Earnings Call Transcript - VRNS Q1 2025

Operator, Operator

Greetings and welcome to the Varonis Systems, Inc. First Quarter 2025 Earnings Conference Call. At this time, all participants are in a listen-only mode. A brief question-and-answer session will follow the formal presentation. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Tim Perz. Thank you. You may begin.

Tim Perz, Host

Thank you, operator. Good afternoon. Thank you for joining us today to review Varonis' first quarter financial results. With me on the call today are Yaki Faitelson, Chief Executive Officer; and Guy Melamed, Chief Financial Officer and Chief Operating Officer of Varonis. After preliminary remarks, we will open the call to a question-and-answer session. During this call, we may make statements related to our business that would be considered forward-looking statements under federal securities laws, including projections of future operating results for our second quarter and full year ended December 31, 2025. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned "Forward-looking Statements," and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation for the most directly comparable GAAP financial measures is also available in our first quarter 2025 earnings press release and our investor presentation which can be found at varonis.com in the Investor Relations section. Lastly, please note the webcast for today's call is available on our website in the Investor Relations section. With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Faitelson. Yaki?

Yaki Faitelson, CEO

Thanks, Tim, and good afternoon, everyone. Thank you for joining us today to review our first quarter results, the progress of our SaaS transition, and to remind you why Varonis is best positioned to secure the world’s data. In the face of uncertainty in the world today, there is one constant which pushes the business case for Varonis: no matter what happens, people will eat, sleep, and create data. The world is completely dependent on data, and because of this importance, bad actors want to steal it. At the same time, companies struggle to protect it. Most organizations deploy technologies to protect their endpoints and their perimeters. These technologies are very important, but they aren't enough to protect data. Varonis takes a data-first approach and helps companies locate their sensitive data, visualize who has access to it, automatically lock it down, and then automatically detect and respond to threats. Last quarter, we announced that we would accelerate our SaaS transition, and our Q1 results prove that we are well on track to complete it by year-end. The reason we are accelerating this transition is because of the strong demand for our SaaS solutions and the benefits to our customers and our company. Simply put, Varonis SaaS is a much better way to deliver our platform and to protect our customers' data more effectively and efficiently. With Varonis SaaS, customers are able to realize greater value from our platform without effort, which leads to more satisfaction and we believe will better position our company to accelerate growth. In the first quarter, ARR grew 19% to $664.3 million and we continue to progress towards completing our SaaS transition, with SaaS ARR now representing approximately 61% of total ARR, or $403.9 million. We generated $65.3 million of free cash flow this quarter, up from $56.4 million in the same period last year. Guy will review our results and updated guidance in more detail shortly. Our first quarter results reflect strong contributions from both new and existing customers that drive our overall business momentum. Organizations face a dangerous threat environment and the security teams are stretched thin, which means they struggle to see and respond to threats as quickly as they must with today’s bad actors. The automated value proposition of the Varonis SaaS platform and MDDR offering resonates with security teams. With Varonis, these organizations can secure their data with very little effort because we do the hard work for them. This is an outcome that simply cannot be achieved by using point solutions or manual work. We also continue to see very healthy customer interest in safely deploying Copilot and other generative AI tools, which is serving as a reason for new customers to engage with Varonis and also for existing ones to convert to our SaaS platform. We see a massive opportunity to increase the ARR from our existing customer base, and in the first quarter we continued to see existing customers expand their deployment and increase their spend with us. Varonis SaaS is a no-brainer for our customers because of the value that it offers. In the first quarter, we were able to convert existing customers to SaaS more effectively because of the lessons we learned last year and the additional investments we made in our team. This is now also freeing up capacity of our sales teams. They are bringing in healthy levels of new customers while also upselling additional platforms to our broader customer base. Existing SaaS customers continue to expand their journey with Varonis, while many of our customers choose to start with their Varonis deployments by protecting data in Microsoft 365 or on-prem storage platforms because that was their top security concern. They realize that they have sensitive data in many places beyond the areas where they originally deployed us. This is why we have significantly expanded our coverage in recent years to include leading cloud data stores, which means we recover data everywhere. Our breadth and depth of coverage has become one of our biggest competitive advantages, which means that we can provide customers with automated data security wherever they have sensitive data. DA Cloud is working well, and during Q1, we continued to see customers looking to Varonis to secure data across these newer cloud data stores. We believe our ability to execute into this large and fast-growing market positions us to continue to accelerate growth once we have completed the SaaS transition. Another benefit of SaaS is that it gives us the ability to innovate much faster. During Q1, we did exactly that, announcing Varonis for Agentforce, which allows organizations to safely enable Agentic AI rollouts in Salesforce. We view Agentic AI as a massive opportunity because agents inherit the permissions of the users who run them. So if users have excessive access, agents can expose sensitive data. For example, if a bank uses Salesforce to process mortgages, guess what would happen when you upload your financial documents with your application? All that information ends up in Salesforce as records, files, and attachments. Salesforce can classify individual fields, but there is no way to find, classify or protect files and attachments natively in Salesforce. Varonis allows organizations to find sensitive data, automatically fix exposures to very complicated permission models, detect threats on the data, and safely enable the data usage of Agentic AI. To finish our example, Varonis automatically removes access to ensure your sensitive mortgage application is not unnecessarily exposed by an agent. In March, we announced the acquisition of Cyral, which expands our data security platform to include next-generation database activity monitoring. Cyral's innovative approach deploys quickly and allows customers to upgrade their costly legacy solutions and unify their structured and unstructured data security monitoring, which means Varonis can serve as a single pane of glass for securing any kind of data. As a unified platform, we will now be able to address more auditing and compliance use cases. In addition to being a strong strategic fit, this market is attractive to us because it has established budgets and is ripe for disruption due to a lack of innovation from incumbents in recent years. This acquisition speeds our time to market and expands our total available market drastically as we enhance our ability to help customers protect their data and allow them to consolidate their data security budgets with Varonis. With that, I would like to briefly discuss a couple of key customer wins from Q1. New logos continue to be the key driver of our business, and this quarter a large health care system with over 100,000 employees became a Varonis customer after suffering a ransomware attack that impacted millions of patients. They evaluated Varonis and a number of point solutions in the data classification and DSPM categories to lock down their sensitive data, and ultimately purchased Varonis SaaS for Windows with MDDR protection and Varonis for Google Drive. Varonis was the only platform that could automatically secure their sensitive data in Google and on-prem while proactively monitoring it for threats. While new customers drove most of our momentum this quarter, we are also seeing strong demand from existing customers looking to convert to our SaaS platform and expand their protection to cover new critical cloud data stores I mentioned a few moments ago. An example from this quarter was a multinational consumer products company with approximately 6,000 employees that first became a Varonis customer years ago. They initially utilized Varonis to map permissions and classify data on-prem. This year, they determined they needed the automation of Varonis SaaS and MDDR because they were severely understaffed and faced an executive mandate to safely deploy Copilot. Over the time they had been our customer, Varonis fixed over 10 million overexposures on-prem and tens of thousands of overexposed links in Microsoft 365, which convinced them that they would be able to safely deploy Copilot. This customer purchased Varonis SaaS for hybrid environments as well as Varonis for AWS, Azure, Google Cloud, Snowflake, and GitHub, which will enable them to safely protect their data in the cloud and in SaaS applications. In summary, we are excited by the continued momentum we are seeing across our customer base that is driving our growth. Our solution has never been more relevant, and we look forward to completing our SaaS transition this year, which will unlock many more benefits for our customers and our company as we execute on our significant market opportunity. With that, let me turn the call over to Guy. Guy?

Guy Melamed, CFO and COO

Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. Our first quarter performance represents a solid start to the year, highlighted by an acceleration in ARR growth, sustained improvement in free cash flow, and continued progress towards the completion of our SaaS transition. This performance allows us to raise our full-year ARR guidance as we focus on executing on factors within our control while closely monitoring the uncertain macroeconomic backdrop. We remain confident in our outlook because of the underlying drivers of our business and are well positioned to capitalize on our growing customer demand. Our Q1 results demonstrate sustained new customer momentum and that the investments we made in our team and lessons we learned regarding existing customer conversions are working. As a result of this momentum, we ended Q1 with 61% of total company ARR coming from SaaS, an 8-point increase in the SaaS mix from the 53% we reported in Q4. When we look at the SaaS NRR, we continue to see very similar trends to last year, which was significantly above our total company NRR reported in 2024. This shows us that SaaS customers are coming back and buying more, which combined with the healthy new customer momentum that we are seeing gives us confidence that we can return to more than 20% ARR growth. In the first quarter, ARR was $664.3 million, increasing 19% year-over-year and this quarter, we generated $65.3 million of free cash flow, up from $56.4 million in the same period last year. In the first quarter, total revenues were $136.4 million, up 20% year-over-year. During the quarter, as compared to the same quarter last year, we had approximately a 1% headwind to our year-over-year revenue growth rate due to having increased SaaS sales in our booking mix, which are recognized ratably versus the upfront recognition of our on-prem subscription products. SaaS revenues were $88.6 million. Term license subscription revenues were $31.5 million and maintenance and services revenues were $16.4 million as our renewal rates were again over 90%. Maintenance and services revenues declined by 32% year-over-year, with the vast majority of the decline driven by perpetual maintenance customers converting to our SaaS platforms. Moving down to the income statement, I'll be discussing non-GAAP results going forward. Gross profit for the first quarter was $109.4 million, representing a gross margin of 80.2% compared to 83.3% in the first quarter of 2024. Operating expenses in the first quarter totaled $115.9 million. As a result, the first-quarter operating loss was $6.5 million or an operating margin of negative 4.7%. This compares to the operating loss of $10.6 million or an operating margin of negative 9.3% in the same period last year. During the quarter, we had approximately a 1% headwind to our operating margin due to the increased SaaS sales in our booking mix, which are recognized fully ratably versus the upfront recognition of our on-prem subscription products. The first-quarter ARR contribution margin was 16.7%, up from 13.7% last year. The significant leverage improvement reflects our ability to drive strong incremental margins while growing ARR and transitioning to SaaS. During the quarter, we had financial income of approximately $10.7 million, driven primarily by interest income on our cash, deposits, and investments in marketable securities. Net income for the first quarter of 2025 was $0.7 million or $0.00 per diluted share compared to a net loss of $3.7 million or a net loss of $0.03 per basic and diluted share for the first quarter of 2024. This is based on 136.7 million diluted shares outstanding and 110 million basic and diluted shares outstanding for Q1 2025 and Q1 2024, respectively. As of March 31, 2025, we had $1.2 billion in cash, cash equivalents, short-term deposits, and marketable securities. For the three months ended March 31, 2025, we generated $68 million of cash from operations compared to $56.7 million generated in the same period last year and CapEx was $2.3 million compared to $0.3 million in the same period last year. During the first quarter, we repurchased 1,476,456 shares at an average purchase price of $41.49 for a total of $61.3 million. Turning now to our updated 2025 guidance in more detail. Our acquisition of Cyral is not expected to have any impact on ARR or revenue this year and is expected to add approximately $4 million of operating expenses in 2025. For the second quarter of 2025, we expect total revenues of $145 million to $150 million, representing growth of 11% to 15%. Non-GAAP operating loss of negative $5 million to negative $2 million and non-GAAP net income per diluted share in the range of $0.00 to $0.01. This assumes 135.2 million diluted shares outstanding. For the full year 2025, we now expect ARR of $742 million to $750 million, representing growth of 16% to 17%. Free cash flow is projected to be between $120 million to $125 million. Total revenues are expected to be between $610 million to $625 million, representing growth of 11% to 13%. Non-GAAP operating income is expected to be between $0.5 million to $10.5 million, and non-GAAP net income per diluted share in the range of $0.14 to $0.17. This assumes 135.8 million diluted shares outstanding. In summary, we are encouraged by our first-quarter results highlighted by broad-based strength leading to healthy ARR growth, operating leverage, and cash flow generation. This performance gives us confidence to raise our full-year ARR guidance as we progress towards the completion of our SaaS transition later this year. With that, we would be happy to take questions. Operator?

Operator, Operator

The first question we have is from Matt Hedberg of RBC.

Matt Hedberg, Analyst

Congrats on the results. It's really great to see the SaaS transition continue to accelerate and finish by year-end. One of the key questions that I get from a lot of investors is, what gives you guys confidence that ARR can grow sort of north of 20% in the guidance you illustrated? I think Guy mentioned the SaaS net NRR significantly above total NRR, but are there any other things that you would give us a guidepost around the confidence in that element?

Guy Melamed, CFO and COO

Matt, thanks for the question. When we look at our ability to grow 20% plus, there are a lot of tailwinds that are working in our favor. One of the things that I mentioned in the prepared remarks is our SaaS NRR. And when you look at SaaS NRR and, to remind everyone, that doesn't include any impact from conversions, it was very healthy this quarter. So we continue to see very similar trends to what we saw last year with that SaaS NRR that is significantly above our total reported company NRR. So this really shows that the SaaS customers see value and they want to protect additional platforms. They are coming back and buying more, which combined with a healthy new customer momentum that we're seeing gives us the confidence that we can return to that ARR growth of more than 20%.

Yaki Faitelson, CEO

And Matt, it's Yaki. It's very important to understand that this is the best way to avoid data breaches. Bad actors are not breaking in; they are logging in and trying to compromise identities. If you can ensure that the right identities have access to the right data, it can prevent typical behavior that could lead to severe data breaches. Data continues to flow across all platforms and is incredibly valuable, making this the most effective way to prevent data breaches. With our SaaS platforms, customers are benefiting, and their information is protected automatically.

Operator, Operator

The next question we have is from Joel Fishbein of Truist Securities.

Joel Fishbein, Analyst

Great results. I'd like to get more insight on MDDR adoption, the competitive landscape surrounding it, and how it could potentially lead to upselling opportunities to accelerate the match question to ARR.

Yaki Faitelson, CEO

So in terms of the overall value, I see so many breaches with customers and usually they become one common ground. Varonis organization has a model security stack, a world-class EDR, a modern firewall, a team that collects the logs and it's severe breach. In order to ensure that we are protecting customers from a data breach, you need to have a very data-centric approach. If you want to protect data, ensure that you can remediate what we call the black radius, the excessive access control automatically, understand abnormal behavior. Additionally, once there is compromise, there is no perimeter anymore. So we are analyzing extremely well the user behavior of identities and users to guarantee that we understand any abnormal behavior and solve it automatically. I truly believe that if someone wants to make sure that they do not have a data breach, they need something like Varonis. The other aspect to consider is also in terms of forensics. If something happens, you want to understand what happened to your data records, the fact that you can identify who is patient zero, what occurred at an endpoint, and to request directly our end-user reports ensures you know what happened to the data records, as the liability can be endless. Thus, even the ability to perform effective forensics must be completely data-centric. This is what we see from MDDR, and we are executing it automatically for customers, and we build a lot of AI. We have developed many security agents that augment our analysts, and this is working extremely well, as every day we save several enterprises from severe breaches.

Guy Melamed, CFO and COO

From a numbers perspective, just to add to that. I think sometimes investors forget that MDDR was only introduced five quarters ago. It has been by far the fastest adopted platform sale we have ever had. We are very, very happy with how customers are adopting it. It's a no-brainer really, as Yaki mentioned, but when you look at the number of the adoption, we truly believe that at the end of this journey, every single customer should have MDDR to be better protected. It's obviously going to take some time. But when you look at this adoption of this platform, it has been really outstanding; we’re very happy with the way it's performed so far.

Operator, Operator

The next question we have is from Saket Kalia of Barclays.

Saket Kalia, Analyst

Guy, you said from the beginning that the North Stars on this transition are going to be ARR, SaaS mix, and free cash flow. But I wanted to ask about the income statement just for a second. And maybe the question is how far are we from the trough in operating margins as we think about this transition accelerating? Are there any other dynamics that you want us to think about as we kind of consider the model going forward in respect to that?

Guy Melamed, CFO and COO

So as you mentioned, the North Stars are the ARR, free cash flow, and the ARR contribution margins. When you look at those kinds of numbers, all of them have been performing extremely well throughout the transition. Looking at the results in Q1, they are pointing in one direction, meaning we are moving nicely and quickly while keeping the cost structure in a very prudent way. So I want to emphasize that before I talk about the P&L. But from a P&L perspective, many factors are going into the mix during the transition; the conversions and the revenue is recognized differently. This creates a lot of messiness. I do think that the trough will happen this year. Next year you still have some volatility on the comparable side; however, I definitely believe that as we progress to complete this transition within this year, the income statement will start to look more normalized. So again, keep everyone focused during the transition to look at the three North Stars; they are the leading indicators: ARR, free cash flow, and ARR contribution margin.

Operator, Operator

The next question we have is from Joshua Tilton of Wolfe Research.

Joshua Tilton, Analyst

Congrats on a great start to the year. I just wanted to double down, Guy, on one thing you said. I know you mentioned that you're monitoring the macro pretty closely. Could you maybe just double-click on what is all impacts in the quarter you saw because of the current macro? How you're thinking about or how you incorporate macro expectations into the guidance for this year?

Guy Melamed, CFO and COO

I think that's a great question. When we look at the macro, obviously, there's a lot of macro uncertainty, but we had a really good quarter. The drivers we talked about last quarter are really all in place, whether it's the SaaS transition, MDDR, or Gen AI. When you think about the guidance and how we approach it, our philosophy hasn’t changed. We take our numbers and guidance to Wall Street very seriously and we feel good about the pipeline in front of us. Even with this macro uncertainty, we have never been more confident about the long-term opportunity as we see it today. We try to remain focused on the factors within our control, and we're confident in our ability to capitalize on a growing customer demand. Something else that makes us feel really good is that in the first quarter, we saw strong demand from both new and existing customers, which led to the ARR acceleration we discussed, continued leverage in our model, and strong cash flow generation. So when you combine all of these and these results and the underlying drivers in our business, this is what gives us the confidence to raise our ARR guidance by that $5 million and increase our SaaS mix to 80% for the full year, despite the uncertainty present in the macro environment.

Operator, Operator

The next question we have is from Roger Boyd of UBS.

Roger Boyd, Analyst

Congratulations on a strong quarter. Guy, you mentioned good traction with new logos in the quarter. Can you share if we are reaching a point where we can quantify how frequently new logos are being secured with some of the newer Varonis offerings for SaaS applications, cloud storage, and databases? Additionally, regarding the strength in use cases for securing Copilot and other AI tools, are we at a stage where we can quantify the significance of that traction?

Yaki Faitelson, CEO

It's Yaki. To clarify mathematically, it's still half. However, I would tell you that in every data report, people have critical data in SaaS applications like Salesforce and ServiceNow in cloud repositories like databases, in Snowflake, any data breach, and they need to protect all of it. We still have a lot of data on-prem and in 365. What has occurred with AI tools is that we have likely shone a spotlight on the data security problems. These agents, these copilots essentially, use all potential access and create a lot of information in their initial stages. So there is excessive access control. Employees immediately receive information they shouldn't access. As you will see more adoption of AI tools, you will realize that in order to enable them, you need data security and automated data security to ensure you can manage their attention between productivity and security, and this is something we are executing exceptionally well. We believe that with SaaS, customers will ultimately protect every data repository they have, and this is why we see significant success with DA Cloud—it is performing exceptionally well for us. We are very pleased with all the investments we have made in the past few years in data repositories, user repositories, and protections with AI tools and automated classification. They are all coming to fruition.

Operator, Operator

The next question we have is from Keith Weiss of Morgan Stanley.

Keith Weiss, Analyst

Congratulations on a solid quarter. I want to ask a little bit about the recent acquisition that you made in the database activity monitoring space. It seems like a pretty logical extension, I guess, even a broader purview of the data within an enterprise as a state. Can you talk to us about where that fits in? How you plan to kind of add it to the portfolio? And then, as a follow-on question to that, I think probably everyone on the line just returned from RSA last week; there's a lot of talk about data and data security. It feels like the environment is getting probably more competitive. Can you talk to us about how you're seeing the competitive environment evolve as this issue becomes front-of-mind for customers?

Yaki Faitelson, CEO

Thanks for the question. First, in terms of database activity monitoring, it is a natural extension for us and we started to see a lot of success with DA Cloud for occupying these database repositories, understanding configuration, and monitoring usage. Customers have told us they are dissatisfied with their incumbent solutions. If they have compliance requirements, we can meet all of them, and because of constant changes, data tends to move from one repository to another. We said, if you can dive deep into the queries, it would be beneficial, and logically, they want to replace the current solution they are using with one scalable data security platform that delivers all these automated outcomes of protection and classification and remediation. Regarding the competitive environment, at this point, it has been very good for us. Nothing has changed in the competitive environment regarding tools like Office 365 and all Microsoft collaboration tools, on-prem storage, and file systems. Primarily, these are not data security tools; they mostly function as data discovery tools that often struggle to scale and do not offer automation. They lack remediation and have no fraud detection layer. What that means for us is that, at this point, it is actually increasing our overall total available market. Everything we are doing in IaaS and other cloud data repositories raises awareness. When customers test them, they realize these are not security tools, they can't perform forensics, and they can't provide remediation. They cannot determine if an attack occurred. I believe that the increased attention on data security is significantly contributing to the success of DA Cloud.

Operator, Operator

The next question we have is from Joseph Gallo of Jefferies.

Joseph Gallo, Analyst

Nice quarter. Last quarter, you mentioned elongation of conversion cycle times. Has the length of cycle time for conversions changed in any way? How are gross retention rates and ASP upside recognized again for those customers?

Guy Melamed, CFO and COO

This is due to the many lessons we learned from the conversion process last year, and we are implementing them starting this year. I think we've done a very good job. If you look at the conversions we had in Q1, they were really strong. All of the investments and lessons learned were implemented effectively, setting us up positively as we entered the year. The gross retention rates and renewal rates were all very strong. We feel good about our position and what we are observing. We discussed the fact that SaaS is undoubtedly a superior product; hence, we are witnessing our existing customers trying it and wanting to buy more to enhance their security. It's important to note that the conversions were not the only strong element this quarter; we are also seeing strong new customer adoption, connecting back to how superior the SaaS platform has become.

Operator, Operator

The next question we have is from Brian Essex of JPMorgan.

Brian Essex, Analyst

Yaki, I got a question for you. It's great to see the innovation outside of Microsoft Copilot into other Agentic applications like CRM. Could you provide a little color regarding your expectations for any different go-to-market motion? I think one of the concerns investors may have is that in the Office 365 environment, you're competing against Purview. Are you seeing strong pull-in from Salesforce and other ISVs you might be working with? Do you anticipate less friction with that go-to-market motion?

Yaki Faitelson, CEO

I believe that as you see more Agentic AI and overall AI, it brings the data security program to the forefront. If you're using these agents, you will receive immediate access to information that you should not see; that is very problematic. It will ultimately harm organizations to process data in this manner. Therefore, if you want to enable your organization to use AI securely, you need a solution like Varonis. You must understand the activity, adjust permissions properly, and automate as much as possible to ensure that legitimate inquiries are accurately managed.

Operator, Operator

The next question we have is from Rob Owens of Piper Sandler.

Unidentified Analyst, Analyst

This is Ethan on for Rob this afternoon. As we think about consolidating more of the data security budget, what are some other natural adjacencies in the space that you think the platform will be well-positioned to address going forward?

Yaki Faitelson, CEO

I believe that significant opportunities lie in database activity monitoring, as well as other areas dealing with identity behaviors, all of which are relevant to the MDDR environment. We are also introducing capabilities that can help capture additional budgets. However, it is clear that another source of budget is the AI budgets organizations are now allocating; they have to adopt AI securely, which is generating increased investments in AI security solutions, and we are benefiting from this.

Operator, Operator

The next question we have from Shaul Eyal of TD Cowen.

Shaul Eyal, Analyst

Congratulations on the strong results and guidance. Yaki, I have two quick questions. First, what is the headcount increase from the small acquisition? And a macro question for Guy or Yaki, specifically regarding DAG—have you noticed anything emerging this quarter?

Guy Melamed, CFO and COO

I'll start with the second question and thank you for that, Shaul. When we look at federal, I want to remind everyone, the federal business for us is still relatively small, about 5% of total company ARR. When we look at the contribution in Q1, it is not considered a large quarter for them. Their largest quarter is Q3. So when you think about the federal space, we did not see any significant change from DAG, and as we think about it from a guidance perspective, we did not assume any significant contribution compared to last year. We're very happy with the progress of the FedRAMP certification; it is progressing as planned, and we hope to achieve it in the coming months. We definitely believe in that long-term opportunity in that vertical. In terms of the headcount, we did not add a significant number; it is a small number that does not impact us much. The expense addition for the year is approximately $4 million, but from a guidance perspective, we can absorb it well.

Operator, Operator

The next question we have is from Fatima Boolani of Citi.

Unidentified Analyst, Analyst

This is Mark on for Fatima. Maybe just want to dig a bit more into the new local momentum you're seeing. It really comes into play adjusting the sales focus this year on renewal conversions. Can you give us some of the drivers there? How much does this outperform expectations? Can you also speak to any discernible changes on new customer adoption behavior aside from maybe the AI-driven purchases? Any guardrails for how we should think about the contributions between new versus conversions to the ARR guide this year?

Guy Melamed, CFO and COO

We've discussed the MDDR offering and its ability to address generative AI. It has become incredibly appealing for new customers to adopt the platform. We've observed a significant change in how we engage with these customers, and we strongly believe our total addressable market has expanded due to the new offerings, the simplicity, and the high level of automation in MDDR. This has enabled us to present value propositions that are being aggressively adopted. We initiated this shift last year, and we are continuing in that direction this year. As we mentioned in the last earnings call, our aim is to transition as quickly as we can and complete it by 2025. The Q1 results are a strong start, and we are seeing progress. We work to balance completing the transition and continuing to attract new customers, and our sales force has successfully balanced these two aspects. This is a key reason behind the acceleration, which informed the increase in our ARR guidance and the leverage in the model as well as the ARR contribution margin. The combination of converting existing customers and attracting new customers efficiently is propelling us forward significantly.

Operator, Operator

The next question we have is from Jason Ader of William Blair.

Jason Ader, Analyst

I wanted to ask on the gross margin outlook. I know that the SaaS transition is impacting that. Can you talk about what you expect for the remainder of 2025, and then the kind of more medium-term outlook? And then just sort of related to that, why is the non-GAAP operating income range so wide? Can you just speak to that?

Guy Melamed, CFO and COO

Regarding revenue, the P&L throughout 2025 will experience significant volatility. The way revenue is recognized through SaaS and on-prem subscriptions is so significantly different that it results in considerable fluctuation. It does not reflect the business's health at all. The conversions will create complexity. Gross margin when considering 2025 will not be indicative of actual performance. When we conducted our Investor Day in 2023, we provided a five-year model and indicated gross margin expectations to be around 80% by the end of 2027. I can assure you that overall, from a cost perspective, our SaaS performance is better than our expectations. However, expect ongoing volatility until we complete the transition. The wide non-GAAP operating income range is due to the many variables embedded within this transition. We are aiming to shift entirely from on-prem subscriptions to SaaS, and while we have made substantial progress thus far, we wish to ensure the transition is complete by the end of the year.

Operator, Operator

The next question we have is from Rudy Kessinger of D.A. Davidson.

Rudy Kessinger, Analyst

Firstly, Guy, I want to make sure I heard you right. I think in response to Josh's question earlier, you said 80% SaaS mix by year-end on ARR, which is up from 78% expected previously. I want to confirm that.

Guy Melamed, CFO and COO

Yes, that's correct. We raised our guidance on the SaaS mix from 78% to 80% at the end of the year.

Operator, Operator

The next question we have is from Shrenik Kothari of Robert W. Baird.

Shrenik Kothari, Analyst

Just on a related note from the previous question. Historically, your spend has been in an unstructured environment, and with the several acquisitions and increased focus on Snowflake, Databricks, BigQuery, will be driving into structured data. Just a few words, Yaki, how are customers responding to a kind of more unified view across structured and unstructured assets? Do you see there is more of a greenfield expansion? Are there real gaps in automated fumigation there? Are you seeing budgets shifting from legacy asset management into your platform? Just curious about your observations.

Yaki Faitelson, CEO

I believe that organizations are increasingly making smarter decisions to ensure they are protecting all data with us; they require all the automated outcomes we provide. They want a unified classification engine, which is exactly what we deliver, leading to better security. We offer second-line data-centric user behavior analytics. We also benefit from our integrations with Active Directory and potentially Okta IAM, which involve monitoring identities and additional streams like firewalls and proxies. This is a natural extension for them and helps safeguard against data breaches, ensure compliance, and deliver automation without necessitating additional headcounts.

Operator, Operator

The next question we have is from Jonathan of Cantor.

Unidentified Analyst, Analyst

Can you talk about the Agentic AI capabilities that you've announced within MDDR? Specifically, when you look at Agentic systems that the adoption curve is still very early. Where would you expect Agentic AI to actually begin to contribute materially to customer outcomes and revenue growth? How do you plan to monetize those new features?

Yaki Faitelson, CEO

Thanks for the question. Currently, we have a world-class team looking at customer data 24/7. We possess a unique dataset that tracks the behavior of users and service accounts and enriches it with their information. What we are doing is building security agents that monitor the data and automatically close numerous alerts to ensure that analysts can maximize productivity. Once customers onboard with our MDDR, they benefit from the most skilled analysts available, utilizing a data-centric platform and an impressive array of automated tools, monitoring the customer's environment to actively prevent data breaches. We are achieving remarkable automation results. By using MDDR, customers gain access to the best data security analysts in the industry working continuously on their behalf.

Operator, Operator

Thank you. Ladies and gentlemen, we have reached the end of the question-and-answer session. I would like to turn the floor back over to Tim Perz for any closing remarks.

Tim Perz, Host

Thanks again for the interest in Varonis. We look forward to seeing you all at conferences this quarter.

Operator, Operator

Ladies and gentlemen, that concludes today's conference. Thank you for joining us. You may now disconnect your lines.