VRNS - NASDAQ

Greetings and welcome to the Varonis Systems, Inc. First Quarter 2025 Earnings Conference Call. At this time, all participants are in a listen-only mode. A brief question-and-answer session will follow the formal presentation. [Operator Instructions] As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Tim Perz. Thank you. You may begin.

Thank you, operator. Good afternoon. Thank you for joining us today to review Varonis' first quarter financial results. With me on the call today are Yaki Faitelson, Chief Executive Officer; and Guy Melamed, Chief Financial Officer and Chief Operating Officer of Varonis. After preliminary remarks, we will open the call to a question-and-answer session. During this call, we may make statements related to our business that would be considered forward-looking statements under federal securities laws, including projections of future operating results for our second quarter and full year ended December 31, 2025. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned "Forward-looking Statements," and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation for the most directly comparable GAAP financial measures is also available in our first quarter 2025 earnings press release and our investor presentation which can be found at varonis.com in the Investor Relations section. Lastly, please note the webcast for today's call is available on our website in the Investor Relations section. With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Faitelson. Yaki?

Thanks, Tim and good afternoon, everyone. Thank you for joining us today to review our first quarter results, the progress of our SaaS transition and to remind you why Varonis is the best positioned to secure the world's data. In the face of uncertainty in the world today, there is one constant which pushes the business case for Varonis, no matter what will happen, people will eat, sleep and create data. The world is completely dependent on data and because of this importance; bad actors want to steal it. At the same time, companies struggle to protect it. Most organizations deploy technologies to protect their endpoints and their perimeters. These technologies are very important but they aren't enough to protect data. Varonis takes a data-first approach and helps companies to locate their sensitive data, visualize who has access to it, automatically lock it down and then automatically detect and respond to threats on it. Last quarter, we announced that we will accelerate our SaaS transition and our Q1 results prove that we are well on track to complete it by the end of the year. The reason we are accelerating this transition is because the strong demand for our SaaS solutions and the benefits to our customers and our company. Simply put, Varonis SaaS is much better way to deliver our platform and to protect our customers' data more effectively and efficiently. With Varonis SaaS, customers are able to realize greater value from our platform without effort which leads to more satisfaction and we believe will better position our company to accelerate growth. In the first quarter, ARR grew 19% to $664.3 million and we continue to progress towards completing our SaaS transition, with SaaS ARR now representing approximately 61% of total ARR or $403.9 million. We generated $65.3 million of free cash flow this quarter, up from $56.4 million in the same period last year. Guy will review our results and updated guidance in more detail shortly. Our first quarter results reflect strong contributions from both new and existing customers that driving our overall business momentum. Organization face a dangerous threat environment and the security teams are stretched thin which means they struggle to see and respond to threats as quickly as they much with today's bad actors. The automated value proposition of the Varonis SaaS platform and MDDR offering resonates with security teams. With Varonis, these organizations can secure their data with very little effort because we do the hard work for them. This is an outcome that simply cannot be achieved by using point solutions or manual work. We also continue to see very healthy customer interest in safely deploying Copilot and other generative AI tools which is serving as a reason for new customers to engage with Varonis and also for existing ones to convert to our SaaS platform. We see massive opportunity to increase the ARR from our existing customer base and in the first quarter we continue to see existing customers expand their deployment and increase their spend with us. Varonis SaaS is a no-brainer for our customers because of the value that it offers. In the first quarter, we were able to convert existing customers to SaaS more effectively because of the lessons we learned last year and the additional investments that we made in our team. This is now also freeing up capacity of our sales teams. They are bringing in healthy levels of new customers while also upselling additional platforms to our broader customer base. Existing SaaS customers continue to expand their journey with Varonis, while many of our customers choose to start with their Varonis deployments by protecting data in Microsoft 365 or on-prem storage platforms because that was their top security concern, they realize that they have sensitive data in many places beyond the areas where they originally deployed us. This is why we have significantly expanded our coverage in recent years to include leading cloud data stores which means we recover data everywhere. Our breadth and depth of coverage has become one of our biggest competitive advantages which means that we are able to provide customers with automated data security wherever they have sensitive data. DA Cloud is working well and during Q1, we continued to see customers looking to Varonis to secure data across these newer cloud data stores and we believe our ability to execute into this large and fast growing market position us to continue to accelerate growth once we have completed the SaaS transition. Another benefit of SaaS is that it gives us the ability to innovate much faster. During Q1, we did exactly that, announcing Varonis for Agentforce which allows organizations to safely enable Agentic AI rollouts in Salesforce. We view Agentic AI as a massive opportunity because agents inherit the permissions of the users who run them. So if users have excessive access, agents can expose sensitive data. For example, if a bank uses Salesforce to process mortgages, guess what would happen when you upload your financial documents with your application? All that information ends up in Salesforce as records, files and attachments. Salesforce can classify individual fields but there is no way to find, classify or protect files and attachments natively in Salesforce. Varonis allows organizations to find sensitive data, automatically fix exposures to very complicated permission models, detect threats on the data and safely enable the data usage of Agentic AI. To finish our example, Varonis automatically removes access to ensure your sensitive mortgage application is not unnecessarily exposed by an agent. In March, we announced the acquisition of Cyral which expands our data security platform to include next-generation database activity monitoring. Cyral's innovative approach to database activity monitoring deploys quickly and allows customers to upgrade their costly legacy solutions and unify their structured and unstructured data security monitoring which means Varonis can serve as a single pane of glass for securing any kind of data. As a unified platform, we will now be able to address more auditing and compliance use cases. In addition to being a strong strategic fit, this market is attractive to us because it has established budgets and is ripe for disruption due to a lack of innovation from incumbents in recent years. This acquisition speeds our time to market and expands our total available market drastically as we enhance our ability to help customers protect their data and allow them to consolidate their data security budgets with Varonis. With that, I would like to briefly discuss a couple of key customer wins from Q1. New logos continue to be the key driver of our business and this quarter a large health care system with over 100,000 employees became a Varonis customer after suffering a ransomware attack that impacted millions of patients. They evaluated Varonis and a number of point solutions in the data classification and DSPM categories to lock down their sensitive data and ultimately purchased Varonis SaaS for Windows with MDDR protection and Varonis for Google Drive. Varonis was the only platform that could automatically secure their sensitive data in Google and on-prem, while proactively monitoring it for threats. While new customers drove most of our momentum this quarter, we are also seeing strong demand from existing customers looking to convert to our SaaS platform and expand their protection to cover new critical cloud data stores I mentioned a few moments ago. An example from this quarter was a multinational consumer products company with approximately 6,000 employees, that first became a Varonis customer years ago. They initially utilized Varonis to map permissions and classify data on-prem. This year, they determined they needed the automation of Varonis SaaS and MDDR because they were severely understaffed and faced an executive mandate to safely deploy Copilot. Over the time they had been our customer. Varonis fixed over 10 million overexposures on-prem and tens of thousands of overexposed links in Microsoft 365 which convinced them that they would be able to safely deploy Copilot. This customer purchased Varonis SaaS for hybrid environments as well as Varonis for AWS, Azure, Google Cloud, Snowflake and GitHub which will enable them to safely protect their data in the cloud and in SaaS applications. In summary, we are excited by the continued momentum we are seeing across our customer base that is driving our growth. Our solution has never been more relevant and we look forward to completing our SaaS transition this year which will unlock many more benefits for our customers and our company as we execute on our significant market opportunity. With that, let me turn the call over to Guy. Guy?

Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. Our first quarter performance represents a solid start to the year, highlighted by an acceleration in ARR growth, sustained improvement in free cash flow and continued progress towards the completion of our SaaS transition. This performance allows us to raise our full year ARR guidance as we focus on executing on factors within our control while closely monitoring the uncertain macroeconomic backdrop. We remain confident in our outlook because of the underlying drivers of our business and are well positioned to capitalize on our growing customer demand. Our Q1 results demonstrate sustained new customer momentum and that the investments we made in our team and lessons we learned regarding existing customer conversions is working. As a result of this momentum, we ended Q1 with 61% of total company ARR coming from SaaS, an 8-point increase in the SaaS mix from the 53% we reported in Q4. When we look at the SaaS NRR, we continue to see very similar trends to last year which was significantly above our total company NRR reported in 2024. This shows us that SaaS customers are coming back and buying more which combined with a healthy new customer momentum that we are seeing gives us confidence that we can return to more than 20% ARR growth. In the first quarter, ARR was $664.3 million, increasing 19% year-over-year and this quarter, we generated $65.3 million of free cash flow, up from $56.4 million in the same period last year. In the first quarter, total revenues were $136.4 million, up 20% year-over-year. During the quarter, as compared to the same quarter last year, we had approximately a 1% headwind to our year-over-year revenue growth rate as a result of having increased SaaS sales in our booking mix which are recognized ratably versus the upfront recognition of our on-prem subscription products. SaaS revenues were $88.6 million. Term license subscription revenues were $31.5 million and maintenance and services revenues were $16.4 million as our renewal rates were again over 90%. Maintenance and services revenues declined by 32% year-over-year, with the vast majority of the decline driven by perpetual maintenance customers converting to our SaaS platforms. Moving down to the income statement, I'll be discussing non-GAAP results going forward. Gross profit for the first quarter was $109.4 million, representing a gross margin of 80.2% compared to 83.3% in the first quarter of 2024. Operating expenses in the first quarter totaled $115.9 million. As a result, first quarter operating loss was $6.5 million or an operating margin of negative 4.7%. This compares to the operating loss of $10.6 million or an operating margin of negative 9.3% in the same period last year. During the quarter, as compared to the same quarter last year, we had approximately a 1% headwind to our operating margin as a result of having increased SaaS sales in our booking mix which are recognized fully ratable versus the upfront recognition of our on-prem subscription products. First quarter ARR contribution margin was 16.7%, up from 13.7% last year. The significant leverage improvement reflects our ability to drive strong incremental margins while growing ARR and transitioning to SaaS. During the quarter, we had financial income of approximately $10.7 million, driven primarily by interest income on our cash, deposits and investments in marketable securities. Net income for the first quarter of 2025 was $0.7 million or $0.00 per diluted share compared to a net loss of $3.7 million or a net loss of $0.03 per basic and diluted share for the first quarter of 2024. This is based on 136.7 million diluted shares outstanding and 110 million basic and diluted shares outstanding for Q1 2025 and Q1 2024, respectively. As of March 31, 2025, we had $1.2 billion in cash, cash equivalents, short-term deposits and marketable securities. For the three months ended March 31, 2025, we generated $68 million of cash from operations compared to $56.7 million generated in the same period last year and CapEx was $2.3 million compared to $0.3 million in the same period last year. During the first quarter, we repurchased 1,476,456 shares at an average purchase price of $41.49 for a total of $61.3 million. Turning now to our updated 2025 guidance in more detail. Our acquisition of Cyral is not expected to have any impact on ARR or revenue this year and is expected to add approximately $4 million of operating expenses in 2025. For the second quarter of 2025, we expect total revenues of $145 million to $150 million, representing growth of 11% to 15%. Non-GAAP operating loss of negative $5 million to negative $2 million and non-GAAP net income per diluted share in the range of $0.00 to $0.01. This assumes 135.2 million diluted shares outstanding. For the full year 2025, we now expect ARR of $742 million to $750 million, representing growth of 16% to 17%. Free cash flow of $120 million to $125 million. Total revenues of $610 million to $625 million, representing growth of 11% to 13%. Non-GAAP operating income of $0.5 million to $10.5 million, non-GAAP net income per diluted share in the range of $0.14 to $0.17. This assumes 135.8 million diluted shares outstanding. In summary, we are encouraged by our first quarter results which were highlighted by broad-based strength and is leading to healthy ARR growth, operating leverage and cash flow generation. This performance gives us confidence to raise our full year ARR guidance as we progress towards the completion of our SaaS transition later this year. With that, we would be happy to take questions. Operator?

[Operator Instructions] The first question we have is from Matt Hedberg of RBC.

Congrats on the results. It's really great to see the SaaS transition continue to accelerate and finish by year-end. One of the key questions that I get from a lot of investors is, what gives you guys confidence that ARR can grow sort of north of 20% in guides you illustrated. I think Guy mentioned the SaaS net NRR significantly above total NRR. But is there any other things that you would give us a guide post around the confidence in that element?

Matt, thanks for the question. When we look at our ability to grow 20% plus, there are a lot of tailwinds that are working in our favor. One of the things that I mentioned in the prepared remarks is our Saas NRR. And when you look at SaaS NRR and to remind everyone, that doesn't include any impact from conversions, it was very healthy this quarter. So we continue to see very similar trends to what we saw last year with that SaaS NRR that is significantly above our total reported company NRR. So this really shows that the SaaS customers see value and they want to protect additional platforms. So they are coming back and buying more which combine with a healthy new customer momentum that we're seeing gives us the confidence that we can return to that ARR growth of more than 20%.

And Matt, it's Yaki. It's very important to understand this is the best way to avoid data breach. Bad actors are not breaking in, they are logging in [ph], they are trying to compromise identities. And then, if you can protect your -- if you can make sure that the right identities can access the right data, can stop all your normal behavior, you will suffer a severe -- most probably you will suffer a sever data breach and data is going relentlessly on all platforms and it's extremely viable and this is the most effective way to avoid the data breach. And with our SaaS platforms, customers are benefiting from it and the information is protected in an automated way.

The next question we have is from Joel Fishbein of Truist Securities.

Great results. I'd love to get some more color around MDDR adoption and how that -- the competitive environment around that and then how that could potentially be an upsell [ph] to get the match question potentially be accelerated to ARR?

So in terms of the overall value, I see so many breaches with customers and usually they become one common ground. Varonis organization has a model security stack, a world-class EDR, a modern firewall, a team that collects the log and it's severe breach. In order to make sure that we are protecting customers from a data breach, you need to have a very data-centric approach. If you want to protect data, protect data, make sure that you can remediate what we call the black radius [ph], the excessive access control automatically, understand abnormal behavior. And also when there is -- once there is the compromise identity or an insider, there is no perimeter anymore. So we are analyzing extremely well the user behavior of identities and users to make sure we understand any abnormal behavior and solve it automatically. I really believe that if somebody wants to make sure that they don't have a data breach, they need something like Varonis. And the other thing to understand is also in terms of forensics. If something happens, you want to understand what happened to your data records, the fact that you can understand, who is patient zero, what happened to an endpoint and to reconfigure or asking directly our end user reports that you don't know what happened to the data records, the liability can be endless. So even the ability to do effective forensics need to be completely data-centric. And this is what we see from the MDDR and we are doing it automatically for customers and we build a lot of AI. We build a lot of security agents that augmenting our analysts and this is working extremely well every day, we are saving several enterprises from severe breaches.

From a numbers perspective, just to add to that. I think sometimes investors forget that MDDR was only introduced five quarters ago. And it has been by far the fastest adopted platform cell we have ever had. So we're very, very happy with how the customers are adopting it. It's a no-brainer really as Yaki mentioned but when you look at the number of the adoption, we truly believe that at the end of this journey, every single customer should have MDDR to be better protected. It's obviously going to take some time. But when you look at this adoption of this platform, it's been really outstanding, we're very happy with the way it's performed so far.

The next question we have is from Saket Kalia of Barclays.

Guy, you said from the beginning that the North Stars on this transition are going to be ARR, SaaS mix and free cash flow. But I wanted to ask about the income statement just for a second. And maybe the question is how far are we from the trough in operating margins as we think about this transition accelerating? And are there any other dynamics that you want us to think about as we kind of think about sort of the model going forward with respect to that?

So as you mentioned, the North Stars are the ARR, free cash flow and the ARR contribution margins. And when you look at those kind of numbers, all of them have been performed extremely well throughout the transition. And if you look at the results in Q1, they're pointing in one direction is that we're moving nicely, quickly and keeping kind of the cost structure in a very prudent way. So I do want to emphasize that before I talk about the P&L. But from a P&L perspective, there is a lot of things that are going into the mix during the transition, it's the conversions and the revenue is recognized differently. So it becomes extremely messy. But I do think that the trough will happen this year. And then obviously, next year, you still have some bumpiness because on the comparable side, you'll get some volatility but less. But I definitely believe that as we progress to complete the transition this year, the income statement starts to look more "normalized". So again, keep everyone focused on during the transition to look at the three North Stars, they are the leading indicators, ARR, free cash flow and ARR contribution margin.

The next question we have is from Joshua Tilton of Wolfe Research.

Congrats on a great start to the year. I just wanted to double down, Guy, on one thing you said. I know you mentioned that you're monitoring the macro pretty closely. Could you maybe just double-click on what is it all impacts in the quarter you saw because of the current macro? How you're thinking about or how you incorporate macro expectations into the guide for this year?

I think that's a great question. When we look at the macro, obviously, there's a lot of macro uncertainty but we had a really good quarter and kind of the drivers that we talked about last quarter are really all in place, whether it's the SaaS transition, MDDR or Gen AI. When you think about kind of the guidance and how we think about it, our philosophy hasn't changed. We treat the numbers, we give Wall Street very seriously and we feel very good about the pipeline in front of us. So when you think about that macro uncertainty and despite it really, we have never been so confident about the long-term opportunity as we see it today. So we try to remain focused on factors within our control and we're confident in our ability to capitalize on a growing customer demand. So another thing that makes us feel really good is that in the first quarter, we saw strong demand from both new and existing customers which led to that ARR acceleration we talked about, that continued leverage in our model and the strong cash flow generation. So when you combine all of these and these results and kind of the underlying drivers in our business is what gives us the confidence to raise our ARR guidance by that $5 million and increase our SaaS mix to 80% for the full year kind of despite the uncertainty that we see in the macro environment.

The next question we have is from Roger Boyd of UBS.

I'll echo comments on -- congrats on a strong quarter. Guy, you mentioned good traction with new logos in the quarter. I wonder if you could talk about, one, are we getting to the point where we can kind of quantify how often new logos are landing with some of the newer offerings Varonis for kind of the SaaS applications, cloud storages and databases? And then similarly, on the strength in use cases around securing Copilot and other AI tools. Are we getting to a point there where we can kind of quantify how big that traction is?

It's Yaki. I see that just to clarify just mathematically, it's still half. But I would tell you in every data reported there, people have critical data, critical data in SaaS applications like Salesforce and ServiceNow in cloud repository, like databases, in Snowflake, any data breach and they need to protect all of it. We still have a lot of data on-prem and in 365. And what happened with all the AI tools, we probably put a spotlight on the data security problems. So these agents, these copilots, what they do essentially, they're just using all the potential access and give you a lot of information and create a lot of information at the starting. So there is excessive access control. Immediately employees will get the information that they shouldn't get. You can point on this AI model and you can also factor [ph]. So as you will see more adoption of AI tools, you will understand that in order to enable them, you need data security and automated data security in order to make sure you can manage their attention between productivity and security. And this is something that we are doing very well. We believe that with SaaS people would just eventually protect every data repository that they have and this is why we see a lot of success with DA Cloud and it's just working very well for us. We are very happy with all the investments we have done in the last few years in data repository, user repository, protecting with the AI tool, automated classification. They are all coming to fruition.

The next question we have is from Keith Weiss of Morgan Stanley.

Congratulations on a solid quarter. I want to ask a little bit about the recent acquisition that you made in the database activity monitoring space. It seems like a pretty logical extension, I guess, even a broader purview of the data within an enterprise as a state. Can you talk to us about sort of where that fits in? How you plan to kind of add it to portfolio? And then a follow-on question to that. I think probably everyone on the line just came back from RSA last week, a lot of talk about data and data security. It feels like the environment is getting probably more competitive. Can you talk to us about how you're seeing the competitive environment evolving as this issue really comes to the forefront of the minds of thesis [ph]?

Thanks for the question. So first, in terms of database which is the natural extension for us and we started to see a lot of success with DA Cloud for occupying these database repositories, understanding configuration and adding the usage. And this customer came and told us they're just not happy with the incumbent. And if you look at -- if they had compliance requirements, we can answer everything and you've got COVID in the past, it's always going from one data repository to the other. And we said, if you can go deep into the queries, it will be great and logically, they want to replace the current solution that they are using and using one scalable data security platforms that give them all these automated outcomes of perfection [ph] and classification and remediation. In terms of this competitive environment, at this point, it's just being very good for us. So nothing changed for us in the competitive environment in terms of stuff like Office 365 and all the Microsoft collaboration tools on the on-prem storages and file systems on CIFS, NFS, or any file system or NAS device and all the DSPM space. Primarily, these are not data security tools, it's primarily data discovery tools that many times still having a hard time to scale and don't give you automation. They don't have remediation, they don't have any layer of fraud detection, they are not integrated with the identity layer. And what is that for us, it's actually at this point increasing our overall total available market and everything that we are doing in IaaS [ph] and other cloud data repositories generate more awareness. And when customers are testing then they understand that these are not security tools, you can't do forensics with them, you can't do remediation with them. You don't understand if you had an attack and I think that the fact that it's becoming -- there is more for outsized is really contributing for the success of DA Cloud.

The next question we have is from Joseph Gallo of Jefferies.

Nice quarter. Last quarter, you mentioned elongation of conversion cycle times. Has that length of cycle time for conversions changed in any way? And then how is the gross retention rates in ASP upside recognized again for those customers?

This to a lot of lessons that we have learned from the conversion process last year and we are trying to implement them starting this year. I think we've done a very good job. And when you look at kind of the conversions that we had in Q1 they were really strong. And I think all of the investments and the lessons learned were implemented in a way that we're happy to kind of to start the year with. When you look at the gross retention rate, when you look at the renewal rates, they're all very strong. We feel good about where we are and what we're seeing. And we talked a lot about the fact that SaaS is purely a better product and therefore, we're seeing our existing customers try it and then want to buy more and be better protected. But really when -- it's important to note that the conversions weren't the only strong element this quarter and we're definitely seeing strong new customer adoption. Again, it kind of relates to that SaaS platform that is being -- the offering is so much better. So when you look at kind of the growth rate and our ability to get to that acceleration is coming from our existing customers buying more and our new customers that were really strong this quarter.

The next question we have is from Brian Essex of JPMorgan.

Yaki, I got a question for you. Great to see the innovation outside of Microsoft Copilot into other Agentic applications like CRM. Could you maybe provide a little bit of color in terms of your expectations for any different go-to-market motion? I think one of the concerns that investors may have is that in Office 365 environment you're competing against Purview. Are you seeing a pull-in from Salesforce and other ISVs you might be working with? And do you anticipate maybe less friction with that go-to-market motion?

I just think that as you will see more of an Agentic AI and overall AI [ph], what it does it; just put the data security program in your phase, if you will [ph]. If you're using these agents and immediately, you get information that you shouldn't get, it's very problematic. It will be very harm for organization to process like that. So if you want to enable your organization to safely use AI, you need something like Varonis. You need to understand the activity, you need to rightsize the permissions, you need to do everything automatically, you need to look at the forms and make sure that people are asking a legitimate question because if not, it's an act of liberty [ph] to them.

The next question we have is from Rob Owens of Piper Sandler.

This is Ethan [ph] on for Rob this afternoon. As we think about consolidating more of the data security budget, what are some other natural adjacencies in the space that you think the platform will be well seeking to address going forward?

I think that obviously database activity monitoring is a big one, a lot of stuff that related to understanding identity behaviors, things that are relevant to the MDDR environment. So it's just -- a lot that and we also are bringing a lot of additional capabilities that -- and take additional budgets. But definitely, another source of budget is the AI budgets the organizations have. So I have to adopt AI and want to do it in a secure way is starting to have this allocated budgets for AI security and enabling the organization to use AI and we are benefiting from.

The next question we have from Shaul Eyal of TD Cowen.

Congrats on solid set of results and guidance. Yaki, I wanted to ask fairly two little quick questions. One, what's the headcount that you're adding with the small -- with the stocking acquisition? And a macro, Guy or Yaki, DAG specifically -- I'm not talking about tariffs, etcetera but DAG specifically, have you seen anything emerging in this quarter?

I'll start with the second question and thanks for that, Shaul. When we look at federal and I want to remind everyone, the federal business for us is still relatively small, about 5% of total company ARR. And when we look at kind of the -- when we look at the contribution in Q1, Q1 is not considered a large quarter for them. Their largest quarter is Q3. So when you think about kind of how we look at federal, we didn't see anything kind of evolved from DAG and the way we think about it from a guidance perspective is that we didn't assume any significance contribution in comparison to last year. So we are very happy with kind of the progress of the FedRAMP certification. It's really as progressing as planned and we hope to get it in the next few months. So we definitely believe in that long-term opportunity in that vertical. So that kind of relates to the federal question. In terms of style, we didn't have -- they don't have a significant number of head count. So it's a small number that doesn't impact us much but when we think about that expense addition throughout the year, it's approximately $4 million of additional expense throughout the year. If you look at kind of the guidance, you can see that it hasn't changed much. We're able to absorb it from a guidance perspective. And we're not expecting any ARR or revenue contribution from the final acquisition this year.

The next question we have is from Fatima Boolani of Citi.

This is Mark [ph] on for Fatima. Maybe just want to dig a little bit more into the new local momentum you're seeing. It really comes to play adjusting the sales focus this year on really the renewal conversion. Can you maybe give us some of the drivers there? How much does this outperform expectation? And maybe can you speak to any discernible changes on new customer adoption behavior aside from maybe the AI driven purchases? And any guardrail for how we should think about the contributions between new versus conversions to ARR guide this year?

We talked a lot about the fact that with the MDDR offering and kind of the fact that we have our Copilot addressing any -- really any generative AI, it really is a no-brainer for new customers to adopt the platform. And we've absolutely seen a change in the way we can address those customers. We truly believe that our TAM has increased with the new offering, the simplicity of the offering, the fact that there's so much automation in the MDDR has really allowed us. Together really with the Copilot being such an issue for our customers that want to adopt it really helped us address the simplicity of going to new customers that we weren't able to sell to before and make add value propositions to be very much adopted in a healthy way. So we started implementing that last year, we started to continue this year. You heard us talk in the last earnings call about the fact that we want to move as quickly as we can throughout the transition and complete it in 2025. I think the results in Q1 are a very good start and showing that we're moving in that direction. So we try to balance and make sure that we're not only completing the transition but the iron on the bar is still on getting new customers. Our sales force has done a really good job of balancing those two and I think that's kind of the reason we were able to show that acceleration, that feed on the -- the raise on the ARR guidance and the leverage in the model and the ARR contribution margin. So I think those two elements of addressing new customers and being able to convert our customers in a more efficient way is what's helping us move forward the way we have so far.

The next question we have is from Jason Ader of William Blair.

I wanted to ask on the gross margin outlook. I know that the SaaS transition is impacting that. Can you just talk about what you expect for the remainder of 2025 and then the kind of more medium-term outlook? And then just sort of related to that, why is a non-GAAP operating income range so wide? Can you just speak to that?

Well, going back to revenue. Listen, revenue -- the P&L in general throughout 2025 is going to get messy. You have to keep in mind that the way revenue is recognized through SaaS and on-prem subscription is so significantly different that it's generating a lot of volatility and it's a lagging indicator and it doesn't indicate for the health of the business at all. So you get the conversions and that generates a lot of messiness. So gross margin, really, when you think about 2025, it's not going to be reflective of anything. When we did our Investor Day in 2023, we gave out like a five-year model and we put in our gross margin expectation which was at the end of 2027 to be in that range of the 80%. I can tell you that overall as a context and I'm not talking about 2025 when we gave guidance from a revenue perspective. But when we look at the performance our cost on SaaS is exceeding our expedition significantly. So as a general concept and just to keep in mind, we are doing better than what we thought when we initiated the transition but you're going to see that volatility until we complete the transition. And the reason that the range is so wide is because there's so many factors that are embedded in this transition. Listen, probably we have to take a shift and completely transition it from on-prem subscription to SaaS. I think we've done a great job so far and we want to make sure that we complete the transition at the end of this year. So getting to 65% -- 61% in Q1 with a great start. But again, there's a lot of volatility, trying to bake in and consider what are the conversions and how it's going to impact. And that's why we took an extra range which I think is prudent.

The next question we have is from Rudy Kessinger of D.A. Davidson.

Firstly, Guy, I want to make sure I heard you right. I think in response to Josh's question earlier, you said 80% SaaS mix by year-end on ARR. I think that's versus 78% expected previously. I want to make sure I got that right. And then secondly, I guess my real question, does it feel like we're getting any closer to an inflection point on the Copilot and Gen AI stuff? Just what are you seeing from customer behavior? How has maybe the macro impact in the rollouts of Agentforce, Copilot, etcetera?

I think that the overall organization understand that these AI tools are market productivity gains. And definitely, I think that they will -- they still need to upgrade how they are going to use exactly, how it's rolled out to all of their employees but definitely we see it as a driver and we believe that it is going to be more and more on the edge of just knowledge workers [ph]. You will see just more an even just demand for data security. So this is definitely something that we see accountable.

And I did want to confirm, yes, you're right, we raised our guidance on the SaaS mix from 78% to 80% at the end of the year.

The next question we have is from Shrenik Kothari of Robert W. Baird.

Just on a related note from the previous question. So historically, your spend has been an unstructured environment and, of course, with the several acquisitions and increased focus on Snowflake, Databricks, BigQuery, will be driving into structured data. Just few words Yaki, how are customers responding to kind of more unified view across structured, unstructured assets? Do you see there is more of a greenfield expansion? And are there like real gaps in automated fumigation there? Are you seeing budgets kind of shift from potentially legacy of asset magnitude into your platform? Just curious what you're seeing.

I think that full organization is just smarter to make sure that they're protecting all the data with us; they need all the automated outcomes that we provide. They want to unify the classification engine and this is exactly what they need from us which is getting much better security. We have second-line data-centric user behavior analytics. We also owe a lot from the Active Directory and probably the Okta IAM, so the monitoring identities and other streams like firewalls and proxies. So this is just natural extension for them and it works very well for them to make sure that they don't have data breach to make sure that they are in compliance and they can do it in an effortless way but also that they can go and show the Board or superior that they have done a good job that in a tangible way, they classified everything, they label it. Now they blast radius [ph] without breaking business process, and they did everything automatically without adding any additional headcounts.

The next question we have is from Jonathan [ph] of Cantor.

Can you talk about the Agentic AI capabilities that you've announced within MDDR? And specifically, when you look at Agentic systems that the adoption curve is still very early. So where would you expect Agentic AI to actually begin to contribute more materially to customer outcomes in revenue growth? And specifically, as it relates to MDDR, how do you plan to monetize those new features?

Thanks for the questions. What is happening, we have a world-class analysts looking at customer data 24/7. And we also have a very unique data set that features the behavior of users and service accounts and all identities into data and enrich it with their all information. But what really is we just plan how to build these security agents that's looking at the data and can close everything takes a lot of events and many alerts can just close them automatically to make sure that the analysts can be extremely productive. So once the customer is onboarding with our MDDR, the best analyst in the world using the data-centric platform and just an army of robots that is helping them in a direct way to look 24/7 in the customers' environment to make sure that they've gone through the data breach and it works extremely well. We are getting stupendous automation. And this is how we're granting our analysts and once you have our MDDR, an extension of your opinion, the best people in the world of any data security that are working for you around the clock is there for these orders.

Thank you. Ladies and gentlemen, we have reached the end of the question-and-answer session. And I would like to turn the floor back over to Tim Perz for any closing remarks.

Thanks again for the interest in Varonis. We look forward to seeing you all at conferences this quarter.