0001628280-26-005450
SEC filingVaronis' MD&A highlights SaaS transition as primary growth driver, with SaaS revenue surging 122% YoY to $462.6M, though total revenues grew only 13% due to accounting headwinds.
Varonis Systems, Inc. is a data security company focused on protecting enterprise data across cloud, SaaS, and on-premises environments. The company was incorporated in Delaware in 2004 and began operations in 2005, with principal offices in Miami, Florida. Varonis describes its mission as closing the gap between the ability to create and share data and the ability to secure it, emphasizing automation to reduce the 'blast radius' of data exposure.
Varonis operates as a single reporting segment centered on its Varonis Data Security Platform. The platform is delivered primarily as a SaaS offering, with legacy self-hosted products scheduled for end-of-life by December 31, 2026. No revenue share by segment is disclosed; the entire business is integrated under one platform.
The flagship offering is the Varonis Data Security Platform, a SaaS solution that includes capabilities for data security posture management, data access intelligence, discovery and classification, least privilege automation, data activity monitoring, detection and response, and user/entity behavior analytics. Customers select Protection Packages covering Microsoft 365, Windows & NAS, Hybrid, and Cloud Environments (including Salesforce, AWS, Azure, Google Cloud, Databricks, ServiceNow, Snowflake, and others). Additional specialized products include Varonis Database Activity Monitoring (DAM) and Varonis Interceptor for email security. The platform also supports a Managed Data Detection and Response (MDDR) service available exclusively through SaaS.
Varonis sells through a global network of channel partners (resellers and distributors) supported by a direct sales organization that engages customers with risk assessments and platform demonstrations. The customer base spans over 95 countries across industries such as financial services, public, healthcare, industrial, insurance, energy, technology, and education. The company reported a renewal rate of over 90% for 2025. No single customer accounts for a material portion of revenue, and no key customer concentration is disclosed.
Varonis operates in a competitive and evolving market. Competitors include vendors offering standalone or partially integrated solutions in data security posture management, discovery and classification, privacy, identity security, and threat detection. Broader security platforms and native features from large cloud providers also compete. Varonis differentiates through its unified platform, automation, and ability to reduce data exposure proactively. The filing notes that some competitors have greater resources, longer histories, or stronger brand recognition.
Varonis's growth strategy has five pillars: (1) extending the platform through organic innovation and strategic acquisitions (e.g., Cyral for database monitoring, SlashNext for email security); (2) growing adoption within existing customers by expanding coverage to additional data stores and use cases; (3) acquiring new customers, particularly larger enterprises, through platform-led expansion; (4) scaling SaaS, automation, and managed services to drive recurring revenue and operational leverage; and (5) expanding internationally as data protection requirements become global.
As of December 31, 2025, Varonis employed 2,658 employees and independent contractors, with 1,139 in the United States, 916 in Israel, and 603 in other countries. The company emphasizes competitive compensation, employee well-being, diversity and inclusion, recognition programs, growth opportunities, and community outreach. Key HR programs include flexible remote work, paid time off, employee resource groups, mentoring, and training bootcamps.
For the year ended December 31, 2025, Varonis reported total revenues of $623.5 million, a 13.2% increase from $551.0 million in 2024. The growth was driven entirely by SaaS revenues, which surged 121.6% to $462.6 million, offsetting sharp declines in term license subscriptions (-56.9%) and maintenance & services (-41.7%). Despite the top-line growth, gross margin contracted from 83.0% to 78.8%, primarily due to a 40.6% increase in cost of revenues, driven by $19.7 million in higher third-party hosting costs and $15.0 million in increased headcount for customer success to support the SaaS transition. Operating loss widened to $146.5 million from $117.7 million as operating expenses grew 11.0%, with research and development rising 20.9% (driven by headcount and acquisition-related costs) and sales and marketing increasing 4.4%. Net loss increased to $129.3 million from $95.8 million, reflecting the expanded operating loss partially offset by financial income, net (down 12.8% to $30.2 million due to higher interest expense on the 2029 convertible notes).
The SaaS segment is now the dominant revenue stream, representing 74.2% of total revenue versus 37.9% in 2024. The transition to a SaaS delivery model is intentional—management has announced the end-of-life of the self-hosted business by December 31, 2026. SaaS ARR reached $638.5 million as of December 31, 2025, accounting for 86% of total ARR of $745.4 million (up 16% YoY). Term license subscriptions declined as customers converted to SaaS, a trend expected to persist. Maintenance and services revenues fell as the perpetual license base shrinks. The renewal rate remained above 90% for both 2025 and 2024, indicating strong customer retention despite the model shift. The company also expanded its data coverage through acquisitions of Cyral (March 2025) for database activity monitoring and SlashNext (August 2025) for email security, which are expected to strengthen the SaaS platform.
Management expects SaaS revenues to continue to grow considerably, while term license and maintenance revenues will continue to decline. The impact of seasonal patterns on gross margin is expected to diminish as SaaS ratable revenue recognition reduces first-quarter troughs. The company guided that ARR and SaaS ARR will increase in absolute dollars. RPO stood at $1.1 billion as of December 31, 2025, indicating a strong contracted revenue backlog. No specific numerical guidance for future quarters was provided. The company has sufficient liquidity with $921.0 million in cash, cash equivalents, and short-term marketable securities, and $187.2 million in long-term investments. Operating cash flow improved to $147.4 million in 2025 from $115.2 million in 2024. Share repurchase programs were active, with $115.0 million repurchased in 2025 and $135.0 million remaining under the October 2025 program expiring October 2026. The strategic priority remains the complete transition to SaaS and the conversion of remaining self-hosted customers.
As of December 31, 2025, Varonis held $202.5M in cash and equivalents, $868.4M in marketable securities (short- and long-term), and $37.3M in short-term deposits, providing total liquidity of $1.08B. Total debt consisted solely of the 1.00% Convertible Senior Notes due 2029, carried at $452.3M net of unamortized issuance costs ($460M principal). The 2025 Notes were fully converted or repaid during the year, reducing debt by $248.5M from the prior year. Stockholders' equity stood at $598.7M, including $23.1M in accumulated other comprehensive income. The company reported $1.097B in remaining performance obligations (RPO), with 54% expected to be recognized within 12 months.
Varonis has three contractual minimum purchase commitments with service providers totaling $423.2M. Of this amount, $31.3M is due within the next 12 months, and the remaining $391.9M due thereafter. One commitment (through May 2031) accounts for $377.6M of the long-term portion. Operating lease liabilities total $69.5M (undiscounted payments $81.9M) and an additional $9.0M lease not yet commenced.
Share repurchases totaled $115.0M in 2025 (2.9M shares). Three programs were in effect: the October 2022 program ($100M, expired), the February 2025 program ($100M, completed in April), and a new October 2025 program authorizing up to $150M (remaining $135M). No dividends were declared. Capital expenditures were $15.5M (2.5% of revenue), including $12.6M for property and equipment and $2.9M for capitalized internal-use software.
The company operates as a single reporting segment. No segment-level profitability is disclosed. Geographic revenue mix: United States $440.5M (70.7%), EMEA $133.6M (21.4%), Rest of World $49.5M (7.9%). Long-lived assets are concentrated in Israel ($49.9M) and the United States ($33.1M).
The risk factors begin by highlighting the uncertainty of market growth for data security software, which is critical to Varonis' success. Economic downturns, inflation, tariffs, and geopolitical unrest (e.g., Russia-Ukraine war) could reduce IT spending and lengthen sales cycles. The market is becoming increasingly competitive, with established vendors and startups targeting similar use cases (DSPM, data classification, AI security).
Varonis faces a complex web of privacy regulations: US state laws (CCPA, CPRA, and new laws in Delaware, Iowa, etc. taking effect in 2025-2026) and international frameworks like GDPR and the UK Data (Use and Access) Act 2025. Cross-border data transfer mechanisms (EU-U.S. Data Privacy Framework) were upheld in September 2025 but remain subject to challenges. Failure to comply could result in fines, litigation, and reputational harm.
Cybersecurity remains a top risk: Varonis is an attractive target due to its role in data security. A breach could lead to significant liability and loss of customer trust. The ongoing transition to a SaaS delivery model introduces uncertainties, including the planned end-of-life of self-hosted products by December 31, 2026, which may cause revenue volatility. The company also relies on third-party cloud providers; service interruptions could impact operations.
Varonis has a history of net losses ($129.3M in 2025) and expects continued investment. The $460M in 2029 Notes (issued September 2024) adds debt service obligations and potential dilution upon conversion. The capped call transactions may mitigate dilution but introduce counterparty risk. Foreign exchange fluctuations, especially in EUR, GBP, and ILS, are hedged but may not fully offset impacts.
Talent acquisition and retention are challenging, particularly in Israel where the R&D center is located. The ongoing war in Israel since October 2023 has led to employee reserve duty calls, potentially disrupting operations. International expansion exposes Varonis to FCPA, anti-corruption laws, and export controls on encryption technology.
A securities class action lawsuit was filed in January 2026, adding litigation risk. Tax changes under the One Big Beautiful Bill Act (July 2025) require capitalization of R&D expenses, increasing tax liabilities once NOLs are exhausted. The Israeli subsidiary's tax benefits terminated in 2020; standard 23% tax may apply if conditions are not met.
The provided document excerpt does not contain the actual Consolidated Statement of Cash Flows. The index references page 63, but the content is limited to auditor reports and other sections. Therefore, no cash flow figures can be extracted. To complete the analysis, the full cash flow statement for Varonis Systems, Inc. for the year ended December 31, 2025 is required.