The focus is -- obviously, we're going to try and get everyone over, but the focus is to continue to drive a healthy SaaS business that can continue to grow and provide value to customers, and that's really at the forefront of everything.

Perfect. Cool. I want to get back to the bigger picture and get Brian back in the conversation. But a high-level question, how do you think about the demand level for data security? And there's a separate question here on AI. But even going back a couple of years ago, it really felt like you guys had to evangelize the space, and I think that's changed a lot. So can you just talk about what you've seen from a customer perspective, like the definition of data security budgets?

Well, the short answer is budgets are going up in data security. If it's not at the top of a CIO and a CISO's list of priorities, I would question why not. That's what an attacker is after. When we talk about insider threats, insider threats are after data. Data is where the damage is done. So that's where security priorities have aligned over the last few years, which is exactly what we've been predicting for a long time.

The advent of Generative AI has only accelerated that. Generative AI is all based on data. It's based on learning from lots of data to build useful models that you can monetize. It's also based on giving people productivity tools like Microsoft Copilot that allow them to better use all of the data that they have access to. But if you're going to deploy those kinds of tools you better make sure that your data is secure.

I've told the story a number of times, but one of the banks that we work with found that as soon as they gave Microsoft Copilot to one of their traders, the trader asked the question, what stocks do our employees invest in? And instead of getting a couple of paragraph summary like you'd expect from ChatGPT, got thousands of lines of names and social security numbers and positions of employee 401(k)s. That's exactly what companies want to avoid. They want to reap the benefits of all of this technology, the benefits of generative AI. They want their employees to be more productive. They want to monetize these data sets. But unless your data is secure, you're introducing far more risk than you can control. You can't get the benefits of AI without data security, which means data security is not the top of everybody's list.

Yes. Makes sense. I think what else got kind of lost last quarter was just the strength that you've had across the broader portfolio. And so features like AI security, MDDR, you launched a Copilot SKU a couple of quarters ago. What's the update on those? I mean, those sound like they're doing well. And again, kind of lost in the shuffle of last quarter's earnings. But what can you give us there?

Yes. I mean we didn't have to talk too much about them because SaaS is doing so well and the innovation, both through the acquisitions of Cyral, which adds database activity monitoring, gets us visibility and observability in places that we didn't have before. The acquisition of SlashNext get us next-generation modern email security and show me a data breach that doesn't involve an e-mail somewhere. Fishing is still in spear fishing, especially in the advent of ChatGPT and Microsoft copilot is still the primary threat vector.

The right way to think about this is our product platform is going as far wide as we can. If you've got data and you've got infrastructure. We want to cover it. We want to give you visibility there. We also want to build useful automation. That means not just having coverage but also the right telemetry and automation to get these outcomes to make sure that data is protected. That you minimize threats without having to do a lot of work because the other key theme from every one of our customers is that they don't have the people to go and implement lots of new complicated technology. It needs to be automatic. So the various pieces of our platform that we've been adding and building are allowing more of our customers to do more of that with a lot less effort, and it's all going really well.

Cool. Just to touch on database activity monitoring and e-mail security. How do you frame like the near-term versus longer-term opportunities there? It sounds like DAM might be a little longer life, e-mail security contribute earlier. Is that the right way to think about it? And how do you think about sales enablement around those products? You're obviously growing the platform quite a bit.

I'll take the last part of that first. Sales enablement has been relatively straightforward with these additions to our platform because our reps and our team to get it. We're protecting data. This is all in service of protecting data. All of our customers have e-mail. All of our customers have e-mail security budgets. Now we can attach to those and do a risk assessment just on e-mail before expanding into a broader security platform. All of our customers that use us to protect their file systems on-premises and in the cloud, they all get databases too, and they've been asking us for coverage in databases. So database activity monitoring is another natural addition.

So the sales enablement piece has not been -- I mean, it's always a priority, but it hasn't been a challenge. It hasn't been a roadblock. The reason that e-mail will probably contribute more quickly is only that it was a more mature product. whereas database activity monitoring, we are folding into our platform. That said, DAM is a -- for those that don't know, DAM is Database Activity Monitoring, DAM. That's how many billions of dollars of business that we can go attack and it's -- there are legacy players there that customers are ready to move on from. So it is a market that is ripe. And then with e-mails, again, everybody's got e-mail, everybody got an e-mail security budget. It allows us to do risk assessments in places that we didn't before more easily with less friction, while also allowing us not just to get to new logos, but then to expand our broader offering.

I want to talk about the e-mail security offering because I think it has to be seen in the context of MDDR. We are not going into the e-mail security as a stand-alone product. This is not kind of the direction we're going is just protecting e-mail. And I want to probably touch on how we got to the thinking of acquiring something that's related to e-mail security. So it really stems from the MDDR offering.

When we analyze and we track this. And the MDDR offering is really when you think about it, it only started to be offered at the beginning of 2024, and it's been so well adopted. Obviously, with almost all of the new customers and definitely by many of the existing customers, we're not anywhere close to 100%, which we believe is the right number. We think every single customer should have the MDDR offering.

And the MDDR offering is when you buy the platform, the alerts that are provided are analyzed by our engineers that know how to analyze those and make sure that the right alerts are being handled by the customer. So in a way, it helps the customer in a tremendous way where Brian talked about this before, they don't have the right increase in head count to deal with the sophistication of attacks. And also the alerts and the hackers are getting more sophisticated by the day. So this really helps in making sure that customers are better protected.

When you see that so many of those attacks, attacks are coming from e-mail, by having an e-mail platform, you're providing way more value to your customer because you're not just protecting them, you're also showing them where it's initiated from and you can protect them one step quicker than what you would do otherwise. So I think the important emphasis I have here is that the e-mail security acquisition was done in the context of MDDRs and not as a stand-alone.

Yes. Makes sense. Cool. I wanted to press on DAM for a second longer. Can you talk about what makes that market so interesting to go out go at right now? And you mentioned there's some vendors in that space that you feel like aren't working for customers. But what does it take from your end? Do you have the suite today? I know you've expanded coverage to Snowflake and Databricks and Oracle and SQL. Like what else do you need to do on your end to be a competitor there?

I think it's -- we have the technology. It's integrating the acquisition of Cyral, which is database activity monitoring for on-premises, legacy databases, SQLs and Oracles and Postgres and MySQLs of the world. We have all of the coverage that we need both now and our near-term road map.

What this allows us to do is not just replace the Da.m. tools that enterprises are currently using. They require a lot of OpEx. They don't -- customers generally don't use them to cover all of their databases. So it's a technology that is ripe for disruption. However, we're not just replacing DAM. Much like how Guy talked about us going into the e-mail space, it is valuable by itself but also in the context of our broader offering and especially with MDDR. Now we're monitoring databases, which allows us to perform behavior analytics on databases that we couldn't before, which allows us to also build automation for automatic risk reduction in addition to data classification.

So what this does is it really expands the Varonis value proposition into new places. Our goal is, if you've got data, I don't care if it's in a file or a database or an application. I don't care if it's on-premises or in the cloud. I don't care if it's in a hyperscaler in your data center, we want to be able to protect it. And DAM is both a product category that we can disrupt while also giving us coverage and visibility where we need to have it.

I want to touch on U.S. federal. I think it came up a little bit short in 3Q, and you had some pretty specific comments about some of the issues that you saw there. Can you kind of rehash what happened? I know part of it was that you got FedRAMP earlier this year and maybe that introduced a little confusion to the buying process. But how do you think about the federal agencies as a vertical market going forward?

We believe there were 3 components that contributed to the shortfall in the federal business. One of them Dodge, I don't know how much of an impact that was. It probably wasn't the largest contributor to the shortfall, but it definitely didn't help. So that was one element.

The second element was similar sales execution that we saw with some of the enterprise business sales teams that we saw in the federal, where they didn't have the same conversations with customers as they should have. But I think the third component, which probably had the largest impact was the timing of the FedRAMP certification. We got a moderate FedRAMP certification really at the beginning of Q2. And one of the things that is important to note is that sales cycles for the federal business are much longer. I think it probably generated more chaos in the sales campaign because now can you switch it to SaaS on time? And if you are trying to switch it, does it generate more turbulence within the deal?

So I think the timing of it definitely didn't help us. We absolutely believe in the vertical, we think we can solve a lot of problems there. But to be fair, we have been underperforming in that vertical for a couple of years now. So what we decided to do is reduce some of the team and make sure that we can see productivity levels go back to kind of numbers that we expect to see and make sure that we put additional investments at the right place. But I think that the FedRAMP was the right thing to do because not only does it help you with the federal business, it also gives a lot of comfort to a lot of the enterprise customers that ask for the FedRAMP certification. So definitely was the right thing to do, but probably didn't help us in the Q3 sales cycle for that vertical.

Yes. Okay. I wanted to touch on competition. I get asked by investors all the time about competition for data security. For a while, it's very hard to kind of line up a truly competitive platform. I'd argue maybe that's changed a little bit in the last few years. You have some competitors in the private market are pretty vocal. How do you see competition? Has it changed at all? And conversely, has some of the new entrants in the space created a bigger kind of demand pull for you? And have there been deals where maybe others have initiated that you've come in and won?

Yes, that's happened a number of times, and it's great that other people are spending money on marketing for us at this point. Yes, there is a lot more investment in the space. And there's been a lot of acquisitions. What's happened -- there's a couple of things that have happened. So there are more players. We believe really strongly in our ability to execute outcomes matter in security. I don't really care when anybody says they can do. I care a lot more about what they prove that they can do, which is why we do our sales motion, our sales execution is actually running a real data risk assessment. Let's prove that we can scale. Let's prove that things are accurate. Let's prove that we deploy incredibly quickly without a lot of noise. That's why we -- that's why that's our motion.

But what has changed in addition to lots of other players because it's data security is at the top of everybody's priority stack is Varonis now covers files and e-mails and databases. We cover the hyperscalers. We cover on-premises data. We cover cloud data, we cover SaaS applications. No one can touch us in coverage, which means if you're an enterprise and you have a project for DSPM or for compliance or privacy or for AI deployments or AI security, and you put it on an RFP, we're in those. We're in every fight now. We're not getting boxed out like we were a few years ago because we didn't cover databases, and we didn't cover some SaaS applications. Now because nobody can touch us in coverage and nobody deploys faster than us, and nobody is as accurate as we are. We need to be in every fight, and we are in every fight. And that's why sales execution is so important for us.

We need to not only be in the RFP, we need to deploy and run a real risk assessment and prove that all of the capabilities that we offer that no other product offers, the automatic remediation, MDDR, in addition to the coverage we have. We have to prove -- we have to show a customer just how valuable that is and how quickly they realize that value. Just how much -- how quickly they can get to these outcomes without a lot of effort, it's so important for us to do that, and we can.

And so our win rates haven't changed. You're probably right now that there's absolutely more competitive products, but there's still nothing that does what we do everywhere that we do it. And so the technical moat that we've built around us is big and continues to get bigger because there's more innovation in front of us than behind us.

I'm going to weave in a question from the audience just because I think it fits well. But how do you think about competition from the data resiliency backup vendors. And conversely, how do you think about that as part of a broader kind of data security platform, the data backup service?

I would never tell a CIO that they don't need backup, but I would also tell them backup is not security, just like Discovery is not security. So we haven't seen any of those players be credible competition for us. And many of our customers use backup and cyber resiliency providers and are very happy with those capabilities, but are still Varonis customers because, again, resiliency backup, that's not security.

Okay. Cool. Guy, you mentioned this before, but some of the customers that didn't close in 3Q are still in the pipeline. Can you just talk about kind of what the game plan is from here? Any -- have you seen any customers come back thus far in 4Q? And when you think about different verticals, federal, like are there anything to note there?

So we definitely saw some of the customers that actually did convert post Q3. And we're in conversations with -- still with many of those customers to find a path to get them over to SaaS. Obviously, we understand that not all of them are going to move. But I think that when we look at the behavior, we're definitely in conversations with a good chunk of those to get them over.

I think the understanding for us that we are, by the end of next year, 100% SaaS business, hitting on the strength of the business and making sure that kind of what happened in the last 2 weeks of Q3 doesn't overshadow where we're planning to go. I think that was an important realization for us post kind of the unfortunate event of Q3.

I think with that said, obviously, we just want to make sure that it doesn't overshadow the strength that we see in the business. In the past, we talked about a price uplift on getting customers over from on-prem to SaaS. I can tell you that we will do everything we can to get customers over to SaaS as quickly as possible. But obviously, without having any customer abuse on the situation, but at the end of the day, we just want to get them over, show them the value that they see with the SaaS platform. And then we can go back to them and show them additional platforms that they can come and purchase.

Cool. Maybe to close, you've talked about this goal of 20% growth, 20% ARR growth in the past. How, if all, has 3Q kind of changed that goal? And if it still stands, what does the path look like going forward? What needs to go right to hit that target?

So obviously, the on-prem subscription renewal rate was a bit of a curve ball for us in the last 2 weeks. But we wanted to see if this was a change in trend or if this was a one-off and that's why we said let's see how Q4 behaves. And then we can give more color on how 2026 will look like.

I do want to note that obviously, we're going line by line, we're going with every single customer and having discussion on whether they will move or not. Some of them we understand they're not going to move to SaaS. And I think that's -- there's a lot of financial benefits for the organization of being fully SaaS at the end of 2026, whether it's less tickets on the support side, whether it's managing -- not having to manage 2 types of code. So there are -- it's not just the fact that the SaaS offering is significantly superior than the on-prem subscription and the value that we can provide customers is much more significant. It's also the financial benefit of not having the on-prem to manage and also the time cannibalization. You have to deal with way more issues with the on-prem subscription with your customers. And we want to make sure that we focus on what's right longer term.

Cool. Well, we'll wrap it there. Thank you all for attending. Thank you, Guy and Brian, for being here.

Thak you.

Thank you.

Greetings. Welcome to Varonis Systems' Third Quarter 2025 Earnings Conference Call. [Operator Instructions] Please note, this conference is being recorded. I will now turn the conference over to Tim Perz of Investor Relations. Tim, you may proceed. Thank you.

Thank you, operator. Good afternoon. Thank you for joining us today to review Varonis' third quarter financial results. With me on the call today are Yaki Faitelson, Chief Executive Officer; and Guy Melamed, Chief Financial Officer and Chief Operating Officer of Varonis. After preliminary remarks, we will open the call to a question-and-answer session.

During this call, we may make statements related to our business that will be considered forward-looking statements under federal securities laws, including projections of future operating results for our fourth quarter and full year ending December 31, and 2025. Due to a number of factors, actual results may differ materially from those set forth in such statements.

These factors are set forth in the earnings press release that we issued today under the section caption -- forward-looking statements, and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings.

These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call.

A reconciliation for the most directly comparable GAAP financial measures is also available on our third quarter 2025 earnings press release and our investor presentation, which can be found at www.varonis.com in the Investor Relations section. Last, note that a webcast of today's call is available on our website in the Investor Relations section.

With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Faitelson. Yaki?

Thanks, Tim, and good afternoon, everyone. We appreciate you joining us to discuss our third quarter performance. We finished the third quarter with 76% of our total company ARR coming from SaaS which means that we have now completed the SaaS transition in less than 3 years and more than 2 years ahead of plan.

In February, on our first quarter earnings call, we noted that Varonis is a story of 2 companies, and this remains true today. Our SaaS business, it drives our momentum, [indiscernible] customers benefit from the simplicity and automated outcomes of the platform and our on-prem subscription business, the drag on total company growth and masked the strength of our SaaS business.

Let's start by reviewing our third quarter results. ARR increased 18% year-over-year to $718.6 million. However, in the final weeks of the quarter, we experienced weaker-than-expected renewals in our federal business in our non-federal on-prem subscription business, which resulted in Q3 coming below our expectations as a result of continued underperformance in the federal vertical will be reducing the size of the team until we see improvement.

Now that we have completed our SaaS transition, we are now announcing the end of life of our self-hosted solution as of December 31, 2026. We expect this to result in increased uncertainty in our remaining OPS business going forward. In each of the first 2 quarters this year, we saw improvement in our gross regular rate across the business, which is why the reduction in the renewal rate that happened in the final weeks of Q3 was unexpected.

To account for this recent change as well as our decision to end of life of self-hosted solution, we are baking in additional conservatism to our guidance and have assumed even lower renewal rates in our OPS business for the fourth quarter. We are also taking thoughtful and prudent steps to manage expenses across the business which includes a 5% reduction in headcount in order to reallocate our resources where we see the highest return on investment.

I will review our results and updated guidance in more detail shortly. Despite the softness we experienced in our OPS business, we again saw strong demand for our SaaS platform during Q3. This is happening because customers are able to secure their data with significantly less effort.

We [indiscernible] SaaS portfolio on the right for cloud environments continue to show traction during Q3, which was driven by the investments we have made in our platform to expand to additional use cases and protect many more platforms. Our ability to protect cloud data represents a significant growth opportunity for us as we're just beginning to discuss the surface because the transition is complete, our reps can put more focus on new business and upselling existing SaaS customers as we believe this additional focus on upsell will help us unlock this market potential.

Now I would like to take a step back from our near-term results and discuss the opportunities we are excited about moving forward. As I have said in prior quarters, [indiscernible] actors not breaking the log. Once an identity is compromised, there is no perimeter and companies need a sophisticated data security platform to keep their data safe.

The only stakes, it had a first approach and helps companies allocate their sensitive data, visualize who has access to it automatically lock down and then automatically detect and respond to threaten it. Performing only 1 or 2 of these tasks is insufficient to secure data. What sets Varonis apart is our ability to successfully do all 3 of these tasks on data every.

Our SaaS platforms and EBITDAR have significantly reduced the amount of effort and resources needed to secure data. AI continues to put a huge spotlight on the need for data security and the CSOs that I speak with want to ensure 3 key things. They won't have a data breach. They won't face compliance fines, and they want to secure their data to enable safe use of AI in an effortless way.

Addressing this problem has always been difficult and in the age of AI, it becomes even harder to secure data without sophisticated automation. In the third quarter, we continue to see demand from companies looking to protect their data to safely realize productivity benefits for pilot and we believe we are still in the early stages of starting to capitalize on this tailwind.

In July, we announced an update to our strategic partnership with Microsoft and are making significant investments to deepen our integration with them to better enable customers to securely adopt copilot over time. We believe these investments ultimately to better position us to capitalize on this massive opportunity.

In July, we announced the release of an next-gen database activity monitoring or them, which stems from the acquisition of [indiscernible] is database activity monitoring provides a cloud-native agentless solution that offers next-generation database security and compliance for the AI era and like legacy database activity monitoring tools that are slow to deploy and offer a limited compliance value, our next-gen dam solution is part of our [indiscernible] SaaS platform, which delivers rapid deployment, real-time threat detection, automated remediation and deep visibility into sensitive data access.

This provides customers with automated security outcomes on any kind of data using our unified SaaS platform. Earlier month we introduced Varonis Interceptor which offers customers a breakthrough AI native e-mail security solution designed to stop data breaches before they start and stand on the recent acquisition of [ flash ] next.

The introduction of Interceptor is a natural evolution of our platform and significantly expand our total addressable market by connecting the dots between e-mail identity and data. We believe we will dramatically increase the value for MVDR service and help customers to [indiscernible] even earlier in the attack plan.

With that, I would like to briefly discuss a couple of key customer wins from Q3. We continue to see strong demand for new customers and one of these is the fintech company that wanted to replace its limited DSP point tools with a data security platform. The encumbered classification vendor could not scale fail to provide forward and complete classification scale and also failed to automatically remediate risk or the tax rates one was able to quickly discover overexposed PII data and credentials and planet that will surface by co-pilot users is also automatically remediated this exposure and provided a current and complete view of their cloud data under a single dashboard.

The purchase Varonis sat with MBR for hybrid environments and core pilot Azure, AWS, ServiceNow, Snowflake and databases. We also continue to see our self-hosted customers looking to convert to SaaS. This quarter, one example of this is a global financial services company that has been a Varonis customer since 2010.

As a heavily regulated organization, they have historically used Varonis for compliance and auditing use case, they wanted additional visibility into their IAS data and wanted to simplify the ongoing maintenance of its deployment under 1 unified sustaining. We evaluated a number of SPM vendors but they did not provide the breadth of support in automated outcomes that Varonis building.

This organization upgraded to Varonis SaaS for hybrid environments in core pilot active directory, Exchange Online Edge units, privacy automation and [indiscernible] for IS. In summary, although we are disappointed with the performance of our on-prem business during the final weeks of the third quarter. We continue to be enclosed by the strong demand we see to our SaaS platform, which now represents 76% of total company's ARR.

This demand is driven by the automated outcomes and scale that it provides as well as customer interest in deploying AI initiatives and securing data in the cloud.

With that, let me turn the call over to Guy.

Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. As Yaki mentioned, we see our owners as 2 companies: our healthy SaaS business which now represents 76% of our total ARR or approximately $545 million, and our on-prem business, whose weaker performance is masking the underlying growth of SaaS in total company results.

I will expand on this shortly, but let me first recap our Q3 results and updated guidance. In the third quarter, ARR increased 18% year-over-year to $718.6 million. Our quarterly results did not meet our expectations due to weaker-than-expected renewals in our federal and nonfederal on-prem subscription business in the final weeks of the quarter.

In each of the first 2 quarters of this year, we saw an improvement in our gross renewal rates across the business, which is why the reduction in the renewal rate in the final weeks of Q3 was unexpected. Since it is unclear if this reduction is specific to the customers that were up for renewal in Q3 or will be applicable to the population of remaining on-prem subscription customers, we have assumed a lower renewal rate in the fourth quarter and expect continued variability in our on-prem renewal rate going forward.

As it relates to our guidance, we are now baking in additional conservatism for the fourth quarter to account for our weaker Q3 results and the decision to end of life our self-hosted solution. At the same time, our SaaS business remains very healthy. even when excluding the impact of conversion, and we continue to see the SaaS NRR trends at a very healthy level.

We expect that this demand will continue to be the growth driver of our business going forward. This is driven by 3 factors: one, a continuation of the healthy new customer demand that we've seen since the introduction of our SaaS platform; two, an increased focus on the SaaS upsell motion starting next year due to the completion of the SaaS transition; and three, the investments that we've made in the Microsoft partnership and the acquisition of Ciro and FlashNext that we expect will start to generate returns.

In the third quarter, ARR was $718.6 million, increasing 18% year-over-year and year-to-date, we generated $111.6 million of free cash flow, up from $88.6 million in the same period last year. In the third quarter, total revenues were $161.6 million, up 9% year-over-year. SaaS revenues were $125.8 million. Term license subscription revenues were $24.8 million, and maintenance and services revenues were $10.9 million as our renewal rate remained over 90%.

Moving down to the income statement. I'll be discussing non-GAAP results going forward. Gross profit for the third quarter was $128.3 million, representing a gross margin of 79.4% compared to 85% in the third quarter of 2024. Our gross margin continues to track ahead of our expectations and we feel very confident in our long-term target set at our Investor Day. Operating expenses in the third quarter totaled $128.1 million.

As a result, third quarter operating income was $0.2 million or an operating margin of 0.1%. This compares to an operating income of $9.1 million or an operating margin of 6.1% in the same period last year. Third quarter ARR contribution margin was 16.3%, up from 15% last year. During the quarter, we had financial income of approximately $10.1 million driven primarily by interest income on our cash deposits and investments in marketable securities.

Net income for the third quarter of 2025 and was $8.4 million or net income of $0.06 per diluted share compared to a total of net income of $13.8 million or net income of $0.10 per diluted share for the third quarter of 2024. The -- this is based on 134.1 million diluted shares outstanding and 134.7 million diluted shares outstanding for Q3 2025 and Q3 2024, respectively.

As of September 30, 2025, we had $1.1 billion in cash, cash equivalents, short-term deposits and marketable securities. For the 9 months ended September 30, 2025, we generated $122.7 million of cash from operations compared to $90.9 million generated in the same period last year and CapEx was $8.7 million compared to $2.3 million in the same period last year.

Turning now to our updated 2025 guidance in more detail. For the fourth quarter of 2025, we expect total revenues of $165 million to $171 million, representing growth of 4% to 8%. We non-GAAP operating income of breakeven to $3 million and non-GAAP net income per diluted share in the range of $0.02 to $0.04. This assumes 133.4 million diluted shares outstanding.

For the full year 2025, we now expect ARR of $730 million to $738 million, representing growth of 14% to 15%. Free cash flow of $120 million to $125 million and total revenues of $615.2 million to $621.2 million representing growth of 12% to 13%. Non-GAAP operating loss of negative $8.2 million to negative $5.2 million, non-GAAP net income per diluted share in the range of $0.12 and to $0.13. This assumes 134.8 million diluted shares outstanding.

Lastly, as we announced today, our board has authorized $150 million share repurchase program. We're able to make this announcement due to our strong balance sheet with over $1 billion in liquidity and our healthy free cash flow generation. In summary, while we are disappointed with the performance of our on-prem business during the third quarter, we remain confident in the performance of our SaaS business.

We will continue to thoughtfully manage our business which we believe will ultimately benefit our customers, company and shareholders in the long term.

With that, we will be happy to take questions. Operator?

[Operator Instructions] Our first question comes from Meta Marshall from Morgan Stanley.

Maybe a question for me is just in terms of kind of you guys had just received FedRAMP high authorization for the SaaS platform. And so I guess just what went into kind of some of the decision to kind of terminate some of the people on the federal team. And just how do you kind of pursue that opportunity going forward?

We have the sedan moderate, but we just don't have this political evidence that in terms of when you're looking at all of the investment, this is the place that we need to invest in. We [indiscernible] all along that it doesn't behave like the enterprise business. And we haven't figured out why the federal continued to underperform.

I just know the result, we are reducing the footprint of our threat and just we being reevaluating the strategy -- the data there is important, but we see what we just move these customers to SaaS. It's just a tremendous value proposition with all the automation, and we believe that the database activity monitoring and the e-mail is very strong and just want to mainly invest in the place that we can move these customers to SaaS as fastest.

Our next question is from Matt Hedberg from RBC Capital Markets.

Yaki, was there anything you heard that was consistent for why the on-prem deals didn't renew? I mean, I guess, was there anything competitively? And then, Guy, you noted SaaS NRR trends remain at healthy levels. So I wonder if you could put a finer point on what level that might imply.

Matt. So the win rates stay the same. We have more than 75% of our ARR coming from the Stand the SaaS platform is performing very well. We identified that some of our apps were very focused on the SaaS customers. And unfortunately, we didn't have the account management trigger of -- for the last leg of this OPS customer primarily when they are single spreaded not using the full Varonis platform on-prem.

You know our methodology of finder, find the clinical data due to remediation and do the starter and we're just going back to the basics and make sure we are getting mark of taking care of these customers in the right way and that they are going to them in a very systematic way, demonstrating the value of staff, almost treating them as a new sales campaign and just not assuming that the fact that there are good signs and positive conversations, they will just move on.

When we look at it, there is just not one common thread, there is not one common theme while this OPS customers didn't renew, and this is why we are just very careful but I think that what we have seen more than anything else that this is this crystal clear tale of 2 companies, this is automated platform.

We just all the coverage that is very easy to take all the rest of the integration. Many customers want to be a cloud -- and when we are competing with the what we call the BSP ankle biters, we have very, very high we rates there to this or OPS customers. So this is really what we are doing now is to make sure we are very focused on the last leg and to move these customers to SaaS.

And Matt, in relation to your NRR question, as Yaki mentioned, this is definitely. There's 2 companies right now in Varonis. We talked about that in the Q4 earnings call about the fact that the SaaS business is strong. And when we look at the results in Q3, I think the overall on-premise subscription business is somewhat dragging and masking the healthy business that we have in SaaS.

When you look at NRR, and I'm looking at NRR on the SaaS side because that's really what matters. We're definitely seeing that NRR continuing to be in very healthy levels and well ahead of the total company NRR. We do disclose the NRR number on an annual basis, and we will provide the SaaS NRR at the end of Q4. But just to remind you, the conversion uplift is not included in that calculation.

So it's really a reflection of kind of the ability to go back to our SaaS customers and continue to sell them additional licenses. And we definitely have plenty to sell to those customers with the amount of platforms that we have -- so we're extremely encouraged by the numbers that we see there, and we feel very good about the SaaS business.

Our next question is from Fatima Boolani from Citigroup.

Guy and Yaki, you've sort of identified that this nonrenewal or rather churn on an enterprise customer, presumably was maybe more of an isolated event, but you are being prudent, and you are frankly, taking a hatchet to your ARR guidance for the year, so I'm wondering in the 24% of the ARR base that is not SaaS.

What are some of the granular assumptions or thought processes you're reflecting to give us a better sense that, hey, we've kind of hit the floor on something like this happening again and frankly, for most of next year, ahead of which maybe customers are going to have an air pocket in terms of their decision-making.

So can you help us through some of that in terms of how you're putting parameters on the risk to the 24% of ARR that is not fast.

So when you look at the fourth quarter, and I'll talk about the fourth quarter first, and then I'll give you some color on kind of how we're thinking about 2026. But the fourth quarter is really the largest quarter of the year.

And we want to wait and see how the business performs before providing really a formal look into 2026. I will tell you, and I want to talk about Q4 for a second, that if we had the same renewal rate that we saw for the on-prem subscription business in H1 2025 and the same renewal rate that we saw for the full year 2024 for the on-prem subscription business, we would have raised our full year guidance.

So this reduction of guidance is isolated to the on-prem subscription and the fact that it behaved I would say, unpredictably, especially in the 2 weeks. In the last 2 weeks of the quarter. When we were going throughout the quarter, we didn't see any change. And we really saw this happened in the last 2 weeks of the quarter.

And that's why we want to evaluate when we see in Q4 and kind of take into consideration whether this was a onetime on the on-prem subscription or if this is a much more of a trend. I will tell you that from a guidance perspective, we baked in additional conservatism because we want to make sure that we account for this behavior and also for the fact that we announced end of life on the on-prem subscription.

So we are baking both of those things into our guidance. And based on what we see in Q4, we will take that into consideration when we look at 2026.

Our next question is from Joshua Tilton from Wolfe Research.

Can you guys hear me okay?

We can, yes.

Awesome. Maybe just one for me, and the answer might be you guys are still kind of trying to figure it out. But I guess, I'm listening to everything that's going on the call. And I'm just -- I understand what happened in the quarter, but I'm still a little confused on the why. Like do we -- like from your perspective, and like what happened, what was the reason as to why you saw some of these lower-than-expected renewals in the on-prem business, both for Fed and not Fed.

And my follow-up to that, maybe just a little more directly, is on the Fed side, was it related to the shutdown? And on the non-Fed side, were these customers aware that the end of life was going to happen? Or is this announcement of end-of-life kind of post quarter, if that makes sense?

So I kind of -- we kind of heard you scrambled at the end, but I think I got the gist of the question. And I want to give some color as to kind of the word within the Q3. So really, as it relates to this quarter, we really saw multiple factors that came up, but we didn't identify any big theme that relates to our customers that did not renew on the on-prem subscription renewals.

I think we identified sales process issues on the convergence that weren't related to the contracts and the documentation that we've talked a lot about in the past, and we are going back to basics to address these issues. We also identified and we some additional budgetary scrutiny from customers this quarter. But it's really hard to say for certain if that was a factor because it happened so late in the quarter.

And obviously, as we mentioned, we had the federal underperformance. I can tell you that one thing that was clear to us is that we didn't see a change in the competitive win rates and we're still in discussions with some of these customers that did not renew.

And we sum them, it was clear that they were what we call single spread, that is some classification and audit and we do all the fund fixed methodology. And in some cases, the things just -- the heart of the sales process is a POC and then QBR that showed the value and EBC that show everything that we have in terms of road map and so forth, and some things didn't really follow this methodology.

And also, it's a tale of 2 companies, but the vast majority is now in SaaS and for some of the teams, it's easier to pay attention to the SaaS customers, and we want to make sure that we are managing their attention and making sure that we are taking care of this last leg of the transition in the rent.

Our next question comes from Joseph Gallo from Jefferies.

Should we expect you to ease on that 25% to 30% ASP uplift for conversions? Or is there anything you can do to further incentivize the on-premise customers remaining to move to SaaS and then just in your conversations with customers, is there any sense of the number or percentage of business that maybe would never be willing to or can't move to SaaS.

We are uncovering every strong here. And as we said, there is not one theme. This is something that till now just worked extremely well. It was a surprise in the last 2 weeks of the quarter. So we just need to B2C how it play out.

And I want to add, when we look at the Q1 and Q2 renewal rate in 2025, we saw that renewal rate increase.

So I think when we're looking at the Q3 renewal rate on the on-prem subscription coming down, we're truly trying to understand if this was a one-off or if this is something that we need to pay more attention to going forward? And that's why we reduced the guidance to bake in additional conservatism.

And I think when we look at the Q4 results, we can identify for 2026 what is kind of the right rate that we should assume going into the year. But when we look at kind of the actions that we have taken, including the reduction of of our headcount and adjusting some of the costs to better adjust to the top line and take it into consideration and that conservatism on the guidance.

We're trying to do everything right and be active in addressing that and making sure that we uncover every stone to identify how to address this going forward. And that was the thought process following the Q3 OPS for [indiscernible]

Our next question is from Brian Essex from Goldman Sachs.

It's Brian from JPMorgan. I guess maybe alky for you, or maybe, Guy, if you want to pick this one up. On the SaaS business, it sounds like that business is still very healthy and kind of as expected. Can you give us a sense of where you think ARR could shake out for the end of the year?

I think if we use like your previous 82% guide that puts us in the neighborhood of, I don't know, $615 million at the midpoint, somewhere in that neighborhood. But just a sense of the. What do you expect on the SaaS side? And then as a follow-up, contribution from next in [indiscernible] what you expect that could contribute for the rest of the year?

So I think when we talked about growing 20-plus percent, we feel very confident with our ability to grow 20-plus percent on the SaaS business. Obviously, kind of the behavior of the on-prem subscription renewals was a surprise to us, and we're trying to address that.

But when I look at the SaaS business, it's acting very strong very healthy, both in the value that we provide to our customers, then in our ability to go back to those customers and sell them additional licenses and additional platforms. So obviously, there is that headwind from the on-prem subscription business.

But I would say that when we look at our -- we plan to end the year with 83% of our total ARR coming from SaaS. And the fact that, that business is performing really well, gives us the confidence that we can continue to grow 20-plus percent on that business. That's part of the reason that we announced the end of life being at the end of next year.

We want to have this on-prem subscription business in a confined time frame to be able to be 100% SaaS and show all the benefits that the platform has to our customers and all the leverage and financial benefits that it can generate for the company.

Regarding FlashNext, we believe that it's a very good acquisition for us and the natural extension for our customers. So today, most of -- a lot of these attacks, the way that they are happening, the sophisticated social engineering from a trusted source, this supply chain attack. And they have lanes an unbelievable detection engine for that and has a very, very strong multiplier with our MDR service and we just started to introduce it and the reaction is very good.

And regarding the database activity monitoring, the 2 incumbents that we can replace, People want to consolidate our 1 data security platform for security, compliance and AI usage and serial proxy works extremely well and everything that we are building around it. So we just feel that these are 2 very strong additions for our platform and work very well and organically within our sales motion.

Our next question comes from Rudy Kessinger from D.A. Davidson.

It's kind of been asked. But I'm just curious, the end of life are self-hosted by the end of next year. And you just had lower renewal rates than you were expecting in Q3. I mean do you feel at all that this push to migrate to SaaS, is it, in any way, alienating a certain portion of your customers who are just never going to move to SaaS.

If so, I guess, why do that? I imagine some of those customers might be very large strategic customers who could have very high lifetime value, why not let them have a longer time frame to migrate to SaaS or remain on term license if they want to

So we wanted to move everybody to SaaS as we said and get rid of the OPS. We always say that it's 10% of the effort and order of money to 10x more value. Just as a business to operate everything that we are doing with engineering, and the value that customers are getting integration of all our products, the way that we provide support.

You need the right platform, then you need the right business model and the right operating model and on alone, the whole thought process was to move to 100% SaaS business, and we just want to also make sure that we are accelerating it because we also believe that in terms of the attention because this is one of the most important ingredient of our sales people.

We wanted their attention will be on getting value to customers, selling more [indiscernible] cloud that is doing very, very well this year, selling the product with database activity monitoring, and we are doing so many more. And we just want this low-touch support model and MDR and provide all the automations and the whole operating and business model of the company and also the value proposition is yield to as us.

Add to that, just when you go back to our Investor Day that we held in Q1 of 2023, we defined a transition to be complete when we get anywhere between 70% to 90% of our ARR coming from SaaS. This is actually the first quarter that we are above that 70% threshold finishing at 76%. And if you go back to conversations that we've had, we always said that we don't want to maintain 2 types of code, that there are a ton of financial benefits for the organization to be only under SaaS.

And as Yaki mentioned, there's obviously a tremendous difference in value provided to customers that are SaaS versus customers that are on the on-prem subscription. So if you look at the benefits of the customers and if you look at the financial benefits for the organization, we don't want to be stuck between the on-prem subscription business and the SaaS business, SaaS business is performing really well.

And obviously, on-prem subscription renewals acting the way they did in Q3. So that's -- we would have announced the end of life -- that was our plan all along. But obviously, with what we see in Q3, we kind of expedited that announcement, but really talking about December -- end of December of next year, and we will work with our customers to make sure that they can move to SaaS and benefit from it.

But as we mentioned all along, we didn't want to maintain 2 types of code, and there are significant financial benefits for the organization. Not maintaining those 2 types of on-prem and SaaS and being just on sale.

So the ability of Salesforce to do effective account management to take care of our customers in the right way. The whole company now the lion share is a SaaS business year to also.

Our next question is from Roger Boyd with UBS.

Just to go back to Josh's question for a minute to just to be clear, was there any change to how you're approaching renewals on maintenance and term license in the quarter? Relative to the second quarter or last year and whether that maybe led to some of this unpredictability.

I guess the context is we had heard some anecdotes that you were maybe more heavily encouraging on-prem customers to move to SaaS or in some cases, living in the ability for customers to renew on maintenance. And just wondering if that at all was informed by this planned end-of-life on-prem business.

So again, going back to kind of the reasons for the lower renewal rate of the on-prem subscription, we just saw multiple factors. I don't think there was any one big theme that we can pinpoint to the reason of the on-prem subscription renewals behaving the way they were, especially when you look at the Q1 and Q2 renewal rates where the -- when you look at the renewal rate of the company going up in Q1 and Q2, we definitely didn't expect that the Q3 renewals of the on-prem subscription would behave that way.

I think that when you go back -- if you go back historically, our sales force has been trying to convert our customers in discussions with our customers for -- since we announced the transition. We were able to move as quickly as we have because our reps were discussing this with customers. We obviously believe that the benefit of having SaaS and MDR has much greater value for our customers than being on the on-prem subscription and then having those customers manage the platform themselves.

So I obviously, I don't know what you heard, but our sales team has been working with customers and we'll continue to work with our customers to make sure that they get the best platform that we have to offer, which is the SaaS plus the MDR and all the functionalities that we have under SaaS that we don't have with the on-prem subscription.

I think that as we look at the results in Q3, we see a very healthy business under the SaaS platform. And obviously, the on-prem subscription acted in a way that surprised us which is part of the reason that we want to be 100% SaaS by the end of next year. So this -- I don't see this as something that is different in Q3 compared to Q2.

I think there were multiple factors that contributed to kind of the lower renewal rate of the on-prem subscription. We talked about the sales process issues we talked about additional budgetary scrutiny, obviously, we talked about the federal underperformance. But as I said before, there was one thing that was clear to us, and that was that we didn't see a change in the competitive win rates and we're still in discussions with some of those customers that didn't renew.

So we think we might be able to get some of them back. We're in discussions with them. But obviously, from a guidance perspective, we're assuming a more conservative guidance for Q4 because of the rates that we saw in Q3.

Our next question comes from Jason Ader with William Blair.

If customers are not renewing their on-prem subscriptions with Varonis and not going to your SaaS then what are they doing? Because obviously, you wouldn't think they'd want to be exposed if they've had Varonis data protection and all of a sudden, they don't have access to the technology anymore.

So maybe just talk us through that, like what are they doing? And then separately, is term -- is there an element of compression and term contract duration at all because we saw that with another software company this morning where they saw some compression in term duration.

So let me address the first question, and then I'll [indiscernible] the second one. When we look at those on-prem subscription renewals, most of them didn't go anywhere. And as I said before, we're in discussions with some of them. For many of these customers, they were single threaded, meaning they were only protecting on-prem data with a single use case, and they weren't using the full platform that we have with our SaaS offering. Historically, we converted these customers without many challenges.

But in Q3, we encountered some of these issues and really can't really tell if it was a one-off or a new trend and that's part of the reason that we want to see how Q4 behaves in order to get more color on kind of the rest of the non-SaaS business. In terms of the duration, that wasn't an impact here.

We looked at that and analyzed that, and it didn't have an impact.

Our next question is from Mike Cikos from Needham & Co.

Mike Cikos here. I'm trying to get a sense if there was anything unusual about this OPS renewal cohort in the final weeks of the third quarter. And really, what I'm trying to get at is I'm wondering if the renewal rates was really tied to a smaller subset of customers, i.e., the breadth of customers really skewed to the renewal rates that we're talking to.

And does that in any way help explain why the team is uncertain on the impact of these renewal rates, maybe just because we don't have enough observed data points. And then, I guess, secondly, have the OPS renewal rates that we saw on those final weeks of Q3? Have they persisted in the 4Q now that we have October, essentially behind us? I'm just trying to get a sense of what's transpired in the following 4 weeks.

So let me touch on the second part of the question. And I think I -- my understanding is -- are we seeing any trends in Q4 on the renewal rate, I think it's important to note, and we've disclosed this in our SEC filings, our business is back in low -- and we've closed a significant portion of our business in the last 3 weeks of the quarter.

It's very hard to see how the renewal rate will behave in Q4 when you own the data points that we have sitting here today. And if you go back to the business was tracking on plan, but really it was only in the final 2 weeks of the quarter that we experienced a decline in our renewal rate for the on-prem subscription business which related really to both the federal and nonfederal sectors. So it's very hard for us to bake in any assumptions.

And from a guidance perspective, we have never baked in positivity before we see it come to fruition. We always assume either the trend continues or gets worse, which is what we did in this case of the guidance. In our Q4 guidance, we assume lower renewal rates that would take into consideration not just what we saw in Q3, but some of the impact of the announcement of end-of-life for our on-prem subscription business.

So that was the thought process there when we looked at the Q4 numbers. And obviously, as we see the results at the end of the quarter, we'll give additional color from all the analysis that we'll see and kind of look at 2026 with the lens of Q3 and Q4 and not just based on Q3 is one data point.

There's no one thing. There is no one plan, but in some cases, definitely, there are account basic account management problems that customers use the small subset of the platform. And our reps assumed like in other situation, they automatically will move into SAP or the full [indiscernible] complete.

They had some positive discussions, but because of the limited use serve and some builds to campaign applies all over to make sure that we are getting some control over the situation.

Our next question comes from Erik Suppiger from B. Riley Securities.

Yes. Just can you remind us what your contribution from said was and maybe with the contribution from the on-premise Fed business because I think all the Fed is probably on-premis. And then you've specifically identified both your Fed on-prem and the non Fed on-prem.

Was there a difference in terms of the decline in renewal rates between those 2 categories? Or were they both down similarly.

So federal business has always been around 5% of our total ARR. And when we look from a guidance perspective going into Q3, we basically assumed a flat contribution going to the quarter, but we actually had a headwind related to the federal business that was really coming from the renewals in the federal business and we had several million dollars of a headwind coming from the federal business, which is kind of why we're making the adjustments to the team.

But when you look at the renewals, there were actually -- the renewal rate decline was both on the federal side and also on the nonfederal side. which is the reason that we're reducing our Q4 numbers. If it was only the federal, I don't think we would have adjusted the full year guidance the way we did.

Our next question comes from Shrenik Kothari with Robert W. Baird.

So now that the conversion phase is largely complete, right, for your initial target for the mix and with the end of life. And in light of your prior confidence in sustaining 20% top line growth, if you can really help kind of triangulate what the underlying growth cadence looks like going forward in your view now with the conversion out of the picture.

Just from that $545 million SaaS ARR core, like how much of that is considered sort of early stage with significant room for upsell, cross-sell next year and after via, of course, usage and modular attach and versus how much is already more mature with product adoption, such as MDR and stuff like it? I just wanted to understand how to think about underlying growth cadence into next year and ahead.

So again, it goes back to the tale of the 2 companies. And when you look at the SaaS business, we definitely see that business acting strong. We believe in our ability to grow 20-plus percent with our SaaS business really due to the momentum we're seeing with new customers and the strong NRR we see with our existing SaaS customers.

I think that -- when you look at how we plan to exit the year and we raised our expectations on the SaaS mix coming out of total ARR going from 82% to 83% I think we are kind of -- the strength of the business is very apparent to us under the SaaS ARR so we feel very confident in our ability to continue to grow going forward.

We're addressing the issues we're addressing the issue that relates to the on-prem subscription renewals we're taking kind of the necessary measures there. But it really is -- the on-prem subscription renewals are really masking the strength of our SaaS business.

Our next question comes from Junaid Siddiqui from Truist Securities.

As you expand your platform to coverage in use cases like SaaS and cloud infrastructure, just curious, where is the source of that incremental budget that you are taking coming from? Are you seeing like a budget reallocation from existing security categories? Or is this tapping into net new spend from customers?

Well, we definitely see that customers have more about to data security, cities, important for them, and this is how we sell.

Ladies and gentlemen, this now concludes our question-and-answer session and does conclude today's teleconference as well. Thank you for your participation. You may disconnect your lines, and have a wonderful day. Goodbye.

Research team here at Citi and very excited to host you all on day 1 of the Citi TMT Conference, and I am very excited to have Varonis on stage with me. To my left, CFO, COO Guy Melamed and to his left, David Gibson.

Guy, I want to start the conversation at the highest level. This year has been very interesting from the standpoint of macro gyrations, right? So at the macro level, you had those dynamics playing out. And then internally, you've had several compounding layers of changes take effect for the business. So I'm wondering if we can set the stage with sort of what have you been experiencing in the macro, how the business has reacted? And then just from a micro perspective, some of the sales organizational and incentive dynamics that have evolved, the SaaS transition, which we will certainly get into. Would love to kind of start there and bifurcate the conversation between macro dynamics and micro dynamics.

So first of all, good to be here. There's a lot to digest in that question, and I'll try and cover at a high level as much as possible, and we can dig in further with anything not covered.

I think when you look at where we are today, the fact that we have moved to SaaS or really at the late stages of the transition, we should be done at the end of this year, 2 years earlier than initially planned is a testament of the technology and the offering and the evolving market. When we look at kind of the landscape from a risk perspective and what customers need to face, their biggest challenge is that the hackers and the sophistication of hackers and even the inside threat, the amount of employees within the organization that try and take data and give it to competition is increasing by the day. And with that level of sophistication, our SaaS offering and the MDDR offering that we can talk more about has really changed the game for those customers. They no longer need to operate the software and need to make sure that they're taking care of that risk. We're helping them mitigate that risk. A lot of kind of the MDDR is covered by AI. 80% of the alerts are covered in an automated way, and we have those technical personnel that overlook and make sure that anything that looks strange or abnormal, we can then notify the customer and let them know that they need to look into it further with us, obviously, we help them do that as well.

So I think when you look at kind of the environment, the SaaS and the MDDR has been a significant change in our favor. And I'd say that Copilot and AI in general has been kind of the second item that is really kind of changing the landscape. And when you look at AI today and the fact that Microsoft is trying to push Copilot and all of the other big companies are pushing kind of the AI. I think AI, that train in a sense of -- it will change the world. We don't know when that point will kind of take off, but there's definitely that focus, employees are asking for it more. And what is happening for organizations is that they realize how vulnerable they are if they don't take care of their data before they roll it out.

We've received frantic phone calls from customers that rolled out Copilot and realized that employees went into the chat box and wrote who got a salary increase in 2024 and got that information within seconds. Because now if you didn't take care of who has access to what type of information, AI doesn't know to distinguish between what's sensitive, what isn't sensitive, what you should be having access to and what you shouldn't. It gives you whatever you're exposed to. And if you don't take care of it, you'll have those catastrophical moments.

So I wouldn't say that AI or Copilot has been fully adopted. I think many of us from conversations with customers, either it's rolled out on a subsidiary or a small group, but there's way more conversations on starting to roll it out to the entire organization.

We can talk about the partnership with Microsoft that has warmed up significantly where we signed an agreement. There's a press release that came out July 3 that talks about kind of the intention of a go-to-market together and building maybe technological capabilities that would cater to customers.

So I think when you look at where we stand today, there's a lot of interesting things. We can talk about the acquisition that was announced yesterday. We can dig into that. There's a lot of things that we're very excited about.

And I think just to recap from Q2, what are some of the key messages that you want to really emphasize and how you're thinking about the remainder of the year and naturally in the context of some of the things you talked about, right, SaaS and MDDR and the transition coming to its full fruition by the end of the year. So some of the more tactical elements and more memorable highlights from Q2.

So to kind of tie to your first question, the part that I didn't answer on the macro, I think when we look at the macro, we've seen kind of macro be very steady. What is actually working in our favor is that the sales cycles for SaaS are shorter than the sales cycles for the on-prem subscription. So there's still that deal scrutiny. There's additional requirements to put pen to paper. But I think with the SaaS offering and with kind of the savings that we can offer our customers with the move to SaaS, where they don't need to manage the hardware and where they can reduce their headcount with the MDDR offering, that has really helped. So it's very fitting to this environment really.

And when I look at how Q2 ended and kind of the continuation of what we see for the rest of the year, it was a very strong quarter from a new customer perspective, from an existing customer perspective. We -- when we look at all the metrics, we're seeing that the customer lifetime value is increasing with our SaaS offering. We're seeing that customers -- our SaaS customers are talking about what they would buy in addition to their initial first purchase. So we talked about NRR of our SaaS offering continuing to be much better than the reported NRR that we disclosed at the end of 2024.

So I think when we look at Q2, it was very much a continuation of Q1. We're set up for a healthy Q2 -- for a healthy H2, sorry. And I think that when we look at what we have to offer, with the Cyral acquisition and with the additional offerings, once you get customers to SaaS and you've kind of taken care of that red tape bureaucratical challenge of just moving them to a SaaS agreement and going through the SaaS checklist and taking care of all of that stuff, which I think we're doing much better in 2025 compared to what we have done in 2024. I think when you look at all of those elements, we're very excited for the second part of the year.

And can you give us a reminder on -- just from a metrics perspective, how much of the base is now full-fledged on Varonis SaaS? How much more of a transition effort remains? And we're all familiar with the notion that, hey, the sales team has been very hard at work and their time has been very occupied in porting and forklifting customers over to the SaaS. And there's all these behind the scenes legal and procurement things that us as investors don't necessarily see that can gum up the machine, if you will, for transition, right? So can you give us a sense of sort of numerically and quantitatively as best you can, where we are on the entire installed base having moved and what might be some sort of the remaining hurdles or...

So at the end of Q2, we increased the SaaS mix guidance to 82%. So we expect to finish the year with an 82% SaaS mix, again, within 3 years, moving very, very quickly.

The one thing that's important to note is that Q4 has always been the largest quarter for us where the largest amount of renewals are in play, and that's obviously one of the lessons we have learned from last year is that we're having conversations with those customers that are up for renewal in Q4. We started those conversations in Q1 earlier than usual in terms of the benefits of SaaS, why it's a much better product. The reception that we're getting is very, very good. Customers are excited to move to SaaS. So I think throughout there's still a lot of the base that we need to convert.

But from a commission perspective, this is the year of transition as we kind of exit the year with an 82% SaaS mix, which is the guidance or if we can do better than that, that doesn't leave a lot of customers to convert. The one element that is actually worth talking about is that a lot of the ones that haven't converted are state and government. And we received our FedRAMP certification in the last couple of weeks, which is -- it was a lot of effort to get it a lot of -- it was a big investment, both from a monetary perspective and from a time perspective, but it was definitely worth it from our perspective because now we can go to our state and government customers and show them that they can move to SaaS with that FedRAMP certification.

So I think that probably kicks in -- I'm not sure it kicks in this quarter. I think it probably was a bit late in the cycle. We're still trying and we're still working on that. But if I look at kind of the ability to convert those customers to SaaS, I think that will be part of what we focus on next year. But if I look at the enterprise business, we're very much in conversations with the one that haven't converted. And I think that it's extremely we've been extremely focused on kind of moving as quickly as we can and the reception of our customers has been great.

So learning lessons for the sales team from last year was, hey, don't wait until Q4 to talk about conversions in Q4. Sales team is talking about conversions in Q1 when your renewal pipeline is the chubbiest in Q4, all the T's have been crossed, all the I's have been dotted. Just from that standpoint, with the sales team having the reps on really evangelizing and educating the customer much, much earlier on, on the benefits of the transition.

The flip side of that, that naturally opens up there -- that naturally opens up their time to actually generate new pipe and build new pipeline, right? I'm wondering if you can shed a little bit of light on or comment on how new pipeline generation has trended over the course of this year after having learned what we learned last year that, hey, sales team is having to take a lot of cycles to talk about conversion. So they're not actually going out prospecting or they don't have the bandwidth to go out to prospect. So just new deal, new logo, net new business pipeline generation activity.

I think probably one of the biggest challenges for investors to understand was how the conversion is cannibalizing the time of our sales force. I know that when we sit here and when we talk about conversions and the adoption, it wasn't a challenge from a technological perspective. Switching customers to SaaS, the way the technology has been built, taking all the experience that we've had over the last 20 years and kind of implementing it into the SaaS platform has made the platform efficient, easy to use. We can see it in the leverage. We can see it in the free cash flow. All the metrics that are hit have actually done better than what we initially expected. But the time to get a customer to start a conversation about a new contract and start doing SaaS checklists and making sure that from a security perspective, everything is in place, that was taking way more time than just getting a PO for a renewal.

So when we thought about where should we put our focus on, we wanted to make sure that we don't kind of stay in that limbo stage for too much longer. We have seen new customers over the last, I'd say, 2 years work really, really well. We see not only an increase in the ASP, we also see an increase in the number of new customers that we can acquire. I think one point to note is that the move to SaaS actually increased our TAM, 3x. The offering, our ability to not only sell it in different markets, but sell it to customers that probably wouldn't buy under the on-prem subscription offering. The ease of use of it has really increased our opportunity dramatically. And now when you go to a customer and you talk about the MDDR offering, basically telling the customer, this is the platform, we have a team that manages any abnormal behavior, and we can help you with that is a completely different conversation than selling you the software and kind of letting you deal with it yourself.

So I think with the move to SaaS and with the MDDR offering and the MDDR offering has only been in place since the beginning of 2024. I know a lot of people kind of think that it's always been there, but it's been by far the fastest adopted platform Varonis has ever had, and there's no close second really when you think about how it's been adopted.

So I think when you look at all of those offerings, our ability to sell to new customers has increased significantly with the SaaS and MDDR compared to what we had in the past. We see it in the numbers. We see it in the trends. When we get customers over, we can now go back to the base and start upselling them in the same manner, in the same way we have done when we had on-prem subscription.

So the setup for us of continuing to sell to new customers in the same way and getting to our existing customers with all the trends that we're seeing where we can continue to upsell to them is part of the reason we want to move as quickly as we can on the SaaS offering conversions and not get stuck in that transition. So that's really the set.

And just as a point of clarification and even a reminder for us, MDDR has been deployed as a carrot to get customers over to SaaS, right, as opposed to independently and individually monetizing MDDR. It is a powerhouse offering in and of itself, but it just makes the whole SaaS platform usage sing, right? Where is kind of the philosophy on that? I know there's been some evolution there, right? How should we think about the direct -- to ask it more simply, how should we think about the direct monetization of MDDR because it is such an important layer on top of the SaaS platform usage?

I am not sure the phrasing you used is the exact accurate way I would use. It's definitely used as a carrot, but we are able to monetize on the MDDR offering. It just really depends how you count the dollars, whether -- if I give you the MDDR, but you're buying a more comprehensive platform, you're paying more dollars, the ASPs are going up. But on the MDDR, there's no specific SKU associated with that.

So it's really hard to distinguish what exactly is driving the increase in spend, honestly, as long as we can provide our customers the right service, they're happy and they're increasing their spend. It doesn't really matter what it's associated with. And we are seeing our existing customers spending more with us, buying additional platforms, getting the MDDR. And the way we have structured the MDDR is that if you buy the larger platform, you get the MDDR at a reduced price. If you want to buy MDDR as a stand-alone, you'd pay a much higher price.

The way we set it up was really to cater our customers to buy the more comprehensive platform. It helps us with the way we structure the alerts and make sure that we have a much larger view as to what's happening in their environment. And we're happy to see that that's actually the path that most of the customers have taken.

And just to kind of continue on this thread. So clearly, still a good chunk of the base needs to be moved over, but let's talk about the installed base that actually has graduated and migrated over to the promise of SaaS, right? Can you talk about some of the buying behavior and more specifically, just to put some numbers and sort of model-related context around it, as we sit here, what should be the driving forces for SaaS net retention rate expansion and overall SaaS ARR growth acceleration?

Is it, hey, SaaS customers are buying more product to secure data sprawl and data classification pain points for existing workloads? Or are you enjoying or are these customers now so much more easily able to jump to completely new solutions to tackle completely new environments. So between more of the same versus more new capabilities being added, what are going to be the most sensitive drivers to SaaS NRR growth and SaaS ARR expansion?

So maybe I'll talk about the numbers, and David can give some color because he's talking to so many of the customers and what their journey is. When we look at our total NRR, and we talked about the reported number for 2024 was $105 million. I think part of the reason that, that number has come down is because of the time it takes to convert and the fact that it was really cannibalizing the time of our reps. When we look at the SaaS NRR, not taking into consideration any of the uplifts that relate to the conversions, but just customers that were on SaaS at the end of 2023, what they bought throughout 2024, we see that the SaaS NRR is significantly higher than the reported $105 million. And that gives us the confidence.

When you look at kind of the ARR growth, we've talked a lot about our desire and focus on getting back to that 20-plus percent growth rate. We're at 19% ARR growth right now. If we can continue selling to new customers the way we have over the last year or 2, and I think there's no reason we couldn't when we look at the opportunity, and we look at the SaaS NRR being significantly higher than that $105 million, when you -- in simple math terms, that really helps us get there.

So from a numbers perspective, we feel very good about kind of the desire to go back to that 20-plus percent. And the trends of the SaaS NRR being significantly higher than the reported one gives us the confidence to get there.

Yes. From my perspective, my experience with our SaaS customers is they are delighted. And we have kind of a routine. Here are the data stores that we're protecting for you. Here are the things that we found and fixed because there's so much automated remediation built into the platform. And here are the threats that we've detected and stopped for you without you having to do anything but take a phone call from us. We know -- we've been talking to you, we know you have data over here. We know you have data over here. So being able to expand the coverage there is a big opportunity, and we're doing this regularly and routinely.

Now in addition to that, I'm usually reviewing our customers -- reviewing our road map, some of the short-term road map that's coming up, like some of the things that we've now announced like the database activity monitoring. Now we've announced e-mail security. So there's so much eagerness for some of the functionality that we've added and that we continue to release. I feel like both the breadth and the depth and the functionality are big opportunities for us, and customers are really excited as am I about what we're offering and what value we're able to provide for them.

I think it's a good plug to maybe talk about the acquisition.

Acquisitions. Yes, fantastic. That's actually great to think alike. -- you'd historically been very selective on M&A. I think Polyrize was your first foray into doing M&A, and that was 5 years ago. And we've now seen 2 deals this year, right? So generally, M&A philosophy and thesis, how that mindset has shifted, right? And why come out guns blazing into e-mail security?

First of all, I think we're still very selective. This was -- this acquisition was a long time in the making, and it was done after a lot of testing of that technology and comparing it to the other options that are out there from a technological perspective. And if you want to touch maybe on kind of the logic and...

Yes. We've talked a lot about our MDDR, our Managed Data Detection and Response. And what we've found, and I think there are some stats, the vast majority of breaches, I think at least over 60% start with a compromised identity and about 90% involve a compromised identity at some point. And we've seen that the way that identities are often compromised is phishing, e-mail compromise.

And so we see -- with our current MDDR offering, we see and stop what happens after people get phished every day. And so -- and we're able to detect, we're seeing what they do. They have usually a pretty familiar playbook to us by now and our threat models fire, and we're able to contain the breach there. But we ask what could we do to stop the attack sooner. How could we actually stop the person from reacting to that phishing e-mail?

So as Guy said, we spent a long time testing the technologies out there and hands down SlashNext had the best detection rates for the phishing e-mails, not just the text space, but the images, a lot of people get phished with barcodes now. We also have a really interesting sandbox technology that they'll basically take a hyperlink and then detonate it, right, in a safe way.

And so really excited about the technology and the tuck-in there for us to make sure that we can stop those breaches sooner. And I just think it makes total sense because of our vantage point, which admittedly is, I think, unique, right? We see -- we have a front row seat to so many of these breaches so that we can see what we need to stop them sooner.

And if I can add in a technological way, but for -- in a non-technological knowledge, one of the things that we have noticed is that many times with that phishing attempt, AI is used, whether someone is impersonating someone else, you can now get a Docusign link to sign a document and you feel you know that person. But in essence, there's an attempt now to get your credentials. And once your credentials, they go after the data. Our MDDR offering with SlashNext is -- you have no idea how excited the MDDR team was with the announcement yesterday because they are seeing how much of those attempts start with phishing, and it gives kind of a full view to our customers on who's trying to get in, how is this happening and gives basically customers better protection.

And just -- I know it's very early. The ink was just dry yesterday. But how should we conceptualize the monetization path for SlashNext? Is this something that's going to be positioned akin to the way you're handling MDDR, right? Or is this going to get just baked into the rest of the portfolio? I mean, what are kind of the initial ideas or thought processes that are...

We will start selling SlashNext, and obviously, it would be kind of under the Varonis name as a separate SKU at first. I think later down the line, we'll get to a point where it's combined as part of the platform. But initially, we will start with offering it to existing customers that can now switch in a rip and replace, which is very straightforward, but also allows us to try with some new customers. And so we're going to cater to both.

I think one point to emphasize -- and we obviously put out updated guidance from the expense side. But from a free cash flow perspective, we kept our free cash flow in place where basically the SlashNext acquisition has approximately $15 million of headwind to our initial numbers when you look at the impact for the year. So I think that part of what we have done throughout the year with a strong balance sheet and with a strong -- really kind of improvement on the free cash flow side, we were able to reiterate the free cash flow numbers for the year. There's no real material impact on the top line from the SlashNext acquisitions. And obviously, we expect to roll it out pretty quickly, I'd say, within Q4, early Q1, that's kind of the time frame. This is not something that will take a year, 2, 3 years for us to try and monetize.

So it's definitely something that we want to roll out relatively quickly. We obviously need to see how this is adopted. We want to implement it into the Varonis platform. All of that is in the making. But the actual expense increase is not that significant where we took approximately 100 employees with the SlashNext acquisition. For the most part, they are based in the U.K. So we're extremely excited to welcome them to the Varonis family, and we're actually even more excited to see how this moves forward with the additional offering that we now have for our customers.

And I'm glad you brought this up just from an OpEx perspective. I think one of the things that stood out to me is the intention around reinvesting into the business, expanding the go-to-market organization, feet on the street, et cetera. So this whole notion of stepped-up investments. Again, what you are seeing is a healthy environment. So I want to get a better sense of in a priority sequence, what's given you the confidence to say, hey, yes, we don't want to sit on the sidelines. We want to step up to the plate here and reinvest, especially from a sales capacity and go-to-market standpoint.

I think when we analyze the market, we analyze the opportunity, we analyze the trends. We analyze the KPIs, what's healthy, where we are. And we have actually realized that there's a much bigger opportunity ahead of us, which gave us the confidence to put money to work.

But when you think about kind of the investments that we have made, we've shown leverage in, I would say, one of the biggest positive feedbacks we've got from investors is how happy they are with kind of the leverage and the ARR contribution margin increasing so significantly. Think about it that when we rolled out the SaaS transition, and we did the Investor Day in Q1 of 2023, we talked about a range of a 20% ARR contribution margin. We gave that range of 18% to 22%, 20% roughly. We're on the run rate of 17%. So 2 years ahead of schedule with the most significant investments of the SaaS move.

So during a SaaS transition, we were able to show significant improvement on the free cash flow, which I think is a clear testament as to how the technology was built in such an efficient way. And I think that we wanted to put money to work both on the R&D side, both on the sales and marketing side to increase our foot on the ground, but also come up with additional platforms that we can cover, go wider and deeper. That's really kind of the way we're thinking about it.

When you think about the SlashNext acquisition, this is not like going from swimming to cycling. This is kind of being in the same lane, just helping our customers be better protected. So I don't think this is moving away from our core desire to protect data wherever it is. This is really kind of the framework that we've put in front of us. And I think when you look at kind of the healthy balance sheet, the healthy improvement on margins, the way we put money to work, we don't want to miss the larger opportunity.

So we want to make sure that we can continue to grow post that $1 billion mark in healthy levels, and that's why we're making some of those investments. But I think that overall, we're able to combine top line improvement, bringing some of it to the bottom line, generating significantly more free cash flow and kind of trying to hit on all of those cylinders in a prudent way.

I'm going to ask you a tough question on the devil's advocate side. So clearly, the market environment is hot. I like to say that you guys were thinking about data security before it was cool, right? So the time is now. There is a lot of market validation for numerous reasons why this is such a pernicious problem. But to your point about investments and the confidence in reinvesting in the business because the signals are so attractive, well, the competition isn't taking a sleep either, right?

So from the standpoint of what's happening in the competitive backdrop between someone like a Zscaler last night that's talking about a $400 million data security franchise within the confines of their platform. How should we think about some of those competitive dynamics that have changed and have evolved to ultimately not -- to make sure that your reinvestments in the business are protected and are not eroded away by some of this rising competitive dynamic. And I would love to hear what customers are saying to you because it seems like everybody has a data security story now, right? So how are customers navigating the FUD on that?

Yes, you're absolutely right. There's been more activity than I've ever seen around data security. And I think we're in a really powerful position because of how long we've been protecting data and how much we've learned about how to do it right, do it at scale and do it continuously.

When we look at our approach and how we're able to identify what's important, identify where it's at risk, and then monitor how it's being used and most importantly, get people to real outcomes, fix the risks automatically, monitor the heck out of it and stop threats wherever sensitive data is stored, make sure you can use AI safely, make sure that you can avoid getting fish or the insider threat or ransomware or all these serious attacks and also be compliant -- I think I'm just being mindful of the time. We have a huge river between us and anybody that's coming behind us.

Anything to add, Guy?

When we go to a customer, we want to make sure that they don't get any fines because of sensitive file that's open to everyone in the company. We want to make sure that they can roll out AI if they desire. And I don't think that's going to be a question in 2, 3 years. If companies don't implement AI, whatever form it is, they're not going to have employees. They're going to move to competition. So I think that train is definitely at our focus. And we want to make sure that you don't get breached.

When you think about giving -- and I'll do it very quick, when you give customers the ability to know not only how many files are open to everyone in the company, but what's sensitive and what isn't, who's touching what and not just showing them that they have a problem, but helping them fix the problem, that's the biggest differentiator. We don't show you how exposed you are. We help you fix it.

My last one for you, 20% plus ARR growth. when we think about weighting factors like the number of protected workloads, the upselling motion, the new logo adds, how would you sequence those in terms of the most consequential impact to the path in exceeding 20% growth and hitting and breaching the $1 billion ARR milestone.

When I look at the tailwinds that we have, and we have many new customers, our investments in some of the territories that we haven't had significant presence. We didn't even talk about that. We're making some significant investments in Australia and India and Japan and Singapore, and all of that takes time, but definitely something that we're putting money to work. And we look at the additional platforms that we have, there are so many things that are working in our favor. We see the opportunity in a way that we have never seen it before. We know we need to execute on it. We understand the responsibility. We're working hard in order to achieve it. And I think that we'll obviously give updates throughout the journey, but we're very excited in where we are right now.

Well, we're watching and we're tuning in. So a great place to put a pin in our conversation. Thank you so much. Always a good discussion with you. Thank you.

Thank you.

Greetings, and welcome to the Varonis Systems Second Quarter 2025 Earnings Conference Call.

[Operator Instructions]

As a reminder, this conference is being recorded. It is now my pleasure to introduce Tim Perz, Investor Relations. Please go ahead.

Thank you, operator. Good afternoon. Thank you for joining us today to review Varonis' second quarter financial results. With me on the call today are Yakov Faitelson, Chief Executive Officer; and Guy Melamed, Chief Financial Officer and Chief Operating Officer of Varonis. After preliminary remarks, we will open the call to a question-and-answer session.

During this call, we may make statements related to our business that would be considered forward-looking statements under federal securities laws, including projections of future operating results for our third quarter and full year ending December 31, 2025. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned forward-looking statements, and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date.

Varonis expressly disclaims any obligation or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation to the most directly comparable GAAP financial measures is also available in our second quarter 2025 earnings press release and our investor presentation which can be found at varonis.com in the Investor Relations section.

Lastly, please note that our webcast of today's call is available on our website in the Investor Relations section.

With that, I'd like to turn the call over to our Chief Executive Officer, Yakov Faitelson. Yaki?

Thanks, Tim, and good afternoon, everyone. We appreciate you joining us to review our second quarter results and the progress of our SaaS transition. Our Q2 performance reflects our continued strong ARR growth and cash flow generation as we accelerate towards the completion of our SaaS transitions and making investments to capture our growing market opportunity. Today, I want to remind you of what set Varonis apart as the leader in data security.

In today's ever changing environment, 1 thing remains constant. Data will continue to be created in shared and usage of AI has only accelerated this trend. At the same time, attackers do not break in, they log in, and they need to secure data and the challenges involved a greater than ever. Varonis takes a data-first approach and help companies to locate their sensitive data, visualize who has access to it automatically lock it down and then automatically detect and respond to threaten it. Performing only 1 or 2 of the stack is insufficient to protect data and what sets Varonis apart is our ability to successfully do all 3 of these tasks on data everywhere.

In the second quarter, this approach contributed to an ARR growth of 19% to $693.2 million as we advance toward completing our SaaS transition with SaaS ARR now representing about 69% of total ARR. Year-to-date, we generated $82.7 million of free cash flow, up from $67.3 million to the same point last year. I will review our results and our updated guidance in more detail shortly.

We continue to experience strong demand to our SaaS platform for both new and existing customers, primarily due to the superior experience that Varonis SaaS and MDDR offers by enabling automatic data security with minimal effort. Additionally, and also proud to announce that we achieved the FedRAMP Authorization, enabling us to offer our entire SaaS platforms to the federal sector. Demand from both new and existing customers looking to protect cloud environments with Varonis continue to positively inflect and is becoming a material contributor to our business. This is driven by the investments we have made in our platform to expand our use cases, going wider and deeper and entering new markets, including DSPM, our ability to protect cloud data represents a significant untapped growth opportunity for us and transitioning our customers to our SaaS delivery model is helping us unlock this market potential.

Data security market is rapidly expanding because of many factors, including AI usage, the proliferation of data and evolving compliance. As a result, data security markets like DSPM are receiving new investments and focus, which is creating more budgeted line items and increasing our opportunity. Looking at the DSPM market, Further, we see usually focused on discovery and classification in cloud databases because it has the lowest barrier to entry, and they don't address more challenging problems, like securing the data by automatically fixing risks and detecting spreads or scaling to analyze large unstructured data sets.

With that as a vector, it's important to note that seeing a problem does not solve a problem. The scatter in classification may find sensitive data like they do not secure it. This generates potential exposure without providing a solution. Varonis has made significant investments to expand our coverage wider to both find and secure the data everywhere at least, by providing more complete and up-to-date visibility than typical DSPM technologies. As a result, customers are consolidating their data security budgets with Varonis. I would like to dive deeper into why we win in competitive deals within the DSPM space.

Our edge lives in the breadth and depth of our platform. following 3-step approach for define fixed sellers, all 3 critical components are needed to secure data, while DSPM point tools focus on discovering sensitive data Varonis is the only data security vendor that does is more, not just finding sensitive data but also finding where it is unprotected, fixing the risks, but locking down sensitive data automatically and continuously monitoring and alerting on unusual data activity.

I will talk about the first step, fine. The 1 is not only cater and classify all of our customers' data, but also mark all the controls that you lock it down, analyzing permissions, identities, entitlements, masking and labeling, which creates a complete point inventory of choice. We know exactly what sensitive data leaves how it is exposed, who is access and how that access was granted. We also watch data usage, tracking every time user accesses modified or delete data. To use a simple example, Varonis watches in the [ bank world ], compiling an inventory of everything inside every person that can access the vault including everything they touch and can access inside while logging all activity in and around the world.

And all this happened without impacting the customers' experience.

Now I will talk about step 2 -- the holy grade of security is ensuring identities have access to the right data, and this is very hard to do because you need all the right ingredients which we provide. Boys understand how data is being used and where it is unnecessary exposed because we watch all data activity and connect identities to data or policies developed through extensive experience with thousands of large customers are designed to intelligently and automatically mitigate risks such as access to data that identities should not have or no longer need.

To continue example because Varonis knows who can access the vault, what the role is and what they do regularly access we can remove unneeded access to -- access from a former intel that works at a competitor or a bank employee that has moved to another branch, but still have the keys to the vault.

Finally, let's talk about step 3, which is a [indiscernible]. Since Varonis see every touch of data, we can baseline user behavior and detect threats or abnormal behavior in real time. because we watch data directly, we generate alerts with very little loans. This enables our MDDR team, which is powered by AI to efficiently watch customer data and investigate, validate and prevent breaches with a 30-minute SLA on ransomware and without customer effort.

To wrap up our example, Varonis watches the vault and can sound an alarm when reception is tried to access it after hours or when a bank manager start going in and out of the vault more often than normal and with more cash. I would like to contrast our approach to what we see from DSPM providers. Starting with step 1, the first key difference is that most DSPM providers schedule scans and new sampling as opposed to viewing all the data to discover and classify sensitive data because they cannot do it any other way. They do not track data activity so they don't know when data is added or changed. So the information is immediately stable and they lack the scalability to view everything.

Sampling allows them to scan quickly, but this also means that significant amount of potential exposed data is never found and they cannot deliver full picture of risk or compliance. And because scans schedule, their picture is always out of date. As a result of these shortcomings, they try to avoid risk assessment, would you be willing to store your money at the bank that does not have security camera and try to protect it using a lease that only includes 10% of its inventory and is only received on 5 days at 5:00 p.m. Moving to step 2, because DSPM providers don't map or track access to sensitive data, there is no viable safe way to fix risks that they find.

As a result, these providers just generate service tickets, leaving overall security teams to manually address them. We hear from prospects that this approach leads to time consuming busy work and often time, followed by a data breach. Finishing with step 3, DSMPointtools cannot detect threats to perform any meaningful forensics. In an event of the suspect of actual which because they don't track data usage, there is no activity in monitoring and no user behavior analytics.

Going back to our example using DSPMPoint tools, he like trying to understand how a bank was robbed and what was taken with no security cameras or footage, no record of who had access to the vault and outdated and incomplete record of what was in the vault. To wrap up, DSPM tools focus on discovery and classification mostly in the cloud. They are compliance, band aids and not security solutions. Varonis not only discover and classified data but also intelligently and automatically locks it down everywhere and watches it for threats.

Our approach results is vastly reduced risk and much lower likelihood for a data breach as compared to alternatives. Customers understand it in our ability to showcase these outcomes automatically at scale is why we are winning. Another key driver of our recent success has been the secular trend of AI usage. This quarter, we expanded our coverage to protect open AI ChatGPT enterprise. We are also excited to announce an update to our strategic partnership with Microsoft. This update is focused on joint feature development, which builds on our existing innovations to help organizations adapt Microsoft co-pilot security.

While deepening our integration with them together, we are addressing 1 of the most critical challenges, which is ensuring AI tools and LLM do not expose data by align our engineering efforts, we are accelerating our ability to drive secure AI adoption game.

With that, I would like to briefly discuss a couple of key customer wins from Q2. The first 1 I would like to talk about is a large health care organization of over 20,000 employees that was concerned about their ability to respond to ransomware and comply with SEC disclosure requirements for their AWS environment. They were evaluating Varonis against the DSPM point tools it became clear that only Varonis would meet their success criteria, our ability to cover petabyte scale cloud environment and provide customers with the tools to avoid breaches and find without effort, where capabilities this point solution could not match.

In contrast, the DSPM tools scanned a small sample of data that quickly became stale, and could not provide any meaningful outcomes as a result. This decision was an easy 1 to choose Varonis. We again saw strong demand from existing customers looking to convert to our SaaS platform. One example was a defense contractor with over 25,000 employees, their new SISO who was undergoing a digital transformation project needed to modernize the data security strategy. Their SISO stated the future of cybersecurity is data security and was quickly on board with Varonis SaaS at understanding the need for automated protection. This is also a key example of our Microsoft Better Together partnership since they will use Varonis to automate the their -- labeling program and automatically reduce exposed data and proactively stop fits. They purchased Varonis SaaS with MDDR for hybrid environments co-pilot and Agile. In summary, we are excited by the many tailwinds we are seeing in our business.

The simplicity and automated outcomes of our SaaS platform, the adoption of AI and growing awareness of data-centric cloud security are driving increased momentum in our business. We remain focused on executing on this tailwind as we capture our massive and growing market opportunity.

With that, let me turn the call over to Guy Melamed.

Thanks, Yakov. Good afternoon, everyone. Thank you for joining us today. Our second quarter performance represents a continuation of our solid start to the year. We again saw strong ARR growth and free cash flow generation as well as continued progress towards the completion of our SaaS transition. This performance allows us to again raise our full year ARR guidance while we also continue to keep an eye on the uncertain macro backdrop. We remain confident in our outlook because of the underlying drivers of our business and are well positioned to execute on the growing need to secure data everywhere. We continue to see broad-based strength from new and existing customers looking for Varonis to secure this data. .

The simplicity and automated outcomes of our SaaS platform and MDDR offering as well as customers looking to secure a copilot continue to be key drivers. As a result of this momentum, we ended Q2 with 69% of total company ARR coming from SaaS or approximately $475 million. This represents an 8-point increase in our SaaS mix from the 61% we reported in Q1. We continue to see SaaS and ARR trends at very healthy levels, which is being driven by our customers coming back and buying protection for additional cloud platforms. Once we complete the SaaS transition, we can allocate even more focus on this upselling motion. We believe that this additional time spent on upselling existing customers, combined with a healthy new customer momentum that we are continuing to see will allow us to drive towards our goal of growing ARR more than 20%.

Furthermore, we are prudently and thoughtfully increasing investments in our business because of the growing demand for our solution, and we see a clear path to drive durable growth post transition. In second quarter, ARR was $693.2 million, increasing 19% year-over-year. And year-to-date, we generated $82.7 million of free cash flow up from $67.3 million in the same period last year. In the second quarter, total revenues were $152.2 million up 17% year-over-year. During the quarter, as compared to the same quarter last year, we had approximately a 7% headwind so our year-over-year revenue growth rate as a result of having increased SaaS sales in our booking mix, which are recognized ratably versus the upfront recognition of our on-prem subscription products.

SaaS revenues were $105.9 million. term license subscription revenues were $32.4 million and maintenance and services revenues were $13.9 million as our renewal rates were again over 90%. As we are getting closer to the completion of our SaaS transition, we expect the positive trend of maintenance and services revenues to continue to decline.

Moving down the income statement. I'll be discussing non-GAAP results going forward. Gross profit for the second quarter was $122.6 million, representing a gross margin of 80.6% compared to 84.1% in the second quarter of 2024. Our gross margin continues to track ahead of our expectations, and we feel very confident in our long-term target set at our Investor Day. Operating expenses in the second quarter totaled $124.5 million. As a result, second quarter operating loss was negative $1.9 million or an operating margin of negative 1.2%. This compares to an operating income of $2.1 million or an operating margin of 1.6% in the same period last year.

During the quarter, as compared to the same quarter last year, we had approximately a 6% headwind to our operating margin as a result of having increased SaaS sales in our booking mix which are recognized fully ratable versus the upfront recognition of our on-prem subscription products. Second quarter ARR contribution margin was 16.5%, up from 14.9% last year. The significant leverage improvement reflects our ability to drive strong incremental margins while growing ARR, transitioning to SaaS and investing in our business to capture our growing market opportunity.

During the quarter, we had financial income of approximately $10 million, driven primarily by interest income on our cash deposits and investments in marketable securities. Net income for the second quarter of 2025 was $3.8 million or net income of $0.03 per diluted share compared to a net income of $6.8 million or net income of $0.05 in per diluted share for the second quarter of 2024. This is based on 135.2 million diluted shares outstanding and 128 million diluted shares outstanding for Q2 2025 and Q2 2024, respectively.

As of June 30, 2025, we had $1.2 billion in cash, cash equivalents, short-term deposits and marketable securities. For the 6 months ended June 30, 2025, we generated $89.3 million of cash from operations compared to $68.4 million generated in the same period last year and CapEx was $5.7 million compared to $1.1 million in the same period last year.

During the second quarter, we repurchased 1 million shares at an average purchase price of $38.59 for a total of $38.7 million. Over the course of the program, we repurchased 2.5 million shares -- for a total consideration of $100 million.

Turning now to our updated 2025 guidance in more detail. For the third quarter of 2025, we expect total revenues of $163 million to $168 million, representing growth of 10% to 13%. Non-GAAP operating income of $4 million to $7 million and non-GAAP net income per diluted share in the range of $0.07 to $0.08. This assumes 134 million diluted shares outstanding.

For the full year 2025, we now expect ARR of $748 million to $754 million, representing growth of 17%. Free cash flow of $120 million to $125 million, total revenues of $616 million to $628 million, representing growth of 12% and to 14%. Non-GAAP operating income of breakeven to $6 million, non-GAAP net income per diluted share in the range of $0.16 to $0.18. This assumes 134.7 million diluted shares outstanding.

In summary, our second quarter performance demonstrates the growing demand for Varonis evidenced by the strong ARR growth and cash flow generation. This demand is driven by the simplicity and automated outcomes of Varonis SaaS and MDDR as well as the security challenges created by the usage of AI and the growing awareness for data security. We look forward to completing our SaaS transition, which will position us to even better execute on these tailwinds and drive additional value for our customers, company and shareholders.

With that, we would be happy to take questions. Operator?

[Operator Instructions]

Our first question is from Saket Kalia with Barclays.

Okay. Great. Yaki, maybe for you. The numbers here are pretty straightforward. So I'd love to ask a market question here, if I could. We all saw 1 of your privately held competitors, Ciara raised money recently. And I was wondering, since we're all on the call, can you just talk about how you compete against them? How you win? And maybe how your move to SaaS is changing that competitive backdrop. Does that make sense?

Yes, completely. Primarily, it's the same for all these DSPM vendors. What they are doing for us more than anything else is expanding our total available market and generate awareness that you need to protect data on this cloud repositories. Essentially, these are very small pieces of the data security platform. We don't provide outcomes. Like we just explained, you need to understand that the DSPM, what they are doing data discovery and very partially, a lot of it is based on sampling, but they don't do any remediation and any prediction essentially if someone is -- if you have a compromise the counter an insider, they will even not see it.

You're starting to have a normal behavior to the data, they can't identify it. They can't remediate the excessive access control. And then after you notice that something happened, they can't even do forensics. Fundamentally, it's something that is completely different. Our thought is primarily about scalability and about automated outcomes. We are doing everything for the customers to secure data with Varonis as easy is having a credit card from a bank in terms of just all the automation and everything we do.

The other thing, data is a massive problem at scale and there is something that is common with all these DSPM vendors, they're avoiding POC like a play -- production data. And this is the cornerstone of our sales motion. We are coming to you and we're starting to deploy very fast, taking all the data, finding automatically classify it, labeling it reducing excessive access control, making sure that your co-pilot and AI can see only what it needs to see, looking at Active Directory and with the MDDR, we save dozens of these customers on a week-to-week basis.

So primarily, what it does is just creating awareness for data security with a very small part of the data security from a data security platform. So by and large, this is something that is doing very well for us and for the awareness of the market.

Our next question is from Matt Hedberg with RBC Capital Markets.

Congrats on the results. Yaki, it's great to hear about the updates to your expanded Microsoft partnership. I'm wondering, is there a way that you can help us size the opportunity in terms of revenue contribution today? And additionally, how should we think about go-to-market initiatives to drive even more success? It sounds like you talked about a lot of integration work. But curious about some of the go-to-market initiatives as well.

Thanks for the question, Matt. At the end of the day, the security problem is a data security problem. And what happened, we have a lot of synergies with Microsoft. But then just understood 1 of the biggest gating factor, so the deployment of a co-pilot, which is fundamental now for their strategy and success is security. You know what happened when we start the POC, it's their cor-pilot, which is a tomentous productivity tool. It's like taken just goes and inhale all the permissions that they have and then people stopping and say, okay, how we are going to deploy it. And Varonis very well for you.

The other thing, we have a lot of synergy with a lot of the security staff from defender to MCAS to sending alerts to Sentinel and just -- and we saw just our customers using a purview for label in the register of synergies. We find a lot of low-hanging fruit by doing the overall technical integration. And then we came together and decided that we need to take the partnership to the next level. It still the early innings, but for them, copilot is a lot of what they want to do in terms of productivity in the workforce, and we are securing it. And it just works very well together.

So they're compensating the regular sellers. We're starting to have pipeline development efforts with them. But so far, are working very well, and we are very excited about the partnership, and I believe that we are also excited.

Our next question is from Joseph Gallo with Jefferies.

Are there any metrics or data you can share that just instill the confidence in over 20% ARR growth. I imagine that means SaaS ARR without conversion tailwinds is growing healthily above that currently. But just anything on new logos or NRR that kind of helps us see that what you guys see and are so positive on.

So when you look at the Q2 results, they were driven by strong new customers again, and we talked a lot about how SaaS opens up the opportunity to sell to additional customers. We saw that continue in Q2. We also saw the conversions and existing customers contributing nicely. But what's actually more interesting is that the NRR for SaaS is higher than the reported NRR that we gave at the end of Q4. And when you look at our ARR number being 19%, if we can continue to sell the new customers the way we have done so far, and actually move away from the conversions and just focus on the upsell within the SaaS customers, then kind of the difference between 19% ARR and 20% is not that large. So there are a lot of moving parts that are working in our favor, and we feel very good about the opportunity of going back to that 20-plus percent.

In addition, we feel very good about our investments in R&D. So we see very strong adoption of everything that's related to the other cloud platforms. And we believe that we have good visibility in the way that our investments in R&D and the new product will work. And we're just very excited about the opportunity. If you want to be serious about security, you need to protect the data and your best bet to protect the data is Varonis.

Our next question is from Joshua Tilton with Wolfe Research.

I have a 2-parter. I guess the first part is just in the prepared remarks, I think you mentioned that the macro environment still kind of challenging. I don't think that's a surprise to anyone, but maybe could you just compare how the macro this quarter compared to last quarter? What direction is that macro trending? And then just maybe on the conversion piece specifically you guys said it contributed nicely to the quarter. But can you just maybe give us an update on how the accelerated conversion is going relative to your plan? Are you tracking in line ahead or maybe behind? Just an update on both of those would be very helpful.

So I'll start with the second part. When we look at the conversions, the fact that we're increasing our SaaS mix from 80% to 82% and actually started the year with a full year guidance of 78% is an indication of things going very well. We knew that we could improve the conversion component in 2025, and there were a lot of lessons learned that we took from 2024 and implemented as part of our strategy for 2025. So I can say that we're very happy. We're not -- I wouldn't say that we're shocked by how good it's going. We're very happy, and we knew that we could do better than 2024. .

When you look at the macro, I can say that Q2 was very much similar to what we saw in Q1. There's not much of a difference. There's more deal scrutiny, and we talked about the deal scrutiny for quite some time now. But at the same time, we can say that when you look at data security and when you look at the fact that copilot is generating a lot of awareness to a problem that existed for a long time, but it's putting that spotlight on it and we're there to try and capitalize on it.

Our next question is from Jason Ader with William Blair.

Sorry, I have a 2 parter as well. Just first on the comment that you guys have made historically that you only see competition in 1 out of 20 deals. I was hoping you can update us on that. And then the second part is kind of related, but we've seen some of the backup vendors move into the DSPM market through acquisition like Rubrik with Laminar and then Commvault most recently with Satori. I don't know, maybe you can comment on convergence between traditional backup and data security, data governance, do you feel like that's a long-term trend. I don't know, just any interpretation of what's happening there with the backout vendors?

The infrastructure and backup vendors, we rarely see them in any of the POCs, completely different sales motion. And in general, we can tell you that all the DSPM companies that got acquired by large companies, we don't see them a lot. It just -- it's a -- data security can be a [indiscernible]. What we see is that the company is we see that the DSPM companies that got funding here and there, it takes the competition level or everything that 365 on-prem stays the same. We see around 10% in the cloud infrastructure, but you need to understand 1 thing, cornerstone for everything that we do is POC. We continue we deploy the problem, it scale.

There is much more data and clinical data in the cloud and in on-prem and talking about these blobs and databases that we are in and Snowflake and Databricks and what we see with our competitors is that they don't want to do POC. They are trying not to do a POC. So sometimes, the initial conversation, we hear about them. But usually, when the rubber meets the road, they don't like to do these POCs. So when customers are doing just a diligent process and in data security, the way that you sell is a POC. They don't like the just -- usually, we don't do it and if we try to do, they try to do it in a live and a small set of data.

There is some of them have real scalability challenges.

[Operator Instructions]

Our next question is from Roger Boyd with UBS.

Awesome. Can you expand on the trend of customers consolidating their data security budgets to Varonis. And when you look at the trends around consolidating around data stores like database or around functional areas like DSPM and DLP, are there particular trends within those that are looking stronger than others? And is this something that you're seeing today, the general brownfield consolidation opportunity? Or is this more of a pipeline opportunity you think out over the next year?

I think it's both -- at budget works. You have budget for security, compliance, insider trade everything that's related to labeling, the ability to understand abnormal behavior part of it is DLP and all the pre-equity for the work that you made, and we are doing all of it and the customers understand that they need to do it. In terms of security, you need to understand that bad actors are not breaking in, they are logging in. If I'm not mistaken, [indiscernible] did a testimony to Congress and it talks about the -- or the fishing that we can have with AI. This is something that we are starting to see. I can take your voice and I can be you.

And then if I have your information, many times, we can get your credentials. So what we see is that just the way that everything moves is that once I get your credentials, we are what we call the only game in town. So a lot of the security that's related to insider spreads that everything that related to user behavior analytics is really consolidating around us. And these bad actors what they are doing in order to elevate credentials these days, most of the time, they are not reading through memory and doing all these gels, whether they are doing it is going from 1 data repository to the other.

So we want to cover everything in order to be secure. And this is also something that worked very well for. We start with something and then people just naturally expand. And this is because of our SaaS platform that is scaling so easy and provide automated outcome. We just need to buy, and we will provide a security.

Our next question is from Brian Essex with Goldman Sachs.

It's Brian from JPMorgan, operator trying to demote me. But thank you for taking the question. Yaki, maybe a question for you. Great to see the FedRAMP Authorization. I would love to get your sense of how you feel positioned ahead of the stronger third quarter for fed spending how much visibility you might have into that Fed business? And what's your sense of the preparedness on the Fed side to adopt data security versus what you're seeing on the enterprise side?

So I'll start and then Yaki can add some stuff. Obviously, we were very excited to receive the FedRAMP Authorization this quarter. It really is a great milestone for us. We can now offer the SaaS platform to the federal sector, and that's really a big deal from our end. Our team put a lot of time, effort and investment into this achievement. And we know there's a significant white space for us in the federal vertical. But I do want to remind everyone, the federal is still about 5% of our total company ARR.

It really is still too early to say if we can have any benefits from the FedRAMP in our Q3 results this year. But from a guidance perspective, we assumed a similar contribution to last year. On the longer-term side, we see a huge opportunity in this vertical.

It's very easy. There is a lot of critical information. We show a lot of critical information about you as well. And the way that it works and you see a lot of bad actors and state actors many times. So this is data that they need to protect. You just now what happened with the share vulnerability and so forth. We just -- it's all about data. And I want to say another thing. FedRAMP, it's not only important for federal customers. When you are a data security company, even though we don't take critical data to our SaaS but it was very important to demonstrate it for many customers on the commercial side, FedRAMP is critical, it is certificate that it take security very seriously that you're under the right audits that you have the right controls and it was very important for us to do this exercise.

We are taking the security of our platform. extremely, extremely seriously. We want to make sure that once we are protecting your data, we are all the time secured. And definitely, on the data security these days from all the DSPM space, we are the only 1 with federal.

Our next question is from Shaul Eyal with TB Cowen.

Congrats on the Beacon race. Yaki. I was listening carefully to your market and products commentary. Specifically on that health care-related win with 25,000 seats. Can you provide us with more color about how many subscription services or modules would such a customer be utilizing through Varonis?

Yes, it was a big AWS swings with everything that was there, databases -- other services, including 365 and on-prem mostly copilot. And this is something -- we see now like the a lot of our bills are just mixed. People understand where I have critical data. I want to start sometimes data that people collaborating more they want to start first and almost always protect the identity side that we are doing extremely well.

Our next question is from Mike Cikos with Needham & Company.

I just wanted to cycle back to Joe's question at the top of the Q&A. Just because that 20% plus ARR growth that you guys are citing is probably 1 of the most frequent inbounds we get from clients. So could you just provide some more commentary on the new logos that you guys are addressing as far as size of those initial lands and what you're seeing, is there actually an acceleration taking place in new logo acquisition?

So we have seen the new logos actually accelerate in terms of the number and also in our ability to land in a larger number. The SaaS platform and the MDDR together with the copilot is extremely appealing to many of our customers. The opportunity to sell to customers and actually go to them and the value proposition is that we would do everything for you. All you need to do is pay us with this environment that is becoming so complex from a cybersecurity perspective and a risk perspective is extremely appealing for customers. And I think that's part of the reason we're seeing our new customers adopt so well.

We've seen very healthy contribution from our new customers. We feel very good with the ASPs over time that have increased significantly from the levels we saw in the past. But even with the higher land, there is so much more meat on the bone in terms of selling additional platforms. So we feel very good with the ability to show value to those customers and then go back to them and sell them additional platforms.

What is very interesting is after we are converting to SaaS and customers are realizing these automated values of fine fixed there, they naturally expand to other platforms. So once we are moving there, which is much easier to do the apps. And as we said before, it's 1 of 2 companies and just the SaaS company is tremendous. And as you can see, we're just moving very fast to the SaaS and after that, definitely reducing friction.

And just to add, that's part of the reason we talked about the SaaS NRR being significantly higher than the reported NRR. There is so much additional platforms to sell once you show that value and the automation and the MDDR.

Our next question is from Andy Nowinski with Wells Fargo.

Okay. So I wanted to ask about your SaaS revenue. So you've had 2 consecutive quarters of significantly outperforming the consensus estimate, suggesting the Street seems to be mismodeling that conversion I know you don't guide specifically to SaaS revenue, but if we just use your SaaS ARR of 478 that you reported this quarter and divide that by 4 and use that as a proxy, it certainly suggests that subscription or SaaS revenue should be about $120 million in Q3. I guess my question is, is there anything -- any reason that, that proxy or that calculation would not be correct. Is there anything that -- why we wouldn't want to use something like that?

I've said really since the Investor Day in 2023, that there are 3 north stars that we're focusing on during the transition. There's a lot of noise during a transition and the 3 north stars that we have talked about are ARR, ARR contribution margin and the free cash flow. The 1 thing I really want to avoid is noise on the conversion on the revenue side and specifically on the SaaS revenue component. The right metric to focus on to identify the strength of the business is the ARR. When we look at revenue as a whole, we're thinking of 2025 as kind of the trough where the P&L is still kind of very noisy.

From a numbers perspective, 2026 as we kind of complete the transition, the actual numbers should become more straightforward. The percentages will still kind of move around because on the comparable side, you'll have that noise from 2025. And then 2027 is really kind of a year where you can look at the P&L in a more straightforward way. So the focus right now on the conversion year, and I can't emphasize this enough. It's kind of focusing on the 3 north stars, where the top line number that should be focused is the ARR.

Our next question is from Shrenik Kothari with Robert W. Baird.

Yes. And echoing congrats on the quarter. So beyond the new logos, right, you reiterated strong SaaS conversion execution, of course, tracking ahead of plan. But specifically, Yaki and Guy, you just made comments that past these conversions and the tailwinds, the SaaS NRR, right, the customer is realizing value faster post transition, about the expansion upside cross. So just what specific new workload ramping or multi-cloud expansion signals are giving you the most confidence here? And if you can just help unpack that SaaS and RR a little bit more among MDDR, copilot, OpenAI, greenfield SaaS, unstructured data, as you mentioned, Snowflake -- just wanted to understand like if you can unpack that a little bit more.

Actually, all of them are performing well. Just data store in Azure, AWS, GCP, Snowflake, data breaks Salesforce.com [indiscernible] critical data. We just -- we can say that this time goes by, more and more platforms are doing well. And now you have a lot of this critical data in the cloud, still in other critical data on prem customers realizing that they need to protect or it and all of it is vulnerable and thankfully we are doing well all over.

Our next question is from Rudy Kessinger with D.A. Davidson.

Similar question actually the last one. I am curious, you mentioned in the prepared remarks, the contribution mix of protecting the cloud and SaaS environment continues to increase. Any data points you can share on what percent of SaaS net new ARR from new logos in expansion, not the conversions you're doing, but new logos and expansion is coming from protecting cloud environment and SaaS applications.

So in Q2, we started to see some meaningful contribution from the additional cloud platforms. I can tell you that we were extremely happy with the performance coming from that spectrum. We don't really break it out in terms of -- in dollar terms. We're trying to sell more and more of the platforms, and we're seeing very good adoption by our customers, and we're actually seeing the sales force focusing on that type of cell, understanding the benefit it can provide to our customers. .

So I can say that it was -- it's kind of improving from quarter-to-quarter. And this quarter, we really started to see some meaningful contribution. We expect that trend to continue.

Our next question is from Jonathan Ruykhaver with Cantor Fitzgerald.

Yes. So regarding the recent introduction of your next-gen dam offering, database activity monitoring, I'm curious how should we view that in terms of just an enhancement over traditional dams to drive a replacement cycle versus positioning around a broader data security strategy. When you look at the revenue opportunity it would seem the replacement opportunity relative to some legacy vendors like Imperva and Guardium would be quite compelling near term. So how are you positioning that in terms of the go-to-market?

With our cloud data repository, we started to do very well with databases, primarily with admin activities and with the classification and really -- so many customers came and told us, please come replace the incumbent, said what's going on, and they said we needed to get into the queries whatever we need for compliance, but we also need user behavior analytics. The current solutions are not really security solutions. And many times, these -- a lot of these companies didn't innovate and haven't done it in the right way, and they wanted part of 1 coherent data security platform.

This is when we bought -- and we just understood that this is a market that is prime for disruption and it's just part of our overall data security because a lot of the most critical data in the world resides within databases. We are very excited about the opportunity. You build a very robust infrastructure. The way that this really state-of-the-art card architecture that we are working in is -- can take massive amount of [indiscernible]. And we want to make sure that everything that's related to data lessor or for data security.

And database is part of it and we definitely feel that we can go to new customers, but also we can benefit from a big replacement cycles of the incumbent. So we are very bullish about the opportunity, and we believe that we can execute very well against the potential of this opportunity.

Our next question is from Junaid Siddiqi with Truist Securities.

Just wanted to ask about your identity protection suite that you launched last month. We're seeing more and more convergence between data and identity security. Could you just talk a bit about some of the differentiating aspects what this does compare to what some of the other identity vendors are able to offer their customers?

Yes. It's not a new model. It's already built into our platform. It's very important to understand that Varonis is not managing identity access. We understand identity from a threat perspective. So what are we doing? We're identifying who you are, what is your configuration, how you behave and if you are doing anything that is abnormal and enrich the identity --of data streams. As we said before, attackers are not breaking in the logging and the beginning is the identity.

Once that identity is compromised, there is no perimeter -- any sophisticated data security platform like Varonis to protect your data from.

Our next question is from Fatima Balani with Citi.

Maybe just to dig a little bit more into the comments on SaaS continues to create opportunity to sell additional customers. Within this cohort, should we think about this selling more into new industries or end markets that SaaS has login to enter? Or your ability with SaaS to capture new budgets with an IT environment? And lately, are these greenfield opportunities? Or are you displacing incumbents?

So we're definitely seeing SaaS open up additional opportunities. It's, in a way, increasing our TAM, increasing our ability to offer protection to customers that probably wouldn't have considered us if we didn't have the SaaS offering. And I can tell you that when we look at different verticals, different sizes of companies, we have absolutely seen our TAM increase 3x from where it was pre the additional data -- the cloud protection that we have introduced recently.

So in analyzing our TAM and analyzing the opportunity, I can tell you that it's additional opportunity. And in a way, there are also opportunities to replace existing offerings. But for the most part, it's opening up new avenues, new verticals and new customers that wouldn't consider our [indiscernible].

There are no further questions at this time. I'd like to hand the floor back over to Tim Perz.

Thanks for the interest in Varonis. We look forward to meeting everybody at conferences this quarter.

This concludes today's conference. You may disconnect your lines at this time. Thank you for your participation.