Varonis Systems Inc Q3 FY2023 Earnings Call

Greetings, and welcome to the Varonis Systems, Inc. Third Quarter 2023 Earnings Conference Call. At this time, all participants are in a listen-only mode. A question-and-answer session will follow the formal presentation. As a reminder, this conference is being recorded. It is now my pleasure to introduce Tim Perz, Investor Relations. Thank you. You may begin.

Thank you, Operator. Good afternoon. Thank you for joining us today to review Varonis' third quarter 2023 financial results. With me on the call today are Yaki Faitelson, Chief Executive Officer; and Guy Melamed, Chief Financial Officer and Chief Operating Officer of Varonis. After preliminary remarks, we will open the call to a question-and-answer session. During this call, we may make statements related to our business that will be considered forward-looking statements under federal securities laws, including projections of future operating results for our fourth quarter and full-year ending December 31, 2023. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today, under the section captioned Forward-Looking Statements, and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation for the most directly comparable GAAP financial measures is also available in our third quarter 2023 earnings press release and investor presentation, which can be found at www.varonis.com in the Investor Relations section. Lastly, please note that a webcast of today's call is available on our website in the Investor Relations section. With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Faitelson. Yaki?

Thanks, Tim, and good afternoon, everyone. Thank you for joining us today. Let me start by saying our thoughts are with our employees, customers, partners, and all of those impacted by the recent events in Israel. We will continue to do whatever it takes to support our employees. Today, I would like to review our Q3 results and discuss how AI can serve as a meaningful tailwind to our business in the years to come. But first, I would like to remind you why Varonis exists and the problems we solve. Data is the prime target for bad actors because of its importance to a business. Data is also out of control. The explosion of the cloud and remote work has improved collaboration but has also made securing data more difficult. Varonis helps companies locate sensitive data, visualize who has access to it, and automatically lock it down. This allows companies to collaborate safely and get value from their data while managing risk, and AI will only make this an even greater priority. Our third quarter results reflect the continued healthy adoption of Varonis SaaS. We saw further evidence that our transition to a SaaS business model is working, and SaaS ARR now represents approximately 15% of total company ARR. Third quarter SaaS mix came in at 59%, comfortably ahead of our guidance of 45%. ARR grew 16% year-over-year to $517.5 million, and we have generated $46 million of free cash flow year-to-date, up from $800,000 through the same period last year. Guy will review our Q3 results and our updated guidance in more detail. From a macro standpoint, we continue to see a higher level of data scrutiny and longer sales cycles this quarter but remain encouraged by the progress of our SaaS transition against these headwinds. Now, I would like to spend some time on how AI presents a meaningful opportunity for Varonis. In my conversations with customers and prospects, AI comes up more and more. And my key takeaway for Varonis is that the growth of AI has the potential to generate significantly more data, significantly more risk, and significantly increase the need for data security. Stepping back, generative AI presents both opportunity and risk for companies. It has an opportunity to boost productivity and efficiency, but in order to safely realize these benefits, there are security risks that businesses must mitigate first. These risks present opportunities for companies like Varonis. The first risk is related to what I call self-inflicted risk, which happens when businesses start using AI to suggest content to employees. Unless data is locked down, there is little to prevent AI from analyzing the company's entire data estate and revealing critical business assets like customer lists, payroll files, or bank account information to the wrong people. Microsoft recommends mitigating this risk by securing sensitive data before deploying Copilot, which is the company's AI assistant, and specifically recommends having robust access controls and policies in place, which is precisely what Varonis does. Without Varonis, rightsizing access control is very challenging. Managing access control only gets harder over time, which with data storage and AI will surely contribute further to this problem. Without the right controls in place, AI doesn't know who should see what and surfaces everything for everyone. This becomes a huge risk for organizations, and bad actors won't even need to search for content they want to steal; AI will help them find it automatically. AI will also increase the risk that companies face from external attackers. A few examples of this include helping bad actors curate and translate phishing emails so they can use them in many languages, creating fake datasets to trick companies into paying ransoms, and creating malware. Unfortunately, the use of AI will continue to lower the barriers to entry for hacking. Varonis helps organizations mitigate this risk by ensuring that only the right people have access to the information that they need to do their job. Varonis can help organizations ensure that employees only see content suggestions that are relevant to their job function. If a bad actor bypasses critical control, Varonis can lock out the compromised users or machines, preventing damage from happening. Although it is early and we are still quantifying timing and sizing, we see AI becoming a growth driver for our business as it gains momentum and have a detailed plan to execute on it. Apart from the demand opportunity arising from security risks related to AI, we are also leveraging this technology in new ways to improve our customer experience. Varonis has been using machine learning and AI for many years in our analysis engine and threat model, for example. And today, we are announcing two exciting generative AI capabilities in our SaaS Data Security Platform, the AI System Security Operations Center, or SOC, and natural language search. Although we do not plan to sell AI as a separate SKU, our AI assistant SOC will provide security analysts with an intelligent AI assistant specialized in performing investigations, remediating threats, and proactively hardening environments. Our SaaS platform can analyze the risks and provide context and next steps to help analysts more efficiently resolve security incidents. With natural language search, AI makes every Varonis user a power user. Anyone, from the helpdesk to the CSO, can use natural language to get fast and accurate answers to questions such as 'Do we have any files containing passwords that are exposed to everyone on the internet?' or 'What users have been accessing our payroll file?' Today, we introduce generative AI features built upon the Varonis SaaS benefits that we have discussed with you over the past year, and they will further reduce the time to value for our customers and improve their experience with Varonis. I would like to remind you of the three key benefits our SaaS platform provides our customers. First, customers are much better protected with less effort due to automated remediation and proactive incident response. Second, SaaS is quicker to deploy and has significantly lower infrastructure costs. And third, SaaS is easier to maintain and upgrade. A few key benefits that we realized are: one, shorter sales cycles; two, larger initial sales; and three, margin benefits over time. This quarter, we continue to see additional proof points of these benefits. A large state government organization became a Varonis SaaS customer this quarter. We first gained a department of this state as a customer in 2022. Over the past year, we had a very successful deployment in that department, which allowed us to build credibility, and ultimately win the broader state government mandate. For this organization, SaaS was a must-have because their security team is spread thin. Now, they will benefit from quicker time to value, faster deployment, and most importantly, they will be better protected with our proactive incident response team and automated remediation for Windows on-prem and Microsoft 365. We also continue to see healthy interest from existing self-hosted customers who converted to SaaS this quarter. One example was a multinational financial institution that first became a customer in 2020. Given their large volume of sensitive customer data, they needed to ensure that information was locked down. They originally purchased four on-prem subscription licenses to protect their on-prem Windows environment. This organization’s success in protecting on-prem Windows data led them to convert to the entirety of the platform by going both wider and deeper. Varonis SaaS will now help them shrink their potential exposure in the cloud, just as they did on-prem. Proactive incident response will supplement their threat detection capabilities, and Varonis SaaS eliminates the need for this customer to manage their on-prem infrastructure, which will improve their scalability. They converted their on-prem Windows licenses to a SaaS-equivalent package and purchased an additional SaaS package for Microsoft 365, widening their coverage. The sustained momentum that we saw from our SaaS transition this quarter, coupled with our faster pace of innovation, gets us closer to achieving our $1 billion ARR target and delivering meaningful stakeholder value. With that, let me turn the call over to Guy. Guy?

Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. It goes without saying that the health and safety of our employees is of paramount importance to us, and we will continue to do whatever it takes to support them. Before I discuss results, I want to briefly comment on the impact of the war in Israel on our operation. From a top-line perspective, Israel has historically represented less than 1% of our business. We have approximately a third of our employees located in Israel, which includes our principal research and development facility, as well as a portion of our support and general and administrative team. At this time, a low single-digit percentage of our global team members have been called up to active duty. We have executed business contingency plans to minimize the impact on our business, and at this time, we don't expect a material impact on our global operation. With that, I'd like to turn to Q3 results. We are pleased with the continued strong adoption of Varonis SaaS against continued macro headwinds. Our SaaS transition continues to gain momentum, and this quarter provided additional proof of the numerous benefits to our customers, as well as the tailwind to our ARR and cash flow performance. As a reminder, ARR, free cash flow, and ARR contribution margin are the leading indicators for our business during this transition. The shift from on-prem subscription licenses, where approximately 80% of the deal's value is recognized upfront, to a SaaS model with fully ratable revenue recognition will cause initial headwinds on the traditional income statement metrics, as the SaaS mix and conversions of existing customers to SaaS increase. And this quarter's impact was meaningful as the number of existing customers converting to SaaS again increased. However, these headwinds are a function of accounting treatment and are not indicative of the health of our business. In fact, the greater these accounting-related headwinds are, the better it is for our business, as it means the transition is progressing at a faster pace. Our third quarter's SaaS mix represented 59% of new business and net new upsell ARR versus our guidance of 45%. And after only three quarters into the transition, SaaS now represents approximately 15% of the company's total ARR. The average deal sizes realized in Q3 continue to provide us with confidence in the 25% to 30% pricing uplift and margin structure that we previously provided. In the third quarter, a significant number of SaaS deals were sold to new customers. Thus, we again saw an increase in existing customers converting to our SaaS offering. In the third quarter, we had approximately $10 million in conversions of existing customers, impacting our Q3 revenue. To be clear, this is the renewal amount that was previously booked as an on-prem subscription that is now SaaS, which causes a headwind to our reported revenue and operating margin, but does not impact ARR or free cash flow. The $10 million from this quarter does not include the uplift that we realize from these conversions, which is accretive to ARR and free cash flow. As we look to our revenue guidance for the fourth quarter, we're now assuming that approximately $12 million of existing customers' renewals will convert to SaaS in Q4, which is up from $10 million previously. In the third quarter, ARR grew 16% year-over-year to $517.5 million. Year-to-date, we generated $46 million of free cash flow, which was up from $0.8 million generated in the same period last year, reflecting the inherent leverage in our model, as well as our commitment to balancing top-line growth with improving cash flow generation. In Q3, we continue to see a macro environment similar to the first half of the year. We're still seeing deal scrutiny and longer sales cycles across the board, which is impacting customer purchasing patterns and is constraining our near-term results. We expect these longer deal cycles to continue, along with the associated budgetary scrutiny, and our updated guidance takes this into consideration. Turning now to our third quarter results in more detail, before I get into the numbers, let me remind you of what we've said for a while now. ARR, free cash flow, and ARR contribution margins are the leading indicators for this transition. We take our commitments to the street seriously, and our revenue guidance is based on a combination of our expected SaaS mix and existing customer conversion. As we said previously, the faster we progress throughout the transition, the more headwinds we will experience to our traditional income statement metrics. We view these headwinds in a positive light, as they show our customers are adopting our SaaS solution more rapidly. Q3 total revenues were $122.3 million, down 1% year-over-year. During the quarter, as compared to the same quarter last year, we had approximately a 12% headwind to our year-over-year revenue growth rate, as a result of increased SaaS sales in our booking mix, which are recognized ratably versus the upfront recognition of our on-prem subscription products. Subscription revenues were $97.7 million, and maintenance and services revenues were $24.6 million, as our renewal rates were again over 90%. Moving down the income statement, I'll be discussing non-GAAP results going forward. Gross profit for the third quarter was $106.7 million, representing a gross margin of 87.3% compared to 88.3% in the third quarter of 2022, despite significant revenue headwinds, which were largely offset by greater efficiency on our SaaS platform than we initially expected. Operating expenses in the third quarter totaled $101.9 million. As a result, third quarter operating income was $4.9 million, or an operating margin of 4%. This compares to operating income of $9.8 million, or an operating margin of 7.9% in the same period last year. During the quarter, as compared to the same quarter last year, we had approximately an 11% headwind to our operating margin, as a result of increased SaaS sales in our booking mix, which are recognized fully ratably versus the upfront recognition of our on-prem subscription product. Third quarter ARR contribution margin was 11.1%, up from 3.6% last year. The significant leverage improvement, even during the early stages of the transition, reflects our ability to drive strong incremental margins while growing ARR and transitioning to SaaS. During the quarter, we had financial income of approximately $8 million, driven primarily by interest income on our cash, deposits, and investments in marketable security. Net income for the third quarter of 2023 was $10.4 million, or $0.08 per diluted share, compared to a net income of $6.7 million, or $0.05 per diluted share for the third quarter of 2022. This is based on 126.7 million diluted shares outstanding for Q3 2023 and 126.9 million diluted shares outstanding for Q3 2022, respectively. As of September 30, 2023, we had $731.5 million in cash, cash equivalents, short-term deposits, and marketable securities. For the nine months ended September 30, 2023, we generated $49 million of cash from operations compared to $8.4 million generated in the same period last year and CapEx was $2.9 million compared to $7.6 million last year. During the third quarter, we repurchased 1.2 million shares at an average purchase price of $30.10, which completed our intended share repurchases. Over the course of the program, we repurchased approximately 4.4 million shares at an average purchase price of $22.64 for a total consideration of approximately $100 million. Turning to our guidance in more detail, we're raising our full-year SaaS mix of new business and upsell ARR guidance to 55%, up from 50% previously, and we expect Q4's SaaS mix to be 60%. We continue to take a prudent approach in building our SaaS mix outlook as the dollar value of deals we expect to close in the fourth quarter is the largest of the year, which is in line with historical trends. In Q4, we're assuming that $12 million of renewals will convert to SaaS, which will serve as a headwind to revenue. Conversions to SaaS before considering any uplifted deal sizes do not impact ARR. Our guidance continues to factor in the same level of macro headwinds that we've discussed at length in the past. Now, turning to our guidance for the fourth quarter of 2023, we expect total revenues of $115 million to $154 million, representing growth of 5% to 8%; non-GAAP operating income of $25 million to $27 million; and non-GAAP net income per diluted share in the range of $0.22 to $0.24. This assumes 126.1 million diluted shares outstanding. For the full year 2023, we now expect ARR of $535 million to $539 million, representing growth of 15% to 16%. Free cash flow of $40 million to $45 million, which includes $8 million to $10 million of headwinds related to the TCJA capitalization of R&D provision. Total revenues of $495 million to $499 million, representing growth of 5%; non-GAAP operating income of $26.5 million to $28.5 million; non-GAAP net income per diluted share in the range of $0.31 to $0.33. This assumes 126.6 million diluted shares outstanding. In summary, we continue to see solid demand for both new and existing customers who wish to consume Varonis through our SaaS platform. As a result, our transition continues to move quickly, and approximately 15% of our total ARR is now coming from SaaS. This is benefiting our ARR performance and cash flow generation, which positions us for a strong fourth quarter. With that, we will be happy to take questions.

Thank you. Ladies and gentlemen, at this time we will be conducting a question-and-answer session. Thank you. Our first question comes from the line of Saket Kalia with Barclays. Please proceed with your question.

Okay, great. Hey guys, thanks for taking my question here and just want to send our thoughts to the Varonis team and their families in Israel.

Thank you.

Thank you.

Absolutely. If I stick to one question, maybe I'll make it for you here, Yaki. You know, it just seems like great traction on SaaS. For those customers that are moving to your SaaS tools, what are you seeing on usage of the different modules? Are you seeing any change in usage now that the tools are arguably easier to deploy and use?

No, we see just a dramatic change. We see what we call robotic value proposition. And the North Star was always what we call 10% of the effort, overall magnitude more value, and this works according to plan. We can measure everything from installation to update to remediation, our ability to reduce threats. And the other thing, we also build the ability of our professional services team to support the customer with much more ease. We can provide a lot of the value of the platform with the customer almost doing nothing, just very, very little in helping in terms of configuration, so it's just a completely different value proposition. We're literally unleashing robots to solve the problem.

Got it, very helpful. I'll get back in queue. Thank you.

Our next question comes from the line of Hamza Fodderwala with Morgan Stanley. Please proceed with your question.

Hey, good evening. Thank you for taking my question. Yaki, I wanted to dig in a little bit more about your commentary around generative AI. I think a lot of the CIOs and CSOs that we're talking to more recently are mentioning that data security and governance is a big hurdle to deploying these large language models. I’m curious to what extent you are starting to have conversations with customers on how they can deploy these generative AI models in a way that can prevent things like data leakage or poisoning from occurring?

I think that is going to be completely a game-changer. The other thing is that, we still haven't seen it completely, but just the initial release of stuff like Copilot for business, this is essentially what it does. It's mining all the data that people can access. And this is not me saying it; Microsoft is saying that 90% of the access control is excessive. You don't need them. So, you have these tools leveraging large language models that are going and mining a massive amount of data, creating tremendous high-value information products that are completely out of policy. So, when I was thinking about it, if I take your credentials, and 90% of the data you can access is not relevant for you, you have these AI tools that are extremely sophisticated creating this highly valuable data. I just think that, very soon, what you will see is that organizations understand that they need to make sure that they have access controls, data auditing, and classification in place to realize productivity gains and avoid disaster. This is something that we're starting to see customers talking about; all the customers are discussing it. And I really believe that Varonis is the foundation to ensure that you can use these AI-based data securely.

Thank you.

Our next question comes from the line of Matt Hedberg with RBC Capital. Please proceed with your question.

Well, thanks, guys. Congrats on the results, and we send our thoughts and prayers to all the Varonis employees around the globe and in Israel. Yaki, maybe as a follow-up to Hamza's question, I think in the prepared remarks, you said you don't expect to sell a separate generative AI SKU at this point. I'm curious, could that change in the future? And then maybe secondarily, as you're having these initial conversations with customers, how do you think it could impact deal sizes long-term?

So, where it's definitely it can change. If you think about what we are doing with our AI, one thing is that it can use the product with just natural language, which means that you don't need to learn syntax, which is tremendous. The second thing, really if you look at the metadata you are collecting, we are the only company in the world that has this metadata, which we call data-oriented threat detection and response. And it will take a regular IT person, and now they have an assistant to be a world-class threat detection expert. But over time, maybe we will monetize it. Our best way to monetize it is to sell the platform. This really answers the other part of your question. Initial deals are great, but I really think that the way we can grow ARR within our customer base is significant. What we are seeing now is just the tip of the iceberg. We're starting to have stability in the overall transition to a completely different usage, able to leverage the unique data that we have to have AI being the foundation for really the digital world to ensure that businesses can be prepared and benefit from AI securely. We decided we are going to monetize this model, but at this point, we want to ensure that we have so much to sell to our customers that it will be very easy for them to use it and gain value.

Thanks, Yaki.

Our next question comes from the line of Brian Essex with J.P. Morgan. Please proceed with your question.

Hi, good afternoon. Thank you for taking the question, and our thoughts are with you and your families in Israel as well. I just wanted to dig in a little bit toward maybe for Yaki, what you're seeing in the pipeline, particularly with regard to previous commentary reflecting elongated sales cycles and the impact of deals in-flight as those customers assess moving to SaaS instead of term. Maybe if you can help us understand the impact in the quarter? And then how much visibility into the pipeline, what was growth like, and how much confidence that gives you into your ability to execute in the last quarter of the year here?

You see, they have seen pipeline across the board. The other thing that we're starting to see is that organizations understand that data protection is inevitable. It's actually your first frontier and last resort. If you don't protect data, wherever you go, it will never be protected. If everything else that you are doing fails, it's the only thing that will save you. Many organizations didn't address it head-on because it was hard to do. With the robotic value proposition that we are building, they understand that they can do it. If you look at really enterprise projects, they can gain immediate time to value and ongoing value in a completely automated way. I'm spending a lot of time with customers these days, and I definitely see that people understand that they need a sophisticated data security platform, and the only way that they can do it is through automation. We are very well-positioned to take this budget.

Got it.

Our next question comes from the line of Joel Fishbein with Truist. Please proceed with your question.

Thanks for taking my question, and I'm also sending my thoughts and prayers to all of you. I wanted to just follow up on the new SEC reporting rules, and if you are seeing your customers starting to ask questions about them. And also, is that there's a potential driver to your pipeline and new business?

It's definitely a potential driver. What we see all around is that people understand they need to protect data. In the last few years, organizations have spent a fortune on security, but many of them are not getting great returns on investment. They have a lot of security on the perimeter, and at the end of the day, most breaches occur from insiders or stolen credentials acting like a user, inflicting damage on the data stores. Attacks can come from anywhere on any device, but only go in one direction: the data that is essentially the most valuable asset that most organizations have and the most vulnerable one. The SEC regulation is another one; it's just inevitable. If you want to have cybersecurity, you need to protect data. Where we see is definitely that every regulation is helping.

Thank you.

Our next question comes from the line of Roger Boyd with UBS. Please proceed with your question.

Great, thanks for taking my question, and congrats on another very strong quarter of SaaS adoption. I don't think investors should be too surprised to see Varonis outperforming on a transition timeline. Just given the success you're seeing in SaaS and meaningful outperformance on mix expectations and conversions, any update to how you're thinking about the timing of phase 2 of the transition? And why not lean further into a more active plan to convert existing customers?

I think that question can be broken into two. One is the overall timeline and the second part is Phase 2. When we think about the overall timeline, with a 5% SaaS increase versus last quarter and the way it extrapolates going forward, it makes sense to reconsider our timeline. This is something that we talked about last quarter that we would revisit our guidance for that at year-end, and we plan to do that. Overall, when we think about the transition, it's moving very fast. We're very happy to have 15% of our ARR coming from SaaS in just three quarters. It's happening fast because our customers and Salesforce are adopting it positively. We definitely look forward to providing more color on that part in our next earnings call. In terms of Phase 2, when you think about the conversion of the installed base and that's how we define Phase 2, it hasn't begun yet. But we are increasing the number that we expect in terms of conversion in Q4 to $12 million. That's gone up from $10 million that we guided last quarter. Regarding the Q3 number, we came in at $10 million, which is a high number as you think about it. It's very positive, but still a small percentage of our existing customer base. So, as much as we're seeing very strong adoption that's happening in a natural way, we haven't prioritized it yet, but we plan to do that next year. Overall, as we look at the progression of the transition, it's been really positive, and we hope to continue to move at that pace going forward.

Thanks, Guy.

Our next question comes from the line of Andrew Nowinski with Wells Fargo. Please proceed with your question.

Okay. Thank you for taking the question. I think last quarter your guidance was for SaaS to account for about 45% of that new and upsell business because of the expected contribution from the U.S. Federal deals. Given how much higher SaaS was relative to your guidance this quarter, is it fair to assume that the Fed demand was not as strong as you expected? And if so, what happened to those deals?

The growth driver this quarter was overall the enterprise business. When you look at the 59%, it was driven by the enterprise business. It's a strong reflection of how customers in the enterprise business are adopting SaaS. When you look at the federal industry as a whole, we definitely see the opportunity there, but it's still small, mid-single-digit percentages out of ARR. When we look at the opportunity, we feel very confident about our ability to grow there.

Our next question comes from the line of Fatima Boolani with Citi. Please proceed with your questions.

Hi, thanks for taking my questions, and our prayers are with you and the entire employee base in the conflict zone. Yaki, a broader picture question actually; we've been hearing a lot about data protection, data security posture management, and all the new monikers that are coming up, as well as more traditional backup and recovery vendors on the infrastructure side, talking a lot about the importance of data protection and data recovery. I wanted to get your perspective on how you are interfacing with buyers as buying psychology changes around data protection? I wanted to get your sense of how those conversations are changing for you, if at all, and if these changes in the competitive landscape are benefiting you in a way in providing a spotlight to what you've been saying all along with respect to the importance of data protection?

I think that we just don't see the backup and business continuity in data protection. We are much more focused on data security. But people understand that they need to protect valuable data. Regarding posture management and all of this stuff, organizations understand very well that this is the first time that we are benefiting from other people doing marketing. To solve the problem, you need these three use cases and need the metadata, which is very hard to do. Everything really eventually to solve the problem needs to be under one umbrella of the data security platform. In most breaches, people are doing lateral movement between a data store, and you need to enrich your data. We definitely see that the marketplace understands that they need one big platform capable of classifying everything in one place and across repositories at scale, to have the profile of how people and identities are using data and implement reliable automated remediation. We are excited to have a tailwind from the marketing that other vendors are doing.

Our next question comes from the line of Chad Bennett with Craig-Hallum. Please proceed with your question.

Great. Thanks for taking my question. So, just on, I know it's early, but just in terms of the type of customer converting from on-prem subscription to SaaS, I think you've talked before about that 25% to 30% uplift. I think you gave a couple of examples on the call already. But is there any commonality in terms of where the on-prem subscription customer is in their license journey when they're converting? And are you seeing significant cross-sell or upsell on that conversion from a license standpoint? Or is the hope, like with a lot of conversion stories, that once you get them to SaaS like-for-like product, that the whole cross-sell and upsell just become easier and kind of accelerated?

Chad, I think that's a very good question. Well, I'll start by saying that the SaaS offering is so much better for our customers, making it a no-brainer for them. We're seeing that with the amount of conversions that are happening naturally. When conversions happen, we can get an uplift in the number of licenses that they buy because we're selling the platform. They don't have the opportunity to buy individual licenses. We can get an uplift in the fact that the number of users goes up, and we can get an uplift in their ability to consume more of the product. It really depends on the situation of the customer, where they are in terms of the renewal, whether they want to speed it up and/or wait for the actual renewal date to place. There’s no one straight answer on how it happens, but once we get them to the SaaS offering, their ability to see value and the simplicity of the usage of the product gives us a tremendous opportunity to continue to sell them more and more licenses. So, I would say there's no one straight answer on how it happens, but at the end of the day, it just works in our favor to get them to SaaS with good confidence in our pricing methodology so far.

Our next question comes from the line of Rob Owens with Piper Sandler. Please proceed with your question.

Great. Thank you for taking my question. I was curious if you could comment on just what the channel response has been regarding the move to SaaS, and are you getting the breadth of channel participation that you would hope in new transactions?

Yes. The channel reaction is usually just in direct correlation to the customer reaction. They definitely understand it’s much easier to sell, and it requires significantly less professional services. This is something that they need to adapt to. The overall thing with this platform is tremendous automation, but we're definitely getting a lot of help from the channel to take this platform to market.

Our next question comes from the line of Jason Ader with William Blair. Please proceed with your question.

Yes. Hi, guys. I wanted to ask you for clarification. You said a 12% headwind to revenue growth in Q3, I believe. That's 12 percentage points, correct?

Correct.

Okay. And then, just on the kind of following up on the channel question, can you remind us how you go to market, how much is direct, how much is indirect, and then where are you seeing the most success right now in terms of finding new customers?

We sell 100% through the channel, but our outside sales force really does all the heavy lifting of doing the risk assessment, talking to the customers, and explaining where the risks are. The channel helps us in getting the meetings and closing the deals, but all the hard work in between is done by our outside sales force. With our SaaS offering, it opens up new markets, new territories, and new industries to customer opportunities that we didn't have before. The reception that we have received to-date on the SaaS offering has been positive, and we expect that to continue as we clear through the toughest part of the transition, introducing every new customer with a quote that is SaaS-only and not really on-prem subscription.

Our next question comes from the line of Joseph Gallo with Jefferies. Please proceed with your question.

Hey guys, thanks for the question. I appreciate the AI commentary. You have a large M365 footprint. Can you just give us an updated size and growth profile of that business? And then maybe just to be clear, given the rollout of Copilot this week, does your existing solution capture that opportunity now, or is it more just that you guys are perfectly positioned to capture that opportunity long-term?

Regarding the product, in terms of preparing an organization for AI, it's already here. It's just the basic value proposition: understand what data is critical, make sure that only the right people can access the right data, and alert and stop any abnormal behavior. It's the basics. Without it, you can't use it securely. This is 100% us.

Just to touch on the first part of the question, when we look at the Office 365 contribution, it's definitely become a significant tailwind for us going forward. But if you go back to our Investor Day in March, we actually showed in one of the slides that our penetration within the overall 365 opportunity was, at the time in March, 1%; it hasn't grown too much since then. The opportunity going forward is vast, and we see positive reception from our customers when we sell that license.

Our next question comes from the line of Rudy Kessinger with D.A. Davidson. Please proceed with your questions.

Hey, great. Thanks for taking my question. Guy, what was SaaS as a percentage of the mix if you exclude federal in Q3? And then just how much higher is federal as a percentage of new and upsell ARR in Q3 relative to Q4 in the other quarters?

As I said before, the actual driver this quarter was the enterprise business. We are not FedRAMP certified yet, so we didn't have SaaS sales that were sold under the federal business, but we do expect to have FedRAMP for next year's cycle, which can become a significant opportunity for us. The amount of malicious actors that have happened in the last couple of months has been tremendous, and our product fits very nicely in that space. We feel that we can capitalize on that opportunity and grow our ARR from that industry moving forward.

Our next question comes from the line of Joshua Tilton with Wolfe Research. Please proceed with your question.

Hey guys, thanks for sneaking me in. My thoughts and prayers are with your employees and just all the people of Israel. I'm actually going to sneak in two-and-a-half questions really quickly. My first question is just how should we think about the implied Q4 net new ARR seasonality, and are the macro impacts baked into Q4 worse than they were a quarter ago? And on the AI front, which is my second question, why won't Microsoft offer these capabilities? And if so, do you expect this to bring you into more competition with them going forward?

In terms of Microsoft, we are the only company in the world today that takes three streams of Metadata: the permissions, the content, and the activity to build this robot for rightsized access. We have to build completely different types of solutions to do that. I just think that for a long time, we can leverage our mode and maintain a tremendous competitive advantage in this space.

Our philosophy on guidance hasn't changed. We're definitely thinking about the guidance in the same way we've talked about it throughout the year. In Q3, we definitely saw things stabilize compared to previous quarters, which is a good sign for us. Our assumptions in terms of guidance have stayed the same, and we believe we are set up well for having our largest Q4 in terms of seasonality.

Our next question comes from the line of Shelby Seyrafi with FBN Securities. Please proceed with your question.

Yes, thank you. Your headcount really was flattish in terms of growth in Q1 and Q2, and looks like it grew around 50, which is a decent pace for the first time in like a year. My question is, is this a sign that the environment is better for you? You talked about deal scrutiny, etc. But at least is it better and therefore you're hiring more? And related to this, can you talk about your headcount growth expectations going forward?

We know how to do this transition, and it was very important for us when we did it to focus on just the right moving parts to ensure it works. We definitely see more stability in the transition. Despite the economic headwinds, we see inevitable demand for data security. This is something organizations need, and we have a lot of pipeline in what we can do in terms of a roadmap of features and products in a massive total available market. We need to cover it with a focus and make sure that our customers succeed while building the organization. The business is performing, and we are investing against the massive opportunity.

If you go back to our last quarter’s earnings call, you could hear in the commentary that we talked about the fact that we're hiring. The increase in headcount was part of our planning. We want to continue to increase headcount but in the right way, ensuring that we generate increased productivity. We believe we can do that going forward. It's a balancing act of increasing headcount at the right pace and location while also improving our leverage as we have done, evident from the ARR contribution margin now at 11.1%, an increase of 750 basis points year-over-year.

Our next question comes from the line of Shrenik Kothari with Robert W. Baird. Please proceed with your question.

Hey, thanks for taking my question. Again, thoughts and prayers to your entire team out there. Just to follow up on the previous Microsoft question, Yaki, you mentioned the tailwinds and growth runway in implementing the access controls and governance policies. There was a previous question on the competitive advantage versus Microsoft as well. Just trying to understand, as the significance of data security rises, especially in the realm of Generative AI, where you're anticipating kind of more traction particularly for data access governance, is it the right way to think that Varonis is focusing on a comprehensive data protection platform, including data security and access control governance versus what Microsoft is offering, which is a more narrow DLP? Is this the competitive advantage you guys have, and is that the right way to think about the competitive dynamic from your perspective?

Yes, it's essentially completely different. What we provide is automated outcomes regarding access control classification and threat detection. We have very little overlap and many good strategies to work with their DLP features and other offerings, but it’s different. We work well with them and have a good partnership regarding generative AI, which serves as the building blocks. If you want to use generative AI the right way and not introduce a lot of risks that can lead to disaster, you need to use our solution to ensure that you are ready. We deliver AI features using technologies with large language models. We are the foundation to help businesses use it to extract value safely from their data.

Our next question comes from the line of Hugh Cunningham with TD Cowen. Please proceed with your question.

Hey guys, thank you for taking my call, and I'll echo that. Everyone here on our team sends our thoughts and prayers to you and your families, your friends, and your coworkers at Varonis.

Thank you.

I do have two quick ones. The first one is the 25% to 30% uplift that we're talking about; that's just on pricing of subscription versus SaaS. That doesn't include any assumptions that you mentioned before, more licenses and users going up, anything like that.

Correct. It's apples to apples only.

Okay. And then, these conversions of existing customers, are these taking place at the end of their existing contracts? What I'm trying to figure out here is if when you quote a number, $10 million or $12 million, that number includes a sort of accelerated recognition or the initial period in that subscription. Is that right?

No, that relates only to the deals within the quarter.

Our next question comes from the line of Brian Colley with Stephens. Please proceed with your question.

Hi guys, thanks for taking my question here. Can you talk about how the SaaS platform has impacted the pipeline for new logos, as well as sales cycles for those new customers? I'm just curious if you're seeing an acceleration in new logo adds or sales cycles?

When we look at new customer ads, we've definitely seen positive signs this quarter. The ability to sell SaaS to new customers opens up opportunities that we didn't have before with the on-prem subscription. The signs we're seeing are healthy and positive, giving us the ability to demonstrate value. We're past the challenging part of the transition where some of the quotes were introduced to customers in the past as on-prem subscription. Now, we’re starting with SaaS as part of the quotes, and it's been very well received because our SaaS product's value is much greater than that of the on-prem subscription.

That's the end of our Q&A session. I'd like to hand it back to management for closing remarks.

Thanks for your interest in Varonis. I look forward to meeting you all at our conferences this quarter.

Ladies and gentlemen, this does conclude today's teleconference. Thank you for your participation. You may disconnect your lines at this time and have a wonderful day.