Greetings, and welcome to the Varonis Systems, Incorporated Third Quarter 2021 Earnings Conference Call. At this time, all participants are in a listen-only mode. A brief question-and-answer session will follow the formal presentation. [Operator Instructions]. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, James Arestia, Director of Investor Relations. Thank you, James. You may begin.

Thank you, operator. Good afternoon. Thank you for joining us today to review Varonis' third quarter 2021 financial results. With me on the call today are Yaki Faitelson, Chief Executive Officer; and Guy Melamed, Chief Financial Officer and Chief Operating Officer of Varonis. After preliminary remarks, we will open the call to a question-and-answer session. During this call, we may make statements related to our business that will be considered forward-looking statements under federal securities laws, including projections of future operating results for our fourth quarter and full year ending December 31, 2021. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned forward-looking statements. And these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein. Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation for the most directly comparable GAAP financial measures is also available in our third quarter 2021 earnings press release, which can be found at www.varonis.com in the Investor Relations section. Also, please note that all common stock and per share data have been retroactively adjusted for the impact of the 3-for-1 stock split effective March 15, 2021. Lastly, please note that an updated investor presentation as well as a webcast of today's call are available on our website in the Investor Relations section. With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Faitelson. Yaki?

Thanks, Jamie, and good afternoon, everyone. Thank you for joining us to discuss our strong Q3, which was a major milestone for Varonis, our first quarter to surpass $100 million in revenues. As companies around the world became more aware of the need to protect sensitive data, we see this achievement as just scratching the surface of the enormous opportunity ahead of us. I want to thank the entire Varonis team for their efforts, which led to the success. With that, let's jump in as I provide an update on our business. I want to focus on the security problem facing all organizations and why our data-first approach continue to resonate with new and existing customers. I will then turn the call to Guy to discuss our Q3 results and updated financial guidance. Let's start with the current operating environment, where our world is more reliant on data than ever before and the ultimate objective of security efforts is to protect it. The global digital transformation has led to many collaboration benefits, but it has also fundamentally changed how companies must approach security, as we have said. Sensitive data is now stored and accessed from more places. The perimeter is hard to define and even harder to monitor and protect. And endpoints now serve mostly as access points to large data stores on-prem and in the cloud. Organizations are using the sanctioned data stores and critical business applications, so that their employees can more easily collaborate and extract more value from data. However, the ease and speed of collaboration has made securing data far more challenging, and we continue to see that without the right protection, it is getting harder and harder for enterprises to manage security without impacting productivity. As this part of data continues, the attack surface grows,…

Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. We are pleased with our third quarter results, which demonstrates the power of our platform and continued need of our customers to secure their sensitive data. Financial highlights in Q3 include 31% total revenue growth year-over-year to surpass $100 million of revenue for the first time in our history. This was driven by 36% growth in ARR to $354.2 million. Our continued execution against our targets resulted in another strong quarter of growth. The confidence we have in our business is reflected in our Q4 guidance, which is the highest growth we have guided to since 2014. That year, our total revenues for the year were approximately $100 million, which is the revenues we delivered this quarter alone. Looking at our results, we continue to see a healthy balance of new customers making substantial upfront commitments and existing customers expanding their Varonis deployment after we demonstrate the value of our platform. We are pleased that the number of licenses purchased by new customers has increased over time as this reflects a meaningful increase in customer lifetime value. As of September 30, 2021, 70% of our total customers with 500 or more employees purchased four or more licenses, up from 60% a year ago and 50% two years ago. At the same time, 37% of our total customers with 500 or more employees purchased six or more licenses, up from 26% a year ago and more than double the 17% in Q3 2019. The rapid growth in these metrics demonstrates the strong customer engagement we see and also illustrate the ongoing opportunity we have to get all Varonis customers to a double-digit number of licenses. Turning now to our third quarter results in more detail. Total revenues grew 31% to…

Thank you. We will now be conducting a question-and-answer session. [Operator Instructions]. Thank you. Our first question comes from Sterling Auty with JPMorgan. Please proceed with your question.

Yes, thanks. Hi, guys. So Guy, I think you had alluded to the idea of stronger or bigger initial commitments from customers. I guess I interpret that as larger initial deal sizes. Can you give us maybe a quantitative look at how much have they grown and maybe a qualitative explanation as to what do you think is driving it and what do you think the trend from here will look like?

It's a great question. The answer is very much the platform consumption of our customers. They are buying way more licenses. They're buying approximately double the number of licenses that we had when we sold perpetual licenses. And what we've also seen is that the more licenses they acquire, the higher the likelihood that they see value in the product and they will come back and buy more. So when we price the subscription price lift, it was at 45% of perpetual on first year maintenance. When you think about the fact that they're acquiring double the number of licenses, you can see how that ASP is much higher than what we initially thought would be when we just initiated the transition. And this consumption of the technology is what's driving the growth and the customer lifetime value.

That makes sense. And one follow-up would be, as you look at your sales hiring and sales capacity, what are you doing in terms of current hiring to set you up to capture that what you mentioned as durable demand moving forward?

We keep hiring. There's just tremendous market opportunity in front of us. And as Guy said, there is a very strong understanding from our customers that they need to protect data, and data is really concentrated in the sanctioned data repositories, on-prem and in the cloud, and we are benefiting from it tremendously. But we need to enable them, and we know we need to make sure that we give them the right sets of the counsel. The total available market in terms of what we can -- how we can grow in the base and just the market opportunity, which we captured is huge, and we're just going to grow the sales force. But we're just going to do it in the right way to make sure that we can support them. We have enough management in place. We have very diligent enablement programs. And we need to make sure that when people come here, we support them in the overall success.

Makes sense. Thank you, guys.

Thank you.

Thank you.

Thank you. Our next question comes from Matt Hedberg with RBC. Please proceed with your question.

Hi, guys, thanks for taking my question and congrats on the results. Yaki, I want to start with you. I guess I'm curious. What is Varonis' stance right now sort of return to work or return to travel? And I guess as the world opens up a bit here into next year, do you think if there is more travel by your team, could that actually help in pipeline generation?

Hi Matt. First and foremost, it's just safety of employees, customers and partners. So we are just diligently following the rules of the health authorities and our HR team in the local offices and markets we operate. But yes, we definitely benefited from remote work in terms of 365 and everything we are doing with DatAdvantage Cloud. So the digital transformation helped us. But as you know, very well, enterprise sales is a full contact sport in the sense of that it makes sense to be with the customers and also with our team. So we are gradually moving to just a hybrid working environment. And in places that we can meet customers and we can meet partners, we are doing. We just build them.

Got it. Thank you. And then maybe just a follow-up for Guy. As ARR decelerates, you're off of more difficult comparisons. As we start to think about the model next year, obviously, you're not guiding to next year yet, but how is the right way that we should think about sort of revenue and growth rates converging? I mean are we to the point where next year, we might see more of a convergence between the two?

I think there's a lot of confusion out there on kind of the convergence of ARR and revenue. And I'll start by saying that we're very happy with ARR growing at 36% and revenue growing at 31%. And as part of kind of the expectation that we have and when we analyze the ARR and the revenue, obviously, one metric is an annual metric, the ARR, and the revenue is a quarterly one. So there could be some sort of discrepancy. But when you look at the recurring revenue, the subscription and maintenance on a 12-month trailing basis and analyze that growth, you see how the revenue and ARR have actually converged. They're both at 36% growth. And it really -- it doesn't matter how you look at it on a quarterly metric or an annual metric, I think those results are very strong and an indication of the strength of the business. And as you mentioned, as we enter next quarter -- in the next earnings call, we'll provide more color for 2022.

Got it. Thanks, guys.

Thank you.

Thank you. Our next question is from Brent Thill with Jefferies. Please proceed with your question.

Great. Just ARR grew nicely, 36%, but only 2% sequentially. So I think there are many questions. Just trying to understand kind of the trajectory and what's driving this going forward? And maybe if you could also just comment a little bit about from a federal versus commercial perspective, any color to add to the federal vertical on what you saw this quarter?

So I think when we look at the overall growth, the ARR being at 36% and, like I said, the revenue being at 31%, very strong numbers, most of the growth was driven by the enterprise business. We feel very good about the pipeline. I think it's a great indication when you look at kind of the Q4 guidance and the guidance providing being at 26% to 29% is kind of an indication of how strong we feel about the business because it's against an outstanding Q4 of 2020. So we definitely feel very good about the business and closing the year strong.

And sorry, Guy, was there any color on federal in terms of what you're seeing?

As Guy mentioned, the growth driver was the overall enterprise business. We saw in federal, there was a lot of focus on remote work and collaboration in Office 365. So we saw just a lot of opportunities, but it was just a bit hard to allocate the budget. But what we do see is that the 365 and the exploring of data is to manage the opportunity for us. So we see just many opportunities for the next year, and there are a lot of projects related to 0 trust. And we are front and center for the 0 trust initiative to many of the federal customers and prospects. So we believe that they can do very well in the next year, but the growth was primarily driven by the enterprise.

Great. Thanks.

Thank you. Our next question comes from Saket Kalia with Barclays.

Maybe for you first, Yaki, the multiproduct adoption here continues to grow. I mean I think the adoption numbers speak for themselves as well as your focus on larger customers. I was curious, I mean, as the base sort of gets to a point where so many more of them have multiple products, have you ever thought about enterprise license agreements with customers in the future? And what are some of the puts and takes as you sort of think about that?

We do. So what we see definitely is that customers understand that they need to protect data. The perimeters are very hard to define. We saw this explosion with endpoint. They are more like access points. Most of the data is in what we call sanctioned repositories on-prem and in the cloud. So when customers are already investing in us, the return of investment many times is tremendous. And if you have security efforts in order to protect your digital assets, Varonis is one of the top, if not [indiscernible] platform that you have. Definitely, the other thing that we see is that more is more. When you have more licenses, there is much higher capability that you will consume much more licenses over time. And customers want to have the most efficient way to do it. So it's still early stages, but we definitely think about it, and we constantly think about what is the right way to make sure that it will be easy for our customers to consume more products and that they will benefit from it and we will benefit from it. But this is something that is in the world, and we'll see how it will play out, but we definitely think about it.

Got it. That's really helpful. Guy, maybe for you. I mean the question was asked about sort of the convergence of ARR and revenue growth. Maybe I'll ask about ARR slightly differently. I mean it's been a pretty nice sort of mid- to high 30% ARR growth here for the last few quarters, several quarters. Is there anything to think about on the glide path of that ARR growth going forward? I mean the transition is done. We've had several high-profile breaches. Of course, we have had COVID last year. Understanding that you don't guide to ARR, what are some of the puts and takes that we should think about when modeling ARR, let's say, for the next couple of years?

Saket, I think when we look at kind of the numbers of ARR out there and some of the talking points that we have heard about ARR, we feel that there's some confusion in how to model those numbers. And one of the things that we have thought of is providing more color on ARR as we enter the next earning call towards 2022. So I think the right metric -- the leading metric for us right now for this year is revenue. But as we sell more DA Cloud licenses and because we will recognize DA Cloud out on a ratable way, ARR will become kind of a leading indicator for us. And therefore, we feel that we should provide more color to that as well.

Saket, one thing from my end, there are these high-level breaches, but the way that usually demand builds for us is that there is high-level breaches, emergency spending, organizations are doing a reactionary stuff. But then they start very thoughtful process, where are my assets, what I need to do, I'm drowning in alerts, what is the best -- how I'm going to protect my enterprise with just the scarcity of stuff. And this is what we are benefiting from. So I just think what's happened is that when the dust is settling, this is where we are benefiting more and more and just becoming more mainstream and the customers are standardizing around us and really looking for a solution...

Our next question comes from Rob Owens with Piper Sandler.

That was a nice lead into DA Cloud, realizing it's still relatively early. But any customer feedback you can give where it's being attached? Any types of rates or if it's actually providing the tip of the spear in terms of your selling motion?

We'll not see material contribution this year, but the customer conversations are very positive. We started to build pipeline. We believe that it's a massive opportunity and really where contemporary risks are going to resideThis is where -- these are the business applications that are running your business. So we believe it's -- the 365 is a good indicator of what we can do with DA Cloud and the initial indications that it can be very strong offering from us.

Yes. And second, I don't know if you've given this metric before, I apologize if you have, but you've talked about getting to double-digit license adoption. And can you give us an idea of what share of customers or how much of the base have actually reached it or gotten there?

The metric we started providing last year was number of customers with more than 500 employees that have 4 or more licenses and 6 or more licenses. And the numbers there are actually supporting exactly what we're talking about, about customers consuming the platform. We have seen the 4 or more licenses go from 50% 2 years ago to 60% last year and 70% this year. And on the 6 or more licenses, we're at 37% this year, actually more than doubling what we had 2 years ago. So very strong indication of the customers consuming the platform and the fact that we are very much in believing that we can get to double-digit licenses on average per customer.

All of you need to understand that the basis is automation. Once they have more customers, they get much more automated value. So this is what you see [indiscernible] just the sheer progress in automation when they have more licenses in [indiscernible] between 3 and 10 or 10 to...

All right. And it almost seems like it's time for another license category, given the success you're seeing in the 4 and the 6.

[Operator Instructions]. Our next question comes from Roger Boyd with UBS.

Congrats on the results. Just thinking about one of these tailwind drivers, Office 365, wondering if you could provide a little more color about what you're seeing in terms of the strength of this tailwind over the past couple of quarters and how you're thinking about it into 4Q and calendar '22?

365, which is -- the whole suite is geared towards collaboration. What we see is that customer capacity to create and share data far exceeded the capacity to protect. And it's just -- it's designed to collaborate and not protect. And this is just -- it exposes a lot of risk to the organization that is using it. And with COVID, you see a lot of adoption there and a lot of adoption we've seen, and our ability to protect data and show the risk is just very effective. So once a customer gets to a critical mass in 365, they always see -- almost always see a lot of value in what we are doing, and this is a tremendous growth area for us. But in the same token, we also believe that the other SaaS services also designed more towards collaboration and very hard to do data protection, and it's constantly we have this tension between productivity and security is just presenting a tremendous opportunity for Varonis. And we are just uniquely positioned to solve these challenges. It's very hard. We need our Metadata Framework and just a lot of very efficient visibility and remediation and classification feature set in order to solve these...

Our next question comes from Andrew Nowinski with Wells Fargo.

So I want to ask about maintenance revenue. If you look at the subscription revenue in isolation, you had amazing growth. However, the maintenance continues to weigh on your overall growth rate. I guess why isn't maintenance revenue declining faster? And when should we expect more existing customers to convert over to subscription?

So the percentage that you see in a decline is an indication of the strong renewal rates that we have. The maintenance of perpetual has had renewal rates that have been consistently over 90%. We have said all along that we don't go back to our existing customers and try and convert them to subscription, but rather just sell them additional licenses under the subscription. So they keep their maintenance of perpetual and they buy additional licenses. We have so many more licenses to sell to our customers that we can provide more value with that recurring component. And for them, it's one line item as an OpEx line item. So if we see customers wanting to convert, we'll be happy to address it, but we haven't seen it so far, and we're not pushing.

So those customers that are buying more licenses, are they buying on a subscription basis or are they just -- does your perpetual license [indiscernible]?

No. We're not selling -- that's de minimis number, the perpetual licenses. We're selling additional licenses as subscription.

Our next question comes from Mike Cikos with Needham & Company.

I had a -- just trying to get more familiar with the sales cycle. And what I'm trying to do is if I'm thinking about the overall environment, the sense of urgency in the heightened threat environment we're currently in, I'd imagine that, that has some impact maybe in compressing your current sales cycles. But on the other hand, are you seeing sales cycles, in fact, elongate as customers are being more thoughtful in their approach and taking on more licenses upfront? Would just be curious if you could help me think about those two differences when I'm putting that all into one bucket for sales cycles.

Overall, if you look at the overall deals, these sales cycles stay the same. Obviously, on a case-by-case basis, there is a bridge. It can accelerate somewhat the closing process. But what we see mainly is that our sales motion is becoming much more strategic. So with the CISO and the simpler these customers are just buying more licenses and over time buying additional licenses. This is really what we see. We see a better conversion rates on the pipeline. We see that the sales process is much more predictable. We see that we can go to larger accounts, sometimes have access on to the CISO and have a larger deal than -- that are in relation -- the overall relationship with our customer base is becoming more and more strategic.

Our next question is from Hamza Fodderwala with Morgan Stanley.

I wanted to follow up on some of the newer cloud products that you have rolled out earlier this year. I know they're not material to sales today. But just as the materiality of pipeline, are you seeing more interest in the cloud solutions as you look at your pipeline going forward into Q4, into next year? Maybe a question for Yaki on that one.

So we definitely see a lot of interest. Just thinking about how customers fill their data, Salesforce, Google, Box, GitHub, how many customers are using stuff like Okta and FSAs a huge part of the world information is there and contemporary risk, this is where they are going. They don't have a lot of data on endpoint. When you compromise an endpoint in order to get to the central repository, the business application, 365, [indiscernible] data, this is what -- this is exactly what you see. The other thing that these -- all the SaaS applications are interconnected. So really easy to do lateral movement. So once you are in, the ability to strike massive damage in the organization is just -- it's huge. So -- and today, what we are doing in the world, that we are solving data protection program, business applications, we are uniquely positioned to do. We are the only one at this point that can do this. So we believe that what we saw in 365 is just that we can add a lot of value, and this is a big part of our business, can be with DatAdvantage Cloud. But as we said, this year, we won't see material contribution. But definitely, we believe that with that, we can be the company that really protects your data and the foundation for the digital transformation.

Got it. And maybe just a follow-up for Guy. Not to beat a dead horse on the ARR question, but I think one of the ways that people look at ARR just on a quarterly basis is looking at net new ARR additions. And the net new ARR additions grew quite strongly in the first half in Q1 and Q2. In Q3, it was somewhat flattish. I'm just curious, as we think about the seasonality in ARR, how should we think about that metric into Q4 just generally relative to Q3?

When you look at the seasonality for the subscription and you compare the seasonality to what we used to see under the perpetual model, we don't see much change. So the expectation for Q4 was always that it's the largest dollar quarter of the year and so is that expectation under the subscription model. So seasonality, as we see it, stays the same.

Our next question comes from Chad Bennett with Craig-Hallum.

So just in terms of -- with the introduction of your new cloud products and the cloud data store coverage you have with Polyrize and now that, that's been rebranded, do you have any indication whether it's -- I guess, split in 2 different ways, whether it's kind of Microsoft-based cloud products penetration or coverage within your base or it's non-Microsoft cloud applications or data stores? Kind of where your penetration is or, maybe asked differently, kind of what the opportunity is there in your base now that you've rolled out these new data stores and cloud data products?

We believe that the activity is massive. Most of the cloud platforms that we protect with DA Cloud with Polyrize acquisition coexist with 365 and Microsoft and others coexist with this all of them. This is the beauty with the cloud. And just think that this is one of the strengths moving forward. Everything on SaaS and always you get to a lot of these SaaS applications once we reach critical mass, a lot of them becoming standard and we need to protect them. And as I said before, there are much more [indiscernible], collaboration, API connectivity, then security, which is a massive opportunity for us. We see huge opportunity in the base to be the standard for data protection, threat detection and response and privacy and compliance in [indiscernible] critical SaaS applications.

Our next question is from Shebly Seyrafi with FBN Securities.

Can you talk about the strength of your pipeline currently? And now that the month of October is behind us, can you just talk about how it went? Did it beat your expectations?

Well, I think when we look at the pipeline, a good indication to see how we think about it is the guidance that we provided for Q4. Q4 guidance is the highest guidance we provided since 2014, and it's against an outstanding Q4, as I said before, Q4 of 2020. So I think when you look at kind of the indication of where we are going into the end of the year, we're kind of putting guidance out there and we're still guiding in the same responsible way. So I think we feel good about the opportunity that we have. We feel good about our ability to continue to sell to our existing customers and acquire new customers. And we've done that throughout the year, and we intend to do that in Q4 as well.

Our next question is from Shaul Eyal with Cowen and Company.

Congrats on the quarterly results and guide. Guy or Yaki, supply chain constraints, it would appear as if you're seeing none right now also when looking at your gross margins. But any commentary, any color on your end on this topic, which has been on investors' minds greatly?

At this point, it's not relevant for us. We don't have anything to say about it.

Our next question comes from Jonathan Ruykhaver with Baird.

So I'm wondering if you could talk about the threat detection and response use case. I understand it's mostly driven by automation. But just trying to get a sense for how material that is to the overall business? And then just strategically, how you're looking at that area going forward, just because we see a great number of security companies focused on more effective detection, faster remediation. And it's not only about malware, but you see companies moving into user behavior, so activity around file systems. So just kind of curious how you look at that area and what you're doing from a product development standpoint to maybe add more capabilities over time?

Yes, we have very strong capabilities that we are constantly adding. And the way that we are looking -- really looking at the world is from the data outside. So everybody are looking at the endpoint and then the network, and they're trying to -- and all of these efforts are in order to protect data. We are coming from the data itself. We have the most reliable stream of data, which is to analyze, which is access to the data store itself, and from there, building profiles -- user profiles that we can understand very well where you have deviation and really classifying the users, regular users, service accounts, VIP in the organization and [indiscernible] with specification of data and the infrastructure that is the closest to the data itself. And from there, we are able to generate very, very accurate alerts, if there is any problem. And not only that, we can really generate it where you are -- where the attack is sitting -- damaging the organization and you are accessing data in the [indiscernible] data, and this works extremely well. And in this part of threat detection and response, we are almost [indiscernible].

Our next question comes from Andrew Smith with Berenberg Capital Markets.

Just a question on competition from me. As you move into securing more cloud data stores with DatAdvantage Cloud, do you expect to potentially run into competition from CASB products? I understand that organizations are likely not 100% in the cloud. So is having the ability to holistically cover both data on-prem and in the cloud an important advantage for you?

Yes. The hybrid is definitely a big advantage, but the other advantage is just the focus on data. So CASB here and there generates confusion. They are not really competition because when you take just a large data set and want to visualize who can access these is critical and the sense of abnormal behavior and not just be with the mentally [indiscernible] just completely different offer. So once we just install the product and we just show you the risk, remediate the risk, classify the data at scale just visually, it's a very visual sell, the customer immediately understands that it's a completely different offering. So we just -- the amount of competition or confusion that we see so far with DatAdvantage Cloud is the same that we see with our enterprise DatAdvantage offering [indiscernible].

Our next question is from Joshua Tilton with Wolfe Research.

Given last year's COVID impact to the business, are there any guardrails you can provide us to help us think about normal Q4 subscription revenue seasonality aside from the biggest quarter, maybe anything unusual from last year's Q4 to call out?

Well, I think when we built the guidance, we took into consideration slightly higher travel, and I'm talking about the expense side, slightly higher travel, but still below pre-pandemic levels. From a revenue perspective, the guidance kind of speaks for itself and as indication -- indicating how we feel going into the quarter. If you think about 2020, we obviously had -- in Q1, we had the hiccup just because when COVID hit and then Q2 was a better quarter. Q3 was even better than that. And then Q4 was an outstanding quarter. And we're providing kind of a strong guidance against that outstanding numbers. So we feel good about kind of how we're entering the end of the year, and we feel that we can execute on all cylinders.

There are no further questions at this time. I would like to turn the floor back over to James Arestia for any closing comments.

So thank you, everyone, for your interest and for joining tonight. And we look forward to speaking with you this quarter. Please don't hesitate to reach out if we can be helpful. Have a good night.

This concludes today's conference. You may disconnect your lines at this time. Thank you for your participation. Have a wonderful evening.