Varonis Systems Inc: Form 10-K for the period ended Dec 31, 2024

We were incorporated under the laws of the State of Delaware on November 3, 2004 and commenced operations on January 1, 2005. Our principal offices are located at 1250 Broadway, 28th Floor, New York, NY 10001. For convenience in this report, the terms “Company,” “Varonis,” “we” and “us” may be used to refer to Varonis Systems, Inc. and/or its subsidiaries, except where indicated otherwise. Our telephone number is (877) 292-8767.

Overview

Varonis is a leader in data security as, since we started operations in 2005, we recognized that an enterprise's capacity to create and share data far exceeded its capacity to protect it. We believed that rapid data growth combined with increasing information dependence would change the global economy and the risk profiles of all organizations - from corporations to governmental agencies. Our focus has been on using innovation to address the cyber-implications of these trends, creating software that provides new ways to track, alert and protect data wherever it is stored.

Data continues to grow in new and existing data stores both in the cloud and on-premises, a trend we have seen accelerate as companies worldwide undergo waves of digital transformation and artificial intelligence ("AI") initiatives that have significantly impacted how they must approach data security. While the significant increase of software-as-service (“SaaS”) and infrastructure-as-service (“IaaS”) usage has accelerated workforce collaboration and information technology ("IT") operations, it has also created unprecedented data sprawl and complexity that have contributed to a growing number of catastrophic data breaches.

We believe the adoption of generative artificial intelligence (“Gen AI”) tools will dramatically compound data growth and introduce new data security challenges that can only be addressed with automation. Gen AI-powered productivity features, commonly called “copilots,” are now embedded within applications such as Microsoft 365, Salesforce, Google Workspace, and Box. These tools typically leverage existing data security controls to determine which sensitive information can be used by AI; if an organization’s data security controls are not optimized, they face an increased risk of unintentional data exposure and potential abuse by malicious actors. As organizations customize AI agents (such as Microsoft Copilot Studio and Salesforce Agentforce) and train their own large language models ("LLMs"), we believe additional challenges around the security of training data, models and the underlying infrastructure will require automated solutions.

In addition to data growth, companies face an environment where threat actors continue to refine their strategies to monetize sensitive data and the risk of substantial fines for noncompliance with data-centric regulations continues to grow. At the same time, organizations are seeing a global scarcity of in-house technical expertise, as the demand for cybersecurity professionals significantly outpaces supply, and IT and security experts are under pressure to solve growing problems with fewer resources. We believe that these trends provide us with a long-term opportunity to fulfill our mission of protecting sensitive data for our customers and alleviating the resource pressure and skills shortage that companies face through our automation capabilities and Managed Data Detection and Response ("MDDR") offering.

Enterprises now use many different combinations of data stores and applications, making it difficult to holistically visualize, quantify and control data breach risk without a unified data security platform. We believe our offering's comprehensive data coverage and automation allows organizations to keep pace with the relentless data growth, sprawl and complexity. We started in 2005 with coverage for Windows file shares. Today, we offer coverage for most mission-critical cloud and on-premises data stores, cloud infrastructure environments, identity repositories and many critical SaaS applications. In 2022, we announced the availability of our flagship Varonis Data Security Platform as a SaaS, which offers simpler deployment, faster time-to-value, and groundbreaking automation capabilities that help customers prevent data breaches. Since that time, we have seen SaaS deployments grow significantly and expect them to continue to increase through 2025, when we believe our transition to a SaaS delivery model to be complete.

Varonis software enables enterprises of all sizes and industries to protect data stored in the cloud and on-premises, including: sensitive files, emails and databases; confidential personal data belonging to customers, patients and employees; financial records; source code, strategic and product plans; and other intellectual property. Recognizing the challenge of protecting data with growing volume, velocity and variety, we have built an integrated platform to simplify and streamline data security, threat detection and response and data privacy and compliance.

The Varonis Data Security Platform helps enterprises protect data against cyberattacks from both external and internal threats. Our technology enables enterprises to analyze data, application and account activity and user behavior to help detect and prevent attacks. Varonis prevents or limits unauthorized use of sensitive information, detects and prevents potential cyberattacks and limits potential damage by automatically locking down data, allowing access to only those who need it, and automating the removal of stale data when it is no longer useful.

The Varonis Data Security Platform is driven by a proprietary technology, our Metadata Framework, that extracts critical metadata, or data about data, from an enterprise’s IT infrastructure. Our platform uses this contextual information to map functional relationships among employees, data objects, systems, content and usage. In doing so, our platform provides real-time intelligence about an enterprise’s massive volumes of data, making it more secure, accessible and manageable.

We believe that the (i) Varonis Data Security Platform technology, (ii) coverage for most mission-critical cloud and on-premises data stores and cloud infrastructure environments, identity repositories and many critical SaaS applications and (iii) technical experts within the Company who continue to expand and improve our offering are our primary, hard to replicate competitive advantages. The strength of our solution is driven by several proprietary technologies and methodologies that we have developed, coupled with how we have combined them into our highly versatile platform. Our belief in our technological advantage stems from having developed a way to do each of the following:

• analyze the relationships between users and data with sophisticated algorithms, including cluster analyses and machine learning;
• visualize and depict the analyses in an intuitive manner, including simulating contemplated changes and automatically executing tasks that are becoming increasingly more complex for IT and business personnel;
• identify and automatically classify data as sensitive, critical, private or regulated, to help organizations ensure compliance with regulations, including the General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act ("CCPA");
• automate remediation of excessive access to sensitive information across large data stores and cloud applications to safely ensure a Zero Trust or least privilege model;
• profile users, devices and data to detect suspicious account behavior and unusual file and email activity using deep analysis of metadata, machine learning and user behavior analytics;
• profile cloud configurations and interconnectivity to identify potential exposure and abuse;
• generate meaningful, actionable alerts when security-related incidents are detected;
• enable security teams to investigate and respond to cyber threats more quickly and conclusively with the help of Gen AI;
• automatically respond to severe incidents, such as ransomware, to limit the potential impact and reduce recovery times;
• provide customers live updates to our platform, which address the rapidly evolving threats they face;
• determine relevant metadata and security information to capture without impacting the enterprise's computing and network infrastructure;
• modify and enrich that metadata in a way that makes it comparable and analyzable despite it having originated from disparate IT systems, and create supplemental metadata, as needed, when the existing IT infrastructure’s activity logs are insufficient;
• decipher the key functional relationships of metadata, the underlying data, and its creators; and
• use those functional relationships to create a graphical depiction, or map, of the data that will endure as enterprises continuously add large volumes of data to their network and storage resources.

The broad applicability of our technology has resulted in our customers deploying our software for numerous use cases. These use cases include: automatic discovery and classification of high-risk, sensitive data; data security posture management; SaaS security posture management; automated remediation of over-exposed data; centralized visibility and risk analysis of enterprise data and monitoring of user behavior and file activity; security monitoring and risk reduction; data breach, insider threat, malware and ransomware detection with MDDR; automatic response to ransomware and other severe incidents to limit exposure and reduce recovery times; data ownership identification, assignment, and automatic involvement; forensics, reporting and auditing with searchable logs; meeting security policy and compliance regulation; automatic data migration; cloud migration; automation of retention and disposition policies; automatic data quarantine; intelligent archiving; and automated indexing for data subject requests related to privacy and compliance requirements.

We sell substantially all our products and services to channel partners, including distributors and resellers, which sell to end-user customers, whom we refer to in this report as our customers. Our products are also available to trial and purchase via the Azure Marketplace, AWS Marketplace, and Salesforce AppExchange. We believe that our sales model, which combines the leverage of a channel sales model with our highly trained and professional sales force, has and will continue to play a major role in our ability to grow and successfully deliver our unique value proposition for securing enterprise data. While our products serve customers of all sizes, across all industries and all geographies, the marketing focus and majority of our sales focus is on targeting larger organizations who can make sizable initial purchases with us and, over time, have a greater potential lifetime value. Our customers span leading firms in the financial services, public, healthcare, industrial, insurance, energy and utilities, technology, consumer and retail, education and construction and engineering sectors. We believe our existing customer base is a strong source of future incremental revenues given our broad platform of products, the growing volumes and complexity of their enterprise data and the associated security concerns.

Size of Our Market Opportunity

The International Data Corporation’s Global DataSphere Forecast, 2024-2028, predicts that over the next five years, data will reach approximately 394 zettabytes (or 394 trillion Gigabytes) by 2028, representing a nearly 10x increase compared to 2018. That data will include both structured and unstructured data, but unstructured data overwhelmingly dominates, accounting for approximately 90% of the data created each year. We expect this significant growth to continue creating a need for automation technologies to protect and manage data. We believe that the diverse coverage and functionality offered by our platform positions us well to capitalize on this powerful trend in the digital universe.

Our Technology

Our proprietary technology extracts critical information about an enterprise’s data and its supporting infrastructure, and uses this contextual information, or metadata, to create a functional map of an enterprise’s data and underlying file systems. Our Metadata Framework technology has been architected to process large volumes of enterprise data and related metadata at a massive scale with minimal demands on the existing IT infrastructure. At the end of 2022, Varonis announced the availability of our flagship Varonis Data Security Platform as a SaaS. The benefits of SaaS delivery are widely established for both customers and providers, and we believe this evolution of a SaaS delivery option for the Varonis Data Security Platform is transformational for several reasons: customers are able to more quickly and easily deploy and maintain our solutions with reduced infrastructure and personnel requirements; a lower total cost of ownership; faster deployment of risk assessments, which is the core of our sales motion; enhanced threat detection; continual threat model updates; increased automation for securing data in place; and the ability to deliver additional features and functionality to customers more efficiently. In addition, our MDDR offering further reduces both the likelihood of a breach and its potential impact by enabling automated 24x7x365 monitoring with a service level agreement ("SLA") that ensures Varonis will respond to alerts within a specified time frame. Our MDDR offering is only available for our SaaS customers because of the automation and visibility that’s built into our SaaS platform.

On November 14, 2023, we announced an expansion of our AI and machine learning capabilities with the launch of Athena AI, a new Gen AI layer within the Varonis Data Security Platform. The initial functionality provided by Athena AI includes (i) an AI-powered security operations center (SOC) analyst that combines LLMs with Varonis' unique context about an organization's data, identities, devices and previous alerts to instantly generate tailored alert response playbooks and recommendations and (ii) a natural language search interface that lets users run reports, perform risk analysis and conduct security investigations without any domain-specific knowledge or product expertise.

Key Benefits of Our Technology

We believe our transition to SaaS enhances many of the benefits described below and allows us to deliver additional benefits to customers that our cloud technology unlocks. Varonis has better visibility into customer usage, issues, and behaviors that better inform our innovation; customers seamlessly benefit from continual threat model updates that help them stay ahead of evolving threats; and the SaaS model allows us to deliver additional features and functionality to customers more efficiently.

Automated Data Security

Comprehensive Solution for Managing and Protecting Enterprise Data. Our products enable a broad range of functionality, including AI security, data governance, least privilege and Zero Trust, as well as intelligent retention. Moreover, our solution is applicable across most major enterprise data stores, cloud infrastructure environments and SaaS applications (Windows, UNIX/Linux, Intranets, email systems, Microsoft 365, including SharePoint Online, Teams and OneDrive for Business, Salesforce, AWS, Azure, Google Cloud, Google Workspace, Databricks, ServiceNow, Snowflake, Slack, GitHub, Okta, Box, Jira, Zoom and databases).

Actionable Insight and Automation. Our products help customers identify and prioritize risks to their data and automatically remediate exposures so that they are less vulnerable to internal and external threats, more compliant and consistently follow a least privilege model. Because of the complexity present in even modest enterprises, we believe that effective remediation is impossible at scale without intelligent automation.

Visibility and Data Monitoring Capabilities All in One Place. Our solution combines analysis from disparate on-premises and cloud stores, applications and infrastructure environments and presents them in a single view, even as data storage and user access become more dispersed and complex in hybrid environments.

Fast Time-to-Value and Low Total Cost of Ownership. Our solutions do not require custom implementations or long deployment cycles. Our software can be deployed in under an hour and allows customers to realize real value with minimal effort. Our SaaS architecture enables customers to protect petabyte-scale data environments with little to no infrastructure costs and by leveraging our automation capabilities and MDDR service, customers can significantly reduce their personnel expenses.

Ease of Use. While we utilize complex data structures and algorithms in our data engine, we abstract that complexity to provide a sleek, intuitive interface. Our software is accessible through a standard web browser and requires limited training, saving time and cost and making it accessible to a broader set of users.

Highly Scalable and Flexible Data Engine. Our metadata analysis technology is built to be highly scalable, allowing our customers to analyze vast amounts of enterprise data. Moreover, our proprietary platform is built with a flexible, modern cloud architecture, allowing customers to expand their data coverage seamlessly and transparently without impacting performance.

Threat Detection and Response

Threat Detection and Response with User, Data and System Context. Our solutions combine classification and data access governance with User and Entity Behavior Analytics ("UEBA") on data stores, cloud applications, identity repositories and perimeter devices, including Domain Name System ("DNS"), Virtual Private Network ("VPN") and web proxy, for accurate detection and risk reduction. Our solutions reduce risk relating to unauthorized use and cyberattacks and reduce incident time to detection (TTD) and time to resolution (TTR).

Protect Data from Insider Threats, Data Breaches, Malware and Cyberattacks. Our solutions analyze how employee accounts, service accounts and admin accounts use and access data, profile employees’ roles and file contents, baseline “normal” behavior patterns, and alert on significant deviations from profiled behaviors. Our customers can detect advanced persistent threats ("APTs"), cybercriminals, rogue insiders, attackers that have compromised internal systems and employee accounts, malware, ransomware and other significant threats.

Managed Data Detection and Response. Under a SaaS delivery model, the Varonis incident response and forensics teams can review, triage, and proactively notify customers of any incidents that require their attention. Because Varonis centrally monitors a wide array of customer environments, we can spot patterns across tenants and take action to prevent data breaches and analyze our security team's actions to continually extend our automated capabilities. In 2023, we introduced Proactive Incident Response, a complementary service included in customers' Varonis SaaS subscription. We expanded upon this offering in early 2024 by introducing MDDR, which gives customers the option to upgrade to 24x7x365 monitoring with a SLA that requires Varonis to respond to alerts within a specified time frame.

Compliance

Discover and Identify Regulated Data. Our solutions automatically discover, identify and classify sensitive, critical and regulated data to help meet privacy and compliance requirements.

Monitor and Detect Security Vulnerabilities. Our solutions analyze, monitor, detect and report on potential security vulnerabilities: helping companies achieve compliance by creating full audit trails, achieving a least privilege model and locking down sensitive data to only those who need it, and facilitating breach notification and security investigations. By ensuring the least privilege, monitoring all access and alerting on potential misuse, Varonis enables privacy by design on data stores containing sensitive and regulated information.

Fulfill Data Subject Access Requests ("DSARs") and Protect Consumer Data. Our solutions help fulfill DSARs from file systems on-premises and in the cloud. Customers can easily find relevant files, pinpoint who has access and enforce policies to move and quarantine regulated data.

Our Growth Strategy

Our objective is to be the primary vendor that enterprises turn to protect their data. The following are key elements of our growth strategy.

Extend Our Technological Capabilities Through Innovation and Strategic Transactions. We intend to increase, in absolute dollars, our current level of investment in product development to enhance existing products to address new use cases and continue to deliver new products, including through acquisitions. We believe that the flexibility, sophistication and broad applicability of our platform will allow us to use this framework as the core of numerous future products built on our same core technology. Our ability to leverage our research and development resources has enabled us to create a new product development engine that we believe can proactively identify and solve enterprise needs and help us further penetrate and grow our markets. We will continue to seek additional opportunities to extend our technological capabilities and grow our business, from continued organic investments in our research and development efforts to technological acquisitions.

Grow Our Customer Base. The unabated rise in enterprise data, ubiquitous reliance on digital collaboration and increased cybersecurity concerns continue to drive demand for data protection, compliance and threat detection and response solutions. We intend to capitalize on this demand by targeting new customers, underpenetrated markets and use cases for our solutions. Our solutions address the needs of customers of all sizes, ranging from small and medium-sized businesses to large multinational companies with hundreds of thousands of employees and petabytes of data. Although our solutions apply to organizations of all sizes, we have and will continue focusing on targeting larger organizations that can make larger purchases with us initially and over time.

Increase Sales to Existing Customers. We believe significant opportunities exist to further expand relationships with existing customers. Data growth and related security concerns continue across all data stores, and enterprises want to standardize solutions that help them manage, protect and extract more value from their data, wherever it is stored. We expect to continue to drive incremental sales from our existing customers through the increased use of our software within our installed base by expanding our footprint and usage. We believe our existing customer base is a strong source of future incremental revenues given our broad product functionality, the growing volume and complexity of enterprise data and the associated security concerns. As we continue to innovate by addressing more use cases, adding more data coverage, and providing automated data security outcomes to customers, we expect to see broader and stickier adoption of our platform. In addition, our transition to a SaaS delivery model provides us with a unique opportunity to convert existing customers to our SaaS offering. Our renewal rate for the year ended December 31, 2024 continued to be over 90%. Our key strategies to ensure a high renewal rate for our products include focusing on the quality and reliability of our customer service and support teams and providing software upgrades and enhancements when available.

Grow Sales from Our New Products and Functionality. We continue introducing additional products and enhancements to existing products to support new functionalities and believe these can also be a meaningful contributor to our growth. In October 2020, we announced the acquisition of Polyrize Security Ltd. ("Polyrize"), whose technology was used for the launch of DatAdvantage Cloud which provides support for cloud applications and infrastructure, including Salesforce, AWS, Azure, Google Cloud, Google Workspace, Databricks, ServiceNow, Snowflake, Slack, GitHub, Okta, Box, Jira, Zoom and databases. At the end of 2022, we announced the availability of our flagship Varonis Data Security Platform as a SaaS, which was previously only sold as a self-hosted solution. Additionally, in 2024 we began offering MDDR to our SaaS customers, which further reduces both the likelihood of a breach and its potential impact by enabling automated 24x7x365 monitoring with a SLA that requires Varonis to respond to alerts within a specified time frame.

Expand Our Sales Force. Continuing to expand our sales force will be essential to achieving our customer base expansion goals. Our approach to in-house development of sales representatives has been key to our successful growth in the past and will be central to our growth plan in the future. While our products serve customers of all sizes, across all industries and all geographies, the marketing focus and majority of our sales focus is on targeting larger organizations who can make sizable initial purchases with us and, over time, generate a greater potential lifetime value. Our customers span leading firms in the financial services, public, healthcare, industrial, insurance, energy and utilities, technology, consumer and retail, education and construction and engineering sectors. We also believe our existing customers represent significant future revenue opportunities for us. We believe that our sales model, which combines the leverage of a channel sales model with our highly trained and professional sales force to efficiently identify leads, perform risk assessments and convert them to satisfied customers, has and will continue to play a major role in our ability to grow and to successfully deliver our unique value proposition for enterprise data.

Establish Our Data Security Platform as the Industry Standard. We have worked with several of the leading providers of NAS and hybrid cloud storage, including Dell/EMC, IBM and NetApp, as well as the major cloud service providers such as Microsoft, Amazon, Google and Salesforce to expand our market reach and deliver enhanced functionality to our customers. We have worked with these vendors to ensure compatibility with their product lines. Using application programming interfaces (APIs), and other integration work, our solutions also integrate with many providers of solutions in the ecosystem. We will continue to pursue such collaborations wherever they advance our strategic goals, thereby expanding our reach and establishing our platform as the de facto industry standard for enterprise data.

Continue International Expansion. We believe there is a significant opportunity for our platform to address the need for data protection and threat detection and response in international markets. Revenues from Europe, the Middle East and Africa (“EMEA") accounted for 21% and revenues from Rest of World (“ROW”) accounted for 6% of our revenues in 2024. We believe that international expansion will be a key component of our growth strategy, and we will continue to invest and market our products and services overseas.

Our Products

With the introduction of our flagship Varonis Data Security Platform as a SaaS, we are transitioning away from selling on-premises subscription licenses. Our SaaS offering is sold as a platform license, providing the functionality of multiple core modules in a single license. Our on-premises subscription licenses, on the other hand, offers an array of modules that customers can purchase individually or as a bundle.

Software-as-a-Service ("SaaS")

Our SaaS product portfolio currently includes two product lines: (1) our flagship Varonis Data Security Platform, which protects Microsoft 365, Windows file shares, Active Directory, Edge devices (VPN, DNS, proxy), UNIX/Linux and hybrid NAS storage, and (2) DatAdvantage Cloud, which protects IaaS environments and SaaS applications such as Salesforce, AWS, Azure, Google Cloud, Google Workspace, Databricks, ServiceNow, Snowflake, Slack, GitHub, Okta and Box, Jira, Zoom and databases.

• Varonis Data Security Platform. The success of our license bundles under the on-premises subscription ("OPS") model demonstrated that customers want to utilize and benefit from the majority of Varonis’ core functionality from the start. We know that customers who utilize a higher number of licenses see more value upfront through automation and synergy between modules. Therefore, we drastically simplified our subscription licensing under SaaS, combining five of our most popular licenses into a single Varonis Data Security Platform license. The Varonis Data Security Platform SaaS license will include, by default, the functionality of five core modules: DatAdvantage, DatAlert, Automation Engine, Data Classification Engine and Data Classification Policy Pack. We will no longer refer to these licenses by name; rather, they will be considered built-in functionality of the Varonis Data Security Platform SaaS license. In addition to the functionality mentioned above, the Varonis Data Security Platform SaaS license includes new capabilities not available in our self-hosted product suite. Today, the Varonis Data Security Platform SaaS license includes:
• Data security posture management ("DSPM"). Provides customers with real-time visibility of their data security posture across their multi-cloud and on-premises data, helps prioritize remediation efforts, and tracks progress over time.
• Data access intelligence. Combines data sensitivity, permissions, and activity to show customers who has access to critical data (i.e., their data blast radius), how they got access, and whether access is necessary.
• Data discovery & classification. Automatically and continuously scans the contents of files, folders, and other objects to determine sensitivity with a high degree of accuracy and precision.
• Discovery policy library. A frequently updated library for identifying and classifying personal information specific to GDPR, CCPA, and US federal controlled unclassified information (CUI).
• Least privilege automation. Automatically and continuously remediates excessive data access granted via shared links, direct permissions, and group memberships without manual effort and without impacting business continuity.
• Data activity monitoring. Gives customers a real-time view into who is accessing data directly or through AI (such as copilots) via a normalized and enriched log of data-centric events such as create, open, read, move, modify, and delete. Varonis also tracks, among other things, permission changes, authentication events, password updates and shared link activity.
• Data detection and response. Provides high-fidelity, data-centric alerts and automated response actions. Includes a web-based alerts dashboard and investigative interface, and seamlessly integrates with security information and event management systems (SIEM).
• User & entity behavior analytics. Profiles users and devices and their associated behaviors with respect to systems and data, detects and alerts on meaningful deviations that indicate compromise. New UEBA threat models are automatically delivered to customers to guard against evolving tactics used by cybercriminals, insiders and advanced persistent threats (APTs).

Varonis Data Security Platform SaaS customers can decide which data stores, applications, and infrastructure environments they want to protect by purchasing “Protection Packages.” Our SaaS platform supports every resource covered by our self-hosted version, and we believe our SaaS architecture will allow us to move quickly to add support for new resources. Additionally, SaaS customers can purchase MDDR which further reduces both the likelihood of a breach and its potential impact by enabling automated 24x7x365 monitoring with a SLA that requires Varonis to respond to alerts within a specified time frame.

The Protection Packages currently available for the Varonis Data Security Platform SaaS are:

• Microsoft 365. Includes support for SharePoint Online, OneDrive for Business, Microsoft Teams, and Entra ID (formerly known as Azure AD). Customers can purchase add-on support for Exchange Online and Microsoft 365 Copilot.
• Windows & NAS. Includes support for Windows/CIFS-based file shares and NAS storage such as Nutanix, Nasuni, Panzura, Pure Storage, NetApp and Dell EMC. Customers can purchase add-on support for on-premises Active Directory, UNIX/Linux and Edge devices (VPN, DNS, proxy).
• Hybrid. Combined support for the protected resources in the Microsoft 365 and Windows & NAS packages.
• Varonis DatAdvantage Cloud. DatAdvantage Cloud is a SaaS platform that helps organizations protect data across SaaS applications and IaaS environments. DatAdvantage Cloud offers functionality similar to our flagship Varonis Data Security Platform including, but not limited to, data security posture management, SaaS security posture management, data classification, data access intelligence, data activity monitoring, data detection and response, and least privilege automation. The protected resources currently available for DatAdvantage Cloud are Salesforce, AWS, Azure, Google Cloud, Google Worskpace, Databricks, ServiceNow, Snowflake, Slack, GitHub, Okta, Box, Jira, Zoom and databases.

On-Premises Subscription

Our self-hosted product licenses utilize our core technology to deliver features and functionality that allow enterprises to fully understand, secure and benefit from the value of their data. This architecture gives our clients the ability to select the features they require for their business needs and the flexibility to expand their usage simply by adding a license, and the fully integrated nature of our products allows individual products to enhance the functionality of the others.

• DatAdvantage. DatAdvantage, our flagship product, captures, aggregates, normalizes and analyzes every data access event for every user on Windows and UNIX/Linux servers, storage devices, email systems, Intranet servers, cloud applications and data stores, without requiring native operating system auditing functionalities or impacting performance or storage on file systems.
• DatAlert. DatAlert profiles users and devices and their associated behaviors with respect to systems and data, detects and alerts on meaningful deviations that indicate compromise and seamlessly integrates with security information and event management systems (SIEM).
• Data Classification Engine. Data Classification Engine identifies and tags data based on criteria set in multiple metadata dimensions and provides business and IT personnel with actionable intelligence about this data.
• DataPrivilege. DataPrivilege provides a self-service web portal that allows users to request access to data necessary for their business functions and allows owners to review accessibility.
• Data Transport Engine. Data Transport Engine provides an execution engine that unifies the manipulation of data and metadata, translating business decisions and instructions into commands, such as data migration or archiving.
• DatAnswers. DatAnswers provides a secure, relevant and timely search functionality for enterprise data and helps companies comply with data privacy regulations, eDiscovery requests and to facilitate data subject access requests.

Our Customers

We currently have customers in over 95 countries. Our customers span numerous industries and vary greatly in size, ranging from small and medium businesses to large multinational enterprises and government agencies. Our customers include leading firms in the financial services, public, healthcare, industrial, insurance, energy and utilities, technology, consumer and retail, education and construction and engineering sectors, with hundreds of thousands of employees and petabytes of data.

Services

Maintenance and Support of Subscription and Perpetual Licenses

Maintenance and support associated with a term license subscription is included in the Term license subscriptions revenue line of the statement of operations. Maintenance and support associated with past perpetual licenses is included in the Maintenance and services line of the statement of operations. These maintenance agreements provide customers the right to receive support and unspecified upgrades and enhancements when and if they become available during the maintenance period and access to our technical support services. Our renewal rate for 2024 continued to be over 90%. Due to the transition to a SaaS delivery model, we expect maintenance and support revenues related to term license subscriptions to continue to decline. Additionally, we do not expect perpetual license revenues in the future and, accordingly, we expect the associated maintenance and support to continue to decline.

We maintain a customer support organization that provides all levels of support to our customers. Our customers that purchase maintenance and support services receive guaranteed response times, direct telephonic support and access to online support portals. Our customer support organization has global capabilities with expertise in both our software and complex IT environments and associated third-party infrastructure.

Professional Services

While users can easily deploy our software on their own, certain enterprises use our professional service team to provide fee-based services, which include training our customers in the use of our products, providing advice on network design, product configuration and implementation, automating and customizing reports and tuning policies and configuration of our products for the particular characteristics of the customer’s environment. Although professional services have always been a small percentage of our total revenues, we have recently seen, and expect to continue to see, that percentage decline as many of our newer licenses can provide remediation in more automated ways.

Sales and Marketing

Sales

We sell substantially all of our products and services to a global network of resellers and distributors that we refer to as our channel partners. Our channel partners, in turn, sell the products they purchase from us to customers. In addition, we maintain a highly trained professional sales force that is responsible for overall market development, including the management of the relationships with our channel partners and supporting channel partners in winning customers through operating demonstrations and risk assessments. Our channel partners identify potential sales targets, maintain relationships with customers and introduce new products to existing customers. Sales to our channel partners are generally subject to our standard, non-exclusive channel partner agreement. These agreements are generally for a term of one year with an automatic renewal of successive one-year periods and can be terminated by us or the channel partner for any reason upon 30 days’ notice. A termination of the agreement has no effect on orders already placed. Payment to us from the channel partner is typically due within 30 to 60 calendar days of the invoice date.

Marketing

Our marketing strategy focuses on building our brand and product awareness, increasing customer adoption and demand, communicating advantages and business benefits as well as generating leads for our channel partners and sales force. We market our software as the Varonis Data Security Platform, a solution for securing and managing enterprise data. We execute our marketing strategy by leveraging a combination of internal marketing professionals, external marketing partners and a network of regional and global channel partners. Our marketing organization is responsible for branding, content creation, demand generation, field marketing and product marketing, and works with our business operations team to support channel marketing and sales support programs. We provide one-on-one and community education and awareness and promote the expanded use of our software. We host in-person or virtual Varonis Connect! customer events across sales regions, as well as free, online technical webinars across multiple regions. We focus our efforts on highly relevant content, events, campaigns and activities that can be leveraged by our channel partners worldwide to extend our marketing reach, such as information regarding product awards and technical certifications, security training, regional seminars and conferences, webinars, podcasts and various other demand-generation activities. Our marketing efforts also include public relations across multiple regions, industry analyst relations, customer marketing, account-based marketing, targeted advertising, extensive content development available through our website and content syndication, and our active blog.

Research and Development

Our research and development efforts are focused primarily on improving and enhancing our existing products, as well as expanding our platform to cover new sources of data and developing new products. Use of our products has expanded beyond just data security into threat detection and response, data privacy and data lifecycle management, and we anticipate that customer demand and innovation will drive functionality into additional areas. We regularly release updates to our products which incorporate new features and enhancements to existing ones. We conduct the majority of our research and development activities in Israel, and we believe this provides us with access to world-class engineering talent. In addition, we continue to seek opportunities to extend our technological capabilities and grow our business from strategic technological acquisitions.

Intellectual Property

We attempt to protect our technology and the related intellectual property under patent, trademark, copyright and trade secret laws, confidentiality procedures and contractual provisions. No single intellectual property right is solely responsible for protecting our products. The nature and extent of legal protection of our intellectual property rights depends on, among other things, its type and the jurisdiction in which it arises. As of December 31, 2024, we had 89 issued patents and 31 pending patent applications in the United States. Our issued U.S. patents expire between 2025 and 2042. We also had 76 patents issued and 34 applications pending for examination in non-U.S. jurisdictions, and 18 pending Patent Cooperation Treaty (“PCT”) patent applications, all of which are counterparts of our U.S. patent applications. The claims for which we have sought patent protection relate primarily to inventions we have developed for incorporation into our products.

In addition to patented technology, we rely on our unpatented proprietary technology and trade secrets. We generally enter into confidentiality agreements with our employees, consultants, service providers, vendors and customers and generally limit internal and external access to, and distribution of, our proprietary information and proprietary technology through certain procedural safeguards. We also rely on invention assignment agreements with our employees, consultants and others, to assign to the Company all inventions developed by such individuals in the course of their engagement with the Company.

Moreover, we have registered the “Varonis” name and logo and “DatAdvantage,” “DataPrivilege,” “DatAlert,” and other names in the United States and, as related to some of these names, certain other countries.

In addition to Company-owned intellectual property, we license software from third parties for integration into our solution, including open-source software and other software available on commercially reasonable terms. It may be necessary in the future to seek or renew licenses relating to various aspects of our products, processes and services. While we have generally been able to obtain such licenses on commercially reasonable terms in the past, such third parties may not continue to maintain such software or continue to make it available to us.

Seasonality

See Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations — Seasonality and Quarterly Trends.”

Competition

While there are some companies which offer features similar to those embedded in our platform, we believe that we do not currently compete with a company that offers comparable depth of functionality, scalability, or support for the number of data stores, applications and infrastructure environments that we cover. Nevertheless, we do compete against a select group of software vendors when the scope of a purchase is limited to a specific use case, such as DSPM, data discovery and classification, data privacy, data migration, data subject access requests and/or Active Directory security.

As we continue to augment our functionality with AI security, insider threat detection and user behavior analytics and as we expand our classification capabilities to better serve compliance needs with new regulations, and as these functionalities continue to be recognized as critical to protect enterprise data, we may face increased perceived and real competition from other data security and privacy technologies. In the future, as customer requirements evolve and new technologies are introduced, we may experience increased competition if established or emerging companies develop solutions that address the enterprise data market. Furthermore, because we operate in an evolving market, we anticipate that competition will increase based on customer demand for these types of products.

A number of factors influence our ability to compete in the markets in which we operate, including, without limitation: the continued reliability and effectiveness of our products’ functionalities; the breadth and completeness of our solutions’ features; the scalability of our solutions; and the ease of deployment and use of our products. We believe that we generally compete favorably in each of these categories. We also believe that we distinguish ourselves from others by delivering an integrated solution and sophisticated automation to address our customers’ needs regarding data security, threat detection and response, data privacy and retention. However, we may not be able to remain unique in this capacity or continue to be able to compete favorably with other providers in the future.

If a more established company were to target our market, we may face significant competition. They may have competitive advantages, such as greater name recognition, larger sales, marketing, research and acquisition resources, access to larger customer bases and channel partners, a longer operating history and lower cloud labor and development costs, all of which may enable them to respond more quickly to new or emerging technologies and changes in customer requirements or to devote greater resources to the development, promotion and sale of their products than we do. Increased competition could result in us failing to attract customers or maintain renewals and licenses at the same rate. It could also lead to price cuts, alternative pricing structures or the introduction of products available for free or a nominal price, reduced gross margins, longer sales cycles and loss of market share.

In addition, our current or prospective channel partners may establish cooperative relationships with any future competitors. These relationships may allow future competitors to rapidly gain significant market share. Such developments could also limit our ability to generate revenues from existing and new customers. If we are unable to compete successfully against current and future competitors, our business, results of operations and financial condition may be harmed.

Employees and Human Capital Resources

As of December 31, 2024, we had 2,406 employees and independent contractors who developed, marketed, sold and supported our technology solutions, including 1,081 in the United States, 844 in Israel and 481 in other countries.

We understand that our innovation leadership is ultimately rooted in our people. Competition for qualified personnel in the technology space is intense, and our success depends in large part on our ability to recruit, develop and retain a productive and engaged workforce. Accordingly, investing in our employees and their well-being, offering competitive compensation and benefits, promoting diversity and inclusion, adopting effective human capital management practices and community outreach constitute core elements of our corporate strategy.

• Offer Competitive Compensation and Benefits. We strive to ensure that our employees receive competitive and fair compensation and innovative benefit offerings, tying incentive compensation to both business and individual performance, offering competitive maternal and paternal leave policies, providing meaningful retirement and health benefits and maintaining an employee stock purchase plan.
• Support Employee Well-being and Engagement. We support the overall well-being of our employees from a physical, emotional, financial and social perspective. Our global well-being programs include a long-standing practice of remote working arrangements, flexible paid time off, life planning benefits, wellness platforms and employee assistance. In addition, we ensure ongoing check-ins with employees by HR and managers to provide additional channels of support. We also regularly seek input from employees, including through broad employee satisfaction and pulse surveys on specific issues, intended to assess our degree of success in promoting an environment where employees are engaged, satisfied, productive and possess a strong understanding of our business goals.
• Promote Sense of Belonging. We conduct code of conduct trainings with employees and managers to share our views on the importance of respecting all individuals and creating a culture where everyone feels they belong. We have Employee Resource Groups, led by our employees, designed to foster connection, understanding and support. Our customers are located in over 95 countries and our global workforce operates across cultures, functions, language barriers and time zones to provide them dedicated and ongoing support.
• Provide Programs for Employee Recognition. We offer rewards and recognition programs to our employees, including awards to recognize employees who best exemplify our values and spot awards to recognize employee contributions. We believe that these recognition programs help drive strong employee performance. We conduct semi-annual employee performance reviews, where each employee is evaluated by their personal manager and also conducts a self-assessment, a process which empowers our employees. Employee performance is assessed based on a variety of key performance metrics, including the achievement of objectives specific to the employee’s department or role. Employees have access to an internal platform to recognize their peers based on their professional and socially responsible contributions to the Company.
• Create Opportunities for Growth and Development. We focus on creating opportunities for employee growth, development, training and education, including opportunities to cultivate talent and identify candidates for new roles from within the company, as well as management and leadership development programs. Employee training and education includes online certification, in person certification and new hire training bootcamps. We also conduct manager training programs on an annual basis, which include in-depth managerial and coaching skills, as well as tailored feedback. We have established an internal mentoring program in which seasoned employees mentor new managers based on defined goals.
• Promote Community Outreach and Support. We believe it is important to give back and promote community outreach and support through corporate giving and employee volunteerism in the communities in which we live and work. We partner with several organizations providing life skills trainings, coding and basic IT skills, financial literacy and more. All programs are led by our employees on a volunteering basis. We also provide corporate matching of employee charitable donations and flexible volunteering during work time, letting our employees know that we support the charitable efforts that matter to them.

Available Information

Our website is located at www.varonis.com (http://www.varonis.com), and our investor relations website is located at https://ir.varonis.com. The information posted on our website is not incorporated into this Annual Report on Form 10-K. Our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and amendments to reports filed or furnished pursuant to Sections 13(a) and 15(d) of the Exchange Act are available free of charge on our investor relations website as soon as reasonably practicable after we electronically file such material with, or furnish it to, the Securities and Exchange Commission (the “SEC"). You may also access all of our public filings through the SEC’s website at www.sec.gov (http://www.sec.gov).

Investors and other interested parties should note that we use our media and investor relations website and our social media channels to publish important information about us, including information that may be deemed material to investors. We encourage investors and other interested parties to review the information we may publish through our media and investor relations website and the social media channels listed on our media and investor relations website, in addition to our SEC filings, press releases, conference calls and webcasts.

Investing in our securities involves risk. You should carefully consider the following risks and all other information contained herein, including our consolidated financial statements and the related notes thereto. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, also may become important factors that affect us. If any of the following risks materialize, our business, financial condition and results of operations could be materially harmed.

Risks Related to the Industry in which we Operate

The market for software that analyzes, secures, governs, manages and migrates enterprise data may not continue to grow or grow at the same pace.

We believe our future success depends in large part on the continued growth of the market for software that enables enterprises to analyze, secure, govern, manage and migrate their data. In order for us to market and sell our products, we must successfully demonstrate to enterprise IT, security and business personnel the risk of their valuable data getting compromised or stolen and the effectiveness of our products to mitigate these risks. Despite a number of high-profile cyberattacks around the world, we must still persuade customers to devote a portion of their budgets to a unified platform that we offer to analyze, secure, govern, manage and extract value from this resource. Enterprises may not recognize the need for our products or, if they do, may not decide that they need a solution that offers the range of functionalities that we offer. The market for our solution may not continue to grow at its current rate or at all and the failure of the market to continue to develop would materially adversely impact our results of operations.

Prolonged economic uncertainties or downturns could materially adversely affect our business.

Our business depends on our current and prospective customers’ ability and willingness to invest in IT services, including cybersecurity projects, which in turn is dependent upon their overall economic health. Negative conditions in the general economy both in the United States and abroad, including inflationary pressure, currency fluctuations and a higher interest rate environment, changes in gross domestic product growth, instability in connection with political elections, potential future government shutdowns, the federal government’s failure to raise the debt ceiling, financial and credit market fluctuations, the imposition of trade barriers and restrictions such as tariffs, political deadlock, restrictions on travel, natural catastrophes, warfare and terrorist attacks, could cause a decrease in business investments, including corporate spending on enterprise software in general and negatively affect the rate of growth of our business. For example, our operations, and the operations of our customers and partners, were affected by geopolitical turmoil and sanctions caused by the war between Russia and Ukraine, and the COVID-19 pandemic and efforts to control its spread, including by mandatory business closures and capacity limitations imposed by the jurisdictions in which we operate. Similar events and restrictions in the future could negatively affect our business.

Uncertainty in the global economy makes it extremely difficult for our customers and us to forecast and plan future business activities accurately. This could cause our customers to reevaluate decisions to purchase our product or to delay their purchasing decisions, which could lengthen our sales cycles and negatively impact our results. In recent years, the European economy experienced economic turmoil that caused the devaluation of local European currencies (specifically, the Euro and the Pound Sterling), inflationary pressures and general economic uncertainty. As a result, there has been, and may in the future be, budgetary tightening and longer sales cycles in the region which may negatively impact our results of operations. The United States could also experience a sustained period of elevated inflation, which may put pressure on discretionary spending by our customers, and a lengthening of our sales cycle in the region, which could negatively impact our results.

A downturn in any of our leading industries, or a reduction in any revenue-generating vertical, may cause enterprises to react to worsening conditions by reducing their spending on IT. Customers may delay or cancel IT projects, choose to focus on in-house development efforts or seek to lower their costs by renegotiating maintenance and support agreements. To the extent purchases of our software are perceived by customers and potential customers to be discretionary, our revenues may be disproportionately affected by delays or reductions in general IT spending. In addition, consolidation in certain industries may result in reduced spending on our software. If the economic conditions of the general economy or industries in which we operate worsen from present levels, our business, results of operations and financial condition could be adversely affected.

Overall economic uncertainty may in the future give rise to a number of risks, including, but not limited to, the following:

• reduced economic activity could lead to a prolonged recession, which could negatively impact spending by our customers or the ability of customers to pay for our services;
• not meeting expectations with respect to certain key performance metrics, such as renewal rates and annual recurring revenues;
• our ability to enter into new markets and to acquire new customers;
• an increase in bad debt reserves as customers face economic hardship and collectability becomes more uncertain, including the risk of bankruptcies;
• variability with forward-looking guidance and financial results, including management’s accounting estimates and assumptions; and
• our ability to raise capital.

The challenges posed by and the full impact of negative conditions in the general economy on our business and our future performance are difficult to predict and there is a risk that any guidance we provide to the market may turn out to be incorrect.

We may face increased competition in our market.

While there are some companies which offer certain features similar to those embedded in our solutions, as well as others with whom we compete in certain tactical use cases, we believe that we do not currently compete with a company that offers the same breadth of functionalities on the number of platforms and applications that we cover. Nevertheless, we do compete against a select group of software vendors that provide standalone solutions, similar to those found in our comprehensive software suite, in the specific markets in which we operate. We also face direct competition with respect to certain use cases, specifically DSPM, data discovery and classification, privacy, data migration, data subject access requests and Active Directory security. As we continue to augment our functionality with AI security, insider threat detection and user behavior analytics and as we expand our classification capabilities to better serve compliance needs, such as General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act ("CCPA") and other data privacy laws, we may face increased perceived and real competition from other security and classification technologies. As we expand our coverage and penetration in the cloud, we may face increased perceived and real competition from other cloud-focused technologies. In the future, as customer requirements evolve and new technologies are introduced, we may experience increased competition if established or emerging companies develop solutions that address the enterprise data market. Furthermore, because we operate in an evolving area, we anticipate that competition will increase based on customer demand for these types of products.

In particular, if a more established company were to target our market, we may face significant competition. They may have competitive advantages, such as greater name recognition, larger sales, marketing, research and acquisition resources, access to larger customer bases and channel partners, a longer operating history and lower labor and development costs, which may enable them to respond more quickly to new or emerging technologies and changes in customer requirements or devote greater resources to the development, promotion and sale of their products than we do. Increased competition could result in us failing to attract customers or maintain licenses at the same rate. It could also lead to price cuts, alternative pricing structures or the introduction of products available for free or a nominal price, reduced gross margins, longer sales cycles, lower renewal rates and loss of market share.

In addition, our current or prospective channel partners may establish cooperative relationships with future competitors. These relationships may allow future competitors to rapidly gain significant market share. These developments could also limit our ability to obtain revenues from existing and new customers.

Our ability to compete successfully in our market will also depend on a number of factors, including ease and speed of product deployment and use, the quality and reliability of our customer service and support, total cost of ownership, return on investment and brand recognition. Any failure by us to successfully address current or future competition in any one of these or other areas may reduce the demand for our products and adversely affect our business, results of operations and financial condition.

We are subject to a number of legal requirements, contractual obligations and industry standards regarding security, data protection and privacy, and any failure to comply with these requirements, obligations or standards could have an adverse effect on our reputation, business, financial condition and operating results.

Privacy and data information security have become a significant issue in the United States and in many other countries where we have employees and operations and where we offer licenses to our products. The regulatory framework for privacy and personal information security issues worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. The U.S. federal and various state and foreign government bodies and agencies have adopted or are considering adopting laws and regulations limiting, or laws and regulations regarding, the collection, distribution, use, disclosure, storage and security of personal information. For example, the CCPA, which went into effect on January 1, 2020, applies to personal data of consumers, business representatives, and employees who are California residents, and requires, among other things, covered companies to provide specific disclosures to California consumers and afford such consumers new abilities to exercise certain privacy rights, including opting out of certain sales of personal information. Consumer rights and obligations under the CCPA were expanded by the California Privacy Rights Act ("CPRA") on November 3, 2020. The CPRA took effect on January 1, 2023, along with the Virginia Consumer Data Protection Act; the Colorado Privacy Act and Connecticut Act Concerning Personal Data Privacy and Online Monitoring took effect on July 1, 2023, and the Utah Consumer Privacy Act took effect on December 31, 2023. In the past few years, numerous other U.S. states have enacted comprehensive privacy laws, and we expect more states to pass similar laws in the future. These laws impose similar obligations on businesses with regard to the use, disclosure and security of personal information, and grant additional rights in that personal information to consumers.

Internationally, virtually every jurisdiction in which we operate has established its own data security and privacy legal framework with which we or our customers must comply. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure and security of data that identifies or may be used to identify or locate an individual, such as names, email addresses and, in some jurisdictions, Internet Protocol addresses. These laws and regulations often are more restrictive than those in the United States and are rapidly evolving. For example, the European Union’s (“EU”) data protection regime, the GDPR, became enforceable on May 25, 2018. Additionally, the United Kingdom ("UK") has enacted legislation that substantially implements the GDPR, but the United Kingdom’s exit from the EU (which formally occurred on January 31, 2020), commonly referred to as “Brexit,” has created uncertainty with regard to the regulation of data protection in the United Kingdom. Although there are currently various mechanisms that may be used to transfer personal data from the European Economic Area ("EEA") and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. Complying with the GDPR or other laws, regulations or other obligations relating to privacy, data protection or information security may cause us to incur substantial operational costs or require us to modify our data handling practices. Non-compliance could result in proceedings against us by governmental entities or others, could result in substantial fines or other liability, and may otherwise adversely impact our business, financial condition and operating results.

Some statutory requirements, both in the United States and abroad, include obligations of companies to notify individuals of security breaches involving particular personal information, which could result from breaches experienced by us or our service providers. Even though we may have contractual protections with our service providers, a security breach could impact our reputation, harm our customer confidence, hurt our sales or cause us to lose existing customers and could expose us to potential liability or require us to expend significant resources on data security and in responding to such breach.

In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards that either legally or contractually apply to us. We also expect that there will continue to be new proposed laws and regulations concerning privacy, data protection and information security, and we cannot yet determine the impact such future laws, regulations and standards may have on our business. New laws, amendments to or re-interpretations of existing laws and regulations, industry standards, contractual obligations and other obligations may require us to incur additional costs and restrict our business operations. Because the interpretation and application of laws and other obligations relating to privacy and data protection are still uncertain, it is possible that these laws and other obligations may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the features of our software. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our software, which could have an adverse effect on our business. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new features could be limited. Any inability to adequately address privacy concerns, even if unfounded, or comply with applicable privacy or data protection laws, regulations and policies could result in additional cost and liability to us, damage our reputation, inhibit sales and adversely affect our business.

Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations and policies that are applicable to the businesses of our customers may increase the costs associated with, limit the use and adoption of, and reduce the overall demand for, our products. Privacy and personal information security concerns, whether valid or not valid, may inhibit market adoption of our products particularly in certain industries and foreign countries.

Risks Related to Our Operations

Security breaches, cyberattacks or other cyber-risks of our IT and production systems could expose us to significant liability and cause our business and reputation to suffer and harm our competitive position.

Our corporate infrastructure stores and processes our sensitive, proprietary and other confidential information (including as related to financial, technology, employees, marketing, sales, etc.) which is used on a daily basis in our operations. In addition, our software involves transmission and processing of our customers’ confidential, proprietary and sensitive information. We have legal and contractual obligations to protect the confidentiality and appropriate use of customer data. As a leader in the cyber industry, we may be an attractive target for cyber attackers or other data thieves.

High-profile cyberattacks and security breaches have increased in recent years, with the potential for such acts heightened as a result of the number of employees working remotely due to many companies adopting a hybrid working model. Security industry experts and government officials have warned about the risks of hackers and cyberattacks targeting IT products and enterprise infrastructure. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and often are not recognized until launched against a specific target, we may be unable to anticipate these techniques or to implement adequate preventative measures. As we continue to increase our client base and expand our brand, we may become more of a target for third parties seeking to compromise our security systems and we anticipate that hacking attempts and cyberattacks will increase in the future. We may not always be successful in preventing or repelling unauthorized access to our systems. We also may face delays in our ability to identify or otherwise respond to any cybersecurity incident or any other breach. Additionally, we use third-party service providers to provide some services to us that involve the cloud hosting, storage or transmission of data, such as SaaS, cloud computing, and internet infrastructure and bandwidth, and they face various cybersecurity threats and also may suffer cybersecurity incidents or other security breaches. Despite our security measures, our IT and infrastructure may be vulnerable to attacks. Threats to IT security can take a variety of forms. Individual and groups of hackers and sophisticated organizations, including state-sponsored organizations or nation-states, continuously undertake attacks that pose threats to our customers and our IT. These actors may use a wide variety of methods, which may include developing and deploying malicious software or exploiting vulnerabilities in hardware, software, or other infrastructure in order to attack our products and services or gain access to our networks, using social engineering techniques to induce our employees, users, partners, or customers to disclose passwords or other sensitive information or take other actions to gain access to our data or our users’ or customers’ data, or acting in a coordinated manner to launch distributed denial of service or other coordinated attacks. Inadequate account security practices may also result in unauthorized access to confidential and/or sensitive data or loss of SaaS platform availability.

Security risks, including, but not limited to, unauthorized use or disclosure of customer data, loss of availability of our SaaS platform offering, cyberattack on our cloud providers, theft of proprietary information, theft of intellectual property, theft of internal employee’s PII/PHI information, theft of financial data and financial reports, loss or corruption of customer data and computer hacking attacks or other cyberattacks, could require us to expend significant capital and other resources to alleviate the problem and to improve technologies, may impair our ability to provide services to our customers and protect the privacy of their data, may result in product development delays, may compromise confidential or technical business information, may harm our competitive position, may result in theft or misuse of our intellectual property or other assets and could expose us to substantial litigation expenses and damages, indemnity and other contractual obligations, government fines and penalties, mitigation expenses, costs for remediation and incentives offered to affected parties, including customers, other business partners and employees, in an effort to maintain business relationships after a breach or other incident, and other liabilities. We are continuously working to improve our IT systems, together with creating security boundaries around our critical and sensitive assets. We provide advanced security awareness training to our employees and contractors that focuses on various aspects of the cybersecurity world. All of these steps are taken in order to mitigate the risk of attack and to ensure our readiness to responsibly handle any security violation or attack. If an actual or perceived breach of our security occurs, the market perception of the effectiveness of our security measures and our products could be harmed, we could lose potential sales and existing customers, our ability to operate our business could be impaired, we may incur significant liabilities, we could suffer harm to our reputation and competitive position, and our operating results could be negatively impacted.

The expansion of cloud-delivered services introduces a number of risks and uncertainties, which could adversely affect our business, results of operations and financial condition.

The launch of our cloud offerings that allow customers to use hosted software required, and any future expansion of our cloud-delivered services may require, a considerable investment in resources, including technical, financial, legal, sales, information technology and operation systems. Additionally, market acceptance of such offerings is affected by a variety of factors, including but not limited to: security, reliability, scalability, customization, performance, current license terms, customer preference, customer concerns with entrusting a third-party to store and manage their data, public concerns regarding privacy and the enactment of restrictive laws or regulations. It is possible that demand for our cloud offerings may not continue to be as strong as it has been to date. Moreover, expansion of our cloud offerings may cause a decline in revenue of our existing products and services that is not offset by revenue from the new products or services. For example, customers may delay making purchases of products and services to permit them to make a more thorough evaluation of these new products and services or until industry and marketplace reviews become widely available. We may be unable to realize the benefits of our investments or the resources we have committed to expanding our cloud-delivered services.

An increasing number of jurisdictions are imposing data localization laws, which require personal information, or certain subcategories of personal information, to be stored in the jurisdiction of origin. These regulations may deter customers from using cloud-based services, and may inhibit our ability to expand into certain markets or prohibit us from continuing to offer services in those markets without significant additional costs.

Our hosted offerings rely upon third-party providers to supply data center space, equipment maintenance and other colocation services and rely upon the ability of those providers to maintain continuous service availability and protect customer data on their services. Customers of our cloud-based offerings need to be able to access our platform at any time, without interruption or degradation of performance, and we provide them with service level commitments with respect to uptime. Third-party cloud providers run their own platforms that we access, and we are, therefore, vulnerable to their service interruptions. Although we have entered into various agreements for the lease of data center space, equipment maintenance and other services, third parties could fail to live up to their contractual obligations. The failure of a third-party provider to prevent service disruptions, data losses or security breaches may require us to issue credits or refunds or indemnify or otherwise be liable to customers or third parties for damages that may occur, and contractual provisions with our third-party providers and public cloud partners may limit our recourse against the third-party provider or public cloud partner responsible for such failure. Additionally, if these third-party providers fail to deliver on their obligations, our reputation could be damaged, our customers could lose confidence in us, and our ability to maintain and expand our hosted offerings would be impaired. Lastly, our cloud product offering and pricing is new and hosting and other costs may be more expensive to us than anticipated.

We may not be able to predict renewal rates and their impact on our future revenues and operating results.

Although our solutions are designed to increase the number of customers that purchase our products and the number of products purchased by existing and new customers to create a recurring revenue stream that increases and is more predictable over time, our customers are not required to renew their subscriptions for our solutions and they may elect not to renew when, or as we expect, or they may elect to reduce the scope of their original purchases or delay their purchase. We cannot accurately predict renewal rates given our varied customer base of enterprise and small and medium size business customers and the number of multiyear contracts. Customer renewal rates may decline or fluctuate due to a number of factors, including offering pricing, competitive offerings, customer satisfaction and reductions in customer spending levels or customer activity due to economic downturns, the adverse impact of import tariffs, inflation or other market uncertainty. If our customers do not renew their contracts when or as we expect, or if they choose to renew for fewer products or renew for shorter contract lengths or if they renew on less favorable terms, our revenues and earnings may decline, and our business may suffer.

Our quarterly results of operations have fluctuated and may fluctuate significantly due to variability in our revenues which could adversely impact our stock price.

Our revenues and other results of operations have fluctuated from quarter to quarter in the past and could continue to fluctuate in the future. Historically, the fluctuation was partially due to the front-loaded revenue recognition nature of our business. Additionally, the Company is currently transitioning to a SaaS delivery model that recognizes revenue ratably and we do not front-load revenue with respect to those purchases. As a result, we may present reduced revenues as compared to prior periods, and comparing our revenues and results of operations on a period-to-period basis may not be meaningful, and should not be relied on for any particular period. Our revenues depend in part on the conversion of enterprises that have undergone risk assessments into paying customers; however, these risk assessments may not be converted at the same historical rates. At the same time, the majority of our sales are typically made during the last three weeks of every quarter. We may fail to meet market expectations for that quarter if we are unable to close the number of transactions that we expect during this short period and closings are deferred to a subsequent quarter or not closed at all. The closing of a large transaction in a particular quarter may raise our revenues in that quarter and thereby make it more difficult for us to meet market expectations in subsequent quarters and our failure to close a large transaction in a particular quarter or any renewals may adversely impact our revenues in that quarter. In addition, our sales cycle from initial contact to delivery of and payment for the software license generally becomes longer and less predictable with respect to large transactions and often involves multiple meetings or consultations at a substantial cost and time commitment to us. Further, we recently began focusing on the conversion of our current OPS customers to our SaaS platform and the sales cycle of such conversions can and may continue to take longer than the acquisition of new customers. Moreover, we base our current and future expense levels on our revenue forecasts and operating plans, and our expenses are relatively fixed in the short-term. Accordingly, we would likely not be able to reduce our costs sufficiently to compensate for an unexpected shortfall in revenues and even a relatively small decrease in revenues could disproportionately and adversely affect our financial results for that quarter.

The variability and unpredictability of these and other factors, many of which are outside of our control, could result in our failing to meet or exceed financial expectations for a given period and may cause the price of our common stock to decline substantially.

If the transition to a SaaS delivery model fails to yield the benefits that we expect, our results of operations could be negatively impacted.

We successfully completed our transition to a subscription-based business model and are currently transitioning our business to a SaaS delivery model. It is uncertain whether this transition will prove successful. Market acceptance of our products is dependent on our ability to include functionality and usability that address certain customer requirements. Additionally, we must optimally price our products in light of marketplace conditions, our costs and customer demand. This transition may have negative revenue and earnings implications, including on our quarterly results of operations.

This SaaS strategy may give rise to a number of risks, including the following:

• our revenues and operating margins may fluctuate more than anticipated over the short-term as a result of this strategy;
• if current customers desire only self-hosted licenses our SaaS sales may lag behind our expectations;
• the shift to a SaaS strategy may raise concerns among our customer base, including concerns regarding changes to pricing over time and access to data once a subscription has expired;
• we may be unsuccessful in maintaining or implementing our target pricing or new pricing models, product adoption and projected renewal rates, or we may select a target price or new pricing model that is not optimal and could negatively affect our sales or earnings;
• if our customers do not renew their subscriptions or do not renew them on a timely basis, our revenues may decline and our business may suffer;
• we may incur hosting costs at a higher than forecasted rate or our SaaS platform can operate less efficiently than anticipated;
• we may incur sales compensation costs at a higher than forecasted rate if the pace of our subscription transition is faster than anticipated; and
• our sales force may struggle with the transition which may lead to increased turnover rates and lower headcount.

We have been growing and expect to continue to invest in our growth for the foreseeable future. If we fail to manage this growth effectively, our business and results of operations will be adversely affected.

We intend to continue to grow our business and plan to continue to hire new sales employees either for expansion or replacement of existing sales personnel. If we cannot adequately and timely hire new employees and if we fail to adequately train these new employees, including our sales force, engineers and customer support staff, our sales may not grow at the rates we project and/or our sales productivity might suffer, our customers might decide not to renew or reduce the scope of their original purchases, or our customers may lose confidence in the knowledge and capability of our employees or products. We must successfully manage our growth to achieve our objectives. Although our business has experienced significant growth in the past, we may not be able to continue to grow at the same rate, or at all.

Our ability to effectively manage any significant growth of our business will depend on a number of factors, including our ability to do the following:

• satisfy existing customers and attract new customers;
• adequately and timely recruit, train, motivate and integrate new employees, including our sales force and engineers, while retaining existing employees, maintaining the beneficial aspects of our corporate culture and effectively executing our business plan;
• successfully introduce new products and enhancements;
• effectively manage existing channel partnerships and expand to new ones;
• improve our key business applications and processes to support our business needs;
• enhance information and communication systems to ensure that our employees and offices around the world are well-coordinated and can effectively communicate with each other and our growing customer base;
• enhance our internal controls to ensure timely and accurate reporting of all of our operations and financial results;
• protect and further develop our strategic assets, including our intellectual property rights;
• continue to capitalize on the transition to a SaaS delivery model; and
• successfully manage and integrate any future acquisitions of businesses, including without limitation, the amount and timing of expenses and potential future charges for impairment of goodwill from acquired companies.

These activities will require significant investments and allocation of valuable management and employee resources, and our growth will continue to place significant demands on our management and our operational and financial infrastructure. We may not be able to grow our business in an efficient or timely manner, or at all. Moreover, if we do not effectively manage the growth of our business and operations, the quality of our software could suffer, which could negatively affect our brand, results of operations and overall business.

We have a limited operating history at our current scale, which makes it difficult to evaluate and predict our future prospects and may increase the risk that we will not be successful.

We have a relatively short history operating our business at its current scale. For example, we have increased the number of our employees and have expanded our operations and product offerings. This limits our ability to forecast our future operating results and subjects us to a number of uncertainties, including our ability to plan for and model future growth. We have encountered and will continue to encounter risks and uncertainties frequently experienced by growing companies in new markets that may not develop as expected. Because we depend in part on the market’s acceptance of our products, it is difficult to evaluate trends that may affect our business. If our assumptions regarding these trends and uncertainties, which we use to plan our business, are incorrect or change in reaction to changes in our markets, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations and our business could suffer. Moreover, although we have experienced significant growth historically, we may not continue to grow as quickly in the future.

Our future success will depend in large part on our ability to, among other things:

• successfully transition to a SaaS delivery model and manage our introduction of cloud-based solutions;
• maintain and expand our business, including our customer base and operations, to support our growth, both domestically and internationally;
• develop new products and services and bring products and services in beta to market;
• renew customer agreements and sell additional products to existing customers;
• maintain high customer satisfaction and ensure quality and timely releases of our products and product enhancements;
• increase market awareness of our products and enhance our brand;
• maintain compliance with applicable governmental regulations and other legal obligations, including those related to intellectual property, international sales and taxation;
• hire, integrate, train and retain skilled talent, including members of our sales force and engineers; and
• our ability to successfully manage and integrate any acquisitions of businesses.

If we fail to address the risks and difficulties that we face, including those associated with the challenges listed above as well as those described elsewhere in this “Risk Factors” section, our business will be adversely affected, and our results of operations will suffer.

If we are unable to attract new customers and expand sales to existing customers, both domestically and internationally, our growth could be slower than we expect, and our business may be harmed.

Our success will depend, in part, on our ability to support new and existing customer growth and maintain customer satisfaction. Our sales and marketing teams host in-person events and engage with customers online and through other communications channels, including virtual meetings. Our sales and marketing teams may not be as successful or effective in building relationships. If we cannot provide the tools and training to our teams to efficiently do their jobs and satisfy customer demands, we may not be able to achieve anticipated revenue growth as quickly as expected.

Our future growth depends upon expanding sales of our products to existing customers and their organizations and receiving renewals. If our customers do not purchase additional products or capabilities, our revenues may grow more slowly than expected, may not grow at all or may decline. Our efforts may not result in increased sales to existing customers (“upsells”) and additional revenues. If our efforts to upsell to our customers are not successful, our business would suffer.

Our future growth also depends in part upon increasing our customer base, particularly those customers with potentially high customer lifetime values. Our ability to achieve significant growth in revenues in the future will depend, in large part, upon the effectiveness of our sales and marketing efforts, both domestically and internationally, and our ability to attract new customers. Our ability to attract new customers may be adversely affected by newly enacted laws that may prohibit certain sales and marketing activities, such as legislation passed in the State of New York, pursuant to which unsolicited telemarketing sales calls are prohibited. If we fail to attract new customers and maintain and expand those customer relationships, our revenues may be adversely affected, and our business will be harmed.

We have a history of losses, and we may not be profitable in the future.

We have incurred net losses in each year since our inception, including a net loss of $95.8 million, $100.9 million and $124.5 million in each of the years ended December 31, 2024, 2023 and 2022, respectively. Because the market for our software is rapidly evolving and has still not yet reached widespread adoption, it is difficult for us to predict our future results of operations. We expect our operating expenses to increase over the next several years as we hire additional personnel, expand and improve the effectiveness of our distribution channels, and continue to develop features and applications for our software.

If we are unable to maintain successful relationships with our channel partners, our business could be adversely affected.

We rely on channel partners, such as distribution partners and resellers, to sell the Varonis Data Security Platform. In 2023 and 2024, our channel partners fulfilled substantially all of our sales, and we expect that sales to channel partners will continue to account for substantially all of our revenues for the foreseeable future. Our ability to achieve revenue growth in the future will depend in part on our success in maintaining successful relationships with our channel partners.

Our agreements with our channel partners are generally non-exclusive, meaning our channel partners may offer customers the products of several different companies. If our channel partners do not effectively market and sell our software, choose to use greater efforts to market and sell their own products or those of others, or fail to meet the needs of our customers, our ability to grow our business, sell our software and maintain our reputation may be adversely affected. Our contracts with our channel partners generally allow them to terminate their agreements for any reason upon 30 days’ notice. A termination of the agreement has no effect on orders already placed. The loss of a substantial number of our channel partners, our possible inability to replace them, or the failure to recruit additional channel partners could materially and adversely affect our results of operations. If we are unable to maintain our relationships with these channel partners, our business, results of operations, financial condition or cash flows could be adversely affected.

Finally, even if we are successful, our relationships with channel partners may not result in greater customer usage of our products or increased revenue.

Our long-term growth depends, in part, on being able to continue to expand internationally on a profitable basis, which subjects us to risks associated with conducting international operations.

Historically, we have generated the majority of our revenues from customers in the United States. For the years ended December 31, 2024 and 2023, approximately 73% and 72%, respectively, of our total revenues were derived from sales in the United States. Nevertheless, we have operations across the globe, and we plan to continue to expand our international operations as part of our long-term growth strategy. The further expansion of our international operations will subject us to a variety of risks and challenges, including:

• sales and customer service challenges associated with operating in different countries;
• increased management travel, infrastructure and legal compliance costs associated with having multiple international operations;
• difficulties in receiving payments from different geographies, including difficulties associated with currency fluctuations, payment cycles, transfer of funds or collecting accounts receivable, especially in emerging markets;
• variations in economic or political conditions between each country or region;
• economic uncertainty around the world and adverse effects arising from economic interdependencies across countries and regions;
• uncertainty around a potential reverse or renegotiation of international trade agreements and partnerships;
• compliance with foreign laws and regulations and the risks and costs of non-compliance with such laws and regulations;
• ability to hire, retain and train local employees and the ability to comply with foreign labor laws and local labor requirements, such as representations by an internal labor committee in France which is affiliated with an external trade union and the applicability of collective bargaining arrangements at the national level in certain European countries;
• compliance with laws and regulations for foreign operations, including the U.S. Foreign Corrupt Practices Act of 1977, as amended (the “FCPA”), the U.K. Bribery Act of 2010 (the “UK Bribery Act”), import and export control laws, tariffs, trade barriers, economic sanctions and other regulatory or contractual limitations on our ability to sell our software in certain foreign markets, and the risks and costs of non-compliance;
• heightened risks of unfair or corrupt business practices in certain geographies and of improper or fraudulent sales arrangements that may impact financial results and result in restatements of financial statements and irregularities in financial statements;
• reduced protection for intellectual property rights in certain countries and practical difficulties and costs of enforcing rights abroad; and
• compliance with the laws of numerous foreign taxing jurisdictions and overlapping of different tax regimes and digital tax imposed on our operations in foreign taxing jurisdictions.

Any of these risks could adversely affect our international operations, reduce our revenues from outside the United States or increase our operating costs, adversely affecting our business, results of operations and financial condition and growth prospects. There can be no assurance that all of our employees, independent contractors and channel partners will comply with the formal policies we have and will implement, or applicable laws and regulations. Violations of laws or key control policies by our employees, independent contractors and channel partners could result in delays in revenue recognition, financial reporting misstatements, fines, penalties or the prohibition of the importation or exportation of our software and services and could have a material adverse effect on our business and results of operations.

We are exposed to collection and credit risks, which could impact our operating results.

Our trade receivables are subject to collection and credit risks. These agreements may include purchase commitments for multiple years of term license subscriptions and SaaS, which may be invoiced over multiple reporting periods increasing these risks. For example, our operating results may be impacted by significant bankruptcies among customers and resellers, which could negatively impact our revenues and cash flows. Although we have processes in place that are designed to monitor and mitigate these risks, we cannot guarantee these programs will be effective. If we are unable to adequately control these risks, our business, operating results and financial condition could be harmed.

If currency exchange rates fluctuate substantially in the future, our results of operations, which are reported in U.S. dollars, could be adversely affected.

Our functional and reporting currency is the U.S. dollar, and we generate the majority of our revenues and incur the majority of our expenses in U.S. dollars. Revenues and expenses are also incurred in other currencies, primarily Euros, Pounds Sterling, Canadian dollars, Australian dollars, Singapore dollar and the New Israeli Shekel. Accordingly, changes in exchange rates may have a material adverse effect on our business, results of operations and financial condition. The exchange rates between the U.S. dollar and foreign currencies have fluctuated substantially in recent years and may continue to fluctuate substantially in the future. Furthermore, a strengthening of the U.S. dollar could increase the cost in local currency of our software and renewals to customers outside the United States, which could adversely affect our business, results of operations, financial condition and cash flows.

We incur expenses for employee compensation and other operating expenses at our non-U.S. locations in local currencies. The weakening of the U.S. dollar against such currencies would cause the U.S. dollar equivalent of such expenses to increase which could have a negative impact on our reported results of operations and our ability to attract employees in such non-U.S. locations due to the actual increase in the compensation to be paid to such employees. We use forward foreign exchange contracts to hedge or mitigate the effect of changes in foreign exchange rates on our revenues and operating expenses denominated in certain foreign currencies. However, this strategy might not eliminate our exposure to foreign exchange rate fluctuations and involves costs and risks of its own, such as cash expenditures, ongoing management time and expertise, external costs to implement the strategy and potential accounting implications. Additionally, our hedging activities may contribute to increased losses as a result of volatility in foreign currency markets and the difference between the interest rates of the currencies being hedged.

Our business is highly dependent upon our brand recognition and reputation, and the failure to maintain or enhance our brand recognition or reputation may adversely affect our business.

We believe that enhancing the “Varonis” brand identity and maintaining our reputation in the IT industry is critical to our relationships with our customers and to our ability to attract new customers. Our brand recognition and reputation are dependent upon:

• our ability to continue to offer high quality, innovative and error- and bug-free products;
• our ability to maintain customer satisfaction with our products;
• our ability to be responsive to customer concerns and provide high quality customer support, training and professional services;
• our marketing efforts;
• any misuse or perceived misuse of our products;
• positive or negative publicity;
• our ability to prevent or quickly react to any cyberattack on our IT systems or security breach of or related to our software;
• interruptions, delays or attacks on our website; and
• litigation or regulatory-related developments.

We may not be able to successfully promote our brand or maintain our reputation. In addition, independent industry analysts often provide reviews of our products, as well as other products available in the market, and perception of our product in the marketplace may be significantly influenced by these reviews. If these reviews are negative, or less positive than reviews about other products available in the market, our brand may be adversely affected. Furthermore, negative publicity relating to events or activities attributed to us, our employees, our channel partners or others associated with any of these parties, may tarnish our reputation and reduce the value of our brand. If we do not successfully enhance our brand and maintain our reputation, our business may not grow, we may have reduced pricing power relative to competitors with stronger brands, and we could lose customers or renewals, all of which would adversely affect our business, operations and financial results. Moreover, damage to our reputation and loss of brand equity may reduce demand for our products and have an adverse effect on our business, results of operations and financial condition. Any attempts to rebuild our reputation and restore the value of our brand may be costly and time consuming, and such efforts may not ultimately be successful.

Moreover, it may be difficult to enhance our brand and maintain our reputation in connection with sales to channel partners. Promoting our brand requires us to make significant expenditures, and we anticipate that the expenditures will increase as our market becomes more competitive, as we expand into new markets and geographies and as more sales are generated to our channel partners. To the extent that these activities yield increased revenues, these revenues may not offset the increased expenses we incur.

Our success depends in part on maintaining and increasing our sales to customers in the public sector.

We derive a portion of our revenues from contracts with federal, state, local and foreign governments and government-owned or -controlled entities (such as public health care bodies, educational institutions and utilities), which we refer to as the public sector herein. We believe that part of the success and growth of our business will continue to depend on our successful procurement of public sector contracts. Selling to public sector entities can be highly competitive, expensive and time consuming, often requiring significant upfront time and expense without any assurance that our efforts will produce any sales. Government demand and payment for our products and services may be impacted by public sector budgetary cycles, or lack of, and funding authorizations, including in connection with an extended government shutdown, with funding reductions or delays adversely affecting public sector demand for our products and services. Factors that could impede our ability to maintain or increase the amount of revenues derived from public sector contracts include:

• changes in public sector fiscal or contracting policies;
• decreases or elimination of available public sector funding;
• non-compliance with or an inability to attain the proper certification to conduct business in the public sector;
• changes in public sector programs or applicable requirements;
• the adoption of new laws or regulations or changes to existing laws or regulations;
• potential delays or changes in the public sector appropriations or other funding authorization processes;
• the requirement of contractual terms that are unfavorable to us, such as most-favored-nation pricing provisions; and
• delays in the payment of our invoices by public sector payment offices.

In addition, we must comply with laws and regulations relating to public sector contracting, which affect how we and our channel partners do business in both the United States and abroad. These laws and regulations may impose added costs on our business, and failure to comply with these or other applicable regulations and requirements, including non-compliance in the past, could lead to claims for damages from our channel partners, penalties, termination of contracts, and temporary suspension or permanent debarment from public sector contracting. Moreover, governments may investigate and audit government contractors’ administrative processes, and any unfavorable audit could result in the government refusing to continue buying our products, which would adversely impact our revenue and results of operations, or institute fines or civil or criminal liability if the audit uncovers improper or illegal activities.

Furthermore, on January 20, 2025, President Donald J. Trump announced an executive order establishing the “Department of Government Efficiency” to maximize government efficiency and productivity. Pressures on and uncertainty surrounding the U.S. federal government’s budget and potential changes in budgetary priorities, could adversely affect the funding for individual programs and delay purchasing decisions by our customers.

The occurrence of any of the foregoing could cause public sector customers to delay or refrain from purchasing licenses of our software in the future or otherwise have an adverse effect on our business, operations and financial results.

We are subject to governmental export and import controls that could subject us to liability or impair our ability to compete in international markets.

We incorporate certain encryption technology into certain of our products and, as a result, are required to comply with U.S. export control laws and regulations, including the Export Administration Regulations administered by the U.S. Department of Commerce’s Bureau of Industry and Security (“BIS”). We are also subject to Israeli export control laws on encryption technology. These export control laws and regulations prohibit, restrict, or regulate our ability to, directly or indirectly, export, re-export, or transfer certain products to certain countries and territories, entities, and individuals for certain end uses. If the applicable U.S. or Israeli legal requirements regarding the export of encryption technology were to change or if we change the encryption means in our products, we may (i) be unable to export our products, (ii) need to apply for new licenses or (iii) be unable to rely on certain license exceptions. Furthermore, various other countries regulate the import of certain encryption technology, including import permitting and licensing requirements, and have enacted laws that could limit our ability to distribute our products or could limit our customers’ ability to implement our products in those countries.

We are also subject to U.S. and Israeli economic sanctions laws, which prohibit the shipment of certain products to embargoed or sanctioned countries, sanctioned governments and sanctioned persons. Like with export controls, we take precautions to prevent our products from being provided in violation of these laws, including requiring our business partners to commit to compliance through contractual undertakings. However, if our business partners were to provide our products to certain countries, governments, or sanctioned persons in violation of these laws, such provision could have negative consequences, including government investigations, penalties and reputational harm.

Any change in export or import regulations, economic sanctions or related legislation, shift in the enforcement or scope of existing regulations, or change in the countries, governments, persons or technologies targeted by such regulations, could result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers with international operations. Moreover, any new export or import restrictions, new legislation or shifting approaches in the enforcement or scope of existing regulations, or in the countries, persons or technologies targeted by such regulations, could result in decreased use of our products. Any decreased use of our products or limitation on our ability to export or sell our products would likely adversely affect our business, financial condition and results of operations.

Our business in countries with a history of corruption and transactions with foreign governments increase the risks associated with our international activities.

As we operate and sell internationally, we are subject to the FCPA, the UK Bribery Act and other laws that prohibit improper payments or offers of payments to foreign governments and their officials and political parties for the purpose of obtaining or retaining business. We have operations, deal with and make sales to governmental customers in countries known to experience corruption, particularly certain emerging countries in Eastern Europe, South and Central America, East Asia, Africa and the Middle East. Our activities in these countries create the risk of unauthorized payments or offers of payments by one of our employees, consultants, channel partners or sales agents that could be in violation of various anti-corruption laws, even though these parties may not be under our control. While we have implemented safeguards to prevent these practices by our employees, consultants, channel partners and sales agents, our existing safeguards and any future improvements may prove to be less than effective, and our employees, consultants, channel partners or sales agents may engage in conduct for which we might be held responsible. Violations of the FCPA or other anti-corruption laws may result in severe criminal or civil sanctions, including suspension or debarment from government contracting, and we may be subject to other liabilities, which could negatively affect our business, operating results and financial condition.

Acquisitions could disrupt our business and adversely affect our results of operations, financial condition and cash flows.

As we continue to pursue business opportunities, we may make acquisitions that could be material to our business, results of operations, financial condition and cash flows. Acquisitions involve many risks, including the following:

• an acquisition may negatively affect our results of operations, financial condition or cash flows because it may require us to incur charges or assume substantial debt or other liabilities, may cause adverse tax consequences or unfavorable accounting treatment, including potential write-downs of deferred revenues, may expose us to claims and disputes by third parties, including intellectual property claims and disputes, or may not generate sufficient financial return to offset additional costs and expenses related to the acquisition;
• we may encounter difficulties or unforeseen expenditures in integrating the business, technologies, products, personnel or operations of any company that we acquire, particularly if key personnel of the acquired company decide not to work for us;
• an acquisition may disrupt our ongoing business, divert resources, increase our expenses and distract our management;
• an acquisition may result in a delay or reduction of customer purchases for both us and the company we acquired due to customer uncertainty about continuity and effectiveness of service from either company;
• we may encounter difficulties in, or may be unable to, successfully sell any acquired products;
• an acquisition may involve the entry into geographic or business markets in which we have little or no prior experience or where competitors have stronger market positions;
• challenges inherent in effectively managing an increased number of employees in diverse locations;
• the potential strain on our financial and managerial controls and reporting systems and procedures;
• potential known and unknown liabilities or deficiencies associated with an acquired company that were not identified in advance;
• our use of cash to pay for acquisitions would limit other potential uses for our cash and affect our liquidity;
• if we incur debt to fund such acquisitions, such debt may subject us to material restrictions on our ability to conduct our business as well as financial maintenance covenants;
• the risk of impairment charges related to potential write-downs of acquired assets or goodwill in future acquisitions;
• to the extent that we issue a significant amount of equity or convertible debt securities in connection with future acquisitions, existing stockholders may be diluted and earnings per share may decrease; and
• managing the varying intellectual property protection strategies and other activities of an acquired company.

We may not succeed in addressing these or other risks or any other problems encountered in connection with the integration of any acquired business. Our ability as an organization to successfully acquire and integrate technologies or businesses is limited. The inability to successfully integrate the business, technologies, products, personnel or operations of any acquired business, or any significant delay in achieving integration, could have a material adverse effect on our business, results of operations, financial condition and cash flows.

Risks Related to Human Capital

A failure to maintain sales and marketing personnel productivity or hire and integrate additional sales and marketing personnel could adversely affect our results of operations and growth prospects.

Our business requires intensive sales and marketing activities. Our sales and marketing personnel are essential to attracting new customers and expanding sales to existing customers, both of which are key to our future growth. We face a number of challenges in successfully expanding our sales force. Our transition to a SaaS delivery model, and the additional demands involved in selling our platform, has increased the complexity and to some extent imposed new challenges in finding, hiring and retaining qualified sales force members. We must locate and hire a significant number of qualified individuals, and competition for such individuals is intense. In addition, as we expand into new markets with which we have less familiarity and develop existing territories, we will need to recruit individuals who have skills particular to a certain geography or territory, and it may be difficult to find candidates with those qualifications. We may be unable to achieve our hiring or integration goals due to a number of factors, including, but not limited to, the challenge in remotely recruiting employees and adequately training them, the number of individuals we hire, challenges in finding individuals with the correct background due to increased competition for such hires, increased attrition rates among new hires and existing personnel as well as the necessary experience to sell the Varonis Data Security Platform rather than individual software products. Furthermore, based on our past experience in mature territories, it can take up to 12 months before a new sales force member is trained and operating at a level that meets our expectations. We invest significant time and resources in training new members of our sales force, and we may be unable to achieve our target performance levels with new sales personnel as rapidly as we have done in the past, or at all, due to larger numbers of hires or lack of experience training sales personnel to operate in new jurisdictions or because of the remote hiring and training process. Our failure to hire a sufficient number of qualified individuals, to integrate new sales force members within the time periods we have achieved historically or to keep our attrition rates at levels comparable to others in our industry may materially impact our projected growth rate.

Failure to retain, attract and recruit highly qualified personnel could adversely affect our business, operating results, financial condition and growth prospects.

Our future success and growth depend, in part, on our ability to continue to recruit and retain highly skilled personnel and to preserve the key aspects of our corporate culture. Because our future success is dependent on our ability to continue to enhance and introduce new products, we are particularly dependent on our ability to hire and retain engineers. Any of our employees may terminate their employment at any time, and we face intense competition for highly skilled employees. Competition for qualified employees, particularly in Israel, where we have a substantial presence and need for qualified engineers, from numerous other companies, including other software and technology companies, many of whom have greater financial and other resources than we do, is intense. Moreover, to the extent we hire personnel from other companies, we may be subject to allegations that they have been improperly solicited or may have divulged proprietary or other confidential information to us. If we are unable to timely attract, train or retain qualified employees, particularly our engineers, salespeople and key managers, our ability to innovate, introduce new products and compete would be adversely impacted, and our financial condition and results of operations may suffer. Lastly, equity grants are a critical component of our current compensation programs. If we reduce, modify or eliminate our equity compensation programs or if there is a decline in our stock price, which will result in the value of our equity compensation being lower, we may have difficulty attracting and retaining employees.

We are dependent on the continued services and performance of our co-founder, Chief Executive Officer and President, the loss of whom could adversely affect our business.

Much of our future performance depends on the continued services and continuing contributions of our co-founder, Chief Executive Officer and President, Yakov Faitelson, to successfully manage our company, to execute on our business plan and to identify and pursue new opportunities and product innovations. The loss of Mr. Faitelson’s services could significantly delay or prevent the achievement of our development and strategic objectives and adversely affect our business.

Risks Related to our Technology, Products, Services and Intellectual Property

Our failure to continually enhance and improve our technology could adversely affect sales of our products.

The market is characterized by the exponential growth in enterprise data, rapid technological advances, changes in customer requirements, including customer requirements driven by changes to legal, regulatory and self-regulatory compliance mandates, frequent new product introductions and enhancements and evolving industry standards in computer hardware and software technology. As a result, we must continually change and improve our products in response to changes in operating systems, application software, computer and communications hardware, networking software, data center architectures, programming tools, computer language technology and various regulations. Moreover, the technology in our products is especially complex because it needs to effectively identify and respond to a user’s data retention, security and governance needs, while minimizing the impact on database and file system performance. Our products must also successfully interoperate with products from other vendors.

While we extend our technological capabilities though innovation and strategic transactions, including our recently announced Managed Data Detection and Response and cloud-based solutions, we cannot guarantee that we will be able to anticipate future market needs and opportunities or be able to extend our technological expertise and develop new products or expand the functionality of our current products in a timely manner or at all. Even if we are able to anticipate, develop and introduce new products and expand the functionality of our current products, there can be no assurance that enhancements or new products will achieve widespread market acceptance.

Our product enhancements or new products could fail to attain sufficient market acceptance for many reasons, including:

• failure to accurately predict market demand in terms of product functionality and to supply products that meet this demand in a timely fashion;
• inability to interoperate effectively with the database technologies and file systems of prospective customers;
• defects, errors or failures;
• negative publicity or customer complaints about performance or effectiveness; and
• poor business conditions, causing customers to delay IT purchases.

If we fail to anticipate market requirements or stay abreast of technological changes, we may be unable to successfully introduce new products, expand the functionality of our current products or convince our customers and potential customers of the value of our solutions in light of new technologies. In addition, it is possible that our product innovations, including our recently announced Managed Data Detection and Response and cloud-based solutions, may not provide satisfactory results to our customers. Accordingly, our business, results of operations and financial condition could be materially and adversely affected.

If our technical support, customer success or professional services are not satisfactory to our customers, they may not renew their agreements or not buy additional products in the future, which could adversely affect our future results of operations.

Our business relies on our customers’ satisfaction with the technical support, customer success and professional services we provide to support our products. Our customers have no obligation to renew their agreements with us after the initial terms have expired. Our customers have an option to renew their agreements and, for us to maintain and improve our results of operations, it is important that our existing customers renew their agreements, if applicable, when the existing contract term expires. For example, our renewal rate for the years ended December 31, 2024, 2023 and 2022 continued to be over 90%.

If we fail to provide technical support services that are responsive, satisfy our customers’ expectations and resolve issues that they encounter with our products and services, then they may elect not to purchase or renew contracts and they may choose not to purchase additional products and services from us. Accordingly, our failure to provide satisfactory technical support, customer success or professional services could lead our customers not to renew their agreements with us or renew on terms less favorable to us, and therefore have a material and adverse effect on our business and results of operations.

Interruptions or performance problems, including associated with our website or support website or any caused by cyberattacks, may adversely affect our business.

Our continued growth depends in part on the ability of our existing and potential customers to quickly access our website and support website. Access to our support website is also imperative to our daily operations and interaction with customers, as it allows customers to download our software, fixes and patches, as well as open and respond to support tickets and register license keys for evaluation or production purposes. We have experienced, and may in the future experience, website disruptions, outages and other performance problems due to a variety of factors, including technical failures, cyberattacks, natural disasters, infrastructure changes, human or software errors, capacity constraints due to an overwhelming number of users accessing our website simultaneously and denial of service or fraud. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time. System failures or outages, including any potential disruptions due to a period of increased global demand on certain cloud-based systems or disruptions of our cloud-based solutions, could compromise our or our customer’s ability to perform day-to-day operations in a timely manner, which could negatively impact our business or delay our financial reporting. It may become increasingly difficult to maintain and improve the performance of our websites, especially during peak usage times and as our software becomes more complex and our user traffic increases. If our websites are unavailable or if our users are unable to download our software, patches or fixes within a reasonable amount of time or at all, we may suffer reputational harm and our business would be negatively affected.

If our software is perceived as not being secure, customers may reduce the use of or stop using our software, and we may incur significant liabilities.

Our software involves the transmission of data between data stores, and between data stores and desktop and mobile computers, and will increasingly involve the storage of data. We have a legal and contractual obligation to protect the confidentiality and appropriate use of customer data. Any security breaches with respect to such data could result in the loss of this information, litigation, indemnity obligations and other liabilities. The security of our products and accompanied services is important in our customers’ decisions to purchase or use our products or services. Security threats are a significant challenge to companies like us whose business is providing technology products and services to others. While we have taken steps to protect the confidential information that we have access to, including confidential information we may obtain through our customer support services or customer usage of our products, we have no direct control over the substance of the content. Security measures might be breached as a result of third-party action, employee error, malfeasance or otherwise. We also incorporate open source software and other third-party software into our products. There may be vulnerabilities in open source software and third-party software that may make our products likely to be harmed by cyberattacks. Moreover, our products operate in conjunction with and are dependent on products and components across a broad ecosystem of third parties. If there is a security vulnerability in one of these components, and if there is a security exploit targeting it, such security vulnerability may adversely impact our product vulnerability and we could face increased costs, liability claims, reduced revenue, or harm to our reputation or competitive position. Because techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until they are launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures.

The limitations of liability in our contracts may not be enforceable or adequate or otherwise protect us from any such liabilities or damages with respect to any particular claim. While we maintain insurance coverage for some of the above events, the potential liabilities associated with these security breach events could exceed the insurance coverage we maintain.

We incorporate machine learning and AI solutions into parts of our platform, offerings, services and features, and these applications may become more important in our operations over time. AI technologies, including generative AI, are complex and rapidly evolving, and we face competition from other companies as well as an evolving regulatory landscape. Several jurisdictions around the globe, including Europe and the United States, have already proposed or enacted laws governing AI, and we may need to commit significant resources to maintain business practices that comply with the evolving regulatory landscape. Our competitors or other third parties may incorporate AI into their products more quickly and successfully than us, which could impair our ability to compete effectively and adversely affect our results of operations.

Any or all of these issues could tarnish our reputation, negatively impact our ability to attract new customers or sell additional products to our existing customers, cause existing customers to elect not to renew their agreements or subject us to third-party lawsuits, regulatory fines or other action or liability, thereby adversely affecting our results of operations.

Our use of open source software could negatively affect our ability to sell our software and subject us to possible litigation.

We use open source software and expect to continue to use open source software in the future. Some open source software licenses require users who distribute open source software as part of their own software product to publicly disclose all or part of the source code to such software product or to make available any derivative works of the open source code on unfavorable terms or at no cost. We may face ownership claims of third parties over, or seeking to enforce the license terms applicable to, such open source software, including by demanding the release of the open source software, derivative works or our proprietary source code that was developed using such software. These claims could also result in litigation, require us to purchase a costly license or require us to devote additional research and development resources to change our software, any of which would have a negative effect on our business and results of operations. In addition, if the license terms for the open source code change, we may be forced to re-engineer our software or incur additional costs. Some open source software may include generative AI software or other software that incorporates or relies on generative AI. The use of such software may expose us to risks as the intellectual property ownership and license rights, including copyright, of generative AI software and tools, has not been fully interpreted by U.S. courts or been fully addressed by federal or state regulation. Finally, while we implement policies and procedures, we cannot provide assurance that we have incorporated open source software into our own software in a manner that conforms with our current policies and procedures and we cannot assure that all open source software is reviewed prior to use in our solution, that our programmers have not incorporated open source software into our solution, or that they will not do so in the future.

In addition, our solution may incorporate third-party software under commercial licenses. We cannot be certain whether such third-party software incorporates open source software without our knowledge. In the past, companies that incorporate open source software into their products have faced claims alleging noncompliance with open source license terms or infringement or misappropriation of proprietary software. Therefore, we could be subject to suits by parties claiming noncompliance with open source licensing terms or infringement or misappropriation of proprietary software. Because few courts have interpreted open source licenses, the manner in which these licenses may be interpreted and enforced is subject to some uncertainty. There is a risk that open source software licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market or provide our solution. As a result of using open source software subject to such licenses, we could be required to release proprietary source code, pay damages, re-engineer our solution, limit or discontinue sales or take other remedial action, any of which could adversely affect our business.

False detection of security breaches, false identification of malicious sources or misidentification of sensitive or regulated information could adversely affect our business.

Our cybersecurity products may falsely detect threats that do not actually exist. For example, our DatAlert product may enrich metadata collected by our products with information from external sources and third-party data providers. If the information from these data providers is inaccurate, the potential for false positives increases. These false positives, while typical in the industry, may affect the perceived reliability of our products and solutions and may therefore adversely impact market acceptance of our products. As definitions and instantiations of personal identifiers and other sensitive content change, automated classification technologies may falsely identify or fail to identify data as sensitive. If our products and solutions fail to detect exposures or restrict access to important systems, files or applications based on falsely identifying legitimate use as an attack or otherwise unauthorized, then our customers’ businesses could be adversely affected. Any such false identification of use and subsequent restriction could result in negative publicity, loss of customers and sales, increased costs to remedy any problem and costly litigation.

Failure to protect our proprietary technology and intellectual property rights could substantially harm our business.

The success of our business and competitive position depends on our ability to obtain, protect and enforce our trade secrets, trademarks, copyrights, patents and other intellectual property rights. We attempt to protect our intellectual property under patent, trademark, copyrights and trade secret laws, and through a combination of confidentiality procedures, contractual provisions and other methods, all of which offer only limited protection and may not now or in the future provide us with a competitive advantage.

As of December 31, 2024, we had 89 issued patents in the United States and 31 pending U.S. patent applications. We also had 76 patents issued and 34 applications pending for examination in non-U.S. jurisdictions, and 18 pending PCT patent applications, all of which are counterparts of our U.S. patent applications. We may file additional patent applications in the future. The process of obtaining patent protection is expensive and time-consuming, and we may not be able to prosecute all necessary or desirable patent applications at a reasonable cost or in a timely manner all the way through to the successful issuance of a patent. We may choose not to seek patent protection for certain innovations and may choose not to pursue patent protection in certain jurisdictions. Furthermore, it is possible that our patent applications may not issue as granted patents, that the scope of our issued patents will be insufficient or not have the coverage originally sought, that our issued patents will not provide us with any competitive advantages, and that our patents and other intellectual property rights may be challenged by others or invalidated through administrative process or litigation. In addition, issuance of a patent does not guarantee that we have an absolute right to practice the patented invention. Our policy is to require our employees (and our consultants and service providers that develop intellectual property included in our products) to execute written agreements in which they assign to us their rights in potential inventions and other intellectual property created within the scope of their employment (or, with respect to consultants and service providers, their engagement to develop such intellectual property). However, we may not be able to adequately protect our rights in every such agreement or execute an agreement with every such party. Finally, in order to benefit from patent and other intellectual property protection, we must monitor, detect and pursue infringement claims in certain circumstances in relevant jurisdictions, all of which is costly and time-consuming. As a result, we may not be able to obtain adequate protection or to enforce our issued patents or other intellectual property effectively.

In addition to patented technology, we rely on our unpatented proprietary technology and trade secrets. Despite our efforts to protect our proprietary technologies and our intellectual property rights, unauthorized parties, including our employees, consultants, service providers or customers, may attempt to copy aspects of our products or obtain and use our trade secrets or other confidential information. We generally enter into confidentiality agreements with our employees, consultants, service providers, vendors, channel partners and customers, and generally limit access to and distribution of our proprietary information and proprietary technology through certain procedural safeguards. These agreements may not effectively prevent unauthorized use or disclosure of our intellectual property or technology and may not provide an adequate remedy in the event of unauthorized use or disclosure of our intellectual property or technology. We cannot provide assurance that the steps taken by us will prevent misappropriation of our trade secrets or technology or infringement of our intellectual property. In addition, the laws of some foreign countries where we operate do not protect our proprietary rights to as great an extent as the laws of the United States, and many foreign countries do not enforce these laws as diligently as government agencies and private parties in the United States.

We have registered the “Varonis” name and logo and “DatAdvantage,” “DataPrivilege,” “DatAlert,” and other names in the United States and, as related to some of these names, certain other countries. However, we cannot provide assurance that any future trademark registrations will be issued for pending or future applications or that any registered trademarks will be enforceable or provide adequate protection of our proprietary rights.

Despite our efforts to protect our proprietary technology and trade secrets, unauthorized parties may attempt to misappropriate, reverse engineer or otherwise obtain and use them. In addition, others may independently discover our trade secrets, in which case we would not be able to assert trade secret rights or develop similar technologies and processes. Further, the contractual provisions that we enter into may not prevent unauthorized use or disclosure of our proprietary technology or intellectual property rights and may not provide an adequate remedy in the event of unauthorized use or disclosure of our proprietary technology or intellectual property rights. Moreover, policing unauthorized use of our technologies, trade secrets and intellectual property is difficult, expensive and time-consuming, particularly in foreign countries where the laws may not be as protective of intellectual property rights as those in the United States and where mechanisms for enforcement of intellectual property rights may be weak. We may be unable to determine the extent of any unauthorized use or infringement of our solution, technologies or intellectual property rights. If we are unable to protect our intellectual property rights and ensure that we are not violating the intellectual property rights of others, we may find ourselves at a competitive disadvantage to others who need not incur the additional expense, time and effort required to create the innovative products that have enabled us to be successful to date.

Assertions by third parties of infringement or other violations by us of their intellectual property rights, whether or not correct, could result in significant costs and harm our business and operating results.

The industries in which we operate, such as data security, cybersecurity, compliance, data retention and data governance are characterized by the existence of a large number of relevant patents and frequent claims and related litigation regarding patent and other intellectual property rights. From time to time, third parties have asserted and may assert their patent, copyright, trademark and other intellectual property rights against us, our channel partners or our customers. Successful claims of infringement or misappropriation by a third-party could prevent us from distributing certain products, performing certain services or could require us to pay substantial damages (including, for example, treble damages if we are found to have willfully infringed patents and increased statutory damages if we are found to have willfully infringed copyrights), royalties or other fees. Such claims also could require us to cease making, licensing or using solutions that are alleged to infringe or misappropriate the intellectual property of others or to expend additional development resources to attempt to redesign our products or services or otherwise to develop non-infringing technology. Even if third parties may offer a license to their technology, the terms of any offered license may not be acceptable, and the failure to obtain a license or the costs associated with any license could cause our business, results of operations or financial condition to be materially and adversely affected. In some cases, we indemnify our channel partners and customers against claims that our products infringe the intellectual property of third parties. Defending against claims of infringement or being deemed to be infringing the intellectual property rights of others could impair our ability to innovate, develop, distribute and sell our current and planned products and services.

Risks Related to our Tax Regime

Our tax rate may vary significantly depending on our stock price.

The tax effects of the accounting for stock-based compensation may significantly impact our effective tax rate from period to period. In periods in which our stock price is higher than the grant price of the stock-based compensation vesting in that period, we will recognize excess tax benefits that will decrease our effective tax rate, while in periods in which our stock price is lower than the grant price of the stock-based compensation vesting in that period, our effective tax rate may increase. The amount and value of stock-based compensation issued relative to our earnings in a particular period will also affect the magnitude of the impact of stock-based compensation on our effective tax rate. These tax effects are dependent on our stock price, which we do not control, and a decline in our stock price could significantly increase our effective tax rate and adversely affect our financial results.

Multiple factors may adversely affect our ability to fully utilize our net operating loss carryforwards.

A U.S. corporation’s ability to utilize its federal and state net operating loss (“NOL”) and tax credit carryforwards to offset its taxable income is limited under Section 382 and Section 383 of the Internal Revenue Code of 1986, as amended (the “Code”), if the corporation undergoes an ownership change (within the meaning of Code Section 382).

As of December 31, 2024, we have accumulated $134.3 million of federal NOL, $141.2 million of state NOL and $7.3 million of federal research credit carryforwards since inception. Future changes in our stock ownership, including future offerings, as well as changes that may be outside of our control, could result in a subsequent ownership change under Section 382, that would impose an annual limitation on NOLs. In addition, the cash tax benefit from our NOLs is dependent upon our ability to generate sufficient taxable income. Accordingly, we may be unable to earn enough taxable income in order to fully utilize our current NOLs.

Changes in our provision for income taxes or adverse outcomes resulting from examination of our income tax returns could adversely affect our results.

We are subject to income taxation in the United States, Israel and numerous other jurisdictions. Determining our provision for income taxes requires significant management judgment. In addition, our provision for income taxes could be adversely affected by many factors, including, among other things, changes to our operating structure including a review of our intellectual property (“IP”) structure, changes in the amounts of earnings in jurisdictions with different statutory tax rates, changes in the valuation of deferred tax assets and liabilities and changes in tax laws. Significant judgment is required to determine the recognition and measurement attributes prescribed in Accounting Standards Codification 740-10-25 (“ASC 740-10-25”). ASC 740-10-25 applies to all income tax positions, including the potential recovery of previously paid taxes, which if settled unfavorably could adversely impact our provision for income taxes. Our income in certain countries is subject to reduced tax rates provided we meet certain criteria. Failure to meet these commitments could adversely impact our provision for income taxes.

We are also subject to the regular examination of our income tax returns by the U.S. Internal Revenue Services and other tax authorities in various jurisdictions. Tax authorities may disagree with our intercompany charges, cross-jurisdictional transfer pricing, IP structure or other matters and assess additional taxes. While we believe that we are currently in material compliance with our obligations under applicable taxing regimes, and regularly assess the likelihood of adverse outcomes resulting from these examinations to determine the adequacy of our provision for income taxes, there can be no assurance that the outcomes from these regular examinations will not have a material adverse effect on our results of operations and cash flows. Further, we may be audited in various jurisdictions, and such jurisdictions may assess additional taxes against us. Although we believe our tax estimates are reasonable, the final determination of any tax audits or litigation could be materially different from our historical tax provisions and accruals, which could have a material adverse effect on our results of operations or cash flows in the period or periods for which a determination is made.

The adoption of the U.S. tax reform and the enactment of additional legislation changes could materially impact our financial position and results of operations.

On December 22, 2017, the Tax Cuts and Jobs Act (the "TCJA") was enacted. The TCJA remains unclear in some respects and has been, and may continue to be, subject to amendments and technical corrections, as well as interpretations and implementing regulations by the Treasury and Internal Revenue Service, any of which could lessen or increase certain adverse impacts of TCJA. Effective in 2022, the TCJA requires all U.S. companies to capitalize, and subsequently amortize R&E expenses that fall within the scope of Section 174 over five years for research activities conducted in the United States and over fifteen years for research activities conducted outside of the United States, rather than deducting such costs in the year incurred for tax purposes. As of the fourth quarter of 2024, we have accounted for an estimate of the effects of the R&E capitalization, based on interpretation of the law as currently enacted. To the extent that this provision is not modified or repealed, and once our available NOLs or tax credits are fully utilized, we would incur a significant increase in our tax expenses and a decrease in our cash flows provided by operations.

The Organization for Economic Cooperation and Development (“OECD”) introduced the base erosion and profit shifting project which sets out a plan to address international taxation principles in a globalized, digitized business world (the “BEPS Plan”). As a result, changes have been and continue to be made to numerous international tax principles and local tax regimes. Due to the expansion of our international business activities, those modifications may increase our worldwide effective tax rate, create tax and compliance obligations in jurisdictions in which we previously had none and adversely affect our financial position.

Risks Related to the Notes

We have incurred substantial indebtedness that may decrease our business flexibility, access to capital, and/or increase our borrowing costs, and we may still incur substantially more debt, which may adversely affect our operations and financial results.

In May 2020, we issued $253.0 million aggregate principal amount of Notes (the "2025 Notes") and in September 2024, we issued $460.0 million aggregate principal amount of Notes (the "2029 Notes" and together with the 2025 Notes, the "Notes"), respectively. As of December 31, 2024, we had approximately $711.5 million outstanding aggregate principal amount of the Notes. Our indebtedness may limit our ability to borrow additional funds for working capital, capital expenditures, acquisitions or other general business purposes, limit our ability to use our cash flow or obtain additional financing for future working capital, capital expenditures, acquisitions or other general business purposes, require us to use a substantial portion of our cash flow from operations to make debt service payments, limit our flexibility to plan for, or react to, changes in our business and industry, place us at a competitive disadvantage compared to our less leveraged competitors and increase our vulnerability to the impact of adverse economic and industry conditions.

Our debt obligations may adversely affect our ability to raise additional capital and will be a burden on our future cash resources, particularly if we elect to settle these obligations in cash upon conversion or upon maturity or required repurchase.

Our ability to meet our payment obligations under the Notes depends on our future cash flow performance. This, to some extent, is subject to general economic, financial, competitive, legislative and regulatory factors, as well as other factors that may be beyond our control. There can be no assurance that our business will generate positive cash flow from operations, or that additional capital will be available to us, in an amount sufficient to enable us to meet our debt payment obligations and to fund other liquidity needs. If we are unable to generate sufficient cash flow to service our debt obligations, we may need to refinance or restructure our debt, sell assets, reduce or delay capital investments, or seek to raise additional capital. Our ability to refinance our indebtedness will depend on the capital markets and our financial condition at such time. We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations. As a result, we may be more vulnerable to economic downturns, less able to withstand competitive pressures and less flexible in responding to changing business and economic conditions.

We may issue additional shares of our common stock in connection with conversions of the Notes, and thereby dilute our existing stockholders and potentially adversely affect the market price of our common stock.

In the event that the remaining Notes are converted and we elect to deliver shares of common stock, the ownership interests of existing stockholders will be diluted, and any sales in the public market of any shares of our common stock issuable upon such conversion could adversely affect the prevailing market price of our common stock. In addition, the anticipated conversion of the Notes could depress the market price of our common stock.

The fundamental change provisions of the Notes may delay or prevent an otherwise beneficial takeover attempt of us.

If the Company undergoes a “fundamental change,” subject to certain conditions, holders may require the Company to repurchase for cash all or part of their Notes at a fundamental change repurchase price equal to 100% of the principal amount of the Notes to be repurchased, plus accrued and unpaid interest to, but excluding, the fundamental change repurchase date. In addition, if such fundamental change also constitutes a “make-whole fundamental change,” the conversion rate for the Notes may be increased upon conversion of the Notes in connection with such “make-whole fundamental change.” Any increase in the conversion rate will be determined based on the date on which the “make-whole fundamental change” occurs or becomes effective and the price paid (or deemed paid) per share of our common stock in such transaction. Any such increase will be dilutive to our existing stockholders. Our obligation to repurchase the Notes or increase the conversion rate upon the occurrence of a make-whole fundamental change may, in certain circumstances, delay or prevent a takeover of us that might otherwise be beneficial to our stockholders.

The Capped Call Transactions may affect the value of the Notes and our common stock.

In connection with the issuance of the Notes, we entered into Capped Call Transactions with certain financial institutions. The Capped Call Transactions are expected generally to reduce or offset the potential dilution upon conversion of the Notes and/or offset any cash payments we are required to make in excess of the principal amount of converted Notes, as the case may be, with such reduction and/or offset subject to the Cap Price, subject to certain adjustments under the terms of the Capped Call Transactions.

From time to time, certain financial institutions (with which we entered into the Capped Call Transactions) or their respective affiliates may modify their hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the Notes. This activity could also cause or avoid an increase or a decrease in the market price of our common stock.

The potential effect, if any, of these transactions and activities on the price of our common stock or Notes will depend in part on market conditions and cannot be ascertained at this time. Any of these activities could adversely affect the value of our common stock.

We are subject to counterparty risk with respect to the Capped Call Transactions.

All or some of the financial institutions (which are counterparties to the capped call transactions) might default under the Capped Call Transactions. Our exposure to the credit risk of the counterparties will not be secured by any collateral. Past global economic conditions have resulted in the actual or perceived failure or financial difficulties of many financial institutions. If an option counterparty becomes subject to insolvency proceedings, we will become an unsecured creditor in those proceedings with a claim equal to our exposure at the time under the capped call transactions with such option counterparty. Our exposure will depend on many factors but, generally, an increase in our exposure will be correlated to an increase in the market price and in the volatility of our common stock. In addition, upon a default by an option counterparty, we may suffer adverse tax consequences and more dilution than we currently anticipate with respect to our common stock. We can provide no assurance as to the financial stability or viability of the option counterparties.

Risks Related to our International Operations

We face risks associated with operating in international markets that may limit our ability to develop and sell our products, which could result in a decrease of our revenues.

We operate on a global basis and political, social, economic and security conditions in countries in which we operate may limit our ability to develop and sell our products. Specifically, we have operations and do business in Israel, the United Kingdom, France, Brazil and Ukraine. Continued political and social instability and war in these regions, and any other areas in the world where we have operations, may affect our business and operations in those and other neighboring regions.

In March 2022, in response to the war between Russia and Ukraine, a number of countries, including the United States, imposed sanctions and export controls on Russia, which in turn imposed counter-sanctions in response. While sales in Russia represented a very small percentage of our overall business, and while our operations in Russia and Ukraine have historically been a small portion of our overall workforce, the conflict is complex and evolving and subjects us to additional regulatory risk and compliance costs. As of December 31, 2024, we do not have any employees or contractors in Russia. We have no way to predict the progress or outcome of the situation, including any impact on the rest of the world, as the conflict and government reactions are rapidly developing.

Our principal research and development facility, which also houses a portion of our support and general and administrative teams, is located in Israel. Since the establishment of the State of Israel in 1948, a number of armed conflicts have taken place between Israel and its neighboring countries, as well as incidents of terror activities and other hostilities, and a number of state and non-state actors have publicly committed to its destruction. In addition, Israel is currently in a war and recently experienced social unrest in connection with the judiciary reform bill. Security, political and economic conditions in Israel could directly affect our operations. We could be adversely affected by hostilities involving Israel, including acts of terrorism or any other hostilities involving or threatening Israel, the interruption or curtailment of trade between Israel and its trading partners, a significant increase in inflation or a significant downturn in the economic or financial condition of Israel. Any on-going or future armed conflicts, terrorist activities, tension along the Israeli borders or with other countries in the region, including Lebanon, Syria, Iran or Yemen, or political instability in the region could disrupt international trading activities in Israel and may materially and negatively affect our business and could harm our results of operations.

Certain countries, as well as certain companies and organizations, continue to participate in a boycott of Israeli companies, companies with large Israeli operations and others doing business with Israel and Israeli companies. The boycott, restrictive laws, policies or practices directed towards Israel, Israeli businesses or Israeli citizens could, individually or in the aggregate, have a material adverse effect on our business in the future.

Some of our employees in Israel are obligated to perform routine military reserve duty in the Israel Defense Forces, depending on their age and position in the armed forces. Furthermore, they have been and may in the future be called to active reserve duty at any time under emergency circumstances for extended periods of time. Currently, due to the war in Israel that began on October 7, 2023, a portion of our employees have been called to active reserve duty and additional employees may be called in the future, if needed. It is possible that our operations could be disrupted if this continues for a significant period of time or if the situation further deteriorates, including, among other things, an expansion of the war to other countries, damage to critical infrastructure and general unrest, which could harm our business.

Our insurance does not cover losses that may occur as a result of an event associated with the security situation in the Middle East or for any resulting disruption in our operations. Although the Israeli government has in the past covered the reinstatement value of direct damages that were caused by terrorist attacks or acts of war, we cannot be assured that this government coverage will be maintained or, if maintained, will be sufficient to compensate us fully for damages incurred and the government may cease providing such coverage or the coverage might not suffice to cover potential damages. Any losses or damages incurred by us could have a material adverse effect on our business.

The tax benefits available to our Israeli subsidiary terminated in 2020 and we expect our Israeli subsidiary to become subject to an increase in taxes.

Our Israeli subsidiary has benefited from a status of a “Beneficiary Enterprise” under the Israeli Law for the Encouragement of Capital Investments, 5719-1959, or the Investment Law, since its incorporation. As of December 31, 2024, the tax benefit that we have been utilizing for our Israeli subsidiary terminated. A tax rate of 16% should be paid by our Israeli subsidiary per such eligible income under the terms of the Investment Law, subject to meeting various conditions. To the extent we do not meet these conditions, our Israeli operations will be subject to a corporate tax at the standard rate of 23%. If the Israeli subsidiary is subject to a corporate tax at the standard rate, it may adversely affect our tax expenses and effective tax rates. Additionally, if our Israeli subsidiary increases its activities outside of Israel, for example, through acquisitions, these activities may not be eligible for inclusion in Israeli tax benefit programs. The tax benefit derived from the Investment Law is dependent upon the ability to generate sufficient taxable income. Accordingly, our Israeli subsidiary may be unable to earn enough taxable income in order to fully utilize its tax benefits.

Risks Related to the Ownership of our Common Stock

Substantial future sales of shares of our common stock could cause the market price of our common stock to decline.

Sales of a substantial number of shares of our common stock into the public market, or the perception that these sales might occur, for whatever reason, including as a result of the conversion of the outstanding Notes or future public equity offerings, could depress the market price of our common stock and could impair our ability to raise capital through the sale of additional equity securities. We are unable to predict the effect that such sales may have on the prevailing market price of our common stock.

As of December 31, 2024, we had options, restricted stock units (“RSUs”) and performance stock units (“PSUs”) outstanding that, if fully vested and exercised, would result in the issuance of approximately 7.6 million shares of our common stock. All of the shares of our common stock issuable upon exercise of options and vesting of RSUs and PSUs have been registered for public resale under the Securities Act. Accordingly, these shares will be able to be freely sold in the public market upon issuance as permitted by any applicable vesting requirements.

Our stock price has been and will likely continue to be volatile.

The market price for our common stock has been, and is likely to continue to be, volatile for the foreseeable future, and is subject to wide fluctuations in response to various factors, some of which are beyond our control. These factors, as well as the volatility of our common stock, could affect the price at which our convertible noteholders could sell the common stock received upon conversion of the Notes and could also impact the trading price of the Notes. The market price of our common stock may fluctuate significantly in response to a number of factors, many of which we cannot predict or control, including the factors listed below and other factors described in this “Risk Factors” section:

• actual or anticipated fluctuations in our results or those of other companies in our industry;
• the financial projections we may provide to the public, any changes in these projections or our failure to meet these projections;
• failure of securities analysts to maintain coverage of our company, changes in financial estimates by any securities analysts who follow our company, or our failure to meet these estimates or the expectations of investors;
• ratings changes by any securities analysts who follow our company;
• announcements of new products, services or technologies, commercial relationships, acquisitions or other events by us or other companies in our industry;
• new announcements that affect investor perception of our industry, including reports related to the discovery of significant cyberattacks;
• changes in operating performance and stock market valuations of other technology companies generally, or those in our industry in particular;
• price and volume fluctuations in certain categories of companies or the overall stock market, including as a result of trends in the global economy;
• the trading volume of our common stock;
• investor confusion with respect to the Company's results of operation during the SaaS transition;
• changes in accounting principles;
• sales of large blocks of our common stock, including sales by our executive officers, directors and significant stockholders;
• additions or departures of any of our key personnel;
• lawsuits threatened or filed against us;
• short sales, hedging and other derivative transactions involving our capital stock;
• general economic conditions in the United States and abroad, including inflationary pressures and higher interest rates;
• changing legal or regulatory developments in the United States and other countries;
• conversion of the Notes; and
• other events or factors, including those resulting from war, incidents of terrorism, pandemics, natural disasters or responses to these events.

In addition, the stock markets have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many technology companies. Stock prices of many technology companies have fluctuated in a manner unrelated or disproportionate to the operating performance of those companies. In the past, stockholders have instituted securities class action litigation following periods of market volatility. If we were to become involved in securities litigation, it could subject us to substantial costs, divert resources and the attention of management from our business and adversely affect our business, results of operations, financial condition and cash flows and may cause a significant increase in the premium paid for our directors and officers insurance.

We do not intend to pay dividends on our common stock, so any returns will be limited to the value of our stock.

We have never declared or paid cash dividends on our common stock. We currently anticipate that we will retain any future earnings and do not expect to pay any dividends in the foreseeable future. Any determination to pay dividends in the future will be at the discretion of our board of directors and will be dependent on a number of factors, including our financial condition, results of operations, capital requirements, share repurchases, general business conditions and other factors that our board of directors may deem relevant. Until such time that we pay a dividend, stockholders, including holders of our Notes who receive shares of our common stock upon conversion of the Notes, must rely on sales of their common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments.

Anti-takeover provisions in our charter documents and under Delaware law and provisions in the indentures for our Notes could make an acquisition of us, which may be beneficial to our stockholders, more difficult and may prevent attempts by our stockholders to replace or remove our current management, thereby depressing the trading price of our common stock and Notes.

Provisions in our amended and restated certificate of incorporation and amended and restated bylaws may delay, discourage or prevent an acquisition of us or a change in our management, including transactions in which stockholders might otherwise receive a premium for their shares, or transactions that our stockholders might otherwise deem to be in their best interests. These provisions include:

• authorizing “blank check” preferred stock, which could be issued by the board without stockholder approval and may contain voting, liquidation, dividend and other rights superior to our common stock, which would increase the number of outstanding shares and could thwart a takeover attempt;
• a classified board of directors whose members can only be dismissed for cause;
• the prohibition on actions by written consent of our stockholders;
• the limitation on who may call a special meeting of stockholders;
• the establishment of advance notice requirements for nominations for election to our board of directors or for proposing matters that can be acted upon at stockholder meetings; and
• the requirement of at least 75% of the outstanding capital stock to amend any of the foregoing second through fifth provisions.

In addition, because we are incorporated in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which limits the ability of stockholders owning in excess of 15% of our outstanding voting stock to merge or combine with us, unless the merger or combination is approved in a prescribed manner. Although we believe these provisions collectively provide for an opportunity to obtain greater value for stockholders by requiring potential acquirers to negotiate with our board of directors, they would apply even if an offer rejected by our board were considered beneficial by some stockholders. In addition, these provisions may frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our board of directors, which is responsible for appointing the members of our management.

In addition, if a “fundamental change” occurs prior to the maturity date of the Notes, holders of the Notes will have the right, at their option, to require us to repurchase all or a portion of their Convertible Notes. If a “make-whole fundamental change” (as defined in the Indentures) occurs prior the maturity date, we will in some cases be required to increase the conversion rate of the Notes for a holder that elects to convert its Notes in connection with such “make-whole fundamental change.” These features of the Notes may make a potential acquisition more expensive for a potential acquiror, which may in turn make it less likely for a potential acquiror to offer to purchase our company, or reduce the amount of consideration offered for each share of our common stock in a potential acquisition. Furthermore, the Indentures prohibit us from engaging in certain mergers or acquisitions unless, among other things, the surviving entity assumes our obligations under the Notes.

General Risks Factors

Real or perceived errors, failures or bugs in our software could adversely affect our growth prospects.

Because our software uses complex technology, undetected errors, failures or bugs may occur. Our software is often installed and used in a variety of computing environments with different operating system management software, and equipment and networking configurations, which may cause errors or failures of our software or other aspects of the computing environment into which it is deployed. In addition, deployment of our software into computing environments may expose undetected errors, compatibility issues, failures or bugs in our software. Despite testing by us, errors, failures or bugs may not be found in our software until it is released to our customers. Moreover, our customers could incorrectly implement or inadvertently misuse our software, which could result in customer dissatisfaction and adversely impact the perceived utility of our products as well as our brand. Any of these real or perceived errors, compatibility issues, failures or bugs in our software could result in negative publicity, reputational harm, loss of or delay in market acceptance of our software, loss of competitive position or claims by customers for losses sustained by them. In such an event, we may be required, or may choose, for customer relations or other reasons, to expend additional resources in order to help correct the problem. Alleviating any of these problems could require significant expenditures of our capital and other resources and could cause interruptions or delays in the use of our solutions, which could cause us to lose existing or potential customers and could adversely affect our operating results and growth prospects.

We may require additional capital to support our business growth, and this capital might not be available on acceptable terms, or at all.

We continue to make investments to support our business growth and may require additional funds to respond to business challenges, including the need to develop new features or enhance our software, improve our operating infrastructure or acquire complementary businesses and technologies. Accordingly, we may need to engage in equity or debt financing to secure additional funds. If we raise additional funds through future issuances of equity or convertible debt securities, our existing stockholders could suffer significant dilution, and any new equity securities we issue could have rights, preferences and privileges superior to those of holders of our common stock. Any debt financing that we may secure in the future could involve restrictive covenants relating to our capital raising activities and other financial and operational matters, which may make it more difficult for us to obtain additional capital and to pursue business opportunities, including potential acquisitions. We may not be able to obtain additional financing on terms favorable to us, if at all. If we are unable to obtain adequate financing on terms satisfactory to us when we require it, our ability to continue to support our business growth and to respond to business challenges could be significantly impaired, and our business may be adversely affected.

Our business is subject to the risks of fire, power outages, floods, earthquakes, pandemics and other catastrophic events, and to interruption by manmade problems such as terrorism and war.

A significant natural disaster, such as a fire, flood or an earthquake, an outbreak of a pandemic disease or a significant power outage could have a material adverse impact on our business, results of operations and financial condition. In the event our customers’ IT systems or our channel partners’ selling or distribution abilities are hindered by any of these events, we may miss financial targets, such as revenues and sales targets, for a particular quarter. Further, if a natural disaster occurs in a region from which we derive a significant portion of our revenue, customers in that region may delay or forego purchases of our products, which may materially and adversely impact our results of operations for a particular period. In addition, acts of terrorism or war could cause disruptions in our business or the business of channel partners, customers or the economy as a whole. Given our typical concentration of sales at each quarter end, any disruption in the business of our channel partners or customers that impacts sales at the end of our quarter could have a significant adverse impact on our quarterly results. All of the aforementioned risks may be augmented if the disaster recovery plans for us and our channel partners prove to be inadequate. To the extent that any of the above results in delays or cancellations of customer orders, or the delay in the development, deployment or shipment of our products, our business, financial condition and results of operations would be adversely affected.

Changes in financial accounting standards may adversely impact our reported results of operations.

New accounting pronouncements and varying interpretations of accounting pronouncements have occurred and may occur in the future. Changes to existing rules or the questioning of current practices may adversely affect our operating results or the way we conduct our business.

If securities or industry analysts do not publish research or reports about our business, or publish negative reports about our business, our stock price and trading volume could decline.

The trading market for our common stock depends in part on the research and reports that securities or industry analysts publish about us or our business, our market and our competitors. We do not have any control over these analysts or their expectations regarding our performance on a quarterly or annual basis. If one or more of the analysts who cover us downgrade our stock or change their opinion of our stock, our stock price would likely decline. If we fail to meet one or more of these analysts’ published expectations regarding our performance on a quarterly basis, our stock price or trading volume could decline. If one or more of these analysts cease coverage of our company or fail to regularly publish reports on us, we could lose visibility in the financial markets, which could cause our stock price or trading volume to decline.

We are obligated to develop and maintain proper and effective internal control over financial reporting. These internal controls may not be determined to be effective, which may adversely affect investor confidence in our company and, as a result, the value of our common stock.

We are required, pursuant to Section 404 of the Sarbanes–Oxley Act, to furnish a report by management on, among other things, the effectiveness of our internal control over financial reporting on an annual basis. This assessment includes disclosure of any material weaknesses identified by our management in our internal control over financial reporting. We are also required to have our independent registered public accounting firm issue an opinion on the effectiveness of our internal control over financial reporting on an annual basis. During the evaluation and testing process, if we identify one or more material weaknesses in our internal control over financial reporting, we will be unable to assert that our internal control over financial reporting is effective.

If we are unable to assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an opinion on the effectiveness of our internal control over financial reporting, we could lose investor confidence in the accuracy and completeness of our financial reports, which could cause the price of our common stock to decline, and we may be subject to investigation or sanctions by the SEC.

Future sales and issuances of our capital stock or rights to purchase capital stock could result in additional dilution of the percentage ownership of our stockholders and could cause our stock price to decline.

Future sales and issuances of our capital stock or rights to purchase our capital stock could result in substantial dilution to our existing stockholders. We may sell common stock, convertible securities and other equity securities in one or more transactions at prices and in a manner as we may determine from time to time. If we sell any such securities in subsequent transactions, investors may be materially diluted. New investors in such subsequent transactions could gain rights, preferences and privileges senior to those of holders of our common stock.

Risk management and strategy

We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, customer's data, sensitive financial information and personal identifiable information (“Information Systems and Data”).

The Chief Information Security Officer (“CISO”) and the information security team that reports to the CISO help identify, assess and manage our cybersecurity and privacy threats and risks, including through the use of our external and internal risk assessments. The CISO and the information security team identify and assess risks from cybersecurity threats by monitoring and evaluating our networks, data and our risk profile using various methods including, among other things, manual tools, automated tools, analyzing reports of threats and actors, conducting scans of the computer networks, internal and/or external audits (including compliance audits with respect to ISO (27001, 27017, 27018, and 27701), SOC 2, PCI DSS and HIPAA for our corporate and cloud based software solutions), conducting assessments for potential internal and external threats, third-party-conducted risk assessments, conducting vulnerability assessments, third-party-conducted red/blue team testing and tabletop incident response exercises and subscribing to reports and services providing cybersecurity threat intelligence.

Depending on the environment, we implement and maintain various technical, physical and administrative processes, measures, standards and policies designed to manage and mitigate risks from cybersecurity threats to our Information Systems and Data, including, among other things, incident detection and response plan and procedures, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, cryptography, network security controls, secured remote access, access controls, change management, physical security, asset management, secured software development lifecycle, logging and monitoring, third-party risk management programs, security awareness trainings, third-party and company penetration testing, cybersecurity insurance and dedicated cybersecurity staff. We use our own software to help further mitigate the risk of a material cybersecurity incident. In addition, our Varonis Data Security Platform is deployed internally as part of our insider threat, data security posture, security operations and compliance management programs.

Our assessment and management of material risks from cybersecurity and privacy threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register. In addition, the information security team works with management to prioritize our risks that are more likely to have a material impact on our business and our CISO evaluates material risks from cybersecurity threats against our overall business objectives and reports to the technology committee of the board of directors (the “technology committee”) and the board of directors. In addition, the audit committee of the board of directors (the “audit committee”) oversees our overall enterprise risk management program and receives semi-annual updates on cybersecurity and privacy threat-related risks as part of such program.

We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats, including, among other things. cybersecurity consultants, cybersecurity software providers, penetration testing firms and other professional services firms.

We use third-party service providers to perform a variety of functions throughout our business, such as SaaS providers and cloud hosting companies. We have a vendor management program designed to manage cybersecurity and privacy risks associated with our use of these providers. The program includes risk assessments for vendors, security questionnaires, review of the vendor’s written security program, review of security assessments and reports, audits, and external attack surface scans related to the vendor and imposition of information contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity and privacy on the provider.

For a description of the risks from cybersecurity threats that may have a material effect on us, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including “Security breaches, cyberattacks or other cyber-risks of our IT and production systems could expose us to significant liability and cause our business and reputation to suffer and harm our competitive position.”

Governance

Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The technology committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The technology committee meets quarterly with members of management, including our CISO, Chief Information Officer ("CIO"), Chief Technology Officer or VP of Cybersecurity Engineering, as applicable, to discuss cybersecurity developments, significant cybersecurity threats and risks and the processes we have implemented to address them. The audit committee also receives presentations related to cybersecurity threats, risk and mitigation on a semi-annual basis unless more frequent discussions are necessary. The board of directors also receives a presentation from our CISO or CIO on our cybersecurity measures and risks at least annually.

Our cybersecurity risk assessment and management processes are implemented and maintained by our CISO. Guy Shamilov, our CISO for the last eight years, has been a chief information security officer for nine years and is certified by Certified Information Systems Security Professional (CISSP), among other technical certifications he holds with respect to cybersecurity. He has worked over the last twenty years in the security industry, and prior to working with us, he was CISO of Tata Consultancy Services, Deputy Chief Information Security Officer of Traiana, Information Security Manager of Logic Industries, Senior Information Security Specialist of Migdal Group and Information Security and System Administrator at Matrix. Our CISO oversees the implementation and compliance of our information security standards and mitigation of information security related risks.

Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our CISO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.

Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Security Management, the Chief Executive Officer, the Chief Financial Officer, the General Counsel, the CIO and other senior members of the Company. Such individuals work with our incident response team to help us assess, mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan includes reporting to the technology committee of the board of directors for certain cybersecurity incidents.

We have offices in Herzliya, Israel where we employ the majority of our research and development team and a portion of our support and general and administrative teams. We also have offices in North Carolina and Cork, Ireland which serve as our primary U.S. and EMEA customer support and inside sales center, respectively. Additionally, we have offices in New York and Florida and smaller offices in Arizona, France, the United Kingdom, Oregon, Australia, Germany, the Netherlands, Singapore and Luxembourg which serve as regional sales offices and some of which are customer support centers. Our office space is primarily leased, the majority of which is under long-term leases with varying expiration dates. We believe that our facilities are adequate to meet our needs in the near future.

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our consolidated financial statements and related notes appearing elsewhere in this Annual Report on Form 10-K. This discussion contains forward-looking statements that reflect our plans, estimates and beliefs, and involve risks and uncertainties. Our actual results and the timing of certain events could differ materially from those anticipated in these forward-looking statements as a result of several factors, including those discussed in the section titled “Risk Factors” included under Part I, Item 1A and elsewhere in this Annual Report. See “Special Note Regarding Forward-Looking Statements and Summary Risk Factors” in this Annual Report.

The Transition to a SaaS Delivery Model

In response to the evolving needs of our customers and the growing threat landscape, we are strategically transitioning to a SaaS delivery model. This transition is driven by the increased importance of an automated, data-centric approach to security and the demand for comprehensive protection in the face of heightened cyber risks, collaboration across multiple platforms, the adoption of generative AI tools and the necessity for compliance. Enterprises now use many different combinations of on-premises and cloud data stores, SaaS applications and IaaS environments and this complexity requires a greater level of automated protection. We believe our offering provides comprehensive data coverage and our ability to address this demand has and will continue to be a key driver of our growth.

In the second half of 2021, we launched our first SaaS offering, introducing new products and support for cloud infrastructure environments and applications. At the end of 2022, we announced the availability of our flagship Varonis Data Security Platform as a SaaS, which was previously only sold as a self-hosted solution. The benefits of SaaS delivery are widely established for both customers and providers, and we believe this evolution of a SaaS delivery option for the Varonis Data Security Platform is transformational. The advantages include: quicker and easier deployment and maintenance of solutions with reduced infrastructure and personnel requirements; a lower total cost of ownership; faster deployment of risk assessments, which is the core of our sales motion; enhanced threat detection; continual threat model updates; increased automation for securing data in place; and the ability to deliver additional features and functionality to customers more efficiently. In addition, our Managed Data Detection and Response ("MDDR") offering further reduces both the likelihood of a breach and its potential impact by enabling automated 24x7x365 monitoring with a service level agreement (SLA) that requires Varonis to respond to alerts within a specified time frame. Our MDDR offering is only available for our SaaS customers because of the automation and visibility that’s built into our SaaS platform.

Since launching our SaaS offerings, we have seen SaaS deployments grow significantly and expect them to continue to increase and become the primary driver of our revenues. During this transition, we expect our revenues to be negatively impacted due to revenue recognition accounting treatment variations associated with the increase in SaaS sales and existing customer conversions to SaaS. We expect these revenue variations to persist throughout the transition to a SaaS delivery model, which we believe will be complete by the end of 2025.

Overview

Varonis is a leader in data security as, since we started operations in 2005, we recognized that an enterprise's capacity to create and share data far exceeded its capacity to protect it. We believed that rapid data growth combined with increasing information dependence would change the global economy and the risk profiles of corporations and governmental agencies. Our focus has been on using innovation to address the cyber-implications of these trends, creating software that provides new ways to track, alert and protect data wherever it is stored.

We sell substantially all of our products and services to channel partners, including distributors and resellers, which sell to end-user customers, which we refer to in this report as our customers. We believe that our sales model, which combines the leverage of a channel sales model with our highly trained and professional sales force, has and will continue to play a major role in our ability to grow and to successfully deliver our unique value proposition for enterprise data. While our products serve customers of all sizes, across industries and across geographies, the marketing focus and majority of our sales focus is on targeting larger organizations who can make sizable initial purchases with us and, over time, have a greater potential lifetime value. Our customers span leading firms in the financial services, public, healthcare, industrial, insurance, energy and utilities, technology, consumer and retail, education and construction and engineering sectors. We believe our existing customer base serves as a strong source of future incremental revenues given our broad platform of products, their growing volumes and complexity of enterprise data and related security concerns. We will continue our focus on targeting larger organizations who can make sizable purchases with us initially and over time. We are also focused on maintaining a high renewal rate by investing in the quality and reliability of our customer service and support teams to ensure our customers receive value from our products and providing software upgrades and enhancements when and if they are available. Our product offering currently contains coverage for most mission-critical cloud and on-premises data stores and cloud infrastructure environments, and many critical SaaS applications. Our renewal rate continued to be over 90% for the year ended December 31, 2024.

We believe there is a significant long-term growth opportunity in both domestic and international markets, which could include any organization that relies on data stored in SaaS applications, IaaS environments, NAS devices, file shares, databases and email servers. For the year ended December 31, 2024, approximately 73% of our revenues were derived from the United States, while approximately 21% of our revenues were derived from EMEA and approximately 6% from ROW. Additionally, despite the revenue recognition variations from the accounting treatment associated with the positive trend of our increase in SaaS sales and existing customer conversions to SaaS, total revenues still grew approximately 10% for the year ended December 31, 2024 compared with the year ended December 31, 2023. We continue to expect expansion in both domestic and international markets to be key components of our long-term growth strategy. Over the last few years, we have seen changes in customer buying patterns including, some budgetary tightening and additional scrutiny on enterprise spending as a result of a higher inflation and interest rate environment.

We continue to expand our domestic and international operations as part of our long-term growth strategy. While the expansion of our domestic operations is focused primarily on our underpenetrated territories, the expansion of our international operations depends in particular on our ability to hire, integrate and retain local sales leadership and personnel in these international markets, acquire new channel partners and implement an effective marketing strategy. Given the nominal amount of our ROW revenues, our ROW revenue growth rates have fluctuated in the past and may fluctuate in the future based on the timing of deal closures. In addition, the further expansion of our international operations will increase our sales and marketing and general and administrative expenses and will subject us to a variety of risks and challenges, including those related to economic and political conditions in each region, compliance with foreign laws and regulations, and compliance with domestic laws and regulations applicable to our international operations.

Since inception, we have continued to scale our business and execute on strategic initiatives which we believe have positioned us for durable long-term growth. During 2024, we have continued to grow our revenues despite revenue recognition accounting treatment variations associated with the increase in SaaS sales and existing customer conversions to SaaS. For the years ended December 31, 2024, 2023 and 2022, SaaS revenues were $208.8 million, $44.4 million and $2.2 million, respectively. For the years ended December 31, 2024, 2023 and 2022, our total revenues were $551.0 million, $499.2 million and $473.6 million, respectively. For the years ended December 31, 2024, 2023 and 2022, we had operating losses of $117.7 million, $117.2 million and $121.2 million and net losses of $95.8 million, $100.9 million and $124.5 million, respectively.

Instability in the Middle East

Due to the war that began on October 7, 2023, a portion of our employees in Israel have been called to active reserve duty and additional employees may be called in the future, if needed. We have a business continuity plan and will remain aware and responsive to the evolving situation; however, any deterioration in the situation might have a negative impact on our operations.

Key Performance Indicators and Recent Business Highlights

Annual Recurring Revenues

Annual recurring revenues is a key performance indicator defined as the annualized value of active SaaS contracts, term-based subscription license contracts and maintenance contracts in effect at the end of that period. SaaS contracts, term-based subscription license contracts and maintenance contracts are annualized by dividing the total contract value by the number of days in the term and multiplying the result by 365.

As of December 31, 2024, 2023 and 2022, ARR was $641.9 million, $543.0 million and $465.1 million, respectively, an increase of 18% and 17% period over period, respectively. The annualized value of contracts is a legal and contractual determination made by assessing the contractual terms with our customers. The annualized value of these contracts is not determined by reference to historical revenues, deferred revenues or any other GAAP financial measure over any period. ARR is not a forecast of future revenues and can be impacted by contract start and end dates and renewal rates. We expect ARR to continue to increase in absolute dollars.

Transition to SaaS Delivery Model and SaaS as a Percentage of ARR

Over the last three years, we have strategically expanded our offering to be delivered as SaaS solutions. Since that time, we have seen SaaS deployments grow significantly and expect them to continue to increase and become the primary driver of our revenues. Due to differences in the revenue recognition accounting treatment, the transition to a SaaS delivery model may cause significant variation in the reported revenues for a given period compared to the same period in the previous year. We expect these revenue variations to persist throughout the transition to a SaaS delivery model, which we believe will be complete by the end of 2025.

As of December 31, 2024, SaaS as a percentage of total ARR was approximately 53% and we expect this percentage to continue to increase throughout the transition to a SaaS delivery model.

Remaining Performance Obligations

Remaining performance obligations ("RPO") represent contracted revenues that have not yet been recognized, which includes deferred revenues and non-cancelable amounts that will be invoiced in the future. Our RPO was $729.7 million as of December 31, 2024. We expect RPO to increase in absolute dollars as we continue to transition to a SaaS delivery model.

Components of Operating Results

Revenues

Term License Subscription Revenues. Term license subscription revenues relate to subscription license revenues which are sold on-premises and are recognized at the point in time when the software license has been delivered and the benefit of the asset has transferred. Maintenance associated with a term license subscription is recognized ratably over the term of the agreement. Due to the transition to a SaaS delivery model, we expect term license subscription revenues to continue to decline.

SaaS Revenues. SaaS revenues relate to the Company's SaaS platform. Over the last three years, the Company began to offer SaaS solutions to its customers, including its (i) flagship Data Security Platform as a SaaS that was previously only sold as a self-hosted solution and (ii) DatAdvantage Cloud product lines. Each of these products allow customers to use hosted software, and the related revenue from these products is recognized ratably over the associated contract period. We expect SaaS revenues to continue to grow considerably and become the primary driver of our revenues in 2025, which is when we believe our transition to a SaaS delivery model will be complete. Conversions from a license sold on-premises to our SaaS offering during the original subscription period are accounted for on a prospective basis. Due to the transition to a SaaS business model, the timing of renewals and renewal rates, we could produce significant variation in the revenues we recognize in a given period.

Maintenance and Services Revenues. Maintenance and services revenues consist of revenues from maintenance agreements of past perpetual license sales and, to a lesser extent, professional services. Customers with maintenance agreements are entitled to receive support and unspecified upgrades and enhancements when and if they become available. We recognize the revenues associated with maintenance ratably over the associated contract period. We measure the renewal rate for our customers over a 12-month period, based on a dollar renewal rate for contracts expiring during that time period. Our renewal rate for each of the years ended December 31, 2024, 2023 and 2022 continued to be over 90%. We do not expect perpetual license revenues in the future and, therefore, we expect the associated maintenance and support to continue to decline despite the strong renewal rates due to the transition to a SaaS delivery model. We also offer professional services, generally provided on a time and materials basis, focused on training our customers in the use of our products. We recognize the revenues associated with these professional services as we deliver the services, provide the training or when the service term has expired. Professional services have always been a small percentage of our total revenues and we expect it to continue to be a small percentage. Accordingly, maintenance and services revenues are expected to continue to decline.

The following table sets forth the percentage of our revenues that have been derived from term license subscriptions, SaaS and maintenance and services revenues for the periods presented.

Our products are used by a wide range of enterprises, including Fortune 500 corporations and small and medium-sized businesses. Our customers span a broad array of industries and are located in over 95 countries.

Cost of Revenues, Gross Profit and Gross Margin

Cost of revenues consist primarily of salaries (including payroll tax expense related to stock-based compensation), employee benefits (including commissions and bonuses) and stock-based compensation for our customer support, customer success, MDDR and services employees; third-party hosting fees; amortization of acquired intangible assets; travel expenses; and allocated overhead costs for facilities, IT and depreciation. We recognize expenses related to these costs as they are incurred and expect that these costs will increase in absolute dollars as we continue to invest in our customer success, support and MDDR teams, move to a SaaS delivery model and support the underlying programs that play a critical role in maintaining our high renewal rate.

Gross profit is total revenues less total cost of revenues. Gross margin is gross profit expressed as a percentage of total revenues. As the majority of our expenses are relatively fixed quarter over quarter and due to the seasonality of our business, the first quarter typically results in the lowest gross margin as our first quarter revenues have historically been the lowest for the year. Conversely, the fourth quarter typically results in the highest gross margin as our fourth quarter revenues have historically been the highest for the year. As we complete the transition to a SaaS delivery model, we expect this seasonality to decrease due to differences in the revenue recognition accounting treatment.

Operating Expenses

Operating expenses are classified into three categories: research and development, sales and marketing and general and administrative. For each category, the largest component is personnel costs, which consists of salaries (including payroll tax expense related to stock-based compensation), employee benefits (including commissions and bonuses) and stock-based compensation. Operating expenses also include allocated overhead costs for facilities, IT and depreciation. Allocated costs for facilities primarily consist of rent and office maintenance. Operating expenses are generally recognized as incurred. As a company, we have always aimed to tie our level of investment in the business to the revenues we expect to achieve and we actively manage expenses across the business. We expect personnel costs to continue to increase in absolute dollars as we continue to grow our business.

Research and Development. Research and development expenses primarily consist of personnel costs attributable to our research and development personnel, as well as allocated overhead costs and acquired in-process research and development. We expense research and development costs as incurred. We expect that our research and development expenses will continue to increase in absolute dollars as we further strengthen our technology platform and invest in the development of both existing and new products through the hiring of talented and capable employees.

Sales and Marketing. Sales and marketing expenses are the largest component of our operating expenses and consist primarily of personnel costs, as well as marketing and business development costs, travel expenses, third-party hosting fees, training and education and allocated overhead costs. We expect that sales and marketing expenses will continue to increase in absolute dollars as we plan to expand our sales and marketing efforts, both domestically and internationally. We also expect sales and marketing expenses to continue to be our largest category of operating expenses.

General and Administrative. General and administrative expenses primarily consist of personnel and facility-related costs for our executive, finance, legal, human resources and administrative personnel. Other expenses are comprised of legal, accounting and other consultant fees and other corporate expenses and allocated overhead. We expect that general and administrative expenses will increase in absolute dollars as we expand our operations.

Financial Income (Expenses), Net

Financial income (expenses), net consists primarily of interest income, foreign exchange gains or losses, amortization of debt issuance costs and interest expense. Interest income represents interest received on our cash, cash equivalents, marketable securities, deposits and amortization of premiums and accretion of discounts related to our investment in available for sale marketable securities. Foreign exchange gains or losses relate to our business activities in foreign countries with different operational reporting currencies. As a result of our business activities in foreign countries, we expect that foreign exchange gains or losses will continue to occur due to fluctuations in exchange rates in the countries where we do business. Amortization of debt issuance costs relate to the Notes we issued in May 2020 and September 2024. Interest expense consists of the contractual interest expenses associated with the Notes.

Income Taxes

We operate in the U.S. and in foreign jurisdictions and are subject to taxes in each country or jurisdiction in which we conduct business. Earnings from our non-U.S. activities are subject to local country income tax and may be subject to U.S. income tax.

Because of our history of operating losses, we have established a full valuation allowance against potential future benefits for deferred tax assets, including loss carryforwards. Our income tax provision could be significantly impacted by estimates surrounding our uncertain tax positions and changes to our valuation allowance in future periods. We reevaluate the judgments surrounding our estimates and make adjustments as appropriate each reporting period.

In addition, we are subject to the regular examinations of our income tax returns by different tax authorities. We regularly assess the likelihood of adverse outcomes resulting from these examinations to determine the adequacy of our provision for income taxes.

Results of Operations

The following tables are a summary of our consolidated statements of operations in dollars and as a percentage of our total revenues.

(in thousands)

45

Comparison of Years Ended December 31, 2024 and 2023

Revenues

(in thousands)

46

For the year ended December 31, 2024, our revenues increased 10% compared to the year ended December 31, 2023 despite increased SaaS sales and existing customer conversions to SaaS which cause variations due to accounting treatment differences in revenue recognition for sales within the respective periods. SaaS revenues increased 370% from $44.4 million for the year ended December 31, 2023 to $208.8 million for the year ended December 31, 2024 as we continue to progress through our transition to a SaaS delivery model. The increase in SaaS revenues was driven by (i) new customer acquisitions, which are happening due to the simplicity of our SaaS platform and MDDR offering, as well as customer interest in Gen AI, (ii) existing customer conversions and (iii) our high renewal rates. Consequently, there was an expected decrease to term license subscriptions given the aforementioned transition and customer conversions, a trend we expect to continue in the coming years. ARR was $641.9 million and $543.0 million as of December 31, 2024 and 2023, respectively, representing an increase of 18%. The anticipated decrease in maintenance and services revenues was due to churn and the conversion of existing customers to SaaS despite our renewal rate continuing to be over 90% for each of the years ended December 31, 2024 and 2023. We continue to expect less associated maintenance and services revenues in the future.

Cost of Revenues and Gross Margin

(in thousands)

The increase in cost of revenues was primarily related to a $11.3 million increase in salaries and benefits and stock-based compensation expense due to increased headcount for customer success personnel to assist with the transition to a SaaS delivery model, including our recently introduced MDDR offering, and ensure high customer satisfaction and maintain our strong renewal rates. The increase is also due to a $9.9 million increase in third-party hosting costs associated with our transition to a SaaS delivery model.

Operating Expenses

(in thousands)

The increase in research and development expenses was primarily related to a $6.7 million increase in acquired in-process research and development costs associated with our asset acquisition, a $3.2 million increase in salaries and benefits and stock-based compensation expense primarily due to increased headcount, an increase of $1.9 million in facilities and allocated overhead costs and a $0.8 million increase in third-party hosting costs associated with our transition to a SaaS delivery model.

The increase in sales and marketing expenses was primarily related to an increase of $9.7 million in general sales and marketing expenses, including increased travel, marketing events and third-party hosting costs associated with our transition to a SaaS delivery model and a $1.8 million increase in salaries and benefits and stock-based compensation expense primarily due to increased headcount.

The increase in general and administrative expenses was primarily related to an increase of $4.9 million in salaries and benefits and stock-based compensation expense primarily due to increased headcount to support the overall growth of our business and an increase of $0.5 million in facilities and allocated overhead costs.

Financial Income, Net

(in thousands)

The increase in financial income, net was primarily due to higher interest income, partially offset by foreign currency losses.

Income Taxes

(in thousands)

Income taxes for the year ended December 31, 2024, including the decrease in income taxes, were comprised of foreign and U.S. income taxes.

Inflation

We do not believe that inflation rates have had a material effect on our business, financial condition or results of operations in the last three fiscal years. If our costs were to become subject to significant inflationary pressures, we may not be able to fully offset such higher costs through price increases. Our inability or failure to do so could harm our business, financial condition and results of operations.

Comparison of Years Ended December 31, 2023 and 2022

For a comparison of our results of operations for the years ended December 31, 2023 and 2022, see “Part II, Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations” of our Annual Report on Form 10-K for the year ended December 31, 2023, filed with the SEC on February 6, 2024, which comparative information is herein incorporated by reference.

Seasonality and Quarterly Trends

When selling on-premises subscription products, our quarterly results reflect seasonality in the sale of our products and services. Historically, we have experienced a pattern of increased sales in the fourth quarter. This trend makes it difficult to achieve sequential revenue growth in the first quarter of the following year. Because of purchasing trends, demand for our products and services is typically slowest in the first quarter, resulting in a decrease in quarterly revenues from the fourth quarter to the first quarter of the subsequent fiscal year. Our gross margins and operating margins have been affected by these historical trends because the majority of our expenses are relatively fixed quarter over quarter. Our expenses, which do not vary directly with revenues, and the seasonal pattern described above have an impact on the cost of revenues, research and development expenses, sales and marketing expenses and general and administrative expenses as a percentage of revenues in each calendar quarter during the year. We expect the impact of these seasonal patterns to decline as we sell more of our SaaS offering to new customers and transition our existing customers to our SaaS platform, due to the ratable revenue recognition of SaaS. The majority of our expenses are personnel-related costs, which consist of salaries (including payroll tax expense related to stock-based compensation), employee benefits (including commissions and bonuses) and stock-based compensation. As a result, we have not experienced significant seasonal fluctuations in the timing of expenses from period to period.

Liquidity and Capital Resources

The following table shows our liquidity and capital resources and our cash flows from operating activities, investing activities and financing activities for the years ended December 31, 2024 and 2023. For a discussion of our liquidity and capital resources and our cash flow activities for the fiscal year ended December 31, 2022, see “Part II, Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations” of our Annual Report on Form 10-K for the year ended December 31, 2023, filed with the SEC on February 6, 2024, which discussion is herein incorporated by reference.

(in thousands)

As of December 31, 2024, our cash and cash equivalents, short-term marketable securities and short-term deposits of $568.4 million were held for working capital purposes. We believe that our existing cash and cash equivalents, short-term marketable securities, short-term deposits and cash flow from operations will be sufficient to fund our operations and capital expenditures for at least the next 12 months. Additionally, as of December 31, 2024, we held $658.9 million in long-term marketable securities. Our future capital requirements will depend on many factors, including our rate of revenue growth, timing of renewals and renewal rates, the expansion of our sales and marketing activities, the timing and extent of spending to support product development efforts and expansion into new geographic locations, the timing of introductions of new software products and enhancements to existing software products, the continuing market acceptance of our software offerings and our use of cash to pay for acquisitions or share repurchases, if any.

Operating Activities

Our operating activities are driven by sales of our products less costs and expenses, primarily payroll and related expenses, and adjusted for certain non-cash items, mainly depreciation and amortization, stock-based compensation, amortization of deferred commissions, non-cash operating lease costs, amortization of debt issuance costs, amortization of premium and accretion of discount on marketable securities, acquired in-process research and development costs, and changes in operating assets and liabilities. Changes in operating assets and liabilities are driven mainly by collection of accounts receivable from the sales of our software products and deferred revenue, which primarily consists of billed fees for our subscriptions, prior to satisfying the criteria for revenue recognition, which are subsequently recognized as revenue in accordance with our revenue recognition policy.

For 2024, cash inflows from our operating activities were $115.2 million. We have observed two seasonal patterns that impact our net cash provided by operating activities. First, a majority of our sales are made during the last three weeks of the quarter. Second, the highest dollar amount of sales of our products and services occurs in the fourth quarter. Consequently, we end the fourth quarter with our highest accounts receivable balance of any quarter which in turn generates the greatest amount of collections in the following quarter. In addition, there is negative sequential sales in the first quarter, which results in a relatively lower amount collected during the second quarter. These seasonal trends also impact our operating loss because the majority of our expenses are relatively fixed in the short-term. For 2024, cash inflows were $102.1 million from our net loss excluding non-cash and acquired in-process research and development charges. Additional sources of cash inflows were from changes in our working capital, including a $110.4 million increase in deferred revenues, a $17.3 million increase in accrued expenses and other liabilities, a $3.6 million increase in trade payables, a $0.3 million decrease in other long-term assets and a $0.3 million increase in other long-term liabilities. This was partially offset by a $95.2 million increase in prepaid expenses and other short-term assets (including deferred commissions) and a $23.7 million increase in accounts receivable. Our days’ sales outstanding (“DSO”) for the three months and year ended December 31, 2024 was 77 and 74, respectively.

For 2023, cash provided by operating activities were $59.4 million. Sources of cash inflows were $105.3 million, which included our net loss of $100.9 million, offset by non-cash charges of $206.2 million. Additional sources of cash inflows were from changes in our working capital, including a $69.9 million increase in deferred revenues and a $0.5 million increase in other long-term liabilities. This was partially offset by a $75.0 million increase in prepaid expenses and other short-term assets (including deferred commissions) and a $33.1 million increase in accounts receivable. Our DSO for the three months and year ended December 31, 2023 was 82 and 72, respectively. Other sources of cash outflows were from a $5.3 million decrease in accrued expenses and other liabilities, a $2.3 million decrease in trade payables and a $0.6 million decrease in other long-term assets.

Investing Activities

Our investing activities consist primarily of capital expenditures to purchase property and equipment, including leasehold improvements, purchase in-process research and development, purchase and sale of deposits and changes in our marketable securities. In the future, we expect to continue to incur capital expenditures to support our expanding operations.

During 2024, net cash used in investing activities of $532.3 million was primarily attributable to net investments of $529.4 million in marketable securities, $6.7 million for in-process research and development and $6.7 million in capital expenditures to support our growth including hardware, office equipment and leasehold improvements mainly in connection with existing office space. This was partially offset by net proceeds of $10.5 million in deposits.

During 2023, net cash used in investing activities of $143.1 million was primarily attributable to net investments of $216.6 million in marketable securities and $5.1 million in capital expenditures to support our growth including hardware, software, office equipment and leasehold improvements mainly in connection with existing office space. This was partially offset by net proceeds of $78.6 million in deposits.

Financing Activities

In 2024, net cash provided by financing activities of $371.9 million was attributable to $449.6 million of net proceeds from the issuance of convertible senior notes and $16.1 million of proceeds from employee stock plans, partially offset by $55.5 million related to purchases of capped calls associated with the convertible senior notes and $38.3 million in taxes paid related to net share settlement of equity awards.

In 2023, net cash used in financing activities of $53.4 million was attributable to $43.5 million of repurchases of common stock and $21.4 million in taxes paid related to net share settlement of equity awards, partially offset by $11.5 million of proceeds from employee stock plans.

Convertible Notes

On September 10, 2024, we issued the 2029 Notes. The net proceeds from the offering, after deducting issuance costs, were approximately $449.6 million. In connection with the issuance of the 2029 Notes, we used $55.5 million of the net proceeds to enter into Capped Call Transactions.

On May 11, 2020, we issued the 2025 Notes. The net proceeds from the offering, after deducting issuance costs, were approximately $245.2 million. In connection with the issuance of the 2025 Notes, we used $29.3 million of the net proceeds to enter into Capped Call Transactions.

For further information regarding the Notes and Capped Call Transactions, refer to Note 7 of our consolidated financial statements.

Contractual Payment Obligations

Our principal commitments primarily consist of obligations under leases for office space and motor vehicles. Aggregate minimum rental commitments under non-cancelable leases as of December 31, 2024 for the upcoming years were as follows:

(in thousands)

50

We have obligations related to unrecognized tax benefit liabilities totaling $33.3 million and others related to severance pay, which have been excluded from the table above as we do not believe it is practicable to make reliable estimates of the periods in which payments for these obligations will be made. We also have a contractual minimum purchase commitment with a service provider through August 31, 2027 totaling $7.1 million due in the next 12 months and $21.0 due thereafter and an additional $32.9 million contractual minimum purchase commitment with another service provider through December 31, 2026 with no specified annual commitments. We expect to fund these obligations with cash flows from operations and cash on our balance sheet.

Off-Balance Sheet Arrangements

As of December 31, 2024, we did not have any off-balance sheet arrangements.

Critical Accounting Policies and Estimates

We prepare our consolidated financial statements in accordance with generally accepted accounting principles in the United States. The preparation of consolidated financial statements also requires us to make estimates and assumptions that affect the reported amounts of assets, liabilities, revenues, costs and expenses and related disclosures. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances. Actual results could differ significantly from the estimates made by our management. To the extent that there are differences between our estimates and actual results, our future financial statement presentation, financial condition, results of operations and cash flows will be affected. We believe that our accounting policies discussed below are critical to understanding our historical and future performance, as these policies relate to the more significant areas involving management’s judgments and estimates. Critical accounting policies and estimates are those that we consider the most important to the portrayal of our financial condition and results of operations because they require our most difficult, subjective or complex judgments, often as a result of the need to make estimates about the effect of the matters that are inherently uncertain.

Revenue Recognition:

We generate revenues primarily in the form of term license subscriptions, SaaS revenues and maintenance and services fees. Term license subscription revenues are sold on-premises and are comprised of time-based licenses whereby customers use our software (including support and unspecified upgrades and enhancements when and if they are available) for a specified period. SaaS revenues, including SaaS with MDDR, are provided on a subscription basis and allow customers to use hosted software. Over the last few years, the Company has introduced new products and support for cloud applications and infrastructure environments, including the Varonis Data Security Platform delivered as a SaaS, which was previously only sold as a self-hosted solution. Maintenance and services primarily consist of fees for maintenance of past perpetual license sales (including support and unspecified upgrades and enhancements when and if they are available) and to a lesser extent professional services, although the user can benefit from the software without our assistance. We sell our products worldwide to a network of distributors and value-added resellers, and payment is typically due within 30 to 60 calendar days of the invoice date.

We recognize revenues in accordance with ASC No. 606, “Revenue from Contracts with Customers.” As such, we identify a contract with a customer, identify the performance obligations in the contract, determine the transaction price, allocate the transaction price to each performance obligation in the contract and recognize revenues when (or as) we satisfy a performance obligation.

Term license subscription software sold on-premises is recognized at the point in time when the software license has been delivered and the benefit of the asset has transferred. Maintenance associated with term license subscription software is recognized ratably over the term of the agreement since these services have a consistent continuous pattern of transfer to a customer during the contract period, and is included within the term license subscriptions line of the consolidated statements of operations.

SaaS revenue is recognized ratably over the associated contract period, beginning when access is provided and the benefit of the service is available. Conversions from a license sold on-premises to the Company’s SaaS offering during the original subscription period are accounted for on a prospective basis.

We recognize revenues from maintenance agreements ratably over the term of the underlying maintenance contract. The term of the maintenance contract is usually one year. Renewals of maintenance contracts create new performance obligations that are satisfied over the new term with the revenues recognized ratably over the contract period.

Revenues from professional services consist mostly of time and material services. The performance obligations are satisfied, and revenues are recognized, when the services are provided or once the service term has expired.

We enter into contracts that can include combinations of products and services, which are generally capable of being distinct and accounted for as separate performance obligations. The term license software is distinct upon delivery as the customer can derive the economic benefit of the software without any additional services, updates or technical support. We allocate the transaction price to each performance obligation based on our relative standalone selling price out of the total consideration of the contract. For software licenses and maintenance included in term license subscriptions, we determine the standalone selling prices based on the price at which we separately sell a renewal contract. For professional services, we determine the standalone selling prices based on the price at which we separately sell those services.

Trade receivables are generally recorded at the invoice amount mostly for a one-year period, net of an allowance for credit losses.

Deferred revenues represent mostly unrecognized fees billed or collected for SaaS and maintenance contracts. Deferred revenues are recognized as (or when) we perform under the contract. Pursuant to these contracts, customers are generally not invoiced for subsequent years until the annual renewal occurs. The amount of revenues recognized in the period that was included in the opening deferred revenues balance was $177.3 million for the year ended December 31, 2024.

Revenues allocated to remaining performance obligations represent contracted revenues that have not yet been recognized, which includes deferred revenues and non-cancelable amounts that will be invoiced in the future. Our remaining performance obligations were $729.7 million as of December 31, 2024, of which we expect to recognize approximately 53% as revenue over the next 12 months and the remainder thereafter.

For information regarding disaggregated revenues, refer to Note 13 to our consolidated financial statements.

Contract Costs:

We pay sales commissions to sales and marketing and certain management personnel based on their attainment of certain predetermined sales goals. Sales commissions earned by employees are considered incremental and recoverable costs of obtaining a contract with a customer. Sales commissions paid for initial contracts, which are not commensurate with sales commissions paid for renewal contracts, are capitalized and amortized over an expected period of benefit. Based on our technology, customer contracts and other factors, we have determined the expected period of benefit to be approximately four years. Sales commissions for renewal contracts are capitalized and then amortized on a straight-line basis. Amortization expenses related to these costs are included in sales and marketing expenses in the accompanying consolidated statements of operations.

Accounting for Stock-Based Compensation:

We account for stock-based compensation in accordance with ASC No. 718, “Compensation-Stock Compensation.” For stock options and restricted stock units, stock-based compensation expense is measured at the grant date, based on the estimated fair value of the equity award granted, and is recognized as expense on a straight-line basis over the requisite service period. In addition, we grant performance stock units to certain employees. The number of performance stock units earned and eligible to vest are generally determined after a one-year performance period, based on achievement of certain Company financial performance measures and the recipient’s continued service. We recognize stock-based compensation expense for performance stock units using the graded vesting method over the requisite service period for each separately-vesting tranche of the award when it is probable that the performance conditions will be achieved. Compensation expense for performance stock units with financial performance measures is measured using the fair value at the date of grant and recorded over each vesting period, and may be adjusted over the vesting period based on interim estimates of performance against the pre-set objectives. We account for forfeitures as they occur for all stock-based awards.

Income Taxes:

We account for income taxes in accordance with ASC No. 740, using the asset and liability method whereby deferred tax assets and liability account balances are determined based on the differences between financial reporting and the tax basis for assets and liabilities and are measured using the enacted tax rates and laws that will be in effect when the differences are expected to reverse. We provide a valuation allowance, if necessary, to reduce deferred tax assets to the amounts that are more likely-than-not to be realized.

ASC 740 contains a two-step approach to recognizing and measuring a liability for uncertain tax positions. The first step is to evaluate the tax position taken or expected to be taken in a tax return by determining if the weight of available evidence indicates that it is more likely than not that, on an evaluation of the technical merits, the tax position will be sustained on audit, including resolution of any related appeals or litigation processes. The second step is to measure the tax benefit as the largest amount that is more than 50% likely to be realized upon ultimate settlement. We accrue interest and penalties related to unrecognized tax provisions in our taxes on income.

Recently Adopted Accounting Pronouncements

In November 2023, the Financial Accounting Standards Board (“FASB”) issued Accounting Standards Update (“ASU”) 2023-07, Segment Reporting (Topic 280), Improvements to Reportable Segment Disclosures to improve reportable segment disclosure requirements through enhanced disclosures about significant segment expenses on an interim and annual basis. All disclosure requirements of ASU 2023-07 are required for entities with a single reportable segment. ASU 2023-07 is effective for fiscal years beginning after December 15, 2023, and interim periods for the fiscal years beginning after December 15, 2024. We adopted the fiscal year standard for the period beginning January 1, 2024 on a retrospective basis which resulted in updated segment disclosures. For more information on the updated segment disclosures, refer to Note 13 of our consolidated financial statements.

Recently Issued Accounting Pronouncements Not Yet Adopted

In December 2023, the FASB issued ASU 2023-09, Income Taxes (Topic 740) - Improvements to Income Tax Disclosures. The ASU requires that an entity disclose specific categories in the effective tax rate reconciliation as well as provide additional information for reconciling items that meet a quantitative threshold. Further, the ASU requires certain disclosures of state versus federal income tax expense and taxes paid. The amendments in this ASU are required to be adopted for fiscal years beginning after December 15, 2024. Early adoption is permitted and the amendments should be applied on a prospective basis. We are currently evaluating the effect of adopting the ASU on our disclosures.

In November 2024, the FASB issued ASU 2024-03, Income Statement-Reporting Comprehensive Income-Expense Disaggregation Disclosures (Subtopic 220-40) - Disaggregation of Income Statement Expenses. The ASU requires, among other items, additional disaggregated disclosures in the notes to financial statements for certain categories of expenses that are included on the Statements of Operations. ASU 2024-03 is effective for fiscal years beginning after December 15, 2026, and for interim periods within fiscal years beginning after December 15, 2027, with early adoption permitted, and may be applied either prospectively or retrospectively. We are currently evaluating the effect of adopting the ASU on our disclosures.

Market risk represents the risk of loss that may impact our financial position due to adverse changes in financial market prices and rates. Our market risk exposure is primarily a result of fluctuations in foreign currency exchange rates. We do not hold financial instruments for trading or speculative purposes.

Market Risk

We are exposed to certain financial risks, including fluctuations in foreign currency exchange rates and interest rates. We manage our exposure to these market risks through internally established policies and procedures. Our policies do not allow speculation in derivative instruments for profit or execution of derivative instrument contracts for which there are no underlying exposures. We do not use financial instruments for trading or speculative purposes, and we are not a party to any leveraged derivatives. We monitor our underlying market risk exposures on an ongoing basis and, where appropriate, may use hedging strategies to mitigate these risks.

Foreign Currency Exchange Risk

Approximately one quarter of our revenues for the years ended December 31, 2024 and 2023 were earned in non-U.S. dollar denominated currencies, mainly in the Euro and Pound Sterling. Our expenses are generally denominated in the currencies in which our operations are located, primarily the U.S. dollar and New Israeli Shekel, and to a lesser extent the Euro, Pound Sterling, Canadian dollar, Australian dollar and Singapore dollar. Our expenses denominated in foreign currencies consist primarily of personnel and overhead costs from our international operations. Our consolidated results of operations and cash flow are, therefore, subject to fluctuations due to changes in foreign currency exchange rates and may be adversely affected in the future due to changes in foreign exchange rates. We enter into financial hedging strategies to reduce our exposure to foreign currency rate changes. During 2024, the effect of a hypothetical 10% change in foreign currency exchange rates applicable to our business, after considering foreign currency hedges, would not have had a material impact on our consolidated financial statements.

For purposes of our consolidated financial statements, local currency assets and liabilities are translated at the rate of exchange to the U.S. dollar on the balance sheet date and local currency revenues and expenses are translated at the exchange rate at the date of the transaction or the average exchange rate during the reporting period.

We use derivative financial instruments, specifically foreign currency forward contracts, to manage exposure to foreign currency risks, by hedging a portion of our forecasted revenues and expenses generally expected to occur within 12 to 24 months. A majority of our revenues and operating expenditures are transacted in U.S. dollars; however, certain revenues and operating expenditures are incurred in or exposed to other currencies, specifically, Euro and Pound Sterling for revenues, and the New Israeli Shekel, Euro and Pound Sterling for operating expenses. The effect of exchange rate changes on foreign currency forward contracts is expected to offset the effect of exchange rate changes on the underlying hedged item. We have also previously entered into forward contracts to hedge a portion of our monetary items in the balance sheet, such as trade receivables and payables, denominated in Pound Sterling and Euro for short-term periods to protect the fair value of the monetary assets and liabilities from foreign exchange rate fluctuations. The effect of exchange rate changes on foreign currency forward contracts is expected to offset the effect of exchange rate changes in the underlying hedged item which impacts financial income, net. We do not use derivative financial instruments for trading or speculative purposes.

Interest Rate Risk

As of December 31, 2024, we had cash and cash equivalents, short-term marketable securities and short-term deposits of $568.4 million and investments in long-term marketable securities of $658.9 million. We hold our cash and cash equivalents, short-term marketable securities and short-term deposits for working capital purposes. We do not enter into marketable security investments for trading or speculative purposes.

Our cash and cash equivalents, marketable securities and short-term deposits are subject to market risk due to changes in interest rates, which may affect our interest income and the fair value of our marketable securities. Due in part to these factors, our future investment income may fluctuate due to changes in interest rates or we may suffer losses in principal if we are forced to sell securities that decline in market value due to changes in interest rates. Due to the liquid and short-term nature of our cash and cash equivalents, short-term marketable securities and short-term deposit instruments, we believe that we do not have any material exposure to changes in the fair value of these instruments as a result of changes in interest rates. Additionally, because we classify our marketable securities as available-for-sale securities, no gains or losses are recognized in the consolidated statements of operations due to the changes in interest rates, unless securities are sold prior to maturity or declines in fair value are determined to be other-than-temporary. The effect of a hypothetical 100 basis point change in interest rates would not have a material impact on our consolidated financial statements.

In May 2020 we issued the 2025 Notes and in September 2024 we issued the 2029 Notes, which have fixed annual interest rates at 1.25% and 1.00%, respectively, and therefore, we do not have economic interest rate exposure on the Notes. However, the values of the Notes are exposed to interest rate risk. Generally, the fair market value of our fixed interest rate Notes will increase as interest rates fall and decrease as interest rates rise. In addition, the fair values of the Notes are affected by our stock price. The fair value of the Notes will generally increase as our common stock price increases and will generally decrease as our common stock price declines in value. Additionally, we carry the Notes at face value less unamortized costs on our balance sheet, and we present the fair value for required disclosure purposes only.

To the extent we enter into other long-term debt arrangements in the future, we would be subject to fluctuations in interest rates which could have a material impact on our future financial condition and results of operation.

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, evaluated the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) of the Exchange Act) as of the end of the period covered by this report. Based on that evaluation, our Chief Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures as of the end of the period covered by this report were effective at a reasonable assurance level in ensuring that information required to be disclosed by us in reports that we file or submit under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms. We believe that a control system, no matter how well designed and operated, cannot provide absolute assurance that the objectives of the control system are met, and no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, within a company have been detected.

Management’s Annual Report on Internal Control Over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act). Our management conducted an evaluation of the effectiveness of our internal control over financial reporting as of December 31, 2024 based on the criteria established in Internal Control - Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission.

Based on the results of its evaluation, management concluded that our internal control over financial reporting was effective as of December 31, 2024.

The effectiveness of our internal control over financial reporting as of December 31, 2024 has been audited by Kost Forer Gabbay & Kasierer, a member of EY Global and an independent registered public accounting firm, as stated in their attestation report which is included in Part II, Item 8 of this Annual Report on Form 10-K.

Changes in Internal Control over Financial Reporting

There was no change in our internal control over financial reporting that occurred during the three months ended December 31, 2024 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.

We regularly seek to identify, develop and implement improvements to our technology systems and business processes, some of which may affect our internal control over financial reporting. These changes may include such activities as implementing new, more efficient systems, updating existing systems or platforms, automating manual processes or utilizing technology developed by third parties. These system changes are often phased in over multiple periods in order to limit the implementation risk in any one period, and as each change is implemented we monitor its effectiveness as part of its internal control over financial reporting.