Varonis Systems Inc

NASDAQ:VRNS

Greetings, and welcome to the Varonis Systems, Inc. Fourth Quarter 2023 Earnings Conference Call. [Operator Instructions]. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Tim Perz of Investor Relations. Thank you, Mr. Perz, you may begin.

Thank you, operator. Good afternoon. Thank you for joining us today to review Varonis' fourth quarter and full year 2023 financial results. With me on the call today are Yaki Faitelson, Chief Executive Officer; and Guy Melamed, Chief Financial Officer and Chief Operating Officer of Varonis. After preliminary remarks, we will open the call to a question-and-answer session. During this call, we may make statements related to our business that would be considered forward-looking statements under federal securities laws, including projections of future operating results for our first quarter and full year ending December 31, 2024. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned Forward-Looking Statements, and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation to the most directly comparable GAAP financial measures is also available in our fourth quarter 2023 earnings press release and investor presentation, which can be found at www.varonis.com in the Investor Relations section. Lastly, please note that a webcast of today's call is available on our website in the Investor Relations section. With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Faitelson. Yaki?

Thanks, Tim, and good afternoon, everyone. Thank you for joining us to discuss our fourth quarter and full year 2023 performance today, I would like to review our fast transition progress and discuss key drivers of our business in 2024 and how we are positioned to capitalize on them. One year ago, we discussed our initial excitement on Varonis SaaS [indiscernible] we have invested heavily for years to build a world-class cloud-native SaaS offering, which allows our customers to secure their data automatically. We simplified our packaging to include automation that we know our customer needs, we have confidence in our product, our team and our plan, but it was early, and we had a lot of [ growth ] despite ongoing macro challenges, SaaS ARR grew from several million dollars in 2022 to approximately $125 million at the end of 2023. We are part of the momentum we have achieved so far in how that set us up for 2024 and beyond. Our fourth quarter results reflect the sustained momentum of our SaaS platform, and I'm happy to announce that SaaS ARR represents approximately 23% of total company ARR [indiscernible]. This progress gives us the confidence to accelerate our transition time line, which we now expect to complete by the end of 2026, a year earlier in our initial [indiscernible]. Fourth quarter SaaS mix came at 66% [ of the ] guidance of 60%. ARR grew 17% year-over-year to $543 million and we generated $54.3 million of free cash flow in 2023, up $0.5 million last year. The macro environment remained stable during Q4, and we continue to see a high level of [ descrutiny ] with multiple levels of approval. Overall, we are excited by the progress of our SaaS transition against these headwinds. Guy will review our Q4 results and our 2024 guidance in more detail. We are still in the early innings with our transition to SaaS delivery model and the benefits we expect to realize are just getting started. But Q4 and 2023 overall marked a strong step in the right direction and I'm very grateful to the entire Varonis team for how we have executed so far. Turning now to our strategic priorities for 2024. Of course, continuing our transition to SaaS will be a primary focus. And to briefly remind you, there are three key benefits of SaaS platform provides to our customers. Customers can achieve automated outcomes, which means we can ensure that data is protected with very little effort. SaaS is quicker to deploy and operationalize because of significantly lower infrastructure and personnel investments and SaaS is easier to maintain [ an uprate ]. Additionally, there are three key benefits that we realized: They are shorter sales cycles, larger initial lands and margin benefits over time. We started to see evidence of these benefits in 2023 and expect them to continue in 2024. In addition to executing on our SaaS transition, the dangerous threat environment is creating increased awareness for data security within that backdrop, we see three additional drivers: our new managed data detection and response service, which we call the adoption of enterprise-generated AI like copilot and Einstein increasing compliance requirements such as the new SEC disclosure rule around cyber events. With that, [ let's ] tackle the overall environment and each of these drivers in more detail. Our foundation for innovation has been centered to follow the data and automate. With SaaS, we have been able to innovate much faster. We have gone wider with more coverage of enterprise data stores, and we have gone deeper in more automation so that our customers can achieve their business outcomes with very little effort, but this is just the beginning. One year ago, we introduced proactive incident response which provides our SaaS customers with a system from our world-class incident response team. Today, we are introducing the next evolution of this offering with the world's first managed data detection and response service, which comes with an SLA and 24/7 coverage. Varonis MDDR is a paid service that takes responsibility of managing Varonis out of our customer's hands and places it with us. Customers [ in no longer ] to monitor the Varonis Solr. Instead, our teams will leverage behavioral analysis, machine learning operations, our unique metadata telemetry to protect them. [ We ] introduce this service because no security teams [ are stretched thin ] and MDDR builds upon automation enabled by the SaaS platform and maximizes the return on investment. Another driver for us in the year ahead will be the impact of generative AI and large language models. We spend sometime last quarter discussing what the [ sterling ] means for Varonis. But to briefly review, gene represents both opportunities and risks for companies the growth of AI has the potential to generate significantly more data and also significantly more risk, which in turn increases the need of automated data security. Without robust data security strategy, AI will reveal sensitive data to the wrong machines and people. most generating AI to utilize existing access control, which leaves organizations overexposed to this [ strength ]. Companies will also need to ensure that sensitive data is not being used when training LLMs and hackers will leverage these tools to [ cost ] better phishing e-mail, create malware or even search for data once inside an organization. Simply put, generative AI is forcing organizations to take a hard look at their data and they are realizing that access control must be correct to ensure sensitive data can be exposed. These are core use cases for Varonis. In support of this, 2 weeks ago, we announced a strategic partnership with Microsoft to help companies safely harness the power of Microsoft CoPilot. This integration takes customer improve the Microsoft 365 data security posture before, during and after deploying profile. As a result of increasing risks and regulation, we are seeing data security become more of a priority. Varonis is in a unique position to capitalize on this as we help organizations protect their data like a bank watches its money. [ Main spot ] financial crime by analyzing financial transaction. Varonis spots cybercrimes by analyzing data transactions. Our customers have Varonis watching the data and the infrastructure close to it, which limits the likelihood of damage. In addition to watching data usage, we locate sensitive data, visualize access to it and automatically lock them. This allows companies to realize more value from their data, leverage safely and keep it protected. The world has never been more reliant on data than it is today. If you dissect every major breach, the one common [ thread ] is that nobody is watching the data. Take for example what happened at the large ride-sharing company with a very sophisticated security [ stack, but ] no data security platform. A group of teenagers was able to bypass the multifactor authentication, access file [ shares ] and steal critical data. It wasn't until the hacker posted messages in Slack with the news they were breached. The biggest threat can come from insiders, think about Wikileaks, Snowden and the Pentagon Breach. These breaches highlight the damage that can happen when insiders has access to far too much data. And the perimeter [ sales ] and you have a rogue insider, we are best positioned to catch it. Data breaches and the danger of Ransomware used to be something we had to explain. And today, every organization knows that they are at risk. The increasingly dangerous threat environment has led governments to enact regulation. For example, the Securities and Exchange Commission rule which took effective in December required public companies to disclose cybersecurity breaches in a Form 8-K within four business days after determining it has a material impact on the business. It also puts more structure into how they disclose their cybersecurity risk management strategy and governance will also be telling management in the board [indiscernible] and expertise in handling these risks. This increased scrutiny on U.S.-listed public companies have raised awareness for cybersecurity and we believe Varonis is well positioned to help companies comply with these regulations. With that, we'd like to briefly discuss a couple of key customer wins from Q4. A real estate company with 5,000 employees became a new customer this quarter. Our organization had an executive mandate to find sensitive data across its hybrid environment during the risk assessment, our team discovered over 250,000 records containing [ PII ] and thousands of employment contracts and mortgage documents that will open to everyone in the organization. Our Internet response team even stopped multiple data breaches attempts, this customer evaluated Varonis and two other vendors. But ultimately, Varonis the only one who could automatically ensure their data was protected. As a result, they purchased Varonis SaaS package for Windows Microsoft 365, Edge, AWS and [ S3 ]. We continue to see strong interest from customers wishing to convert to Varonis SaaS. One example is a large municipal government that became a Varonis on-prem subscription customers in 2018. We are leveraging our software to find and protect sensitive data and to monitor abnormal user behavior in a single department. The success this organization had protecting their on-prem environment enabled our team to win the mandate for the broader municipal organization. This quarter, they converted to Varonis SaaS and expanded from just 500 users to 25,000 users. SaaS is an ideal fit for them because for automated remediation, improved scalability and infrastructure savings. They purchased SaaS package for Windows, Microsoft 365, Active Directory and Exchange Online, which will allow them to protect their data without training their security teams. Finally, about a month ago, we had our sales kickoff event here in New York with the amount of changes and magnitude of innovation we had in 2023, it was important for us to bring our team together, and I cannot speak enough about the level of energy and enthusiasm during the event. We would like to thank our team for the tariff effort is none of these possible results. We are excited about the reception of our SaaS platform and the momentum of our business leaves me optimistic as we look ahead not only to 2024, but also beyond as we approach $1 billion [indiscernible]. With that, let me turn the call over to Guy. Guy?

Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. We are pleased with our fourth quarter results, which reflect the strong adoption trends of Varonis SaaS against the challenging but stable macro backdrop. Our SaaS transition continues to gain momentum and after just one year in the transition, SaaS now represents approximately 23% of our total company ARR. As a result of this momentum, we now expect to complete our SaaS transition in 2026 which is one year earlier than previously outlined. As a reminder, our transition will be considered complete when 70% to 90% of total company's ARR is coming from SaaS. In the past, we've described the transition is occurring in two phases: Phase 1 began when we introduced the product and is the phase where we focus on selling SaaS to our new customers. Phase 2 of the transition, which is converting our installed base of on-prem subscription customers to our SaaS platform is planned to begin in earnest during the second half of this year. We expect that the ramp-up of this phase will not be linear and anticipate growing momentum in each quarter of 2024 and further accelerating in 2025 and 2026. We ended the year with ARR of $543 million, which increased 17% year-over-year, and we generated $54.3 million of free cash flow in 2023 up from $0.5 million last year. These metrics illustrate our ability to drive top line growth, margin leverage and cash flow generation even in the first year of transition. Our fourth quarter SaaS [indiscernible] represent 66% of new business and net new upsell ARR versus our guidance of 60%, which led to a full year SaaS mix of 57% versus our guidance of 55%. We again saw more of our existing customers converting to our SaaS offering. In the fourth quarter, we had approximately $15 million in conversions of existing customers impacting our Q4 revenue. To be clear, this $15 million represents the renewal [ amount ] that was previously [ booked as ] on-prem subscription, but which converted to SaaS during the quarter. Because SaaS revenues are recognized ratably when the $15 million worth of customer renewals convert from on-prem subscription to SaaS, it causes a headwind to our reported revenue and operating margin. The $15 million revenue impact from this quarter does not include the uplift that we realized for these conversions, which is accretive to ARR and free cash flow. We ended the year with approximately 4,950 subscription customers, which was up 14% year-over-year. Our dollar-based net retention rate for subscription customers was 107% at the end of 2023 adjusting for FX. Turning now to our fourth quarter results in more detail. As a reminder, ARR, free cash flow and ARR contribution margin are the leading indicators for this transition. The shift from on-prem subscription licenses where approximately 8% of the deal's value is recognized upfront to a SaaS delivery model with fully ratable revenue recognition will cause initial headwinds on the traditional income statement metrics. As we said previously, the faster we progress through the transition the more headwinds we will experience to our traditional income statement metrics. We view these headwinds in a positive light. In the fourth quarter, we continue to see [ deal screen ] with multiple levels of approval which are still impacting our results. But if I had to describe the environment in one word, I would use the same word I used last quarter, which is stabilization. Q4 total revenues were $154.1 million, up 8% year-over-year. During the quarter, as compared to the same quarter last year, we had approximately a 16% headwind to our year-over-year revenue growth rate as a result of having increased SaaS sales in our bookings mix, which are recognized ratably versus the upfront recognition of our on-prem subscription products. Subscription revenues were $129.2 million, and maintenance and services revenues were $24.9 million as our renewal rates were again over 90%. Moving down the income statement, I'll be discussing non-GAAP results going forward. Gross profit for the fourth quarter was $136.4 million representing a gross margin of 88.5% compared to 89.9% in the fourth quarter of 2022 despite significant revenue headwinds, which were largely offset by SaaS platform efficiency. Operating expenses in the fourth quarter totaled $109.2 million. As a result, fourth quarter operating income was $27.2 million or an operating margin of 17.7%. This compares to operating income of $26 million or an operating margin of 18.2% in the same period last year. During the quarter, as compared to the same quarter last year, we had approximately a 10% headwind to all operating margin as a result of having increased SaaS sales in our bookings mix, which are recognized fully ratable versus the upfront recognition of our on-prem subscription products. Fourth quarter ARR contribution margin was 13.4%, up from 4.5% last year. The significant leverage improvement even during the early stages of the transition, reflects our ability to drive strong incremental margin while growing ARR and transitioning to SaaS. During the quarter, we had financial income of approximately $8.1 million, driven primarily by interest income on our cash, deposits and investments in marketable securities. Net income for the fourth quarter of 2023 was $34.3 million or $0.27 per diluted share compared to net income of $26.1 million or net income of $0.21 per diluted share for the fourth quarter of 2022. This is based on $126.1 million and $126 million diluted shares outstanding for Q4 2023 and Q4 2022, respectively. As of December 31, 2023, we had $744.8 million in cash, cash equivalents, short-term deposits and marketable securities. For the 12 months ended December 31, 2023, we generated $59.4 million of cash from operations compared to $11.9 million generated in the same period last year and CapEx was $5.1 million compared to $11.4 million last year. I will now briefly recap our full year 2023 results. Total revenues grew 5% to $499.2 million. In 2023, as compared to 2022, we had approximately a 12% headwind to our year-over-year revenue growth rate as a result of having increased SaaS sales in our booking mix, which are recognized ratably versus the upfront recognition of our on-prem subscription products. Our full year operating margin was 5.8% compared to 6.2% for 2022. In 2023, as compared to 2022, we had approximately a 10% headwind to our operating margin as a result of having increased SaaS sales in our booking mix, which are recognized fully ratable versus the upfront recognition of our on-prem subscription products. Turning now to our 2024 guidance. We continue to take a responsible approach to our guidance philosophy, which includes factoring in the continuation of long deal cycles and multiple layers of deals [ would be ] throughout 2024. Our Commitment to balancing top line growth, margin leverage and cash flow generation has not changed. While at the same time, we also see an opportunity to invest in order to capture the longer-term opportunity that we see and capitalize on the secular tailwinds that Yaki discussed. These investments are already baked into our guidance, which shows our ability to invest in the business while generating improvements in our North Star metric. When we launched this transition, we committed to being transparent and also to providing metrics that accurately measure the health of the business. As we turn our attention towards the final phase of this transition, our main focus is now completing this transition, which [ with SaaS ] is 70% to 90% of total ARR. In an effort to provide metrics that help you monitor our progress throughout the next phase, we will be providing SaaS revenue and also SaaS as a percentage of total ARR on a quarterly basis. At the same time, this will be the final time that we provide SaaS mix as that metric measures the progress of Phase 1 of the transition. Going forward, we expect the vast majority of new customers to purchase our SaaS offering. For the first quarter of 2024, we expect total revenues of $111 million to $115 million, representing growth of 3% to 7%. Non-GAAP operating loss of negative $15 million to negative $13 million and non-GAAP net loss per basic and diluted share in the range of negative $0.10 to negative $0.09. This assumes 110.1 million basic and diluted shares outstanding. For the full year 2024, we expect ARR of $678 million to $625 million, representing growth of 14% to 15%, Free cash flow of $17 million to $75 million, Total Revenue of $536 million to $546 million, representing growth of 7% to 9%. Non-GAAP operating income of $7.5 million to $12.5 million. Non-GAAP net income per diluted share in the range of $0.11 to $0.13. This assumes 127.7 million diluted shares outstanding. In summary, we are excited by the progress of our SaaS transition, which is benefiting our three North star metrics: ARR, free cash flow, and ARR contribution margin. The momentum of our transition, coupled with the tailwinds of MDDR, the adoption of generative AI and increased data-centric regulation gives us the confidence as we finish the initial stage of the transition and look to grow new customers and convert existing ones to our SaaS platform in 2024 and beyond. With that, we will be happy to take questions. Operator?

[Operator Instructions] Our first question comes from the line of Matt Hedberg with RBC.

First off, congrats on the [ result ], the SaaS momentum is impressive. But equally interesting is the free cash flow. And it's great to see both of those. I guess for one question, Yaki, can you talk a bit more about the specifics of the Microsoft partnership? I know there were some news releases this past quarter, maybe a little bit more about the go-to-market functions in the channel. But any way to think about sort of the momentum, maybe the pipeline generation that Microsoft is generating?

It's still early innings, but essentially, copilot for Microsoft is a tremendous productivity opportunity for organizations but coming with a lot of risk. So what happened is that the Copilot for business is going to digest any data that they can get and the data that they can get is access control is related to access control. This is a security model that they are using and without a product like us, 90% of the data on average that the user can access is not relevant for them. So think what will happen. They will create a staggering rate, high-value information product completely out of policy, not label that you don't know where they are. And this is massive risk. So they recognize that in order to close the blast radius automatically, you need us. And the other thing, if a tool like that is in the hands of a bad actor, it'll inflict massive damage on organizations. So we are teaming with them. We are teaming with the sellers in order to make sure that we will be the foundation of this -- of getting a good control over the data before you are going to unleash this to unleash these tools. It's important to understand that it's still early innings. They are still not in mass distribution with this product. It's coming up in every conversation. But we think that as they're going to release it and organization will really understand the power of this and also the risk that come with it, but they really need to make sure that they are ahead of the risk, and we are well, well positioned to do very well. We are very excited about the opportunity.

Our next question comes from the line of Saket Kalia with Barclays.

Yaki, maybe for you, a little bit of a higher-level question. SaaS transitions in other areas of software have often expanded the total addressable market. And understanding that it's still early here in Varonis' transition, what are some of the anecdotes that you can see out there where you think your SaaS products are expanding customer spending on data protection? I think you mentioned a couple of customer examples, but I know you spend a lot of time with customers. Do you see some of that TAM expansion starting here with the move to SaaS?

Of course. And it's very tangible. So the way that you see this, it is only stemming from the value proposition. First, it's just tremendous amount of automation. And with ease, we can cover many more data repositories, but also with the MDDR, the automation, the threat detection response, the classification, the data protection. We can do so much more for customers. So if they buy a product now, we can really take all the not all, but a lot of the operational load on us and make sure that they have a world-class security team that is completely oriented to data. And the extension of the TAM in terms of innovation and you will also see it with what we are going to release in the future. But you see they are very aggressive, if you will, release cycles and you see now Snowflake and more coverage as organizations are going to have more critical data repositories and they will hit the critical mass in the marketplace. We are going to protect it. Just in terms of the value today, if you have Varonis, most probably, you will not have a data breach, and you will not have a data breach automatically without any effort. You just need to buy the platform. So it's from everywhere from the value, from the way that you can expand the data repositories or coverage or automation, it's just increasing our drastically and also in terms of innovation, it's much easier for us to take a thought and to make it a commercial reality and really distribute it to the marketplace. We are very excited about our ability to innovate. And the situation that is related to data, you see things like CoPilot. With copilot, you'll have more connectors and stuff like that. So it's definitely expanding the need.

Our next question comes from the line of Hamza Fodderwala with Morgan Stanley.

Yaki, question for you. We're obviously seeing a lot of focus with companies getting their data prepped for these generative AI deployments. Big focus on data security and governance around that. I'm just curious, as you're having more conversations with your customers and prospective customers, how often is that coming up for Varonis? And how do you expect that conversation to ramp throughout the year and ultimately drive more sales for your business?

So it's really coming up with every single conversation. And I think that if you will take almost every system and ask them, what is your main objective? They will tell you that the lion's share of the objective is to avoid a data breach and the other part is to make sure that the infrastructure, obviously, the applications, you have uptime. Everything can really deliver a service. And for us, with all the SaaS, we really can make sure that you will -- most probably, you will not have a data breach, but for which you have a data breach, the potential damage will be very small, and we'll get to the root cause super fast. The reality today in organizations, they [ set ] every breach, you guys understand extremely well. It's almost always about the data. This organization has a very sophisticated modern security stack. A lot of very smart people that manage security, but they bypass the perimeter and they don't see anything, it's all about the data. Then they need to bring an IR company, they pay them sometimes, sometimes it's millions of dollars. And they can say what damage happened on the data layer. This is a world that is upside down and people understand it. Constantly they spend more on security, and they have more data breaches. And the way that a credit card issuer can't give you fraud detection without seeing the transaction or you will never do business with the bank that can provide the ledger and can tell you if you have other identities or devices on your account, it's the same with data. So we definitely see the organizations understand it. And definitely, things like Copilot accelerate it. It's because they -- it's really, it's like ransomware, it's exposing the problem and then [ once, if ]out of thousands will get it or hundred organizations, I think that everybody will get Copilot. So Copilot is going to really expose the blast radius. So we feel that it's -- it can be over time, a very good opportunity for us. And we're also excited that we are joining forces with Microsoft.

Our next question comes from the line of Brian Essex with JPMorgan.

I guess maybe for Guy, would you mind unpacking your net dollar retention rate a little bit? And how might we think about that and, I guess, factors that go into calculating that, whether it's customer growth, cross-sell, upsell and how might we expect that to drive kind of a better traction as we look into fiscal '24?

Absolutely. When you look at kind of NRR in 2023, there were basically two factors that had an impact. The first one was the friction related to the transition in the first six months of the year. If you remember, we started the year. We're sitting here today at 23% SaaS mix out of total ARR, and that only happened in one year. But we had to go through a lot in the first six months definitely had an impact in terms of the friction there. And the second factor was the macro environment, which we talked a lot about in terms of longer sales cycles and deal scrutiny, and that's definitely kind of the second factor that impacted NRR. I think as we look at kind of the opportunity both with the customer lifetime value that we're generating with our existing customers, converting them to SaaS, that generates a tremendous opportunity for us to continue to sell to them and make them better protected on additional platforms. We're very excited about that. It happened -- kind of the whole conversion in 2023 happened in a natural way, and it's been very extremely encouraging for us. And we believe that can accelerate in 2024. But even in terms of new customers, you look at the land, they're larger lands with the SaaS offering. And as with the simplicity of the product and the fact that we are now offering the MDDR which is really a game changer for us in terms of the offering to our customers in terms of having them better protected in a much easier way. All of those are an opportunity for us to grow our NRR into larger and higher levels.

Our next question comes from the line of Joel Fishbein with Truist Securities.

I wanted to -- Guy, I wanted to ask about the MDDR offering. Can you just give us a little color on how that will be priced? And then what do you think the adoption curve looks like in terms of time to revenue?

It's a very good question. When you look at kind of our offering to date, we've offered the proactive incident response team for quite some time now, and the reception the way customers have received it has been extremely positive. So all we're doing right now is charging for the service that we've provided for quite some time. And I think there, as you look at kind of the MDDR, we expect it to generate a healthy uplift in terms of the ASP and what we can generate from our customers. So we don't expect us to become a service company. We believe that over time, we can generate MDDR that is in licensed software margins. We feel that not only is extremely beneficial for our customers, but it can also help with increased and improved renewal rates over time. It can help with the opportunity to upsell additional platforms that a customer would see the value and would want to be protected on multiple platforms. And at the same time, it's so appealing and for customers that it can actually help with closing rates. So I think the MDDR has an option on all of those fronts. The way we've structured the comp plan in 2024 makes it a no-brainer for our reps to introduce it to our customers. So I expect the adoption to be extremely healthy this year. And I think it's a benefit for our customers, but also a significant benefit for us as an organization.

Our next question comes from the line of Andrew Nowinski with Wells Fargo.

I wanted to ask about total ARR guidance. You guys have outlined so many different positive growth drivers tonight. The mix of your SaaS revenue is 23%. I think it's the fastest pace we've seen over the last 4 quarters. You're getting that 25% to 30% price uplift on SaaS, you're getting larger [ lands ], as you mentioned. You got the new integration, of course, with Microsoft and the MDDR service, but your outlook for ARR implies a fairly steep deceleration. I'm just -- given those growth drivers, why would we expect a deceleration in your ARR growth this year?

So when you look at the math, and I think the numbers that you look at, I completely understand the math that you're doing and it makes sense. I think when you look at the prepared remarks, we had extremely bullish tone, and I do want to reconcile that with the guidance that we've provided. So when -- as you look at us sitting here today, we've never had so many things working in our favor. Apart from the everyday increasing breaches that we've seen happen for years, there's additional drivers and tailwinds that we've really never seen before. Yaki talked about the Copilot, there's the cybersecurity SEC regulation and also what we believe is a game changer for us, which is the MDDR, which we just introduced. But you have to remember, our sales cycles are three months on the shorter end and up to 12 months on the larger deals. So when you look at kind of us sitting here right now and looking at the philosophy that we've guided for in the past for many, many years. It's not something that we have done in the past to bake in positive assumptions into our guidance without seeing the data that supports it. So it's really a starting point for the year. We're sitting here in February, and there's a long year ahead of us. We believe that we will see those trends that I've talked about, kind of work in our favor over the year. And as we have done in the past, we'll be happy to update our guidance as the year progresses. But as I mentioned, there's a lot of things that are working in our favor that we haven't seen in the past.

Our next question comes from the line of Fatima Boolani with Citi.

Guy, this one's for you. I was hoping you could help unpack for us how much of the expected operating margin degradation that you're anticipating this year is more due to the fact that the transition is actually accelerating because you did pull forward that timeline. So certainly, we appreciate the mechanical P&L impact to that. But just how much of that degradation on a year-over-year basis is tied to this sort of mechanical artifact versus some of your comments in the prepared remarks pertaining to a desire to reinvest in certain parts of the business? I believe you said some organic reinvestment. So just some directional help on that front would be great.

That's a very good question. And I think it's a combination of some of the accounting in terms of the cloud costs and the way they're recognized in terms of the expense in a [ ratable ] way versus kind of the ARR where you recognize it up on the day of the sale but there's also this understanding that there is a tremendous opportunity ahead of us, and we want to take advantage of it. So when you look at kind of our philosophy over the last couple of years, we've been very focused on the top line growth and wanted to make sure that we show margin leverage and free cash flow generation. I think as we sit here today, we feel extremely confident about kind of the guidance that we provided during the Investor Day in March of 2023, about a 20% ARR contribution margin by 2027. So kind of when you look at the progression, in terms of free cash flow, we've shown improvement from '22 to '23 and even in the guidance of 2024, there's a significant improvement there as well. ARR contribution margin moved significantly from 2022 levels to 2023 levels and the 2024 guidance has an improvement as well. So I think some of the investments that we're making today are ahead of what we want to see is a return to the ARR top line growth of kind of that 20-plus percent. So I think we're definitely making the investments to take advantage of a larger opportunity. And we believe that with the tailwinds that we've talked about, there is a tremendous opportunity for us to take advantage of.

Our next question comes from the line of Roger Boyd with UBS.

Guy, I wanted to go back to the conversion math. You converted a little over $30 million from term license to SaaS this year really without any sort of formal go-to-market behind it. Apologies if I missed this, I think you noted that you're expecting that to accelerate. But any rough cut assumptions on what you're expecting in terms of conversions in 2024? And alternatively, kind of the puts and takes here around renewal timing, the sales ramp-up, which you know it will be kind of skewed towards the back half of the year.

Absolutely. We finished 2023 with 23% SaaS out of total ARR so at $125 million. And our assumptions for 2024 is that we will finish at 46% SaaS percentage out of total ARR. That basically means $285 million of SaaS by the end of 2024. So a significant increase that basically means $160 million of SaaS ARR in 2024, a significant increase versus the $120 million of SaaS that we have generated in 2023. So obviously, our assumptions are that there will be some significant increase in the conversions themselves, but also that the percentage of SaaS sold to new customers would be pretty significant as well. I think the overall understanding and the feedback that we're getting from our customers is that they prefer the SaaS offering because it's a better product. And in terms of -- from a commission perspective, our reps retire quota on anything on top of that renewal. So on the uplift that they get from an existing customer in that conversion, that goes towards that quota retirement. So it's actually a win-win. It's a win-win for -- it's a win for our customers, and it's a win for our sales team, and that's the best way to kind of incentivize. And that's why the 2023 has been a great surprise in the level of conversions that we saw and our expectation is for an acceleration in 2024, which would bring us to that $285 million of SaaS by the end of this year.

Our next question comes from the line of Chad Bennett with Craig-Hallum.

Guy, maybe just a prior question, when you talked about the MDDR opportunity, and the ASP difference. Is there any way to kind of quantify kind of how material that uplift is or just the deal size difference you see in MDDR versus a traditional SaaS deal?

It's very early still, but I can tell you that even as we sit here today, and we just spoke to our sales teams about it during the SKO that we had a couple of weeks ago, we've already seen that they've adopted it in a very healthy and positive way. We've actually seen some of the quotes where they go back and get an uplift. I don't want to put a number quite yet just because it's so early. But the MDDR does allow us to generate a pretty significant and nice uplift, but at the same time, provide customers the value with less of a need of people to actually be protected. And at the end of the day, that's the [ vesting ] -- the win-win with our customers.

The win-win is that there is many customers that are using managed security service providers and at times get little value in terms of data breaches and they can be completely protected with us. So there are budgets for it. And the other thing in order to get the most from the MDDR, you need a good footprint of the platform as much as you have more licenses with us, if you will, more bundles, you get more value. And regarding our AI capabilities, we invested to [indiscernible] a [ CII ], not just for our customers but also for our analysts. We are selling software. So we build robots and interfaces to make sure that our -- the people that provide incident response and professional services can be much, much, much more productive and we learn very fast. The system, they learn what they are doing repeatedly and really build the robots behind it. So we think that this offering has tremendous opportunity, tremendous attachment to budgets. It's a driver to buy more bundles. It's just the beginning, but we think that it's something that is very unique and the first [ manage detection ] response that is data oriented.

And just to touch on that, as we go through the year and kind of the sample size becomes much more meaningful, we'll be happy to provide more color about what we see in terms of the MDDR and the uplift that we see.

And then maybe just one quick follow-up. Just now that we've kind of been through a full year of the SaaS transition, and we have a decent amount of critical mass in that business in deal flow and whatnot. Maybe for Yaki, just in terms of -- I know the 25% to 30% uplift on deals on conversion. But just are you seeing -- is there any quantification of new data repositories or new use cases now that you are -- you have seen a pretty good volume of SaaS deals that maybe outside of the Microsoft ecosystem you're realizing more of these opportunities from a data repository use case standpoint? Is there two or three that are significant?

Yes. The three things that we are doing extremely well is making sure that only the right people can access the right data, the robotic remediation of access control without breaking any business processes, which is the holy grail of data protection. Threat detection and response, that is data oriented. And then obviously, a very accurate classification of data and to give it context, and then we are doing into every depositor. We have this amazing product for sales folks and [ Box ] and Google that we are going now into the [ IS ] world. And with AWS, all the databases, all the [ RDS ], S3 and in Azure, Azure Blob and we're just moving very, very, very fast really to do everything we have done, we use on-prem data with storage in these biggest NAS devices of the world and they [ aren't structured ] and then went to application and [ semi structure ] than e-mail and the SaaS applications and how this data repository is in AWS and Azure, and we will move very fast. And everywhere we go, we bring these three use cases. But the other thing is also, as you have more data, you have more enrichment. Because if you look at most of the breaches, almost all of them, they always go from one -- they're coming in, they try to get credentials, they are becoming a user. And then they are moving from one data repository to the other. And we are really in the best position to make sure that organizations don't have data breach, and we are doing it automatically. And now even in the places that they need to put some effort, we are taking it on ourselves. We just need to help us set it up and someone needs to answer the phone. This is the level of automation we are getting to. And any repository that we are going to protect this is the level of protection [ you ] will get.

Our next question comes from the line of Jason Ader with William Blair.

Just wanted to ask in terms of the conversion process in practice, how does it work with your existing customers? Do you wait for the term expiration kind of a little bit ahead of that to try to convince people to switch over to the SaaS version, how much incentives do you provide for them? I know you have a 25% to 30% price uplift, that doesn't seem like much of an incentive to [ new ] customer. So what are some specific things that you're doing as you think about 2024, especially second half where you talked about accelerating the kind of some of the activity with the existing customer base?

So Jason, I'd start by saying that, that 25%, 30% uplift is actually a significant incentive for our customers to convert because the total cost of ownership saves them money. So yes, they pay more on our price list. But at the end of the day, they save on the hardware, and they save on the people. and they're getting a much, much better product. And especially with the MDDR, it could save them even more in terms of the offering. So it's definitely an incentive. As we look at our offering. And when we look at kind of the renewals, if we really take the queue from our customers. Some customers want to wait until the renewal period, and then they would talk about the conversions. Sometimes, they don't want to wait, they have a renewal that's ahead of time, but they want SaaS and they want it now. We work with our customers to make sure that they would be protected in the way that they feel most comfortable. I can tell you that getting a renewal on the on-prem subscription side is a pretty automatic process. You ask for the renewal, you get the PO. There's not too much conversation going on. Obviously, you want to position in terms of the upsell, but just getting a pure renewal is pretty straightforward. Getting a conversion requires understanding what types of offering would make the most sense for them, kind of talking about the price uplift, but how it saves them money over the [ TCO ] in general. So there's more of an effort there. It's not happening automatically. But it's a much better product, it's providing better protection to our customers. And the fact that we can convert them sets them up for additional upsell opportunity because they'd be protected on additional platforms. and they see the value, and they would want to purchase more. So it's a win-win and it's time very well spent from our perspective, and that's why we're so focused on that. Obviously, as you look at kind of the seasonality, we have, historically, way more renewals happening in the second part of the year. That's why we talked about the Phase I and the conversions happening accelerating towards the second part of the year for obvious reasons. But we also see the conversions accelerating within the year. So every single year, we expect to have more conversions in dollar terms as this picks up. But I think as we sit here today and with our expectation of getting to $285 million of SaaS by the end of this year, we're expecting customers to convert at a higher pace than we saw in 2023.

Our next question comes from the line of Joe Gallo with Jefferies.

You guys have launched many new products recently, Snowflake protection, you've upgraded protection for Salesforce as you bolster DA cloud. Can you just talk qualitatively about the traction you're seeing in DA Cloud? And then quantitatively, any metrics or size or growth profile? And then just how we should think about the mix as a percentage of ARR over time from DA Cloud?

Joe, if you remember, for quite some time now, we're looking at our SaaS offering as a whole, and we're definitely seeing that in terms of the conversations with customers where they not only buy the SaaS offering on the platforms that we used to have on-prem, but they're also talking about additional platforms that we have through the Polyrize acquisition and the offering there. So I think overall, the adoption as we saw in Q4, was healthy. It's definitely helping in terms of the conversations. Obviously, we think we can do much better and we've talked about the fact that it takes time to introduce new products until they kind of take off as we saw with the Office 365 and the automation engine. But we're very happy with the progress so far, and we believe that we can increase it in 2024. Our reps are very much in line with this. They understand the benefits there. Our customers are asking about it and talking to us about it. So overall, we're happy with the progress so far.

Our next question comes from the line of Shrenik Kothari with Baird.

So Yaki, you talked about the sales kickoff event earlier in the call and the level of energy [indiscernible]. So just one follow-up to the previous question about the second half ramp for Phase 2 regarding the Sales force incentive specifically. Of course, so far, they are uplift from SaaS kind of naturally was the momentum due to higher commissions. And yet, you have not implemented any additional monitoring [indiscernible] for selling SaaS. So can you elaborate on the conversion kind of go-to-market motion around adjusting this sales force incentive dynamics related time lines? And also, how does these incentives drive incremental OpEx, which you're tying into your margin guidance, framework and assumptions for the first half and second half?

So I'll take this question. In terms of the incentives for 2024, we've definitely seen some very positive momentum on the conversions in 2023, and we talked a lot about it throughout the year and the fact that it's happening in a natural way. We had discussions internally of whether it makes sense to incentivize the conversions in 2024. And I could tell you that with the momentum and the fact that it's happening in a natural way, we didn't see any reason to at this current stage to put additional dollars to work from a commission perspective because what the reps are actually benefiting from is the uplift on the conversion. So anything on top of that renewal amount goes towards their quota retirement and we've definitely seen some healthy uplift. There's a 25%, 30% uplift. But if that conversion requires additional users, additional licenses, additional platforms, then those increases are actually higher than that 25%, 30%, and that's very beneficial for our reps. So we didn't start with any incentives in 2024 related to that. Obviously, if we see a need to accelerate on that and put money to work there, we will. But I currently don't see any need to do that because the way the structure is happening is benefiting our customers and it's benefiting our sales force with those uplifts. I think as we increase those uplifts, the magnitude in dollar terms throughout 2024 and I talked about kind of Phase 2 accelerating within the year. And also as we see that Phase 2 accelerating within the years themselves, where every single year actually has more of conversions versus the previous year. I think it puts us in a very good position to upsell to those customers, provide them a product that is much better because the SaaS offering is a better product than the on-prem subscription offering. And with the MDDR offering, I think that's an actual game changer for us because it provides value where customers don't necessarily need to have the same teams in place. They can have less people and be better protected. And we can benefit from that and provide the protection to our customers that we can provide in the past. So I think all of those are positive that we want to take advantage of.

Our next question comes from the line of Erik Suppiger with JMP Securities.

On the MDDR service, did you say that you would or you would not need to add additional people? Is that just going to be using the IR team that you have? And if you look longer term, what type of penetration do you think you can get with that across your customer base?

It's still early in terms of the penetration, we will communicate as this thing is moving forward. But in terms of people, obviously, when we have the service, we'll need more people, but the productivity profile of an IR team using our AI from the cloud is just significantly better. You're talking about -- it can be 5x more productive. So this is the key for us. The key for us is to make sure that we are using the software to provide to many customers a premium service with an SLA, with a very strict SLA and they will have, for them, a world-class analyst. It will be partially analyst, it will be a robot. So this is the way that it works. The software is augmenting people to be much, much more productive.

And I want to give some additional color on kind of the expense side as we look at this. Obviously, our expectation in terms of the investments are already baked into our guidance. So we definitely built in some additional investment in customer success, IR, but we have provided the proactive incident response team for a couple of years now. Now we're just charging for it. So we can actually benefit from it in terms of margins. So as I mentioned before, we're still a software company. We don't see us changing that, and we expect that MDDR over time will have software-like margins.

Our next question comes from the line of Brian Colley with Stephens.

So I'm curious if you've seen any uptick in the pipeline that's directly related to customers they're looking to enhance their data security before deploying Gen AI. So I realize it's still early, but just trying to try to see what you all think in terms of how Gen AI could impact the growth rate [indiscernible].

What we can say with a lot of confidence that it comes up almost in every conversation. People understand that it's a big opportunity with a lot of risks and they need to be ahead of it. If we need to -- you never know, but the way that we think that it's going to move forward and with these tools will be in the hands of many end users will just be -- people will just realize it on a daily basis and God forbid if it's going to bad actors, but it's definitely coming up with every conversation. This AI comes with security risks, security risks for data risks. The #1 is this overexposed data in terms of excessive access control, and we are uniquely positioned to solve this problem.

Our next question comes from the line of Rudy Kessinger with D.A. Davidson.

Guy, I know you're not giving exact color, but is $15 million in converted ARR a good starting point for Q1? And then with your sales reps, you're giving them quota relief on the uplift amount on renewals. Does that impact their ability to focus on net new customers and new deals? And how are you factoring that into your guidance?

Well, I'll start with the second part of your question. I think we've been extremely focused on acquiring new customers. The SaaS offering allows us to tap into markets and verticals and customers that we've never had the opportunity to sell to. I can tell you that the way the 2024 comp plan is set up is that account managers will not be able to make significant money if they don't sell to new customers. So that's been at the forefront of our philosophy over the last couple of years, and I can tell you that in 2024, we've actually doubled down on the importance of the new customer acquisitions. In terms of the conversions, we want to convert our customers as well because there is a lot of leverage with a SaaS offering for us from a financial perspective and the SaaS offering is a much better product and provides the opportunity to update that product in a much more seamless way. So there's a benefit for us, and it's a much better product for our customers. So I'm not sure that $15 million is the right starting point. You have to remember that there is a seasonality within our business where Q4 is the largest quarter of the year. And then in dollar terms, Q1 historically has been the lowest in terms of in dollar terms. So it starts with a small dollar term quarter in Q1, and then it picks up throughout the year. So that needs to be baked into consideration. But I think a good starting point should expect kind of the same progression of Q1, Q2, Q3 and Q4 that we saw in 2023 as a starting point for 2024 as well just in dollar terms, the actual dollar terms that we expect to get to with our SaaS offering by the end of this year is expected to be significantly higher than the $125 million we finished with, we want to get -- the guidance assumes $285 million at the end of this year.

Our next question comes from the line of Rob Owens with Piper Sandler.

I want to drill down a little bit on some of your comments there, noting that the net new subscription numbers ticked down year-over-year and frankly, have ticked down for the last four years. So to that end, was it the way the sales force was incentivized with quota retirement? Is it churn? Because I know in some of your comments earlier, Guy, you did talk about friction with regard to the SaaS change. Or is this just more sales cycle and timing around the shift to SaaS? Just curious for color, I guess, in terms of new customer acquisition throughout the year.

I think no matter how you look at the business, there are strong underlying trends. And I think our philosophy in terms of new versus existing has been very, very much -- kind of a mix of both with our existing customers, there's definitely kind of an increased customer lifetime value that we're seeing with the SaaS offering. But as I mentioned before, the new business opportunity has never been greater for us. And that's why in 2024, we've kind of structured our comp plan where account managers will not be able to make significant money if they don't sell to new customers. I think it's important to note that it's not a simple excel where we put in a 25%, 30% uplift, then you plug it in and you get the PO. Renewals happen in an automatic way when you get that on-prem subscription renewal. But when you try and convert a customer, you have to talk to them about the benefits, you have to talk to them about the cost. It's an exercise that requires time.

It is a different contract in terms of different security review. Look at this transition though, just so many moving parts. I will tell you that, that in terms of the value proposition, it's completely different. I think that the common ground is the logo. It just is -- order of magnitude in terms of the automation, the way it works. The overall platform is a fraction of the support ticket, the self-hosted versus the SaaS. And sitting here today, I will tell you that it's so far moving much faster than we anticipated, but it's -- you need to do it with great, great attention to details. There are just so many things to do in order to make sure that it will work right that you will cater to the customers. It just it's -- you need a daily focus on it. Just -- you have laser focus on the way you're doing it.

And just to touch on kind of the new customer adds. I think it's still early, but SaaS does open up kind of opportunity for us to new markets and new customers that we haven't been able to sell to before. As you look at kind of the ASP, they're higher when we sell to our -- the new customers through SaaS offering, which is very healthy. And I think that as you look at kind of the years ahead, the SaaS offering will allow us to continue to take advantage and generate additional fuel that will support the growth of this business in the years ahead.

Our final question comes from the line of Josh Tilton with Wolfe Research.

This is Patrick on for Josh. Just a quick clarification one for me. with the transition time line being moved up a year, does that change the way we should think about the path to the 2027 long-term targets provided at the Analyst Day? And are you all now targeting Rule of 40 exiting the transition now in 2026? And what should the composition of that look like?

When we laid out kind of the plan in March of 2023, we talked about the transition lasting five years, we're bringing that one year shorter and we're very happy about that. We're not actually not changing that $1 billion target, and that's still at 2027, but I think we're extremely excited to reduce these the whole transition period and cut it by one year to four years. So the rest is kind of staying intact

Thank you. There are no further questions at this time. And I would like to turn the floor back over to Tim Perz for closing comments.

Thank you for the interest in Varonis, we look forward to meeting with all of you at the conferences this quarter.

This concludes today's teleconference. You may disconnect your lines at this time. Thank you for your participation.