Varonis Systems Inc 10-Q for FY2026 Q3
Varonis Systems Inc (VRNS)
10-Q
2026-11-04
For: 2026-09-30
View Original
Added on
November 05, 2026
About this 10-Q
Varonis Systems Inc filed this 10-Q on November 4, 2026, covering the quarter ended September 30, 2026 (FY2026 Q3).
Headline figures
Quarter ended September 30, 2026, as reported in this filing, compared with the same period a year earlier where the filing states it.
- Revenue
- $189.46M
- up 17.3% from $161.58M a year earlier
- Net loss
- $41.65M
- compared with a net loss of $29.94M a year earlier
- Diluted EPS
- -$0.36
- compared with -$0.26 a year earlier
UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549
____________________
FORM 10-Q
____________________
(Mark One)
| QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934 | |||||
For the quarterly period ended September 30, 2026
or
| TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934 | |||||
For the transition period from to
Commission File Number: 001-36324
____________________
(Exact name of registrant as specified in its charter)
____________________
| (State or other jurisdiction of incorporation or organization) | (I.R.S. Employer Identification No.) | |||||||||||||
| (Address of principal executive offices) | (Zip Code) | |||||||||||||
(877 ) 292-8767
(Registrant's telephone number, including area code)
Securities registered pursuant to Section 12(b) of the Act:
| Title of each class | Trading Symbol(s) | Name of each exchange on which registered | ||||||
____________________
Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities and Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. ý Yes ¨ No
Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§ 232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit and post such files). ý Yes ¨ No
Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company,” and “emerging growth company” in Rule 12b-2 of the Exchange Act.
| ý | Accelerated filer | ¨ | |||||||||
| Non-accelerated filer | ¨ | Smaller reporting company | |||||||||
| Emerging growth company | |||||||||||
If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ¨
Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). ☐
Yes ý No
As of October 30, 2026, there were 115,298,568 shares of common stock, par value $0.001 per share, outstanding.
TABLE OF CONTENTS
| PART I. | FINANCIAL INFORMATION | ||||
| Item 1. | Financial Statements | ||||
VARONIS SYSTEMS, INC. AND SUBSIDIARIES
CONDENSED CONSOLIDATED BALANCE SHEETS
(in thousands, except share data)
| September 30, 2026 | December 31, 2025 | ||||||||||
| (unaudited) | |||||||||||
| Assets | |||||||||||
| Current assets: | |||||||||||
| Cash and cash equivalents | $ | $ | |||||||||
| Marketable securities | |||||||||||
| Short-term deposits | |||||||||||
Accounts receivable (net of allowances of $ | |||||||||||
| Prepaid expenses and other short-term assets | |||||||||||
| Total current assets | |||||||||||
| Long-term assets: | |||||||||||
| Long-term marketable securities | |||||||||||
| Operating lease right-of-use assets | |||||||||||
| Property and equipment, net | |||||||||||
| Intangible assets, net | |||||||||||
| Goodwill | |||||||||||
| Other assets | |||||||||||
| Total long-term assets | |||||||||||
| Total assets | $ | $ | |||||||||
| Liabilities and stockholders’ equity | |||||||||||
| Current liabilities: | |||||||||||
| Trade payables | $ | $ | |||||||||
| Accrued expenses and other short-term liabilities | |||||||||||
| Deferred revenues | |||||||||||
| Total current liabilities | |||||||||||
| Long-term liabilities: | |||||||||||
| Convertible senior notes, net | |||||||||||
| Operating lease liabilities | |||||||||||
| Deferred revenues | |||||||||||
| Other liabilities | |||||||||||
| Total long-term liabilities | |||||||||||
| Stockholders’ equity: | |||||||||||
| Share capital | |||||||||||
1
Common stock of $ | |||||||||||
| Accumulated other comprehensive income | |||||||||||
| Additional paid-in capital | |||||||||||
| Accumulated deficit | ( | ( | |||||||||
| Total stockholders’ equity | |||||||||||
| Total liabilities and stockholders’ equity | $ | $ | |||||||||
The accompanying notes are an integral part of these condensed consolidated financial statements.
2
VARONIS SYSTEMS, INC. AND SUBSIDIARIES
UNAUDITED CONDENSED CONSOLIDATED STATEMENTS OF OPERATIONS
(in thousands, except share and per share data)
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| 2026 | 2025 | 2026 | 2025 | ||||||||||||||||||||
| Revenues: | |||||||||||||||||||||||
| SaaS | $ | $ | $ | $ | |||||||||||||||||||
| Term license subscriptions | |||||||||||||||||||||||
| Maintenance and services | |||||||||||||||||||||||
| Total revenues | |||||||||||||||||||||||
| Cost of revenues | |||||||||||||||||||||||
| Gross profit | |||||||||||||||||||||||
| Operating expenses: | |||||||||||||||||||||||
| Research and development | |||||||||||||||||||||||
| Sales and marketing | |||||||||||||||||||||||
| General and administrative | |||||||||||||||||||||||
| Total operating expenses | |||||||||||||||||||||||
| Operating loss | ( | ( | ( | ( | |||||||||||||||||||
| Financial income, net | |||||||||||||||||||||||
| Loss before income taxes | ( | ( | ( | ( | |||||||||||||||||||
| Provision for income taxes | ( | ( | ( | ( | |||||||||||||||||||
| Net loss | $ | ( | $ | ( | $ | ( | $ | ( | |||||||||||||||
| Net loss per share of common stock, basic and diluted | $ | ( | $ | ( | $ | ( | $ | ( | |||||||||||||||
| Weighted average number of shares used in computing net loss per share of common stock, basic and diluted | |||||||||||||||||||||||
The accompanying notes are an integral part of these condensed consolidated financial statements.
3
VARONIS SYSTEMS, INC. AND SUBSIDIARIES
UNAUDITED CONDENSED CONSOLIDATED STATEMENTS OF COMPREHENSIVE LOSS
(in thousands)
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| 2026 | 2025 | 2026 | 2025 | ||||||||||||||||||||
| Net loss | $ | ( | $ | ( | $ | ( | $ | ( | |||||||||||||||
| Other comprehensive income (loss): | |||||||||||||||||||||||
| Unrealized income (loss) on marketable securities, net of tax | ( | ( | |||||||||||||||||||||
| Income (loss) on marketable securities reclassified into earnings, net of tax | ( | ||||||||||||||||||||||
| ( | ( | ||||||||||||||||||||||
| Unrealized income (loss) on derivative instruments, net of tax | ( | ( | |||||||||||||||||||||
| Income on derivative instruments reclassified into earnings, net of tax | |||||||||||||||||||||||
| ( | ( | ||||||||||||||||||||||
| Total other comprehensive income (loss) | ( | ( | |||||||||||||||||||||
| Comprehensive loss | $ | ( | $ | ( | $ | ( | $ | ( | |||||||||||||||
The accompanying notes are an integral part of these condensed consolidated financial statements.
4
VARONIS SYSTEMS, INC. AND SUBSIDIARIES
UNAUDITED CONDENSED CONSOLIDATED STATEMENTS OF CHANGES IN STOCKHOLDERS’ EQUITY
(in thousands, except share data)
| Common stock | Additional paid-in capital | Accumulated other comprehensive income (loss) | Accumulated deficit | Total stockholders’ equity | |||||||||||||||||||||||||||||||
| Number | Amount | ||||||||||||||||||||||||||||||||||
| Balance as of December 31, 2024 | $ | $ | $ | $ | ( | $ | |||||||||||||||||||||||||||||
| Stock-based compensation expense | — | — | — | — | |||||||||||||||||||||||||||||||
| Common stock issued under employee stock plans | — | — | |||||||||||||||||||||||||||||||||
| Taxes related to net share settlement of equity awards | — | — | ( | — | — | ( | |||||||||||||||||||||||||||||
| Repurchase of common stock | ( | ( | ( | — | — | ( | |||||||||||||||||||||||||||||
| Unrealized loss on derivative instruments, net of tax | — | — | — | ( | — | ( | |||||||||||||||||||||||||||||
| Unrealized income on available for sale securities, net of tax | — | — | — | — | |||||||||||||||||||||||||||||||
| Common stock issued for debt conversion | — | — | — | ||||||||||||||||||||||||||||||||
| Net loss | — | — | — | — | ( | ( | |||||||||||||||||||||||||||||
| Balance as of March 31, 2025 | ( | ( | |||||||||||||||||||||||||||||||||
| Stock-based compensation expense | — | — | — | — | |||||||||||||||||||||||||||||||
| Common stock issued under employee stock plans | — | — | — | — | |||||||||||||||||||||||||||||||
| Taxes related to net share settlement of equity awards | — | — | ( | — | — | ( | |||||||||||||||||||||||||||||
| Repurchase of common stock | ( | ( | ( | — | — | ( | |||||||||||||||||||||||||||||
| Unrealized income on derivative instruments, net of tax | — | — | — | — | |||||||||||||||||||||||||||||||
| Unrealized loss on available for sale securities, net of tax | — | — | — | ( | — | ( | |||||||||||||||||||||||||||||
| Common stock issued for debt conversion | — | — | — | ||||||||||||||||||||||||||||||||
| Net loss | — | — | — | — | ( | ( | |||||||||||||||||||||||||||||
| Balance as of June 30, 2025 | ( | ||||||||||||||||||||||||||||||||||
| Stock-based compensation expense | — | — | — | — | |||||||||||||||||||||||||||||||
| Common stock issued under employee stock plans | — | — | — | ||||||||||||||||||||||||||||||||
| Taxes related to net share settlement of equity awards | — | — | ( | — | — | ( | |||||||||||||||||||||||||||||
| Unrealized income on derivative instruments, net of tax | — | — | — | — | |||||||||||||||||||||||||||||||
| Unrealized income on available for sale securities, net of tax | — | — | — | — | |||||||||||||||||||||||||||||||
| Common stock issued for debt conversion | — | — | |||||||||||||||||||||||||||||||||
| Settlement of capped call transactions | ( | ( | — | — | |||||||||||||||||||||||||||||||
| Net loss | — | — | — | — | ( | ( | |||||||||||||||||||||||||||||
| Balance as of September 30, 2025 | $ | $ | $ | $ | ( | $ | |||||||||||||||||||||||||||||
5
| Common stock | Additional paid-in capital | Accumulated other comprehensive income (loss) | Accumulated deficit | Total stockholders’ equity | |||||||||||||||||||||||||||||||
| Number | Amount | ||||||||||||||||||||||||||||||||||
| Balance as of December 31, 2025 | $ | $ | $ | $ | ( | $ | |||||||||||||||||||||||||||||
| Stock-based compensation expense | — | — | — | — | |||||||||||||||||||||||||||||||
| Common stock issued under employee stock plans | — | — | |||||||||||||||||||||||||||||||||
| Taxes related to net share settlement of equity awards | — | — | ( | — | — | ( | |||||||||||||||||||||||||||||
| Repurchase of common stock | ( | ( | ( | — | — | ( | |||||||||||||||||||||||||||||
| Repurchase of common stock through options, net | ( | ( | ( | — | — | ( | |||||||||||||||||||||||||||||
| Unrealized loss on derivative instruments, net of tax | — | — | — | ( | — | ( | |||||||||||||||||||||||||||||
| Unrealized loss on available for sale securities, net of tax | — | — | — | ( | — | ( | |||||||||||||||||||||||||||||
| Net loss | — | — | — | — | ( | ( | |||||||||||||||||||||||||||||
| Balance as of March 31, 2026 | ( | ||||||||||||||||||||||||||||||||||
| Stock-based compensation expense | — | — | — | — | |||||||||||||||||||||||||||||||
| Common stock issued under employee stock plans | — | — | — | — | |||||||||||||||||||||||||||||||
| Taxes related to net share settlement of equity awards | — | — | ( | — | — | ( | |||||||||||||||||||||||||||||
| Unrealized income on derivative instruments, net of tax | — | — | — | — | |||||||||||||||||||||||||||||||
| Unrealized loss on available for sale securities, net of tax | — | — | — | ( | — | ( | |||||||||||||||||||||||||||||
| Net loss | — | — | — | — | ( | ( | |||||||||||||||||||||||||||||
| Balance as of June 30, 2026 | ( | ||||||||||||||||||||||||||||||||||
| Stock-based compensation expense | — | — | — | — | |||||||||||||||||||||||||||||||
| Common stock issued under employee stock plans | — | — | — | ||||||||||||||||||||||||||||||||
| Taxes related to net share settlement of equity awards | — | — | ( | — | — | ( | |||||||||||||||||||||||||||||
| Unrealized loss on derivative instruments, net of tax | — | — | — | ( | — | ( | |||||||||||||||||||||||||||||
| Unrealized loss on available for sale securities, net of tax | — | — | — | ( | — | ( | |||||||||||||||||||||||||||||
| Net loss | — | — | — | — | ( | ( | |||||||||||||||||||||||||||||
| Balance as of September 30, 2026 | $ | $ | $ | $ | ( | $ | |||||||||||||||||||||||||||||
The accompanying notes are an integral part of these condensed consolidated financial statements.
6
VARONIS SYSTEMS, INC. AND SUBSIDIARIES
UNAUDITED CONDENSED CONSOLIDATED STATEMENTS OF CASH FLOWS
(in thousands)
| Nine Months Ended September 30, | |||||||||||
| 2026 | 2025 | ||||||||||
| Cash flows from operating activities: | |||||||||||
| Net loss | $ | ( | $ | ( | |||||||
| Adjustments to reconcile net loss to net cash provided by operating activities: | |||||||||||
| Depreciation and amortization | |||||||||||
| Stock-based compensation | |||||||||||
| Amortization of deferred commissions | |||||||||||
| Non-cash operating lease costs | |||||||||||
| Amortization of debt issuance costs | |||||||||||
| Amortization of premium and accretion of discount on marketable securities, net | |||||||||||
| Deferred income taxes, net | ( | ||||||||||
| Remeasurement of options to repurchase common stock | |||||||||||
| Changes in assets and liabilities: | |||||||||||
| Accounts receivable | |||||||||||
| Prepaid expenses and other short-term assets | |||||||||||
| Deferred commissions | ( | ( | |||||||||
| Other long-term assets | ( | ( | |||||||||
| Trade payables | |||||||||||
| Accrued expenses and other short-term liabilities | |||||||||||
| Deferred revenues | ( | ||||||||||
| Other long-term liabilities | |||||||||||
| Net cash provided by operating activities | |||||||||||
| Cash flows from investing activities: | |||||||||||
| Proceeds from maturities of marketable securities | |||||||||||
| Proceeds from sales of marketable securities | |||||||||||
| Investment in marketable securities | ( | ( | |||||||||
| Proceeds from short-term and long-term deposits | |||||||||||
| Investment in short-term and long-term deposits | ( | ( | |||||||||
| Acquisitions, net of cash acquired | ( | ( | |||||||||
| Purchases of property and equipment | ( | ( | |||||||||
| Capitalized internal-use software | ( | ( | |||||||||
| Net cash provided by (used in) investing activities | ( | ||||||||||
| Cash flows from financing activities: | |||||||||||
| Repurchase of common stock | ( | ( | |||||||||
| Payment of deferred consideration for acquisition | ( | ||||||||||
| Proceeds from options to repurchase common stock | |||||||||||
| Proceeds from employee stock plans | |||||||||||
| Taxes paid related to net share settlement of equity awards | ( | ( | |||||||||
| Repayment of convertible senior notes | ( | ||||||||||
| Net cash used in financing activities | ( | ( | |||||||||
7
| Increase (decrease) in cash and cash equivalents | ( | ||||||||||
| Cash and cash equivalents at beginning of period | |||||||||||
| Cash and cash equivalents at end of period | $ | $ | |||||||||
| Supplemental disclosure of cash flow information: | |||||||||||
| Cash paid (refunded) for income taxes | $ | ( | $ | ||||||||
| Cash paid for interest | $ | $ | |||||||||
| Supplemental disclosure of non-cash activities: | |||||||||||
| Lease liabilities arising from obtaining right-of-use assets | $ | $ | |||||||||
| Liability related to acquisition holdback | $ | $ | |||||||||
| Common stock issued for debt conversion | $ | $ | |||||||||
The accompanying notes are an integral part of these condensed consolidated financial statements.
8
NOTES TO UNAUDITED CONDENSED CONSOLIDATED FINANCIAL STATEMENTS
NOTE 1: GENERAL
Description of Business
Varonis Systems, Inc. ("VSI" and together with its subsidiaries, collectively, the “Company” or "Varonis") was incorporated under the laws of the State of Delaware on November 3, 2004, commenced operations on January 1, 2005 and has sixteen wholly-owned subsidiaries.
The Company develops software for data and AI security, threat detection and response and data privacy and compliance. Varonis enables enterprises of all sizes and across industries to protect their most critical asset – data – wherever it lives: in the cloud, on-premises, in SaaS applications, and across AI-driven systems. That includes sensitive files and emails; confidential personal, patient, and employee data; financial records; source code; and strategic intellectual property.
The Varonis Data Security Platform provides comprehensive visibility into how data is accessed, used, and exposed – including by AI systems and agents – and applies automated controls to reduce risk and contain threats before they become breaches. The platform analyzes data, applications, and account activity alongside user and AI-related behavior to detect anomalies, prevent unauthorized access, and automatically lock down sensitive data when risk is detected.
Customers rely on Varonis to achieve three board-level outcomes: enabling secure AI adoption, preventing data breaches, and maintaining compliance with data-related regulations. Core use cases include: automated discovery and classification of sensitive data, emails, and databases; AI-readiness and AI system security; data security posture management (DSPM); database activity monitoring ("DAM"); SaaS security posture management; automated remediation of over-exposed data; centralized visibility and risk analysis across the enterprise; monitoring of user, file, email, and AI-related activity; insider threat, malware, ransomware, and phishing detection through Managed Data Detection and Response ("MDDR"); automated response to ransomware and other high-severity incidents; data ownership identification and assignment; forensics, reporting and audit logging; compliance and security policy enforcement; data migration and retention automation; and automated indexing for data subject requests and privacy regulations.
Merger Agreement
On October 15, 2026, the Company entered into an Agreement and Plan of Merger (the “Merger Agreement”) with Proofpoint, Inc., a Delaware corporation (“Parent”), and Vail Merger Sub, Inc., a Delaware corporation and a wholly owned subsidiary of Parent (“Merger Sub”). Parent and Merger Sub are affiliates of funds advised by Thoma Bravo, L.P. Pursuant to and subject to the terms and conditions set forth in the Merger Agreement, Merger Sub will merge with and into the Company, with the Company continuing as the surviving corporation and becoming a wholly owned subsidiary of Parent (the “Merger”). The Company’s Board of Directors (the “Board”) has unanimously approved the Merger Agreement and resolved to recommend that the Company's stockholders adopt the Merger Agreement.
If the Merger is consummated, at the effective time of the Merger (the “Effective Time”), each share of Varonis common stock issued and outstanding immediately prior to the Effective Time will be converted automatically into the right to receive $49.75 in cash, without interest, other than certain excluded shares, including restricted shares, shares held in treasury or owned by Parent, Merger Sub or any subsidiary of the Company and shares for which appraisal rights have been properly demanded under Delaware law.
The Merger is expected to close in the first half of 2027, subject to the satisfaction of customary closing conditions, including, but not limited to (i) approval by the holders of at least a majority in voting power of the outstanding Company shares entitled to vote thereon, (ii) the absence of any governmental entity issuing any order or other legal restraint that makes consummation of the Merger illegal or otherwise prohibited, (iii) the expiration or termination of the applicable waiting period under the Hart-Scott-Rodino Antitrust Improvements Act of 1976, as amended, (iv) the clearance or approval under certain specified foreign regulatory laws and (v) the absence of any Material Adverse Effect (as defined in the Merger Agreement) since the date of the Merger Agreement. The obligation of each party to consummate the Merger is also conditioned upon the other party’s representations and warranties being true and correct (subject to certain materiality exceptions) and the other party having performed in all material respects its obligations under the Merger Agreement. The obligations of Parent and Merger Sub to consummate the Merger are not subject to any financing condition.
9
The Merger Agreement generally requires the Company to operate its business in the ordinary course in all material respects, subject to customary exceptions, pending consummation of the Merger, and contains customary interim operating covenants that restrict the Company from taking certain specified actions without Parent's consent until the Merger is consummated or the Merger Agreement is terminated in accordance with its terms.
The Merger Agreement contains certain termination rights for the Company and Parent, including that, subject to certain limitations, either party may terminate the Merger Agreement (i) if the Merger is not consummated by 11:59 p.m. New York time on July 15, 2027, subject to an automatic three-month extension under specified circumstances relating to required regulatory approvals, (ii) if any order prohibiting the Merger has become final and non-appealable or (iii) if the Company’s stockholders do not approve the adoption of the Merger Agreement at the stockholders’ meeting held for that purpose. In addition, subject to certain conditions and prior to receipt of Company stockholder approval, Parent may terminate the Merger Agreement if the Board adversely changes its recommendation in favor of the Merger, and the Company may terminate the Merger Agreement to enter into a definitive agreement providing for a superior proposal. The Company and Parent may also terminate the Merger Agreement by mutual written consent.
The Company is subject to customary restrictions on its ability to solicit alternative acquisition proposals from third parties and to provide non-public information to, and participate in discussions and engage in negotiations with, third parties regarding alternative acquisition proposals, subject to customary exceptions. If the Merger Agreement is terminated under certain specified circumstances, including, among other circumstances: (A) if the Company terminates the Merger Agreement in order to enter into an agreement providing for a superior proposal or Parent terminates the Merger Agreement because the Board adversely changes its recommendation in favor of the Merger, the Company would be required to pay Parent a termination fee of $211,700 and (B) if Parent fails to consummate the Merger following satisfaction or waiver of certain closing conditions and the Company’s irrevocable confirmation that it is ready, willing and able to consummate the closing, or if the Company terminates the Merger Agreement due to Parent’s breach of its obligations under the Merger Agreement, which breach gives rise to a failure of certain conditions to the Merger and which Parent fails to cure, Parent would be required to pay the Company a reverse termination fee of $423,300 .
Parent has obtained equity financing commitments from funds managed by Thoma Bravo and debt financing commitments from certain financial institutions for the purpose of financing the transactions contemplated by the Merger Agreement and paying related fees and expenses. The Company is a third-party beneficiary under certain provisions of the equity commitment letter.
If the Merger is consummated, the Company shares will be delisted from the Nasdaq Stock Market and deregistered under the Securities Exchange Act of 1934, as amended. The foregoing summary of the Merger Agreement and the transactions contemplated thereby does not purport to be complete and is subject to, and qualified in its entirety by, the full text of the Merger Agreement which is filed as Exhibit 2.1 to the Company's Current Report on Form 8-K filed with the SEC on October 15, 2026.
Basis of Presentation
In management’s opinion, the Company has made all adjustments (consisting only of normal, recurring adjustments) necessary to fairly present its condensed consolidated financial position, results of operations and cash flows. The Company’s interim period operating results do not necessarily indicate the results that may be expected for any other interim period or for the full fiscal year. These condensed consolidated financial statements and accompanying notes should be read in conjunction with the 2025 consolidated financial statements and notes thereto included in the Company’s Annual Report on Form 10-K for its fiscal year ended December 31, 2025 filed with the SEC on February 4, 2026 (the “2025 Form 10-K”).
Significant Accounting Policies
There have been no changes in the significant accounting policies from those that were disclosed in the audited consolidated financial statements for the fiscal year ended December 31, 2025 included in the 2025 Form 10-K, unless otherwise stated.
Revenue Recognition
10
The Company generates revenues primarily in the form of SaaS revenues, and, to a lesser extent, term license subscriptions and maintenance and services fees. SaaS revenues, including SaaS with MDDR, are provided on a subscription basis and allow customers to use hosted software for a specified period. Over the last few years, the Company has introduced new products and support for cloud applications and infrastructure environments, including the Varonis Data Security Platform delivered as a SaaS solution, which was previously only sold as a self-hosted solution. Term license subscription revenues are sold on-premises and are comprised of time-based licenses whereby customers use the Company's software (including support and unspecified upgrades and enhancements when and if they are available) for a specified period. Maintenance and services primarily consist of fees for maintenance of past perpetual license sales (including support and unspecified upgrades and enhancements when and if they are available). The Company sells its products worldwide through a network of distributors and value-added resellers and payment is typically due within 30 to 60 calendar days of the invoice date.
For information regarding disaggregated revenues, refer to Note 8, "Geographic Information and Major Customer Data."
Contract Costs
The Company pays sales commissions to sales and marketing and certain management personnel based on their attainment of certain predetermined sales goals. The Company capitalizes sales commissions that are considered incremental and recoverable costs of obtaining a contract with a customer. Incremental sales commissions paid for initial contracts, which are not commensurate with sales commissions paid for renewal contracts, are capitalized and amortized over an expected period of benefit. Based on its technology, customer contracts and other factors, the Company has determined the expected period of benefit to be approximately four years . Incremental sales commissions which are commensurate, are capitalized and amortized over the related contractual period and aligned with revenue recognized from these contracts. Amortization expenses related to these costs are included in sales and marketing expenses in the accompanying condensed consolidated statements of operations.
Derivative Instruments
The Company’s primary objective for holding derivative instruments is to reduce its exposure to foreign currency rate changes. The Company reduces its exposure by entering into forward foreign exchange contracts with respect to revenues and operating expenses that are forecasted to be incurred in currencies other than the U.S. dollar. A majority of the Company’s revenues and operating expenses are transacted in U.S. dollars; however, certain revenues and operating expenses are incurred in or exposed to other currencies, specifically, the euro and pound sterling for revenues and the new Israeli shekel, euro and pound sterling for operating expenses.
The Company has established forecasted transaction currency risk management programs to protect against the volatility of future cash flows caused by changes in exchange rates. The Company’s currency risk management program includes forward foreign exchange contracts designated as cash flow hedges. These forward foreign exchange contracts generally mature within periods of up to 24 months. The Company does not enter into derivative financial instruments for trading or speculative purposes.
Derivative instruments measured at fair value and their classification in the condensed consolidated balance sheets are presented in the following table (in thousands):
11
| Assets (liabilities) as of September 30, 2026 (unaudited) | Assets (liabilities) as of December 31, 2025 | ||||||||||||||||||||||
| Notional Amount | Fair Value | Notional Amount | Fair Value | ||||||||||||||||||||
| Foreign exchange forward contract derivatives in cash flow hedging relationships for operating expenses included in prepaid expenses and other short-term assets | $ | $ | $ | $ | |||||||||||||||||||
| Foreign exchange forward contract derivatives in cash flow hedging relationships for operating expenses included in accrued expenses and other short-term liabilities | $ | $ | ( | $ | $ | ||||||||||||||||||
| Foreign exchange forward contract derivatives in cash flow hedging relationships for operating expenses included in long-term other assets | $ | $ | $ | $ | |||||||||||||||||||
| Foreign exchange forward contract derivatives in cash flow hedging relationships for operating expenses included in long-term other liabilities | $ | $ | ( | $ | $ | ||||||||||||||||||
| Foreign exchange forward contract derivatives in cash flow hedging relationships for revenues included in prepaid expenses and other short-term assets | $ | $ | $ | $ | |||||||||||||||||||
| Foreign exchange forward contract derivatives in cash flow hedging relationships for revenues included in accrued expenses and other short-term liabilities | $ | $ | ( | $ | $ | ( | |||||||||||||||||
| Foreign exchange forward contract derivatives in cash flow hedging relationships for revenues included in long-term other assets | $ | $ | $ | $ | |||||||||||||||||||
| Foreign exchange forward contract derivatives in cash flow hedging relationships for revenues included in long-term other liabilities | $ | $ | ( | $ | $ | ( | |||||||||||||||||
Net gains (losses) related to cash flow hedges that were reclassified from accumulated other comprehensive income to the condensed consolidated statements of operations are presented in the following table (in thousands):
| Three Months Ended | Nine Months Ended | ||||||||||||||||||||||||||||
| September 30, | September 30, | ||||||||||||||||||||||||||||
| 2026 | 2025 | 2026 | 2025 | ||||||||||||||||||||||||||
| (unaudited) | |||||||||||||||||||||||||||||
| Revenues | $ | ( | $ | $ | ( | $ | |||||||||||||||||||||||
| Cost of revenues | ( | ||||||||||||||||||||||||||||
| Research and development | ( | ||||||||||||||||||||||||||||
| Sales and marketing | |||||||||||||||||||||||||||||
| General and administrative | ( | ||||||||||||||||||||||||||||
| Financial income, net | ( | ||||||||||||||||||||||||||||
Total net gain related to cash flow hedges | $ | $ | $ | $ | |||||||||||||||||||||||||
No material ineffective hedges were recognized during the three and nine months ended September 30, 2026 and 2025 in the condensed consolidated statement of operations.
Income Taxes
The Company operates in the U.S. and in foreign jurisdictions and is subject to taxes in each country or jurisdiction in which it conducts business. Earnings from its non-U.S. activities are subject to local country income tax and may be subject to U.S. income tax.
12
Because of its history of operating losses, the Company has established a full valuation allowance against potential future benefits for deferred tax assets, including loss carryforwards.
Accounting for income taxes for interim periods generally requires the provision for income taxes to be determined by applying an estimate of the annual effective tax rate for the full fiscal year to “ordinary” income or loss (pretax income or loss excluding unusual or infrequently occurring discrete items) for the reporting period. For the three and nine months ended September 30, 2026, a discrete effective tax rate method was used in jurisdictions where a small change in estimated ordinary income has a significant impact on the annual effective tax rate.
In some foreign tax jurisdictions, the Company bases its interim tax accruals on the annual estimated effective tax rate applicable to the Company and its subsidiaries, adjusted for items which are considered discrete to the period. In each quarter, the Company updates its calculation and makes a year-to-date adjustment to its tax provision as necessary.
The Company's fiscal 2026 annual effective rate differs from the U.S. statutory rate primarily due to research and development capitalization under the terms of Section 174, tax deduction for stock-based compensation, generation or utilization of carry forward net operating loss (NOL) and research and development tax credits resulting in a current provision expense without an offset to deferred expense, as the Company remains in a valuation allowance on its U.S. deferred tax assets.
The Company's income tax provision could be significantly impacted by estimates surrounding its uncertain tax positions and changes to its valuation allowance. The Company reevaluates the judgments surrounding its estimates and makes adjustments as appropriate each reporting period.
The Company remains open to federal and state examination to the extent net carry-over unused operating losses and tax credit attributable to those years remain unutilized. As of September 30, 2026, the Company's federal tax returns for the years 2010 through the current period, excluding the 2016 tax year which was audited by the Internal Revenue Service, and most state tax returns for the years 2009 through the current period, are still open to examination.
In addition, the Company is subject to the regular examinations of its income tax returns by different tax authorities. The Company regularly assesses the likelihood of adverse outcomes resulting from these examinations to determine the adequacy of its provision for income taxes.
Cash, Cash Equivalents and Marketable Securities
The Company accounts for investments in marketable securities in accordance with ASC No. 320, “Investments—Debt Securities” and ASC No. 326, “Financial Instruments—Credit Losses.” The Company considers all highly liquid investments with a maturity of three months or less when purchased to be cash equivalents. Cash and cash equivalents consist of cash on hand, highly liquid investments in money market funds and other securities.
13
| As of September 30, 2026 | |||||||||||||||||||||||
| (unaudited) | |||||||||||||||||||||||
| Amortized Cost | Gross Unrealized Gains | Gross Unrealized Losses | Fair Value | ||||||||||||||||||||
| Cash equivalents | |||||||||||||||||||||||
| Money market funds | $ | $ | — | $ | — | $ | |||||||||||||||||
| Total | $ | $ | — | $ | — | $ | |||||||||||||||||
| Marketable securities | |||||||||||||||||||||||
| US Treasury securities | $ | $ | $ | ( | $ | ||||||||||||||||||
| Total | $ | $ | $ | ( | $ | ||||||||||||||||||
| Long-term marketable securities | |||||||||||||||||||||||
| US Treasury securities | $ | $ | $ | ( | $ | ||||||||||||||||||
| Total | $ | $ | $ | ( | $ | ||||||||||||||||||
| As of December 31, 2025 | |||||||||||||||||||||||
| Amortized Cost | Gross Unrealized Gains | Gross Unrealized Losses | Fair Value | ||||||||||||||||||||
| Cash equivalents | |||||||||||||||||||||||
| Money market funds | $ | $ | — | $ | — | $ | |||||||||||||||||
| Total | $ | $ | — | $ | — | $ | |||||||||||||||||
| Marketable securities | |||||||||||||||||||||||
| US Treasury securities | $ | $ | $ | ( | $ | ||||||||||||||||||
| Total | $ | $ | $ | ( | $ | ||||||||||||||||||
| Long-term marketable securities | |||||||||||||||||||||||
| US Treasury securities | $ | $ | $ | $ | |||||||||||||||||||
| Total | $ | $ | $ | $ | |||||||||||||||||||
Unrealized losses associated with investments in available for sale securities have all been in a continuous unrealized loss position of less than one year as of September 30, 2026 and December 31, 2025.
The gross unrealized gains and losses related to these investments were due primarily to changes in interest rates. If the amortized cost of an individual security exceeds its fair value, the Company considers its intent to sell the security or whether it is more likely than not that it will be required to sell the security before recovery of its amortized basis. If either of these criteria are met, then impairment is recorded to the fair value of the security. If neither of these criteria are met, the securities are assessed using the credit losses model for marketable securities to determine what portion of that difference, if any, is caused by expected credit losses. Expected credit losses on available for sale debt securities are recognized in financial income, net in the condensed consolidated statements of operations. During the three and nine months ended September 30, 2026 and 2025, the Company did not recognize impairment or an allowance for credit losses on available for sale marketable securities.
Business Combinations
The Company accounts for its business combinations using the acquisition method of accounting, which requires, among other things, allocation of the fair value of the purchase consideration to the tangible and intangible assets acquired and liabilities assumed at their estimated fair values on the acquisition date. The excess of the fair value of the purchase consideration over the
14
values of these identifiable assets and liabilities is recorded as goodwill. When determining the fair value of assets acquired and liabilities assumed, the Company makes estimates and assumptions, especially with respect to intangible assets. The Company's estimates of fair value are based upon assumptions believed to be reasonable, but which are inherently uncertain and unpredictable and, as a result, actual results may differ from such estimates. During the measurement period, not to exceed one year from the date of acquisition, the Company may record adjustments to the assets acquired and liabilities assumed, with a corresponding offset to goodwill if new information is obtained related to facts and circumstances that existed as of the acquisition date. After the measurement period, any subsequent adjustments are reflected in the condensed consolidated statements of operations. Acquisition costs, such as legal and consulting fees, are expensed as incurred.
Goodwill and Other Long-Lived Assets, including Acquired Intangible Assets and Right-of-Use Assets
Goodwill represents the excess of the fair value of the purchase consideration in a business combination over the fair value of the net tangible and intangible assets acquired. Goodwill amounts are not amortized, but rather tested for impairment at least annually or more often if circumstances indicate that the carrying value may not be recoverable. The Company operates as one reporting segment, which consists of a single reporting unit. If the carrying amount of the Company's reporting unit exceeds its fair value, the Company recognizes an impairment loss in an amount equal to that excess, limited to the total amount of goodwill allocated to that reporting unit. During the periods presented, no
Acquired intangible assets consist of identifiable intangible assets, including developed technology, customer relationships and non-compete agreements, resulting from business combinations and asset acquisitions. Acquired finite-lived intangible assets are initially recorded at fair value and are amortized on a straight-line basis over their estimated useful lives. Amortization expense of the acquired intangible assets are recorded within cost of revenues and sales and marketing expense in the condensed consolidated statements of operations.
The Company’s long-lived assets are reviewed for impairment in accordance with ASC No. 360 “Property, Plant and Equipment” whenever events or changes in circumstances indicate that the carrying amount of an asset (or asset group) may not be recoverable. Recoverability of assets (or asset group) to be held and used is measured by a comparison of the carrying amount of an asset to the future undiscounted cash flows expected to be generated by the assets. If such assets are considered to be impaired, the impairment to be recognized is measured by the amount by which the carrying amount of the assets exceeds the fair value of the assets. During the periods presented, no
Capitalized Internal-use Software Development Costs
The Company capitalizes certain development costs incurred in connection with its internal-use software in accordance with ASC No. 350-40, "Intangibles-Goodwill and Other-Internal-Use Software." These capitalized costs are related to the Company's SaaS platform. Costs incurred in the preliminary and post-implementation stages of development are expensed as incurred. Once internal-use software has reached the application development stage, direct internal and external costs are capitalized until the internal-use software is substantially complete and ready for its intended use. Capitalized internally developed software costs are recorded within property and equipment, net in the condensed consolidated balance sheets.
On August 21, 2026, the Company entered into an asset purchase agreement with an unrelated third party to acquire certain internal-use software assets delivered at closing and additional internal-use software assets to be delivered in the future. Total cash consideration attributable to the internal-use software assets is $17,810 , of which $900 was paid at closing for assets delivered during the third quarter of 2026 and $16,910 is payable in 2027, subject to delivery and specified acceptance conditions for the remaining internal-use software assets, as well as potential adjustments for indemnity claims. Costs capitalized under the asset purchase agreement are recorded within intangible assets, net in the condensed consolidated balance sheets.
Management tests these assets for impairment whenever events or changes in circumstances occur that could impact recoverability of these assets. As of September 30, 2026, all capitalized internal-use software development assets were in the application development stage, as such, no amortization has been recorded in the condensed consolidated statements of operations related to these assets and no impairment has been recorded.
Concentration of Credit Risks
Financial instruments that potentially subject the Company to concentrations of credit risk consist principally of cash, cash equivalents, marketable securities, short-term deposits and accounts receivable.
15
The Company’s cash, cash equivalents, marketable securities and short-term deposits are invested in major banks mainly in the United States but also in France, Israel, the United Kingdom, Canada, Singapore, Ireland, Australia, Germany, the Netherlands, Luxembourg, India, Japan and Poland. Such deposits in the United States may be in excess of insured limits and are not insured in other jurisdictions. The Company maintains cash and cash equivalents with reputable financial institutions and monitors the amount of credit exposure to each financial institution.
Accounts receivable is recorded when the right to consideration is unconditional. The Company’s accounts receivable is geographically diversified and derived primarily from sales through a network of distributors and value-added resellers (VARs) mainly in the United States and Europe, and to a lesser extent, in Asia. Concentration of credit risk with respect to accounts receivable is limited by credit limits, ongoing credit evaluation and account monitoring procedures. The Company performs ongoing credit evaluations of its customers and establishes an allowance for credit losses based upon a review of all significant outstanding invoices, historical collection experience, customer creditworthiness and current economic and market conditions. The Company elected to apply the practical expedient and assumed that current conditions as of the balance sheet date would not change for the remaining life of the assets. The Company writes off receivables when they are deemed uncollectible and having exhausted all collection efforts.
Basic and Diluted Net Loss Per Share
Basic net loss per share is computed by dividing net loss by the weighted-average number of shares of common stock outstanding during the period.
Diluted net loss per share is computed by giving effect to all potentially dilutive securities, including stock options, restricted stock units, performance stock units and the shares related to the conversion of the 1.00 % Convertible Senior Notes issued by the Company on September 10, 2024 and due September 15, 2029 in an aggregate principal amount of $460,000 (the "2029 Notes"), to the extent dilutive.
Basic and diluted net loss per share were the same for each period presented as the inclusion of all potential shares of common stock outstanding would have been anti-dilutive. There were 9,036,241 and 8,626,352 potentially dilutive shares from the conversion of outstanding stock options, restricted stock units and performance stock units that were not included in the calculation of diluted net loss per share for the periods ending September 30, 2026 and 2025, respectively. Additionally, 6,781,660
Contractual Purchase Obligations and Contingent Liabilities
Contractual Purchase Obligations
As of September 30, 2026, the Company has contractual minimum purchase commitments with cloud hosting service providers of $390,849 through 2031, consisting of $12,105 due within the next 12 months and the remainder due thereafter, primarily under arrangements with no specified annual commitments.
Contingent Liabilities
The Company accounts for its contingent liabilities in accordance with ASC No. 450 “Contingencies.” A provision is recorded when it is both probable that a liability has been incurred and the amount of the loss can be reasonably estimated. From time to time, the Company is involved in claims and litigation in the ordinary course of business. The Company investigates these claims as they arise and legal provisions are reviewed and adjusted to reflect the impact of negotiations, estimated settlements, legal rulings, advice of legal counsel and other information and events pertaining to a particular matter. Although claims are inherently unpredictable, as of September 30, 2026 and December 31, 2025, the Company was not a party to any litigation that it believes will have a material adverse effect on the Company’s condensed consolidated balance sheets, results of operations or cash flows.
On January 7, 2026, the Company and certain officers of the Company were named as defendants in a putative securities class action captioned, Molchanov v. Varonis Systems, Inc. et al., filed in the U.S. District Court for the Southern District of New York. The complaint alleged that defendants made misrepresentations or omissions in its public disclosures about the Company’s expected annual recurring revenue for fiscal year 2025 and the Company’s ability to convert existing self-hosted customers to its SaaS offering, between February 4, 2025 and July 29, 2025, in violation of Section 10(b) of the Exchange Act and Rule 10b-5 promulgated thereunder, and further alleged that certain officers are liable as control persons under Section 20(a) of the Exchange Act. On July 17, 2026, lead plaintiffs filed an amended complaint, which, among other things, extended
16
the purported class period from the original complaint’s period of February 4, 2025 through October 28, 2025 to a period of February 4, 2025 through February 3, 2026 and adds additional alleged misrepresentations by defendants. The substantive allegations of the amended complaint remain substantially similar to the original complaint. On August 25, 2026, lead plaintiffs filed a motion to transfer the venue of this action from the Southern District of New York to the Southern District of Florida. The Company has opposed this motion to transfer and it remains pending before the court. The defendants still intend to file a motion to dismiss this action, which will be filed after the court’s decision on the motion to transfer venue. The Company believes the claims in this action are without merit and intends to defend the action vigorously. At this early stage of the proceedings, the Company can neither predict the ultimate outcome of the litigation nor estimate any range of possible losses but the Company believes the claims in this litigation are without merit and intends to defend the action vigorously.
On May 12, 2026, a shareholder derivative action was filed, purportedly on behalf of the Company, against the Company’s directors and certain officers in the U.S. District Court for the Southern District of New York. The complaint alleges claims asserting violations of Sections 10(b), 14(a) and 20(a) of the Exchange Act, breach of fiduciary duty, aiding and abetting breach of fiduciary duty, unjust enrichment and waste of corporate assets against all individual defendants, as well as a claim for contribution under Section 10(b) and Section 21(d) of the Exchange Act against certain officers, based on substantially the same events and disclosures that are the subject of the litigation filed on January 7, 2026, as described above. On June 3, 2026, the court entered a stipulation and order staying this action pending the resolution of the anticipated motion to dismiss the purported securities class action described above. At this early stage of the proceedings, the Company can neither predict the ultimate outcome of the litigation nor estimate any range of possible losses but the Company believes the claims in this litigation are without merit and intends to defend the action vigorously.
Recently Issued Accounting Pronouncements Not Yet Adopted
In November 2024, the FASB issued ASU 2024-03, Income Statement-Reporting Comprehensive Income-Expense Disaggregation Disclosures (Subtopic 220-40) - Disaggregation of Income Statement Expenses. The ASU requires, among other items, additional disaggregated disclosures in the notes to the financial statements for certain categories of expenses that are included in the consolidated statements of operations. ASU 2024-03 is effective for fiscal years beginning after December 15, 2026, and for interim periods within fiscal years beginning after December 15, 2027, with early adoption permitted, and may be applied either prospectively or retrospectively. The Company is currently evaluating the effect of adopting the ASU on its disclosures.
In September 2025, the FASB issued ASU 2025-06, Intangibles-Goodwill and Other-Internal-Use Software (Subtopic 350-40) - Targeted Improvements to the Accounting for Internal-Use Software. The ASU was updated to consider different methods of software development and requires internal-use software costs to be capitalized when management has authorized and committed to funding the software project and when significant uncertainty associated with the development of the software has been resolved. The amendments in this ASU are required to be adopted for annual and interim reporting periods beginning after December 15, 2027, with early adoption permitted, and may be applied either through a prospective, retrospective or a modified transition approach. The Company is currently evaluating the effect of adopting the ASU on its consolidated financial statements.
In December 2025, the FASB issued ASU 2025-11, Interim Reporting (Topic 270) - Narrow-Scope Improvements. The ASU was updated to improve the navigability of the required interim disclosures within ASC No. 270 and to clarify when the guidance applies. This ASU is not intended to change the fundamental nature of interim reporting or expand or reduce current interim disclosure requirements. The amendments in this ASU are required to be adopted for interim reporting periods beginning after December 15, 2027, with early adoption permitted, and may be applied either through a prospective or retrospective approach. The Company is currently evaluating the effect of adopting the ASU on its condensed consolidated financial statement disclosures.
NOTE 2: FAIR VALUE MEASUREMENTS
The Company evaluates assets and liabilities subject to fair value measurements on a recurring basis to determine the appropriate level to classify them for each reporting period. There have been no transfers between fair value measurement levels during the periods presented. The carrying amounts of cash and cash equivalents, accounts receivable, short-term deposits and trade payables approximate their fair value due to the short-term maturity of such instruments.
The authoritative guidance on fair value measurements establishes a consistent framework for measuring fair value on either a recurring or nonrecurring basis, whereby inputs used in valuation techniques are assigned a hierarchical level. The following are the hierarchical levels of inputs to measure fair value:
17
•Level 1: Observable inputs that reflect quoted prices (unadjusted) for identical assets or liabilities in active markets.
•Level 2: Observable inputs that reflect quoted prices for identical assets or liabilities in markets that are not active; quoted prices for similar assets or liabilities in active markets; inputs other than quoted prices that are observable for the assets or liabilities; or inputs that are derived principally from or corroborated by observable market data by correlation or other means.
•Level 3: Unobservable inputs reflecting the Company’s own assumptions incorporated in valuation techniques used to determine fair value. These assumptions are required to be consistent with market participant assumptions that are reasonably available.
The following table sets forth the Company’s assets and liabilities that were measured at fair value as of September 30, 2026 and December 31, 2025 by level within the fair value hierarchy (in thousands):
| As of September 30, 2026 | As of December 31, 2025 | ||||||||||||||||||||||||||||||||||||||||||||||
| (unaudited) | |||||||||||||||||||||||||||||||||||||||||||||||
| Level I | Level II | Level III | Level I | Level II | Level III | ||||||||||||||||||||||||||||||||||||||||||
| Financial assets: | |||||||||||||||||||||||||||||||||||||||||||||||
| Cash equivalents: | |||||||||||||||||||||||||||||||||||||||||||||||
| Money market funds | $ | $ | $ | $ | $ | $ | |||||||||||||||||||||||||||||||||||||||||
| Marketable securities: | |||||||||||||||||||||||||||||||||||||||||||||||
| US Treasury securities | |||||||||||||||||||||||||||||||||||||||||||||||
| Prepaid expenses and other short-term assets: | |||||||||||||||||||||||||||||||||||||||||||||||
| Forward foreign exchange contracts | |||||||||||||||||||||||||||||||||||||||||||||||
| Long-term marketable securities: | |||||||||||||||||||||||||||||||||||||||||||||||
| US Treasury securities | |||||||||||||||||||||||||||||||||||||||||||||||
| Long-term other assets: | |||||||||||||||||||||||||||||||||||||||||||||||
| Forward foreign exchange contracts | |||||||||||||||||||||||||||||||||||||||||||||||
| Financial liabilities: | |||||||||||||||||||||||||||||||||||||||||||||||
Accrued expenses and other short-term liabilities: | |||||||||||||||||||||||||||||||||||||||||||||||
| Forward foreign exchange contracts | ( | ( | |||||||||||||||||||||||||||||||||||||||||||||
| Long-term other liabilities: | |||||||||||||||||||||||||||||||||||||||||||||||
| Forward foreign exchange contracts | ( | ( | |||||||||||||||||||||||||||||||||||||||||||||
| Total financial assets (liabilities), net | $ | $ | $ | $ | $ | $ | |||||||||||||||||||||||||||||||||||||||||
See Note 4, "Business Combinations," for the estimated fair value of acquired net tangible and intangible assets and liabilities and Note 6, "Convertible Senior Notes and Capped Call Transactions," for the carrying amount and estimated fair value of the Company's 2029 Notes, as of September 30, 2026. Marketable securities and derivative instruments are classified within Level 2, as these assets are valued using alternative pricing sources utilizing market observable inputs.
NOTE 3: LEASES
The Company has various operating leases for office space and vehicles that expire through 2035. The lease agreements generally do not contain any material residual value guarantees or material restrictive covenants. Some leases include one or more options to renew. The exercise of lease renewal options is typically at the Company's sole discretion; therefore, the majority of renewals to extend the lease terms are not included in the Company's right-of-use assets and lease liabilities, as they are not reasonably certain of exercise. The Company regularly evaluates the renewal options, and, when it is reasonably certain of exercise, it will include the renewal period in its lease term.
Below is a summary of the Company's operating right-of-use assets and operating lease liabilities (in thousands):
18
| September 30, 2026 | |||||||||||
| (unaudited) | |||||||||||
| Operating lease right-of-use assets | $ | ||||||||||
| Operating lease liabilities, current | $ | ||||||||||
| Operating lease liabilities, long-term | |||||||||||
| Total operating lease liabilities | $ | ||||||||||
Operating lease liabilities, current are included within in the condensed consolidated balance sheets.
Minimum lease payments for the Company's right-of-use assets over the remaining lease periods as of September 30, 2026, are as follows (in thousands):
| September 30, 2026 | |||||
| (unaudited) | |||||
| 2026 | $ | ||||
| 2027 | |||||
| 2028 | |||||
| 2029 | |||||
| 2030 | |||||
| Thereafter | |||||
| Total undiscounted lease payments | $ | ||||
| Less: Imputed interest | $ | ( | |||
| Present value of lease liabilities | $ | ||||
19
NOTE 4: BUSINESS COMBINATIONS
2026 Business Combination
AllTrue.ai, Inc. ("AllTrue.ai")
On February 6, 2026, the Company completed the acquisition of the share capital of AllTrue.ai, a provider of AI system security software that delivers real-time visibility and control over AI agents, models, and the data they access across the enterprise. Since the acquisition, the Company has launched Varonis Atlas, which is powered by AllTrue.ai, and is continuing to further integrate the technology into its platform. The acquisition was accounted for as a business combination in accordance with ASC No. 805, "Business Combinations." The transaction price was for $180,276 in cash and comprised of the fair value of total consideration transferred of $114,505 and aggregate conditional consideration consisting of an amount up to $40,000 that is conditional on the satisfaction of certain performance targets and employee service periods and an additional $25,771 that is primarily conditional on employee service. The conditional consideration is primarily recorded as research and development compensation expense within the condensed consolidated statements of operations.
The total purchase price was preliminarily allocated using information currently available to the Company and may be subject to change as additional information is received during the respective measurement period, up to one year from the acquisition date. During the nine months ended September 30, 2026, measurement period adjustments were recorded that increased the developed technology and customer relationship intangible assets and the related deferred tax liability by $2,250 , $36 and $518 , respectively, to primarily reflect adjustments from the filing of income tax returns for periods prior to the acquisition date. Additionally, working capital adjustments were recorded that increased the fair value of net tangible assets acquired by $32 and increased the total consideration transferred by $80 , to reflect facts and circumstances that existed as of the acquisition date. These measurement period adjustments had a corresponding net decrease to goodwill of $1,720 . The following table summarizes the preliminary allocation of the purchase price to the fair value of the tangible and intangible assets acquired and liabilities assumed as of the acquisition date (in thousands, except useful life):
| Purchase Price Allocation | Estimated Weighted Average Useful Life | ||||||||||
| (unaudited) | (in years) | ||||||||||
| Net tangible assets acquired | $ | ||||||||||
| Deferred tax liability | ( | ||||||||||
| Developed technology intangible asset | |||||||||||
| Customer relationship intangible asset | |||||||||||
| Goodwill | |||||||||||
| Total purchase price | $ | ||||||||||
The fair values of the developed technology and customer relationship intangible assets were estimated using the multi-period excess earnings method, which utilizes various assumptions including projected future revenue, projected profit margin, discount rate and useful life. The excess of the purchase price and liabilities assumed over the fair value of tangible and identifiable intangible assets acquired was recorded as goodwill. The Company believes the goodwill represents the synergies expected from expanded market opportunities when integrating the business with the Company's offerings. The goodwill is not expected to be deductible for income tax purposes. During the three and nine months ended September 30, 2026, acquisition-related costs of $30 and $1,116 , respectively, are included in general and administrative expenses in the condensed consolidated statements of operations.
On the acquisition date, the Company considered the deferred tax impact of the excess fair value of the assets and liabilities accounted for in the business combination over their historical cost basis. The Company recognized $9,652 of a deferred tax liability which relates to the fair value of intangibles, other than goodwill and the fair value adjustments for the tangible assets acquired over their historical cost basis. The Company will file a consolidated tax return in the U.S. to utilize the benefit of the Company’s loss carryforwards against future taxable profit and consequently decreased its valuation allowance in an amount equal to the deferred tax liability recognized in the business combination.
The unaudited pro forma results of operations related to this acquisition have not been disclosed, as they are immaterial to the Company's condensed consolidated financial statements.
20
2025 Business Combination
SlashNext, Inc. ("SlashNext")
On August 28, 2025, the Company completed the acquisition of the share capital of SlashNext, an AI-native email security provider that detects advanced phishing and social engineering attacks, which, together with MDDR, has been integrated with the Company's technology platform. The acquisition was accounted for as a business combination in accordance with ASC No. 805, "Business Combinations." The transaction price was for $105,953 in cash and comprised of an initial fair value of total consideration transferred of $105,447 and an aggregate conditional consideration of $4,662 , conditional on employee retention, along with the settlement of a $4,156 pre-existing relationship. The conditional consideration is recorded as research and development compensation expense in the condensed consolidated statements of operations. During the nine months ended September 30, 2026, working capital adjustments were recorded within the acquisition measurement period that reduced the amount of consideration transferred by $425
The following table summarizes the allocation of the purchase price to the fair value of the tangible and intangible assets acquired and liabilities assumed as of the acquisition date (in thousands, except useful life):
| Purchase Price Allocation | Estimated Weighted Average Useful Life | ||||||||||
| (unaudited) | (in years) | ||||||||||
| Net tangible assets (liabilities) acquired | $ | ( | |||||||||
| Developed technology intangible asset | |||||||||||
| Customer relationship intangible asset | |||||||||||
| Goodwill | |||||||||||
| Total purchase price | $ | ||||||||||
NOTE 5: GOODWILL AND INTANGIBLE ASSETS
Goodwill
Goodwill represents the excess of the purchase price over the identifiable tangible and intangible assets acquired less liabilities assumed arising from business combinations. The Company believes the goodwill represents the synergies expected from expanded market opportunities when integrating with its offerings.
The change in the carrying amount of goodwill during the nine months ended September 30, 2026 is related to the AllTrue.ai and SlashNext acquisitions. For additional information regarding the acquisitions, see Note 4, "Business Combinations."
The following table reflects goodwill activity for the nine months ended September 30, 2026 (in thousands):
21
| Amount (unaudited) | |||||
Balance at December 31, 2025 | $ | ||||
| Goodwill acquired | |||||
Balance at September 30, 2026 | $ | ||||
Intangible Assets, net
The total cost and amortization of the Company's intangible assets for the period ended September 30, 2026 is comprised of the following (in thousands):
| September 30, 2026 | |||||||||||||||||
| (unaudited) | |||||||||||||||||
| Gross Carrying Amount | Accumulated Amortization | Net Carrying Amount | |||||||||||||||
| Developed technology | $ | $ | ( | $ | |||||||||||||
| Customer relationship | ( | ||||||||||||||||
| Non-compete | ( | ||||||||||||||||
| Total | $ | $ | ( | $ | |||||||||||||
Intangible assets are expensed on a straight-line basis over the useful life of the asset. The Company recorded amortization expense of $3,306 and $7,994 for the three and nine months ended September 30, 2026, respectively. During the three and nine months ended September 30, 2025, the Company recorded amortization expense of $312 and $508 , respectively.
The following table summarizes estimated future amortization expense of the Company's intangible assets as of September 30, 2026 (in thousands):
| Amount | |||||
| Years ending December 31, | (unaudited) | ||||
| 2026 | $ | ||||
| 2027 | |||||
| 2028 | |||||
| 2029 | |||||
| 2030 | |||||
| Thereafter | |||||
| Total future amortization expense | $ | ||||
NOTE 6: CONVERTIBLE SENIOR NOTES AND CAPPED CALL TRANSACTIONS
2025 Notes
The Company issued 1.25 % Convertible Senior Notes on May 11, 2020, which matured on August 15, 2025, in an aggregate principal amount of $253,000 (the "2025 Notes" and, together with the 2029 Notes, the "Notes") pursuant to an indenture dated May 11, 2020 (the “2025 Indenture”). The net proceeds to the Company after issuance costs were approximately $245,158 . The Company used $29,348 of the net proceeds from the offering to pay the cost of the capped call transactions described below.
The 2025 Notes were settled prior to or on their maturity date of August 15, 2025 in accordance with the terms of the 2025 Indenture. The unconverted principal of the 2025 Notes and the accrued interest due at maturity were settled in cash.
22
2029 Notes
The Company issued the 2029 Notes pursuant to an indenture dated September 10, 2024 (the “2029 Indenture”). The offering totaled $460,000 aggregate principal amount. The net proceeds to the Company after issuance costs were approximately $449,649 . The Company used $55,522 of the net proceeds from the offering to pay the cost of the capped call transactions described below.
The 2029 Notes will mature on September 15, 2029, unless earlier converted, redeemed or repurchased. Interest will be payable semi-annually in arrears on March 15 and September 15 of each year, beginning on March 15, 2025, at a rate of 1.00 % per year.
The initial conversion rate for the 2029 Notes is 14.7419 shares of the Company’s common stock for each $1,000 principal amount of the 2029 Notes, which is equivalent to an initial conversion price of approximately $67.83 per share. The conversion rate is subject to adjustment in specified events. The consummation of the Merger will constitute, among other things, a “Make-Whole Fundamental Change” and a “Corporate Event,” each as defined in the 2029 Indenture. The 2029 Notes are convertible into shares of the Company’s common stock, at the option of a holder, prior to the close of business on the business day immediately preceding March 15, 2029, under certain conditions, which may include the Merger.
In addition, on or after March 15, 2029, a holder may convert all or any portion of its 2029 Notes at any time. Upon conversion, the Company may elect to repay the 2029 Notes in cash, shares of common stock, or a combination of both. As of September 30, 2026, the 2029 Notes were classified as long-term in the Company's condensed consolidated balance sheets.
Effective September 20, 2027, the Company may redeem the 2029 Notes for cash, at its option, subject to the terms and conditions provided in the 2029 Indenture.
In accordance with ASC No. 470, "Debt," the Company accounts for the 2029 Notes as a single liability measured at amortized cost. The carrying value of the liability is represented by the face amount of the 2029 Notes, less debt issuance costs. The total offering costs upon issuance of the 2029 Notes are amortized as interest expense over the term of the 2029 Notes, using the effective interest rate method.
The net carrying amount of the 2029 Notes was as follows (in thousands):
| September 30, 2026 | December 31, 2025 | ||||||||||||||||||||||||||||||||||
| Liability | (unaudited) | ||||||||||||||||||||||||||||||||||
| Principal | $ | $ | |||||||||||||||||||||||||||||||||
| Unamortized issuance costs | ( | ( | |||||||||||||||||||||||||||||||||
| Net carrying amount | $ | $ | |||||||||||||||||||||||||||||||||
During the three and nine months ended September 30, 2026, the effective interest rate for the 2029 Notes was 1.46 %. During the three and nine months ended September 30, 2025, the effective interest rate for the 2029 and 2025 Notes was 1.46 % and 1.86 %, respectively. The interest expense recognized related to the Notes during the three and nine months ended September 30, 2026 and 2025 were as follows (in thousands):
| Three Months Ended September 30, | |||||||||||||||||||||||||||||||||||||||||||||||
| 2026 | 2025 | ||||||||||||||||||||||||||||||||||||||||||||||
| 2025 Notes | 2029 Notes | Total | 2025 Notes | 2029 Notes | Total | ||||||||||||||||||||||||||||||||||||||||||
(unaudited) | |||||||||||||||||||||||||||||||||||||||||||||||
| Contractual interest expense | $ | $ | $ | $ | $ | $ | |||||||||||||||||||||||||||||||||||||||||
| Amortization of debt issuance costs | |||||||||||||||||||||||||||||||||||||||||||||||
| Total | $ | $ | $ | $ | $ | $ | |||||||||||||||||||||||||||||||||||||||||
23
| Nine Months Ended September 30, | |||||||||||||||||||||||||||||||||||||||||||||||
| 2026 | 2025 | ||||||||||||||||||||||||||||||||||||||||||||||
| 2025 Notes | 2029 Notes | Total | 2025 Notes | 2029 Notes | Total | ||||||||||||||||||||||||||||||||||||||||||
(unaudited) | |||||||||||||||||||||||||||||||||||||||||||||||
| Contractual interest expense | $ | $ | $ | $ | $ | $ | |||||||||||||||||||||||||||||||||||||||||
| Amortization of debt issuance costs | |||||||||||||||||||||||||||||||||||||||||||||||
| Total | $ | $ | $ | $ | $ | $ | |||||||||||||||||||||||||||||||||||||||||
As of September 30, 2026 and December 31, 2025, the total estimated fair value of the 2029 Notes was approximately $456,030 and $429,028 , respectively. The fair values were determined based on the closing trading price of the 2029 Notes as of the last day of trading for the period. The fair value of the 2029 Notes is primarily affected by the trading price of the Company's common stock and market interest rates. The fair value of the 2029 Notes is considered Level 2 within the fair value hierarchy and was determined based on inputs that are observable in the market or that could be derived from, or corroborated with, observable market data.
Capped Call Transactions
In May 2020 and September 2024, in connection with the pricing of the 2025 and 2029 Notes, respectively, the Company entered into privately negotiated capped call transactions (the “Capped Call Transactions”). The Capped Call Transactions are generally expected to reduce the potential dilution to the Company’s common stock upon any conversion of the Notes and/or offset any cash payments the Company is required to make in excess of the principal amount of converted Notes, as the case may be, with such reduction and/or offset subject to a cap initially equal to $47.24 and $104.36 , for the 2025 and 2029 Notes, respectively.
The Capped Call Transactions are considered a freestanding instrument in accordance with ASC No. 480, "Distinguishing Liabilities from Equity," as they were entered into separately and apart from the Notes and since the conversion or redemption of the Notes does not automatically result in the exercise of the Capped Call Transactions. As the Capped Call Transactions are considered indexed to the Company's stock and are considered equity classified, they are recorded in stockholders’ equity in the condensed consolidated balance sheets and are not accounted for as derivatives. The cost of the Capped Call Transactions for the 2025 and 2029 Notes were approximately $29,348 and $55,522 , respectively, and were recorded as a reduction to additional paid-in capital.
During 2025, in connection with the maturity of the 2025 Notes, the capped call transactions entered into in May 2020 were exercised and net share settled. The Company received and subsequently retired 2,604,434 shares of its common stock.
NOTE 7: STOCKHOLDERS’ EQUITY
Stock Plans
On November 14, 2013, the Company’s board of directors adopted the Varonis Systems, Inc. 2013 Omnibus Equity Incentive Plan (the “2013 Plan”) which was subsequently approved by the Company’s stockholders. The Company initially reserved 5,713,899 shares of common stock for issuance under the 2013 Plan to employees, directors, officers and consultants of the Company and its subsidiaries. Since January 1, 2016, the share reserve under the 2013 Plan has been automatically increased by an aggregate of 27,579,672 shares. Awards granted under the 2013 Plan generally vest over four years . No awards were granted under the 2013 Plan subsequent to June 5, 2023, and no further awards will be granted under the 2013 Plan.
On October 22, 2020, and as part of the Polyrize Security Ltd. ("Polyrize") acquisition, the Company’s board of directors approved the assumption of a certain portion of Polyrize Options pursuant to the terms and conditions of the Polyrize 2019 Share Incentive (“Polyrize Plan”). No further awards were or will be granted under the Polyrize Plan.
On April 20, 2023, the Company’s board of directors adopted the Varonis Systems, Inc. 2023 Omnibus Equity Incentive Plan (the “2023 Plan”), subject to approval by the Company's stockholders. On June 5, 2023, the Company’s stockholders approved the 2023 Plan which became effective and replaced the 2013 Plan. The Company initially reserved 5,500,000 shares of common stock for issuance under the 2023 Plan to employees, directors, officers and consultants of the Company and its subsidiaries. Since June 5, 2023, the Company’s stockholders have approved an additional 12,682,279 shares under the 2023 Plan, including the Company's stockholders approval that occurred on June 1, 2026 for an additional 6,402,279 shares.
24
Restricted Stock Units ("RSUs") and Performance Stock Units ("PSUs")
A summary of RSUs and PSUs for employees, consultants and non-employee directors of the Company for the nine months ended September 30, 2026 (unaudited) is as follows:
| Number of shares underlying outstanding RSUs and PSUs | Weighted- average grant date fair value | ||||||||||
Unvested balance as of January 1, 2026 | $ | ||||||||||
| Granted | $ | ||||||||||
| Vested | ( | $ | |||||||||
| Forfeited | ( | $ | |||||||||
Unvested balance as of September 30, 2026 | $ | ||||||||||
As of September 30, 2026, there was $246,582 of total unrecognized compensation cost related to employees, consultants and non-employee directors unvested restricted stock units and performance stock units which is expected to be recognized over a weighted-average period of 2.473 years.
Employee Stock Purchase Plans
On May 5, 2015, the Company’s stockholders approved the Varonis Systems, Inc. 2015 Employee Stock Purchase Plan (the “2015 ESPP”), which the Company’s board of directors had adopted on March 19, 2015. The 2015 ESPP became effective as of June 30, 2015. The Company initially reserved 1,500,000 shares of common stock for issuance under the 2015 ESPP. The number of shares available for issuance under the 2015 ESPP was increased on January 1, 2016 and has been increased each January thereafter through January 1, 2025. Since January 1, 2016, the share reserve under the 2015 ESPP has been automatically increased by an aggregate of 4,321,921 shares. There will be no further offering periods under the 2015 ESPP.
On June 5, 2025, the Company’s stockholders approved the Varonis Systems, Inc. 2025 Employee Stock Purchase Plan (the “2025 ESPP,” together with the 2015 ESPP, the "ESPP plans"), which the Company’s board of directors adopted on April 17, 2025. The Company initially reserved 8,000,000 shares of common stock for issuance under the 2025 ESPP. The 2025 ESPP will continue in effect until the earlier of (i) the date when no shares of common stock are available for issuance thereunder, or (ii) June 5, 2035; unless terminated prior thereto by the Company’s board of directors or compensation committee, each of which has the right to terminate the 2025 ESPP at any time.
The ESPP plans allow eligible employees to purchase shares of the Company’s common stock at a discount through payroll deductions of up to 15 % of their eligible compensation, at not less than 85 % of the fair market value of the Company’s common stock on the first day or last trading day in the offering period, subject to any plan limitations.
Stock-based Compensation Expense
The Company recognized stock-based compensation expense in the condensed consolidated statements of operations as follows (in thousands):
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| 2026 | 2025 | 2026 | 2025 | ||||||||||||||||||||
| (unaudited) | (unaudited) | ||||||||||||||||||||||
| Cost of revenues | $ | $ | $ | $ | |||||||||||||||||||
| Research and development | |||||||||||||||||||||||
| Sales and marketing | |||||||||||||||||||||||
| General and administrative | |||||||||||||||||||||||
| Total | $ | $ | $ | $ | |||||||||||||||||||
25
Share Repurchase Programs
In February 2025, the Company's board of directors authorized a share repurchase program of up to $100,000 of the Company’s common stock (the “February 2025 Share Repurchase Program”). Under the February 2025 Share Repurchase Program, the Company was authorized to repurchase shares through open market purchases, privately-negotiated transactions or otherwise in accordance with applicable federal securities laws, including through Rule 10b5-1 trading plans and under Rule 10b-18 of the Exchange Act. The Company completed its February 2025 Share Repurchase Program in April 2025. During 2025, the Company repurchased and subsequently retired 2,480,341 shares under its February 2025 Share Repurchase Program, for a total of $100,000 .
In October 2025, the Company's board of directors authorized a share repurchase program of up to $150,000 of the Company’s common stock (the “October 2025 Share Repurchase Program”). Under the October 2025 Share Repurchase Program, the Company was authorized to repurchase shares through open market purchases, privately-negotiated transactions or otherwise in accordance with applicable federal securities laws, including through Rule 10b5-1 trading plans and under Rule 10b-18 of the Exchange Act. The Company completed its October 2025 Share Repurchase Program in March 2026. During 2026, the Company repurchased and subsequently retired 5,355,445 shares under its October 2025 Share Repurchase Program, for a total of $135,000 . The cost of the share repurchase was partially offset by $2,900 of premiums received from options to repurchase common stock. During 2025, the Company repurchased and subsequently retired 448,439 shares under its October 2025 Share Repurchase Program, for a total of $15,000 .
NOTE 8: GEOGRAPHIC INFORMATION AND MAJOR CUSTOMER DATA
ASC No. 280, “Segment Reporting,” establishes standards for reporting information about operating segments. Operating segments are defined as components of an enterprise about which separate financial information is available that is evaluated regularly by the chief operating decision maker ("CODM") in deciding how to allocate resources and in assessing performance. The Company manages its business on the basis of one reportable segment and unit and derives revenues mainly from SaaS revenues, term license subscriptions and maintenance and services fees (see Note 1, "General," for a brief description of the Company’s business and revenue recognition).
The CODM of the Company is the Chief Executive Officer. The CODM assesses the performance of the Company and decides how to allocate resources based upon consolidated net loss that is also reported within the condensed consolidated statements of operations. The measure of segment assets that is reviewed by the CODM is reported within the condensed consolidated balance sheets as consolidated total assets. The CODM uses consolidated net loss to monitor period-over-period results and decides where to allocate and invest additional resources within the business to continue growth.
The following is a summary of the significant expense categories and consolidated net loss details provided to the CODM (in thousands):
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| 2026 | 2025 | 2026 | 2025 | ||||||||||||||||||||
| (unaudited) | (unaudited) | ||||||||||||||||||||||
| Total revenues | $ | $ | $ | $ | |||||||||||||||||||
| Less: | |||||||||||||||||||||||
Stock-based compensation | |||||||||||||||||||||||
| Other segment items (*) | |||||||||||||||||||||||
| Net loss | $ | ( | $ | ( | $ | ( | $ | ( | |||||||||||||||
(*) Other segment expense items included within net loss include payroll, financial income, net (inclusive of interest income of $9,043 and $28,111 for the three and nine months ended September 30, 2026, respectively, and $12,336 and $37,735 for the three and nine months ended September 30, 2025, respectively, and interest expense of $1,151 and $3,452 for the three and nine months ended September 30, 2026, respectively, and $1,535 and $5,412 for the three and nine months ended September 30, 2025, respectively), marketing activities, overhead and depreciation ($3,116 and $9,963 for the three and nine months ended September 30, 2026, respectively, and $2,664 and $7,456 for the three and nine months ended September 30, 2025, respectively), travel and entertainment, income taxes, information technology and communication, department activities,
26
amortization of acquired intangibles and other miscellaneous expenses. See the condensed consolidated financial statements for other financial information regarding the Company’s operating segment.
The following is a summary of revenues within geographic areas (in thousands):
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| 2026 | 2025 | 2026 | 2025 | ||||||||||||||||||||
| (unaudited) | (unaudited) | ||||||||||||||||||||||
| Revenues based on customer’s location: | |||||||||||||||||||||||
| United States | $ | $ | $ | $ | |||||||||||||||||||
EMEA | |||||||||||||||||||||||
| Rest of the World | |||||||||||||||||||||||
| Total revenues | $ | $ | $ | $ | |||||||||||||||||||
During the three and nine months ended September 30, 2026 and 2025, there were no revenues to a single customer exceeding 10% of the Company's total revenues.
The following is a summary of long-lived assets, including property and equipment, net and operating lease right-of-use assets, within geographic areas (in thousands):
| As of | As of | ||||||||||
| September 30, 2026 | December 31, 2025 | ||||||||||
| (unaudited) | |||||||||||
| Long-lived assets by geographic region: | |||||||||||
| Israel | $ | $ | |||||||||
| United States | |||||||||||
| Other | |||||||||||
| Total long-lived assets | $ | $ | |||||||||
27
| Item 2. | Management’s Discussion and Analysis of Financial Condition and Results of Operations | ||||
The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our condensed consolidated financial statements and related notes appearing elsewhere in this Quarterly Report on Form 10-Q and our Annual Report on Form 10-K for our fiscal year ended December 31, 2025.
Special Note Regarding Forward-Looking Statements
This report contains forward-looking statements that involve risks and uncertainties. Our actual results could differ materially from those discussed in the forward-looking statements. The statements contained in this report that are not purely historical are forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended (the “Securities Act”), and Section 21E of the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Forward-looking statements are often identified by the use of words such as, but not limited to, “anticipate,” “believe,” “can,” “continue,” “could,” “estimate,” “expect,” “intend,” “may,” “plan,” “project,” “seek,” “should,” “strategy,” “target,” “will,” “would” and similar expressions or variations intended to identify forward-looking statements. These statements are based on the beliefs and assumptions of our management based on information currently available to management. Such forward-looking statements are subject to risks, uncertainties and other important factors that could cause actual results and the timing of certain events to differ materially from future results expressed or implied by such forward-looking statements. Factors that could cause or contribute to such differences include, but are not limited to, those identified below and those discussed in the section titled “Risk Factors” included under Part II, Item 1A below. Furthermore, such forward-looking statements speak only as of the date of this report. Except as required by law, we undertake no obligation to update any forward-looking statements to reflect events or circumstances after the date of such statements.
Pending Merger
On October 15, 2026, we entered into the Merger Agreement with Parent, an affiliate of funds advised by Thoma Bravo, L.P., and Merger Sub. If the Merger is consummated, our stockholders will be entitled to receive $49.75 in cash, without interest, for each share of our common stock they hold as of immediately prior to the Effective Time of the Merger, other than certain excluded shares. The Merger is expected to close in the first half of 2027, subject to approval by our stockholders, receipt of required regulatory approvals and the satisfaction of other customary closing conditions. See "Merger Agreement" within Note 1 “General” of our condensed consolidated financial statements for information regarding the Merger.
Overview
Varonis is a data and AI security company. We protect what matters most to organizations: their data – and how it is accessed, used, and exposed, including by AI systems and agents. Modern enterprises run on data that is created, copied, shared, analyzed, and acted upon across cloud services, SaaS applications, AI-enabled platforms, and on-premises environments – often faster and on a larger scale than security teams can track. Varonis was founded on a simple but durable observation: the capacity to create and share data scales faster than the ability to secure it. That gap has never been wider than it is today.
AI has changed the attack surface in ways most security vendors weren’t built to address. AI agents access sensitive data autonomously, make decisions without human review, and introduce a new class of unpredictable, non-deterministic risk that traditional perimeter and identity-based controls weren’t designed to catch. At the same time, enterprises are under pressure to adopt AI quickly – and the data that powers those systems is frequently over-exposed, under-classified, and inadequately governed. Varonis sits at that intersection: we protect data, secure AI systems, and stop AI threats – including those that traditional security tools were never built to see.
Our transition to a SaaS delivery model was strategic and deliberate. SaaS enables the automation at scale that modern data security demands: continuous classification, real-time risk reduction, faster threat detection, and the ability to deploy and update capabilities across a customers’ environment without friction. Our Managed Data Detection and Response (MDDR) offering extends this further, using agentic AI to deliver 24x7x365 monitoring with a guaranteed response SLA.
28
We have continued to expand our platform through acquisitions that directly extend our ability to protect data and secure AI systems. The acquisition of Cyral brought database activity monitoring (DAM) into our platform. The acquisition of SlashNext added email and collaboration security, enabling detection and prevention of AI-generated phishing and other threats delivered through the collaboration layer. The acquisition of AllTrue.ai, Inc. ("AllTrue.ai") extended our platform into AI system security, giving customers real-time visibility and control over AI agents, models, and the data they access across the enterprise.
We have announced the end-of-life for our self-hosted business effective December 31, 2026. We expect this transition to result in increased variability with our remaining self-hosted customers throughout the end-of-life period and as we seek to convert these remaining customers to SaaS, but we believe it positions us for a more durable, recurring revenue model and accelerates our ability to deliver the automation and intelligence that define our platform’s value.
Our go-to-market model is channel-led and enterprise-focused. We sell through channel partners, including distributors and resellers, which sell to end-user customers, which we refer to in this report as our customers. We believe that our sales model, which combines the leverage of a channel sales model with our highly trained and professional sales force, has and will continue to play a major role in our ability to grow and to successfully deliver our unique value proposition for enterprise data. While our products serve customers of all sizes, across industries and across geographies, the marketing focus and majority of our sales focus is on targeting larger organizations who can make sizable initial purchases with us and, over time, have a greater potential lifetime value. Our customers span leading organizations across financial services, public, healthcare, industrial, insurance, energy and utilities, technology, construction and engineering, education and consumer and retail sectors. Our sales motion leads with a rapid risk assessment that surfaces immediate, high-priority exposure – typically within days of deployment – creating a clear and urgent case for expansion. Our SaaS renewal rate is over 90% for the nine months ended September 30, 2026.
We believe there is a significant long-term growth opportunity in both domestic and international markets. Any organization that stores data in SaaS applications, IaaS environments, databases, file shares, email systems, or AI platforms is a potential customer. As enterprises accelerate AI adoption, the need to govern, secure, and monitor the data those systems touch will only grow. We believe Varonis is uniquely positioned to meet that demand – not as a company adapting to the AI era, but as one built for it. For the three and nine months ended September 30, 2026, approximately 72% of our revenues were derived from the United States, while approximately 20% of our revenues were derived from EMEA and approximately 8% from ROW. Additionally, despite the revenue recognition variations from the accounting treatment associated with existing customer conversions to SaaS, total revenues still grew approximately 21% for the nine months ended September 30, 2026, compared with the nine months ended September 30, 2025. We continue to expect expansion in both domestic and international markets to be key components of our long-term growth strategy. Over the last few years, we have seen changes in customer buying patterns including some budgetary tightening and additional scrutiny on enterprise spending as a result of a higher inflation and interest rate environment.
We continue to expand our domestic and international operations as part of our long-term growth strategy. While the expansion of our domestic operations is focused primarily on our underpenetrated territories, the expansion of our international operations depends in particular on our ability to hire, integrate and retain local sales leadership and personnel in these international markets, acquire new channel partners and implement an effective marketing strategy. Given the nominal amount of our ROW revenues, our ROW revenue growth rates have fluctuated in the past and may fluctuate in the future based on the timing of deal closures. In addition, the further expansion of our international operations will increase our sales and marketing and general and administrative expenses and will subject us to a variety of risks and challenges, including those related to economic and political conditions in each region, compliance with foreign laws and regulations, and compliance with domestic laws and regulations applicable to our international operations.
Since inception, we have continued to scale our business and execute on strategic initiatives which we believe have positioned us for durable long-term growth. During the three and nine months ended September 30, 2026, we have continued to grow our revenues despite revenue recognition accounting treatment variations associated with existing customer conversions to SaaS. For the three months ended September 30, 2026 and 2025, SaaS revenues were $185.1 million and $125.8 million, respectively. For the nine months ended September 30, 2026 and 2025, SaaS revenues were $517.9 million and $320.3 million, respectively. For the three months ended September 30, 2026 and 2025, our total revenues were $189.5 million and $161.6 million, respectively. For the nine months ended September 30, 2026 and 2025, our total revenues were $542.6 million and $450.2 million, respectively. For the three months ended September 30, 2026 and 2025, we have operating losses of $47.7 million and $35.9 million and net losses of $41.6 million and $29.9 million, respectively. For the nine months ended September 30, 2026 and 2025, we have operating losses of $132.8 million and $116.3 million and net losses of $125.3 million and $101.5 million, respectively.
29
Key Performance Indicators and Recent Business Highlights
SaaS Annual Recurring Revenues
SaaS annual recurring revenues ("SaaS ARR") is a key performance indicator defined as the annualized value of active SaaS contracts in effect at the end of that period. SaaS contracts are annualized by dividing the total contract value by the number of days in the term and multiplying the result by 365. As we have announced the end-of-life of our self-hosted business as of December 31, 2026, we are disclosing SaaS ARR until the end-of-life of the self-hosted business is complete, at which point, ARR and SaaS ARR will be materially consistent.
As of September 30, 2026 and 2025, SaaS ARR was $774.6 million and $546.1 million, respectively, an increase of 42% period over period. The annualized value of contracts is a legal and contractual determination made by assessing the contractual terms with our customers. The annualized value of these contracts is not determined by reference to historical revenues, deferred revenues or any other GAAP financial measure over any period. SaaS ARR is not a forecast of future revenues and can be impacted by contract start and end dates and renewal rates. We expect SaaS ARR to continue to increase in absolute dollars.
SaaS Renewal Rate and SaaS ARR Excluding Conversions
As we have completed our SaaS transition and announced the end-of-life of our self-hosted business by the end of 2026, the historical renewal rate disclosure has been replaced by the SaaS renewal rate which is over 90% for the nine months ended September 30, 2026. In addition, throughout 2026, we will also be disclosing SaaS ARR excluding conversions which excludes SaaS ARR associated with self-hosted customers converting to SaaS over the trailing twelve months. As of September 30, 2026, SaaS ARR excluding conversions was $674.6 million, an increase of 24% compared to September 30, 2025 SaaS ARR. We expect SaaS ARR excluding conversions to increase in absolute dollars. These additional performance metrics align with our new business model and how management views the business.
Remaining Performance Obligations
Remaining performance obligations ("RPO") represent contracted revenues that have not yet been recognized, which includes deferred revenues and non-cancelable amounts that will be invoiced in the future. Our RPO was $1,127.6 million as of September 30, 2026 and we expect RPO to increase in absolute dollars.
Business Acquisition
On February 6, 2026, we completed the acquisition of AllTrue.ai, a provider of AI system security software that delivers real-time visibility and control over AI agents, models, and the data they access across the enterprise. For further information regarding the AllTrue.ai acquisition, refer to Note 4, "Business Combinations," of our condensed consolidated financial statements.
Components of Operating Results
30
Revenues
SaaS Revenues. SaaS revenues, including SaaS with MDDR, relate to the Varonis Data Security Platform delivered as a SaaS model. Over the last several years, we began to offer SaaS-delivered solutions and strategically enhanced our platform to safeguard customers' most mission-critical assets, including cloud environments, SaaS applications, on-premises data, email and AI systems. Each of these products allow customers to use hosted software, and the related revenue from these products is recognized ratably over the associated contract period. Our SaaS solutions are the primary driver of our revenues and we expect SaaS revenues to continue to grow considerably. Conversions from a license sold on-premises to our SaaS offering during the original subscription period are accounted for on a prospective basis.
Term License Subscription Revenues. Term license subscription revenues relate to subscription license revenues which are sold on-premises and are recognized at the point in time when the software license has been delivered and the benefit of the asset has transferred. Maintenance associated with a term license subscription is recognized ratably over the term of the agreement.
Maintenance and Services Revenues. Maintenance and services revenues consist of revenues from maintenance agreements of past perpetual license sales and, to a lesser extent, professional services. Customers with maintenance agreements are entitled to receive support and unspecified upgrades and enhancements when and if they become available. We recognize the revenues associated with maintenance ratably over the associated contract period.
Our SaaS renewal rate for each of the nine months ended September 30, 2026 and 2025 is over 90%. We measure the SaaS renewal rate for our customers over a 12-month period, based on a dollar renewal rate for SaaS contracts expiring during that time period. The expected increase in SaaS revenues, combined with the timing of conversions and renewals, as well as conversion and renewal rates, may result in significant variation in the revenues we recognize in a given period. We expect term license subscription revenues and perpetual license revenues, including the associated maintenance and support related to perpetual licenses, to continue to decline.
The following table sets forth the percentage of our revenues that have been derived from SaaS, term license subscriptions and maintenance and services revenues for the periods presented.
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| 2026 | 2025 | 2026 | 2025 | ||||||||||||||||||||
| (as a percentage of total revenues) | |||||||||||||||||||||||
| Revenues: | |||||||||||||||||||||||
| SaaS | 97.7 | % | 77.9 | % | 95.4 | % | 71.1 | % | |||||||||||||||
| Term license subscriptions | 0.6 | 15.3 | 2.3 | 19.7 | |||||||||||||||||||
| Maintenance and services | 1.7 | 6.8 | 2.3 | 9.2 | |||||||||||||||||||
| Total revenues | 100.0 | % | 100.0 | % | 100.0 | % | 100.0 | % | |||||||||||||||
Our products are used by a wide range of enterprises, including Fortune 500 corporations and small and medium-sized businesses. Our customers span a broad array of industries and are located in 100 countries.
Cost of Revenues, Gross Profit and Gross Margin
Cost of revenues consist primarily of salaries (including payroll tax expense related to stock-based compensation), employee benefits (including commissions and bonuses) and stock-based compensation for our customer support, customer success, MDDR and services employees; third-party hosting fees; amortization of certain acquired intangible assets; travel expenses; and allocated overhead costs for facilities, IT and depreciation. We recognize expenses related to these costs as they are incurred and expect that these costs will increase in absolute dollars as we continue to invest in our customer success, support and MDDR teams and support the underlying programs that play a critical role in maintaining our high SaaS renewal rate.
Gross profit is total revenues less total cost of revenues. Gross margin is gross profit expressed as a percentage of total revenues. As the majority of our expenses are relatively fixed quarter over quarter and due to the seasonality of our business, the first quarter typically results in the lowest gross margin as our first quarter revenues have historically been the lowest for the year. Conversely, the fourth quarter typically results in the highest gross margin as our fourth quarter revenues have historically been the highest for the year. We have seen the impact of these seasonal patterns, due to differences in revenue recognition
31
accounting treatment, decline in 2025 and during the nine months ended September 30, 2026 and we expect it to continue to decline, as we seek to sell more of our SaaS offering to customers and complete the end-of-life of our self-hosted business.
Operating Expenses
Operating expenses are classified into three categories: research and development, sales and marketing and general and administrative. For each category, the largest component is personnel costs, which consists of salaries (including payroll tax expense related to stock-based compensation), employee benefits (including commissions and bonuses) and stock-based compensation. Operating expenses also include allocated overhead costs for facilities, IT and depreciation. Allocated costs for facilities primarily consist of rent and office maintenance. Operating expenses are generally recognized as incurred. As a company, we have always aimed to tie our level of investment in the business to the revenues we expect to achieve and we actively manage expenses across the business. We expect personnel costs to continue to increase in absolute dollars as we continue to grow our business.
Research and Development. Research and development expenses primarily consist of personnel costs attributable to our research and development personnel, as well as allocated overhead costs. We expense research and development costs as incurred, except for certain internal-use software development costs that are capitalized. We expect that our research and development expenses will continue to increase in absolute dollars as we further strengthen our technology platform and invest in the development of both existing and new products through the hiring of talented and capable employees.
Sales and Marketing. Sales and marketing expenses are the largest component of our operating expenses and consist primarily of personnel costs, as well as marketing and business development costs, travel expenses, third-party hosting fees, training and education, allocated overhead costs and amortization of certain acquired intangible assets. We expect that sales and marketing expenses will continue to increase in absolute dollars as we plan to expand our sales and marketing efforts, both domestically and internationally. We also expect sales and marketing expenses to continue to be our largest category of operating expenses.
General and Administrative. General and administrative expenses primarily consist of personnel and facility-related costs for our executive, finance, legal, human resources and administrative personnel. Other expenses are comprised of legal, accounting and other consultant fees and other corporate expenses and allocated overhead. We expect that general and administrative expenses will increase in absolute dollars as we expand our operations.
Financial Income (Expenses), Net
Financial income (expenses), net consists primarily of interest income, amortization of premiums and accretion of discounts related to our investment in available for sale marketable securities, foreign exchange gains or losses, amortization of debt issuance costs and interest expense and the remeasurement of options to repurchase common stock. Interest income represents interest received on our cash, cash equivalents, marketable securities and deposits. Foreign exchange gains or losses relate to our business activities in foreign countries with different operational reporting currencies. As a result of our business activities in foreign countries, we expect that foreign exchange gains or losses will continue to occur due to fluctuations in exchange rates in the countries where we do business. Amortization of debt issuance costs relate to the Notes we issued in May 2020 and September 2024. Interest expense consists of the contractual interest expenses associated with the Notes. The Notes we issued in May 2020 matured on August 15, 2025, as such, no further amortization of debt issuance costs or contractual interest expense will be incurred related to these Notes. The remeasurement of options to repurchase common stock are associated with our October 2025 share repurchase program.
Provision for Income Taxes
We operate in the U.S. and in foreign jurisdictions and are subject to taxes in each country or jurisdiction in which we conduct business. Earnings from our non-U.S. activities are subject to local country income tax and may be subject to U.S. income tax.
Because of our history of operating losses, we have established a full valuation allowance against potential future benefits for deferred tax assets, including loss carryforwards. Our income tax provision could be significantly impacted by estimates surrounding our uncertain tax positions and changes to our valuation allowance in future periods. We reevaluate the judgments surrounding our estimates and make adjustments as appropriate each reporting period.
32
In addition, we are subject to the regular examinations of our income tax returns by different tax authorities. We regularly assess the likelihood of adverse outcomes resulting from these examinations to determine the adequacy of our provision for income taxes.
Results of Operations
Comparison of the Three Months Ended September 30, 2026 and 2025
The following tables are a summary of our condensed consolidated statements of operations for the three months ended September 30, 2026 and 2025 in dollars and as a percentage of our total revenues.
| Three Months Ended September 30, | |||||||||||
| 2026 | 2025 | ||||||||||
| (unaudited) (in thousands) | |||||||||||
| Statement of Operations Data: | |||||||||||
| Revenues: | |||||||||||
| SaaS | $ | 185,120 | $ | 125,824 | |||||||
| Term license subscriptions | 1,217 | 24,812 | |||||||||
| Maintenance and services | 3,124 | 10,941 | |||||||||
| Total revenues | 189,461 | 161,577 | |||||||||
| Cost of revenues | 46,890 | 35,149 | |||||||||
| Gross profit | 142,571 | 126,428 | |||||||||
| Operating expenses: | |||||||||||
| Research and development | 78,668 | 62,737 | |||||||||
| Sales and marketing | 80,943 | 74,025 | |||||||||
| General and administrative | 30,674 | 25,600 | |||||||||
| Total operating expenses | 190,285 | 162,362 | |||||||||
| Operating loss | (47,714) | (35,934) | |||||||||
| Financial income, net | 9,188 | 7,806 | |||||||||
| Loss before income taxes | (38,526) | (28,128) | |||||||||
| Provision for income taxes | (3,122) | (1,814) | |||||||||
| Net loss | $ | (41,648) | $ | (29,942) | |||||||
| Three Months Ended September 30, | |||||||||||
| 2026 | 2025 | ||||||||||
(as a percentage of total revenues) | |||||||||||
| Statement of Operations Data: | |||||||||||
| Revenues: | |||||||||||
| SaaS | 97.7 | % | 77.9 | % | |||||||
| Term license subscriptions | 0.6 | 15.3 | |||||||||
| Maintenance and services | 1.7 | 6.8 | |||||||||
| Total revenues | 100.0 | 100.0 | |||||||||
| Cost of revenues | 24.7 | 21.8 | |||||||||
| Gross profit | 75.3 | 78.2 | |||||||||
| Operating expenses: | |||||||||||
| Research and development | 41.5 | 38.8 | |||||||||
| Sales and marketing | 42.8 | 45.8 | |||||||||
| General and administrative | 16.2 | 15.8 | |||||||||
| Total operating expenses | 100.5 | 100.4 | |||||||||
33
| Operating loss | (25.2) | (22.2) | |||||||||
| Financial income, net | 4.9 | 4.8 | |||||||||
| Loss before income taxes | (20.3) | (17.4) | |||||||||
| Provision for income taxes | (1.7) | (1.1) | |||||||||
| Net loss | (22.0) | % | (18.5) | % | |||||||
Revenues
| Three Months Ended September 30, | |||||||||||||||||
| 2026 | 2025 | % Change | |||||||||||||||
| (unaudited) (in thousands) | |||||||||||||||||
| Revenues: | |||||||||||||||||
| SaaS | $ | 185,120 | $ | 125,824 | 47.1 | % | |||||||||||
| Term license subscriptions | 1,217 | 24,812 | (95.1) | % | |||||||||||||
| Maintenance and services | 3,124 | 10,941 | (71.4) | % | |||||||||||||
| Total revenues | $ | 189,461 | $ | 161,577 | 17.3 | % | |||||||||||
| Three Months Ended September 30, | |||||||||||
| 2026 | 2025 | ||||||||||
| (as a percentage of total revenues) | |||||||||||
| Revenues: | |||||||||||
| SaaS | 97.7 | % | 77.9 | % | |||||||
| Term license subscriptions | 0.6 | 15.3 | |||||||||
| Maintenance and services | 1.7 | 6.8 | |||||||||
| Total revenues | 100.0 | % | 100.0 | % | |||||||
For the three months ended September 30, 2026, our revenues increased 17% compared to the three months ended September 30, 2025 despite existing customer conversions to SaaS which cause variations due to accounting treatment differences in revenue recognition for sales within the respective periods. SaaS revenues increased 47% from $125.8 million for the three months ended September 30, 2025 to $185.1 million for the three months ended September 30, 2026. The increase in SaaS revenues is happening due to the simplicity and automated outcomes of our SaaS platform and MDDR offering, as well as customer interest in securing AI and also driven by (i) our high renewal rates, (ii) existing customer conversions and upselling and (iii) new customer acquisitions. Consequently, there was an expected decrease to term license subscriptions given the aforementioned transition and customer conversions. SaaS ARR was $774.6 million and $546.1 million as of September 30, 2026 and 2025, respectively, representing an increase of 42%. The anticipated decrease in maintenance and services revenues was due to the conversion of existing customers to SaaS and churn. We continue to expect less maintenance and services revenues in the future.
Cost of Revenues and Gross Margin
| Three Months Ended September 30, | |||||||||||||||||
| 2026 | 2025 | % Change | |||||||||||||||
| (unaudited) (in thousands) | |||||||||||||||||
| Cost of revenues | $ | 46,890 | $ | 35,149 | 33.4 | % | |||||||||||
34
| Three Months Ended September 30, | |||||||||||
| 2026 | 2025 | ||||||||||
| (as a percentage of total revenues) | |||||||||||
| Total gross margin | 75.3 | % | 78.2 | % | |||||||
The increase in cost of revenues was primarily related to a $6.3 million increase in third-party hosting costs associated with the growth in our SaaS delivery model, a $2.3 million increase in salaries, benefits and stock-based compensation expense due to increased headcount for customer success personnel to assist with the growth of our SaaS delivery model, including our MDDR offering, to ensure high customer satisfaction and to maintain our strong SaaS renewal rate, a $2.3 million increase in developed technology intangible asset amortization due to the business acquisitions and a $0.7 million increase in facilities and allocated overhead costs.
Operating Expenses
| Three Months Ended September 30, | |||||||||||||||||
| 2026 | 2025 | % Change | |||||||||||||||
| (unaudited) (in thousands) | |||||||||||||||||
| Operating expenses: | |||||||||||||||||
| Research and development | $ | 78,668 | $ | 62,737 | 25.4 | % | |||||||||||
| Sales and marketing | 80,943 | 74,025 | 9.3 | % | |||||||||||||
| General and administrative | 30,674 | 25,600 | 19.8 | % | |||||||||||||
| Total operating expenses | $ | 190,285 | $ | 162,362 | 17.2 | % | |||||||||||
| Three Months Ended September 30, | |||||||||||
| 2026 | 2025 | ||||||||||
| (as a percentage of total revenues) | |||||||||||
| Operating expenses: | |||||||||||
| Research and development | 41.5 | % | 38.8 | % | |||||||
| Sales and marketing | 42.8 | 45.8 | |||||||||
| General and administrative | 16.2 | 15.8 | |||||||||
| Total operating expenses | 100.5 | % | 100.4 | % | |||||||
The increase in research and development expenses was primarily related to a $14.2 million increase in salaries, benefits and stock-based compensation expense primarily due to increased headcount and conditional consideration related to the business acquisitions, an increase of $1.2 million in facilities and allocated overhead costs and a $0.4 million increase in third-party hosting costs associated with our SaaS delivery model.
The increase in sales and marketing expenses was primarily related to an increase of $5.2 million in salaries, benefits and stock-based compensation expense and a $1.8 million increase in facilities and allocated overhead costs.
The increase in general and administrative expenses was primarily related to a $5.2 million increase in salaries, benefits and stock-based compensation expense, a $0.5 million increase in consulting and services fees and a $0.3 million increase in facilities and allocated overhead cost, partially offset by a $1.4 million decrease in acquisition-related costs associated with the business acquisitions.
35
Financial Income, Net
| Three Months Ended September 30, | |||||||||||||||||
| 2026 | 2025 | % Change | |||||||||||||||
| (unaudited) (in thousands) | |||||||||||||||||
| Financial income, net | $ | 9,188 | $ | 7,806 | 17.7 | % | |||||||||||
The increase in financial income, net was primarily due to foreign currency gains, less interest and issuance cost amortization expense related to the maturity of the 2025 convertible note and less amortization of premiums on marketable securities, partially offset by lower interest income.
Provision for Income Taxes
| Three Months Ended September 30, | |||||||||||||||||
| 2026 | 2025 | % Change | |||||||||||||||
| (unaudited) (in thousands) | |||||||||||||||||
| Provision for income taxes | $ | (3,122) | $ | (1,814) | (72.1) | % | |||||||||||
Provision for income taxes for the three months ended September 30, 2026, including the change in income taxes, were comprised of foreign and U.S. income taxes.
Results of Operations
Comparison of the Nine Months Ended September 30, 2026 and 2025
The following tables are a summary of our condensed consolidated statements of operations for the nine months ended September 30, 2026 and 2025 in dollars and as a percentage of our total revenues.
| Nine Months Ended September 30, | |||||||||||
| 2026 | 2025 | ||||||||||
| (unaudited) (in thousands) | |||||||||||
| Statement of Operations Data: | |||||||||||
| Revenues: | |||||||||||
| SaaS | $ | 517,912 | $ | 320,279 | |||||||
| Term license subscriptions | 12,275 | 88,674 | |||||||||
| Maintenance and services | 12,423 | 41,210 | |||||||||
| Total revenues | 542,610 | 450,163 | |||||||||
| Cost of revenues | 132,972 | 95,416 | |||||||||
| Gross profit | 409,638 | 354,747 | |||||||||
| Operating expenses: | |||||||||||
| Research and development | 221,768 | 173,194 | |||||||||
| Sales and marketing | 240,257 | 223,366 | |||||||||
| General and administrative | 80,439 | 74,439 | |||||||||
| Total operating expenses | 542,464 | 470,999 | |||||||||
| Operating loss | (132,826) | (116,252) | |||||||||
| Financial income, net | 12,871 | 24,724 | |||||||||
| Loss before income taxes | (119,955) | (91,528) | |||||||||
| Provision for income taxes | (5,356) | (10,021) | |||||||||
| Net loss | $ | (125,311) | $ | (101,549) | |||||||
36
| Nine Months Ended September 30, | |||||||||||
| 2026 | 2025 | ||||||||||
(as a percentage of total revenues) | |||||||||||
| Statement of Operations Data: | |||||||||||
| Revenues: | |||||||||||
| SaaS | 95.4 | % | 71.1 | % | |||||||
| Term license subscriptions | 2.3 | 19.7 | |||||||||
| Maintenance and services | 2.3 | 9.2 | |||||||||
| Total revenues | 100.0 | 100.0 | |||||||||
| Cost of revenues | 24.5 | 21.2 | |||||||||
| Gross profit | 75.5 | 78.8 | |||||||||
| Operating expenses: | |||||||||||
| Research and development | 40.9 | 38.5 | |||||||||
| Sales and marketing | 44.3 | 49.6 | |||||||||
| General and administrative | 14.8 | 16.5 | |||||||||
| Total operating expenses | 100.0 | 104.6 | |||||||||
| Operating loss | (24.5) | (25.8) | |||||||||
| Financial income, net | 2.4 | 5.5 | |||||||||
| Loss before income taxes | (22.1) | (20.3) | |||||||||
| Provision for income taxes | (1.0) | (2.3) | |||||||||
| Net loss | (23.1) | % | (22.6) | % | |||||||
Revenues
| Nine Months Ended September 30, | |||||||||||||||||
| 2026 | 2025 | % Change | |||||||||||||||
| (unaudited) (in thousands) | |||||||||||||||||
| Revenues: | |||||||||||||||||
| SaaS | $ | 517,912 | $ | 320,279 | 61.7 | % | |||||||||||
| Term license subscriptions | 12,275 | 88,674 | (86.2) | % | |||||||||||||
| Maintenance and services | 12,423 | 41,210 | (69.9) | % | |||||||||||||
| Total revenues | $ | 542,610 | $ | 450,163 | 20.5 | % | |||||||||||
| Nine Months Ended September 30, | |||||||||||
| 2026 | 2025 | ||||||||||
| (as a percentage of total revenues) | |||||||||||
| Revenues: | |||||||||||
| SaaS | 95.4 | % | 71.1 | % | |||||||
| Term license subscriptions | 2.3 | 19.7 | |||||||||
| Maintenance and services | 2.3 | 9.2 | |||||||||
| Total revenues | 100.0 | % | 100.0 | % | |||||||
37
For the nine months ended September 30, 2026, our revenues increased 21% compared to the nine months ended September 30, 2025 despite existing customer conversions to SaaS which cause variations due to accounting treatment differences in revenue recognition for sales within the respective periods. SaaS revenues increased 62% from $320.3 million for the nine months ended September 30, 2025 to $517.9 million for the nine months ended September 30, 2026. The increase in SaaS revenues is happening due to the simplicity and automated outcomes of our SaaS platform and MDDR offering, as well as customer interest in securing AI and also driven by (i) our high renewal rates, (ii) existing customer conversions and upselling and (iii) new customer acquisitions. Consequently, there was an expected decrease to term license subscriptions given the aforementioned transition and customer conversions. SaaS ARR was $774.6 million and $546.1 million as of September 30, 2026 and 2025, respectively, representing an increase of 42%. The anticipated decrease in maintenance and services revenues was due to the conversion of existing customers to SaaS and churn. We continue to expect less associated maintenance and services revenues in the future.
Cost of Revenues and Gross Margin
| Nine Months Ended September 30, | |||||||||||||||||
| 2026 | 2025 | % Change | |||||||||||||||
| (unaudited) (in thousands) | |||||||||||||||||
| Cost of revenues | $ | 132,972 | $ | 95,416 | 39.4 | % | |||||||||||
| Nine Months Ended September 30, | |||||||||||
| 2026 | 2025 | ||||||||||
| (as a percentage of total revenues) | |||||||||||
| Total gross margin | 75.5 | % | 78.8 | % | |||||||
The increase in cost of revenues was primarily related to an increase of $18.8 million in third-party hosting costs associated with the growth in our SaaS delivery model, a $9.0 million increase in salaries and benefits and stock-based compensation expense due to increased headcount for customer success personnel to assist with the growth of our SaaS delivery model, including our MDDR offering, to ensure high customer satisfaction and to maintain our strong SaaS renewal rates, a $6.5 million increase in developed technology intangible asset amortization due to the business acquisitions and an increase of $2.7 million in facilities and allocated overhead costs.
Operating Expenses
| Nine Months Ended September 30, | |||||||||||||||||
| 2026 | 2025 | % Change | |||||||||||||||
| (unaudited) (in thousands) | |||||||||||||||||
| Operating expenses: | |||||||||||||||||
| Research and development | $ | 221,768 | $ | 173,194 | 28.0 | % | |||||||||||
| Sales and marketing | 240,257 | 223,366 | 7.6 | % | |||||||||||||
| General and administrative | 80,439 | 74,439 | 8.1 | % | |||||||||||||
| Total operating expenses | $ | 542,464 | $ | 470,999 | 15.2 | % | |||||||||||
38
| Nine Months Ended September 30, | |||||||||||
| 2026 | 2025 | ||||||||||
| (as a percentage of total revenues) | |||||||||||
| Operating expenses: | |||||||||||
| Research and development | 40.9 | % | 38.5 | % | |||||||
| Sales and marketing | 44.3 | 49.6 | |||||||||
| General and administrative | 14.8 | 16.5 | |||||||||
| Total operating expenses | 100.0 | % | 104.6 | % | |||||||
The increase in research and development expenses was primarily related to a $41.6 million increase in salaries and benefits and stock-based compensation expense primarily due to increased headcount and conditional consideration related to the business acquisitions, an increase of $5.3 million in facilities and allocated overhead costs and a $1.6 million increase in third-party hosting costs associated with our SaaS delivery model.
The increase in sales and marketing expenses was primarily related to an increase of $9.2 million in salaries, benefits and stock-based compensation expense, an increase of $4.5 million in facilities and allocated overhead costs and a $3.3 million increase in general sales and marketing expenses, including increased travel, marketing events and third-party hosting costs associated with the growth in our SaaS delivery model.
The increase in general and administrative expenses was primarily related to a $3.8 million increase in salaries, benefits and stock-based compensation expense, a $1.4 million increase in consulting and services fees and a $1.1 million increase in facilities and allocated overhead costs, partially offset by a $0.9 million decrease in acquisition-related costs associated with the business acquisitions.
Financial Income, Net
| Nine Months Ended September 30, | |||||||||||||||||
| 2026 | 2025 | % Change | |||||||||||||||
| (unaudited) (in thousands) | |||||||||||||||||
| Financial income, net | $ | 12,871 | $ | 24,724 | (47.9) | % | |||||||||||
39
The decrease in financial income, net was primarily due to lower interest income, remeasurement of options to repurchase common stock, foreign currency loss and amortization of premiums on marketable securities, partially offset by less interest and issuance cost amortization expense related to the maturity of the 2025 convertible note.
Provision for Income Taxes
| Nine Months Ended September 30, | |||||||||||||||||
| 2026 | 2025 | % Change | |||||||||||||||
| (unaudited) (in thousands) | |||||||||||||||||
| Provision for income taxes | $ | (5,356) | $ | (10,021) | 46.6 | % | |||||||||||
Provision for income taxes for the nine months ended September 30, 2026, including the change in income taxes, were comprised of foreign and U.S. income taxes. Additionally, we recognized $9.7 million of a deferred tax liability which relates to the fair value of intangibles, other than goodwill and the fair value adjustments for the tangible assets acquired over their historical cost basis for the AllTrue.ai acquisition. We will file a consolidated tax return in the U.S. to utilize the benefit of our loss carryforwards against future taxable profit and consequently decreased our valuation allowance in an amount equal to the deferred tax liability recognized in the business combination.
Liquidity and Capital Resources
The following table shows our liquidity and capital resources and our cash flows from operating activities, investing activities and financing activities for the stated periods:
| Nine Months Ended September 30, | |||||||||||
| 2026 | 2025 | ||||||||||
| (unaudited) (in thousands) | |||||||||||
| Net cash provided by operating activities | $ | 108,296 | $ | 122,747 | |||||||
| Net cash provided by (used in) investing activities | 104,628 | (36,760) | |||||||||
| Net cash used in financing activities | (144,452) | (114,218) | |||||||||
| Increase (decrease) in cash and cash equivalents | $ | 68,472 | $ | (28,231) | |||||||
As of September 30, 2026, our cash and cash equivalents, short-term marketable securities and short-term deposits of $631.4 million were held for working capital purposes. We believe that our existing cash and cash equivalents, short-term marketable securities, short-term deposits and cash flow from operations will be sufficient to fund our operations and capital expenditures for at least the next 12 months. Additionally, as of September 30, 2026, we held $306.3 million in long-term marketable securities. Our future capital requirements will depend on many factors, including our rate of revenue growth, timing of renewals and renewal rates, the amount and timing of conversions, the expansion of our sales and marketing activities, the timing and extent of spending to support product development efforts and expansion into new geographic locations, the timing of introductions of new software products and enhancements to existing software products, the continuing market acceptance of our software offerings and our use of cash to pay for acquisitions or share repurchases, if any.
On October 15, 2026, we entered into the Merger Agreement pursuant to which the Parent agreed to acquire us for $49.75 per share in an all-cash transaction. We have agreed to various covenants, including, among others, agreements to conduct our business in the ordinary course in all material respects during the period between the execution of the Merger Agreement and the Effective Time of the Merger. In addition, without the consent of the Parent, we may not take, authorize, agree or commit to do certain actions outside of the ordinary course of business, including incurring capital expenditures above specified thresholds, issuing additional equity securities, incurring indebtedness for borrowed money, and repurchasing shares of our outstanding common stock, in each case, outside of certain limited exceptions. If the Merger Agreement is terminated in certain circumstances, including: (A) by us in order to enter into a superior proposal or by Parent because the Board withdraws its recommendation in favor of the Merger, we would be required to pay Parent a termination fee of $211.7 million and (B) if Parent fails to consummate the Merger following satisfaction or waiver of certain closing conditions and our irrevocable confirmation that we are ready, willing and able to consummate the closing or terminated by us due to Parent’s breach of its obligations under the Merger Agreement, Parent would be required to pay us a reverse termination fee of $423.3 million. We do
40
not believe these restrictions will prevent us from meeting our debt obligations, ongoing costs of operations, working capital needs or capital expenditure requirements.
Operating Activities
Our operating activities are driven by sales of our products less costs and expenses, primarily payroll and related expenses, and adjusted for certain non-cash and non-operating cash flow items, mainly depreciation and amortization, stock-based compensation, amortization of deferred commissions, non-cash operating lease costs, amortization of debt issuance costs, amortization of premium and accretion of discount on marketable securities, deferred income taxes, net and remeasurement of options to repurchase common stock, and changes in operating assets and liabilities. Changes in operating assets and liabilities are driven mainly by collection of accounts receivable from the sales of our software products and deferred revenues, which primarily consists of billed fees for our subscriptions, prior to satisfying the criteria for revenue recognition, which are subsequently recognized as revenue in accordance with our revenue recognition policy.
For the nine months ended September 30, 2026, net cash provided by operating activities was $108.3 million. We have historically observed two seasonal patterns that impact our net cash provided by operating activities, which we continue to expect under a SaaS delivery model. First, a majority of our sales are made during the last three weeks of the quarter. Second, the highest dollar amount of sales of our products and services occurs in the fourth quarter. Consequently, we end the fourth quarter with our highest accounts receivable balance of any quarter which in turn generates the greatest amount of collections in the following quarter. In addition, there is negative sequential sales in the first quarter, which results in a relatively lower amount collected during the second quarter. These seasonal trends also impact our operating loss because the majority of our expenses are relatively fixed in the short-term. For the nine months ended September 30, 2026, cash inflows were $54.2 million from our net loss excluding non-cash and non-operating cash flow charges. Additional sources of cash inflows were from changes in our working capital, including a $75.8 million decrease in accounts receivable. Our days sales outstanding (“DSO”) for the three and nine months ended September 30, 2026 was 80. Other sources of cash inflows was from a $32.4 million increase in accrued expenses and other short-term liabilities, a $4.4 million increase in other long-term liabilities and a $2.9 million increase in trade payables. This was partially offset by a $51.1 million increase in prepaid expenses and other short-term assets (including deferred commissions), a $7.0 million increase in other long-term assets and a $3.2 million decrease in deferred revenues.
For the nine months ended September 30, 2025, net cash provided by operating activities was $122.7 million. For the nine months ended September 30, 2025, cash inflows were $54.2 million from our net loss excluding non-cash charges. Additional sources of cash inflows were from changes in our working capital, including a $46.5 million decrease in accounts receivable. Our DSO for the three and nine months ended September 30, 2025 was 72 and 76, respectively. Other sources of cash inflows were from a $50.1 million increase in deferred revenues, a $23.4 million increase in accrued expenses and other short-term liabilities, a $1.6 million increase in other long-term liabilities and a $0.8 million increase in trade payables. This was partially offset by a $53.5 million increase in prepaid expenses and other short-term assets (including deferred commissions) and a $0.3 million increase in other long-term assets.
Investing Activities
Our investing activities consist primarily of acquisitions, capital expenditures to purchase property and equipment, including leasehold improvements, capitalized internal-use software and the purchase, sale and maturity of deposits and marketable securities. In the future, we expect to continue to incur capital expenditures to support our expanding operations.
For the nine months ended September 30, 2026, net cash provided by investing activities of $104.6 million was attributable to net proceeds of $231.8 million in marketable securities, partially offset by $113.6 million of cash paid for acquisitions, net of cash acquired and escrow refunds, $10.9 million in capital expenditures to support our growth including hardware, software, office equipment and leasehold improvements mainly in connection with existing office space and $2.6 million for capitalized internal-use software expenditures.
For the nine months ended September 30, 2025, net cash used in investing activities of $36.8 million was primarily attributable to $123.5 million of cash paid for acquisitions, $8.7 million in capital expenditures to support our growth including hardware, software, office equipment and leasehold improvements mainly in connection with existing office space and $2.5 million for capitalized internal-use software expenditures, partially offset by net proceeds of $94.6 million in marketable securities and net proceeds of $3.3 million in deposits.
Financing Activities
41
For the nine months ended September 30, 2026, net cash used in financing activities of $144.5 million was attributable to $135.0 million in repurchases of common stock, $22.8 million in taxes paid related to net share settlement of equity awards and $3.5 million for a deferred acquisition payment, partially offset by $14.0 million of proceeds from employee stock plans and $2.9 million in proceeds from options to repurchase common stock.
For the nine months ended September 30, 2025, net cash used in financing activities of $114.2 million was attributable to $100.0 million in repurchases of common stock, $28.4 million in taxes paid related to net share settlement of equity awards and $0.1 million in repayment of 2025 convertible senior note principal, partially offset by $14.3 million of proceeds from employee stock plans.
Convertible Notes
On September 10, 2024, we issued $460.0 million aggregate principal amount of Notes (the "2029 Notes"). The net proceeds from the offering, after deducting issuance costs, were approximately $449.6 million. In connection with the issuance of the 2029 Notes, we used $55.5 million of the net proceeds to enter into Capped Call Transactions.
On May 11, 2020, we issued $253.0 million aggregate principal amount of Notes (the "2025 Notes" and together with the 2029 Notes, the "Notes"). The net proceeds from the offering, after deducting issuance costs, were approximately $245.2 million. In connection with the issuance of the 2025 Notes, we used $29.3 million of the net proceeds to enter into Capped Call Transactions. The 2025 Notes were settled prior to or on their maturity date of August 15, 2025 in accordance with the terms of the 2025 Indenture. Additionally, the Capped Call Transactions entered into in connection with the 2025 Notes were executed and net share settled.
For further information regarding the Notes and Capped Call Transactions, refer to Note 6, "Convertible Senior Notes and Capped Call Transactions," of our condensed consolidated financial statements.
Share Repurchase Programs
In October 2025, our board of directors authorized a share repurchase program of up to $150.0 million of the Company’s common stock (the “October 2025 Share Repurchase Program”). Under the October 2025 Share Repurchase Program, we were authorized to repurchase shares through open market purchases, privately-negotiated transactions or otherwise in accordance with applicable federal securities laws, including through Rule 10b5-1 trading plans and under Rule 10b-18 of the Exchange Act. The October 2025 Share Repurchase Program was completed in March 2026.
In February 2025, our board of directors authorized a share repurchase program of up to $100.0 million of the Company’s common stock (the “February 2025 Share Repurchase Program”). Under the February 2025 Share Repurchase Program, we were authorized to repurchase shares through open market purchases, privately-negotiated transactions or otherwise in accordance with applicable federal securities laws, including through Rule 10b5-1 trading plans and under Rule 10b-18 of the Exchange Act. The February 2025 Share Repurchase Program was completed in April 2025.
Contractual Payment Obligations
Our principal commitments primarily consist of obligations under leases for office space and motor vehicles. Aggregate minimum rental commitments under non-cancelable leases as of September 30, 2026 for the upcoming years were as follows:
| Payments Due by Period | |||||||||||||||||||||||||||||||||||||||||
| 2026 | 2027 | 2028 | 2029 | 2030 | Thereafter | Total | |||||||||||||||||||||||||||||||||||
| (in thousands) | |||||||||||||||||||||||||||||||||||||||||
| Operating lease obligations | $ | 5,750 | $ | 20,531 | $ | 13,865 | $ | 13,184 | $ | 12,195 | $ | 26,918 | $ | 92,443 | |||||||||||||||||||||||||||
We have obligations related to unrecognized tax benefit liabilities totaling $65.3 million and others related to severance pay, which have been excluded from the table above as we do not believe it is practicable to make reliable estimates of the periods in which payments for these obligations will be made. We also have contractual minimum purchase commitments with service providers of $390.8 million through 2031, which includes $12.1 million due within the next 12 months and the remainder due thereafter, primarily under arrangements with no specified annual commitments. We expect to fund these obligations with cash flows from operations and cash on our condensed consolidated balance sheets.
42
Off-Balance Sheet Arrangements
As of September 30, 2026, we did not have any off-balance sheet arrangements.
Critical Accounting Policies and Estimates
We prepare our condensed consolidated financial statements in accordance with generally accepted accounting principles in the United States. The preparation of condensed consolidated financial statements also requires us to make estimates and assumptions that affect the reported amounts of assets, liabilities, revenues, costs and expenses and related disclosures. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances. Actual results could differ significantly from the estimates made by our management. To the extent that there are differences between our estimates and actual results, our future financial statement presentation, financial condition, results of operations and cash flows will be affected. We believe that our accounting policies are critical to understanding our historical and future performance, as these policies relate to the more significant areas involving management’s judgments and estimates. Critical accounting policies and estimates are those that we consider the most important to the portrayal of our financial condition and results of operations because they require our most difficult, subjective or complex judgments, often as a result of the need to make estimates about the effect of the matters that are inherently uncertain.
Recently Issued Accounting Pronouncements Not Yet Adopted
In November 2024, the FASB issued ASU 2024-03, Income Statement-Reporting Comprehensive Income-Expense Disaggregation Disclosures (Subtopic 220-40) - Disaggregation of Income Statement Expenses. The ASU requires, among other items, additional disaggregated disclosures in the notes to the financial statements for certain categories of expenses that are included in the statements of operations. ASU 2024-03 is effective for fiscal years beginning after December 15, 2026, and for interim periods within fiscal years beginning after December 15, 2027, with early adoption permitted, and may be applied either prospectively or retrospectively. We are currently evaluating the effect of adopting the ASU on our disclosures.
In September 2025, the FASB issued ASU 2025-06, Intangibles-Goodwill and Other-Internal-Use Software (Subtopic 350-40) - Targeted Improvements to the Accounting for Internal-Use Software. The ASU was updated to consider different methods of software development and requires internal-use software costs to be capitalized when management has authorized and committed to funding the software project and when significant uncertainty associated with the development of the software has been resolved. The amendments in this ASU are required to be adopted for annual and interim reporting periods beginning after December 15, 2027, with early adoption permitted, and may be applied either through a prospective, retrospective or a modified transition approach. We are currently evaluating the effect of adopting the ASU on our consolidated financial statements.
In December 2025, the FASB issued ASU 2025-11, Interim Reporting (Topic 270) - Narrow-Scope Improvements. The ASU was updated to improve the navigability of the required interim disclosures within ASC No. 270 and to clarify when the guidance applies. This ASU is not intended to change the fundamental nature of interim reporting or expand or reduce current interim disclosure requirements. The amendments in this ASU are required to be adopted for interim reporting periods beginning after December 15, 2027, with early adoption permitted, and may be applied either through a prospective or retrospective approach. We are currently evaluating the effect of adopting the ASU on our condensed consolidated financial statement disclosures.
| Item 3. | Quantitative and Qualitative Disclosures About Market Risk | ||||
Market risk represents the risk of loss that may impact our financial position due to adverse changes in financial market prices and rates. Our market risk exposure is primarily a result of fluctuations in foreign currency exchange rates. We do not hold financial instruments for trading or speculative purposes.
Market Risk
43
We are exposed to certain financial risks, including fluctuations in foreign currency exchange rates and interest rates. We manage our exposure to these market risks through internally established policies and procedures. Our policies do not allow speculation in derivative instruments for profit or execution of derivative instrument contracts for which there are no underlying exposures. We do not use financial instruments for trading or speculative purposes, and we are not a party to any leveraged derivatives. We monitor our underlying market risk exposures on an ongoing basis and, where appropriate, may use hedging strategies to mitigate these risks.
Foreign Currency Exchange Risk
Approximately one fifth of our revenues for the three months ended September 30, 2026 were earned in non-U.S. dollar denominated currencies, mainly in the euro and pound sterling. Our expenses are generally denominated in the currencies in which our operations are located, primarily the U.S. dollar and new Israeli shekel, and to a lesser extent the euro, pound sterling, Canadian dollar, Australian dollar, Singapore dollar, Indian rupee, Japanese yen and Polish zloty. Our expenses denominated in foreign currencies consist primarily of personnel and overhead costs from our international operations. Our condensed consolidated results of operations and cash flow are, therefore, subject to fluctuations due to changes in foreign currency exchange rates and may be adversely affected in the future due to changes in foreign exchange rates. We enter into financial hedging strategies to reduce our exposure to foreign currency rate changes. During 2026, the effect of a hypothetical 10% change in foreign currency exchange rates applicable to our business, after considering foreign currency hedges, would not have had a material impact on our condensed consolidated financial statements.
For purposes of our condensed consolidated financial statements, local currency assets and liabilities are translated at the rate of exchange to the U.S. dollar on the balance sheet date and local currency revenues and expenses are translated at the exchange rate at the date of the transaction or the average exchange rate during the reporting period.
We use derivative financial instruments, specifically foreign currency forward contracts, to manage exposure to foreign currency risks, by hedging a portion of our forecasted revenues and expenses generally expected to occur within periods of up to 24 months. A majority of our revenues and operating expenses are transacted in U.S. dollars; however, certain revenues and operating expenses are incurred in or exposed to other currencies, specifically, the euro and pound sterling for revenues and the new Israeli shekel, euro and pound sterling for operating expenses. The effect of exchange rate changes on foreign currency forward contracts is expected to offset the effect of exchange rate changes on the underlying hedged item. We do not use derivative financial instruments for trading or speculative purposes.
Interest Rate Risk
As of September 30, 2026, we have cash and cash equivalents, short-term marketable securities and short-term deposits of $631.4 million and investments in long-term marketable securities of $306.3 million. We hold our cash and cash equivalents, short-term marketable securities and short-term deposits for working capital purposes. We do not enter into marketable security investments for trading or speculative purposes.
Our cash and cash equivalents, marketable securities and short-term deposits are subject to market risk due to changes in interest rates, which may affect our interest income and the fair value of our marketable securities. Due in part to these factors, our future investment income may fluctuate due to changes in interest rates or we may suffer losses in principal if we are forced to sell securities that decline in market value due to changes in interest rates. Due to the liquid and short-term nature of our cash and cash equivalents, short-term marketable securities and short-term deposit instruments, we believe that we do not have any material exposure to changes in the fair value of these instruments as a result of changes in interest rates. Additionally, because we classify our marketable securities as available-for-sale securities, no gains or losses are recognized in the condensed consolidated statements of operations due to the changes in interest rates, unless securities are sold prior to maturity or declines in fair value are determined to be other-than-temporary. The effect of a hypothetical 100 basis point change in interest rates would not have a material impact on our condensed consolidated financial statements.
In September 2024 we issued the 2029 Notes, which have a fixed annual interest rate of 1.00%, and therefore, we do not have economic interest rate exposure on the 2029 Notes. However, the value of the 2029 Notes is exposed to interest rate risk. Generally, the fair market value of our fixed interest rate 2029 Notes will increase as interest rates fall and decrease as interest rates rise. In addition, the fair value of the 2029 Notes is affected by our stock price. The fair value of the 2029 Notes will generally increase as our common stock price increases and will generally decrease as our common stock price declines in value. Additionally, we carry the 2029 Notes at face value less unamortized costs in our condensed consolidated balance sheets, and we present the fair value for required disclosure purposes only.
44
To the extent we enter into other long-term debt arrangements in the future, we would be subject to fluctuations in interest rates which could have a material impact on our future financial condition and results of operation.
| Item 4. | Controls and Procedures | ||||
Evaluation of Disclosure Controls and Procedures
We maintain disclosure controls and procedures (as that term is defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended ("Exchange Act")) that are designed to ensure that information required to be disclosed in our reports under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms, and that such information is accumulated and communicated to our management, including its Chief Executive Officer and Chief Financial Officer, as appropriate, to allow timely decisions regarding required disclosures. Any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving the desired control objectives. Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, evaluated the effectiveness of our disclosure controls and procedures as of the end of the period covered by this report. Based on that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures as of the end of the period covered by this report were effective to accomplish their objectives at the reasonable assurance level.
Changes in Internal Control over Financial Reporting
There was no change in our internal control over financial reporting that occurred during the three months ended September 30, 2026 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.
We regularly seek to identify, develop and implement improvements to our technology systems and business processes, some of which may affect our internal control over financial reporting. These changes may include such activities as implementing new, more efficient systems, updating existing systems or platforms, automating manual processes or utilizing technology developed by third parties. These system changes are often phased in over multiple periods in order to limit the implementation risk in any one period, and as each change is implemented, we monitor its effectiveness as part of its internal control over financial reporting.
| PART II. | OTHER INFORMATION | ||||
| Item 1. | Legal Proceedings | ||||
The information required by this Item is incorporated herein by reference to Part I, Item 1. “Financial Statements,” Note 1, “Contractual Purchase Obligations and Contingent Liabilities” of our accompanying Notes to Condensed Consolidated Financial Statements included in Part I, Item 1 of this Quarterly Report on Form 10-Q.
| Item 1A. | Risk Factors | ||||
Investing in our securities involves risk. You should carefully consider the following risks and all other information contained herein, including our condensed consolidated financial statements and the related notes thereto. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, also may become important factors that affect us. If any of the following risks materialize, our business, financial condition and results of operations could be materially harmed.
Summary Risk Factors
Our business faces significant risks. In addition to the summary below, you should carefully review the Risk Factors in this Quarterly Report on Form 10-Q. We may be subject to additional risks and uncertainties not presently known to us or that we currently deem immaterial. Our business, financial condition and results of operations could be materially adversely affected by any of these risks, and the trading price of our common stock could decline by virtue of these risks. These risks should be read in conjunction with the other information in this report. The following is a summary of the principal risks of our business:
45
•failure to complete, or delays in completing, the Merger could materially and adversely affect our business, financial condition, results of operations, and stock price;
•uncertainty about the Merger may adversely affect relationships with our customers, partners, suppliers, and employees, whether or not the Merger is completed;
•the fact that the market for software that analyzes, secures, governs, manages and migrates enterprise data may not continue to grow or grow at the same pace;
•prolonged economic uncertainties or downturns;
•currency exchange rate fluctuations;
•increased competition;
•security breaches, cyberattacks or other cyber-risks and failure to comply with legal requirements, contractual obligations and industry standards regarding security, data protection and privacy;
•our expansion into cloud-delivered services;
•our ability to predict renewal rates and manage growth effectively;
•fluctuation in our quarterly results of operations due to variability in our revenues;
•our limited operating history at our current scale, which makes it difficult to evaluate and predict our future prospects;
•our history of losses;
•our ability to maintain strong relationships with our channel partners, including distributors and resellers, to whom we sell substantially all of our products and services;
•risks inherent in our international operations, including military conflicts that could impact operations, the effect of export and import controls and the risk of a violation or alleged violation of applicable anti-corruption or anti-bribery laws;
•collection and credit risks;
•stock price volatility;
•our ability to maintain or enhance our brand recognition or reputation;
•our ability to retain, attract and recruit highly qualified personnel;
•our dependency on the continued services and performance of our co-founder, Chief Executive Officer and President;
•our ability to continually enhance and improve our technology;
•the fact that, if we experience interruptions or performance problems with our products, or if our software is not perceived as being secure, customers may reduce the use of or stop using our products;
•our ability to protect our proprietary technology and intellectual property rights;
•the fact that our tax rate may vary significantly depending on our stock price;
•our ability to fully utilize our net operating loss carryforwards; and
•our indebtedness.
Risks Related to the Merger
Failure to complete, or delays in completing, the Merger could materially and adversely affect our business, financial condition, results of operations, and stock price.
On October 15, 2026, we entered into the Merger Agreement with Parent and Merger Sub. Completion of the Merger is subject to approval by our stockholders, receipt of required regulatory approvals and the satisfaction of other customary closing conditions in the Merger Agreement. The parties to the Merger Agreement may not receive the necessary approvals for the transaction or receive them within the expected timeframe. In addition, the Merger may fail to close for other reasons, and either we or Parent may terminate the Merger Agreement if the Merger is not consummated by July 15, 2027, subject to an automatic three-month extension under specified circumstances relating to required regulatory approvals. If the proposed Merger is delayed or not completed, we are subject to a number of risks, including:
•our management will have devoted significant attention and resources to the Merger;
•we could be subject to litigation related to any failure to complete the Merger;
•if the Merger Agreement is terminated, under some circumstances, we may be required to pay a termination fee of $211.7 million;
•if the Merger Agreement is terminated under circumstances in which Parent is required to pay us a reverse termination fee of $423.3 million, such fee, together with certain limited expense reimbursement and enforcement costs, generally will be our sole and exclusive monetary remedy against Parent and its related parties and may not be sufficient to compensate us for our losses;
•we will remain liable for significant transaction costs, including legal, accounting, financial advisory and other costs relating to the Merger regardless of whether the Merger is consummated;
•the price of our common stock may decline, including to the extent that the current market price of our common stock reflects an assumption that the Merger and the other transactions contemplated by the Merger Agreement will be
46
consummated without delays, which could have a material adverse effect on our business, results of operations, and financial condition.
If any of these effects were to occur, it could adversely impact our business, results of operations, financial condition or cash flow, as well as the market price of our common stock and our perceived value, regardless of whether the Merger is completed.
Uncertainty about the Merger may adversely affect relationships with our employees, customers, partners and suppliers, whether or not the Merger is completed.
Uncertainty about the Merger and the effect of the Merger on customers, partners, suppliers, employees and other third parties who deal with us may have a material adverse effect on our business, results of operations, and financial condition. Such uncertainties may impair our ability to attract, retain, and motivate key personnel pending the consummation of the Merger, as such personnel may experience uncertainty about their future roles following the consummation of the Merger, creating distractions and thus resulting in a decline in their productivity.
These uncertainties could also lead current and prospective customers and partners to purchase products and services from other providers or delay purchasing from us, which could have a material adverse effect on our business, results of operations, financial condition, and market price of our common stock. The Merger may also generate negative publicity and a negative impression of us in the financial markets, and may lead to litigation against us and our directors and officers.
The pursuit of the Merger may place a significant burden on management and internal resources, which may have a negative impact on our ongoing business. It may also divert management’s time and attention from the day-to-day operation of our remaining businesses and the execution of our other strategic initiatives. This could adversely affect our financial results.
Any of the foregoing, individually or in combination, could materially and adversely affect our business, our financial condition and our results of operations.
While the Merger is pending, we are subject to contractual restrictions and interim covenants that could harm our business relationships, financial condition, results of operations, and business.
The Merger Agreement generally requires us to operate our business in the ordinary course in all material respects, subject to certain exceptions, pending consummation of the Merger, and subjects us to customary interim operating covenants that restrict us from taking certain specified actions without Parent's approval until the Merger is consummated or the Merger Agreement is terminated in accordance with its terms, including, among other things, issuing or repurchasing equity securities; incurring debt; entering into, establishing, adopting, amending, modifying or terminating any employee benefit plan or certain contracts; increasing the compensation or employee benefits of certain employees, contractors or service providers or hiring or terminating certain employees, contractors or service providers; settling, releasing, waiving or compromising certain legal proceedings; materially changing our methods, principles or practices of financial accounting; and incurring certain capital expenditures. These restrictions could prevent us from pursuing certain business opportunities that may arise prior to the consummation of the Merger and may affect our ability to execute our business strategies and attain financial and other goals and may impact our financial condition, results of operations and cash flows.
The Merger Agreement contains provisions that limit our ability to pursue alternatives to the Merger.
Under the Merger Agreement, we are restricted from soliciting or engaging in discussions or negotiations with respect to any alternative acquisition proposal, subject to customary fiduciary exceptions. In addition, under certain circumstances, including if we terminate the Merger Agreement to enter into an agreement providing for a superior proposal or if Parent terminates the Merger Agreement because our board of directors adversely changes its recommendation in favor of the Merger, we would be required to pay Parent a termination fee of $211.7 million. These provisions could discourage a third party that may have an interest in acquiring all or a significant part of our business from considering or proposing an acquisition, even if such third party were prepared to pay consideration with a higher value than the value of the consideration provided for in the Merger Agreement.
The Merger will involve substantial costs.
The Company and Parent have incurred, and expect to continue to incur, a number of non-recurring costs associated with the proposed Merger, a substantial majority of which will consist of transaction and regulatory costs.
Lawsuits may be filed against us and the members of our board of directors arising out of the Merger, which may delay or prevent the Merger.
47
Stockholder complaints and other complaints may be filed against us, our board of directors, Parent, Parent's board of directors, and others in connection with the transactions contemplated by the Merger Agreement. The outcome of litigation is uncertain, and we may not be successful in defending against any such claims. Such lawsuits could delay or prevent the Merger, divert the attention of our management and employees from our day-to-day business, result in substantial costs to us, and otherwise adversely affect our business, results of operations, and financial condition.
Risks Related to the Industry in which we Operate
The market for software that analyzes, secures, governs, manages and migrates enterprise data may not continue to grow or grow at the same pace.
We believe our future success depends in large part on the continued growth of the market for software that enables enterprises to analyze, secure, govern, manage and migrate their data. In order for us to market and sell our products, we must successfully demonstrate to enterprise IT, security and business personnel the risk of their valuable data getting compromised or stolen and the effectiveness of our products to mitigate these risks. Despite a number of high-profile cyberattacks around the world, we must still persuade customers to devote a portion of their budgets to a unified platform that we offer to analyze, secure, govern, manage and extract value from this resource. Enterprises may not recognize the need for our products or, if they do, may not decide that they need a solution that offers the range of functionalities that we offer. The market for our solution may not continue to grow at its current rate or at all and the failure of the market to continue to develop would materially adversely impact our results of operations.
Prolonged economic uncertainties or downturns could materially adversely affect our business.
Our business depends on our current and prospective customers’ ability and willingness to invest in IT services, including cybersecurity projects, which in turn is dependent upon their overall economic health. Negative conditions in the general economy both in the United States and abroad, including inflationary pressure, currency fluctuations and a higher interest rate environment, changes in gross domestic product growth, instability in connection with political elections, potential future government shutdowns, the federal government’s failure to raise the debt ceiling, financial and credit market fluctuations, the imposition of trade barriers and restrictions such as tariffs, political deadlock, restrictions on travel, natural catastrophes, warfare and terrorist attacks, could cause a decrease in business investments, including corporate spending on enterprise software in general and negatively affect the rate of growth of our business. For example, our operations, and the operations of our customers and partners, were affected by geopolitical turmoil and sanctions caused by the war between Russia and Ukraine, and the COVID-19 pandemic and efforts to control its spread, including by mandatory business closures and capacity limitations imposed by the jurisdictions in which we operate. Similar events and restrictions in the future could negatively affect our business.
Uncertainty in the global economy makes it extremely difficult for our customers and us to forecast and plan future business activities accurately. This could cause our customers to reevaluate decisions to purchase our product or to delay their purchasing decisions, which could lengthen our sales cycles and negatively impact our results. In recent years, the European economy experienced economic turmoil that caused the devaluation of local European currencies (specifically, the euro and the pound sterling), inflationary pressures and general economic uncertainty. As a result, there has been, and may in the future be, budgetary tightening and longer sales cycles in the region which may negatively impact our results of operations. In addition, the imposition of tariffs may materially impact business performance for companies operating around the world and may cause budgetary tightening and longer sales cycles for companies in those impacted countries. The United States could also experience a sustained period of elevated inflation, which may put pressure on discretionary spending by our customers, and a lengthening of our sales cycle in the region, which could negatively impact our results.
A downturn in any of our leading industries, or a reduction in any revenue-generating vertical, may cause enterprises to react to worsening conditions by reducing their spending on IT. Customers may delay or cancel IT projects, choose to focus on in-house development efforts or seek to lower their costs by renegotiating maintenance and support agreements. To the extent purchases of our software are perceived by customers and potential customers to be discretionary, our revenues may be disproportionately affected by delays or reductions in general IT spending. In addition, consolidation in certain industries may result in reduced spending on our software. If the economic conditions of the general economy or industries in which we operate worsen from present levels, our business, results of operations and financial condition could be adversely affected.
Overall economic uncertainty may in the future give rise to a number of risks, including, but not limited to, the following:
48
• reduced economic activity could lead to a prolonged recession, which could negatively impact spending by our customers or the ability of customers to pay for our services;
• not meeting expectations with respect to certain key performance metrics, such as SaaS renewal rates and SaaS annual recurring revenues;
• our ability to enter into new markets and to acquire new customers;
• an increase in bad debt reserves as customers face economic hardship and collectability becomes more uncertain, including the risk of bankruptcies;
• variability with forward-looking guidance and financial results, including management’s accounting estimates and assumptions; and
• our ability to raise capital.
The challenges posed by and the full impact of negative conditions in the general economy on our business and our future performance are difficult to predict and there is a risk that any guidance we provide to the market may turn out to be incorrect.
We may face increased competition in our market.
Data security is a rapidly growing and evolving market, driven by increasing regulatory demands, the proliferation of data across hybrid environments, the rising sophistication of cyber threats and increasing AI usage, which increases the need for data security. The growing adoption of AI‑driven applications, agents and automation has expanded the types of sensitive assets that organizations must protect, including machine identities, secrets, credentials and non‑human access paths, which further increases demand for data security and adjacent security solutions. As a result, the market is attracting investment from both established players and emerging innovators, which is driving increased awareness for the need to secure data, increasing the size of the data security market and intensifying the competitive landscape. Over time, we have strategically made investments in our platform to better serve our customers and also address new use cases, which has grown our market opportunity and also brought us into more competitive discussions.
While there are some companies which offer certain features similar to those embedded in our solutions, and others with whom we compete in certain tactical use cases, we believe that no single competitor delivers the same automated outcomes on the number of platforms and applications that we support. However, we do face competition from a select group of software vendors that provide standalone solutions similar to those features embedded in our comprehensive platform, particularly in the markets we serve. We also face direct competition in specific use cases, specifically DSPM, data discovery and classification, privacy, data migration, data subject access requests and Active Directory security. Following our acquisition of AllTrue.ai, we have expanded our platform with AI security capabilities that provide organizations with visibility into, and governance and real‑time control over, AI systems, models and agents that access and act on enterprise data. As a result, we now compete more directly with vendors focused on AI security, AI governance and risk management, cloud security and adjacent data protection markets. As we continue to augment our functionality with AI security, insider threat detection and user behavior analytics and as we expand our classification capabilities to better serve compliance needs, such as General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act ("CCPA") and other data privacy laws, we may face increased perceived and real competition from other security and classification technologies. Our growing presence in the cloud data security market and our broader product coverage are also placing us in more direct competition with companies focused on discovery and classification. As customer requirements evolve and new technologies emerge, including evolving AI architecture and deployment models, we face heightened competition from companies—both established and emerging—that develop solutions targeting the enterprise data market.
In particular, if a more established company were to target our market, we may face significant competition. They may have competitive advantages, such as greater name recognition, larger sales, marketing, research and acquisition resources, access to larger customer bases and channel partners, a longer operating history and lower labor and development costs, which may enable them to respond more quickly to new or emerging technologies and changes in customer requirements or devote greater resources to the development, promotion and sale of their products than we do. Increased competition could result in us failing to attract customers or maintain licenses at the same rate. It could also lead to price cuts, alternative pricing structures or the introduction of products available for free or a nominal price, reduced gross margins, longer sales cycles, lower renewal rates and loss of market share.
In addition, our current or prospective channel partners may establish cooperative relationships with future competitors. These relationships may allow future competitors to rapidly gain significant market share. These developments could also limit our ability to obtain revenues from existing and new customers.
Our ability to compete successfully in our market will also depend on a number of factors, including ease and speed of product deployment and use, the quality and reliability of our customer service and support, total cost of ownership, return on investment and brand recognition. Any failure by us to successfully address current or future competition in any one of these or
49
other areas may reduce the demand for our products and adversely affect our business, results of operations and financial condition.
Lastly, at times, we engage in discussions and collaborations with other technology companies, including companies that offer security‑related products, regarding potential partnerships, integrations, or commercial relationships. While these discussions are intended to expand our ecosystem and market reach, they may involve the sharing of information about our products, strategy, and potential future development plans. Even where appropriate confidentiality measures are in place, these counterparties may use knowledge gained through such interactions to inform their own product development, roadmap decisions, or competitive strategies, including in ways that increase competition with us. As a result, our efforts to pursue partnerships could accelerate the development of competing offerings or otherwise adversely affect our competitive position.
We are subject to a number of legal requirements, contractual obligations and industry standards regarding security, data protection and privacy, and any failure to comply with these requirements, obligations or standards could have an adverse effect on our reputation, business, financial condition and operating results.
Privacy and data protection laws in the United States and internationally are rapidly evolving and remain subject to uncertainty. U.S. federal, state, and foreign authorities have enacted, and continue to consider, laws governing the collection, use, disclosure, storage, and security of personal information. In the United States, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) impose significant obligations on businesses and grant consumers enhanced rights, such as the ability to opt out of certain sales of personal information. In recent years, numerous U.S. states have enacted comprehensive privacy laws, and additional states continue to consider similar legislation. These laws generally impose obligations relating to the collection, use, disclosure, storage, security, and processing of personal information, provide consumers with enhanced rights regarding their personal data, and require businesses to implement specified data protection measures. Because these laws are not uniform and continue to evolve, they increase the complexity of the regulatory landscape and may increase our compliance costs, require changes to our business practices, products and services, and expose us to heightened regulatory, litigation, and reputational risks.
Internationally, nearly every jurisdiction where we operate has established its own privacy and data security framework, often more restrictive than U.S. laws, governing the collection, use, storage, disclosure, and protection of data that identifies or could identify an individual (for example, names, email addresses, and, in some jurisdictions, IP addresses). The European Union’s General Data Protection Regulation (GDPR) imposes stringent obligations, and the United Kingdom has implemented similar legislation. In 2025, the United Kingdom enacted the Data (Use and Access) Act 2025, which amends the UK GDPR regime, including targeted changes related to automated decision‑making, cookies, recognized legitimate interests, regulator powers, and international transfers. In December 2025, the European Commission renewed its UK adequacy decisions (subject to review), supporting continued data flows between the UK and the EEA.
Cross‑border data transfers from the European Economic Area and the UK to the United States rely on mechanisms such as standard contractual clauses, the UK’s International Data Transfer Agreement (or Addendum), and the EU–U.S. Data Privacy Framework (including its UK extension). In September 2025, the European General Court upheld the validity of the EU–U.S. Data Privacy Framework, providing near‑term stability for organizations that self‑certify to the framework; however, challenges and appeals remain possible, and the transfer landscape continues to evolve. Compliance with GDPR, the UK regime as amended by the Data (Use and Access) Act 2025, and other international privacy laws may require significant operational changes and costs, while non‑compliance could result in substantial fines, litigation, and reputational harm, adversely affecting our business, financial condition, and results of operations.
Certain U.S. and international laws also require companies to notify individuals of security breaches involving personal information, whether caused by us or our service providers. Despite contractual protections, a breach could harm our reputation, erode customer trust, reduce sales, lead to customer loss, and expose us to liability or significant remediation costs. Beyond government regulation, privacy advocates and industry groups may introduce new self‑regulatory standards that could apply to us. We also anticipate continued legislative and regulatory developments in privacy, data protection, and information security, the impact of which remains uncertain. In addition, regulatory frameworks governing artificial intelligence, automated decision-making, and the use of data in connection with AI systems are rapidly evolving in the United States, Europe, the United Kingdom, and other jurisdictions. These requirements may impose additional compliance obligations, restrict certain product functionality, increase costs, or result in regulatory investigations, enforcement actions or litigation. New laws, amendments, or reinterpretations of existing requirements—as well as evolving industry standards and contractual obligations—may increase compliance costs and restrict our operations. Because interpretation and enforcement of these requirements are uncertain, they may conflict with our current practices or product features. If so, we could face fines, litigation, or be required to make fundamental changes to our business or software, which may not be commercially feasible and could limit our ability to innovate. Failure to adequately address privacy concerns—whether valid or perceived—or to comply with applicable
50
requirements could result in additional costs, liability, reputational harm, inhibited sales, and other adverse effects on our business.
Furthermore, compliance costs and other burdens imposed by privacy and data protection laws applicable to our customers may increase the cost of using our products, limit their adoption, and reduce overall demand. In addition, privacy and personal information security concerns—whether well‑founded or not—may discourage market acceptance of our products, particularly in certain industries and international markets.
Risks Related to Our Operations
Security breaches, cyberattacks or other cyber-risks of our IT and production systems could expose us to significant liability and cause our business and reputation to suffer and harm our competitive position.
Our corporate infrastructure stores and processes our sensitive, proprietary and other confidential information (including as related to financial, technology, employees, marketing, sales, etc.) which is used on a daily basis in our operations. In addition, our software involves transmission and processing of our customers’ confidential, proprietary and sensitive information. We have legal and contractual obligations to protect the confidentiality and appropriate use of customer data. As a leader in the cyber industry, we may be an attractive target for cyber attackers or other data thieves.
High-profile cyberattacks and security breaches have increased in recent years, with the potential for such acts heightened as a result of the number of employees working remotely due to many companies adopting a hybrid working model. Security industry experts and government officials have warned about the risks of hackers and cyberattacks targeting IT products and enterprise infrastructure. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and often are not recognized until launched against a specific target, we may be unable to anticipate these techniques or to implement adequate preventative measures. As we continue to increase our client base and expand our brand, we may become more of a target for third parties seeking to compromise our security systems and we anticipate that hacking attempts and cyberattacks will increase in the future. We may not always be successful in preventing or repelling unauthorized access to our systems. We also may face delays in our ability to identify or otherwise respond to any cybersecurity incident or any other breach. Additionally, we use third-party service providers to provide some services to us that involve the cloud hosting, storage or transmission of data, such as SaaS, cloud computing, and internet infrastructure and bandwidth, and they face various cybersecurity threats and also may suffer cybersecurity incidents or other security breaches. Despite our security measures, our IT and infrastructure may be vulnerable to attacks. Threats to IT security can take a variety of forms. Individual and groups of hackers and sophisticated organizations, including state-sponsored organizations or nation-states, continuously undertake attacks that pose threats to our customers and our IT. These actors may use a wide variety of methods, which may include developing and deploying malicious software or exploiting vulnerabilities in hardware, software, or other infrastructure in order to attack our products and services or gain access to our networks, using social engineering techniques to induce our employees, users, partners, or customers to disclose passwords or other sensitive information or take other actions to gain access to our data or our users’ or customers’ data, or acting in a coordinated manner to launch distributed denial of service or other coordinated attacks. Inadequate account security practices may also result in unauthorized access to confidential and/or sensitive data or loss of SaaS platform availability.
Security risks, including, but not limited to, unauthorized use or disclosure of customer data, loss of availability of our SaaS platform offering, cyberattack on our cloud providers, theft of proprietary information, theft of intellectual property, theft of internal employee’s PII/PHI information, theft of financial data and financial reports, loss or corruption of customer data and computer hacking attacks or other cyberattacks, could require us to expend significant capital and other resources to alleviate the problem and to improve technologies, may impair our ability to provide services to our customers and protect the privacy of their data, may result in product development delays, may compromise confidential or technical business information, may harm our competitive position, may result in theft or misuse of our intellectual property or other assets and could expose us to substantial litigation expenses and damages, indemnity and other contractual obligations, government fines and penalties, mitigation expenses, costs for remediation and incentives offered to affected parties, including customers, other business partners and employees, in an effort to maintain business relationships after a breach or other incident, and other liabilities. We are continuously working to improve our IT systems, together with creating security boundaries around our critical and sensitive assets. We provide advanced security awareness training to our employees and contractors that focuses on various aspects of the cybersecurity world. All of these steps are taken in order to mitigate the risk of attack and to ensure our readiness to responsibly handle any security violation or attack. If an actual or perceived breach of our security occurs, the market perception of the effectiveness of our security measures and our products could be harmed, we could lose potential sales and existing customers, our ability to operate our business could be impaired, we may incur significant liabilities, we could suffer harm to our reputation and competitive position, and our operating results could be negatively impacted.
51
The expansion of cloud-delivered services introduces a number of risks and uncertainties, which could adversely affect our business, results of operations and financial condition.
The launch of our cloud offerings that allow customers to use hosted software required, and any future expansion of our cloud-delivered services may require, a considerable investment in resources, including technical, financial, legal, sales, information technology and operation systems. Additionally, market acceptance of such offerings is affected by a variety of factors, including but not limited to: security, reliability, scalability, customization, performance, current license terms, customer preference, customer concerns with entrusting a third-party to store and manage their data, public concerns regarding privacy and the enactment of restrictive laws or regulations. It is possible that demand for our cloud offerings may not continue to be as strong as it has been to date. Moreover, expansion of our cloud offerings may cause a decline in revenue of our existing products and services that is not offset by revenue from the new products or services. For example, customers may delay making purchases of products and services to permit them to make a more thorough evaluation of these new products and services or until industry and marketplace reviews become widely available. We may be unable to realize the benefits of our investments or the resources we have committed to expanding our cloud-delivered services.
An increasing number of jurisdictions are imposing data localization laws, which require personal information, or certain subcategories of personal information, to be stored in the jurisdiction of origin. These regulations may deter customers from using cloud-based services, and may inhibit our ability to expand into certain markets or prohibit us from continuing to offer services in those markets without significant additional costs.
Our hosted offerings rely upon third-party providers to supply data center space, equipment maintenance and other colocation services and rely upon the ability of those providers to maintain continuous service availability and protect customer data on their services. Customers of our cloud-based offerings need to be able to access our platform at any time, without interruption or degradation of performance, and we provide them with service level commitments with respect to uptime. Third-party cloud providers run their own platforms that we access, and we are, therefore, vulnerable to their service interruptions. Although we have entered into various agreements for the lease of data center space, equipment maintenance and other services, third parties could fail to live up to their contractual obligations. The failure of a third-party provider to prevent service disruptions, data losses or security breaches may require us to issue credits or refunds or indemnify or otherwise be liable to customers or third parties for damages that may occur, and contractual provisions with our third-party providers and public cloud partners may limit our recourse against the third-party provider or public cloud partner responsible for such failure. Additionally, if these third-party providers fail to deliver on their obligations, our reputation could be damaged, our customers could lose confidence in us, and our ability to maintain and expand our hosted offerings would be impaired. Lastly, our cloud product offering and pricing is new and hosting and other costs may be more expensive to us than anticipated.
We may not be able to predict renewal or conversion rates and their impact on our future revenues and operating results.
Although our solutions are designed to increase the number of customers that purchase our products and the number of products purchased by existing and new customers to create a recurring revenue stream that increases and is more predictable over time, our customers are not required to renew their subscriptions for our solutions and they may elect not to renew when, or as we expect, or they may elect to reduce the scope of their original purchases or delay their purchase. We cannot accurately predict renewal or conversion rates given our varied customer base of enterprise and small and medium size business customers and the number of multiyear contracts. Customer renewal or conversion rates may decline or fluctuate due to a number of factors, including offering pricing, competitive offerings, customer satisfaction and reductions in customer spending levels or customer activity due to economic downturns, the adverse impact of import tariffs, inflation or other market uncertainty. If our customers do not renew their contracts when or as we expect, or if they choose to renew for fewer products or renew for shorter contract lengths or if they renew on less favorable terms, our revenues and earnings may decline, and our business may suffer. Further, we plan to end-of-life our self-hosted business as of December 31, 2026, which we expect to increase the uncertainty with our remaining term license customers going forward. This may result in a decline in revenues and cause revenues to be more difficult to predict for a period of time. We may occasionally inform customers that products or services will be reaching their end-of-life and will no longer be supported or receive updates or security patches. Failure to effectively manage this process could lead to customer dissatisfaction and contractual liabilities, which could adversely affect our business and operating results.
Our quarterly results of operations have fluctuated and may fluctuate significantly due to variability in our revenues which could adversely impact our stock price.
52
Our revenues and other results of operations have fluctuated from quarter to quarter in the past and could continue to fluctuate in the future. Historically, the fluctuation was partially due to the front-loaded revenue recognition nature of our business. Additionally, the Company has converted the significant majority of its customers to a SaaS delivery model that recognizes revenue ratably and not up front. However, there are still a number of term license subscriptions remaining to be converted and, as a result, we may present reduced revenues as compared to prior periods, and comparing our revenues and results of operations on a period-to-period basis may not be meaningful and should not be relied on for any particular period. Our revenues depend in part on the conversion of enterprises that have undergone risk assessments into paying customers; however, these risk assessments may not be converted at the same historical rates or at all. At the same time, the majority of our sales are typically made during the last three weeks of every quarter. We may fail to meet market expectations for that quarter if we are unable to close the number of transactions that we expect during this short period and closings are deferred to a subsequent quarter or not closed at all. The closing of a large transaction in a particular quarter may raise our revenues in that quarter and thereby make it more difficult for us to meet market expectations in subsequent quarters and our failure to close a large transaction in a particular quarter or any renewals may adversely impact our revenues in that quarter. In addition, our sales cycle from initial contact to delivery of and payment for the software license generally becomes longer and less predictable with respect to large transactions and often involves multiple meetings or consultations at a substantial cost and time commitment to us. Further, we have been focusing on the conversion of our current OPS customers to our SaaS platform and the sales cycle of such conversions can and may continue to take longer than the acquisition of new customers. Moreover, we base our current and future expense levels on our revenue forecasts and operating plans, and our expenses are relatively fixed in the short-term. Accordingly, we would likely not be able to reduce our costs sufficiently to compensate for an unexpected shortfall in revenues and even a relatively small decrease in revenues could disproportionately and adversely affect our financial results for that quarter.
The variability and unpredictability of these and other factors, many of which are outside of our control, could result in our failing to meet or exceed financial expectations for a given period and may cause the price of our common stock to decline substantially.
If we do not successfully optimize and manage our predominantly SaaS‑based business model, or if the remaining transition away from self‑hosted products fails to progress as expected, our results of operations could be negatively impacted.
As our business is now substantially SaaS‑focused, our future performance depends heavily on our ability to effectively operate, scale, and continuously improve our SaaS offerings. Although customer adoption of our SaaS solutions has increased significantly, uncertainties remain regarding whether and when our remaining self‑hosted customers will convert and the degree to which our SaaS offerings will continue to meet evolving customer expectations for functionality, reliability, security, and value.
This SaaS strategy continues to pose a number of risks, including the following:
•our revenues and operating margins may fluctuate more than anticipated as our business model relies on subscription revenues, which may be more sensitive to renewal rates, customer usage patterns, and macroeconomic conditions;
•the remaining self‑hosted customer base may convert more slowly than projected, or certain customers may choose not to transition at all, which could reduce expected growth or require continuing investment in legacy offerings;
•customers may continue to express concerns related to long‑term pricing, data access, data residency, or vendor lock‑in, which could affect new subscription sales or renewal rates;
•we may be unsuccessful in maintaining or adjusting our pricing models, product tiers, or packaging strategies, or such changes may adversely affect customer adoption, demand, or earnings;
•if our customers do not renew their subscriptions, reduce usage, or delay renewal decisions, our revenues may decline and our business and operating results may suffer;
•our hosting, infrastructure, or third‑party cloud costs may exceed forecasts, or our SaaS platform may not scale or operate as efficiently as anticipated, negatively affecting gross margins;
•we may incur higher than expected sales compensation expenses if the pace of remaining conversions or new SaaS sales varies from forecasted levels; and
•our sales force and customer facing teams may face ongoing challenges with selling and supporting SaaS solutions, which may lead to productivity issues, increased turnover, or the need for additional training and investment.
If we fail to effectively manage or optimize our SaaS‑focused operating model, or if customer adoption, retention, or conversion does not continue at expected levels, our revenues, margins, and overall results of operations could suffer.
Our results of operations could be negatively affected by foreign currency exposures.
53
Our functional and reporting currency is the U.S. dollar. While the majority of our revenues and expenses are denominated in U.S. dollars, we also generate revenues and incur operating expenses in foreign currencies, primarily the euro, pound sterling, Canadian dollar, Australian dollar, Singapore dollar and new Israeli shekel. As a result, our operating results are exposed to movements in foreign currency exchange rates.
Exchange rates between the U.S. dollar and foreign currencies have been volatile in recent years. In addition, based on our current geographic revenue mix, cost structure and expected growth profile, even if foreign exchange rates remain at or near current levels, we expect to experience foreign currency‑related headwinds in future periods, which could adversely affect our reported revenues, operating margins and results of operations.
A strengthening of the U.S. dollar relative to foreign currencies may increase the local‑currency cost of our software and renewals for customers outside the United States and may adversely affect demand, pricing, renewal rates and revenue growth. At the same time, a weakening of the U.S. dollar against currencies in which we incur expenses would increase the U.S. dollar equivalent of those costs, including employee compensation and other operating expenses at our non‑U.S. locations, which could negatively impact operating margins and increase compensation pressure in those regions.
We use foreign currency forward contracts to hedge a portion of our exposure to foreign‑currency‑denominated revenues and operating expenses. These hedging activities may not fully offset the impact of current or future exchange rate movements and involve costs and risks, including cash requirements, management time and resources, external implementation costs, potential accounting impacts and the risk of losses resulting from volatility in foreign currency markets or differences between the exchange rates of the currencies being hedged. As a result, our results of operations and financial condition may be adversely affected by foreign exchange rate movements even if exchange rates remain stable.
We have been growing and expect to continue to invest in our growth for the foreseeable future. If we fail to manage this growth effectively, our business and results of operations will be adversely affected.
We intend to continue to grow our business and plan to continue to hire new sales employees either for expansion or replacement of existing sales personnel. If we cannot adequately and timely hire new employees and if we fail to adequately train these new employees, including our sales force, engineers and customer support staff, our sales may not grow at the rates we project and/or our sales productivity might suffer, our customers might decide not to renew or reduce the scope of their original purchases, or our customers may lose confidence in the knowledge and capability of our employees or products. We must successfully manage our growth to achieve our objectives. Although our business has experienced significant growth in the past, we may not be able to continue to grow at the same rate, or at all.
Our ability to effectively manage any significant growth of our business will depend on a number of factors, including our ability to do the following:
• satisfy existing customers and attract new customers;
• adequately and timely recruit, train, motivate and integrate new employees, including our sales force and engineers, while retaining existing employees, maintaining the beneficial aspects of our corporate culture and effectively executing our business plan;
• successfully introduce new products and enhancements;
• effectively manage existing channel partnerships and expand to new ones;
• improve our key business applications and processes to support our business needs;
• enhance information and communication systems to ensure that our employees and offices around the world are well-coordinated and can effectively communicate with each other and our growing customer base;
• enhance our internal controls to ensure timely and accurate reporting of all of our operations and financial results;
• protect and further develop our strategic assets, including our intellectual property rights;
• continue to capitalize on the transition to a SaaS delivery model; and
• successfully manage and integrate any future acquisitions of businesses, including without limitation, the amount and timing of expenses and potential future charges for impairment of goodwill from acquired companies.
These activities will require significant investments and allocation of valuable management and employee resources, and our growth will continue to place significant demands on our management and our operational and financial infrastructure. We may not be able to grow our business in an efficient or timely manner, or at all. Moreover, if we do not effectively manage the growth of our business and operations, the quality of our software could suffer, which could negatively affect our brand, results of operations and overall business.
54
We have a limited operating history at our current scale, which makes it difficult to evaluate and predict our future prospects and may increase the risk that we will not be successful.
We have a relatively short history operating our business at its current scale. For example, we have increased the number of our employees and have expanded our operations and product offerings. This limits our ability to forecast our future operating results and subjects us to a number of uncertainties, including our ability to plan for and model future growth. We have encountered and will continue to encounter risks and uncertainties frequently experienced by growing companies in new markets that may not develop as expected. Because we depend in part on the market’s acceptance of our products, it is difficult to evaluate trends that may affect our business. If our assumptions regarding these trends and uncertainties, which we use to plan our business, are incorrect or change in reaction to changes in our markets, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations and our business could suffer. Moreover, although we have experienced significant growth historically, we may not continue to grow as quickly, or at all, in the future.
Our future success will depend in large part on our ability to, among other things:
•convert our remaining self-hosted customers to our SaaS delivery model;
• manage our introduction of cloud-based solutions;
• maintain and expand our business, including our customer base and operations, to support our growth, both domestically and internationally;
• develop new products and services and bring products and services in beta to market;
• renew customer agreements and sell additional products to existing customers;
• maintain high customer satisfaction and ensure quality and timely releases of our products and product enhancements;
• increase market awareness of our products and enhance our brand;
• maintain compliance with applicable governmental regulations and other legal obligations, including those related to intellectual property, international sales and taxation;
• hire, integrate, train and retain skilled talent, including members of our sales force and engineers; and
• our ability to successfully manage and integrate any acquisitions of businesses.
If we fail to address the risks and difficulties that we face, including those associated with the challenges listed above as well as those described elsewhere in this “Risk Factors” section, our business will be adversely affected, and our results of operations will suffer.
If we are unable to attract new customers and expand sales to existing customers, both domestically and internationally, our growth could be slower than we expect, and our business may be harmed.
Our success will depend, in part, on our ability to support new and existing customer growth and maintain customer satisfaction. Our sales and marketing teams host in-person events and engage with customers online and through other communications channels, including virtual meetings. Our sales and marketing teams may not be as successful or effective in building relationships. If we cannot provide the tools and training to our teams to efficiently do their jobs and satisfy customer demands, we may not be able to achieve anticipated revenue growth as quickly as expected.
Our future growth depends upon expanding sales of our products and capabilities to existing customers and their organizations and obtaining renewals. If our customers do not purchase additional products or capabilities, our revenues may grow more slowly than expected, may not grow at all, or may decline. Our efforts to increase sales to existing customers may not be successful, and if we are unable to effectively upsell our customers, our business, operating results and financial condition could be adversely affected.
Our future growth also depends, in part, on increasing our customer base, particularly among customers with potentially high customer lifetime values. Our ability to achieve significant future revenue growth depends in large part on the effectiveness of our sales and marketing efforts, both domestically and internationally, and our ability to attract new customers. Existing and future laws and regulations may restrict sales and marketing activities. Laws governing telemarketing, electronic communications, privacy, data protection and consumer protection continue to evolve and may limit our ability to identify, contact and engage prospective customers or increase the costs associated with our sales and marketing activities. If these laws reduce the effectiveness of our sales and marketing efforts, our ability to attract new customers and expand existing customer relationships may be adversely affected, which could harm our revenues, business and operating results.
We have a history of losses, and we may not be profitable in the future.
55
We have incurred net losses in each year since our inception, including a net loss of $125.3 million for the nine months ended September 30, 2026 and net losses of $129.3 million and $95.8 million in each of the years ended December 31, 2025 and 2024, respectively. Because the market for our software is rapidly evolving and has still not yet reached widespread adoption, it is difficult for us to predict our future results of operations. We expect our operating expenses to increase over the next several years as we hire additional personnel, expand and improve the effectiveness of our distribution channels, and continue to develop features and applications for our software.
If we are unable to maintain successful relationships with our channel partners, our business could be adversely affected.
We rely on channel partners, such as distribution partners and resellers, to sell the Varonis Data Security Platform. In 2025 and for the nine months ended September 30, 2026, our channel partners fulfilled substantially all of our sales, and we expect that sales to channel partners will continue to account for substantially all of our revenues for the foreseeable future. Our ability to achieve revenue growth in the future will depend in part on our success in maintaining successful relationships with our channel partners.
Our agreements with our channel partners are generally non-exclusive, meaning our channel partners may offer customers the products of several different companies. If our channel partners do not effectively market and sell our software, choose to use greater efforts to market and sell their own products or those of others, or fail to meet the needs of our customers, our ability to grow our business, sell our software and maintain our reputation may be adversely affected. Our contracts with our channel partners generally allow them to terminate their agreements for any reason upon 30 days’ notice. A termination of the agreement has no effect on orders already placed. The loss of a substantial number of our channel partners, our possible inability to replace them, or the failure to recruit additional channel partners could materially and adversely affect our results of operations. If we are unable to maintain our relationships with these channel partners, our business, results of operations, financial condition or cash flows could be adversely affected.
Finally, even if we are successful, our relationships with channel partners may not result in greater customer usage of our products or increased revenue.
Our long-term growth depends, in part, on being able to continue to expand internationally on a profitable basis, which subjects us to risks associated with conducting international operations.
Historically, we have generated the majority of our revenues from customers in the United States. For the year ended December 31, 2025 and for the nine months ended September 30, 2026, approximately 71% and 72%, respectively, of our total revenues were derived from sales in the United States. Nevertheless, we have operations across the globe, and we plan to continue to expand our international operations as part of our long-term growth strategy. The further expansion of our international operations will subject us to a variety of risks and challenges, including:
• sales and customer service challenges associated with operating in different countries;
• increased management travel, infrastructure and legal compliance costs associated with having multiple international operations;
• difficulties in receiving payments from different geographies, including difficulties associated with currency fluctuations, payment cycles, transfer of funds or collecting accounts receivable, especially in emerging markets;
• variations in economic or political conditions between each country or region;
• economic uncertainty around the world and adverse effects arising from economic interdependencies across countries and regions;
• uncertainty around a potential reverse or renegotiation of international trade agreements and partnerships;
• compliance with foreign laws and regulations and the risks and costs of non-compliance with such laws and regulations;
• ability to hire, retain and train local employees and the ability to comply with foreign labor laws and local labor requirements, such as representations by an internal labor committee in France which is affiliated with an external trade union and the applicability of collective bargaining arrangements at the national level in certain European countries;
• compliance with laws and regulations for foreign operations, including the U.S. Foreign Corrupt Practices Act of 1977, as amended (the “FCPA”), the U.K. Bribery Act of 2010 (the “UK Bribery Act”), import and export control laws, tariffs, trade barriers, economic sanctions and other regulatory or contractual limitations on our ability to sell our software in certain foreign markets, and the risks and costs of non-compliance;
56
• heightened risks of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of financial statements and irregularities in financial statements;
• reduced protection for intellectual property rights in certain countries and practical difficulties and costs of enforcing rights abroad; and
• compliance with the laws of numerous foreign taxing jurisdictions and overlapping of different tax regimes and digital tax imposed on our operations in foreign taxing jurisdictions.
Any of these risks could adversely affect our international operations, reduce our revenues from outside the United States or increase our operating costs, adversely affecting our business, results of operations and financial condition and growth prospects. There can be no assurance that all of our employees, independent contractors and channel partners will comply with the formal policies we have and will implement, or applicable laws and regulations. Violations of laws or key control policies by our employees, independent contractors and channel partners could result in delays in revenue recognition, financial reporting misstatements, fines, penalties or the prohibition of the importation or exportation of our software and services and could have a material adverse effect on our business and results of operations.
We are subject to governmental export and import controls that could subject us to liability or impair our ability to compete in international markets.
We incorporate certain encryption technology into certain of our products and, as a result, are required to comply with U.S. export control laws and regulations, including the Export Administration Regulations administered by the U.S. Department of Commerce’s Bureau of Industry and Security (“BIS”). We are also subject to Israeli export control laws on encryption technology. These export control laws and regulations prohibit, restrict, or regulate our ability to, directly or indirectly, export, re-export, or transfer certain products to certain countries and territories, entities, and individuals for certain end uses. If the applicable U.S. or Israeli legal requirements regarding the export of encryption technology were to change or if we change the encryption means in our products, we may (i) be unable to export our products, (ii) need to apply for new licenses or (iii) be unable to rely on certain license exceptions. Furthermore, various other countries regulate the import of certain encryption technology, including import permitting and licensing requirements, and have enacted laws that could limit our ability to distribute our products or could limit our customers’ ability to implement our products in those countries.
We are also subject to U.S. and Israeli economic sanctions laws, which prohibit the shipment of certain products to embargoed or sanctioned countries, sanctioned governments and sanctioned persons. Like with export controls, we take precautions to prevent our products from being provided in violation of these laws, including requiring our business partners to commit to compliance through contractual undertakings. However, if our business partners were to provide our products to certain countries, governments, or sanctioned persons in violation of these laws, such provision could have negative consequences, including government investigations, penalties and reputational harm.
Any change in export or import regulations, economic sanctions or related legislation, shift in the enforcement or scope of existing regulations, or change in the countries, governments, persons or technologies targeted by such regulations, could result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers with international operations. Moreover, any new export or import restrictions, new legislation or shifting approaches in the enforcement or scope of existing regulations, or in the countries, persons or technologies targeted by such regulations, could result in decreased use of our products. Any decreased use of our products or limitation on our ability to export or sell our products would likely adversely affect our business, financial condition and results of operations.
Our business in countries with a history of corruption and transactions with foreign governments increase the risks associated with our international activities.
As we operate and sell internationally, we are subject to the FCPA, the UK Bribery Act and other laws that prohibit improper payments or offers of payments to foreign governments and their officials and political parties for the purpose of obtaining or retaining business. We have operations, deal with and make sales to governmental customers in countries known to experience corruption, particularly certain emerging countries in Eastern Europe, South and Central America, East Asia, Africa and the Middle East. Our activities in these countries create the risk of unauthorized payments or offers of payments by one of our employees, consultants, channel partners or sales agents that could be in violation of various anti-corruption laws, even though these parties may not be under our control. While we have implemented safeguards to prevent these practices by our employees, consultants, channel partners and sales agents, our existing safeguards and any future improvements may prove to be less than effective, and our employees, consultants, channel partners or sales agents may engage in conduct for which we might be held responsible. Violations of the FCPA or other anti-corruption laws may result in severe criminal or civil sanctions, including
57
suspension or debarment from government contracting, and we may be subject to other liabilities, which could negatively affect our business, operating results and financial condition.
Acquisitions could disrupt our business and adversely affect our results of operations, financial condition and cash flows.
As we continue to pursue business opportunities, we may make acquisitions that could be material to our business, results of operations, financial condition and cash flows. Acquisitions involve many risks, including the following:
• an acquisition may negatively affect our results of operations, financial condition or cash flows because it may require us to incur charges or assume substantial debt or other liabilities, may cause adverse tax consequences or unfavorable accounting treatment, including potential write-downs of deferred revenues, may expose us to claims and disputes by third parties, including intellectual property claims and disputes, or may not generate sufficient financial return to offset additional costs and expenses related to the acquisition;
• we may encounter difficulties or unforeseen expenditures in integrating the business, technologies, products, personnel or operations of any company that we acquire, particularly if key personnel of the acquired company decide not to work for us;
• an acquisition may disrupt our ongoing business, divert resources, increase our expenses and distract our management;
• an acquisition may result in a delay or reduction of customer purchases for both us and the company we acquired due to customer uncertainty about continuity and effectiveness of service from either company;
• we may encounter difficulties in, or may be unable to, successfully sell any acquired products;
• an acquisition may involve the entry into geographic or business markets in which we have little or no prior experience or where competitors have stronger market positions;
• challenges inherent in effectively managing an increased number of employees in diverse locations;
• the potential strain on our financial and managerial controls and reporting systems and procedures;
• potential known and unknown liabilities or deficiencies associated with an acquired company that were not identified in advance;
• our use of cash to pay for acquisitions would limit other potential uses for our cash and affect our liquidity;
• if we incur debt to fund such acquisitions, such debt may subject us to material restrictions on our ability to conduct our business as well as financial maintenance covenants;
• the risk of impairment charges related to potential write-downs of acquired assets or goodwill in future acquisitions;
• to the extent that we issue a significant amount of equity or convertible debt securities in connection with future acquisitions, existing stockholders may be diluted and earnings per share may decrease; and
• managing the varying intellectual property protection strategies and other activities of an acquired company.
We may not succeed in addressing these or other risks or any other problems encountered in connection with the integration of any acquired business. Our ability as an organization to successfully acquire and integrate technologies or businesses is limited. The inability to successfully integrate the business, technologies, products, personnel or operations of any acquired business, or any significant delay in achieving integration, could have a material adverse effect on our business, results of operations, financial condition and cash flows.
We are exposed to collection and credit risks, which could impact our operating results.
Our accounts receivable is subject to collection and credit risks. These agreements may include purchase commitments for multiple years of SaaS and term license subscriptions, which may be invoiced over multiple reporting periods increasing these risks. For example, our operating results may be impacted by significant bankruptcies among customers and resellers, which could negatively impact our revenues and cash flows. Although we have processes in place that are designed to monitor and mitigate these risks, we cannot guarantee these programs will be effective. If we are unable to adequately control these risks, our business, operating results and financial condition could be harmed.
Our business is highly dependent upon our brand recognition and reputation, and the failure to maintain or enhance our brand recognition or reputation may adversely affect our business.
We believe that enhancing the “Varonis” brand identity and maintaining our reputation in the IT industry is critical to our relationships with our customers and to our ability to attract new customers. Our brand recognition and reputation are dependent upon:
• our ability to continue to offer high quality, innovative and error- and bug-free products;
• our ability to maintain customer satisfaction with our products;
58
• our ability to be responsive to customer concerns and provide high quality customer support, training and professional services;
• our marketing efforts;
• any misuse or perceived misuse of our products;
• positive or negative publicity;
• our ability to prevent or quickly react to any cyberattack on our IT systems or security breach of or related to our software;
• interruptions, delays or attacks on our website; and
• litigation or regulatory-related developments.
We may not be able to successfully promote our brand or maintain our reputation. In addition, independent industry analysts often provide reviews of our products, as well as other products available in the market, and perception of our product in the marketplace may be significantly influenced by these reviews. If these reviews are negative, or less positive than reviews about other products available in the market, our brand may be adversely affected. Furthermore, negative publicity relating to events or activities attributed to us, our employees, our channel partners or others associated with any of these parties, may tarnish our reputation and reduce the value of our brand. If we do not successfully enhance our brand and maintain our reputation, our business may not grow, we may have reduced pricing power relative to competitors with stronger brands, and we could lose customers or renewals, all of which would adversely affect our business, operations and financial results. Moreover, damage to our reputation and loss of brand equity may reduce demand for our products and have an adverse effect on our business, results of operations and financial condition. Any attempts to rebuild our reputation and restore the value of our brand may be costly and time consuming, and such efforts may not ultimately be successful.
Moreover, it may be difficult to enhance our brand and maintain our reputation in connection with sales to channel partners. Promoting our brand requires us to make significant expenditures, and we anticipate that the expenditures will increase as our market becomes more competitive, as we expand into new markets and geographies and as more sales are generated to our channel partners. To the extent that these activities yield increased revenues, these revenues may not offset the increased expenses we incur.
Our success depends in part on maintaining, converting to SaaS and increasing our sales to customers in the public sector.
We derive a portion of our revenues from contracts with federal, state, local and foreign governments and government-owned or -controlled entities (such as public health care bodies, educational institutions and utilities), which we refer to as the public sector herein. We believe that part of the success and growth of our business will continue to depend on our successful procurement of public sector contracts. Selling to public sector entities can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that our efforts will produce any sales. Government demand and payment for our products and services may be impacted by public sector budgetary cycles, or lack of, and funding authorizations, including in connection with an extended government shutdown, with funding reductions or delays adversely affecting public sector demand for our products and services. Factors that could impede our ability to maintain or increase the amount of revenues derived from public sector contracts include:
• changes in public sector fiscal or contracting policies;
• decreases or elimination of available public sector funding;
• non-compliance with or an inability to attain the proper certification to conduct business in the public sector;
• changes in public sector programs or applicable requirements;
• the adoption of new laws or regulations or changes to existing laws or regulations;
• potential delays or changes in the public sector appropriations or other funding authorization processes;
• the requirement of contractual terms that are unfavorable to us, such as most-favored-nation pricing provisions; and
• delays in the payment of our invoices by public sector payment offices.
In addition, we must comply with laws and regulations relating to public sector contracting, which affect how we and our channel partners do business in both the United States and abroad. These laws and regulations may impose added costs on our business, and failure to comply with these or other applicable regulations and requirements, including non-compliance in the past, could lead to claims for damages from our channel partners, penalties, termination of contracts, and temporary suspension or permanent debarment from public sector contracting. Moreover, governments may investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our products, which would adversely impact our revenue and results of operations, or institute fines or civil or criminal liability if the audit uncovers improper or illegal activities.
59
The occurrence of any of the foregoing could cause public sector customers to delay or refrain from purchasing licenses of our software in the future or otherwise have an adverse effect on our business, operations and financial results.
Risks Related to Human Capital
Talent acquisition and retention challenges could adversely affect our growth and operational performance.
Our ability to sustain growth and execute our strategy depends heavily on attracting, retaining and scaling a highly productive workforce, particularly in sales, marketing and research and development. As we continue to expand our platform, the complexity of our sales process has increased, requiring a more consultative and technically skilled sales force. This shift has introduced new challenges in hiring and onboarding qualified personnel, especially in competitive markets. We face intense competition for top talent, particularly in regions like Israel where we maintain a significant research and development presence. Recruiting individuals with the right expertise, whether for new geographies, specialized sales roles, or advanced research and development positions is increasingly difficult. Remote hiring and training, high attrition rates and the time required to ramp new hires (which can take up to 12 months for sales personnel to operate at a level that meets our expectations) further complicate our ability to scale effectively. Our growth also depends on retaining key employees and preserving our corporate culture. Any inability to attract or retain skilled personnel, including key managers, could hinder our ability to innovate, deliver new products and compete effectively. Additionally, equity compensation is a critical component of our talent strategy. A decline in our stock price or changes to our equity programs could reduce the attractiveness of our compensation packages, making it harder to recruit and retain top talent. If we fail to maintain or improve the productivity of our teams, or if we are unable to hire and integrate new personnel efficiently, our ability to meet growth targets, expand into new markets and serve our customers effectively could be materially impacted.
We are dependent on the continued services and performance of our co-founder, Chief Executive Officer and President, the loss of whom could adversely affect our business.
Much of our future performance depends on the continued services and continuing contributions of our co-founder, Chief Executive Officer and President, Yakov Faitelson, to successfully manage our company, to execute on our business plan and to identify and pursue new opportunities and product innovations. The loss of Mr. Faitelson’s services could significantly delay or prevent the achievement of our development and strategic objectives and adversely affect our business.
Risks Related to our Technology, Products, Services and Intellectual Property
Our failure to continually enhance and improve our technology could adversely affect sales of our products.
The market is characterized by the exponential growth in enterprise data, rapid technological advances, changes in customer requirements, including customer requirements driven by changes to legal, regulatory and self-regulatory compliance mandates, frequent new product introductions and enhancements and evolving industry standards in computer hardware and software technology. As a result, we must continually change and improve our products in response to changes in operating systems, application software, computer and communications hardware, networking software, data center architectures, programming tools, computer language technology and various regulations. Moreover, the technology in our products is especially complex because it needs to effectively identify and respond to a user’s data retention, security and governance needs, while minimizing the impact on database and file system performance. Our products must also successfully interoperate with products from other vendors.
While we extend our technological capabilities though innovation and strategic transactions, including our recently announced MDDR, DAM, email security, AI security and cloud-based solutions, we cannot guarantee that we will be able to anticipate future market needs and opportunities or be able to extend our technological expertise and develop new products or expand the functionality of our current products in a timely manner or at all. Even if we are able to anticipate, develop and introduce new products and expand the functionality of our current products, there can be no assurance that enhancements or new products will achieve widespread market acceptance.
Our product enhancements or new products could fail to attain sufficient market acceptance for many reasons, including:
• failure to accurately predict market demand in terms of product functionality and to supply products that meet this demand in a timely fashion;
• inability to interoperate effectively with the database technologies and file systems of prospective customers;
• defects, errors or failures;
60
• negative publicity or customer complaints about performance or effectiveness; and
• poor business conditions, causing customers to delay IT purchases.
If we fail to anticipate market requirements or stay abreast of technological changes, we may be unable to successfully introduce new products, expand the functionality of our current products or convince our customers and potential customers of the value of our solutions in light of new technologies. In addition, it is possible that our product innovations, including our recently announced MDDR, DAM, email security, AI security and cloud-based solutions, may not provide satisfactory results to our customers. Accordingly, our business, results of operations and financial condition could be materially and adversely affected.
If our technical support, customer success or professional services are not satisfactory to our customers, they may not renew their agreements or not buy additional products in the future, which could adversely affect our future results of operations.
Our business relies on our customers’ satisfaction with the technical support, customer success and professional services we provide to support our products. Our customers have no obligation to renew their agreements with us after the initial terms have expired. Our customers have an option to renew their agreements and, for us to maintain and improve our results of operations, it is important that our existing customers renew their agreements, if applicable, when the existing contract term expires. For example, our SaaS renewal rate for the nine months ended September 30, 2026 and 2025 is over 90%.
If we fail to provide technical support services that are responsive, satisfy our customers’ expectations and resolve issues that they encounter with our products and services, then they may elect not to purchase or renew contracts and they may choose not to purchase additional products and services from us. Accordingly, our failure to provide satisfactory technical support, customer success or professional services could lead our customers not to renew their agreements with us or renew on terms less favorable to us, and therefore have a material and adverse effect on our business and results of operations.
Interruptions or performance problems, including associated with our website or support website or any caused by cyberattacks, may adversely affect our business.
Our continued growth depends in part on the ability of our existing and potential customers to quickly access our website and support website. Access to our support website is also imperative to our daily operations and interaction with customers, as it allows customers to download our software, fixes and patches, as well as open and respond to support tickets and register license keys for evaluation or production purposes. We have experienced, and may in the future experience, website disruptions, outages and other performance problems due to a variety of factors, including technical failures, cyberattacks, natural disasters, infrastructure changes, human or software errors, capacity constraints due to an overwhelming number of users accessing our website simultaneously and denial of service or fraud. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time. System failures or outages, including any potential disruptions due to a period of increased global demand on certain cloud-based systems or disruptions of our cloud-based solutions, could compromise our or our customer’s ability to perform day-to-day operations in a timely manner, which could negatively impact our business or delay our financial reporting. It may become increasingly difficult to maintain and improve the performance of our websites, especially during peak usage times and as our software becomes more complex and our user traffic increases. If our websites are unavailable or if our users are unable to download our software, patches or fixes within a reasonable amount of time or at all, we may suffer reputational harm and our business would be negatively affected.
If our software is perceived as not being secure, customers may reduce the use of or stop using our software, and we may incur significant liabilities.
Our software involves the transmission of data between data stores, and between data stores and desktop and mobile computers, and will increasingly involve the storage of data. We have a legal and contractual obligation to protect the confidentiality and appropriate use of customer data. Any security breaches with respect to such data could result in the loss of this information, litigation, indemnity obligations and other liabilities. The security of our products and accompanied services is important in our customers’ decisions to purchase or use our products or services. Security threats are a significant challenge to companies like us whose business is providing technology products and services to others. While we have taken steps to protect the confidential information that we have access to, including confidential information we may obtain through our customer support services or customer usage of our products, we have no direct control over the substance of the content. Security measures might be breached as a result of third-party action, employee error, malfeasance or otherwise. We also incorporate open source software and other third-party software into our products. There may be vulnerabilities in open source software and third-party software that may make our products likely to be harmed by cyberattacks. Moreover, our products operate in conjunction with and are dependent on products and components across a broad ecosystem of third parties. If there is a security
61
vulnerability in one of these components, and if there is a security exploit targeting it, such security vulnerability may adversely impact our product vulnerability and we could face increased costs, liability claims, reduced revenue, or harm to our reputation or competitive position. Because techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until they are launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures.
The limitations of liability in our contracts may not be enforceable or adequate or otherwise protect us from any such liabilities or damages with respect to any particular claim. While we maintain insurance coverage for some of the above events, the potential liabilities associated with these security breach events could exceed the insurance coverage we maintain.
We incorporate machine learning and AI solutions into parts of our platform, offerings, services and features, and these applications may become more important in our operations over time. AI technologies, including generative AI, are complex and rapidly evolving, and we face competition from other companies as well as an evolving regulatory landscape. Several jurisdictions around the globe, including Europe and the United States, have already proposed or enacted laws governing AI, and we may need to commit significant resources to maintain business practices that comply with the evolving regulatory landscape. Our competitors or other third parties may incorporate AI into their products more quickly and successfully than us, which could impair our ability to compete effectively and adversely affect our results of operations. In addition, the increasing adoption of agentic AI technologies may increase the risk of control failures, security vulnerabilities and unauthorized actions. Errors or unintended decisions by autonomous AI systems could result in operational disruptions, regulatory exposure or financial losses.
Any or all of these issues could tarnish our reputation, negatively impact our ability to attract new customers or sell additional products to our existing customers, cause existing customers to elect not to renew their agreements or subject us to third-party lawsuits, regulatory fines or other action or liability, thereby adversely affecting our results of operations.
Our use of open source software could negatively affect our ability to sell our software and subject us to possible litigation.
We use open source software and expect to continue to use open source software in the future. Some open source software licenses require users who distribute open source software as part of their own software product to publicly disclose all or part of the source code to such software product or to make available any derivative works of the open source code on unfavorable terms or at no cost. We may face ownership claims of third parties over, or seeking to enforce the license terms applicable to, such open source software, including by demanding the release of the open source software, derivative works or our proprietary source code that was developed using such software. These claims could also result in litigation, require us to purchase a costly license or require us to devote additional research and development resources to change our software, any of which would have a negative effect on our business and results of operations. In addition, if the license terms for the open source code change, we may be forced to re-engineer our software or incur additional costs. Some open source software may include generative AI software or other software that incorporates or relies on generative AI. The use of such software may expose us to risks as the intellectual property ownership and license rights, including copyright, of generative AI software and tools, has not been fully interpreted by U.S. courts or been fully addressed by federal or state regulation. Finally, while we implement policies and procedures, we cannot provide assurance that we have incorporated open source software into our own software in a manner that conforms with our current policies and procedures and we cannot assure that all open source software is reviewed prior to use in our solution, that our programmers have not incorporated open source software into our solution, or that they will not do so in the future.
In addition, our solution may incorporate third-party software under commercial licenses. We cannot be certain whether such third-party software incorporates open source software without our knowledge. In the past, companies that incorporate open source software into their products have faced claims alleging noncompliance with open source license terms or infringement or misappropriation of proprietary software. Therefore, we could be subject to suits by parties claiming noncompliance with open source licensing terms or infringement or misappropriation of proprietary software. Because few courts have interpreted open source licenses, the manner in which these licenses may be interpreted and enforced is subject to some uncertainty. There is a risk that open source software licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market or provide our solution. As a result of using open source software subject to such licenses, we could be required to release proprietary source code, pay damages, re-engineer our solution, limit or discontinue sales or take other remedial action, any of which could adversely affect our business.
False detection of security breaches, false identification of malicious sources or misidentification of sensitive or regulated information could adversely affect our business.
62
Our cybersecurity products may falsely detect threats that do not actually exist. For example, our DatAlert product may enrich metadata collected by our products with information from external sources and third-party data providers. If the information from these data providers is inaccurate, the potential for false positives increases. These false positives, while typical in the industry, may affect the perceived reliability of our products and solutions and may therefore adversely impact market acceptance of our products. As definitions and instantiations of personal identifiers and other sensitive content change, automated classification technologies may falsely identify or fail to identify data as sensitive. If our products and solutions fail to detect exposures or restrict access to important systems, files or applications based on falsely identifying legitimate use as an attack or otherwise unauthorized, then our customers’ businesses could be adversely affected. Any such false identification of use and subsequent restriction could result in negative publicity, loss of customers and sales, increased costs to remedy any problem and costly litigation.
Failure to protect our proprietary technology and intellectual property rights could substantially harm our business.
The success of our business and competitive position depends on our ability to obtain, protect and enforce our trade secrets, trademarks, copyrights, patents and other intellectual property rights. We attempt to protect our intellectual property under patent, trademark, copyrights and trade secret laws, and through a combination of confidentiality procedures, contractual provisions and other methods, all of which offer only limited protection and may not now or in the future provide us with a competitive advantage.
As of September 30, 2026, we have 134 issued patents in the United States and 70 pending U.S. patent applications. We also have 58 patents issued and 123 applications pending for examination in non-U.S. jurisdictions, and 25 pending PCT patent applications, all of which are counterparts of our U.S. patent applications. We may file additional patent applications in the future. The process of obtaining patent protection is expensive and time-consuming, and we may not be able to prosecute all necessary or desirable patent applications at a reasonable cost or in a timely manner all the way through to the successful issuance of a patent. We may choose not to seek patent protection for certain innovations and may choose not to pursue patent protection in certain jurisdictions. Furthermore, it is possible that our patent applications may not issue as granted patents, that the scope of our issued patents will be insufficient or not have the coverage originally sought, that our issued patents will not provide us with any competitive advantages, and that our patents and other intellectual property rights may be challenged by others or invalidated through administrative process or litigation. In addition, issuance of a patent does not guarantee that we have an absolute right to practice the patented invention. Our policy is to require our employees (and our consultants and service providers that develop intellectual property included in our products) to execute written agreements in which they assign to us their rights in potential inventions and other intellectual property created within the scope of their employment (or, with respect to consultants and service providers, their engagement to develop such intellectual property). However, we may not be able to adequately protect our rights in every such agreement or execute an agreement with every such party. Finally, in order to benefit from patent and other intellectual property protection, we must monitor, detect and pursue infringement claims in certain circumstances in relevant jurisdictions, all of which is costly and time-consuming. As a result, we may not be able to obtain adequate protection or to enforce our issued patents or other intellectual property effectively.
In addition to patented technology, we rely on our unpatented proprietary technology and trade secrets. Despite our efforts to protect our proprietary technologies and our intellectual property rights, unauthorized parties, including our employees, consultants, service providers or customers, may attempt to copy aspects of our products or obtain and use our trade secrets or other confidential information. We generally enter into confidentiality agreements with our employees, consultants, service providers, vendors, channel partners and customers, and generally limit access to and distribution of our proprietary information and proprietary technology through certain procedural safeguards. These agreements may not effectively prevent unauthorized use or disclosure of our intellectual property or technology and may not provide an adequate remedy in the event of unauthorized use or disclosure of our intellectual property or technology. We cannot provide assurance that the steps taken by us will prevent misappropriation of our trade secrets or technology or infringement of our intellectual property. In addition, the laws of some foreign countries where we operate do not protect our proprietary rights to as great an extent as the laws of the United States, and many foreign countries do not enforce these laws as diligently as government agencies and private parties in the United States.
We have registered the “Varonis” name and logo and “DatAdvantage,” “DataPrivilege,” “DatAlert,” and other names in the United States and, as related to some of these names, certain other countries. However, we cannot provide assurance that any future trademark registrations will be issued for pending or future applications or that any registered trademarks will be enforceable or provide adequate protection of our proprietary rights.
Despite our efforts to protect our proprietary technology and trade secrets, unauthorized parties may attempt to misappropriate, reverse engineer or otherwise obtain and use them. In addition, others may independently discover our trade secrets, in which
63
case we would not be able to assert trade secret rights or develop similar technologies and processes. Further, the contractual provisions that we enter into may not prevent unauthorized use or disclosure of our proprietary technology or intellectual property rights and may not provide an adequate remedy in the event of unauthorized use or disclosure of our proprietary technology or intellectual property rights. Moreover, policing unauthorized use of our technologies, trade secrets and intellectual property is difficult, expensive and time-consuming, particularly in foreign countries where the laws may not be as protective of intellectual property rights as those in the United States and where mechanisms for enforcement of intellectual property rights may be weak. We may be unable to determine the extent of any unauthorized use or infringement of our solution, technologies or intellectual property rights. If we are unable to protect our intellectual property rights and ensure that we are not violating the intellectual property rights of others, we may find ourselves at a competitive disadvantage to others who need not incur the additional expense, time and effort required to create the innovative products that have enabled us to be successful to date.
Assertions by third parties of infringement or other violations by us of their intellectual property rights, whether or not correct, could result in significant costs and harm our business and operating results.
The industries in which we operate, such as data security, cybersecurity, compliance, data retention and data governance are characterized by the existence of a large number of relevant patents and frequent claims and related litigation regarding patent and other intellectual property rights. From time to time, third parties have asserted and may assert their patent, copyright, trademark and other intellectual property rights against us, our channel partners or our customers. Successful claims of infringement or misappropriation by a third-party could prevent us from distributing certain products, performing certain services or could require us to pay substantial damages (including, for example, treble damages if we are found to have willfully infringed patents and increased statutory damages if we are found to have willfully infringed copyrights), royalties or other fees. Such claims also could require us to cease making, licensing or using solutions that are alleged to infringe or misappropriate the intellectual property of others or to expend additional development resources to attempt to redesign our products or services or otherwise to develop non-infringing technology. Even if third parties may offer a license to their technology, the terms of any offered license may not be acceptable, and the failure to obtain a license or the costs associated with any license could cause our business, results of operations or financial condition to be materially and adversely affected. In some cases, we indemnify our channel partners and customers against claims that our products infringe the intellectual property of third parties. Defending against claims of infringement or being deemed to be infringing the intellectual property rights of others could impair our ability to innovate, develop, distribute and sell our current and planned products and services.
Risks Related to our Tax Regime
Our tax rate may vary significantly depending on our stock price.
The tax effects of the accounting for stock-based compensation may significantly impact our effective tax rate from period to period. In periods in which our stock price is higher than the grant price of the stock-based compensation vesting in that period, we will recognize excess tax benefits that will decrease our effective tax rate, while in periods in which our stock price is lower than the grant price of the stock-based compensation vesting in that period, our effective tax rate may increase. The amount and value of stock-based compensation issued relative to our earnings in a particular period will also affect the magnitude of the impact of stock-based compensation on our effective tax rate. These tax effects are dependent on our stock price, which we do not control, and a decline in our stock price could significantly increase our effective tax rate and adversely affect our financial results.
Multiple factors may adversely affect our ability to fully utilize our net operating loss carryforwards.
A U.S. corporation’s ability to utilize its federal and state net operating loss (“NOL”) and tax credit carryforwards to offset its taxable income is limited under Section 382 and Section 383 of the Internal Revenue Code of 1986, as amended (the “Code”), if the corporation undergoes an ownership change (within the meaning of Code Section 382).
Future changes in our stock ownership, including future offerings, as well as changes that may be outside of our control, could result in a subsequent ownership change under Section 382, that would impose an annual limitation on NOLs. In addition, the cash tax benefit from our NOLs is dependent upon our ability to generate sufficient taxable income. Accordingly, we may be unable to earn enough taxable income in order to fully utilize our current NOLs.
Changes in our provision for income taxes or adverse outcomes resulting from examination of our income tax returns could adversely affect our results.
64
We are subject to income taxation in the United States, Israel and numerous other jurisdictions. Determining our provision for income taxes requires significant management judgment. In addition, our provision for income taxes could be adversely affected by many factors, including, among other things, changes to our operating structure including a review of our intellectual property (“IP”) structure, changes in the amounts of earnings in jurisdictions with different statutory tax rates, changes in the valuation of deferred tax assets and liabilities and changes in tax laws. Significant judgment is required to determine the recognition and measurement attributes prescribed in Accounting Standards Codification 740-10-25 (“ASC 740-10-25”). ASC 740-10-25 applies to all income tax positions, including the potential recovery of previously paid taxes, which if settled unfavorably could adversely impact our provision for income taxes. Our income in certain countries is subject to reduced tax rates provided we meet certain criteria. Failure to meet these commitments could adversely impact our provision for income taxes.
We are also subject to the regular examination of our income tax returns by the U.S. Internal Revenue Service and other tax authorities in various jurisdictions. Tax authorities may disagree with our intercompany charges, cross-jurisdictional transfer pricing, IP structure or other matters and assess additional taxes. While we believe that we are currently in material compliance with our obligations under applicable taxing regimes, and regularly assess the likelihood of adverse outcomes resulting from these examinations to determine the adequacy of our provision for income taxes, there can be no assurance that the outcomes from these regular examinations will not have a material adverse effect on our results of operations and cash flows.
Further, we may be audited in various jurisdictions, and such jurisdictions may assess additional taxes against us. Although we believe our tax estimates are reasonable, the final determination of any tax audits or litigation could be materially different from our historical tax provisions and accruals, which could have a material adverse effect on our results of operations or cash flows in the period or periods for which a determination is made.
The adoption of the U.S. tax reform and the enactment of additional legislation changes could materially impact our financial position and results of operations.
On July 4, 2025, the One Big Beautiful Bill Act ("OBBBA") was enacted. Included in the OBBBA are provisions that allow for the immediate expensing of U.S. research and development expenses and certain capital expenditures, as well as changes to the U.S. taxation of profits derived from foreign operations. While we continue to evaluate the impact of these legislative changes as additional guidance becomes available, uncertainty remains regarding the timing and interpretation by tax authorities in affected jurisdictions. These legislative changes could have an adverse impact on our future effective tax rate, tax liabilities and cash paid for income taxes.
On December 22, 2017, the Tax Cuts and Jobs Act (the "TCJA") was enacted. The TCJA remains unclear in some respects and has been, and may continue to be, subject to amendments and technical corrections, as well as interpretations and implementing regulations by the Treasury and Internal Revenue Service, any of which could lessen or increase certain adverse impacts of TCJA. Effective in July 2025, the TCJA, as revised by the OBBBA, requires all U.S. companies to capitalize and subsequently amortize research and development expenses that fall within the scope of Section 174 over fifteen years for research and development activities conducted outside of the U.S. As of the third quarter of 2026, we have accounted for an estimate of the effects of the research and development capitalization, based on interpretation of the law as currently enacted. Once our available NOLs or tax credits are fully utilized, then, due to the capitalization of research and development expenses for those activities conducted outside of the U.S., we would incur a significant increase in our tax expenses and a decrease in our cash flows provided by operations.
The Organization for Economic Cooperation and Development (“OECD”) introduced the base erosion and profit shifting project which sets out a plan to address international taxation principles in a globalized, digitized business world (the “BEPS Plan”). As a result, changes have been and continue to be made to numerous international tax principles and local tax regimes. Due to the expansion of our international business activities, those modifications may increase our worldwide effective tax rate, create tax and compliance obligations in jurisdictions in which we previously had none and adversely affect our financial position.
Risks Related to the 2029 Notes
We have incurred substantial indebtedness that may decrease our business flexibility, access to capital, and/or increase our borrowing costs, and we may still incur substantially more debt, which may adversely affect our operations and financial results.
In September 2024, we issued the 2029 Notes. As of September 30, 2026, we have $460.0 million outstanding aggregate principal amount of the 2029 Notes. Our indebtedness may limit our ability to borrow additional funds for working capital,
65
capital expenditures, acquisitions or other general business purposes, limit our ability to use our cash flow or obtain additional financing for future working capital, capital expenditures, acquisitions or other general business purposes, require us to use a substantial portion of our cash flow from operations to make debt service payments, limit our flexibility to plan for, or react to, changes in our business and industry, place us at a competitive disadvantage compared to our less leveraged competitors and increase our vulnerability to the impact of adverse economic and industry conditions.
Our debt obligations may adversely affect our ability to raise additional capital and will be a burden on our future cash resources, particularly if we elect to settle these obligations in cash upon conversion or upon maturity or required repurchase.
Our ability to meet our payment obligations under the 2029 Notes depends on our future cash flow performance. This, to some extent, is subject to general economic, financial, competitive, legislative and regulatory factors, as well as other factors that may be beyond our control. There can be no assurance that our business will generate positive cash flow from operations, or that additional capital will be available to us, in an amount sufficient to enable us to meet our debt payment obligations and to fund other liquidity needs. If we are unable to generate sufficient cash flow to service our debt obligations, we may need to refinance or restructure our debt, sell assets, reduce or delay capital investments, or seek to raise additional capital. Our ability to refinance our indebtedness will depend on the capital markets and our financial condition at such time. We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations. As a result, we may be more vulnerable to economic downturns, less able to withstand competitive pressures and less flexible in responding to changing business and economic conditions.
We may issue additional shares of our common stock in connection with conversions of the 2029 Notes, and thereby dilute our existing stockholders and potentially adversely affect the market price of our common stock.
In the event that the remaining 2029 Notes are converted and we elect to deliver shares of common stock, the ownership interests of existing stockholders will be diluted, and any sales in the public market of any shares of our common stock issuable upon such conversion could adversely affect the prevailing market price of our common stock. In addition, the anticipated conversion of the 2029 Notes could depress the market price of our common stock.
The fundamental change provisions of the 2029 Notes may delay or prevent an otherwise beneficial takeover attempt of us.
If the Company undergoes a “fundamental change,” subject to certain conditions, holders may require the Company to repurchase for cash all or part of their 2029 Notes at a fundamental change repurchase price equal to 100% of the principal amount of the 2029 Notes to be repurchased, plus accrued and unpaid interest to, but excluding, the fundamental change repurchase date. In addition, if such fundamental change also constitutes a “make-whole fundamental change,” the conversion rate for the 2029 Notes may be increased upon conversion of the 2029 Notes in connection with such “make-whole fundamental change.” Any increase in the conversion rate will be determined based on the date on which the “make-whole fundamental change” occurs or becomes effective and the price paid (or deemed paid) per share of our common stock in such transaction. Any such increase will be dilutive to our existing stockholders. Our obligation to repurchase the 2029 Notes or increase the conversion rate upon the occurrence of a make-whole fundamental change may, in certain circumstances, delay or prevent a takeover of us that might otherwise be beneficial to our stockholders.
The Capped Call Transactions may affect the value of the 2029 Notes and our common stock.
In connection with the issuance of the 2029 Notes, we entered into Capped Call Transactions with certain financial institutions. The Capped Call Transactions are expected generally to reduce or offset the potential dilution upon conversion of the 2029 Notes and/or offset any cash payments we are required to make in excess of the principal amount of converted 2029 Notes, as the case may be, with such reduction and/or offset subject to a cap, subject to certain adjustments under the terms of the Capped Call Transactions.
From time to time, certain financial institutions (with which we entered into the Capped Call Transactions) or their respective affiliates may modify their hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the 2029 Notes. This activity could also cause or avoid an increase or a decrease in the market price of our common stock.
The potential effect, if any, of these transactions and activities on the price of our common stock or Notes will depend in part on market conditions and cannot be ascertained at this time. Any of these activities could adversely affect the value of our common stock.
66
We are subject to counterparty risk with respect to the Capped Call Transactions.
All or some of the financial institutions (which are counterparties to the capped call transactions) might default under the Capped Call Transactions. Our exposure to the credit risk of the counterparties will not be secured by any collateral. Past global economic conditions have resulted in the actual or perceived failure or financial difficulties of many financial institutions. If an option counterparty becomes subject to insolvency proceedings, we will become an unsecured creditor in those proceedings with a claim equal to our exposure at the time under the capped call transactions with such option counterparty. Our exposure will depend on many factors but, generally, an increase in our exposure will be correlated to an increase in the market price and in the volatility of our common stock. In addition, upon a default by an option counterparty, we may suffer adverse tax consequences and more dilution than we currently anticipate with respect to our common stock. We can provide no assurance as to the financial stability or viability of the option counterparties.
Risks Related to our International Operations
We face risks associated with operating in international markets that may limit our ability to develop and sell our products, which could result in a decrease of our revenues.
We operate on a global basis and political, social, economic and security conditions in countries in which we operate may limit our ability to develop and sell our products. Continued political and social instability and war in these regions, and any other areas in the world where we have operations, may affect our business and operations in those and other neighboring regions. In addition, increased regulatory scrutiny, sanctions, export controls, data‑localization requirements and other legal or regulatory restrictions, including those relating to software, data security and AI‑enabled technologies, could further limit our ability to operate or expand in certain international markets and could increase our compliance costs.
In March 2022, in response to the war between Russia and Ukraine, a number of countries, including the United States, imposed sanctions and export controls on Russia, which in turn imposed counter-sanctions in response. While sales in Russia represented a very small percentage of our overall business, and while our operations in Russia and Ukraine have historically been a small portion of our overall workforce, the conflict is complex and evolving and subjects us to additional regulatory risk and compliance costs. Sanctions and export control regimes are continuously evolving and increasingly complex, including with respect to software, encryption, data security and AI‑related functionality, and compliance with such requirements may restrict sales opportunities, limit customer deployments or require operational changes. Since 2022, we have not had any employees or contractors in Russia. We have no way to predict the progress or outcome of the situation, including any impact on the rest of the world, as the conflict and government reactions are rapidly developing.
Our principal research and development facility, which also houses a portion of our support and general and administrative teams, is located in Israel. Since the establishment of the State of Israel in 1948, a number of armed conflicts have taken place between Israel and its neighboring countries, as well as incidents of terror activities and other hostilities, and a number of state and non-state actors have publicly committed to its destruction. In addition, Israel is currently in a war and the duration, geographic scope and severity of the current war remain uncertain. Security, political and economic conditions in Israel could directly affect our operations. We could be adversely affected by hostilities involving Israel, including acts of terrorism or any other hostilities involving or threatening Israel, the interruption or curtailment of trade between Israel and its trading partners, a significant increase in inflation or a significant downturn in the economic or financial condition of Israel. Any on-going or future armed conflicts, terrorist activities, tension along the Israeli borders or with other countries in the region, including Lebanon, Syria, Iran or Yemen, or political instability in the region could disrupt international trading activities in Israel and may materially and negatively affect our business and could harm our results of operations.
Certain countries, as well as certain companies and organizations, continue to participate in a boycott of Israeli companies, companies with large Israeli operations and others doing business with Israel and Israeli companies. The boycott, restrictive laws, policies or practices directed towards Israel, Israeli businesses or Israeli citizens could, individually or in the aggregate, have a material adverse effect on our business in the future.
Some of our employees in Israel are obligated to perform routine military reserve duty in the Israel Defense Forces, depending on their age and position in the armed forces. Furthermore, they have been and may in the future be called to active reserve duty at any time under emergency circumstances for extended periods of time. Currently, due to the war in Israel that began on October 7, 2023, a portion of our employees have been called to active reserve duty and additional employees may be called in the future, if needed. It is possible that our operations could be disrupted if this continues for a significant period of time or if the situation further deteriorates, including, among other things, an expansion of the war to other countries, damage to critical infrastructure and general unrest, which could harm our business.
67
Our insurance does not cover losses that may occur as a result of an event associated with the security situation in the Middle East or for any resulting disruption in our operations. Although the Israeli government has in the past covered the reinstatement value of direct damages that were caused by terrorist attacks or acts of war, we cannot be assured that this government coverage will be maintained or, if maintained, will be sufficient to compensate us fully for damages incurred and the government may cease providing such coverage or the coverage might not suffice to cover potential damages. Any losses or damages incurred by us could have a material adverse effect on our business.
The tax benefits available to our Israeli subsidiary terminated in 2020 and we expect our Israeli subsidiary to become subject to an increase in taxes.
Our Israeli subsidiary has benefited from a status of a “Beneficiary Enterprise” under the Israeli Law for the Encouragement of Capital Investments, 5719-1959, or the Investment Law, since its incorporation. As of September 30, 2026, the tax benefit that we have been utilizing for our Israeli subsidiary terminated. A tax rate of 16% should be paid by our Israeli subsidiary per such eligible income under the terms of the Investment Law, subject to meeting various conditions. To the extent we do not meet these conditions, our Israeli operations will be subject to a corporate tax at the standard rate of 23%. If the Israeli subsidiary is subject to a corporate tax at the standard rate, it may adversely affect our tax expenses and effective tax rates. Additionally, if our Israeli subsidiary increases its activities outside of Israel, for example, through acquisitions, these activities may not be eligible for inclusion in Israeli tax benefit programs. The tax benefit derived from the Investment Law is dependent upon the ability to generate sufficient taxable income. Accordingly, our Israeli subsidiary may be unable to earn enough taxable income in order to fully utilize its tax benefits.
Risks Related to the Ownership of our Common Stock
Substantial future sales of shares of our common stock could cause the market price of our common stock to decline.
Sales of a substantial number of shares of our common stock into the public market, or the perception that these sales might occur, for whatever reason, including as a result of the conversion of the outstanding Notes or future public equity offerings, could depress the market price of our common stock and could impair our ability to raise capital through the sale of additional equity securities. We are unable to predict the effect that such sales may have on the prevailing market price of our common stock.
As of September 30, 2026, we have options, restricted stock units (“RSUs”) and performance stock units (“PSUs”) outstanding that, if fully vested and exercised, would result in the issuance of approximately 9.0 million shares of our common stock. All of the shares of our common stock issuable upon exercise of options and vesting of RSUs and PSUs have been registered for public resale under the Securities Act. Accordingly, these shares will be able to be freely sold in the public market upon issuance as permitted by any applicable vesting requirements.
Our stock price has been and will likely continue to be volatile.
The market price for our common stock has been, and is likely to continue to be, volatile for the foreseeable future, and is subject to wide fluctuations in response to various factors, some of which are beyond our control. These factors, as well as the volatility of our common stock, could affect the price at which our convertible noteholders could sell the common stock received upon conversion of the 2029 Notes and could also impact the trading price of the 2029 Notes. The market price of our common stock may fluctuate significantly in response to a number of factors, many of which we cannot predict or control, including the factors listed below and other factors described in this “Risk Factors” section:
• actual or anticipated fluctuations in our results or those of other companies in our industry;
• the financial projections we may provide to the public, any changes in these projections or our failure to meet these projections;
• failure of securities analysts to maintain coverage of our company, changes in financial estimates by any securities analysts who follow our company, or our failure to meet these estimates or the expectations of investors;
• ratings changes by any securities analysts who follow our company;
• announcements of new products, services or technologies, commercial relationships, acquisitions or other events by us or other companies in our industry;
• new announcements that affect investor perception of our industry, including reports related to the discovery of significant cyberattacks;
• changes in operating performance and stock market valuations of other technology companies generally, or those in our industry in particular;
68
• price and volume fluctuations in certain categories of companies or the overall stock market, including as a result of trends in the global economy;
• the trading volume of our common stock;
• volatility with respect to the Company's results of operation while we seek to convert the remaining term license subscription customers to our SaaS platform;
• changes in accounting principles;
• sales of large blocks of our common stock, including sales by our executive officers, directors and significant stockholders;
• additions or departures of any of our key personnel;
• lawsuits threatened or filed against us;
• short sales, hedging and other derivative transactions involving our capital stock;
• general economic conditions in the United States and abroad, including inflationary pressures and higher interest rates;
• changing legal or regulatory developments in the United States and other countries;
• conversion of the 2029 Notes; and
• other events or factors, including those resulting from war, incidents of terrorism, pandemics, natural disasters or responses to these events.
In addition, the stock markets have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many technology companies. Stock prices of many technology companies have fluctuated in a manner unrelated or disproportionate to the operating performance of those companies. In the past, stockholders have instituted securities class action litigation following periods of market volatility. A significant decline in our stock price has and could in the future subject us to securities class action litigation, including the securities class action lawsuit filed against us and certain of our executive officers in January 2026, as more fully described in Note 1, “Contractual Purchase Obligations and Contingent Liabilities” of our accompanying Notes to Condensed Consolidated Financial Statements included in Part I, Item 1 of this Quarterly Report on Form 10-Q. Such securities litigation, and any potential securities litigation in the future, could subject us to substantial costs, divert resources and the attention of management from our business and adversely affect our business, results of operations, financial condition and cash flows and may cause a significant increase in the premium paid for our directors and officers insurance.
We do not intend to pay dividends on our common stock, so any returns will be limited to the value of our stock.
We have never declared or paid cash dividends on our common stock. We currently anticipate that we will retain any future earnings and do not expect to pay any dividends in the foreseeable future. Any determination to pay dividends in the future will be at the discretion of our board of directors and will be dependent on a number of factors, including our financial condition, results of operations, capital requirements, share repurchases, general business conditions and other factors that our board of directors may deem relevant. Until such time that we pay a dividend, stockholders, including holders of our Notes who receive shares of our common stock upon conversion of the 2029 Notes, must rely on sales of their common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments.
Anti-takeover provisions in our charter documents and under Delaware law and provisions in the indentures for our Notes could make an acquisition of us, which may be beneficial to our stockholders, more difficult and may prevent attempts by our stockholders to replace or remove our current management, thereby depressing the trading price of our common stock and Notes.
Provisions in our amended and restated certificate of incorporation and amended and restated bylaws may delay, discourage or prevent an acquisition of us or a change in our management, including transactions in which stockholders might otherwise receive a premium for their shares, or transactions that our stockholders might otherwise deem to be in their best interests. These provisions include:
• authorizing “blank check” preferred stock, which could be issued by the board without stockholder approval and may contain voting, liquidation, dividend and other rights superior to our common stock, which would increase the number of outstanding shares and could thwart a takeover attempt;
• a classified board of directors whose members can only be dismissed for cause;
• the prohibition on actions by written consent of our stockholders;
• the limitation on who may call a special meeting of stockholders;
• the establishment of advance notice requirements for nominations for election to our board of directors or for proposing matters that can be acted upon at stockholder meetings; and
69
• the requirement of at least 75% of the outstanding capital stock to amend any of the foregoing second through fifth provisions.
In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which limits the ability of stockholders owning in excess of 15% of our outstanding voting stock to merge or combine with us, unless the merger or combination is approved in a prescribed manner. Although we believe these provisions collectively provide for an opportunity to obtain greater value for stockholders by requiring potential acquirers to negotiate with our board of directors, they would apply even if an offer rejected by our board were considered beneficial by some stockholders. In addition, these provisions may frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our board of directors, which is responsible for appointing the members of our management.
In addition, if a “fundamental change” occurs prior to the maturity date of the 2029 Notes, holders of the 2029 Notes will have the right, at their option, to require us to repurchase all or a portion of their Convertible Notes. If a “make-whole fundamental change” (as defined in the indentures) occurs prior to the maturity date, we will in some cases be required to increase the conversion rate of the 2029 Notes for a holder that elects to convert its Notes in connection with such “make-whole fundamental change.” These features of the 2029 Notes may make a potential acquisition more expensive for a potential acquiror, which may in turn make it less likely for a potential acquiror to offer to purchase our company, or reduce the amount of consideration offered for each share of our common stock in a potential acquisition. Furthermore, the indentures prohibit us from engaging in certain mergers or acquisitions unless, among other things, the surviving entity assumes our obligations under the 2029 Notes.
General Risks Factors
Real or perceived errors, failures or bugs in our software could adversely affect our growth prospects.
Because our software uses complex technology, undetected errors, failures or bugs may occur. Our software is often installed and used in a variety of computing environments with different operating system management software, and equipment and networking configurations, which may cause errors or failures of our software or other aspects of the computing environment into which it is deployed. In addition, deployment of our software into computing environments may expose undetected errors, compatibility issues, failures or bugs in our software. Despite testing by us, errors, failures or bugs may not be found in our software until it is released to our customers. Moreover, our customers could incorrectly implement or inadvertently misuse our software, which could result in customer dissatisfaction and adversely impact the perceived utility of our products as well as our brand. Any of these real or perceived errors, compatibility issues, failures or bugs in our software could result in negative publicity, reputational harm, loss of or delay in market acceptance of our software, loss of competitive position or claims by customers for losses sustained by them. In such an event, we may be required, or may choose, for customer relations or other reasons, to expend additional resources in order to help correct the problem. Alleviating any of these problems could require significant expenditures of our capital and other resources and could cause interruptions or delays in the use of our solutions, which could cause us to lose existing or potential customers and could adversely affect our operating results and growth prospects.
We may require additional capital to support our business growth, and this capital might not be available on acceptable terms, or at all.
We continue to make investments to support our business growth and may require additional funds to respond to business challenges, including the need to develop new features or enhance our software, improve our operating infrastructure or acquire complementary businesses and technologies. Accordingly, we may need to engage in equity or debt financing to secure additional funds. If we raise additional funds through future issuances of equity or convertible debt securities, our existing stockholders could suffer significant dilution, and any new equity securities we issue could have rights, preferences and privileges superior to those of holders of our common stock. Any debt financing that we may secure in the future could involve restrictive covenants relating to our capital raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities, including potential acquisitions. We may not be able to obtain additional financing on terms favorable to us, if at all. If we are unable to obtain adequate financing on terms satisfactory to us when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be adversely affected.
Our business is subject to the risks of fire, power outages, floods, earthquakes, pandemics and other catastrophic events, and to interruption by manmade problems such as terrorism and war.
70
A significant natural disaster, such as a fire, flood or an earthquake, an outbreak of a pandemic disease or a significant power outage could have a material adverse impact on our business, results of operations and financial condition. In the event our customers’ IT systems or our channel partners’ selling or distribution abilities are hindered by any of these events, we may miss financial targets, such as revenues and sales targets, for a particular quarter. Further, if a natural disaster occurs in a region from which we derive a significant portion of our revenue, customers in that region may delay or forego purchases of our products, which may materially and adversely impact our results of operations for a particular period. In addition, acts of terrorism or war could cause disruptions in our business or the business of channel partners, customers or the economy as a whole. Given our typical concentration of sales at each quarter end, any disruption in the business of our channel partners or customers that impacts sales at the end of our quarter could have a significant adverse impact on our quarterly results. All of the aforementioned risks may be augmented if the disaster recovery plans for us and our channel partners prove to be inadequate. To the extent that any of the above results in delays or cancellations of customer orders, or the delay in the development, deployment or shipment of our products, our business, financial condition and results of operations would be adversely affected.
Changes in financial accounting standards may adversely impact our reported results of operations.
New accounting pronouncements and varying interpretations of accounting pronouncements have occurred and may occur in the future. Changes to existing rules or the questioning of current practices may adversely affect our operating results or the way we conduct our business.
If securities or industry analysts do not publish research or reports about our business, or publish negative reports about our business, our stock price and trading volume could decline.
The trading market for our common stock depends in part on the research and reports that securities or industry analysts publish about us or our business, our market and our competitors. We do not have any control over these analysts or their expectations regarding our performance on a quarterly or annual basis. If one or more of the analysts who cover us downgrade our stock or change their opinion of our stock, our stock price would likely decline. If we fail to meet one or more of these analysts’ published expectations regarding our performance on a quarterly basis, our stock price or trading volume could decline. If one or more of these analysts cease coverage of our company or fail to regularly publish reports on us, we could lose visibility in the financial markets, which could cause our stock price or trading volume to decline.
We are obligated to develop and maintain proper and effective internal control over financial reporting. These internal controls may not be determined to be effective, which may adversely affect investor confidence in our company and, as a result, the value of our common stock.
We are required, pursuant to Section 404 of the Sarbanes–Oxley Act, to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting on an annual basis. This assessment includes disclosure of any material weaknesses identified by our management in our internal control over financial reporting. We are also required to have our independent registered public accounting firm issue an opinion on the effectiveness of our internal control over financial reporting on an annual basis. During the evaluation and testing process, if we identify one or more material weaknesses in our internal control over financial reporting, we will be unable to assert that our internal control over financial reporting is effective.
If we are unable to assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an opinion on the effectiveness of our internal control over financial reporting, we could lose investor confidence in the accuracy and completeness of our financial reports, which could cause the price of our common stock to decline, and we may be subject to investigation or sanctions by the SEC.
Future sales and issuances of our capital stock or rights to purchase capital stock could result in additional dilution of the percentage ownership of our stockholders and could cause our stock price to decline.
Future sales and issuances of our capital stock or rights to purchase our capital stock could result in substantial dilution to our existing stockholders. We may sell common stock, convertible securities and other equity securities in one or more transactions at prices and in a manner as we may determine from time to time. If we sell any such securities in subsequent transactions, investors may be materially diluted. New investors in such subsequent transactions could gain rights, preferences and privileges senior to those of holders of our common stock.
71
| Item 5. | Other Information | ||||
During the fiscal quarter ended September 30, 2026, no director or officer adopted terminated
| Item 6. | Exhibits | ||||
The exhibits listed below in the accompanying “Exhibit Index” are filed or incorporated by reference as part of this Quarterly Report on Form 10-Q.
72
SIGNATURES
Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.
| VARONIS SYSTEMS, INC. | |||||||||||
| November 4, 2026 | By: | /s/ Yakov Faitelson | |||||||||
| Yakov Faitelson | |||||||||||
Chief Executive Officer and President (Principal Executive Officer) | |||||||||||
| November 4, 2026 | By: | /s/ Guy Melamed | |||||||||
| Guy Melamed | |||||||||||
| Chief Financial Officer and Chief Operating Officer (Principal Financial and Accounting Officer) | |||||||||||
73
EXHIBIT INDEX
Exhibit Number | Description of the Document | ||||
| 101 | The following materials from the Company’s Quarterly Report on Form 10-Q for the quarter ended September 30, 2026, formatted in inline XBRL (eXtensible Business Reporting Language): (i) the Condensed Consolidated Balance Sheets, (ii) the Unaudited Condensed Consolidated Statements of Operations, (iii) the Unaudited Condensed Consolidated Statements of Comprehensive Loss, (iv) the Unaudited Condensed Consolidated Statements of Changes in Stockholders' Equity, (v) the Unaudited Condensed Consolidated Statements of Cash Flows and (vi) related notes to these condensed consolidated financial statements, tagged as blocks of text and in detail. | ||||
| 104 | Cover Page Interactive Data File - (formatted as Inline XBRL and contained in Exhibit 101) | ||||
____________
| * | Document has been furnished, is not deemed filed and is not to be incorporated by reference into any of the Company’s filings under the Securities Act of 1933, as amended, or the Securities Exchange Act of 1934, as amended, irrespective of any general incorporation language contained in any such filing. | ||||
| (1) | Filed as Exhibit 2.1 to the Company’s Current Report on Form 8-K with the Securities and Exchange Commission on October 15, 2026 (File No. 001-36324) and incorporated herein by reference. | ||||
| (2) | Filed as Exhibit 3.1 to the Company’s Quarterly Report on Form 10-Q filed with the Securities and Exchange Commission on May 8, 2014 (File No. 001-36324) (the “Company’s First Quarter 2014 Form 10-Q”) and incorporated herein by reference. | ||||
| (3) | Filed as Exhibit 3.2 to the Company’s Annual Report on Form 10-K with the Securities and Exchange Commission on February 8, 2022 (File No. 001-36324) and incorporated herein by reference. | ||||
74
Exhibit 31.1
CERTIFICATION OF CHIEF EXECUTIVE OFFICER PURSUANT TO
SECURITIES EXCHANGE ACT RULES 13a-14(a) AND 15(d)-14(a), AS ADOPTED PURSUANT TO
SECTION 302 OF THE SARBANES-OXLEY ACT OF 2002
I, Yakov Faitelson, certify that:
1.I have reviewed this quarterly report on Form 10-Q of Varonis Systems, Inc.;
2.Based on my knowledge, this report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by this report;
3.Based on my knowledge, the financial statements, and other financial information included in this report, fairly present in all material respects the financial condition, results of operations and cash flows of the registrant as of, and for, the periods presented in this report;
4.The registrant’s other certifying officer and I are responsible for establishing and maintaining disclosure controls and procedures (as defined in Exchange Act Rules 13a-15(e) and 15d-15(e)) and internal control over financial reporting (as defined in Exchange Act Rules 13a-15(f) and 15d-15(f)) for the registrant and have:
a.Designed such disclosure controls and procedures, or caused such disclosure controls and procedures to be designed under our supervision, to ensure that material information relating to the registrant, including its consolidated subsidiaries, is made known to us by others within those entities, particularly during the period in which this report is being prepared;
b.Designed such internal control over financial reporting, or caused such internal control over financial reporting to be designed under our supervision, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles;
c.Evaluated the effectiveness of the registrant’s disclosure controls and procedures and presented in this report our conclusions about the effectiveness of the disclosure controls and procedures, as of the end of the period covered by this report based on such evaluation; and
d.Disclosed in this report any change in the registrant’s internal control over financial reporting that occurred during the registrant’s most recent fiscal quarter (the registrant’s fourth fiscal quarter in the case of an annual report) that has materially affected, or is reasonably likely to materially affect, the registrant’s internal control over financial reporting; and
5.The registrant’s other certifying officer and I have disclosed, based on our most recent evaluation of internal control over financial reporting, to the registrant’s auditors and the audit committee of the registrant’s board of directors (or persons performing the equivalent functions):
a.All significant deficiencies and material weaknesses in the design or operation of internal control over financial reporting which are reasonably likely to adversely affect the registrant’s ability to record, process, summarize and report financial information; and
b.Any fraud, whether or not material, that involves management or other employees who have a significant role in the registrant’s internal control over financial reporting.
| Date: November 4, 2026 | By: | /s/ Yakov Faitelson | |||||||||
| Yakov Faitelson | |||||||||||
Chief Executive Officer and President (Principal Executive Officer) | |||||||||||
Exhibit 31.2
CERTIFICATION OF CHIEF FINANCIAL OFFICER PURSUANT TO
SECURITIES EXCHANGE ACT RULES 13a-14(a) AND 15(d)-14(a), AS ADOPTED PURSUANT TO
SECTION 302 OF THE SARBANES-OXLEY ACT OF 2002
I, Guy Melamed, certify that:
1.I have reviewed this quarterly report on Form 10-Q of Varonis Systems, Inc.;
2.Based on my knowledge, this report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by this report;
3.Based on my knowledge, the financial statements, and other financial information included in this report, fairly present in all material respects the financial condition, results of operations and cash flows of the registrant as of, and for, the periods presented in this report;
4.The registrant’s other certifying officer and I are responsible for establishing and maintaining disclosure controls and procedures (as defined in Exchange Act Rules 13a-15(e) and 15d-15(e)) and internal control over financial reporting (as defined in Exchange Act Rules 13a-15(f) and 15d-15(f)) for the registrant and have:
a.Designed such disclosure controls and procedures, or caused such disclosure controls and procedures to be designed under our supervision, to ensure that material information relating to the registrant, including its consolidated subsidiaries, is made known to us by others within those entities, particularly during the period in which this report is being prepared;
b.Designed such internal control over financial reporting, or caused such internal control over financial reporting to be designed under our supervision, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles;
c.Evaluated the effectiveness of the registrant’s disclosure controls and procedures and presented in this report our conclusions about the effectiveness of the disclosure controls and procedures, as of the end of the period covered by this report based on such evaluation; and
d.Disclosed in this report any change in the registrant’s internal control over financial reporting that occurred during the registrant’s most recent fiscal quarter (the registrant’s fourth fiscal quarter in the case of an annual report) that has materially affected, or is reasonably likely to materially affect, the registrant’s internal control over financial reporting; and
5.The registrant’s other certifying officer and I have disclosed, based on our most recent evaluation of internal control over financial reporting, to the registrant’s auditors and the audit committee of the registrant’s board of directors (or persons performing the equivalent functions):
a.All significant deficiencies and material weaknesses in the design or operation of internal control over financial reporting which are reasonably likely to adversely affect the registrant’s ability to record, process, summarize and report financial information; and
b.Any fraud, whether or not material, that involves management or other employees who have a significant role in the registrant’s internal control over financial reporting.
| Date: November 4, 2026 | By: | /s/ Guy Melamed | |||||||||
| Guy Melamed | |||||||||||
Chief Financial Officer and Chief Operating Officer (Principal Financial and Accounting Officer) | |||||||||||
Exhibit 32.1
CERTIFICATION OF CEO PURSUANT TO
18 U.S.C. SECTION 1350,
AS ADOPTED PURSUANT TO
SECTION 906 OF THE SARBANES-OXLEY ACT OF 2002
In connection with the Quarterly Report on Form 10-Q of Varonis Systems, Inc. (the “Company”) for the quarterly period ended September 30, 2026 as filed with the Securities and Exchange Commission on the date hereof (the “Report”), Yakov Faitelson, as Chief Executive Officer and President of the Company, hereby certifies, pursuant to 18 U.S.C. Section 1350, as adopted pursuant to Section 906 of the Sarbanes-Oxley Act of 2002, that, to the best of his knowledge:
(1) The Report fully complies with the requirements of Section 13(a) or 15(d) of the Securities Exchange Act of 1934; and
(2) The information contained in the Report fairly presents, in all material respects, the financial condition and results of operations of the Company.
| By: | /s/ Yakov Faitelson | ||||||||||
| Yakov Faitelson | |||||||||||
Chief Executive Officer and President (Principal Executive Officer) | |||||||||||
Date: November 4, 2026
This certification accompanies the Report pursuant to Section 906 of the Sarbanes-Oxley Act of 2002 and shall not, except to the extent required by the Sarbanes-Oxley Act of 2002, be deemed filed by the Company for purposes of Section 18 of the Securities Exchange Act of 1934, as amended.
Exhibit 32.2
CERTIFICATION OF CFO PURSUANT TO
18 U.S.C. SECTION 1350,
AS ADOPTED PURSUANT TO
SECTION 906 OF THE SARBANES-OXLEY ACT OF 2002
In connection with the Quarterly Report on Form 10-Q of Varonis Systems, Inc. (the “Company”) for the quarterly period ended September 30, 2026 as filed with the Securities and Exchange Commission on the date hereof (the “Report”), Guy Melamed, as Chief Financial Officer and Chief Operating Officer of the Company, hereby certifies, pursuant to 18 U.S.C. Section 1350, as adopted pursuant to Section 906 of the Sarbanes-Oxley Act of 2002, that, to the best of his knowledge:
(1) The Report fully complies with the requirements of Section 13(a) or 15(d) of the Securities Exchange Act of 1934; and
(2) The information contained in the Report fairly presents, in all material respects, the financial condition and results of operations of the Company.
| By: | /s/ Guy Melamed | ||||||||||
| Guy Melamed | |||||||||||
| Chief Financial Officer and Chief Operating Officer (Principal Financial and Accounting Officer) | |||||||||||
Date: November 4, 2026
This certification accompanies the Report pursuant to Section 906 of the Sarbanes-Oxley Act of 2002 and shall not, except to the extent required by the Sarbanes-Oxley Act of 2002, be deemed filed by the Company for purposes of Section 18 of the Securities Exchange Act of 1934, as amended.