Earnings Call Transcript - VRNS Q1 2020

Operator, Operator

Greetings, and welcome to the Varonis Systems, Inc. First Quarter 2020 Earnings Conference Call. The operator provided instructions for how to enter the question queue. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, James Arestia, Director of Investor Relations. Thank you. You may now begin.

James Arestia, Director of Investor Relations

Thank you, Operator. Good afternoon. Thank you for joining us today to review Varonis' first quarter 2020 financial results. With me on the call today are Yaki Faitelson, Chief Executive Officer; Guy Melamed, Chief Financial Officer and Chief Operating Officer. After preliminary remarks, we will open up the call to a question-and-answer session. During this call, we may make statements related to our business that will be considered forward-looking statements under federal securities laws, including projections of future operating results for our second quarter ending June 30, 2020. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned Forward-Looking Statements, and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any obligation to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation for the most directly comparable GAAP financial measures is also available in our first quarter 2020 earnings press release, which can be found at www.varonis.com in the Investor Relations section. Also, please note that an updated investor presentation as well as the webcast of today's call are available on our website in the Investor Relations section. With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Faitelson. Yaki?

Yakov Faitelson, Chief Executive Officer

Thanks, Jamie, and good afternoon, everyone. Thank you for joining us. I'm happy to speak with you today and discuss our first quarter results and our current operating environment in more detail. First and foremost, I hope that everyone and their loved ones are safe and healthy. COVID-19 has rapidly evolved to a global crisis with a clear human and economic impact, and our thoughts are with everyone who has been affected. Obviously, this earnings call is being held under circumstances different from any we have encountered before. I'm very proud of the global Varonis team, which has been both resilient and adaptable, and our leadership, which is committed to running the business for the long term. Before we discuss the quarter and current operating environment, I first want to outline some of the measures we have taken over the past two months. Our top priority is the safety and welfare of our employees. Our offices have been closed since mid-March, and our colleagues are working remotely. A good number of our employees already operated this way, so the adjustment has been as smooth as a change like this can be. It is the same for interaction with customers and prospects. All meetings are taking place virtually. In many instances, particularly with existing customers, this is nothing new. Our risk assessment, which includes the 90-minute installation of our software, can easily be done virtually. And while we would certainly prefer face-to-face meetings, the power of our findings as well as what we are able to reveal about the threats in today's environment are just as compelling when conveyed remotely. Lastly, in addition to keeping our people safe and quickly adapting to the new working conditions, we are taking thoughtful and prudent steps to manage the business. Like everyone, we don't know when or exactly how we can expect life to return to normal or what the new normal may look like. As we have always said, we seek to tie our level of investment with the revenues that we achieve. And given the greater uncertainty we face, we are actively managing expenses across the business. This includes implementing a hiring decrease with the exception of key sales positions. In the beginning of April, we reduced employee salaries across the organization, with senior management and the highest compensated employees seeing the largest reduction. The Board of Directors also believes it is appropriate that the cash retainers be reduced. In addition, we have taken further measures to examine all projects and activities and are taking cost savings actions. These were not easy decisions, but I'm inspired by the collective response from our colleagues, which reflects the strength of our culture and the team's commitment to the company. Despite these challenges, business has continued and I'm pleased to announce that after one year, our transition to a subscription company is complete. Ninety-eight percent of our license revenues in the first quarter were from subscriptions. And today, more than 95% of our revenues are recurring compared to less than 40% at the end of 2019 before we formally started the transition. Specific to the first quarter, we had a strong start in January and February and saw a continuation of the momentum we showed throughout 2019. In mid-March, however, as the impact of the pandemic became more pronounced, closing deals became more difficult, which led to the shortfall in our revenues versus guidance we provided in February. This trend was across the board and it was not specific to certain customer size, verticals or geographies. Given how much the world is changing day-to-day, I think it is most relevant to discuss our current operating environment and why I believe we remain well positioned to capitalize on the substantial market opportunity we see. Let's start with the current environment. As you know, we founded Varonis to help customers protect their sensitive data. And today, this is more critical than ever. We know that crises create optimal conditions for cybercrimes. Threat actors will try to take advantage of companies when they are most vulnerable. In addition to these potential threats from malicious actors, companies around the world now have the majority of their employees working from vulnerable home networks and sometimes even unsecured home computers, accessing critical on-premises data stores and infrastructure through the VPN as well as cloud stores like Office 365 and Teams. Our customers and prospects understand the elevated risk associated with so many employees working remotely, which is driving strong interest in our unique capabilities around threat detection and protecting data and infrastructure. Simply put, we believe our platform is a must-have in this new environment, providing unparalleled data protection, alerting and investigation capabilities. Security is one of the most indispensable areas of technology spend, and our solutions that help mitigate the threat of a breach or even a total shutdown are one of the most important parts of the security stack, and we are encouraged by what we see in our pipeline. First, our sales reps have conducted an unprecedented number of remote risk assessments and evaluations over the last few weeks. As organizations are eager to improve visibility into remote worker access, we have also seen a significant increase in traffic to our website, driven primarily by organic search, as well as a tremendous uptick in the use of our platform by existing customers. At the same time, we have had a record number of participants in our webinars and other online activities. And lastly, our system engineers as well as our forensics and incident response teams, which help customers protect their data and investigate alerts and potential threats to their data and infrastructure, have never been busier. Our ability to help organizations address challenges with remote work has prospects and customers more attentive than they have ever been. While it is hard to predict the timing of when this increased pipeline will be monetized given the near-term disruption, we are cautiously optimistic and believe that the demand for our solution remains as strong as ever. Before I turn the call over to Guy, I want to talk about the enormous opportunity we have in front of us and how it has been further accelerated by the subscription position that has made it easier for customers to consume more of our platform and be better protected. We continue to see new customers buy on average between four to five licenses in the initial deal compared to two or three licenses under the perpetual model. Equally important, the number of licenses in upsell is increasing as our existing customers continue to buy more and adopt a greater number of licenses, driving much better outcomes for our customers. The growth in this number over the course of 2019 and Q1 is further evidence of the value of consuming Varonis as a platform play. Even with this meaningful increase in adoption rates, we remain significantly underpenetrated within our customer base, which represents a significant go-forward opportunity for the company. Given that we have completed our subscription model transition, our risk assessment can be done virtually and because all our licenses are under a common code base, it is now more frictionless than ever for customers who have licenses. We closely analyze the risk exposure and license usage for all of our customers, and we see a path for each of them to materially increase the number of licenses they purchase to get optimal protection from our platform. We started Varonis to help customers solve some of their largest data protection programs. And these problems have only intensified during COVID-19. We know that this pandemic has made life challenging for everyone — for both our customers and our employees — these past few weeks and months are a reminder that we are all in this together. I'm empowered by the dedication of our employees, particularly their willingness to go above and beyond for our customers in this unprecedented time. With the value we continue to provide our customers and the trust they place in us, I'm fully confident that we can emerge from this stronger than ever. With that, let me turn the call over to Guy. Guy?

Guy Melamed, Chief Financial Officer and Chief Operating Officer

Thanks, Yaki. Good afternoon, everyone. I want to thank you all for joining today and echo Yaki's opening comments that I hope everyone is safe and well. I plan to spend the majority of the prepared remarks today discussing how we are managing the business during this turbulent time. After that, I'll recap our first quarter results and discuss our financial guidance for the second quarter before we open for Q&A. It's clearly a different world from when we spoke with you 12 weeks ago and outlined our expectations for 2020. Our view for the last couple of years, which was reiterated in the earnings call in February, was that growth and profitability are equally important to us. The balance of those two pillars was at the forefront of any strategic decision we made as a company. And although we expect to ultimately return to that philosophy, simply put, things have changed for now, and I want to provide a bit more color on how we think about the business. Let's start with revenue. On that side, three components drive the business: one, landing new customers; two, expanding with existing customers; and three, recurring revenues, which this year includes subscription renewals in addition to maintenance on perpetual licenses. On the first point, while the pipeline from new customers is healthy, at the end of Q1, we saw it become more challenging to monetize, and we expect that to continue in the near term, which is reflected in our Q2 guidance. As mentioned earlier, we continue to see new customers adopt four to five licenses on average as we did throughout 2019. On the expanding side, the level of engagement we have seen over the past month from our existing customers is unprecedented. As you know, we have a land and expand model. And to give you a sense of the opportunity with our installed base, here are a few data points. As of March 31, 55% of our customers with 500 employees or more had purchased four or more licenses compared to 45% a year ago, and 21% purchased six or more licenses compared to 14% a year ago. The strong growth in these metrics confirms how we are unleashing the potential of the platform in addition to demonstrating the remaining opportunity we have within our base. Please keep in mind that this is different than the product family numbers we reported regularly, and instead focuses on the number of individual licenses out of the 26 licenses we currently have to offer our customers. And finally, the recurring portion of our revenue base, which has significantly increased as a result of the completion of our subscription transition, allows us to move through this time of uncertainty from a much stronger position than even a year ago. ARR at the end of Q1 grew 59%, and renewal rates of maintenance on perpetual licenses continue to be above 90% and remain healthy. And to provide additional color this quarter, our dollar-based net retention rate, which is calculated based on using a denominator of ARR from all subscription customers as of the same prior year period and the numerator of that same set of subscription customers as of the end of the current period, is more than 105% and higher still when looking at the important subset of our enterprise customers. Taken together, our recurring revenues have more than doubled over the last five quarters to more than 95% in Q1 2020. To say that these results exceeded even our most aggressive hopes when we initiated this transition in 2019 is a huge understatement. Given the near-term change in our expectations regarding top-line growth, we have acted quickly and thoughtfully in the last several weeks, with a greater focus on the bottom line. Doing so will allow us to continue to operate efficiently at lower expense levels while strategically positioning us to quickly reaccelerate growth when the time comes. Yaki discussed some of the measures we have implemented as part of our expense reduction across the board, which include opportunistic hiring, salary reductions and challenging our teams to innovate and be as effective as possible given current operating constraints. We believe that successfully navigating a dynamic environment requires decisiveness and adaptability, the same skills that were critical in taking this business from a subscription mix of 7% to 98% in just five quarters. I'll now turn to our results. Total revenues for Q1 were $54.2 million. First quarter license revenues were $20.8 million, which included $20.4 million of subscription revenues or a 98% subscription mix. Maintenance and services revenues were in line with our expectations at $33.4 million. Looking at the business geographically, North America revenues were $37.9 million or 70% of total revenues. In EMEA, revenues were $14.6 million, representing 27% of total revenues. Rest of world revenues were $1.7 million or 3% of total revenues. Turning back to the income statement, I'd like to point out that I'll be discussing non-GAAP results going forward. Gross profit for the first quarter was $45 million, representing a gross margin of 83.2% compared to 86.5% in the first quarter of 2019. This reflects the impact from the coronavirus as well as a higher mix of subscription revenue. Operating expenses in the first quarter totaled $62.5 million. As a result, our operating loss was $17.4 million or an operating margin of negative 32.2% for the first quarter compared to an operating loss of $11.1 million or an operating margin of negative 19.8% in the same period last year. I'd also like to point out that despite the shortfall in revenues, our first quarter operating loss came in just below the low end of our guidance. This is a result of our generally lean operations, moderately lower expenses due to COVID-19 and our disciplined and proactive approach to operating in this new environment that we discussed above. During the quarter, we had financial income of approximately $214,000, primarily due to interest income. Our net loss was $17.4 million for the first quarter of 2020 or a loss of $0.56 per basic and diluted share compared to a net loss of $11.1 million or a loss of $0.37 per basic and diluted share for the first quarter of 2019. This is based on 30.9 million basic and diluted shares outstanding for Q1 2020 and 29.8 million basic and diluted shares outstanding for Q1 2019. We ended the quarter with $126.3 million in cash, cash equivalents, marketable securities and short-term deposits, which despite the impact of the transition last year, are at healthy levels. The strength of our balance sheet provides meaningful support in the current business environment. Through the quarter, we generated $3.9 million of cash from operations compared to generating $14.1 million of cash from operations in the same period last year. As a reminder, we are collecting on annual contract value amounts under subscription, and therefore, we continue to see a short-term impact on cash flows. However, once we begin to see a subscription renewal contract ramp, which have a lower cost, we expect to generate significantly more cash from operations. We ended the quarter with 1,605 employees, an 11% increase from the first quarter of 2019. As already mentioned, we expect headcount to remain approximately constant or to decrease slightly in the near term. Moving to our guidance for the second quarter. We expect total revenues of $56 million to $58 million. We expect our non-GAAP operating loss to range between negative $11 million to negative $10 million and non-GAAP net loss per basic and diluted share in the range of $0.36 to $0.34. This assumes a tax provision of $400,000 to $600,000 and 31.5 million basic and diluted shares outstanding. The low end of our Q2 revenue range assumes that the government-mandated or recommended shelter-in-place orders currently in effect will remain in place for the remainder of the quarter. Here are some additional points to consider. First, while the front-loaded revenue recognition aspects of our business are a current headwind, it should also allow us to rebound more rapidly compared to a ratable revenue recognition model. Second, please keep in mind that the Q2 2019 subscription mix was 56% and the higher subscription mix we anticipate this year will result in a headwind to revenue. Third, we expect that CapEx in 2020 will be slightly lower than what we provided in the last earnings call in the range of $8 million to $12 million as part of the measures we discussed above. And lastly, we hedge foreign exchange rate exposure by entering into hedging contracts. While 2020 is already fully locked, we took advantage of the currency volatility and locked in our hedging for most of 2021 at more favorable rates. In summary, we have not shied away from challenges in the past, and this time is no different. The company is thoughtfully, decisively and actively responding to the near-term volatility, which will not only allow us to weather the storm, but will also prepare us to reaccelerate growth when the time comes. Thanks for joining us today, and we hope you and your loved ones remain safe and healthy. With that, we will be happy to take questions. Operator?

Operator, Operator

The operator provided instructions for the question-and-answer session. Our first question comes from the line of Brent Thill with Jefferies.

Brent Thill, Analyst, Jefferies

I was just curious if you could give us a view of what is happening in April? And are you seeing things stabilize from demand at the end of March? And then just secondarily, if you could just comment on the renewals from last year as you entered your first big renewal cycle in the new model.

Yakov Faitelson, Chief Executive Officer

Thanks for the question. So we had a very solid April, and we saw completely different purchasing patterns than we saw in March. What happened to us is that in the last two weeks of March, we saw a tremendous uptick in pipeline, but customers were slow to buy because they were trying to set up working remotely, getting more VPN capacity and configuring applications in the cloud that they can work with but they needed our software. We saw a lot of usage of this software, and as I said, a massive amount of pipeline. After adding capacity to the VPN and setting up the cloud environment, customers had what we call acute stationary risk: people accessing these VPNs from unsecured networks, sometimes compromised machines, and completely different access patterns. The cloud is great with Office 365 and Azure, but with a rush to configure these applications and workloads, there was a tremendous amount of risk. This environment is just heaven for cybercrime. So after those two weeks, as we entered April, we kept seeing this record pipeline and our customers started to buy and bought more and more as the month progressed. As I said, we had a very solid April. And overall, we saw very healthy and strong renewal rates.

Guy Melamed, Chief Financial Officer and Chief Operating Officer

So just to add on that, I want to give some color and data points on what Yaki just said. When you look at shelter-in-place, it really couldn't have started at a worse time for us. Because similar to other enterprise software companies, we're back-end loaded. Around March 15, everyone switched to work-from-home, which caused disruptions. As a result, we didn't see the typical quarter-end purchasing patterns but at the same time, as Yaki said, there was a huge disconnect because our pipeline was significantly increasing. Then April came, customers started signing purchase orders. We closed some of the March slip deals, and business was up for the month, which, when you think of that, was despite the material headwind from the subscription transition. So we're encouraged by the month. But remember, April is still a small part of the quarter. Overall, we're optimistic. In terms of the renewal rates, we provided this quarter, for the first time, NRR. We wanted to provide a sense of the expansion within our base. And this is kind of a theme we've been discussing for a long time. So we wanted to give as much information about the business as possible, given the operating environment. We mentioned that NRR was greater than 105%. While this is a small sample, we're pleased with what we're seeing.

Operator, Operator

Our next question comes from the line of Matt Hedberg with RBC Capital Markets.

Matthew Hedberg, Analyst, RBC Capital Markets

Given the higher levels of work-from-home, I imagine your supportive collaboration products like Microsoft Teams, in particular, are super relevant these days. Can you talk a little bit about how that might be a demand driver for you guys? I guess that product in particular seems like it's the right product at the right time. And then maybe along the same line, taking a step back, I imagine CIOs, executives, board members have a new emphasis on data governance. Have you seen a lot of net-new inbound from folks that maybe you never even thought would call, given that your product overall is well suited for this environment?

Yakov Faitelson, Chief Executive Officer

Matt, yes, Teams is massive for us. It's a product that drives collaboration, but essentially it acts like a client on top of OneDrive and SharePoint Online. So it's very hard to manage permissions and you can be overexposed; there is a lot of critical data. Not only Teams, but everything in Office 365 — SharePoint Online, Exchange, OneDrive and Teams — are huge for us. Teams is opening up critical data right and left. The other thing that works very well is everything related to Azure. Many workloads and machines are connected to on-prem and to the on-prem domain. You can have RDP exposed, and you see a lot of attacks going from the cloud to on-premises. So everything in Office 365, Teams in particular, is a huge driver and also the workloads in Azure are very strong demand drivers for Varonis. We've seen more demand for our cloud support than ever, and we feel that we are even more relevant in the cloud than on-premises data. The product overall and the three primary use cases are working extremely well. We've seen a massive increase in traffic to the website, primarily from organic search. People understand the risks. In this environment, people are looking at overall security and data protection processes and technologies and asking what they need to do to be protected. There are record amounts of ransomware and attacks. It's a favorable environment for cybercrime and people are nervous about clicking links. There are a lot of configurations being done very fast with new technologies to adapt, and we are extremely relevant. We see data on-prem and in the cloud, regulation with sharp teeth and sophisticated cybercrime that can bypass traditional security, so you need advanced analytics to be protected. This benefits us. In the short term, it's hard to know how long it will take to monetize this pipeline, but we see a record pipeline and a tremendous uptick in product usage. Customers with many licenses get a lot of automation and benefits and they're realizing it. So in the short term, we had a very positive April. Every deal has scrutiny, but our champions — the people using Varonis — take it through the approval process and often can justify it even with scrutiny.

Operator, Operator

Our next question comes from the line of Saket Kalia with Barclays.

Saket Kalia, Analyst, Barclays

Yaki, maybe first for you. You talked a little bit about how the pipeline was building here, particularly with so many risk assessments done. Could you shed a little bit more light on what products you're seeing particular interest in? And maybe just broad brush, what percentage of the time does a risk assessment actually ultimately result in driving business?

Yakov Faitelson, Chief Executive Officer

Okay Saket, so first, it's important to understand that in Varonis what we count as pipeline is always risk assessments. Most of our deals come through risk assessments and these POCs. All the products are working, but we definitely see a big uptick in everything related to Office 365 and Edge. Edge supports the Edge streams, which is VPN, proxy and DNS, and is extremely critical for working remotely. Everything related to the kill chain in terms of remote access — reconnaissance, infection and exfiltration — is relevant. The products related to Office 365 and protecting data and access are in high demand. It depends on the teams, but a lot of our veteran teams close a very high percentage of these risk assessments. In the short term during this COVID crisis, I don't know how quickly we are going to monetize everything, but I can tell you this is a record amount of POCs and customers are using them. In the three use cases — data protection, privacy and compliance, and threat detection and response — customers are looking for quality and a lot of automation, and we provide that. They understand they lack visibility. Everyone has experienced a lot of attacks. There are a lot of configurations and data scattered everywhere. Customers are testing and using the product extensively and there is strong appetite to expand.

Saket Kalia, Analyst, Barclays

Got it. That makes sense. Guy, maybe for my follow-up. The 98% subscription mix was great to see. Could that number ebb and flow in the future as the perpetual business perhaps returns, or do you expect this to stay in that range going forward? And as a housekeeping question, can you talk about what the customer count was this quarter and how you're thinking about disclosing that metric going forward?

Guy Melamed, Chief Financial Officer and Chief Operating Officer

Sure Saket. I'll start with your second question on customer count. We have more customers now than we did at the end of 2019. While attrition is not an issue, as we mentioned last quarter, we're no longer disclosing new customer adds because it's not helpful in judging progress against our strategy of engaging large enterprises. In terms of the subscription mix, coming in at 98% in Q1 was a great number for us. We guided at the beginning of the year for 90-plus percent and said we wouldn't change guidance quarter-to-quarter, so we're leaving that at 90-plus percent. Perpetual license will become insignificant for us and that's how we plan for it to continue.

Operator, Operator

Our next question comes from the line of Melissa Gorham Franchi with Morgan Stanley.

Melissa Franchi, Analyst, Morgan Stanley

Good to hear from everyone. Yaki, you said April was a pretty solid month and you did say there were some deals that slipped from March. For the deals that weren't just slipped deals, did you see any sort of emergency spending as enterprises were looking to shore up their threat detection capabilities to secure remote workers? Or was the activity in April really just projects that were already in the pipe and budgeted for?

Yakov Faitelson, Chief Executive Officer

First, it's important to remember that April is still a small sample, but it was both. Many projects that were budgeted chose to add protections for Office 365 or Edge capabilities. The risks that come from working from home with increased VPN capacity and high traffic in Office 365 made customers want to ensure they are protected. So it was a mix of both emergency needs and previously budgeted projects being accelerated.

Guy Melamed, Chief Financial Officer and Chief Operating Officer

And Melissa, I just want to add that when you look at April, even with a significantly higher subscription mix — going from approximately 30% subscription mix in April 2019 to really close to 100% in April 2020 — we still saw year-over-year growth in license sales. So, like Yaki said, it's a small sample and a small number for the quarter, but we're very pleased, particularly in this environment.

Melissa Franchi, Analyst, Morgan Stanley

Okay. Great. And then a follow-up for you, Guy. You mentioned there was going to be a hiring freeze. I'm wondering if that is contingent on shelter-in-place requirements and if, should things return to normal later in the year, that hiring freeze could be lifted?

Guy Melamed, Chief Financial Officer and Chief Operating Officer

In the prepared remarks we talked about opportunistically hiring, and we're thinking of hiring quota-carrying reps because we want to be ready to reaccelerate growth when the time is right. We've always tried to tie our level of expenses to the level of revenue we expect to achieve. So we're very focused on the top line but also on the bottom line, and we'll be ready to reaccelerate when the time is right.

Operator, Operator

Our next question comes from the line of Alex Henderson with Needham & Company.

Roger Boyd, Analyst, Needham & Company (on behalf of Alex Henderson)

This is Roger Boyd on for Alex. I was wondering, you made some very nice comments on risk assessment activity and remote upsell of the platform to existing customers. Can you talk a little bit about your shelter-in-place and your ability to close and implement new business remotely?

Yakov Faitelson, Chief Executive Officer

Yes. For us, most of the risk assessment is being done remotely, so this is nothing new. Our risk assessments and installations on-premises or in the cloud, in Azure or AWS, are typically remote. So this is how we run our risk assessments and it doesn't change anything. We prefer face-to-face meetings many times, but remote meetings have also been very effective. For us, by and large, it's business as usual.

Roger Boyd, Analyst, Needham & Company

Okay, great. And then quickly, looking at EMEA, what were the effects of the current macro environment in that geography? It seemed like they were kind of delayed in their adoption of subscription. Is that still a headwind or are you seeing more effects of COVID or anything worth calling out in Europe?

Yakov Faitelson, Chief Executive Officer

As Guy said, we are close to 100% subscription globally, and this is happening in EMEA as well. We are now a subscription business; this is how we sell and the EMEA teams are adopting it. So far, in April, we also saw very good results in EMEA.

Operator, Operator

Our next question comes from the line of Gur Talpaz with Stifel.

Gur Talpaz, Analyst, Stifel

Yaki, you mentioned the notion of frictionless deployment and upsell in the prepared remarks. Can you expand on that? What are you seeing in terms of your ability not just to deploy initially but to actually upsell in this environment?

Yakov Faitelson, Chief Executive Officer

We see that customers want comprehensive coverage. For example, the enrichment we provide with alerts helps customers understand what is critical data, whether access is coming from VPN and how users behave afterward. We see attacks from on-prem to cloud and cloud to on-prem. For data protection and compliance, the same content often exists on file shares, NAS devices, OneDrive and SharePoint Online and in mailboxes. Customers want one standard of protection across platforms. With subscription, it's much easier to sell the platform, and we believe over time we will see tremendous results in customer lifetime value. We have evidence that this is now a full-blown platform play and customers are buying with a clear path to expand. The conversations with customers are more strategic and we can demonstrate automated value so that without a lot of effort we bring significant value to key data protection and cybersecurity initiatives.

Gur Talpaz, Analyst, Stifel

That's helpful. Guy, given the mix of business and where we're at today, have you contemplated a pathway for legacy license customers to migrate to subscriptions? Have you thought about what that migration might look like over the next few quarters or years?

Guy Melamed, Chief Financial Officer and Chief Operating Officer

If you're talking about existing customers buying additional licenses, they're doing that already as part of the subscription transition. We don't go back to existing customers to convert their legacy licenses to subscription. Instead we offer them additional licenses and they continue to buy. One KPI we introduced this quarter is the number of customers with 500 users and above that have four or more licenses, and six or more licenses. Those numbers have increased nicely over the last year — four-plus licenses went from 45% in Q1 2019 to 55% this quarter, and six-plus licenses went from 14% to 21%. That's a nice increase showing how customers are utilizing the platform and how much more we can sell within our existing customer base.

Operator, Operator

Our next question comes from the line of Shaul Eyal with Oppenheimer.

Shaul Eyal, Analyst, Oppenheimer

I hope everybody is fine. Yaki, any unusual discounting worthy of note? Or steady as we go on ASP trends?

Yakov Faitelson, Chief Executive Officer

No, at this point we have not seen unusual discounting. There is a lot of scrutiny on deals, but we are often winning. When we win, customers realize the value. So day-to-day you feel the COVID impact, but there is nothing special to report on discounting.

Guy Melamed, Chief Financial Officer and Chief Operating Officer

Shaul, one thing to note: at the beginning of 2019, we introduced a compensation concept where reps could make significantly more if they sold at better pricing and get penalized for higher discounts. That's helping reps do the right thing for both themselves and the company.

Shaul Eyal, Analyst, Oppenheimer

Got it. And on foreign exchange, did you see any FX headwind this quarter with the swings in March, and were you able to lock in favorable rates for 2021?

Guy Melamed, Chief Financial Officer and Chief Operating Officer

Yes. We were able to take advantage of spikes and volatility and lock in favorable rates for 2021. Our 2020 foreign exchange hedging was already closed when we entered the year and was part of our guidance. The volatility helped us secure more favorable hedges for 2021.

Operator, Operator

Our next question comes from the line of Chad Bennett with Craig-Hallum.

Chad Bennett, Analyst, Craig-Hallum

Guy, just going back to the NRR percentage, just to make sure we're clear. The 105% — that is a combination of the recurring revenue from subscriptions only, or does it include maintenance on perpetual licenses?

Guy Melamed, Chief Financial Officer and Chief Operating Officer

First, it's higher than 105% when you look at some subsets. To clarify the definition: the denominator is ARR from all subscription customers as of the same prior year period and the numerator is that same set of subscription customers as of the end of the current period. So this number does not include maintenance on perpetual licenses. It is purely a metric to show expansion within our subscription base.

Chad Bennett, Analyst, Craig-Hallum

I'm curious — given the attach and penetration rates you've highlighted over the last year, I might have expected that percentage to be a lot higher than 105%.

Guy Melamed, Chief Financial Officer and Chief Operating Officer

One thing to remember is that the NRR number is a very small sample right now. It only includes one full quarter of rolling this globally, which was Q1 2019 and part of a pilot in the second part of 2018. While it's a small sample, we are pleased with what we're seeing.

Chad Bennett, Analyst, Craig-Hallum

On the weakness you saw in the last couple weeks of March, you mentioned slip deals. Beyond slipped deals, were there customers — new or existing — pulling back spend in general that hurt you as well?

Guy Melamed, Chief Financial Officer and Chief Operating Officer

I think the issue in the last two weeks of March was that shelter-in-place came at a particularly bad time for us. The end of Q1 wasn't a typical quarter-end purchasing pattern. There was a disconnect between the growing pipeline and purchasing patterns. In April, however, we started seeing deals close and some slip deals come in.

Yakov Faitelson, Chief Executive Officer

Customers were scrambling to set up remote work. Once they addressed acute infrastructure needs, they accelerated purchases because they needed protection. There were varied purchasing patterns but many projects accelerated in April.

Operator, Operator

Our next question comes from the line of Jason Ader with William Blair.

Jason Ader, Analyst, William Blair

Work-from-home clearly creates a lot of compliance holes. But with organizations in crisis mode, do you think some of these companies could push compliance down the priority list in the short term, even if they view it as more strategic long term?

Yakov Faitelson, Chief Executive Officer

It's hard to tell now, but much of what we do is around cybersecurity and data protection, and compliance often highlights risks you need to mitigate. There's a tremendous uptick in ransomware and malware, and also incidents involving rogue employees who access data they shouldn't. All of this drives demand for protection. Postponing compliance won't soften demand because the underlying reasons for compliance and protection are more evident than ever. Organizations that rely on customer, employee and partner data need to protect it to remain in business.

Jason Ader, Analyst, William Blair

Okay, great. And on sales cycles, as you contemplated guidance, did you assume longer sales cycles?

Guy Melamed, Chief Financial Officer and Chief Operating Officer

Yes. When we built the guidance, we took into consideration higher scrutiny on deals and slower sales cycles. We didn't see that in Q1 broadly, but there were deals that moved into Q2. We're monitoring it closely and incorporated that into our Q2 guidance.

Operator, Operator

Our next question comes from the line of Erik Suppiger with JMP Securities.

Erik Suppiger, Analyst, JMP Securities

How has COVID-19 affected your ability to work with channel partners? Has it made much of a difference there?

Yakov Faitelson, Chief Executive Officer

No. We work with partners remotely — meetings and installations are remote — so there has been no material change for our channel engagements.

Operator, Operator

Our next question comes from the line of Mark Schappel with Benchmark.

Mark Schappel, Analyst, Benchmark

Most of my questions have been answered. Just one: Yaki, what should we expect on the product development front this year as far as new releases?

Yakov Faitelson, Chief Executive Officer

We are constantly innovating. Thematically, we are focused on bringing more automation, covering more platforms and reducing friction while increasing the ability to provide value to our customers. This environment shows a direct correlation between the value we bring and how much customers will consume our solutions. We're focused on enabling customers to realize more value through classification, compliance reporting and supporting new cloud streams, and we continue to invest in those areas.

Operator, Operator

Our next question comes from the line of Daniel Ives with Wedbush Securities.

Daniel Ives, Analyst, Wedbush Securities

In this environment, can you talk about going after existing customers from the licensing perspective — moving customers from four to six, six to eight licenses versus new logos? It seems new logos are more challenging. Can you talk tactically about the approach?

Yakov Faitelson, Chief Executive Officer

Both new logos and expanding within the installed base are priorities. We changed to subscription, which provides a clear path for customers to consume significantly more licenses. We have built strong customer success practices to ensure customers realize value — we do value business reviews every three months to map and engage stakeholders. The installed base remains underpenetrated, so it makes sense to spend time taking customers to six, 10 or 15 licenses. At the same time, we want the right new customers — enterprises with 1,000-plus employees and good structure that deliver strong lifetime value. Both strategies work well for us, but we focus on the right customers to maximize lifetime value.

Daniel Ives, Analyst, Wedbush Securities

And just quick follow-up: on a day-to-day basis, as a management team in this remote environment, are you finding that walking customers through the solution remotely is accelerating deals, and how are you getting customers over the finish line without in-person meetings?

Yakov Faitelson, Chief Executive Officer

It's all about delivering value to customers. Our priority is safety for the team, then showing value and making customers successful. We're doing that remotely, and it is working very well.

Guy Melamed, Chief Financial Officer and Chief Operating Officer

We have received very positive notes from customers during the crisis, saying they have rarely seen a supplier be so hands-on and helpful. We're doing our best to help as much as we can.

Operator, Operator

Our next question comes from the line of Rishi Jaluria with D.A. Davidson.

Rishi Jaluria, Analyst, D.A. Davidson

Two quick ones. First, on dialing back investments and hiring freeze: why make that decision given you're well capitalized and there is a big opportunity ahead? Why not keep the foot on the accelerator in product and R&D? Second, are you seeing changes in customer behavior, such as requests to extend payment terms or restructure contracts?

Yakov Faitelson, Chief Executive Officer

Regarding hiring, we have strong capacity within the company and will hire on a case-by-case basis where it matters. The management philosophy is to tie expenses to revenues. There are unknowns right now and we want to see how the top line evolves and assess productivity gains. We believe this is the prudent decision; it will not harm product investment or our ability to take market share. In areas where we need to hire, we will. We are being prudent while preserving the ability to accelerate when we have more clarity. In terms of customer behavior, the partnership with our customers is a top priority. We try to work with customers when needed without negatively impacting the business. We're balancing support for customers with running the company.

Guy Melamed, Chief Financial Officer and Chief Operating Officer

To add, we're trying to balance helping customers and maintaining business stability. We're working with customers where needed but also ensuring the company remains healthy.

Operator, Operator

There are no further questions in the queue. I'd like to hand the call back to James Arestia for closing remarks.

James Arestia, Director of Investor Relations

So thank you all for your interest today. We hope everyone stays safe and well, and we look forward to speaking with you soon. Have a good night.

Operator, Operator

Ladies and gentlemen, this does conclude today's teleconference. Thank you for your participation. You may disconnect your lines at this time, and have a wonderful day.