Varonis (NASDAQ:VRNS) reported its second quarter 2023 (Q2) financial results on July 31 when it missed both the revenue and EPS estimates. Despite this bad performance, its shares climbed from around $28.7 to $31 in the immediate aftermath of the announcement which makes you wonder whether, behind these disappointing results, there is not something more important to look for.
It is precisely the aim of this thesis to determine the catalysts for the upside while focusing on SaaS (software as a service) sales which are synonymous with more stable sales in the form of ARR or Average Recurring Revenues which in turn give way to more predictable cash flows. At the same time, I will highlight the company’s antivirus offering and differentiate it from the competition, before providing insights on valuations by invoking a non-traditional valuation metric.
Varonis Embracing the SaaS Model
First, SaaS rhythms with simplicity and efficiency as it requires no prior installation of an application by a service technician who has to come all the way to the company’s premises for the purpose. Instead, applications are accessed directly on the cloud. Looking from an application provider like Varonis’ perspective, SaaS means less operating expenses as fewer on-site interventions are required to resolve operational errors, which are commonplace on desktops and laptops.
Furthermore, SaaS software is relatively more affordable than its traditional On-premises (On-prem) counterpart, which is helping it gain market share. Also, contrary to other commercially available off-the-shelf software, most SaaS products tend to be continuously developed and can run on the infrastructures of large service providers like Amazon’s (AMZN) AWS who do not charge big fees upfront.
Despite all these advantages, the transition from on-prem to SaaS has not been an easy one.
The reason is that the traditional business model consisting of developing On-premises applications has been profitable for decades and touched upon all corners of the IT sector. Furthermore, many companies, especially those using financial applications based on Oracle’s (ORCL) database have not migrated to the cloud because of security reasons, or simply gotten used to the practice of buying a one-year license together with the associated maintenance services.
For Varonis, the transition was announced in March last year with the SaaS business now representing approximately 10% of the total company ARR in Q2, after recurring revenues grew by 17% YoY to reach $497 million. This enabled the generation of $40 million of free cash flow on a YTD basis with this period covering the two quarters the company has been actively transitioning to SaaS. This compares to only $3.9 million of cash for the same period last year.
Guidance Amid Changing Revenue and Profit Mix
Now, this is an important development as shifting from On-prem subscription licenses where more than three-thirds of the deal’s value is recognized upfront, to SaaS where revenue comes gradually (for example monthly and also on a per-usage basis) normally adversely impacts the income statement. It is precisely because a sizeable portion of customers switched to SaaS in Q2 that sales were impacted by about $6 million. Conversely, the average dollar value of a SaaS deal is higher than on-prem, by an average of 25% to 30%.
Therefore, having missed the topline does not indicate that the health of the business is deteriorating, but, rather that the transition is progressing rapidly. Moreover, another advantage of adding more SaaS clients is better gross margins but this also yields a lower operating margin structure during the transition period. Thus, despite Q2’s sales progressing by only 3.56% over last year’s, gross profits have risen by 4.68%, but operating income has declined by 5.72%, which explains why the company also missed EPS estimates.
Using the same logic, the company has adjusted its full-year revenue guidance lower to $497 million to $503 million whose mid-point represents only a 5.6% increase, as conversion rates for the rest of the year accelerate to $18 million. On the other hand, the ARR of $529 million to $535 million represents a faster growth, at 14%-15% as highlighted in orange in the table below.
Thus, during the duration of the transition, less attention should be paid to the traditional income statement metric called revenue, and instead, investors should focus on those highlighted in orange as tabled above. In this connection, for the third quarter (Q3) which ends in October, two metrics to watch out for are ARR contribution margin which analogously to gross margin considers the cost of revenues incurred to generate related sales. This will ultimately depend on the SaaS mix (or portion of SaaS compared to On-prem sales), expected to be 45%.
Now, this guidance is based on the strong adoption of Varonis SaaS.
Cybersecurity and Competition
This consists of the company’s data security platform initially available in On-prem mode and now available through the cloud-native deployment model plus some automation features. The launch was done in October last year as pictured below.
However, while it is SOC2-compliant which means that it adheres to some security standards around System and Organization Control 2, Varonis SaaS is not yet FedRAMP certified. This pertains specifically to U.S. government requirements for security assessment and is key for providing cloud offerings to federal agencies.
However, till it gets certified, Varonis will sell related products based on On-prem subscriptions, especially during the third quarter, at the expense of SaaS. Noteworthily, since the company’s other cloud-based products are already used by the U.S. Army and other large companies as shown below, it is already recognized as a major data protection provider.
In this respect, its antivirus business which leverages experience in data analysis and security, profiles employees, especially in relation to the data they normally access in order to accomplish their jobs. In this way, exception reports are automatically generated in case employees access data in the form of reports or applications which they are not supposed to, flagging them as potential hackers. This way of protection has the advantage of rapidly identifying insider threats before confidential information is leaked over social media as was the case recently in the Pentagon.
Looking beyond governmental bodies, this type of protection which focuses on the data has now become a necessity due to remote work, whereby the employee can work from his apartment garage or even from a hotel compared to the time when he or she had to be located within the four walls of an office. In this scenario, traditional protection devices like firewalls focusing on perimeter defense were enough for protection
Now, looking across the industry there are other strong competitors like CrowdStrike (CRWD) or Okta (OKT) which already offer zero trust protection solutions to address the limitations of perimeter defense, but learning from the Pentagon incident, even ZTP may “help, but won’t ever serve as a silver bullet”. Instead, officials favor a dual technology process.
Thus according to Matt Radolec, senior director of incident response at data protection, speaking in the aftermath of the incident, an alternative consists of focusing on the intelligence data and putting certain controls on how to handle the situation in case of suspicious access. Now, this approach appears to be covered by Varonis SaaS according to its CEO speaking during the earnings call, and which is gaining traction among customers at the point of positively impacting ARR guidance.
Valuing the Company
Therefore, it is all about ARR which means that traditional valuation metrics based on a comparison of revenues and earnings with peers from the IT sector are not appropriate to value the company during its transition period. Instead, I looked at a publication entitled “SAAS Unit Economics & Valuation Exploration” published by the University of South Carolina. This contains the ARR annual growth rates for companies like CrowdStrike, Salesforce (CRM), ServiceNow (NOW), and Workday (WDAY) and I have adapted it for the purpose of valuing Varonis.
Looking deeper, as a cloud-native company or a company exclusively proposing services on the cloud, compared to the others which have transitioned gradually, CrowdStrike has seen a progression rate of above 150%. However, the remaining three started their transition with ARR growth rates between the 20% to 40% range, whereas Varonis anticipates 14% to 15% in its first year of On-prem to SaaS shift.
This could be due to macroeconomic conditions continuing to remain a headwind. However, since SaaS entails significantly lower capital expenses (in terms of infrastructure costs) and less OpEx (in terms of maintenance), the management remains confident that it can upgrade the guidance as it also has visibility on the pipeline and, to this end, its data protection solutions remains strong. This implies that based on a comparison with Salesforce, ServiceNow, and Workaday, Varonis’ ARR growth could surpass the 20% level as highlighted in black above.
Varonis is a Hold While it Executes on SaaS
However, this is not sufficient a reason to buy the stock as, in addition to ARR growth, other factors to consider are free cash flow and ARR contribution margin. These are trending in a positive direction according to the executives, but, looking at Q3, an ARR contribution margin of above the 8.2% obtained in Q2 would validate the idea that more SaaS revenues are good for the bottomline.
In conclusion, this thesis has shown that the catalysts responsible for Varonis’ recent upside are double-digit ARR growth and Q2’s SaaS mix increasing to 58%, or 23% above the guidance of 35%, which all mean that shifting away from On-prem is progressing rapidly.
Despite this progress, I have a hold position, as any temporary deceleration in the ARR growth, or the SaaS mix not attaining 45% in Q3 could spell volatility for the stock. This risk emanates from the high level of market expectation seen during the recent financial results when the stock gained about 8%. Therefore, it is important to stay tuned to how the non-traditional metrics evolve as per the above table.