Varonis Systems Inc Q3 FY2025 Earnings Call

Greetings. Welcome to Varonis Systems' Third Quarter 2025 Earnings Conference Call. Please note, this conference is being recorded. I will now turn the conference over to Tim Perz of Investor Relations. Tim, you may proceed. Thank you.

Thank you, operator. Good afternoon. Thank you for joining us today to review Varonis' third quarter financial results. With me on the call today are Yaki Faitelson, Chief Executive Officer; and Guy Melamed, Chief Financial Officer and Chief Operating Officer of Varonis. After preliminary remarks, we will open the call to a question-and-answer session. During this call, we may make statements related to our business that will be considered forward-looking statements under federal securities laws, including projections of future operating results for our fourth quarter and full year ending December 31, 2025. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned, forward-looking statements, and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation for the most directly comparable GAAP financial measures is also available on our third quarter 2025 earnings press release and our investor presentation, which can be found at www.varonis.com in the Investor Relations section. Lastly, please note that a webcast of today's call is available on our website in the Investor Relations section. With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Faitelson. Yaki?

Thanks, Tim, and good afternoon, everyone. We appreciate you joining us to discuss our third quarter performance. We finished the third quarter with 76% of our total company ARR coming from SaaS, which means that we have now completed the SaaS transition in less than 3 years and more than 2 years ahead of plan. In February, on our first quarter earnings call, we noted that Varonis is a story of 2 companies, and this remains true today. Our SaaS business drives our momentum as SaaS customers benefit from the simplicity and automated outcomes of the platform, while our on-prem subscription business serves as a drag on total company ARR growth and masks the strength of our SaaS business. Let's start by reviewing our third quarter results. ARR increased 18% year-over-year to $718.6 million. However, in the final weeks of the quarter, we experienced weaker-than-expected renewals in our federal business as well as our non-federal on-prem subscription business, which resulted in Q3 coming below our expectations. As a result of continued underperformance in the federal vertical, we will be reducing the size of the team until we see improvement. Now that we have completed our SaaS transition, we are announcing the end of life of our self-hosted solution as of December 31, 2026. We expect this to result in increased uncertainty with our remaining on-prem subscription business going forward. In each of the first 2 quarters of this year, we saw improvement in our gross renewal rate across the business, which is why the reduction in the renewal rate that happened in the final weeks of Q3 was unexpected. To account for this recent change as well as our decision to end of life our self-hosted solution, we are incorporating additional conservatism into our guidance and have assumed even lower renewal rates in our on-prem subscription business for the fourth quarter. We are also taking thoughtful and prudent steps to manage expenses across the business, which includes a 5% reduction in headcount in order to reallocate our resources where we see the highest return on investment. Now I will review our results and updated guidance in more detail shortly. Despite the softness we experienced in our on-prem business, we again saw strong demand for our SaaS platform during Q3. This is happening because customers are able to secure their data with significantly less effort. Within our SaaS portfolio, Varonis for cloud environments continues to show traction during Q3, which was driven by the investment we have made in our platform to expand to additional use cases and protect many more platforms. Our ability to protect cloud data represents a significant growth opportunity for us, as we're just beginning to scratch the surface. Since the transition is complete, our reps can put more focus on new business and upselling existing SaaS customers, as we believe this additional focus on upsell will help us unlock this market potential. Now I would like to take a step back from our near-term results and discuss the opportunities we are excited about moving forward. As I have said in prior quarters, bad actors are not breaking in; they are logging in. Once an identity is compromised, there is no perimeter, and companies need a sophisticated data security platform to keep their data safe. Varonis takes a data-first approach and helps companies locate their sensitive data, visualize who has access to it, automatically lock it down, and then automatically detect and respond to threats on it. Performing only 1 or 2 of these tasks is insufficient to secure data. What sets Varonis apart is our ability to successfully do all 3 of these tasks on data everywhere. Our SaaS platforms and MDDR have significantly reduced the amount of effort and resources needed to secure data. AI continues to put a huge spotlight on the need for data security, and the Chief Information Security Officers that I speak with want to ensure 3 key things: they won't have a data breach, they won't face compliance fines, and they want to secure their data to enable the safe use of AI in an effortless way. Addressing this problem has always been difficult, and in the age of AI, it becomes even harder to secure data without sophisticated automation. In the third quarter, we continued to see demand from companies looking to protect their data to safely realize productivity benefits of Copilot, and we believe we are still in the early stages of capitalizing on this tailwind. In July, we announced an update to our strategic partnership with Microsoft and are making significant investments to deepen our integration with them to better enable customers to securely adopt Copilot over time. We believe these investments will ultimately better position us to capitalize on this massive opportunity. In July, we announced the release of our Next-Gen Database Activity Monitoring or DAM, which stems from the acquisition of Cyral. Varonis Database Activity Monitoring provides a cloud-native agent-less solution that offers next-generation database security and compliance for the AI era. Unlike legacy database activity monitoring tools that are slow to deploy and offer limited compliance value, our next-gen DAM solution is part of our broader SaaS platform, which delivers rapid deployment, real-time threat detection, automated remediation, and deep visibility into sensitive data access. This provides customers with automated security outcomes on any kind of data using our unified SaaS platform. Earlier this month, we introduced Varonis Interceptor, which offers customers a breakthrough AI-native e-mail security solution designed to stop data breaches before they start and was based on the recent acquisition of SlashNext. The introduction of Interceptor is a natural evolution of our platform and significantly expands our total addressable market by connecting the dots between e-mail, identity, and data. We believe we will dramatically increase the value of our MDDR service and help customers stop threats even earlier in the attack chain. With that, I would like to briefly discuss a couple of key customer wins from Q3. We continue to see strong demand for new customers, and one of these was a fintech company that wanted to replace its limited DSP endpoint tools with a data security platform. The incumbent classification vendor could not scale, failed to provide forward and complete classification scale, and also failed to automatically remediate risk or detect threats. Varonis was able to quickly discover overexposed PII data and credentials in plain text that were surfaced by Copilot users. Varonis also automatically remediated this exposure and provided a current and complete view of their cloud data under a single dashboard. They purchased Varonis SaaS with MDDR for hybrid environments and Copilot Azure, AWS, ServiceNow, Snowflake, and databases. We also continue to see our self-hosted customers looking to convert to SaaS. This quarter, one example of this is a global financial services company that has been a Varonis customer since 2010. As a heavily regulated organization, they have historically used Varonis for compliance and auditing use cases. They wanted additional visibility into their IaaS data and wanted to simplify the ongoing maintenance of their deployment under one unified SaaS tenant. They evaluated a number of DSPM vendors, but they did not provide the breadth of support and automated outcomes that Varonis did. This organization upgraded to Varonis SaaS for hybrid environments and Copilot, Active Directory, Exchange Online, Edge, UNIX, privacy automation, and Varonis for IaaS. In summary, although we are disappointed with the performance of our on-prem business during the final weeks of the third quarter, we continue to be encouraged by the strong demand we see for our SaaS platform, which now represents 76% of total company's ARR. This demand is driven by the automated outcomes and scale that it provides, as well as customer interest in deploying AI initiatives and securing data in the cloud. With that, let me turn the call over to Guy. Guy?

Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. As Yaki mentioned, we see Varonis as 2 companies: our healthy SaaS business, which now represents 76% of our total ARR or approximately $545 million, and our on-prem business, whose weaker performance is masking the underlying growth of SaaS in total company results. I will expand on this shortly, but let me first recap our Q3 results and update guidance. In the third quarter, ARR increased 18% year-over-year to $718.6 million. Our quarterly results did not meet our expectations due to weaker-than-expected renewals in our federal and non-federal on-prem subscription business in the final weeks of the quarter. In each of the first 2 quarters of this year, we saw an improvement in our gross renewal rates across the business, which is why the reduction in the renewal rate in the final weeks of Q3 was unexpected. Since it is unclear if this reduction is specific to the customers that were up for renewal in Q3 or will be applicable to the population of remaining on-prem subscription customers, we have assumed a lower renewal rate in the fourth quarter and expect continued variability in our on-prem renewal rate going forward. As it relates to our guidance, we are now incorporating additional conservatism for the fourth quarter to account for our weaker Q3 results and the decision to end of life our self-hosted solution. At the same time, our SaaS business remains very healthy, even when excluding the impact of conversion, and we continue to see the SaaS net revenue retention trend at very healthy levels. We expect that this demand will continue to be the growth driver of our business going forward. This is driven by 3 factors: one, continuation of the healthy new customer demand that we've seen since the introduction of our SaaS platform; two, an increased focus on the SaaS upsell movement starting next year due to the completion of the SaaS transition; and three, the investments that we've made in the Microsoft partnership and the acquisition of Cyral and SlashNext that we expect will start to generate returns. In the third quarter, ARR was $718.6 million, increasing 18% year-over-year. Year-to-date, we generated $111.6 million of free cash flow, up from $88.6 million in the same period last year. In the third quarter, total revenues were $161.6 million, up 9% year-over-year. SaaS revenues were $125.8 million. Term license subscription revenues were $24.8 million, and maintenance and services revenues were $10.9 million, as our renewal rates remained over 90%. Moving down to the income statement, I'll be discussing non-GAAP results going forward. Gross profit for the third quarter was $128.3 million, representing a gross margin of 79.4% compared to 85% in the third quarter of 2024. Our gross margin continues to track ahead of our expectations, and we feel very confident in our long-term target set at our Investor Day. Operating expenses in the third quarter totaled $128.1 million. As a result, third quarter operating income was $0.2 million, or an operating margin of 0.1%. This compares to an operating income of $9.1 million, or an operating margin of 6.1% in the same period last year. Third quarter ARR contribution margin was 16.3%, up from 15% last year. During the quarter, we had financial income of approximately $10.1 million, driven primarily by interest income on our cash, deposits, and investments in marketable securities. Net income for the third quarter of 2025 was $8.4 million or net income of $0.06 per diluted share compared to a total of net income of $13.8 million or net income of $0.10 per diluted share for the third quarter of 2024. This is based on 134.1 million diluted shares outstanding for Q3 2025 and 134.7 million diluted shares outstanding for Q3 2024, respectively. As of September 30, 2025, we had $1.1 billion in cash, cash equivalents, short-term deposits, and marketable securities. For the 9 months ended September 30, 2025, we generated $122.7 million of cash from operations compared to $90.9 million generated in the same period last year, and CapEx was $8.7 million compared to $2.3 million in the same period last year. Turning now to our updated 2025 guidance in more detail. For the fourth quarter of 2025, we expect total revenues of $165 million to $171 million, representing growth of 4% to 8%. Non-GAAP operating income of breakeven to $3 million and non-GAAP net income per diluted share in the range of $0.02 to $0.04. This assumes 133.4 million diluted shares outstanding. For the full year 2025, we now expect ARR of $730 million to $738 million, representing growth of 14% to 15%. Free cash flow of $120 million to $125 million. And total revenues of $615.2 million to $621.2 million, representing growth of 12% to 13%. Non-GAAP operating loss of negative $8.2 million to negative $5.2 million. Non-GAAP net income per diluted share in the range of $0.12 to $0.13. This assumes 134.8 million diluted shares outstanding. Lastly, as we announced today, our Board has authorized a $150 million share repurchase program. We're able to make this announcement due to our strong balance sheet with over $1 billion in liquidity and our healthy free cash flow generation. In summary, while we are disappointed with the performance of our on-prem business during the third quarter, we remain confident in the performance of our SaaS business. We will continue to thoughtfully manage our business, which we believe will ultimately benefit our customers, company, and shareholders in the long term. With that, we would be happy to take questions. Operator?

Our first question comes from Meta Marshall from Morgan Stanley.

Maybe a question for me is just in terms of kind of you guys had just received FedRAMP high authorization for the SaaS platform. And so I guess just what went into kind of some of the decision to kind of terminate some of the people on the federal team? And just how do you kind of pursue that opportunity going forward?

We have the FedRAMP moderate, but we just don't have the empirical evidence that, in terms of when we're looking at all of the investment, this is the place that we need to invest in. We said all along that it doesn't behave like the enterprise business. And we haven't figured out why the federal continued to underperform. It's just the result that we are reducing the footprint of our federal team and regrouping and reevaluating the strategy there. The data there is important, but we see when we just move these customers to SaaS, it's just a tremendous value proposition with all the automation, and we believe that the database activity monitoring and the e-mail is very strong and just want to mainly invest in the place that we can move these customers to SaaS as fast as possible.

Our next question is from Matt Hedberg from RBC Capital Markets.

Yaki, was there anything you heard that was consistent for why the on-prem deals didn't renew? I mean, I guess, was there anything competitively? And then, Guy, you noted SaaS NRR trends remain at healthy levels. I wonder if you could put a finer point on what level that might imply.

Matt, so the win rates stayed the same. We have more than 75% of our ARR coming from SaaS, and the SaaS platform is performing very well. We identified that some of our apps were very focused on the SaaS customers. Unfortunately, they didn't have the account management trigger for the last leg of the on-prem customers, primarily when they are single-threaded and not using the full Varonis platform on-prem. You know our methodology of find, fix, alerts. Find the critical data, do the remediation and do the threat detection. We're just going back to the basics and make sure we are taking care of these customers in the right way, demonstrating the value of SaaS almost treating them as a new sales campaign and just not assuming that because there are good signs and positive conversations, they will just move on. When we look at it, there is just not one common thread. There is not one common theme why this on-prem customer didn't renew. This is why we are just very careful. But I think that what we have seen more than anything else that this is clearly a tale of 2 companies; this automated platform with just all the coverage that is very easy to take all the rest of the integration. Many customers want DA Cloud, and when we are competing with what we call DSPM ankle biters, we have very, very high win rates against these on-prem customers.

And Matt, regarding your NRR question, as Yaki mentioned, there are definitely 2 companies right now in Varonis. We talked about that in the Q4 earnings call about the fact that the SaaS business is strong. When we look at the results in Q3, I think the overall on-prem subscription business is somewhat dragging and masking the healthy business that we have in SaaS. The SaaS net revenue retention is continuing to be in very healthy levels and well ahead of the total company NRR. We do disclose the NRR number on an annual basis, and we will provide the SaaS NRR at the end of Q4. Just to remind you, the conversion uplift is not included in that calculation, so it really reflects our ability to go back to our SaaS customers and continue selling them additional licenses. We have plenty to sell to those customers with the amount of platforms that we have. So we're extremely encouraged by the numbers that we see there, and we feel very good about the SaaS business.

Our next question is from Fatima Boolani from Citigroup.

Guy and Yaki, you've sort of identified that this non-renewal or rather churn on an enterprise customer presumably was maybe more of an isolated event, but you are being prudent and you are frankly taking a hatchet to your ARR guidance for the year. So I'm wondering, in the 24% of the ARR base that is not SaaS, what are some of the granular assumptions or thought processes you're reflecting to give us a better sense that, hey, we've kind of hit the floor on something like this happening again and frankly, for most of next year, ahead of which maybe customers are going to have an air pocket in terms of their decision-making. So can you help us through some of that in terms of how you're putting parameters on the risk to the 24% of ARR that is not SaaS?

When you look at the fourth quarter, I'll talk about the fourth quarter first, and then I'll give you some color on kind of how we're thinking about 2026. The fourth quarter is really the largest quarter of the year, and we want to wait and see how the business performs before providing really a formal look into 2026. I will tell you that if we had the same renewal rate that we saw for the on-prem subscription business in H1 2025 and the same renewal rate that we saw for the full year 2024, we would have raised our full year guidance. This reduction of guidance is isolated to the on-prem subscription and the fact that it behaved unpredictably, especially in the last 2 weeks of the quarter. When we were going throughout the quarter, we didn't see any change, and we really saw this happen in the last 2 weeks of the quarter. That's why we want to evaluate when we see in Q4 and take into consideration whether this was a one-time event in the on-prem subscription or if this is much more of a trend. From a guidance perspective, we baked in additional conservatism because we want to make sure that we account for this behavior, along with the fact that we announced the end of life on the on-prem subscription. So we are factoring both of those things into our guidance. Based on what we see in Q4, we will take that into consideration when we look to 2026.

Our next question is from Joshua Tilton from Wolfe Research.

Can you guys hear me okay?

We can, yes.

Awesome. I have a question. I understand what occurred during the quarter, but I'm still a bit unclear on the reasons behind it. From your viewpoint, what led to some of the lower-than-expected renewals in the on-prem business for both federal and non-federal sectors? Additionally, on the federal side, was this related to the shutdown? And for the non-federal side, were customers informed about the impending end of life, or did the announcement come after the quarter?

We heard you scrambled at the end, but I think I got the gist of the question. I want to give some color on what has happened in Q3. As it relates to this quarter, we saw multiple factors come up, but we didn't identify any big theme that relates to our customers that did not renew on the on-prem subscription renewals. We identified sales process issues on the conversions that weren't related to the contracts and the documentation that we've discussed a lot in the past, and we are going back to basics to address these issues. We are also seeing some additional budgetary scrutiny from customers this quarter, but it's hard to say definitively if that was a factor because it happened so late in the quarter. As you mentioned, we had the federal underperformance. I can tell you that one thing that was clear to us is that we didn't see a change in our competitive win rates, and we're still in discussions with some of these customers that did not renew.

Some teams were primarily focused on classification and audit without fully implementing our find, fix, alert methodology. In certain situations, the core of the sales process was overlooked, where a proof of concept and subsequent quarterly business review were essential to demonstrating value, along with an executive briefing that covered our roadmap. Not all teams adhered to this approach. This reflects the distinction between two types of companies, but most are now part of the SaaS model. For some teams, engaging with SaaS customers is easier, and we aim to ensure we manage their needs effectively as we navigate the final phase of this transition.

Our next question comes from Joseph Gallo from Jefferies.

Should we expect you to ease on that 25% to 30% average selling price uplift for conversions? Or is there anything you can do to further incentivize the on-premise customers remaining to move to SaaS? And then just in your conversations with customers, is there any sense of the number or percentage of business that maybe would never be willing to or can't move to SaaS?

We are just uncovering every stone here as we said. There is not one thing. This is something that until now has just worked extremely well. It was a surprise in the last 2 weeks of the quarter. So we just need to see how it will play out.

When we look at the Q1 and Q2 renewal rates in 2025, we saw that renewal rate increase. So I think when we're looking at the Q3 renewal rate on the on-prem subscription coming down, we're trying to understand if this was a one-off or if it's something that requires more attention going forward. That's why we reduced the guidance to factor in additional conservatism. When we look at the Q4 results, we can identify for 2026 what is the right rate to assume going into the year. We're taking proactive measures, including the 5% headcount reduction and adjusting some of the costs to better align with the top line and factoring that conservatism on the guidance. We're trying to do everything correctly and actively addressing that to make sure we uncover every stone going forward.

Our next question is from Brian Essex from JPMorgan.

It's Brian from JPMorgan. I guess maybe, Yaki, for you or maybe, Guy, if you want to pick this one up. On the SaaS business, it sounds like that business is still very healthy and kind of as expected. Can you give us a sense of where you think ARR could shake out for the end of the year? I think if we use like your previous 82% guide, that puts us in the neighborhood of, I don't know, $615 million at the midpoint, somewhere in that neighborhood. But just a sense of what to expect on the SaaS side? As a follow-up, contribution from SlashNext Cyral, what do you expect that could contribute for the rest of the year?

When we talked about growing 20-plus percent, we feel very confident in our ability to grow 20-plus percent on the SaaS business. The behavior of the on-prem subscription renewals was a surprise to us, and we're trying to address that. But when I look at the SaaS business, it's acting very strong and healthy, both in the value that we provide to our customers and in our ability to go back to those customers and sell them additional licenses and additional platforms. Obviously, there is that headwind from the on-prem subscription business, but I would say that when we look at our plan to end the year with 83% of our total ARR coming from SaaS, the performance of the business gives us confidence that we can continue to grow 20-plus percent in that business. That's part of the reason that we announced the end of life being at the end of next year. We want to have this on-prem subscription business in a confined time frame to be able to be 100% SaaS and show all the benefits of the platform to our customers.

Regarding SlashNext, we believe that it's a very good acquisition for us and a natural extension for our customers. Many of these attacks happen due to sophisticated social engineering from a trusted source, and SlashNext has an exceptional detection engine for that. It has a strong multiplier effect with our MDDR service. We just started to introduce it and the reaction has been very good. Regarding the database activity monitoring, we can replace the two incumbents. People want to consolidate around one data security platform for security, compliance, and ensuring AI usage. We feel that these are two very strong additions to our platform that work very well and integrate organically within our sales motion.

Our next question comes from Rudy Kessinger from D.A. Davidson.

It's been asked, but I'm just curious, the end of life for self-hosted by the end of next year, and you just had lower renewal rates than you were expecting in Q3. I mean, do you feel at all that this push to migrate to SaaS is in any way alienating a certain portion of your customers who are just never going to move to SaaS? And if so, I guess, why do that? I imagine some of those customers might be very large strategic customers who could have very high lifetime values. Why not let them have a longer time frame to migrate to SaaS or remain on term license if they want to?

We wanted to move everybody to SaaS and we said to get rid of the on-prem solutions. We've always said that it's 10% of the effort and an order of magnitude, 10x more value. Just as a business to operate, everything we're doing with engineering and the value customers are getting, the integration of all our products, the way we provide support requires the right platform, the right business model, and the right operating model. All along, the thought process was to move to a 100% SaaS business, and we just want to also make sure that we are accelerating it because we believe this is one of the most important ingredients for our salespeople. We want their focus to be on receiving value from customers, selling more DA Cloud doing very well this year, selling the SlashNext product, database activity monitoring, and many more. We want a low-touch support model and MDDR and provide all the automations; the whole operating and business model of the company and the value proposition is geared towards that.

If we go back to our Investor Day that we held in Q1 of 2023, we defined a transition to be complete when we get anywhere between 70% to 90% of our ARR coming from SaaS. This is actually the first quarter that we are above that 70% threshold, finishing at 76%. If you go back to conversations we've had, we always said that we do not want to maintain two types of code, and that there are a ton of financial benefits for the organization to only have SaaS. As Yaki mentioned, there's a tremendous difference in value provided to customers that are on SaaS versus those on the on-prem subscription. If you look at the benefits for the customers and if you look at the financial benefits for the organization, we do not want to be stuck between the on-prem subscription business and the SaaS business, which is performing well. The on-prem subscription renewals acted unpredictably in Q3, which is part of the reason we announced the end of life. We expedited that announcement, but really talking about the end of December next year. We will work with our customers to ensure their transition to SaaS benefits them. But we’ve mentioned all along, we didn't want to maintain two types of code, and there are significant financial benefits to the organization from not maintaining those two types of on-prem and SaaS, which is why we are focused on being purely SaaS.

Also, the ability of our sales force to provide effective account management is crucial to taking care of our customers in the right way. The whole company now primarily operates as a SaaS business.

Our next question comes from Roger Boyd with UBS.

Just to go back to Josh's question for a minute to just be clear, was there any change to how you're approaching renewals on maintenance and term license in the quarter relative to the second quarter or last year, and whether that maybe led to some of this unpredictability? I guess, the context is we had heard some anecdotes that you were maybe more heavily encouraging on-prem customers to move to SaaS or, in some cases, limiting the ability for customers to renew on maintenance. And just wondering if that at all was informed by this planned end-of-life on-prem business.

Going back to the reasons for the lower renewal rate of the on-prem subscription, we saw multiple factors. I don't think there was any one big theme that we can pinpoint as the reason for the on-prem subscription renewals behaving the way they were, especially when you look at Q1 and Q2 renewal rates where the company showed an increase. We did not expect that the Q3 renewals of the on-prem subscription would behave that way. Our sales force has been trying to convert customers in discussions with our customers since we announced the transition. We were able to move quickly because our reps were discussing this with customers. We believe that the benefits of having SaaS and MDDR greatly surpass those of being on the on-prem subscription. I don't know what you heard, but our sales team has been working with customers, and we'll continue to work to ensure they are provided with the best platform to offer, which is the SaaS plus the MDDR and all the functionalities that we have are not available on the on-prem subscription. We see a very healthy business under the SaaS platform, while the on-prem subscription acted in a way that surprised us, which is part of the reason we want to be 100% SaaS by the end of next year. We don't see this as something different in Q3 compared to Q2; multiple factors contributed to inform the lower renewal rate of the on-prem subscription. We talked about sales process issues, additional budgetary scrutiny, and obviously, the federal underperformance. But we didn’t see a change in competitive win rates, and we continue to be actively engaged with customers who didn’t renew.

Our next question comes from Jason Ader with William Blair.

So if customers are not renewing their on-prem subscriptions with Varonis and not moving to your SaaS, then what are they doing? Because obviously, you wouldn't think they'd want to be exposed if they've had Varonis data protection and all of a sudden, they don't have access to the technology anymore. So maybe just talk us through that, like what are they doing? And then separately, is there an element of compression in term contract duration at all because we saw that with another software company this morning where they saw some compression in term duration.

When we look at those on-prem subscription renewals, most of them didn't go anywhere. As I said before, we're in discussions with some of them. Many of these customers were single-threaded, meaning they were only protecting on-prem data with a single use case, and they weren't using the full platform that we have with our SaaS offering. Historically, we have converted these customers without many challenges, but we experienced issues in Q3 and cannot determine if it was a one-off issue or a new trend. This is the reason we want to see how Q4 behaves to gather additional insights on the rest of the non-SaaS business. In terms of duration, that wasn't impacted here. We analyzed that and found it did not have an effect.

Our next question comes from Mike Cikos from Needham & Co.

I'm trying to get a sense if there was anything unusual about this on-prem renewal cohort in the final weeks of the third quarter. I'm wondering if the renewal rates were really tied to a smaller subset of customers, i.e., the breadth of customers really skewed the renewal rates that we're discussing. Does that help explain why the team is uncertain on the impact of these renewal rates, possibly due to lack of observed data points? Secondly, have the on-prem renewal rates that we saw in the final weeks of Q3 persisted in Q4, now that we have October behind us? I'm just trying to get a sense of what's transpired in the following 4 weeks.

Let me address the second part of your question first. It’s important to note, and we've disclosed this in our SEC filings, that our business is back-end loaded. We closed a significant portion of our business in the last 3 weeks of the quarter. It's very hard to gauge how the renewal rate will behave in Q4 based on the current data points. During Q3, the business was on plan, but it was primarily in the final 2 weeks of the quarter that we experienced a decline in our renewal rate for the on-prem subscription business, which affected both federal and non-federal sectors. Hence, it's tough for us to bake in any assumptions, and from a guidance perspective, we never factor in positivity prior to observing it actually materialize. We tend to assume either the trend continues or worsens, which is what we did with this guidance.

There's no one thing. There is no one plan. In some cases, definitely, there are basic account management problems where customers used a small subset of the platform, and our reps assumed that in other situations they would automatically move to SaaS for the full hybrid offering. They had some positive discussions, but due to the limited usage of some deals, we need to ensure we have control over these scenarios.

Our next question comes from Erik Suppiger from B. Riley Securities.

Just can you remind us what your contribution from federal was and maybe what the contribution from the on-premise federal business? I think all the federal is probably on-premise. You specifically identified both your federal on-prem and the non-federal on-prem. Was there a difference in terms of the decline in renewal rates between those 2 categories? Or were they both down similarly?

The federal business has always been around 5% of our total ARR. From a guidance perspective going into Q3, we assumed a flat contribution going into the quarter, but we actually had a headwind related to the federal business that resulted from the renewals in that sector. We faced several million dollars of a headwind from the federal business, which is part of the reason we are making adjustments to the team. The renewal rate decline impacted both the federal and non-federal sides, which is why we reduced our Q4 numbers. If it was only the federal issue, I don't think we would have adjusted the full year guidance.

Our next question comes from Shrenik Kothari with Robert W. Baird.

Now that the conversion phase is largely complete for your initial target for the mix, with the announcement of the end of life, in light of your prior confidence in sustaining 20% top line growth, could you help triangulate what the underlying growth cadence looks like going forward? From the $545 million SaaS ARR core, how much is considered early stage with significant room for upsell and cross-sell next year, and how much is a little more mature with product adoption such as MDR? I just wanted to understand the underlying growth cadence into next year and after.

Again, it goes back to the tale of the 2 companies. When you look at the SaaS business, we definitely see that business acting strong. We believe in our ability to grow 20-plus percent with our SaaS business due to the momentum we're seeing with new customers and the strong net revenue retention we see with existing SaaS customers. Our plan is to end the year with 83% of our total ARR coming from SaaS. The strength of the business is apparent within the SaaS ARR, so we feel good about being able to continue to grow going forward. We're addressing the issues related to the on-prem subscription renewals and taking necessary measures there. The on-prem subscription renewals are masking the strength of our SaaS business.

Our next question comes from Junaid Siddiqui from Truist Securities.

As you expand your platform to cover adjacent use cases like SaaS and cloud infrastructure, I'm curious where is the source of that incremental budget that you are taking coming from? Are you seeing budget reallocation from existing security categories? Or is this tapping into new spending from customers?

We definitely see that customers have more budget for data security. It's important for them, and this is how we sell.

Ladies and gentlemen, this now concludes our question-and-answer session and does conclude today's teleconference as well. Thank you for your participation. You may disconnect your lines, and have a wonderful day.