Participants

Tim Perz; Director - Investor Relations; Varonis Systems Inc

Yaki Faitelson; Co-Founder, Chief Executive Officer; Varonis Systems Inc

Guy Melamed; Chief Financial Officer, Chief Operating Officer; Varonis Systems Inc

Matthew Hedberg; Analyst; RBC Capital Markets

Joel Fishbein; Analyst; Truist Securities, Inc.

Saket Kalia; Analyst; Barclays Capital Inc.

Joshua Tilton; Analyst; Wolfe Research, LLC

Roger Boyd; Analyst; UBS Securities LLC

Joseph Gallo; Analyst; Jefferies Group LLC

Brian Essex; Analyst; JPMorgan Chase & Co.

Shaul Eyal; Analyst; TD Cowen

Jason Ader; Analyst; William Blair & Company

Rudy Kessinger; Analyst; D.A. Davidson & Co.

Shrenik Kothari; Analyst; Robert W. Baird & Co. Inc.

Presentation

Operator

Greetings. Welcome to the Varonis Systems Inc., first-quarter 2025 earnings conference call.
 (Operator Instructions) As a reminder, this conference is being recorded.
 It is now my pleasure to introduce your host, Tim Perz. Thank you. You may begin.

Tim Perz

Thank you, operator. Good afternoon. Thank you for joining us today to review Varonis' first-quarter financial results.
 With me on the call today are Yaki Faitelson, Chief Executive Officer; and Guy Melamed, Chief Financial Officer and Chief Operation Officer of Varonis.
 After preliminary remarks, we will open the call to a question-and-answer session.
 During this call, we may make statements related to our business that would be considered forward-looking statements under Federal Securities Laws, including projections of future operating results for our second quarter and full year ending December 31, 2025.
 Due to a number of factors, actual results may differ, materially, from those set forth in such statements. These factors are set forth in the earnings press release that we issued today of, under the section captioned Forward-Looking Statements. These and other important risk factors are described more fully in our reports filed with the Securities and Exchange Commission. We encourage all investors to read our SEC filings.
 These statements reflect our views only as of today and should not be relied upon as representing our views as of any subsequent date. Varonis expressly disclaims any application or undertaking to release, publicly, any updates or revisions to any forward-looking statements made herein.
 Additionally, non-GAAP financial measures will be discussed on this conference call. A reconciliation for the most directly comparable GAAP financial measures is also available in our first-quarter 2025 earnings press release and our investor presentation, which can be found at varonis.com, in the Investor Relations section.
 Lastly, please note the webcast for today's call is available on our website in the Investor Relations section.
 With that, I'd like to turn the call over to our Chief Executive Officer, Yaki Faitelson. Yaki?

Story Continues

Yaki Faitelson

Thanks, Tim. Good afternoon, everyone. Thank you for joining us today to review our first-quarter results, the focus of our fast transition to remind you why Varonis is best positioned to secure the world's data.
 In the face of uncertainty in the world today, there is one constant which pushes the business case for Varonis no matter what will happen. People will eat, sleep, and create data. The world is completely dependent on data and because of its importance, bad actors want to steal it. At the same time, companies struggle to protect it.
 More organizations deploy technologies to protect their endpoints and their perimeters; these technologies are very important but they aren't enough to protect data. Varonis takes a data-first approach and helps companies to locate their sensitive data; visualize the access to it; automatically lock down; and then, automatically [be taken respond] to strengthen it.
 Last quarter, we announced that we will accelerate our SaaS transition. And our Q1 results prove that we are well on track to complete it by the end of the year. The reason we are accelerating this transition is because of the strong demand for our SaaS solutions and the benefits to our customers and our company
 Simply put, Varonis SaaS is a much better way to deliver our platform and to protect our customers' data more effectively and efficiently. With Varonis SaaS, customers are able to realize greater value from our platform without effort, which leads to more satisfaction and we believe will better position our company to accelerate growth.
 In the first quarter, ARR grew 19% to $664.3 million. And we continue to progress towards completing our SaaS transition, with SaaS ARR now representing approximately 61% of total ARR or $403.9 million.
 We generated $65.3 million of free cash flow this quarter, up $156.4 million in the same period last year.
 Guy will review our results and updated guidance in more detail, shortly.
 Our first-quarter results reflect strong contributions from both new and existing customers that are driving our overall business momentum.
 Organizations face a dangerous, threat environment. And their security teams are stretching, which means they struggle to see and respond to threat as quickly, as being marked with today's bad actors.
 The automated value proposition of the Varonis SaaS platform and MDDR offering resonates with security teams. With Varonis, these organizations can secure their data with very little effort because we do the hard work for them. This is an outcome that simply cannot be achieved by using point solutions or manual work.
 We also continue to see very healthy customer interest in safely deploying copilot and other generative AI tools, which is serving as a reason for new customers to engage with Varonis; and, also, for existing ones to convert to our SaaS platform. We see massive opportunity to increase the ARR of our existing customer base.
 An in the first quarter, we continued to see existing customers expand their deployments and increase their spend with us. Varonis Saas is a no-brainer for our customers because of the value that is offered.
 In the first quarter, we were able to convert existing customers to SaaS more effectively because of the lessons we learned last year and the additional investments that were made in out team.
 This is now also freeing up capacity of our sales teams. They're bringin in healthy levels of new customers, while also upselling additional platforms to our broader customer base.
 Existing SaaS customers continue to expand their journey with Varonis, while many of our customers choose to start with their Varonis deployment by protecting data in Microsoft 365 or on-prem storage platforms because that was the top security concern.
 They realized that they have sensitive data in many places, beyond the areas where they originally deployed us. This is why we have significantly expanded our coverage in recent years to include leading cloud data stores, which means we cover data everywhere.
 Our breadth and depth of coverage has become one our biggest competitive advantages, which means that we are able to provide customers with automated data security, wherever they have sensitive data
 (inaudible) Cloud is working well. And during Q1, we continue to see customers looking to Varonis to secure data across these newer cloud data stores. And we believe our ability to execute into this large and fast-growing markets position us to continue to accelerate growth ,once we completed the SaaS transition.
 Another benefit of SaaS is that it gives us the ability to innovate much faster. During Q1, we did exactly that, announcing Varonis for Agentforce, which allows organizations to safely enable agentic AI roll-out in Salesforce. Review agentic AI is a massive opportunity because agents in [indiscernible] the permission of the users who run them. So if users have excessive access, agent can expose sensitive data. For example, if a bank uses Salesforce to process mortgages, get what would happen when you upload your financial documents with your application or that information ends up with Salesforce, a record files and attachments. Salesforce can classify the visual [indiscernible] but there is no way to find [indiscernible] and attachments to making [indiscernible] to find sensitive data automatically, fixed exposure to very complicated -- complicated permission model, [indiscernible] on the data and safely enable the data usage of Agentic AI. To finish our example, Varonis automatically removed access to ensure your sensitive mortgage application is not unnecessarily exposed by an agent. In March to enhanced the acquisition of [ Cal ], which explains our data security platform to include the next-generation database activity monitoring, [indiscernible] innovative report, the database activity model becomes quickly and allows customers to upgrade their costly legacy solutions and unified with structured and unstructured data security monitoring, which means Varonis can [indiscernible] a single [indiscernible] of grass for securing any kind of data [indiscernible] platform, we will now be able to address quality and compliance use cases. In addition, to being a strong strategic fit, this market is attracting to us because it has established budgets and thrive for disruptions, due to a lack of innovation or [indiscernible] recent years. These acquisitions speed our time to market and expand our total available market drastically and we enhance our ability to help customers protect their data and allow them to consolidate their data security budget is on. Is that I would like to briefly discuss a couple of key customer wins in Q1. [indiscernible] continue to be key drivers of our business. In this quarter, [ Varonis ] health care system is over 100,000 employees becoming Varonis customer after suffering a ransom attack that impacted millions of patients. They evaluated Varonis, a number of [indiscernible] solutions in the data [indiscernible] and [ GSP ] categories to lock down their [ centipede ] data and ultimately purchase Varonis [indiscernible] for Windows with MDR protection and Varonis for Google Drive. Varonis was the only platform that could automatically secure the sensitive data in Google and on-prem, while proactively monitoring its core strength. For new customers drove most of our momentum this quarter. We are also seeing strong demand from existing customers looking to convert to our SaaS platform and expand the protection to cover new critical cloud data stores I mentioned a moment ago. [indiscernible] for this quarter for the multinational consumer product company with approximately 6,000 employees that first became a Varonis customers years ago. They initially utilized Varonis to a permissions and classify data on-prem. This year, they determined they needed the automation of Varonis SaaS and MDDR because they will severely understaff and face an executive mandates to safely deploy copilots. Over the time, they have met our customers. Varonis takes over 10 million of exposure on-prem in terms of starting of overexposed links in Microsoft 365, which convinced them that they would be able to safely deploy copilot. This customer purchased Varonis SaaS for hybrid environments as well as the Varonis for AWS, Azure, Google Cloud, [ Snowflake ] and [indiscernible], which will enable them to safely protect their data in the cloud and the SaaS applications. In summary, we are excited with the competing momentum we are seeing across our customer base that is driving our growth. Our solution has never been more relevant, and we look forward to completing our fast transition this year, which will unlock many more benefits for customers and our company as we execute on our significant market opportunity. With that, let me turn the call over to Guy Melamed.

Guy Melamed

Thanks, Yaki. Good afternoon, everyone. Thank you for joining us today. Our first quarter performance represents a solid start to the year, highlighted by an acceleration in ARR growth, sustained improvement in free cash flow and continued progress towards completion of our SaaS transition. This performance allows us to raise our full year ARR guidance as we focus on executing on factors within our control while closely monitoring the uncertain macroeconomic backdrop. We remain confident in our outlook because of the underlying drivers of our business and are well positioned to capitalize on our growing customer demand. Our Q1 results demonstrate sustained new customer momentum and that the investments we made in our team and lessons we learned regarding existing customer conversion is working. As a result of this momentum, we ended Q1 with 61% of total company ARR coming from SaaS, an 8-point increase in the SaaS mix from the [ 53% ] we reported in Q4. When we look at the SaaS NRR, we continue to see very similar trends to last year, which was significantly above our total company NRR reported in 2024. This shows us that SaaS customers are coming back and buying more, which combined with a healthy new customer momentum that we are seeing gives us confidence that we can return to more than 20% ARR growth. In the first quarter, ARR was $664.3 million, increasing 19% year-over-year. In this quarter, we generated $65.3 million of free cash flow, up from $56.4 million in the same period last year. In the first quarter, total revenues were $136.4 million, up 20% year-over-year. During the quarter, as compared to the same quarter last year, we had approximately a 1% headwind to our year-over-year revenue growth rate as a result of having increased SaaS sales in our booking mix, which are recognized ratably versus the upfront recognition of our on-prem subscription products. Tax revenues were $88.6 million. Term license subscription revenues were $31.5 million and maintenance and services revenues were $16.4 million as our renewal rate were again over 90%. Maintenance and Services revenues declined by 32% year-over-year, with the vast majority of the decline driven by perpetual maintenance customers converting to our SaaS platforms. Moving down to the income statement, I'll be discussing non-GAAP results going forward. Gross profit for the first quarter was $109.4 million, representing a gross margin of 80.2% compared to 83.3% in the first quarter of 2024. Operating expenses in the first quarter totaled $115.9 million, as a result first quarter operating loss was $6.5 million or an operating margin of negative 4.7%. This compares to the operating loss of $10.6 million or an operating margin of negative 9.3% in the same period last year. During the quarter, as compared to the same quarter last year, we had approximately a 1% headwind to our operating margin as a result of having increased SaaS sales in our booking mix which are recognized fully ratable versus the upfront recognition of our on-prem subscription products. First quarter ARR contribution margin was 16.7% up from 13.7% last year. The significant leverage improvement reflects our ability to drive strong incremental margins while growing ARR and transitioning to tax. During the quarter, we had financial income of approximately $10.7 million, driven primarily by interest income on our cash, deposits and investments in marketable securities. Net income for the first quarter of 2025 was $0.7 million or $0.00 per diluted share compared to a net loss of $3.7 million or a net loss of $0.03 per basic and diluted share for the third quarter of 2024. This is based on 136.7 million diluted shares outstanding and 170 million basic and diluted shares outstanding for Q1 2025 and Q1 2024, respectively. As of March 31, 2025, we had $1.2 billion in cash, cash equivalents, short-term deposits and marketable securities. For the 3 months ended March 31, 2025, we generated $68 million of cash from operations compared to $56.7 million generated in the same period last year and CapEx was $2.3 million compared to $0.3 million in the same period last year. During the first quarter, we repurchased 1,476,456 shares at an average purchase price of $41.49 for a total of $61.3 million. Turning now to our updated 2025 guidance in more detail. Our acquisition of [ silo ] is not expected to have any impact on ARR or revenue this year and is expected to add approximately [ $4 million ] of operating expenses in 2025. For the second quarter of 2025, we expect total revenues of $145 million to $150 million, representing growth of 11% to [ 15% ]. Non-GAAP operating loss of negative $5 million to negative $2 million and non-GAAP net income per diluted share in the range of $0.00 to $0.01. This assumes 135.2 million diluted shares outstanding. For the full year 2025, we now expect ARR of $742 million to $750 million, representing growth of [ 16% to 17% ]. Free cash flow of $120 million to $125 million, total revenues of $610 million to $625 million, representing growth of 11% to 13%. Non-GAAP operating income of $0.5 million to $10.5 million, non-GAAP net income per diluted share in the range of $0.14 to $0.17, this assumes [ 135.8 ] million diluted shares outstanding. In summary, we are encouraged by our first quarter results, which were highlighted by broad-based strength and is leading to healthy ARR growth, operating leverage and cash flow generation. This performance gives us confidence to raise our full year ARR guidance as we progress towards the completion of our SaaS transition later this year. With that, we would be happy to take questions. Operator?

Question and Answer Session

Operator

[Operator Instructions] The first question we have is from Matt Hedberg of RBC. Go ahead.

Matthew Hedberg

Congrats on the results. It's really great to see the SaaS transition continue to accelerate and finish by year-end. One of the key questions that I get from a lot of investors is, what gives you guys confidence that ARR can grow [indiscernible] [ 20 guys ] you illustrated. I think you -- Guy mentioned the SaaS net NRR significantly above total NRR. Is there any other things that you would give us a guide post around the confidence in that element?

Guy Melamed

Matt, thanks for the question. When we look at our ability to grow 20-plus percent. There are a lot of tailwinds that are working in our paper. One of the things that I mentioned in the prepared remarks is our Saas NRR. And when you look at SaaS NRR, and to remind everyone, that doesn't include any impact from conversions, it was very healthy this quarter. So we continue to see very similar trends to what we saw last year, but that has been [indiscernible] that is significantly above our total reported company NRR. So this really shows that the SaaS customers see value and they want to protect additional platforms. So they are coming back and buying more, which buying with a healthy new customer [indiscernible] that we're seeing gives us the confidence that we can return to that ARR growth of [indiscernible] 20%.

Yaki Faitelson

And Matt, it's also very important to understand this is the best way to avoid data breach. The adapters are not breaking in their [indiscernible], their trying to compromise identities and then if you can protect your -- if you can make sure that the right identities can access the right data, stock in normal behavior, you will suffer a severe -- most probably you will suffer a sever data breach and data is going relentlessly on all platforms and it's extremely viable, and this is the most effective way to evolving data breach. [indiscernible] SaaS platforms, customers are benefiting from it and the information is protected in an automated way.

Operator

The next question we have from Joel Fishbein of Truist Securities. Please go ahead.

Joel Fishbein

Thank you so much for the questions and great results. I'd love to get some more color around MDDR adoption and how that -- the competitive environment around that and then how that could potentially be an [indiscernible] questions [indiscernible] to be accelerated to ARR?

Yaki Faitelson

So in terms of the overall value, I see so many breaches with customers and usually they come [indiscernible]. [indiscernible] this organization has a model security starts, a world-class [ EDR ], a modern firewall, [indiscernible] to collect the log and it's severe breach. In order to make sure that we are protecting customers from a data breach, you need to have a very data-centric approach. If you want to protect data, protect data, make sure that you can remediate what you call the [indiscernible], the excessive access control automatically, understand abnormal behavior. And also under [indiscernible] the compromise identity or an insider, there is no perimeter anymore. So we analyzing extremely well the user behavior of identities and user to make sure we understand any abnormal behavior and solve it automatically. I really believe that if somebody wants to make sure that they don't have a data breach, they need something like Varonis. And the other thing to understand is also in terms of [indiscernible]. If something happens, you want to understand what happened to your data records, the fact that you can understand, who is patient [indiscernible], what happened to a endpoint and to reconfigure or asking directly [indiscernible] and you don't know what happened to the data records, the liability can be endless. So even the ability to do effective [indiscernible] you need to be completely data center. And this is what we see from the MDDR, and we are doing it automatically for customers, and we build a lot of AI. We build a lot of security agents that augmenting our analysts, and this is working extremely well every day, we are saving several enterprises to severe breaches.

Guy Melamed

From a numbers perspective, just to add to that. I think sometimes investors forget that MDDR was only introduced 5 quarters ago. And it has been by far the fastest adopted that we have ever had. So we're very, very happy with how the customers are adopting it. It's a no-brainer really as Yaki mentioned, but when you look at the number of the adoption, we truly believe that at the end of this journey, every single customer should have MDDR to be better protected. It's obviously going to take some time. But when you look at [indiscernible] of this platform, it's been really [indiscernible], very happy with the way it's performing so far.

Operator

The next question we have is from Saket Kalia of Barclays. Please go ahead.

Saket Kalia

You said from the beginning that the [ North Stars ] on this trend in are going to be ARR, SaaS mix and free cash flow. But I wanted to ask about the income statement just for a second. And maybe the question is how far are we from the trough in operating margins as we think about this transition accelerating? And are there any other dynamics that you want us to think about as we kind of think about sort of the model going forward with respect to that?

Guy Melamed

So as you mentioned, the [ North Stars ] are the ARR, free cash flow and the ARR contribution margins. And when you look at those kind of numbers, all of them have been performed extremely well throughout the transition. And if you look at the results in Q1, they're pointing in one direction that we're moving nicely quickly and keeping kind of the cost structure in a very prudent way. So I do want to emphasize that before I talk about the P&L. But from a P&L perspective, there is a lot of things that are going into them during the transition, it's the conversions and the revenue is recognized differently. So it becomes extremely messy. But I do think that the trough will happen this year. And then obviously, next year, you still have some bumpiness because on the comparable side, you'll get some volatility, but less. But I definitely believe that as we progress to complete the transition this year, the income statement starts to look more "normalized". So again, keep everyone focused on during the transition to look at the 3 North Stars, they are the leading indicators, ARR, free cash flow, and ARR contribution margin.

Operator

The next question we have is from Joshua Tilton of Wolfe Research. Please go ahead.

Joshua Tilton

Hello guys, can you hear me?

Yaki Faitelson

We can.

Joshua Tilton

Awesome. Congrats on a great start to the year. I just wanted to double down, Guy, on one thing you said. I know you mentioned that you're monitoring the macro pretty closely. Could you maybe just double-click on what is it all impacts in the quarter you saw because of the current macro? how you're thinking about or how you incorporate macro expectations into the guidance for this year?

Guy Melamed

I think that's a great question. When we look at the macro, obviously, there's a lot of macro uncertainty, but we had a really good quarter and kind of the drivers that we talked about last quarter are really all in place, where it's the SaaS transition, MDDR or Gen AI. When you think about kind of the guidance and how we think about it, our philosophy hasn't changed. We treat the numbers, we give Wall Street very seriously, and we feel very good about the pipeline in front of us. So when you think about the macro uncertainty and despite it really, we have never been so confident about the long-term opportunity as we see it today. So we try to remain focused on factors within our control, and we're confident in our ability to capitalize on a growing customer demand. So another thing that makes us feel really good is that in the first quarter, we saw strong demand from both new and existing customers, which led to that ARR acceleration we talked about, that continued leverage in our model and the strong cash flow generation. So when you combine all of these, and these results and kind of the underlying drivers in our business is what gives us the confidence to raise our ARR guidance by that $5 million and increase our SaaS mix to 80% for the full year kind of despite the uncertainty that we see in the macro environment.

Operator

The next question we have from Roger Boyd of UBS. Please go ahead.

Roger Boyd

Thanks for taking my questions, and I'll echo comments on cash on a strong quarter. Guy you mentioned good traction being logos in the quarter. I wonder if you could talk about, one, are we getting to the point where we can kind of quantify how often new logos are landing with some of the newer offerings Varonis for kind of the SaaS applications, cloud storages and databases? And then similarly, on the strength in use cases around securing copilot and other AI tools. Are we getting to a point there where we can kind of quantify how big that traction is?

Yaki Faitelson

[indiscernible], I see that just to clarify just mathematically, it's still half. But I would tell you in every data reported [indiscernible] people have critical data, critical data in SaaS applications like Salesforce and [ ServiceNow ] in cloud is positive, like databases, being [ Snowflake ], any data breach and they need to protect [indiscernible]. We still have a lot of data on-prem and in 365. And what happened is all the AI tools they put a spotlight on the data security problems. So the agents, these copilots, what they do essentially, they're just using all the potential access and give you a lot of information and [indiscernible] a lot of information [indiscernible]. So there is excessive access control immediately, employees will get the information that we shouldn't get. You can point on this AI model, and you can also [indiscernible]. So as you will see more adoption of AI tools, you will understand that in order to enable them, we need data security and automated data security in order to make sure you can manage their attention between productivity and security. And this is something that we are doing very well. We believe that with SaaS [indiscernible] people who just eventually protect every data deposited that they have, and this is why we see a lot of success with [indiscernible] Cloud and just working very well for us. We are very happy with all the investments we have done in the last few years in data repository, user repository, protecting with the AI tool, automated classification. They are all coming to fruition.

Operator

The next question we have is from [ Kiwis ] of Morgan Stanley. Please go ahead.

Congratulations on a solid quarter. I want to ask a little bit about the recent acquisition that you made in the database activity monitoring space. It seems like a pretty logical extension, I guess, even a broader purview of the data within an enterprise as a state. Can you talk to us about sort of where that fits in? How you plan to kind of add the portfolio? And then a follow-on question for that. I think probably everyone on the line just came back from RSA last week, a lot of talk about data and data security. It feels like the environment is getting [indiscernible] more competitive. Can you talk to us about how you're seeing the competitive environment evolving as this issue really comes to the forefront of the minds of [indiscernible]?

Yaki Faitelson

Yes. Thanks for the question. So first, in terms of database, which is just the natural extension for us, and we started to see a lot of success with [indiscernible] Cloud, top line is database repositories, understanding configuration and adding the usage. And this customer came and told us there is not happy with the incumbent. And if you look if there are compliance requirements, we can answer everything, you've got COVID [indiscernible] in the past, it's always going from one data repository to the other. And we said, if you can go deep into the queries, it will be great and logically, they want to replace the current solution that they are using, using one scalable data security platforms that give them all these automated outcomes of [indiscernible] and classification and remediation. In terms of this competitive environment, at this point, it's just being very good for us. So nothing changed for us in the competitive environment in terms of stuff like Office 365 and all the Microsoft collaboration tools on the on-prem storages and [indiscernible] on seats [indiscernible] or any at device and all the [ DSPM ] space, finally, these are not data security [indiscernible], it's primarily data discovery tools that many times still having a hard time to scale and don't give you automation. They don't have remediation, they don't give anywhere [indiscernible] detection, they are not integrated with the identity layer and what is that for us, it's actually a decent increase in our overall total available market and everything that we are doing in [indiscernible] and other cloud data repositories generate more awareness. And when customers are testing then they understand these are not security tools, you can't do [indiscernible] with them, you can do remediation with them. You don't understand if you had an attack, and I think that the fact that it's becoming there is more for outsized is really contributing for the success of [indiscernible] Cloud.

Operator

The next question we have is from Joseph Gallo of Jefferies. Please go ahead.

Joseph Gallo

Last quarter, you mentioned elongation of conversion cycle times. Has that length of cycle time for conversions changed in any way? And then how is the gross retention rates in ASP upside recognized in for those customers?

Guy Melamed

There are a lot of lessons that we have learned from the conversion process last year, and we are trying to implement them starting this year. I think we've done a very good job. And when you look at kind of the conversions that we had in Q1 they were really strong. And I think all of the investments and the lessons learned were implemented in a way that we're happy to kind of to start the year with. When you look at the gross retention rate, when you look at the renewals, they're all very strong. We feel good about where we are, and we're seeing and we talked a lot about the fact that SaaS is purely a better product and therefore, we're seeing our existing customers try it and then want to buy more and be better protected. But really, when it's important to note that the conversions weren't the only strong element this quarter and we're definitely seeing strong new customer adoption. Again, it kind of relates to that SaaS platform that is being -- the offering is so much better. So when you look at kind of the growth rate and our ability to get to that acceleration is coming from our existing customers buying more and our new customers that were really strong this quarter.

Operator

The next question we have is from Brian Essex of JPMorgan. Please go ahead.

Brian Essex

Yaki got a question for you. Great to see the innovation outside of Microsoft copilot into other Agentic applications like CRM. Could you maybe provide a little bit of color in terms of your expectations for any different go-to-market motion. I think one of the concerns that investors may have is that in Office 365 environment you're competing against [ purview ]. Are you seeing a pull-in from Salesforce and other ISVs you might be working with? And do you anticipate maybe less friction with that go-to-market motion?

Yaki Faitelson

[indiscernible] as you will see [indiscernible] Agentic AI and [indiscernible] AI, what he does is just put the data security program [indiscernible], you're using these agents and immediately, you get information that you shouldn't get, it's very problematic. It will be very helpful organization to like that. So if you want to enable your organization to safely use AI, you need something like Varonis. You need to understand the activity, you need to [indiscernible] the permission. You need to do everything automatically, you need to look at the forms and make sure that people are asking a legitimate question because if not, it's an act [indiscernible].

Operator

The next question we have is from Rob Owens of Piper Sandler. Please go ahead.

This is Ethan on for Rob this afternoon. As we think about consolidating more of the data security budget, what are some other natural adjacencies in the space that you think the platform will be well seeking to address going forward?

Yaki Faitelson

[indiscernible] obviously database activity monitoring is a big one, a lot of stuff that related to understanding identity behaviors, things that are relevant to the [ MDR ] environment. So just a lot and we also are bringing a lot of additional capabilities that and take additional budgets. But definitely, another source of [indiscernible], the AI budgets organizations are -- so I am to adopt AI and want to do it in a secure way is starting to have this allocated budgets for AI security and enabling the organization to use AI and we are benefiting from.

Operator

The next question we have from Shaul Eyal of TD Cowen.

Shaul Eyal

Congrats on solid set results and guidance. Yaki I wanted to ask very 2 little quick questions. One was the headcount that you're adding with the small with the stocking acquisition? And a macro, Guy or Yaki, [indiscernible] specifically, I'm not talking about tariffs, et cetera, but [indiscernible] specifically, have you seen anything emerging in this quarter?

Guy Melamed

I'll start with the second question, and thanks for that, Shaul. When we look at federal and I want to remind everyone, the federal business for us is still relatively small, about 5% of total [indiscernible] ARR. And when we look at kind of the -- when we look at the contribution in Q1, Q1 is not considered a large quarter for them. Their largest quarter is Q3, so when you think about kind of how we look at federal, we didn't see anything kind of evolved from [indiscernible] the way we think about it from a guidance perspective is that we didn't assume any significance contribution in comparison to last year. So we are very happy with kind of the progress of the Fed [indiscernible] certification. It's really a [indiscernible] as planned, and we hope to get it in the next few months. So we definitely believe in that long-term opportunity in that vertical. So that kind of relates to the federal question. In terms of style, we didn't have -- they don't have a significant number of head count. So it's a small number that doesn't impact us much but when we think about that expense addition throughout the year, it's approximately $4 million of additional expense throughout the year. If you look at kind of the guidance, you can see that it hasn't changed much. We're able to absorb it from a guidance perspective. And we're not expecting any ARR or any contribution from the final acquisition this year.

Operator

The next question we have is from Fatima Boolani of Citi. Please go ahead.

This is [ Mark ] on for Fatima. Maybe just want to dig a little bit more into the new local momentum you're seeing. I really can [indiscernible] adjusting the sales [indiscernible] focus this year on the renewal conversion. But can you maybe give us some of the drivers there? How much does this [indiscernible] on expectation? And maybe can you speak to any discernible changes on new customer adoption behavior aside from maybe the AI driven purchases? And any [indiscernible] how we should think of the contribution between new versus [indiscernible] to ARR guide this year?

Guy Melamed

We talked a lot about the fact that with the MDDR offering and kind of the fact that we have our copilot addressing any Generative AI, it really is a no brainer for new customers to adopt the platform. And we've absolutely seen a change in the way we can address those customers, we truly believe that our TAM has increased with the new offering, the simplicity of the offering, the fact that there's so much [indiscernible] in the MDDR has really allowed us. Together really with the copilot being such an issue for our customers that want to adopt it really helped us address the simplicity of going to new customers that we weren't able to sell to before and make add value proposition to be very much adopted in a healthy way. So we started [indiscernible] that last year, we started to continue this year. You heard us talk in the last earnings call about the fact that we want to move as quickly as we can [indiscernible] the transition and complete it in 2025. I think the results in Q1 are a very good start and showing that we're moving in that direction. So we try to balance, making sure that we're not only completing the transition, but the [indiscernible] is still on getting new customers. Our Salesforce has done a really good job of balancing those 2, and I think that's kind of the reason we were able to show that acceleration, that feed the raise on the ARR guidance, and the leverage in the model and the ARR contribution margin. So I think those 2 elements addressing new customers and being able to convert our customers in a more efficient way is what's helping us move forward the way we have so far.

Operator

The next question we have is from Jason Ader of William Blair.

Jason Ader

I wanted to ask on the gross margin outlook. I know that the SaaS transition is impacting that. Can you just talk about what you expect for the remainder of 2025 and then the kind of more medium-term outlook? And then just sort of related to that, why is a non-GAAP operating income range so wide? Can you just speak to that?

Guy Melamed

We're going back to revenue. Listen, revenue, the P&L in general throughout 2025 is going to get messy. You have to keep in mind that the way revenue is recognized through SaaS and on-time subscription is so significantly different, that it's generating a lot of volatility, and it's a lagging indicator and it doesn't indicate for the health of the business at all. So you get the conversion and that generates a lot of messiness. So gross margin, really, when you think about 2025, it's not going to be reflective of anything. When we did our Investor Day in 2023, we gave out like a 5-year model, and we put in our gross margin expectation, which was at the end of 2027 to be in that range of the 80%. I can tell you that overall as a context, and I'm not talking about 2025 when we gave guidance from a revenue perspective. But when we look at the performance our cost on that is exceeding our expedition significantly. So as a general concept and just to keep in mind, we are doing better than what we thought when we initiated the transition but you're going to see that volatility until we complete the transition. And the reason that the range is so wide is because there's so many factors that are embedded in this transition, [indiscernible] to take a shift and completely transition it from onprem subscription to SaaS. I think we've done a great job so far, and we want to make sure that we complete the transition at the end of this year. So getting 65% -- 61% in Q1 with a great start. But again, there's a lot of volatility, trying to bake in and consider what are the conversions and how it's going to impact. And that's why we took an extra range, which I think is prudent.

Operator

The next question we have is from Rudy Kessinger of D.A. Davidson. Please go ahead.

Rudy Kessinger

Firstly, Guy, I want to make sure [indiscernible], I think in response to Josh's question earlier, you said 80% SaaS mixed by year-end on ARR. I think that's versus 78% expected previously. I want to make sure I got that right. And then secondly, I guess my real question does it feel like we're getting any closer to an inflection point on the copilot and Gen AI stuff? Just what are you seeing from customer behavior? How has maybe the macro impact in the rollout of agent force copilot, et cetera?

Yaki Faitelson

I think that the overall organization understand that these AI tools or market productivity gains. And definitely, I think that they will -- we need to update how they are going to use exactly, how [indiscernible] to all their employees, but definitely we see as a driver, and we believe that is going to be more [indiscernible]. You will see [indiscernible] demand for data security. So this is definitely something that we see [indiscernible].

Guy Melamed

And I did want to confirm you're right, we raised our guidance on the SaaS mix from 78% to 80% at the end of the year.

Operator

The next question we have is from Shrenik Kothari of Robert W. Baird.

Shrenik Kothari

Just on a related note from the previous question. So historically, your spend has been an unstructured environment and, of course, with the several acquisitions and increased focus on [indiscernible], will be driving into infrastructure data. Just Yaki, how are customers responding to kind of more [ UNFI ] across structured, unstructured assets? Do you see as more of a green bar expansion? And are there like real gaps in automated congregation there? Are you seeing budgets kind of shift from potentially legacy asset [indiscernible] into your platform? Just curious what you're seeing.

Yaki Faitelson

I think that the organization is just smart to make sure that they're protecting all the data with us, they need all the automated outcomes that we provide. They want to [indiscernible] the classification engine, and this is exactly what the [indiscernible] which is getting much better security. We have second-line data centeric user behavior analytics. We also [indiscernible] a lot from the active directory [indiscernible], so the monitoring identities and other [indiscernible] like firewalls. So this is just natural expansion for them and it works very well for them to make sure that they don't have data breach to make sure that they are in compliance and they can do it in an [indiscernible] way but also that they can go and show the [indiscernible] superior than they have done a good job that in a tangible way, they classified everything, they label it, they now the last [indiscernible] without making business [indiscernible] and they did everything automatically result adding any additional items.

Operator

The next question we have is from [ Carsten Recover ] of [indiscernible].

Yes. Can you talk about the Agentic AI capabilities that you've announced in MDDR? And specifically, when you look at Agentic system the adoption curve is still very early. So where would you expect Agentic AI to actually begin to contribute more materially to customer outcomes in revenue growth? And specifically, as it relates to MDDR how do you plan to monetize those new features?

Yaki Faitelson

Thanks for the questions. What is happening, we have a world-class analyst looking at customer data 24/7. And we also have a very unique data set that features the behavior of users and service accounts and all identities into data and reach it with [indiscernible] information. But what really is we just plan how to build these security agents that looking at the data and to [indiscernible] close [indiscernible] a lot of events and many others can just close them automatically to make sure that the analysts can be extremely productive. So once the customers is onboarding with our MDDR, the best analyst in the world using the data-centric platform and just an army of robots that is helping them in a direct way to look 24/7 in the customers' environment to make sure that they've gone to the data breach and it works extremely well. We are getting [indiscernible] automation. And this is how we're granting our analysts and once you have our MDDR, an extension of your opinion, the best people in the world [indiscernible] data security that are working for you around the clock is [indiscernible].

Operator

Thank you. Ladies and gentlemen, we have reached the end of the question-and-answer session. And I would like to turn the floor back over to Tim Perz for any closing remarks.

Tim Perz

Thanks again for the interest in Varonis. We look forward to seeing you all at conferences this quarter.

Operator

Goodbye. Ladies and gentlemen, that concludes today's conference. Thank you for joining us. You may now disconnect your lines.

View Comments