Key Highlights

  • Varonis Systems (NASDAQ:VRNS) reported second-quarter results. SaaS annual recurring revenue, the run-rate value of its cloud subscriptions, reached US$726.0m, up 52%; revenues rose 18% to US$180.0m; and full-year guidance was raised.
  • June-quarter revenues of US$180.0m comprised US$171.7m of SaaS, US$4.2m of term licences and US$4.1m of maintenance; a year earlier the split was US$105.9m, US$32.4m and US$13.9m.
  • From 2027 Varonis becomes a clean subscription business: one revenue line, rateable recognition and comparisons that mean something.
  • SaaS ARR growth excluding conversions has stepped down from 29% to 25%, with 20-21% guided for the year.

Why the market is paying attention

Varonis Systems (NASDAQ:VRNS) reported second-quarter results. SaaS annual recurring revenue, the run-rate value of its cloud subscriptions, reached US$726.0m, up 52%; revenues rose 18% to US$180.0m; and full-year guidance was raised.

The shares fell anywayThat capitalises Varonis at about US$4.59bn on aggregated market data's figures against a 52-week range of US$19.70 to US$63.90.

The explanation sits in a second number published alongside the first. Excluding customers migrating off older self-hosted licences, SaaS ARR grew 25%, down from 29% in the March quarter, with 22-23% guided for September. Those migrations end, when the FY2025 annual report says the self-hosted products reach end-of-life.

What the company does

Varonis sells software that guards data rather than the network perimeter. It discovers and classifies sensitive files, maps who can reach them, strips away excess access automatically and monitors activity across Microsoft 365, cloud storage, databases and on-premises systems. The FY2025 10-K puts it bluntly: security outcomes depend less on perimeter controls than on how much access exists when something goes wrong.

Managed Data Detection and Response matters commercially: Varonis' own analysts monitor and respond for the customer under defined service-level commitments, and the 10-K says MDDR is available exclusively through the SaaS platform, a reason to convert as well as a differentiator. Newer products include Athena AI, the Interceptor phishing tool, Database Activity Monitoring and Atlas.

Growth has been bought as well as built: SlashNext, in email security, closed in August 2025 for US$105.9m and AI-governance vendor AllTrue.ai in February 2026 for US$180.3m. About 71% of FY2025 revenues came from the United States.

Latest financial and operating performance

June-quarter revenues of US$180.0m comprised US$171.7m of SaaS, US$4.2m of term licences and US$4.1m of maintenance; a year earlier the split was US$105.9m, US$32.4m and US$13.9m. Gross margin fell to 75.3% from 79.5% as hosting costs replaced near-costless licence revenue. Operating expenses of US$176.1m, research and development up 30% to US$73.3m after the acquisitions, produced a GAAP operating loss of US$40.6m and a net loss of US$46.8m, or US$0.41 a share. Non-GAAP operating income was US$3.7m.

First-half free cash flow was US$69.1m, against US$82.7m a year earlier; 2025 free cash flow was US$131.9m. Cash, securities and deposits stood at US$911.5m against US$460m of 1.00% convertible notes due 2029, net cash near US$458m. The notes convert at US$67.83, far above today's price. Varonis bought back US$135m of stock in the half.

Total ARR was US$742.9m, up 16% and already 86% SaaS. The company no longer publishes total ARR and discloses no net revenue retention rate, leaving ex-conversions ARR growth as the only public proxy for expansion. The 2026 guide is SaaS ARR of US$819m-US$850m, revenues of US$735m-US$739m, free cash flow of US$105m-US$110m and non-GAAP earnings of US$0.14-US$0.15 a share.

The catalyst: an accounting distortion about to unwind

Reading Varonis means separating cash from accounting. A term licence lets a vendor recognise a large slice of contract value on delivery; a SaaS subscription is spread evenly across the term. Switching between the two therefore cuts reported revenue in the short run even when the contract is worth more.

Term licence revenue has fallen from US$32.4m to US$4.2m a quarter in twelve months and maintenance from US$13.9m to US$4.1m. Those legacy lines now total US$8.3m a quarter against US$46.3m, so the drag is nearly spent, which is why reported growth of 18% has converged on underlying ARR growth.

The distortion runs the other way in ARR, because a converted customer adds its full contract value to SaaS ARR the day it moves. Hence 52% headline growth against 25% excluding conversions. When self-hosted products retire in December that boost disappears and headline growth collapses onto the ex-conversions rate, guided at 20-21%.

The bull case

From 2027 Varonis becomes a clean subscription business: one revenue line, rateable recognition and comparisons that mean something. A company guiding to 20%-plus underlying ARR growth, at roughly 6.2 times the midpoint of 2026 revenue guidance, is not obviously expensive for enterprise software.

Demand is the strongest leg. Enterprises rolling out AI assistants find the tools inherit whatever permissions already exist, precisely the problem Varonis was built for, and management credited new-logo strength to securing AI and the data behind it. Net cash of roughly US$458m and US$135m of buybacks give it room to act.

The bear case and the risks

Deceleration is the central risk. SaaS ARR growth excluding conversions has stepped down from 29% to 25%, with 20-21% guided for the year. If the true rate settles in the high teens once conversions stop, the multiple compresses further.

GAAP economics stay unappealing. The first-half net loss widened to US$83.7m and share-based compensation of US$68.4m absorbed 19% of first-half revenue; buybacks largely offset dilution rather than shrinking the count. Gross margin has also slipped to 75.3% as hosting costs replace licence revenue.

Competition comes from a direction Varonis cannot outspend. Microsoft's Purview suite bundles data loss prevention, information protection, insider risk management and data security posture management, including for Copilot and third-party AI applications, for customers already paying Microsoft. Rubrik's latest annual report also describes posture-management capabilities, and the 10-K concedes that large cloud providers are expanding native features into Varonis' space.

Integration risk has risen. Goodwill stands at US$215.1m after two deals in eleven months, with US$65.8m of the AllTrue.ai price still contingent.

What investors should watch next

Third-quarter results, typically filed in late October or early November. SaaS ARR excluding conversions against the 22-23% guide, and revenue within guidance.

The legacy lines and cash conversion. Term licence and maintenance revenue of US$8.3m should approach zero after the 31 December end-of-life, while first-half free cash flow of US$69.1m must roughly double to meet the US$105m-US$110m guide.

Disclosure. Any quantification of MDDR, Interceptor or AllTrue.ai contribution, and whether a total ARR or retention metric returns.

Fiscal 2027 guidance, due with fourth-quarter results in early 2027, the first outlook set with no conversion tailwind.

Investor takeaway

Varonis has largely completed a subscription transition that has broken other software companies. Some 86% of ARR was already SaaS entering 2026, revenue growth is back in the high teens, free cash flow is real and the balance sheet holds roughly US$458m of net cash. The premise that the SaaS conversion is accelerating does not survive the disclosures, though: conversions are running out by design, and the underlying growth they have masked is decelerating toward the low twenties just as Microsoft folds comparable capability into subscriptions customers already buy.

The offsets, MDDR, Interceptor, Database Activity Monitoring and AllTrue.ai, are real but unquantified in the accounts. The cleanest read arrives with 2027 guidance in February; until then the debate is about durability rather than delivery.

This article is for informational purposes only and does not constitute investment advice or a recommendation to buy, sell, or hold any security. Share prices can rise or fall, and past performance does not guarantee future results. Investors should conduct independent research and consult a licensed financial adviser before making investment decisions.