10-K: Varonis 2025 Annual Report: SaaS Drives Growth Amid Losses

Varonis Systems, Inc. reports significant SaaS revenue growth and strategic acquisitions in 2025, alongside continued net losses and a full transition to a SaaS delivery model by end of 2026.

Summary

• Varonis is a data security company focused on protecting enterprise data across cloud services, SaaS applications, and on-premises environments.
• The company is strategically transitioning to a SaaS delivery model, with SaaS revenue increasing 122% to $462.6 million in 2025 from $208.8 million in 2024.
• Total revenues grew 13% to $623.5 million in 2025, up from $551.0 million in 2024.
• Annual Recurring Revenue (ARR) increased 16% to $745.4 million as of December 31, 2025, from $641.9 million in 2024. SaaS ARR was $638.5 million as of December 31, 2025, representing approximately 86% of total ARR.
• A net loss of $129.3 million was reported in 2025, compared to $95.8 million in 2024 and $100.9 million in 2023.
• Operating loss increased to $146.5 million in 2025 from $117.7 million in 2024.
• Cost of revenues increased 40.6% to $131.9 million in 2025, primarily due to higher third-party hosting costs for SaaS and increased headcount for customer success.
• Research and development expenses rose 20.9% to $237.8 million in 2025, driven by increased headcount, acquisition-related conditional consideration, and hosting costs.
• Sales and marketing expenses increased 4.4% to $301.3 million in 2025.
• The company completed two acquisitions in 2025: Cyral, Inc. for Database Activity Monitoring (DAM) and SlashNext, Inc. for AI-based email security.
• A share repurchase program of up to $150.0 million was authorized in October 2025, with $15.0 million repurchased by December 31, 2025, leaving $135.0 million remaining.
• The end-of-life for self-hosted products is announced as of December 31, 2026, with an expectation for customers to adopt the SaaS platform.
• Remaining Performance Obligations (RPO) were $1,096.7 million as of December 31, 2025.
• A class action lawsuit was filed on January 7, 2026, alleging misrepresentations regarding 2025 ARR and SaaS conversion.
• The company entered into a definitive agreement to acquire AllTrue.ai Inc., an AI security company, for approximately $126.0 million in cash, expected to close in Q1 2026.

Sentiment

Score: 6

Explanation: StockSavvy.ai views this as a mixed report. While the strong SaaS revenue growth and strategic acquisitions are positive indicators of future potential, the widening net and operating losses, coupled with underperforming stock price relative to benchmarks, suggest ongoing challenges in achieving profitability and market confidence.

Positives

• SaaS revenues increased significantly by 122% to $462.6 million in 2025, becoming the primary revenue driver.
• Total revenues grew by 13% to $623.5 million in 2025.
• Annual Recurring Revenue (ARR) increased by 16% to $745.4 million, with SaaS ARR at 86% of total ARR, indicating successful transition.
• A high renewal rate of over 90% for the year ended December 31, 2025, demonstrates strong customer retention.
• Strategic acquisitions of Cyral (Database Activity Monitoring) and SlashNext (AI-based email security) enhance platform capabilities and market reach.
• Introduction of Athena AI, a generative AI layer, designed to enhance security operations.
• Strong liquidity with $921.0 million in cash, cash equivalents, short-term marketable securities, and short-term deposits as of December 31, 2025.
• Management believes existing liquidity and cash flow will be sufficient to fund operations and capital expenditures for at least the next 12 months.

Negatives

• Continued net losses, widening to $129.3 million in 2025 from $95.8 million in 2024.
• Operating loss increased to $146.5 million in 2025 from $117.7 million in 2024.
• Gross margin decreased to 78.8% in 2025 from 83.0% in 2024.
• Term license subscriptions revenue decreased significantly by 56.9% to $109.6 million in 2025, reflecting the transition but also a decline in a traditional revenue stream.
• Maintenance and services revenues decreased by 41.7% to $51.3 million in 2025, also due to SaaS conversion and churn.
• Increased cost of revenues (40.6%) and operating expenses (11.0%) due to SaaS transition, headcount, and acquisition-related costs.
• Stock price performance underperformed NASDAQ Composite and NASDAQ Computer indices from 2020 to 2025.
• A securities class action lawsuit was filed in January 2026, alleging misrepresentations regarding ARR and SaaS conversion.

Risks

• The market for data security software may not continue to grow or grow at the same pace.
• Prolonged economic uncertainties or downturns, including inflationary pressure, currency fluctuations, and higher interest rates, could adversely affect business.
• Increased competition from established players and emerging innovators in the rapidly evolving data security market.
• Security breaches, cyberattacks, or other cyber-risks to IT and production systems could lead to significant liability and reputational harm.
• Expansion of cloud-delivered services introduces risks related to market acceptance, security, reliability, scalability, and compliance with data localization laws.
• Inability to predict renewal or conversion rates for SaaS and their impact on future revenues and operating results.
• Fluctuations in quarterly results of operations due to revenue variability, especially during the SaaS transition.
• Limited operating history at current scale makes future prospects difficult to evaluate and predict.
• History of losses and potential for continued unprofitability.
• Dependence on channel partners for sales and potential adverse effects if relationships are not maintained.
• Risks inherent in international operations, including political instability (e.g., Israel, Ukraine), currency fluctuations, and compliance with foreign laws.
• Collection and credit risks from trade receivables.
• Stock price volatility and potential for future declines.
• Dependence on brand recognition and reputation.
• Talent acquisition and retention challenges, particularly for skilled personnel in sales, marketing, and R&D.
• Dependence on the continued services and performance of co-founder, CEO, and President, Yakov Faitelson.
• Failure to continually enhance and improve technology could adversely affect sales.
• Unsatisfactory technical support, customer success, or professional services could impact renewals and future sales.
• Interruptions or performance problems with websites or cloud-based solutions.
• Perception of software not being secure could lead to customer loss and liabilities.
• Risks associated with incorporating machine learning and AI solutions, including competition and evolving regulatory landscape.
• Potential negative effects from using open-source software, including litigation and intellectual property claims.
• False detection of security breaches or misidentification of sensitive information by products.
• Failure to protect proprietary technology and intellectual property rights.
• Tax rate variability due to stock-based compensation and inability to fully utilize net operating loss carryforwards.
• Changes in income tax provisions or adverse outcomes from tax examinations.
• Impact of U.S. tax reform (OBBBA) and OECD BEPS Plan on financial position and results.
• Substantial indebtedness from 2029 Notes, potentially decreasing business flexibility and access to capital.
• Potential dilution of existing stockholders from conversion of 2029 Notes.
• Anti-takeover provisions in charter documents and Delaware law.
• Real or perceived errors, failures, or bugs in software.
• Need for additional capital to support business growth.
• Risks of fire, power outages, floods, earthquakes, pandemics and other catastrophic events, and to interruption by manmade problems such as terrorism and war.
• Changes in financial accounting standards.
• Reliance on securities or industry analysts' reports.
• Obligation to develop and maintain proper and effective internal control over financial reporting.
• Future sales and issuances of capital stock or rights to purchase capital stock could result in additional dilution of the percentage ownership of stockholders and could cause stock price to decline.

Future Outlook

The company expects SaaS revenues to continue to increase and Annual Recurring Revenue (ARR) and SaaS ARR to grow in absolute dollars. The end-of-life for self-hosted products by December 31, 2026, is expected to increase variability in revenues during the transition. The company anticipates continued investment in product development, sales and marketing, and international expansion, aiming to be the primary platform enterprises rely on for data protection.

Management Comments

• Our strategy is built around closing that gap, giving organizations the deep visibility and automated controls to deeply understand their enterprise data, reduce exposure and respond to threats quickly, wherever their data lives.
• We believe the adoption of AI materially raises the stakes for security and risk.
• We believe organizations must continuously reduce their blast radius — limiting unnecessary ability to access, move or misuse data — to reap the tremendous benefits of AI.
• We believe comprehensive coverage and automation are required to keep pace with the scale and complexity of modern data environments.
• Our objective is to be the primary platform enterprises rely on to protect their most sensitive data.
• We believe the combination of accelerating data growth, expanding use of SaaS and cloud infrastructure, and the adoption of AI-driven systems creates a durable, long-term opportunity for automated data security.
• We believe our sustained investment in research and development supports the long-term competitiveness of our platform and positions us to address emerging risks, including those introduced by new data types, cloud architecture and AI-driven systems.

Industry Context

StockSavvy.ai notes that Varonis's strategic shift to a SaaS-first model and its focus on AI-driven data security aligns with broader industry trends of cloud adoption, increasing data sprawl, and the escalating sophistication of cyber threats. The emphasis on 'blast radius' reduction and automated data security directly addresses the growing complexity and resource constraints faced by security teams, especially with the rapid integration of generative AI into enterprise platforms like Microsoft 365 and Salesforce. The acquisitions of Cyral and SlashNext demonstrate a proactive approach to expanding coverage in critical areas like database activity monitoring and email security, which are increasingly targeted by threat actors.

Comparison to Industry Standards

• The company's renewal rate of over 90% for 2025 is a strong indicator of customer satisfaction and product stickiness, comparing favorably to many SaaS companies that often report renewal rates in the 80-95% range, especially for enterprise clients.
• The 16% ARR growth is solid, though specific industry benchmarks for data security SaaS companies would be needed for a direct comparison. However, the rapid 122% SaaS revenue growth suggests successful execution of the transition strategy, potentially outpacing competitors still heavily reliant on on-premises models.
• The continued net losses, while common for high-growth SaaS companies investing heavily in R&D and sales, warrant comparison to peers like CrowdStrike, Palo Alto Networks, or Zscaler, which have demonstrated paths to profitability or are already profitable at scale.

Management Changes

Corporate Governance

Legal Proceedings

• On January 7, 2026, a putative securities class action lawsuit, 'Molchanov v. Varonis Systems, Inc. et al,' was filed in the U.S. District Court for the Southern District of New York.
• The complaint alleges misrepresentations or omissions in public disclosures about the company's expected annual recurring revenue for fiscal year 2025 and its ability to convert existing self-hosted customers to its SaaS offering, between February 4, 2025, and July 29, 2025.
• The lawsuit claims violations of Section 10(b) of the Exchange Act and Rule 10b-5, with certain officers also alleged to be liable as control persons under Section 20(a) of the Exchange Act.
• The company believes these claims are without merit and intends to defend the action vigorously.
• At this early stage, the company cannot predict the ultimate outcome or estimate any range of possible losses.

Stakeholder Impact

• Shareholders: Potential dilution from future equity issuances (e.g., convertible notes conversion, stock plans), impact of share repurchase programs, and volatility of stock price. The class action lawsuit could also negatively impact shareholder value.
• Employees: Equity compensation plans (RSUs, PSUs, ESPP) are key for retention and motivation. Changes in management, particularly the CISO, affect security posture. The war in Israel could impact employees in that region.
• Customers: Transition to SaaS aims to provide quicker deployment, continuous updates, and enhanced security. Acquisitions (Cyral, SlashNext) expand product offerings. End-of-life for self-hosted products requires customers to migrate.
• Channel Partners: Continued reliance on channel partners for sales, requiring strong relationships.
• Creditors: Indebtedness from 2029 Notes creates payment obligations.

Next Steps

• Continue investing in product development to expand the Varonis Data Security Platform capabilities and address new use cases.
• Expand coverage across additional data stores, cloud services, and SaaS applications.
• Selectively pursue strategic acquisitions that extend the platform or accelerate entry into adjacent markets.
• Grow adoption within existing customers by scaling with their evolving data volumes and AI-driven workflows.
• Acquire new customers, focusing on larger enterprises, through a global network of channel partners and a trained sales organization.
• Scale SaaS, automation, and Managed Data Detection and Response (MDDR) offerings.
• Expand internationally by investing in sales, marketing, and partner relationships.
• Complete the end-of-life transition for self-hosted products by December 31, 2026.
• Close the acquisition of AllTrue.ai Inc. in the first quarter of 2026.

Key Dates

Recommendation

The company is undergoing a significant and successful transition to a SaaS model, evidenced by strong SaaS revenue and ARR growth. Strategic acquisitions and AI integration position it well in a growing market. However, continued net and operating losses, a declining gross margin, and the recent class-action lawsuit introduce considerable uncertainty and risk. The stock has also underperformed benchmarks. A 'hold' recommendation is appropriate as the market awaits clearer signs of profitability and resolution of legal challenges, while acknowledging the strong underlying business transformation.

Keywords

Data Security, SaaS, Cybersecurity, AI, Cloud Security, Data Governance, Risk Management, Threat Detection, Data Protection, SEC Filing, 10-K, Varonis, VRNS, Software, Enterprise Data, Compliance, Financial Reporting, Acquisitions, Convertible Notes, Share Repurchase