VRNS - NASDAQ

Greetings and welcome to the Varonis Systems, Inc. Third Quarter 2024 Earnings Conference Call. At this time, all participants are in listen-only mode. A brief question-and-answer session will follow the formal presentation. [Operator Instructions]. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Tim Perz, Investor Relations. Thank you. You may begin.

Thank you, operator. Good afternoon. Thank you for joining us today to review Varonis' third quarter financial results. With me on the call today are Yaki Faitelson, Chief Executive Officer, and Guy Melamed, Chief Financial Officer and Chief Operating Officer of Varonis. After preliminary remarks, we will open the call to a question-and- answer session. During this call, we may make statements related to our business that would be considered forward-looking statements under federal securities laws, including projections of future operating results for our fourth quarter and full year ending December 31, 2024. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned forward-looking statements, and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation for the most directly comparable GAAP financial measures is also available in our third quarter 2024 earnings press release and our investor presentation which can be found at www.varonis.com, in the Investor Relations section. Lastly, please note that a webcast of today's call is available on our website in the Investor Relations section. With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Faitelson. Yaki?

Thanks, Tim. And good afternoon, everyone. Thank you for joining us today to review our third quarter results. Today, I would like to discuss our SaaS transition progress and the key drivers of our business. First, as I often do on these calls, I would like to remind you why Varonis exists and the problems we solve. Next to its people, data is the most valuable asset of any business, so it is the primary target for bad actors and cyberattacks. Most organizations focus on securing endpoints and perimeters, but leave many gaps for cyberattacks on their data. With the expansion of the cloud and the emergence of generative AI, productivity and collaboration have improved, but the risk of overexposing sensitive data has greatly increased. Since the inception of our company, we have taken a data-first approach to security, which allows our customers to locate their sensitive data, visualize who has access to it, lock it down, and detect and respond to threats on it. Now with the automation of our SaaS platform, our customers can spend less time and effort protecting their data. Our Managed Data Detection and Response offering, which we call MDDR, saves them even more time, and makes them much more protected. Simply put, Varonis allows organizations to use AI and collaborate in a much safer way. Turning to our third quarter results, ARR grew 18% to $610 million dollars and SaaS ARR now represents approximately 43% of total ARR or approximately $260 million, which reflects the growing momentum of our SaaS platform and our MDDR offering as well as a small contribution from Gen AI. Year-to-date, we generated $88.6 million dollars of free cash flow vs. $46 million last year. While our federal business underperformed our expectations, our strong performance this quarter was led by our enterprise business, with healthy contribution from new logo growth and conversion activity from both on-prem subscription and perpetual maintenance customers. Guy will review our results and our updated guidance in more detail shortly. Our SaaS transition continues to gain momentum because of the many benefits our customers realize. As a reminder, they are: Customers achieve automated outcomes, which means they ensure data is protected with very little effort; SaaS is quicker to deploy and operationalize with significantly lower infrastructure and personnel investments; and SaaS is easier to maintain and upgrade. Additionally, the three key benefits we continue to realize are: Shorter sales cycles, larger initial lands, and margin benefits over time. This quarter, we continued to see more proof of these benefits in our SaaS transition and MDDR offerings as well as very early contributions from Generative AI solutions. At the beginning of the year, we introduced MDDR, the first managed service for monitoring and protecting critical data, built on top of our SaaS platform, and therefore only available to our SaaS customers. It protects data in a more automated way. This offering is so important for an organization because the threat environment grows more dangerous by the day. And when a breach happens, every second counts. Security teams are stretched thin, and struggle to see and respond to threats as quickly as they must with today’s threat actors. With MDDR, we address the problem for them, leveraging our unique telemetry, user behavior analysis and years of experience building highly accurate threat models to detect and stop potential data breaches. While we have been selling MDDR for only two full quarters, customers are seeing immediate and impactful benefits, and MDDR is becoming a key driver of new business wins and SaaS conversions. As we previously said, we believe that MDDR is a gamechanger and that we are just scratching the surface of this opportunity. Another tailwind that we have discussed is the impact of Generative AI and large language models. This topic remains top of mind and a key theme in our discussions with prospects and customers. The productivity benefits of Gen AI are well understood, and companies are rapidly starting to understand the related risks. As a reminder, the usage of AI makes it easier to create and access data, which benefits employees, but makes the job of an insider threat or outside attacker much easier. Generative AI tools utilize native access controls to determine which data is available to the identity that is using the prompt. These controls must be optimized, or Generative AI tools will create immense risk for organizations, increasing the risk of cyberattacks. Varonis helps organizations mitigate these risks, by ensuring that only the right people have access to the information that they need to do their job, and monitoring what they do access, either directly or through AI. Once a bad actor bypasses perimeter controls, Varonis can automatically lock out the compromised user or machine, preventing damage from happening. In the third quarter, Gen AI had a small positive impact to our reported metrics. It is very early, so we are taking a measured approach with regards to our expectations around Gen AI’s contribution to our results, but the behavior we are seeing from customers gives us additional confidence that we should see momentum grow as its adoption increases. With that, I would like to briefly discuss a couple key customer wins from Q3. A large medical company became a Varonis customer this quarter. This organization is subject to many state privacy and data regulations and wanted to better protect its data after it suffered multiple ransomware attacks. They were focused on visualizing their risk, automatically locking their data down and being able to monitor it as they continue to grow through M&A. They also wanted to ensure their data was protected when deploying Microsoft Copilot. Prior to bringing in Varonis, the team unsuccessfully tried to lock down their data using a DLP solution. Our risk assessment revealed over 40% of their sensitive data was open to every employee, including 60,000 files shared with anyone on the internet. Ultimately, they purchased the Varonis SaaS Hybrid package with MDDR, Varonis for Copilot, GitHub, Salesforce and databases. This will allow this customer to safely adopt Microsoft Copilot, automatically reduce overexposures at scale, and meet its regulatory requirements. We also saw continued strong demand with existing customers looking to convert to Varonis SaaS with MDDR protection. One example of this was a large insurance company that has been a perpetual license customer since 2015, using Varonis to audit user access activity for its on-prem Windows environment. This organization was looking to change their data classification vendor, while locking down their overexposed data in their unmonitored Microsoft 365 environment. Our risk assessment in Microsoft 365 identified 40,000 files with social security numbers that were open to all employees. It also uncovered 10 terabytes of unlabeled files in OneDrive. After failing to protect their data with their existing DLP and SIEM vendors, they ultimately purchased the Varonis SaaS Hybrid package with MDDR and Varonis for databases. In addition to automatically locking down their data at scale, Varonis MDDR will proactively monitor their hybrid environment. In summary, the sustained momentum that we saw from our SaaS platform and MDDR this quarter leaves us excited as we head into the fourth quarter. We are confident in our ability to capitalize on the tailwinds of MDDR, Gen AI, and increasing data-centric compliance regulations to capture our significant market opportunity. With that, let me turn the call over to Guy. Guy?

Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. When looking at the quarter, this was our strongest performance across the business since embarking on the SaaS transition. These results reflect the strong adoption trends of Varonis SaaS and MDDR coupled with a small contribution from Gen AI. Our performance this quarter gives us increased confidence as we look to close out the year, and our SaaS transition continues to gain momentum with SaaS now representing 43% of our total company ARR. We saw strong contribution from both new logos and existing customer conversions, including conversions from perpetual maintenance customers, and many of the secular tailwinds we have noted this year, are continuing to have a positive impact on our business. Our enterprise business was the driver of our strong performance this quarter, with strong new business activity, healthy conversions and very early contributions from Gen AI to our reported metrics. Our federal business, however, underperformed our expectations by several million dollars. We have decided to make changes to the management team of our federal business and believe those changes, coupled with our expectations for FedRAMP authorization next year, will better position us to capture that market opportunity going forward. Looking at the quarter in more detail, the key drivers were again SaaS and MDDR. Our SaaS platform and MDDR offering together eliminate the two biggest pushbacks of, one, not wanting hardware and, two, not having the headcount to manage the platform or respond to alerts. The automation of our SaaS offering, together with the simplicity of the story, continue to drive positive momentum and shorter sales cycles when compared to the on-prem subscription deals. As we have said for a few quarters, Gen AI continues to come up in nearly every customer conversation, but this was the first quarter where it began to contribute to our results. We believe Gen AI is still very early in the adoption curve, which keeps us measured in our expectations around the timing and sizing of its contribution to our results. This quarter gave us additional confidence that we should benefit from this tailwind as its adoption increases over time. The strong Q3 performance, coupled with our healthy pipeline, allows us to raise our full-year ARR guidance. Because it is still very early in its adoption, we are not assuming material Gen AI contribution in our updated guidance. As we look ahead to the fourth quarter, we anticipate converting more customers to our SaaS platform. Pricing continues to be in line with our price list increase of 25% to 30% and, in some cases, we see deal sizes increase in excess of that, as customers consume more of the platform upon conversion to SaaS. We expect that the ramp-up of this phase will not be linear and momentum should grow each quarter, with SaaS conversions showing further acceleration in dollar terms in 2025 and 2026. In the third quarter, ARR grew 18% year-over-year to $610 million and year-to- date we generated $88.6 million of free cash flow, which was up from $46 million generated over the same period last year. These metrics demonstrate our commitment to balancing topline growth with improving cash flow generation during the transition. Turning now to our third quarter results in more detail. As a reminder, the leading indicators of our transition are the three north stars: ARR, free cash flow and ARR contribution margin. As we have said many times, the faster we progress through the transition, the more headwinds we will experience to our traditional income statement metrics, but we view these in a positive light. The macroenvironment remains stable while SaaS and MDDR are resonating well, and we feel increasingly confident in the trajectory of the business following our third quarter results. Q3 total revenues were $148.1 million, up 21% year-over-year, reflecting our strong performance as well as a higher contribution from perpetual maintenance converting to SaaS. During the quarter, as compared to the same quarter last year, we had approximately a 5% headwind to our year-over-year revenue growth rate as a result of having increased SaaS sales in our bookings mix, which are recognized ratably vs. the upfront recognition of our on-prem subscription products. In the third quarter, SaaS revenues were $57.8 million. Term license subscription revenues were $68.8 million and maintenance and services revenues were $21.5 million as our renewal rates were again over 90%. Maintenance and services revenues declined by 13% year-over-year, with the majority of the decline driven by perpetual maintenance customers converting to our SaaS platform. Moving down the income statement, I’ll be discussing non-GAAP results going forward. Gross profit for the third quarter was $125.8 million, representing a gross margin of 85% compared to 87.3% in the third quarter of 2023. Gross margin continues to be strong and the year-over-year change is due to the revenue headwind associated with a higher mix of SaaS sales, increased headcount to support the transition and increased hosting costs. Operating expenses in the third quarter totaled $116.7 million. This includes approximately $6.7 million of acquired in-process research and development expenses within the R&D expense line due to a small asset purchase made during the quarter. As a result, third quarter operating income was $9.1 million or an operating margin of 6.1%. This compares to operating income of $4.9 million or an operating margin of 4% in the same period last year. During the third quarter, as compared to the same quarter last year, we had approximately a 4% headwind to our operating margin as a result of having increased SaaS sales in our bookings mix, which are recognized ratably vs. the upfront recognition of our on-prem subscription products. This quarter, ARR contribution margin was 15%, up from 11.1% last year. The significant leverage improvement, even during the transition, reflects our ability to drive strong incremental margins, while growing ARR and transitioning to SaaS. During the quarter, we had financial income of approximately $9.7 million, driven primarily by interest income on our cash, deposits and investments in marketable securities. Net income for the third quarter of 2024 was $13.8 million or $0.10 per diluted share compared to net income of $10.4 million or $0.08 per diluted share for the third quarter of 2023. This is based on 134.7 million and 126.7 million diluted shares outstanding for Q3 2024 and Q3 2023, respectively. As of September 30, 2024, we had $1.2 billion in cash, cash equivalents, short-term deposits and marketable securities, $332.3 million of which is included within long-term marketable securities. Our liquidity position also reflects $394.1 million of net proceeds from the successful issuance of convertible notes in early September, which strengthened our already healthy balance sheet. For the nine months ended September 30, 2024, we generated $90.9 million of cash from operations compared to $49 million generated in the same period last year and CapEx was $2.3 million compared to $2.9 million last year. Turning now to our updated guidance in more detail. For the fourth quarter of 2024, we expect total revenues of $162 million to $167 million, representing growth of 5% to 8%; non-GAAP operating income of $20 million to $22 million; and non-GAAP net income per diluted share in the range of $0.13 to $0.14. This assumes 135 million diluted shares outstanding, which includes 6.8 million shares related to the issuance of convertible notes maturing in 2029. For the full year 2024, we now expect ARR of $635 million to $639 million, representing growth of 17% to 18%; free cash flow of $95 million to $100 million; total revenues of $554.4 million to $559.4 million, representing growth of 11% to 12%; non-GAAP operating income of $20.6 million to $22.6 million; non-GAAP net income per diluted share in the range of $0.26 to $0.27. This assumes 134.9 million diluted shares outstanding. In summary, when looking at the quarter, this was our strongest performance across the business since embarking on the SaaS transition. This strength was driven by Varonis SaaS, the strong reception to MDDR, and the secular tailwinds benefiting our business. The growing demand for Varonis is strengthening our ARR performance and cash flow generation, and these tailwinds position us to unlock meaningful value for our customers, our company, and our shareholders. With that, we would be happy to take questions. Operator?

[Operator Instructions]. The first question is from Matt Hedberg from RBC.

Congrats on the results. Yaki, there's a lot of left unpacked. It's hard to think about one question here, but I guess if I were to focus on one, I couldn't help but hear you talk about Gen AI, although early, positively impacting results. I guess I just wanted to put a finer point on what aspects of the portfolio are contributing to customer Gen AI spending. And if we look forward another couple of years, how do you think the products that attribute to Gen AI spending could expand over time?

It's primarily now related to Copilot and you see it a lot on the 365, but eventually obviously you have Einstein in Salesforce and you have it for GitHub and there are – there's this type thing that is going to be part of every walk of life. The reality is that, at the beginning, we saw just these small POCs in the hands of IP that immediately exposed the problem, the data security problem. You have this massive blast radius. But what we're starting to see now is that more knowledge workers are using it. And once they are using it, solving the problem becomes almost inevitable. So you just see that people get to a lot of critical data they don't need to get, generating a lot of critical data they shouldn't generate outside of policy, starting to just using the wrong intent and it's just extremely dangerous in terms of losing the critical data. So, at the beginning, it was on the PS/POC stage, but now when knowledge workers are demanding it and they are trying to buy it and you're just starting to hit critical mass within organizations that are using the product, they generate a lot of urgency to buy a protection for Gen AI and Copilot mainly and it's just working extremely well for us. We just – an unbelievable solution to solve it automatically.

The next question is from Hamza Fodderwala from Morgan Stanley.

Yaki, you and Guy teased us a bit with a lot of the Gen AI contribution commentary, but didn't quite size the opportunity, at least today. I know it's early innings, but we're seeing some of the problems in terms of over-permissioning and data leakage with Copilot. You've had some customer case studies already where customers are using Varonis for Gen AI. There's a Gen AI readiness program with some of your partners like ePlus. So, there seems to be some momentum there. I'm just curious, if you're not willing to give sort of ARR revenue contribution today, what percentage of your pipeline would you say is Gen AI related customers coming to you and trying to prepare themselves for Gen AI going forward?

Hamza, we've been talking about Copilot for about a year now. This time is slightly different. I think you kind of noted that and here's why. This quarter, we finally started to see some deals close. But as he says and as we've talked a lot about it, it's still early on which is why we're not baking in any material amounts closing into our Q4 guidance. But the fact that we started to see deals close this quarter gives us increased confidence that we should benefit as Gen AI adoption increases. And as Yaki mentioned, it's not just around the Microsoft Copilot. It also includes the internally built LLMs, Salesforce Einstein and others. When we look at the pipeline, it comes up really in every conversation with our customers. A lot of our customers are talking to us about it. But again, this quarter, we started to see some deals close, but it's still a very small amount and immaterial amount for the quarter.

But it's front and center in every conversation. We believe that, over time, it will be inevitable that it will be in the hands of any knowledge worker. It's just the productivity gains are tremendous. And once enough people are using it within the organization, it's exposing many times the data security problem. The fact that data is overexposed, the fact that you can use these robots in a malicious intent, and it's very, very dangerous. But we believe that it's going to be a big part of the future of IT and we are well positioned to protect organizations and make sure that the community is secure.

The next question is from Saket Kalia from Barclays.

To Matt's earlier point, a lot to unpack, particularly in Gen AI, but maybe I could switch gears a little bit. Guy, I've gotten the question from investors just around how much of the net new ARR, generally through this process, has come from conversion. And of course, that isn't something that we disclose, but I think that what a lot of people are trying to figure out is how does demand look excluding that conversion activity. So is there a way that you can talk to us about that qualitatively just as we think about sort of base net new ARR next year plus any conversions, plus a lot of the other good things that you talked about with Gen AI?

Saket, I think one of the biggest misconceptions, and we've talked a lot about this during a lot of the conversations that we've had with investors, is this conception that the conversion, you just plug it in the Excel and it happens very quickly and very easily. When you look at what drove the momentum and the strength this quarter, it definitely came from the SaaS platform and the MDDR. We continue to see shorter sales cycles on SaaS and very strong new logo activity, which was really driven by the MDDR offering. And that's really because the SaaS value proposition eliminates the two biggest pushbacks of customers. And we've talked a lot about it, one being not wanting to buy hardware, and the second that they don't have enough people to support the solution. Without the conversions, we wouldn't have gotten to 43% of total ARR being SaaS or approximately $260 million, but the conversions take time. And conversions are – you have to talk about the legal elements of it with the customer and it takes time to flip them. It's not a plug and play. But at the end of the day, provides more value to our customers. That's why we do it. That's why our customers are buying SaaS and converting to SaaS. But at the end of the day, what drove the momentum this quarter and also last quarter when you look at kind of the commentary that we gave last time is the new logos, the MDDR offering, and that's really what's driving the business.

The next question is from Brian Essex of J.P. Morgan.

Great to see the profitability and cash flow here so early on still in the transition phase. Maybe, Yaki, I think last quarter we caught up – in terms of talking about the transition, I thought you had a great analogy where I don't know if it was either you or Guy talked about stage one of the transition was the carrot phase and then phase two was the stick and then you said that carrot phase is going so well, you don't feel like you need to use the stick. Is that still the case? How much visibility do you have in that transition pipeline and how smoothly is it going for those existing customers that you're converting over now? How much runway do you have left with those easier converts if I can maybe put it that way?

In terms of the overall value proposition and our ability to get to outcomes, the SaaS is second to none. The reality is that bad actors many times are not breaching in, they are logging in. Once you have an identity, there is no perimeter anymore and we are your best bet. So a data centric data security platform is the first thing you need to do and the last thing that really will save you. So anytime our customers are tasting the value, the automated outcomes that we provide, it's a game changer. You have stuff that's related with all the remediation robots and the MDDR. We just released the MDDR and what we just catch on a weekly basis is mind blowing even to us and our ability to automate everything and also with the way that we are covering more data and user repositories just elevate the whole value proposition. So once customers taste it and understand just the regular value of a high quality SaaS architecture, but primarily these automated outcomes, that they can get most of the value literally doing nothing automatically generates a lot of appetite due to conversion.

One thing to add, and I think it's a very good question in terms of kind of value proposition and kind of the commentary that we gave about the fact that many of our customers are asking for SaaS and wanting to switch to SaaS because it's a much better product, but if we take a step back for a second and when you look at kind of when we announced the transition, we're just under two years into the transition and we expect to be at approximately 50% of the business coming from SaaS. That's a huge milestone for us. So when you look at kind of the progress that we have had through this transition, it's been extremely healthy. We're very happy with the progress that we are. And you noted correctly, we're doing that with significant generation of cash flow. When you look at the free cash flow, upping our guidance and getting to levels that are very healthy, we're very happy with that. We think we can continue on that path and do better, but we're very happy with the progress we've had so far.

The next question is from Joel Fishbein from Truist Securities.

Good quarter. Yaki, you mentioned on the call that the federal business underperformed. I'm just curious there whether or not that was sort of self-inflicted execution or if there's something going on there. It's been a good area of business. I know you're still on track for FedRAMP. I'd love to get a little bit more color there. Really appreciate it.

So that's a great question. I'll take that. The federal business did underperform by several million dollars. But let's keep things in perspective, that vertical accounts for mid-single digit percentages out of total ARR. So when we look across the remaining 95% of the business, this was the best quarter we've had since the start of the transition and that momentum was driven by continued strength in the enterprise segment. If federal did what it was supposed to do, this would have been a picture perfect quarter for us. So after several years of underperformance from the federal business, we decided to bring in a new management team and we believe that these changes coupled with the expectation for FedRAMP authorization next year will better position us to capture that market opportunity going forward.

The next question is from Fatima Boolani of Citi.

Guy, I wanted to double back on an earlier question with respect to some of the conversion momentum that you're seeing in the base. Understand that it's not like flipping a switch, but I'm curious to understand how much of your install base has actually converted. And as a related question, how much of your install base has actually converted? And as a related matter, is your guidance for SaaS ARR mix for the full year at 48% still intact?

Again, when we look at kind of where we are from SaaS out of total ARR, getting to 43% was definitely – you can't get to that percentage without having existing customers converting. Our Q3 conversion was very similar in dollar terms to the Q2 conversion amount. So, again, it's the same commentary that we gave in Q2, the strength of the quarter came from new business, the MDDR and the fact that we're seeing shorter sales cycles on the SaaS offering. And when we look at kind of where we want to end, we talked about 48% kind of finishing the year. We're looking now to be in that 49% SaaS mix at the end of the year. And we think that even that metric gives us a lot of confidence to deliver in the same manner we've delivered on other metrics to Wall Street.

The next question is from Roger Boyd from UBS.

I know there's a variety of ways you're monetizing MDDR, but are we getting to a point where you might be able to quantify the size of that business? Or alternatively, any color you can give on the typical uplift you see to ACV when you do bring that into customer engagements?

Roger, one of the things that we've talked a lot about is our desire to be able to extract more dollars from our customers through the MDDR offering. It's part of a bundle, basically. And there are multiple ways to buy the MDDR. If you want to buy it separately without additional licenses that we have as part of the bundle, you will pay a higher price. But what we wanted to see and what is actually happening is that many of our customers are actually buying more of the platform and getting MDDR at a reduced price. For us, it doesn't really matter. We want to provide the value. And we think that if they consume more of the platform, they get a much better value for money. And at the end of the day, it allows us to increase our ASPs. So at the end of the day, everyone wins here. When we look at kind of the adoption of MDDR, we only had two full quarters. But don't forget, we introduced it at the beginning at the beginning of the year. So January was the first time it was introduced to our Salesforce. Very well adopted by our customers, very well adopted by the Salesforce, because it's a no brainer. It helps on the sale cycles. It helps on the conversation, the value that is provided to customers is great. We haven't quantified because we're providing a lot of color in terms of the numbers. And I think that MDDR at the end of the day needs to be with every single customer we have. We've talked a lot about that. It doesn't happen overnight. But at the end of the day, it's something that can help all of our customers.

The next question is from Andrew Nowinski from Wells Fargo.

I just want to get a better understanding of how you're defining a material impact from Gen AI. Are you guys measuring it based on the number of new logo adds you get when they tell you they're buying Varonis for an LLM support? Or can existing customers that roll out an LLM also have an impact on your ARR? I guess I'm just trying to understand how you define a material impact and what that might look like.

We are analyzing every POC, looking at the pipeline and understanding very well, methodically, why customers and prospects are buying the product. And many times we just we see in what we call a risk assessment that when they're using Copilot, it's just exposing the problem in a big way. And we also see that our customers just many times expediting the purchasing process in lockstep with their intent to release the Copilot product to more and more knowledge workers. This is really how we see it. And before it was very contained in the IT department, but as time goes by, we just see that once they release it to a broader population, they need to understand that they must make sure that only the right people can access the right data. They need to be able to audit activity. They need to make sure that they contain the queries themselves Queries that make sense because, if not, these tremendous tools will inflict a lot of damage.

One thing to add, when we look at kind of the Copilot, we talked a lot about it. We have it as a separate SKU. We have it as part of the MDDR. And we've talked a lot about the fact that, when customers have the Office 365, they have a lot of protection that can help them with the Copilot. The copilot has additional functionality, but the true value in dollar terms is selling Copilot to new customers. When we quantify materiality, we quantify it in dollar terms. When we looked at kind of the Copilot SKUs sold in Q3 as a standalone, it didn't have a material impact. But as I said before, there is difference, and that was part of our prepared remarks. We did see deals closed that were related to Copilot in a way that gives us increased confidence that it will become a tailwind in the near and medium term future.

The next question is from Joseph Gallo with Jefferies.

I appreciate the federal commentary earlier, but anything else to note on the overall business environment? And then just any expectations for a 4Q budget plus? Just trying to understand your 4Q guide where net new ARR is relatively similar to your 3Q. So just trying to understand if there's anything else we should be aware of.

When we look at the philosophy of guidance, that really hasn't changed. That's why we didn't bake in any additional Gen AI contribution. We've always been under kind of the assumption, and our philosophy has always been, that we don't bake in any positivity until we see it translate into data. And that's why we're kind of staying with the same philosophy for Q4. In terms of budget flush, it's not something that we've seen in the past. There is the regular seasonality within the business where Q4 is the largest quarter of the year, and we expect that to be the same this year. But we haven't seen any changes in terms of budget flush when we move to SaaS. If we see anything, we'll obviously provide commentary post-quarter.

The next question is from Jason Ader with William Blair.

I just wanted to see if you had any early thoughts on 2025. I know you're not providing any specific guidance, but just maybe can you help us think through the impact of the SaaS transition on 2025 relative to elements like revenue growth, operating margin. Operating margin was down this year from last year, primarily, I would assume, from the SaaS transition. Will it stabilize, you think, in 2025? Could it go down more? And then on the revenue growth side, same thing. It actually probably outperformed probably what most people expected this year. But what are some guideposts for 2025, and how should we be thinking about that?

Jason, I'll start by re-emphasizing the three North Stars, which are ARR, ARR contribution margin and free cash flow. I think looking at regular standard financial statement metrics that relate to revenue and operating margin through a transition are very misleading because of the ratable recognition of revenue through SaaS versus the upfront recognition of the on-prem subscription. So I would highly, highly, highly recommend not looking at revenue and the regular operating margin because it really is not reflective of anything within the business. When I look at the ARR contribution margin, it was actually moving very nicely throughout this year. We're showing nice leverage compared to 2023. And when we look at kind of our commitment, we've talked about our desire to continue to grow, but also from an ARR contribution margin, show improvement and generate more cash. And I think when you look at the free cash flow generation, it's been progressing really nicely. We believe that obviously that's one of the essence of having a company want to generate healthy free cash flow. In terms of the 2025 color, we'll provide more color as we finish Q4. Obviously, Q4 is the largest quarter of the year. We're very focused and we feel good getting into the quarter and we'll provide additional color on 2025 as we see kind of the trends in Q4. But overall, we're entering Q4 with strong pipeline and believe that we can do well.

The next question is from Rob Owens with Piper Sandler.

Just a quick one from me. I think you called out in your prepared remarks a small asset purchase that you made during the quarter. Could you elaborate on that?

We bought just a small team of programmers that can help us accelerate the roadmap. We have many exciting new products and features in the roadmap and this was just shortening time to market. Just a very small acquisition that help us accelerating the roadmap.

And just to give some color from the financial statement side, as Yaki said, we purchased code. So this is a small technological tuck-in. And as Yaki mentioned, helps shorten our time to market. From a cash flow perspective, the asset purchase at max totaled $6.7 million. And on the income statement, the full amount is expensed immediately. So you will see that amount of acquired in-process research expense within the non-GAAP R&D expense line item. We don't expect any ARR or material expense because of the very small size of the asset purchase.

The next question is from Joshua Tilton from Wolfe Research.

One for me, I guess. It's clearly a positive that you guys are calling out contributions from Gen AI. And I guess we can interpret that as Copilot adoption is possibly going a little bit more mainstream in the enterprise than it was maybe 12 months ago. And I guess my question is, it feels like prior to this AI hype cycle and this want or need to adopt some type of Copilot strategy, that you guys lived on this very secluded island when it came to competition. I think part of the reason why we all love the story is because there was really no competition for your core offering, especially when it was on-prem. And I guess my question is, as you see Copilot adoption become more mainstream, more customers want to deploy this technology, look for ways to secure their data. It just feels like the competitive landscape is getting increasingly more noisy. And I'm curious how you think about the fact that there are so many companies coming after the data security market, the data security opportunity as you had in 2025 and maybe how that changes the competitive positioning that you once had as an on-premise business.

At this point, we see no change to the competitive landscape. We sell our products through POC, we analyze each and every one and we know we have a competition. But what we do see is that there is just a lot of noise, a lot of awareness around data. Most breaches are data breaches. And this whole notion that organizations spend an arm and a leg on security and constantly have breaches that are more sophisticated in attacking data is just a losing proposition. I think that what you see is that data security becoming front and center and organizations understand that they need data security. It's a very complex problem to solve. You have massive volumes of data with a lot of data stores and you need to integrate and you need to marry them with a lot of additional streams in order to really solve the problems, to make sure that only the right people can access the data, to understand if you have any abnormal behavior and to find critical assets. And this is something that we are experts in doing extremely well. But at this point, there is no change whatsoever to the competitive landscape.

The next question is from Rudy Kessinger from D.A. Davidson.

Similar to Saket, I get a lot of questions from investors just on the conversions and contribution towards growth. Guy, you said in response to a question earlier, you converted about the same amount in Q3 as you did in Q2. If I look at the numbers here, the step down in your term and perpetual ARR was about $5 million higher Q2 to Q3 than Q1 to Q2. So it looks like from those numbers you converted a good chunk more. So I'm curious how gross retention has been trending and how it was in Q3 versus Q2 in prior quarters just as you started to lean into the conversion notion more to your existing customers.

When we look at our renewal rates, they're consistently over 90%. So we're happy with what we're seeing there. I can tell you that when you look at kind of the conversions, we have seen more conversions happen from our customers that own maintenance of perpetual and that's part of the reason you're seeing that revenue increase because, in a way, there's no headwind when you convert the maintenance of perpetual to SaaS. When you look at the maintenance and services line items, and when you look at the decline there, the majority of that decline in that line item is actually coming from conversions. So when you look at our conversions, I think we're happy with customers converting, but again, I can't emphasize this enough. When you look at what drove the momentum in this quarter, it was new customers, it was the MDDR. We're very happy with the way our new customers are adopting MDDR and the way our Salesforce is selling to new customers. And we saw growth in the new customers, a very healthy dollar increase with our customers.

The next question is from Shrenik Kothari from Robert W. Baird.

Congrats on great execution. Guy, you mentioned about the upsized convertible notes offering and the strategic flexibility it provides. And with M&A being one potential avenue – and, Yaki, please feel free to chime in – any specific areas in your product portfolio or market segments that you might be eyeing that align with your core data security focus. Specifically, would you be focusing on certain technologies that complement your existing offerings, expand overall reach, or provide new capabilities, either in context of competitive dynamics or not, if you can provide some sense there.

I think that we just build a very unique asset with this data security platform that can take all the activities, a lot of telemetry, and really support production that will provide the automated outcomes. And with that, it just opens up a lot of the logical extension. There is just a lot of meat on the bone to do very, very interesting things that provide a lot of value. They have great engineering organization and a lot of capacity there. But we're also shrewd business people and we look at opportunities and we see something that makes sense. So, a good team that can help us accelerate our roadmap, we will consider.

To add some more on in terms of the convert and kind of how we look at it, obviously, our 2020 convert was coming due in August 2025. So, we obviously didn't want to wait for the last minute and decided to opportunistically raise in a really favorable convertible market. But as Yaki mentioned, the convert really allows us to be more offensive as we've talked about the fact that our opportunity has never been bigger than it is today. But we did not think that doing a deal is a necessity to achieving our $1 billion ARR target. Rather, this sets us up to grow at healthy levels way beyond the $1 billion of ARR. with additional capital allocation flexibility. But I think that what's very important to note is that this allows us to look at slightly larger M&A, but nothing crazy or changing the risk profile of the business. So just want to emphasize that.

There are no further questions at this time. I would like to turn the floor back over to Tim Perz for closing comments.

Thanks for joining us today. We appreciate the interest in Varonis and look forward to speaking with everybody at the conferences this quarter.