Varonis Systems Inc

NASDAQ:VRNS

Earnings Call Analysis

Varonis Reports Strong Q3 Growth with SaaS Transition Momentum

Varonis' Q3 2024 results show a significant turnaround, with total revenues growing 21% year-over-year to $148.1 million and Annual Recurring Revenue (ARR) rising 18% to $610 million. The company forecasts Q4 revenues between $162 million and $167 million, representing 5% to 8% growth. Notably, SaaS now accounts for 43% of total ARR, supported by a strong pipeline and 90% renewal rates. The introduction of Managed Data Detection and Response (MDDR) has been well-received, driving sales and shorter cycles. Despite some underperformance in the federal sector, the overall outlook remains positive, with expectations for ARR to reach $635 million to $639 million for 2024.

Transition to SaaS: A Promising Shift

Varonis has made significant strides in its transition to Software as a Service (SaaS), which is beginning to bear fruit. In Q3, Annual Recurring Revenue (ARR) rose 18% year-over-year to $610 million, with SaaS revenues contributing to approximately 43% of total ARR. This momentum reflects a broader trend within the company, driven by an increasing number of new logos and conversions from perpetual maintenance customers. The switch to SaaS is seen as critical for improving customer engagement and satisfaction, as it eliminates the need for on-premises hardware and reduces ongoing management burdens.

Strong Financial Performance

The financials for Q3 showcased impressive performance, with overall revenues growing 21% year-over-year to $148.1 million. This growth was complemented by a notable increase in free cash flow, which jumped to $88.6 million, a significant rise from $46 million in the same period last year. Varonis continues to strategically balance growth with cash flow generation, an approach that strengthens its financial health amidst the ongoing transition.

Guided Growth and Future Projections

Looking ahead, Varonis has raised its full-year ARR guidance to between $635 million and $639 million, representing an expected growth of 17% to 18%. For Q4, the company anticipates total revenues to range from $162 million to $167 million with growth of 5% to 8%. Additionally, non-GAAP operating income for the fourth quarter is projected to be between $20 million and $22 million, with net income per diluted share expected to land between $0.13 and $0.14. This positive outlook indicates confidence in ongoing momentum.

Mixed Results in the Federal Sector

While the overall performance was strong, the federal business underperformed expectations, missing targets by several million dollars. In response, Varonis has made leadership changes in that sector, anticipating that these adjustments, combined with expected FedRAMP authorization next year, will position the federal business for future success. Despite this setback, the enterprise business has been a strong growth driver, reinforcing the company's overall positive trajectory.

Emerging Impact of Generative AI

Generative AI has begun to show promise in Varonis’ customer engagements, although its contributions remain in early stages. The executives emphasized that AI discussions have surged in customer conversations, with early contributions observed in reported metrics. However, Varonis is cautious, choosing not to factor significant AI contributions into their guidance just yet. Over the coming quarters, heightened adoption of Generative AI may provide further tailwinds, and client demand for data security solutions will likely increase as organizations navigate its associated risks.

Investment in MDDR: A Strategic Advantage

The Managed Data Detection and Response (MDDR) service has been a key driver of growth for Varonis, facilitating shorter sales cycles and additional customer engagement. This newer offering is becoming a central part of the SaaS strategy, as clients increasingly recognize its value in automating data protection and threat response. The management highlighted a substantial appetite for MDDR, predicting it will continue to enhance both customer retention and new sales.

Prepared for Future Opportunities

With $1.2 billion in cash and cash equivalents, including $394.1 million from a recent convertible notes issuance, Varonis is well-prepared for future growth opportunities. This robust liquidity gives the company additional flexibility to explore strategic acquisitions that can enhance its service offerings. As the market for data security continues to evolve, Varonis is positioned to leverage its unique capabilities and solidify its competitive edge.

Earnings Call Transcript 2024-Q3

[Operator]

Greetings, and welcome to the Varonis Systems, Inc. Third Quarter 2024 Earnings Conference Call. [Operator Instructions]. As a reminder, this conference is being recorded.

It is now my pleasure to introduce your host, Tim Perz, Investor Relations. Thank you. You may begin.

[Tim Perz, executive]

Thank you, operator. Good afternoon. Thank you for joining us today to review Varonis' third quarter financial results. With me on the call today are Yaki Faitelson, Chief Executive Officer; and Guy Melamed, Chief Financial Officer and Chief Operating Officer of Varonis. After preliminary remarks, we will open the call to a question-and-answer session.

During this call, we may make statements related to our business that would be considered forward-looking statements under federal securities laws, including projections of future operating results for our fourth quarter and full year ending December 31, 2024. Due to a number of factors, actual results may differ materially from those set forth in such statements. These factors are set forth in the earnings press release that we issued today under the section captioned Forward-Looking statements and these and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings. These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release publicly any updates or revisions to any forward-looking statements made herein.

Additionally, non-GAAP financial measures will be discussed in this conference call. A reconciliation for the most directly comparable GAAP financial measures is also available in our third quarter 2024 earnings press release and our investor presentation, which can be found at www.varonis.com in the Investor Relations section. Lastly, please note that our webcast of today's call is available on our website in the Investor Relations section.

With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Faitelson. Yaki?

[Yakov Faitelson, executive]

Thanks, Tim, and good afternoon, everyone. Thank you for joining us today to review our third quarter results. Today, I would like to discuss our SaaS transition progress and the key drivers of our business. First, as I often do on these calls, I would like to remind you why Varonis exists and the problem we solve. Next to its people, data is the most valuable assets of any business. So it is the primary target for bad actors and cyber attacks.

Most organizations focus on securing endpoints and perimeters but leave many gaps for cyber attacks on their data. With the expansion of the cloud and the emergence of generative AI, productivity and collaboration have improved, but the risk of overexposing sensitive data has greatly increased. Since the inception of our company, we have taken a data-first approach to security, which allows our customers to locate their sensitive data, visualize who has access to it, lock it down and detect and respond to threats on it.

Now with the automation of our SaaS platform, our customers can spend less time and effort protecting their data our managed data detection and response offering, which we call MDDR save them even more time and make them much more protected. Simply put, Varonis allows organization to use the and collaborate in a much safer way.

Turning to our third quarter results. ARR grew 18% to $610 million in SaaS. ARR now represents approximately 43% of total or approximately $260 million, which reflects the growing momentum of our SaaS platform and our MDDR offering as well as a small contribution from Gen AI. Year-to-date, we generated $88.6 million of free cash flow versus $46 million last year while our federal business underperformed our expectations, our strong performance this quarter was led by our enterprise business with healthy contribution from new logos growth in conversion activity from both on-prem subscription and perpetual maintenance customers. Guy will review our results and our updated guidance in more detail shortly.

Our SaaS transition continue to gain momentum because of the many benefits our customers realize, as a reminder, they are customers achieve automated outcomes, which means to ensure data is protected with very little effort. SaaS is quicker to deploy and operationalize with significantly lower infrastructure and personnel investments and SaaS is easier to maintain and upgrade. Additionally, the 3 key benefits we continue to realize are shorter sales cycles, larger initial lands and margin benefits over time. This quarter, we continue to see more proof of these benefits in our SaaS transitions and MDDR offering as well as very early contribution from Generative AI solutions.

At the beginning of the year, we introduced MDDL, the first managed service for monitoring and protecting critical data built on top of our SaaS platforms and therefore, only available to our SaaS customers. It protects data in a more automated way. This offering is so important for an organization because the threat environment grows more dangerous by the day. And when a breach happens every second counts. Security teams are stretched in and struggle to see and respond to threats as quickly as they must with today's threat actors. With MDDR, we address the problem for leveraging our unique telemetry, user behavior analysis and use of experience building highly accurate threat models to detect and stop potential data breaches.

While we have been selling MDDR for only 2 full quarters, customers are seeing immediate and impactful benefits and MDDR is becoming a key driver of new business wins in SaaS conversions. As we previously said, we believe that MDDR is a game changer and that we are just scratching the surface of this opportunity. Another tailwind that we have discussed is the impact of Generative AI and large language models. These topics remain top of mind and a key theme in our discussion with prospects and customers.

The productivity benefits of Gen AI are well understood and companies are rapidly starting to understand the related risks. As a reminder, the usage of AI makes it easier to create and access data which benefits employees but makes the job of an insider threat or outside attacker much easier. Generative AI tools utilize native access controls to determine which data is available to the identity and that is using the pump. These controls must be optimized or Generative AI tools will create immense risk for organizations, increasing the risk of cyber attacks. Varonis health organizations mitigate these risks, but ensuring that only the right people have access to the information that they need to do their job and monitoring what they do access either directly or through AI.

Once the bad actor bypasses perimeter control, Varonis can automatically lock out the compromised user or machine preventing damage from happening. In the third quarter, Generative AI is a small positive impact to our reported metrics. It is very early. So we are taking a major approach with regard to our expectations around Gen AI contribution to our results, but the behavior we are seeing from customers to give us additional confidence that we should see momentum grow is its adoption increases.

With that, I would like to briefly discuss a couple of key customer wins in Q3. A large medical company became a Varonis customer this quarter. This organization is subject to many state privacy and data regulation and wanted to better protect its data after it [indiscernible] multiple ransom attacks. They are focused on visualizing the risk automatically locking their data down and being able to monitor it as they continue to grow through M&A. They also wanted to ensure their data was protected when deploying Microsoft copilot prior to bringing in Varonis, the team and successfully tried to lock down their data using the DLP solution.

Our risk assessment revealed over 40% of the sensitive data was open to every employee, including 60,000 payers shared with anyone on the Internet. Ultimately, they purchased the Varonis SaaS hybrid package with MDDR, [ the voice for ] Copilot, GitHub, Salesforce and databases. This will allow this customer to safely adapt Microsoft Coautomatically reduce over exposures at scale and meet its regulatory requirement. We also saw continued strong demand with existing customers looking to convert the Varonis SaaS with MDDR protection.

One example of this was a large insurance company that has been a perpetual license customer since 2015 using Varonis to audit user access activity for its on-plan Windows environment. This organization was looking to change their data classification vendor while locking down their overexposed data in the unmonitored Microsoft 365 environment. Our risk assessment in Microsoft 365 identified trials with social security numbers that we're open to all employees. It also uncovered 10 terabytes of unlabeled files in one drive after paying to protect their data with their existing DLP and SIM vendors they ultimately purchase the Varonis SaaS hybrid package with MDDR and Varonis for databases in addition to automatically locking down their data at scale, Varonis MDDR will proactively monitor their hybrid environment.

In summary, the sustained momentum that we saw from our SaaS platforms and MDDR this quarter leaves us excited as we head into the fourth quarter. we are confident in our ability to capitalize on the tailwind of MDDR or Gen AI and increasing data-centric compliance regulation to capture our significant market opportunity.

With that, let me turn the call over to Guy. Guy?

[Guy Melamed, executive]

Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. When looking at the quarter, this was our strongest performance across the business since embarking on the SaaS transition. These results reflect the strong adoption trends of Varonis SaaS and MDDR coupled with a small contribution from Gen AI. Our performance this quarter gives us increased confidence as we look to close out the year, and our SaaS transition continues to gain momentum with SaaS now representing 43% of our total company ARR.

We saw a strong contribution from both new logos and existing customer conversions, including conversions from perpetual maintenance customers and many of the secular tailwinds we have noted this year are continuing to have a positive impact on our business.

Our enterprise business was the driver of our strong performance this quarter with strong new business activity healthy conversions and very early contributions from Gen AI to our reported metrics. Our federal business, however, underperformed our expectations by several million dollars. We have decided to make changes to the management team of our federal business and believe those changes, coupled with our expectations to FedRAMP authorization next year will better position us to capture that market opportunity going forward.

Looking at the quarter in more detail. The key drivers were, again, SaaS and MDDR. Our SaaS platform and MDDR offering together eliminates the 2 biggest pushbacks of one, not wanting hardware; and two, not having the head count to manage the platform or respond to alert. The automation of our SaaS offering, together with the simplicity of the story, continued to drive positive momentum and shorter sale cycle when compared to the on-prem subscription deal.

As we have said for a few quarters, Gen AI continues to come up in nearly every customer conversation, but this was the first quarter where it began to contribute to our results. We believe Gen AI is still very early in the adoption curve, which keeps us measured in our expectations around the timing and sizing of its contribution to our results. This quarter gave us additional confidence that we should benefit from this tailwind as its adoption increases over time. The strong Q3 performance, coupled with our healthy pipeline allows us to raise our full year ARR guidance. Because it is still very early in its adoption, we're not assuming material Gen AI contribution in our updated guidance.

As we look ahead to the fourth quarter, we anticipate converting more customers to our SaaS platform. Pricing continues to be in line with our price list increase of 25% to 30% and in some cases, we see deal sizes increase in access of that as customers consume more of the platform upon conversion to SaaS. We expect that the ramp-up of this phase will not be linear and momentum should grow each quarter with SaaS conversion showing further acceleration in dollar terms in 2025 and 2026.

In the third quarter, ARR grew 18% year-over-year to $610 million, and year-to-date, we generated $88.6 million of free cash flow which was up from $46 million generated over the same period last year. These metrics demonstrate our commitment to balancing top line growth with improving cash flow generation during the transition.

Turning now to our third quarter results in more detail. As a reminder, the leading indicators of our transition are the 3 [ North starts ] ARR, free cash flow and ARR contribution margin. As we have said many times, the faster we progress through the transition, the more headwinds we will experience to our traditional income statement metrics, but we view these in a positive light. The macro environment remains stable, while SaaS and NPDR are resonating well, and we feel increasingly confident in the trajectory of the business following our third quarter results.

Q3 total revenues were $148.1 million, up 21% year-over-year, reflecting our strong performance as well as a higher contribution from perpetual maintenance converting to SaaS. During the quarter, as compared to the same quarter last year, we had approximately a 5% headwind to our year-over-year revenue growth rate as a result of having increased SaaS sales in our booking mix. which are recognized ratably versus the upfront recognition of our on-prem subscription products. In the third quarter, SaaS revenues were $57.8 million, Term license subscription revenues were $68.8 million, and maintenance and services revenues were $21.5 million as our renewal rates were again over 90%. We Maintenance and services revenues declined by 13% year-over-year, with the majority of the decline driven by perpetual maintenance customers converting to our SaaS platform.

Moving down the income statement, I'll be discussing non-GAAP results going forward. Gross profit for the third quarter was $125.8 million, representing a gross margin of 85% and compared to 87.3% in the third quarter of 2023. Gross margin continues to be strong and the year-over-year change is due to the revenue headwind associated with a higher mix of SaaS sales increased head count to support the transition and increased hosting costs.

Operating expenses in the third quarter totaled $116.7 million. This includes approximately $6.7 million of acquired in-process research and development expenses within the R&D expense line due to a small asset purchase made during the quarter. As a result, third quarter operating income was $9.1 million or an operating margin of 6.1%. This compares to operating income of $4.9 million or an operating margin of 4% in the same period last year.

During the third quarter, as compared to the same quarter last year, we had approximately a 4% headwind to our operating margin as a result of having increased SaaS sales in our booking mix which are recognized ratably versus the upfront recognition of our on-prem subscription products. This quarter, ARR contribution margin was 15%, up from 11.1% last year. The significant leverage improvement even during the transition reflects our ability to drive strong incremental margins while growing ARR and transitioning to SaaS.

During the quarter, we had financial income of approximately $9.7 million, driven primarily by interest income on our cash, deposits and investments in marketable securities. Net income for the third quarter of 2024 was $13.8 million or $0.10 per diluted share compared to net income of $10.4 million or $0.08 per diluted share for the third quarter of 2023. This is based on $134.7 million and $126.7 million diluted shares outstanding for Q3 2024 and Q3 2023, respectively.

As of September 30, 2024, we had $1.2 billion in cash, cash equivalents, short-term deposits and marketable securities, $332.3 million of which is included within long-term marketable securities. Our liquidity position also reflects $394.1 million of net proceeds from the successful issuance of convertible notes in early September, which strengthens our already healthy balance sheet. For the 9 months ended September 30, 2024, we generated $90.9 million of cash from operations compared to $49 million generated in the same period last year and CapEx was $2.3 million compared to $2.9 million last year.

Turning now to our updated guidance in more detail. For the fourth quarter of 2024, we expect total revenues of $162 million to $167 million, representing growth of 5% to 8%. Non-GAAP operating income of $20 million to $22 million and non-GAAP net income per diluted share in the range of $0.13 to $0.14. This assumes 135 million diluted shares outstanding, which includes 6.8 million shares related to the issuance of convertible notes maturing in 2029. For the full year 2024, we now expect ARR of $635 million to $639 million, representing growth of 17% to 18%.

Free cash flow of $95 million to $100 million, total revenues of $554.4 million to $559.4 million, representing growth of 11% to 12%; non-GAAP operating income of $20.6 million to $22.6 million non-GAAP net income per diluted share in the range of $0.26 to $0.27. This assumes 134.9 million diluted shares outstanding.

In summary, when looking at the quarter, this was our strongest performance across the business since embarking on the SaaS transition. This strength was driven by Varonis SaaS, the strong reception to MDDR and the secular tailwind benefiting our business. The growing demand for Roni is strengthening our ARR performance and cash flow generation. And these tailwinds position us to unlock meaningful value for our customers, our company and our shareholders.

With that, we will be happy to take questions. Operator?[Operator Instructions]. The first question is from Matt Hedberg from RBC.

[Matthew Hedberg, analyst]

Yaki, there's a lot to unpack. It's hard to think about one question here, but I guess if I were to focus on one. I couldn't help but hear you talk about Gen AI, although early positively impacting results. I guess I just wanted to put a finer point on what aspects of the portfolio are contributing to customer Gen AI spending. And if we look forward another couple of years, I mean how do you think the products that attribute to Gen AI spending could expand over time?

[Yakov Faitelson, executive]

Matt, so it's primarily now related to copilot and you see there are on the 365. But eventually, obviously, you have unstanding sales growth and you have 4 [indiscernible] I think that it's going to be part of every work of life. The reality is that at the beginning, we saw just the smaller POCs in the hands of IT that immediately exposes the problem, the data security problem, you have this massive blasters. But what we're starting to see now is that it's more knowledgeable are using it. And once they are using it, is just solving the problem becomes almost inevitable. So we just see that people get to a lot of critical data they don't need to get, generating a lot of clinical data, they shouldn't generate outside of policy starting to just using the wrong intent, and it's just extremely dangerous in terms of losing the critical data.

So at the beginning, it was on the POC stage, but now when knowledge workers are demanding it, and they are trying to buy it and you're just starting to hit critical mass within organizations that are using the product they generate a lot of urgency to buy protection for Gen AI and Copilot mainly and just moving extremely well for us. We just -- unbelievable solution to solve [indiscernible].

[Operator]

The next question is from Hamza Fodderwala from Morgan Stanley.

[Hamza Fodderwala, analyst]

Yaki, you and Guy teased this a bit with a lot of the Jenai contribution commentary, but didn't quite size the opportunity at least today. I know it's early innings, but we're seeing some of the problems in terms of over permissioning and data leakage with Copilot. You've had some customer case studies already where customers are using Varonis for there's Gen AI readiness program with some of your partners like ePlus. So there seems to be some momentum there. I'm just curious if you're not willing to sort of give ARR revenue contribution today, what percentage of your pipeline would you say is Gen AI related customers coming to you and trying to prepare themselves for this for Gen AI going forward?

[Guy Melamed, executive]

Hamza, we've been talking about copilot for about a year now. This time is slightly different. I think you kind of noted that, and here's why. This quarter, we finally started to see some deals close. But as you said and as we've talked a lot about it, it's still early on, which is why we're not baking in any material amounts closing into our Q4 guidance. But the fact that we started to see deals close this quarter gives us increased confidence that we should benefit as Gen AI adoption increases. And as Yaki mentioned, it's not just around the Microsoft CoPilot, it also includes the internally built LLMs, Salesforce, Einstein and others.

When we look at the pipeline, it comes up really in every conversation with our customers. A lot of our customers are talking to us about it. But again, this quarter, we started to see some deals close, but it's still a very small amount and immaterial amount for the quarter.

[Yakov Faitelson, executive]

But it's front and center in every conversation. We believe that over time, it will be inevitable that it will be in the hands of any knowledge worker, so just the productivity game are tremendous. And once enough people are using it within the organization, just exposing many times the data security problem, the fact that data is overexposed. The fact that you can use these robots in malicious intent, and it's very, very dangerous. But we just -- we believe that it's the big part of the future of IT, and we are well positioned to be -- to protect organizations and make sure that they can use it and secure it.

[Operator]

The next question is from Saket Kalia from Barclays.

[Saket Kalia, analyst]

To Matt's earlier point, a lot to unpack, particularly in Gen AI, but maybe I could switch gears a little bit. Guy, I've gotten the question from investors just around how much of the net new ARR generally through this process has come from conversion. And of course, that isn't something that we disclose but I think that what a lot of people are trying to figure out is, how does demand look excluding that conversion activity. So is there a way that you can talk to us about that qualitatively. Just as we think about sort of base net new ARR next year plus any conversions plus a lot of the other good things that you talked about with Gen AI.

[Guy Melamed, executive]

Saket, I think one of the biggest misconceptions and we've talked a lot about the string a lot of the conversations that we've had with investors is this conception that the conversion, you just plug it in the Excel and it happens very quickly and very easily. When you look at what drove the momentum and the strength this quarter, it definitely came from the SaaS platform and the MDDR. We continue to see shorter sales cycles on SaaS and very strong new logo activity, which was really driven by the MDDR offering. And that's really because the SaaS value proposition eliminates the 2 biggest pushbacks of customers. And we've talked a lot about it, one being not willing to buy hardware and the second that they don't have enough people to support the solution.

The conversions -- without the conversions, we wouldn't have gotten to 43% of total ARR being SaaS or approximately $260 million, but the conversions take time and conversions are -- you have to talk about the legal elements of it with a customer, and it takes time to flip them. It's not a plug and play. But at the end of the day, it provides more value to our customers. That's why we do it. That's why our customers are buying SaaS and converting to SaaS. But at the end of the day, what drove the momentum this quarter and also last quarter, when you look at kind of the commentary that we gave last time, is the new logos, the MDDR offering, and that's really what's driving the business.

[Operator]

The next question is from Brian Essex of JPMorgan.

[Brian Essex, analyst]

Maybe Yaki, I think last quarter, we caught up in terms of talking about the transition, I thought you had a great analogy where I don't know if it was either you or guy talked about Stage 1 of the transition with the [indiscernible] phase and then Phase 2 is the stick. And then you said that there phase is going so well. You don't feel like you need to use the stick. Is that still the case? I mean, how much visibility do you have in that transition pipeline? And how smoothly is it going for those existing customers that that you're converting over now, how much runway do you have left with those easier converts, if I can maybe put it that way.

[Yakov Faitelson, executive]

In terms of the overall value proposition and our ability to get to outcomes, the SaaS is second to none. The reality is that bad actors, many times were not breaching in their login. And once you have an identity, there is no perimeter anymore, and we are your best bet. So data-centric -- data security platform is the first thing you need to do and the last thing that really will save you. So anytime our customers or this testing the value, this automated -- the automated outcomes that we provide, it's just -- it's a game changer. You have stuff [indiscernible] with all the remediation robots the MDDR.

We just released the MDDR and what we just catch on a weekly basis, it's mind blowing even to us and our ability to automate everything. And also with the way that we are covering more data and user depositor is just the whole value proposition. So once customers take it and understand just the regular value of high-quality SaaS architecture, but primarily these automated outcomes that can get to most of the value is literally doing nothing automatically, it generates a lot of appetite to do the conversion.

[Guy Melamed, executive]

One thing to add, and I think it's a very good question in terms of kind of the value proposition and kind of the commentary that we gave about the fact that many of our customers are asking for SaaS and wanting to switch to SaaS because it's a much better product. But if we take a step back for a second and when you look at kind of when we announced the transition, we're just under 2 years into the transition, and we expect to be at approximately 50% of the business coming from SaaS. That's a huge milestone for us.

So when you look at kind of the progress that we have had through this transition, it's been extremely healthy. We're very happy with the progress that we are. And you noted correctly, we're doing that with significant generation of cash flow. So when you look at the free cash flow, upping our guidance and getting to levels that are very healthy. We're very happy with that. We think we can continue on that path and do better, but we're very happy with the progress we've had so far.

[Operator]

The next question is from Joel Fishbein from Truist Securities.

[Joel Fishbein, analyst]

Yaki, you mentioned on the call that the federal business underperformed. Just curious there, whether or not that was sort of self-inflicted execution or if there's something going on there. It's been a good area of business. I know you're still on track for FedRAMP. I'd love to get a little bit more color there. I really appreciate it.

[Guy Melamed, executive]

So that's a great question. I'll take that. The federal business did underperform by several million dollars. But let's keep things in perspective. That vertical accounts for mid-single-digit percentages out of total ARR. So when we look across the remaining 95% of the business, this was the best quarter we've had since the start of the transition and that momentum was driven by continued strength in the enterprise segment.

If federal did what it was supposed to do, this would have been a picture-perfect quarter for us. So after several years of underperformance from the federal business, we decided to bring in a new management team. And we believe that these changes, coupled with the expectation for FedRAMP authorization next year will better position us to capture that market opportunity going forward.

[Operator]

The next question is from Fatima Boolani of Citi.

[Fatima Boolani, analyst]

Guy, I wanted to double back on an earlier question with respect to some of the conversion momentum that you're seeing in the base understand that it's not like flipping a switch, but I'm just curious to understand how much of your installed base has actually converted, and as a related matter, is your guidance for SaaS ARR mix for the full year at 48 still intact?

[Guy Melamed, executive]

So again, when we look at kind of where we are from SaaS out of total ARR, getting to 43% were definitely -- you can't get to that percentage without having existing customers converting our Q3 conversion was very similar in dollar terms to the Q2 conversion amount. So again, as the same commentary that we gave in Q2, the strength of the quarter came from new business, the MDDR and the fact that we're seeing shorter sales cycles on the SaaS offering. And when we look at kind of where we want to end, we talked about 48% kind of finishing the year. We're looking now to be in that 49% SaaS mix at the end of the year. And we think that even that metric gives us a lot of confidence to deliver in the same manner we've delivered on other metrics to [indiscernible].

[Operator]

The next question is from Roger Boyd from UBS.

[Roger Boyd, analyst]

I know there's a variety of ways you're monetizing MDDR, but are we getting to a point where you might be able to quantify the size of that business? Or alternatively, any color you can give on the typical uplift you see to ACV when you do bring that into customer engagements?

[Guy Melamed, executive]

Roger, one of the things that we've talked a lot about is our desire to be able to extract more dollars from our customers through the MDDR offering. It's part of a bundle, basically, and there are multiple ways to buy the MDDR. If you want to buy it separately without additional licenses that we have as part of the bundle, you will pay a higher price. But what we wanted to see and what is actually happening is that many of our customers are actually buying more of the platform and getting MDDR at a reduced price trust, it doesn't really matter. We want to provide the value, and we think that if they consume more of the platform, they get a much better value for money. And at the end of the day, it allows us to increase our ASPs. So at the end of the day, everyone wins here.

When we look at kind of the adoption of NDDR, we only had 2 full quarters. Don't forget, we introduced it at the beginning of the year. So January was the first time it was introduced to our sales force, is very well adopted by our customers, very well adopted by the sales force because it's a no-brainer. It helps on the sales cycles, it helps on the conversation, the value that is provided to customers is great. We haven't quantified it because we're providing a lot of color in terms of the numbers. And I think that MDDR at the end of the day needs to be with every single customer we have. We've talked a lot about that. It doesn't happen overnight, but at the end of the day, it's something that can help all of our customers.

[Operator]

The next question is from Andrew Nowinski from Wells Fargo.

[Andrew Nowinski, analyst]

I just want to get a better understanding of how you're defining a material impact from Jenny. I mean are you guys measuring it based on the number of new logo adds you get when they tell you they're buying Varonis for an LLM support? Or can existing customers that roll out in LLM also have an impact on your ARR. I guess I'm just trying to understand how you define a material impact and what that might look like.

[Yakov Faitelson, executive]

Well, thanks for the question. We are analyzing every POC, really looking at the pipeline and understanding very well. Historically, while customers and prospects are buying the product and many times, we just -- we see in what we call a risk assessment that when they're using Copilot is just exposing the problem in a big way, and we also see that our customers just many times experiencing the purchasing process in lockstep with the intent to release the copilot product to more and more knowledge workers. This is really how we see it.

And before it was very contending IT departments, but as time goes back just see that once they release it to a broader population, they need to understand that they must make sure that only the right people can access the right data. They need to be able to audit activity. They need to make sure that they intend. The queries themselves queries that make sense because if not these tremendous tools will pick a lot, a lot of damage.

[Guy Melamed, executive]

One thing to add. When we look at kind of the Copilot, and we talked a lot about it, we have it as a separate SKU. We have it as part of the MDDR, and we've talked a lot about the fact that when customers have the Office 365, they have a lot of protection that can help them with the Copilot. The Copilot has additional functionality, but the true value in dollar terms is selling copilot to new customers. And when we quantify materiality, we quantify it in dollar terms. So when we looked at kind of the copilot SKUs in -- sold in Q3, as a stand-alone, it didn't have a material impact. But as I said before, there is difference, and that was part of our prepared remarks. We did see deals closed that were related to copilot in a way that gives us increased confidence that it will become a tailwind in the near and medium-term future.

[Operator]

The next question is from Joseph Gallo with Jefferies.

[Joseph Gallo, analyst]

I appreciate the federal commentary earlier, but anything else to note on the overall business environment. And then just any expectations for 4Q budget for us? Just trying to understand your 4Q guide where net new ARR is relatively similar to your 3Q. So just trying to understand if there's anything else we should be aware of.

[Guy Melamed, executive]

So when we look at the philosophy of guidance, that really hasn't changed, and that's why we didn't bake in any additional Gen AI contribution. We've always been under kind of the assumption and our philosophy has always been that we don't bake in any positivity until we see it translate into data, and that's why we're kind of staying with the same philosophy for Q4.

In terms of budget flush, it's not something that we've seen in the past. There is the regular seasonality within the business where Q4 is the largest quarter of the year, and we expect that to be the same this year. But we haven't seen any changes in terms of budget flush when we move to SaaS. If we see anything, we'll obviously provide commentary post quarter.

[Operator]

The next question is from Jason Ader with William Blair.

[Jason Ader, analyst]

I just wanted to see if you had any early thoughts on 2025. I know you're not providing any specific guidance, but just maybe can you help us think through the impact of the SaaS transition on 2025 relative to elements like revenue growth, operating margin and operating margin was down this year from last year, primarily, I would assume, from the SaaS transition will it stabilize, you think, in 2025? Could it go down more?

And then on the revenue growth side, same thing. I mean, it actually probably outperformed probably what most people expected this year. But we're -- what are some guideposts for 2025? And how should we be thinking about that?

[Guy Melamed, executive]

So Jason, I'll start by kind of reemphasizing the 3 North Stars, which are ARR contribution margin and free cash flow. I think looking at regular standard financial statement metrics that relate to revenue and operating margin through a transition are very misleading because of the ratable recognition of revenue through SaaS versus the upfront recognition of the on-prem subscription -- so I would highly, highly, highly recommend not looking at revenue and the regular operating margin because it really is not reflective of anything within the business. So when I look at the ARR contribution margin, it was actually moving very nicely throughout this year. We're showing nice leverage compared to 2023. And when we look at kind of our commitment, we've talked about our desire to continue to grow, but also from an ARR contribution margin show improvement and generate more cash. And I think when you look at the free cash flow, generation, it's been progressing really nicely. We believe that, obviously, that's one of the essence of having a company want to generate healthy free cash flow.

In terms of the 2025 color, we'll provide more color as we finish Q4. Obviously, Q4 is the largest quarter of the year. We're very focused, and we feel good getting into the quarter, and we'll provide additional color on 2025 as we see kind of the trends in Q4. But overall, we're entering Q4 with a strong pipeline and believe that we can do well.

[Operator]

The next question is from Rob Owens with Piper Sandler.

[Robbie Owens, analyst]

And just a quick one for me. I think you called out in your prepared remarks a small asset purchase that you made during the quarter. Could you elaborate on that?

[Yakov Faitelson, executive]

Yes. We bought just a small team of programmers that can help us accelerate our road map. We have just a lot -- we have many exciting new products and features in the road map, and this was just a shortening time to market. It's just a very small acquisition that help us accelerating [indiscernible].

[Guy Melamed, executive]

And just to give some color from the financial statement side. As Yaki said, we purchased [indiscernible]. So this is a small technological tuck-in. And as Jake mentioned, helps shorten our time to market. From a cash flow perspective, the asset purchase at MAX totaled $6.7 million. And on the income statement, the full amount is expensed immediately. So you will see that amount of acquired in process research expense within the non-GAAP R&D expense line item. We don't expect any ARR or material expense because of the very small size of the asset purchase.

[Operator]

The next question is from Joshua Tilton from Wolfe Research.

[Joshua Tilton, analyst]

One for me, I guess, it's clearly a positive that you guys are calling out a contribution from Gen AI. And I guess we can interpret that as co-pilot adoption is possibly going a little bit more mainstream in the enterprise than it was maybe 12 months ago. And I guess my question is, it feels like prior to this AI hype cycle and thus want or need to adopt some type of co-pilot strategy, you guys kind of lived on this very secluded island when it came to competition. I think part of the reason why we all loved the story is because there was really no competition for your core offering, especially when it was on-prem.

And I guess my question is, as you see Copilot adoption become more mainstream, more customers want to deploy this technology, look for ways to secure their data. It just feels like the competitive landscape is getting increasingly more noisy. And I'm curious how you think about the fact that there are so many companies coming after the data security market, the data security opportunity as you head into 2025 and maybe how that changes the competitive positioning that you once had as an on-premise business.

[Yakov Faitelson, executive]

At this point, we see no change to the competitive landscape. We sell our products through POC. We analyze each and every one, and we know where we have competition. But what we do see is that there is just a lot of noise, a lot of awareness around data. Most data are -- most breaches are of data breaches and this whole notion that organizations spend and how many legs on security and constantly have breaches that are more sophisticated and attacking data, is just losing proposition.

So I think that what you see is that data security becoming front and center and organizations understand that they need data security. It's a very complex problem to solve. And you have massive volumes of data with a lot of data stores and you need to play and you need to marry them with a lot of additional streams in order to really solve the problems to make sure that only the right people can access the data to understand if you have a normal behavior and to find critical assets. And this is something that we are expecting in doing extremely well. But this [indiscernible] nothing whatsoever to the competitive landscapre.

[Operator]

Next question is from Rudy Kessinger from D.A. Davidson.

[Rudy Kessinger, analyst]

[indiscernible] I get a lot of questions from investors just on the conversions and contribution towards growth. Guy, you said in response to a question earlier, you converted about the same amount in Q3 as you did in Q2. If I look at the numbers here, the step down in your term and perpetual ARR was about $5 million higher Q2 to Q3 than Q1 to Q2. So it looks like from those numbers, you converted a good chunk more. So I'm curious how gross retention has been trending and how it was in Q3 versus Q2 and prior quarters just as you've started to lean into the conversion notion more of your existing customers.

[Guy Melamed, executive]

When we look at our renewal rates, they're consistently over 90%. So we're happy with what we're seeing there. I can tell you that when you look at kind of the conversions, we have seen more conversions happen from our customers that own maintenance of perpetual. And that's part of the reason you're seeing that revenue increase because in a way, there's no headwind when you convert the maintenance of perpetual to SaaS. When you look at the maintenance and services line item, and when you look at the decline there, the majority of that decline in that line item is actually coming from conversion.

So when you look at our conversions, I think we're happy with customers converting. But again, I can't emphasize this enough. When you look at what drove the momentum in this quarter, it was new customers, it was the MDDR. We're very happy with what -- the way our new customers are adopting and the way our sales force is selling to new customers, and we saw growth in the new customers and very healthy dollar increase with our customers.

[Operator]

The next question is from Shrenik Kothari from Robert W. Baird.

[Shrenik Kothari, analyst]

So Guy, you mentioned about the upsized convertible notes offering and the strategic flexibility it provides. And with M&A being one potential avenue, right? And Yaki, please feel free to chime in. Any specific areas in your product portfolio or market segments that you might be eyeing that aligned with your core data security focus, basically, refocusing on certain technologies that complement our existing offerings expand overall reach or kind of provide new capabilities, either in context of competitive dynamics or not, if you can just kind of provide some sense there.

[Yakov Faitelson, executive]

I think that we just built a very unique asset with this data security platform that can take order activities, a lot of telemetry in business software production that provide the automated outcomes. And with that just opens up a lot of the logical extension. There is just a lot of meat on the bone to do very, very interesting things that provide a lot of value. We have great engineering organization and a lot of capacity there. But we also shoot business people, and we look at opportunities and we see something that makes sense to a good team that can help us accelerate our road map we will consider.

[Guy Melamed, executive]

To add some more on in terms of the convert and kind of how we look at it. Obviously, our 2020 convert was coming due in August 2025. So we obviously didn't want to wait for the last minute and decided to opportunistically raise in a really favorable convertible market. But as Yaki mentioned, the convert really allows us to be more offensive as we've talked about the fact that our opportunity has never been bigger than it is today. But we did not think that doing a deal is a necessity to achieving our $1 billion ARR target. Rather, this sets us up to grow at healthy levels way beyond the $1 billion of ARR with additional capital allocation flexibility.

But I think that what's very important to note is that this allows us to look at slightly larger M&A, but nothing crazy or changing the risk profile of the business. So I just want to emphasize that.

[Operator]

There are no further questions at this time. I would like to turn the floor back over to Tim Perz for closing comments.

[Tim Perz, executive]

Thanks for joining us today. We appreciate the interest in Varonis, and look forward to speaking with everybody at the conferences this quarter.

[Operator]

Goodbye. This concludes today's teleconference. You may disconnect your lines at this time. Thank you for your participation.