Varonis Systems

Varonis reported second-quarter results that included sales of $180 million, up 18%, and adjusted operating margins of 2%, up 300 basis points. Management raised its 2026 sales outlook slightly to $737 million, implying around 18% growth at the midpoint of the guidance range.

Why it matters: Varonis' stock has been buoyed by investors' view that worries about artificial intelligence models' potential offensive capabilities in cyber will spur demand for cyber vendors, including Varonis. While we agree with cyber spending increasing due to AI, we don't see Varonis as a key beneficiary. We continue to view Varonis as a small cyber vendor that faces structural headwinds from vendor consolidation and view platform vendors as the chief beneficiaries of increased cyber spending. We believe not only can the platform vendors match or outperform smaller vendors on capabilities, they can offer much better pricing to customers due to multimodule bundle discounts, which are all the more important as enterprises navigate tight budgets and increased AI spending.

The bottom line: We maintain our $28 fair value estimate per share for no-moat Varonis. While shares slid after hours, we continue to view them as overvalued. We believe investors are overly optimistic about how much benefit will accrue to Varonis even as AI drives security spending higher.

Between the lines: Management noted that a few large deals were not able to be closed in the second quarter due to acquisition rumors that news outlets reported in June. With these deals closed, annual recurring revenue growth would've been better than the 25% the firm reported.

Bulls say: If Varonis were to be acquired, with rumors circulating around a potential private equity buyout, the price paid would likely be in excess of our fair value estimate and where the stock currently trades. As such, a potential deal could be great news for Varonis shareholders.

Our fair value estimate is $28 per share, implying a 2026 enterprise value/sales multiple of 4 times.

Over the next five years, we forecast revenue to increase at a 13% compound annual growth rate. In our view, data security and privacy will remain key areas of enterprise cybersecurity spending in the coming years. We expect Varonis to benefit from this increased demand for data security products by both acquiring new customers and expanding sales to existing customers.

Varonis’ gross margins have hovered in the mid-80s over the last few years. While we model some near-term headwinds to gross margin as the company transitions to its model, we expect gross margin to return to the low-80s over our explicit forecast.

Varonis has spent heavily on research and sales in the past. However, as the company scales, we expect these line items to decrease as a percentage of sales. In particular, we expect material declines in research and sales spending as a fraction of the top line as the firm completes its cloud transition. As a result, we model GAAP operating margin expanding to high single digits over the next five years, from negative 23.5% in 2025. On a non-GAAP basis, we expect operating margin to rise from negative 1% in 2025 to 19% in 2030.

We believe Varonis Systems merits a no-moat rating. While we believe Varonis has carved out a place in the broader data security space, we believe it faces tough competition in a fragmented market. While we see some evidence of switching costs for the business, as illustrated by strong retention and upselling metrics, the company’s recent profitability has been less than stellar, and we do not have sufficient confidence in the firm’s ability to generate excess returns on capital over the next decade.

Varonis’ primary area of expertise is data security and privacy. The firm’s software allows clients to secure structured and unstructured data, monitor and control access to the data, and receive alerts on any potential breaches or security threats. Varonis’ security solutions are geared toward securing sensitive data within enterprises, such as financial records or sensitive customer data. In a time of heightened scrutiny around data privacy, Varonis’ software can also enable its clients to comply with regulatory requirements such as GDPR and CCPA. We believe the broader data security space, especially for enterprise customers, is conducive to the presence of economic moats. Data security vendors often handle and protect critical data for their clients, leaving them averse to switching away from their existing vendor.

We believe this natural moatiness of the data security space has allowed Varonis to keep churn low. The firm’s gross retention metric is above 90%, implying a customer lifetime of more than 10 years. At the same time, the firm’s upselling activity has allowed it to clock net retention in excess of 110% over the last few years. These impressive gross and net retention metrics show the presence of switching costs, as Varonis is able to not only retain existing clients but also entrench itself further within their data security infrastructure. While these metrics are in line with companies under our coverage that have been awarded economic moats, we remain unconvinced that these retention metrics—and the implied switching costs—will allow Varonis to outearn its cost of capital over the next decade. Varonis’ customers appear to be sticky, but the company has incurred operating losses to build its business and capture these customers.

As we think of Varonis' competitive positioning, we believe the firm may face difficulty maintaining its current retention rates. Varonis is currently undergoing a cloud transition, a process in which a firm weans its on-premises customers over to its cloud products delivered as software as a service. We believe that any cloud transition brings along difficulty in customer retention. For example, Varonis may wish to move one of its existing clients from a term license over to a cloud-based deal. The client, rightfully so, may wish to only move over to Varonis’ cloud offering once the term license is close to expiry. As a result, there is a sweet spot in which the client can effectively move off Varonis’ platform onto a competitor’s without signing the cloud deal. More broadly, the company undergoing a cloud transition effectively opens the exit door but asks the client not to leave. With the firm just beginning its cloud transition journey, we believe that, as it weans its customers off its on-premises offering, there will be a period of heightened churn as some customers opt for a different data security vendor.

While Varonis’ business demonstrates a qualitative argument for an economic moat via strong retention metrics, the firm’s profitability (both past and projected) is one filled with red ink. We believe that the cloud transition coupled with continued investments in research and sales will stack up hefty economic losses over the next few years. Thus, we don’t foresee Varonis generating excess returns on capital in the near to medium term, which precludes us from believing that the firm has an economic moat.

Varonis remains a strong competitor in the data security and privacy space.

Data security and privacy spending is expected to increase materially, acting as a tailwind behind data security vendors such as Varonis.

The firm’s long operating history means that it has valuable expertise in the data security end market.

Large vendors, including hyperscalers, have competing solutions that could affect Varonis’ retention metrics.

A poorly managed SaaS transition could spell trouble for Varonis as it could negatively affect customer retention.

There always remains a risk that Varonis’ solutions can be rendered obsolete in an industry that moves at a rapid pace.