VRNS 10-K & 10-Q changes, risk factors and insider trading

Our business depends on our current and prospective customers’ ability and willingness to invest in IT services, including cybersecurity projects, which in turn is dependent upon their overall economic health. Negative conditions in the general economy both in the United States and abroad, including inflationary pressure, currency fluctuations and a higher interest rate environment, changes in gross domestic product growth, instability in connection with political elections, potential future government shutdowns, the federal government’s failure to raise the debt ceiling, financial and credit market fluctuations, the imposition of trade barriers and restrictions such as tariffs, including tariffs implemented around the world by the United States or other countries, political deadlock, restrictions on travel, natural catastrophes, warfare and terrorist attacks, could cause a decrease in business investments, including corporate spending on enterprise software in general and negatively affect the rate of growth of our business. For example, our operations, and the operations of our customers and partners, were affected by geopolitical turmoil and sanctions caused by the war between Russia and Ukraine, and the COVID-19 pandemic and efforts to control its spread, including by mandatory business closures and capacity limitations imposed by the jurisdictions in which we operate. Similar events and restrictions in the future could negatively affect our business.

Uncertainty in the global economy makes it extremely difficult for our customers and us to forecast and plan future business activities accurately. This could cause our customers to reevaluate decisions to purchase our product or to delay their purchasing decisions, which could lengthen our sales cycles and negatively impact our results. In recent years, the European economy experienced economic turmoil that caused the devaluation of local European currencies (specifically, the Euro and the Pound Sterling), inflationary pressures and general economic uncertainty. As a result, there has been, and may in the future be, budgetary tightening and longer sales cycles in the region which may negatively impact our results of operations. In addition, the imposition of tariffs, such as those implemented by the United States or other countries in 2025, may materially impact business performance for companies operating around the world and may cause budgetary tightening and longer sales cycles for companies in those impacted countries. The United States could also experience a sustained period of elevated inflation, which may put pressure on discretionary spending by our customers, and a lengthening of our sales cycle in the region, which could negatively impact our results.

While there are some companies which offer certain features similar to those embedded in our solutions, as well asand others with whom we compete in certain tactical use cases, we believe that weno dosingle notcompetitor currently compete with a company that offersdelivers the same breadthautomated of functionalitiesoutcomes on the number of platforms and applications that we cover.support. Nevertheless,However, we do competeface againstcompetition from a select group of software vendors that provide standalone solutions,solutions similar to those foundfeatures embedded in our comprehensive softwareplatform, suite,particularly in the specific markets in which we operate.serve. We also face direct competition within respect to certainspecific use cases, specifically DSPM, data discovery and classification, privacy, data migration, data subject access requests and Active Directory security. As we continue to augment our functionality with AI security, insider threat detection and user behavior analytics and as we expand our classification capabilities to better serve compliance needs, such as General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act ("CCPA") and other data privacy laws, we may face increased perceived and real competition from other security and classification technologies. AsOur wegrowing expand our coverage and penetrationpresence in the cloud,cloud wedata maysecurity face increased perceivedmarket and realour broader product coverage are also placing us in more direct competition fromwith othercompanies cloud-focusedfocused technologies.on Indiscovery theand future,classification. asAs customer requirements evolve and new technologies are introduced,emerge, we mayface experience increasedheightened competition iffrom companies—both established orand emerging companies—that develop solutions that addresstargeting the enterprise data market. Furthermore, because we operate in an evolving area, we anticipate that competition will increase based on customer demand for these types of products.

InCertain additionU.S. and international laws also require companies to notify individuals of security breaches involving personal information, whether caused by us or our service providers. Despite contractual protections, a breach could harm our reputation, erode customer trust, reduce sales, lead to customer loss, and expose us to liability or significant remediation costs. Beyond government regulation, privacy advocates and industry groups may proposeintroduce new and different self-regulatoryself‑regulatory standards that either legally or contractuallycould apply to us. We also expectanticipate thatcontinued there will continue to be new proposed lawslegislative and regulationsregulatory concerningdevelopments in privacy, data protectionprotection, and information security, and we cannot yet determine the impact suchof futurewhich laws,remains regulations and standards may have on our business.uncertain. New laws, amendments toamendments, or re-interpretationsreinterpretations of existing lawsrequirements—as andwell regulations,as evolving industry standards,standards and contractual obligations and other obligations —may requireincrease us to incur additionalcompliance costs and restrict our business operations. Because the interpretation and applicationenforcement of lawsthese and other obligations relating to privacy and data protectionrequirements are still uncertain, it is possible that these laws and other obligationsthey may be interpreted and applied in a manner that is inconsistentconflict with our existing data managementcurrent practices or theproduct features of our software.features. If so, inwe additioncould to the possibility offace fines, lawsuitslitigation, and other claims, we couldor be required to fundamentallymake changefundamental changes to our business activities and practices or modify our software, which couldmay have an adverse effect on our business. We maynot be unablecommercially to make such changesfeasible and modificationscould in a commercially reasonable manner or at all, andlimit our ability to developinnovate. new features could be limited. Any inabilityFailure to adequately address privacy concerns,concerns—whether even if unfounded,valid or perceived—or to comply with applicable privacy or data protection laws, regulations and policiesrequirements could result in additional costcosts, liability, reputational harm, inhibited sales, and liabilityother toadverse us,effects damage our reputation, inhibit sales and adversely affecton our business.

Furthermore, the costs of compliance with,costs and other burdens imposed by,by the laws, regulationsprivacy and policiesdata thatprotection arelaws applicable to the businesses of our customers may increase the costscost associatedof with,using our products, limit thetheir use and adoption of,adoption, and reduce the overall demanddemand. for,In ouraddition, products. Privacyprivacy and personal information security concerns, concerns—whether validwell‑founded or not valid, —may inhibitdiscourage market adoptionacceptance of our productsproducts, particularly in certain industries and foreigninternational countries.markets.

We may not be able to predict renewal or conversion rates and their impact on our future revenues and operating results.

Although our solutions are designed to increase the number of customers that purchase our products and the number of products purchased by existing and new customers to create a recurring revenue stream that increases and is more predictable over time, our customers are not required to renew their subscriptions for our solutions and they may elect not to renew when, or as we expect, or they may elect to reduce the scope of their original purchases or delay their purchase. We cannot accurately predict renewal or conversion rates given our varied customer base of enterprise and small and medium size business customers and the number of multiyear contracts. Customer renewal or conversion rates may decline or fluctuate due to a number of factors, including offering pricing, competitive offerings, customer satisfaction and reductions in customer spending levels or customer activity due to economic downturns, the adverse impact of import tariffs, inflation or other market uncertainty. If our customers do not renew their contracts when or as we expect, or if they choose to renew for fewer products or renew for shorter contract lengths or if they renew on less favorable terms, our revenues and earnings may decline, and our business may suffer. Further, we plan to end-of-life our self-hosted business as of December 31, 2026, which we expect to increase the uncertainty with our remaining term license customers going forward. This may result in a decline in revenues and cause revenues to be more difficult to predict for a period of time. We may occasionally inform customers that products or services will be reaching their end-of-life and will no longer be supported or receive updates or security patches. Failure to effectively manage this process could lead to customer dissatisfaction and contractual liabilities, which could adversely affect our business and operating results.

Our revenues and other results of operations have fluctuated from quarter to quarter in the past and could continue to fluctuate in the future. Historically, the fluctuation was partially due to the front-loaded revenue recognition nature of our business. Additionally, the Company ishas currentlyconverted transitioningthe significant majority of its customers to a SaaS delivery model that recognizes revenue ratably and we do not front-loadup revenuefront. withHowever, respectthere are still a number of term license subscriptions remaining to thosebe purchases.converted Asand, as a result, we may present reduced revenues as compared to prior periods, and comparing our revenues and results of operations on a period-to-period basis may not be meaningful,meaningful and should not be relied on for any particular period. Our revenues depend in part on the conversion of enterprises that have undergone risk assessments into paying customers; however, these risk assessments may not be converted at the same historical rates.rates or at all. At the same time, the majority of our sales are typically made during the last three weeks of every quarter. We may fail to meet market expectations for that quarter if we are unable to close the number of transactions that we expect during this short period and closings are deferred to a subsequent quarter or not closed at all. The closing of a large transaction in a particular quarter may raise our revenues in that quarter and thereby make it more difficult for us to meet market expectations in subsequent quarters and our failure to close a large transaction in a particular quarter or any renewals may adversely impact our revenues in that quarter. In addition, our sales cycle from initial contact to delivery of and payment for the software license generally becomes longer and less predictable with respect to large transactions and often involves multiple meetings or consultations at a substantial cost and time commitment to us. Further, we recentlyhave beganbeen focusing on the conversion of our current OPS customers to our SaaS platform and the sales cycle of such conversions can and may continue to take longer than the acquisition of new customers. Moreover, we base our current and future expense levels on our revenue forecasts and operating plans, and our expenses are relatively fixed in the short-term. Accordingly, we would likely not be able to reduce our costs sufficiently to compensate for an unexpected shortfall in revenues and even a relatively small decrease in revenues could disproportionately and adversely affect our financial results for that quarter.

If we do not successfully optimize and manage our predominantly SaaS‑based business model, or if the remaining transition toaway afrom SaaSself‑hosted delivery modelproducts fails to yieldprogress theas benefits that we expect,expected, our results of operations could be negatively impacted.

This SaaS strategy may give risecontinues to pose a number of risks, including the following:

•our revenues and operating margins may fluctuate more than anticipated over the short-term as aour resultbusiness ofmodel thisrelies strategyincreasingly on subscription revenues, which may be more sensitive to renewal rates, customer usage patterns, and macroeconomic conditions;

•we may be unsuccessful in maintaining or implementingadjusting our target pricing or new pricing models, product adoption and projected renewal rates,tiers, or wepackaging strategies, or such changes may select a target price or new pricing model that is not optimal and could negativelyadversely affect ourcustomer salesadoption, demand, or earnings;

•if our customers do not renew their subscriptionssubscriptions, reduce usage, or dodelay notrenewal renew them on a timely basis,decisions, our revenues may decline and our business and operating results may suffer;

•weour hosting, infrastructure, or third‑party cloud costs may incurexceed hosting costs at a higher than forecasted rateforecasts, or our SaaS platform canmay not scale or operate lessas efficiently thanas anticipatedanticipated, negatively affecting gross margins;

•we may incur higher than expected sales compensation costs at a higher than forecasted rateexpenses if the pace of ourremaining subscriptionconversions transitionor isnew fasterSaaS thansales anticipatedvaries from forecasted levels; and

•our sales force and customer facing teams may struggleface ongoing challenges with theselling transitionand supporting SaaS solutions, which may lead to productivity issues, increased turnoverturnover, ratesor the need for additional training and lower headcount.investment.

We have a relatively short history operating our business at its current scale. For example, we have increased the number of our employees and have expanded our operations and product offerings. This limits our ability to forecast our future operating results and subjects us to a number of uncertainties, including our ability to plan for and model future growth. We have encountered and will continue to encounter risks and uncertainties frequently experienced by growing companies in new markets that may not develop as expected. Because we depend in part on the market’s acceptance of our products, it is difficult to evaluate trends that may affect our business. If our assumptions regarding these trends and uncertainties, which we use to plan our business, are incorrect or change in reaction to changes in our markets, or if we do not address these risks successfully, our operating and financial results could differ materially from our expectations and our business could suffer. Moreover, although we have experienced significant growth historically, we may not continue to grow as quicklyquickly, or at all, in the future.

• successfully transition to a SaaS delivery model and manage our introduction of cloud-based solutions;

While we extend our technological capabilities though innovation and strategic transactions, including our recently announced ManagedMDDR, DataDAM, Detectionemail and Responsesecurity and cloud-based solutions, we cannot guarantee that we will be able to anticipate future market needs and opportunities or be able to extend our technological expertise and develop new products or expand the functionality of our current products in a timely manner or at all. Even if we are able to anticipate, develop and introduce new products and expand the functionality of our current products, there can be no assurance that enhancements or new products will achieve widespread market acceptance.

If we fail to anticipate market requirements or stay abreast of technological changes, we may be unable to successfully introduce new products, expand the functionality of our current products or convince our customers and potential customers of the value of our solutions in light of new technologies. In addition, it is possible that our product innovations, including our recently announced ManagedMDDR, DataDAM, Detectionemail and Responsesecurity and cloud-based solutions, may not provide satisfactory results to our customers. Accordingly, our business, results of operations and financial condition could be materially and adversely affected.

As of December 31, 2024,2025, we hadhave 89116 issued patents in the United States and 3163 pending U.S. patent applications. We also had 7695 patents issued and 3479 applications pending for examination in non-U.S. jurisdictions, and 1831 pending PCT patent applications, all of which are counterparts of our U.S. patent applications. We may file additional patent applications in the future. The process of obtaining patent protection is expensive and time-consuming, and we may not be able to prosecute all necessary or desirable patent applications at a reasonable cost or in a timely manner all the way through to the successful issuance of a patent. We may choose not to seek patent protection for certain innovations and may choose not to pursue patent protection in certain jurisdictions. Furthermore, it is possible that our patent applications may not issue as granted patents, that the scope of our issued patents will be insufficient or not have the coverage originally sought, that our issued patents will not provide us with any competitive advantages, and that our patents and other intellectual property rights may be challenged by others or invalidated through administrative process or litigation. In addition, issuance of a patent does not guarantee that we have an absolute right to practice the patented invention. Our policy is to require our employees (and our consultants and service providers that develop intellectual property included in our products) to execute written agreements in which they assign to us their rights in potential inventions and other intellectual property created within the scope of their employment (or, with respect to consultants and service providers, their engagement to develop such intellectual property). However, we may not be able to adequately protect our rights in every such agreement or execute an agreement with every such party. Finally, in order to benefit from patent and other intellectual property protection, we must monitor, detect and pursue infringement claims in certain circumstances in relevant jurisdictions, all of which is costly and time-consuming. As a result, we may not be able to obtain adequate protection or to enforce our issued patents or other intellectual property effectively.

On December 22, 2017, the Tax Cuts and Jobs Act (the "TCJA") was enacted. The TCJA remains unclear in some respects and has been, and may continue to be, subject to amendments and technical corrections, as well as interpretations and implementing regulations by the Treasury and Internal Revenue Service, any of which could lessen or increase certain adverse impacts of TCJA. Effective in 2022,July 2025, the TCJATCJA, as revised by the OBBBA, requires all U.S. companies to capitalize,capitalize and subsequently amortize R&Eresearch and development expenses that fall within the scope of Section 174 over fivefifteen years for research activities conducted in the United States and over fifteen years for researchdevelopment activities conducted outside of the United States, rather than deducting such costs in the year incurred for tax purposes.U.S. As of the fourth quarter of 2024,2025, we have accounted for an estimate of the effects of the R&Eresearch and development capitalization, based on interpretation of the law as currently enacted. To the extent that this provision is not modified or repealed, and onceOnce our available NOLs or tax credits are fully utilized, then, due to the capitalization of research and development expenses for those activities conducted outside of the U.S., we would incur a significant increase in our tax expenses and a decrease in our cash flows provided by operations.

Risks Related to the 2029 Notes

In May 2020, we issued $253.0 million aggregate principal amount of Notes (the "2025 Notes") and in September 2024, we issued $460.0 million aggregate principal amount of Notes (the "2029 Notes" and together with the 2025 Notes, the "Notes"), respectively.Notes. As of December 31, 2024,2025, we hadhave approximately $711.5$460.0 million outstanding aggregate principal amount of the 2029 Notes. Our indebtedness may limit our ability to borrow additional funds for working capital, capital expenditures, acquisitions or other general business purposes, limit our ability to use our cash flow or obtain additional financing for future working capital, capital expenditures, acquisitions or other general business purposes, require us to use a substantial portion of our cash flow from operations to make debt service payments, limit our flexibility to plan for, or react to, changes in our business and industry, place us at a competitive disadvantage compared to our less leveraged competitors and increase our vulnerability to the impact of adverse economic and industry conditions.

Our ability to meet our payment obligations under the 2029 Notes depends on our future cash flow performance. This, to some extent, is subject to general economic, financial, competitive, legislative and regulatory factors, as well as other factors that may be beyond our control. There can be no assurance that our business will generate positive cash flow from operations, or that additional capital will be available to us, in an amount sufficient to enable us to meet our debt payment obligations and to fund other liquidity needs. If we are unable to generate sufficient cash flow to service our debt obligations, we may need to refinance or restructure our debt, sell assets, reduce or delay capital investments, or seek to raise additional capital. Our ability to refinance our indebtedness will depend on the capital markets and our financial condition at such time. We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations. As a result, we may be more vulnerable to economic downturns, less able to withstand competitive pressures and less flexible in responding to changing business and economic conditions.

In response to the evolving needs of our customers and the growing threat landscape, we are strategically transitioningtransitioned to a SaaS delivery model. As of December 31, 2025, SaaS as a percentage of total ARR was approximately 86%. This transition iswas driven by the increased importance of an automated, data-centric approach to security and the demand for comprehensive protection in the face of heightened cyber risks, collaboration across multiple platforms, the adoption of generative AI tools and the necessity for compliance. Enterprises now use many different combinations of on-premises and cloud data stores, SaaS applications and IaaS environments and this complexity requires a greater level of automated protection.security. We believe our offering provides comprehensive data coverage and our ability to address this demand has and will continue to be a key driver of our growth.

In the second half of 2021, we launched our first SaaS offering, introducing new products and support for cloud infrastructure environments and applications. At the end of 2022, we announced the availability of our flagship Varonis Data Security Platform as a SaaS,SaaS solution, which was previously only sold as a self-hosted solution. The benefits of SaaS delivery are widely established for both customers and providers, and we believe this evolution of a SaaS delivery option for the Varonis Data Security Platform is transformational. The advantages include: quicker and easier deployment and maintenance of solutions with reduced infrastructure and personnel requirements; a lower total cost of ownership; faster deployment of risk assessments, which is the core of our sales motion; enhanced threat detection; continual threat model updates; increased automation for securing data in place; and the ability to deliver additional features and functionality to customers more efficiently. In addition, our Managed Data Detection and Response ("MDDR") offering further reduces both the likelihood of a breach and its potential impact bythrough agentic AI, enabling automated 24x7x365 monitoring with a service level agreement (SLA) that requires Varonis to respond to alerts within a specified time frame. Our MDDR offering is only available for our SaaS customers because of the automation and visibility that’s built into our SaaS platform. In 2025, we further expanded our data coverage through the acquisition of Cyral which allowed us to enter the Database Activity Monitoring (DAM) market and SlashNext, which, together with our MDDR offering, strengthens our ability to stop attacks via email and collaboration apps.

Since launching our SaaS offerings, we have seen SaaS deployments grow significantly and expectthey themare to continue to increase and becomenow the primary driver of our revenues. During this transition, weWe expect SaaS revenues to continue to increase. However, our revenues tomay be negatively impacted due to revenue recognition accounting treatment variations associated with the increase in SaaS sales and whether and when existing customerterm conversionslicense subscription customers will continue to convert to SaaS. In addition, we have announced the end-of-life for our self-hosted business as of December 31, 2026. We expect thesethis to result in increased variability with our remaining self-hosted customers going forward and for revenue variationsfluctuations to persist throughoutas thewe transitionseek to aconvert SaaSour deliveryremaining model,term-license whichcustomers weto believe will be complete by the end of 2025.SaaS.

We sell substantially all of our products and services tothrough channel partners, including distributors and resellers, which sell to end-user customers, which we refer to in this report as our customers. We believe that our sales model, which combines the leverage of a channel sales model with our highly trained and professional sales force, has and will continue to play a major role in our ability to grow and to successfully deliver our unique value proposition for enterprise data. While our products serve customers of all sizes, across industries and across geographies, the marketing focus and majority of our sales focus is on targeting larger organizations who can make sizable initial purchases with us and, over time, have a greater potential lifetime value. Our customers span leading firms in the financial services, public, healthcare, industrial, insurance, energy and utilities, technology, consumerconstruction and retail,engineering, education and constructionconsumer and engineeringretail sectors. We believe our existing customer base serves as a strong source of future incremental revenues given our broad platform of products, their growing volumes and complexity of enterprise data and related security concerns. We will continue our focus on targeting larger organizations who can make sizable purchases with us initially and over time. We are also focused on maintaining a high renewal rate by investing in the quality and reliability of our customer service and support teams to ensure our customers receive value from our products and providing software upgrades and enhancements when and if they are available. Our product offering currently contains coverage for most mission-critical cloud and on-premises data stores and cloud infrastructure environments, and many critical SaaS applications. Our renewal rate continued to be over 90% for the year ended December 31, 2024.2025. In addition, our business has substantially transitioned to SaaS and we have announced the end-of-life for our self-hosted business as of December 31, 2026. We expect this to result in increased variability with our remaining self-hosted customers throughout the end-of-life period and as we seek to convert these remaining customers to SaaS.

We believe there is a significant long-term growth opportunity in both domestic and international markets, which could include any organization that relies on data stored in SaaS applications, IaaS environments, NAS devices, file shares, databases and email servers. For the year ended December 31, 2024,2025, approximately 73%71% of our revenues were derived from the United States, while approximately 21% of our revenues were derived from EMEA and approximately 6%8% from ROW. Additionally, despite the revenue recognition variations from the accounting treatment associated with the positive trend of our increase in SaaS sales and existing customer conversions to SaaS, total revenues still grew approximately 10%13% for the year ended December 31, 20242025, compared with the year ended December 31, 2023.2024. We continue to expect expansion in both domestic and international markets to be key components of our long-term growth strategy. Over the last few years, we have seen changes in customer buying patterns including,including some budgetary tightening and additional scrutiny on enterprise spending as a result of a higher inflation and interest rate environment.

Annual recurring revenues is a key performance indicator defined as the annualized value of active SaaS contracts, term-based subscription license contracts and maintenance contracts in effect at the end of that period. SaaS contracts, term-based subscription license contracts and maintenance contracts are annualized by dividing the total contract value by the number of days in the term and multiplying the result by 365. As we have substantially transitioned to a SaaS delivery model and announced the end-of-life of our self-hosted business as of December 31, 2026, ARR associated with SaaS contracts ("SaaS ARR") will become a key performance indicator throughout 2026. Accordingly, we are disclosing SaaS ARR until the end-of-life of the self-hosted business is complete, at which point, ARR and SaaS ARR will be materially consistent.

As of December 31, 2024,2025, 20232024 and 2022,2023, ARR was $641.9$745.4 million, $543.0$641.9 million and $465.1$543.0 million, respectively, an increase of 18%16% and 17%18% period over period, respectively. As of December 31, 2025, SaaS ARR is $638.5 million. The annualized value of contracts is a legal and contractual determination made by assessing the contractual terms with our customers. The annualized value of these contracts is not determined by reference to historical revenues, deferred revenues or any other GAAP financial measure over any period. ARR and SaaS ARR is not a forecast of future revenues and can be impacted by contract start and end dates and renewal rates. We expect ARR and SaaS ARR to continue to increase in absolute dollars.

Transition to SaaS Delivery Model andModel, SaaS as a Percentage of ARR and SaaS renewal rate

Over the last threeseveral years, we have strategically expanded our offering to be delivered as SaaS solutions. SinceDuring that time, we have seen SaaS deployments grow significantly and expect them to continue to increase and become the primary driver of our revenues.increase. Due to differences in the revenue recognition accounting treatment,treatment and the transitionconversion of existing term license subscription customers to aSaaS, SaaS delivery modelthere may causebe significant variationvariations in the reported revenues for a given period compared to the same period in the previous year. We expect these revenue variations to persist throughoutas we seek to convert our remaining term license subscription customers to SaaS and complete the transition to a SaaS delivery model, which we believe will be complete by the endend-of-life of 2025.our self-hosted business.

Remaining performance obligations ("RPO") represent contracted revenues that have not yet been recognized, which includes deferred revenues and non-cancelable amounts that will be invoiced in the future. Our RPO was $729.7$1,096.7 million as of December 31, 2024.2025 Weand we expect RPO to increase in absolute dollars as we continue to transition to a SaaS delivery model.dollars.

SaaS Revenues. SaaS revenues relate to the Company'sVaronis Data Security Platform delivered as a SaaS platform.model. Over the last threeseveral years, the Companywe began to offer SaaSSaaS-delivered solutions and strategically enhanced our platform to itssafeguard customers,customers' most mission-critical assets, including itscloud (i) flagship Data Security Platform as aenvironments, SaaS that was previously only sold as a self-hosted solutionapplications and (ii)on-premises DatAdvantage Cloud product lines.data. Each of these products allow customers to use hosted software, and the related revenue from these products is recognized ratably over the associated contract period. WeOur SaaS solutions are the primary driver of our revenues and we expect SaaS revenues to continue to grow considerably and become the primary driver of our revenues in 2025, which is when we believe our transition to a SaaS delivery model will be complete.considerably. Conversions from a license sold on-premises to our SaaS offering during the original subscription period are accounted for on a prospective basis. Due to the transition to a SaaS business model, the timing of renewals and renewal rates, we could produce significant variation in the revenues we recognize in a given period.

The following table sets forth the percentage of our revenues that have been derived from SaaS, term license subscriptions, SaaSsubscriptions and maintenance and services revenues for the periods presented.

Cost of revenues consist primarily of salaries (including payroll tax expense related to stock-based compensation), employee benefits (including commissions and bonuses) and stock-based compensation for our customer support, customer success, MDDR and services employees; third-party hosting fees; amortization of certain acquired intangible assets; travel expenses; and allocated overhead costs for facilities, IT and depreciation. We recognize expenses related to these costs as they are incurred and expect that these costs will increase in absolute dollars as we continue to invest in our customer success, support and MDDR teams, move to a SaaS delivery modelteams and support the underlying programs that play a critical role in maintaining our high renewal rate.

Gross profit is total revenues less total cost of revenues. Gross margin is gross profit expressed as a percentage of total revenues. As the majority of our expenses are relatively fixed quarter over quarter and due to the seasonality of our business, the first quarter typically results in the lowest gross margin as our first quarter revenues have historically been the lowest for the year. Conversely, the fourth quarter typically results in the highest gross margin as our fourth quarter revenues have historically been the highest for the year. AsWe wehave completeseen the transitionimpact toof athese SaaSseasonal delivery model, we expect this seasonality to decreasepatterns, due to differences in the revenue recognition accounting treatment.treatment, decline in 2025 and we expect it to continue to decline, as we seek to sell more of our SaaS offering to customers and complete the end-of-life of our self-hosted business.

Research and Development. Research and development expenses primarily consist of personnel costs attributable to our research and development personnel, as well as allocated overhead costs and acquired in-process research and development.costs. We expense research and development costs as incurred.incurred, except for certain internal use software development costs that are capitalized. We expect that our research and development expenses will continue to increase in absolute dollars as we further strengthen our technology platform and invest in the development of both existing and new products through the hiring of talented and capable employees.

Sales and Marketing. Sales and marketing expenses are the largest component of our operating expenses and consist primarily of personnel costs, as well as marketing and business development costs, travel expenses, third-party hosting fees, training and education andeducation, allocated overhead costs.costs and amortization of certain acquired intangible assets. We expect that sales and marketing expenses will continue to increase in absolute dollars as we plan to expand our sales and marketing efforts, both domestically and internationally. We also expect sales and marketing expenses to continue to be our largest category of operating expenses.

Financial income (expenses), net consists primarily of interest income, amortization of premiums and accretion of discounts related to our investment in available for sale marketable securities, foreign exchange gains or losses, amortization of debt issuance costs and interest expense. Interest income represents interest received on our cash, cash equivalents, marketable securities, depositssecurities and amortization of premiums and accretion of discounts related to our investment in available for sale marketable securities.deposits. Foreign exchange gains or losses relate to our business activities in foreign countries with different operational reporting currencies. As a result of our business activities in foreign countries, we expect that foreign exchange gains or losses will continue to occur due to fluctuations in exchange rates in the countries where we do business. Amortization of debt issuance costs relate to the Notes we issued in May 2020 and September 2024. Interest expense consists of the contractual interest expenses associated with the Notes. The Notes we issued in May 2020 matured on August 15, 2025, as such, no further amortization of debt issuance costs or contractual interest expense will be incurred related to these Notes.

For the year ended December 31, 2024,2025, our revenues increased 10%13% compared to the year ended December 31, 20232024, despite increased SaaS sales and existing customer conversions to SaaS which cause variations due to accounting treatment differences in revenue recognition for sales within the respective periods. SaaS revenues increased 370%122% from $44.4 million for the year ended December 31, 2023 to $208.8 million for the year ended December 31, 20242024, to $462.6 million for the year ended December 31, 2025, as we continue to progress throughcompleted our transition to a SaaS delivery model. The increase in SaaS revenues was driven by (i) new customer acquisitions, which are happening due to the simplicity and automated outcomes of our SaaS platform and MDDR offering, as well as customer interest in Gen AI, (ii) existing customer conversions and upselling and (iii) our high renewal rates. Consequently, there was an expected decrease to term license subscriptions given the aforementioned transition and customer conversions, a trend we expect to continue in the comingnear years.future. ARR was $641.9$745.4 million and $543.0$641.9 million as of December 31, 20242025 and 2023,2024, respectively, representing an increase of 18%.16%. The anticipated decrease in maintenance and services revenues was due to churn and the conversion of existing customers to SaaS and churn, despite our renewal rate continuing to be over 90% for each of the years ended December 31, 20242025 and 2023.2024. We continue to expect less associated maintenance and services revenues in the future.

The increase in cost of revenues was primarily related to a $11.3$19.7 million increase in salariesthird-party andhosting costs associated with our transition to a SaaS delivery model. The increase is also due to a $15.0 million increase in salaries, benefits and stock-based compensation expense due to increased headcount for customer success personnel to assist with the transitioncompletion toof aour SaaS delivery model,transition, including our recently introduced MDDR offering, andto ensure high customer satisfaction and to maintain our strong renewal rates. The increase is also due to a $9.9 million increase in third-party hosting costs associated with our transition to a SaaS delivery model.

The increase in research and development expenses was primarily related to a $6.7$35.5 million increase in acquired in-process research and development costs associated with our asset acquisition, a $3.2 million increase in salaries andsalaries, benefits and stock-based compensation expense primarily due to increased headcount,headcount and conditional consideration related to the business acquisitions, an increase of $1.9$5.7 million in facilities and allocated overhead costs andcosts, a $0.8$4.3 million increase in third-party hosting costs associated with our transition to a SaaS delivery model.model and a $1.5 million increase in acquisition-related costs associated with the business acquisitions, partially offset by a $6.7 million decrease in acquired in-process research and development costs associated with a prior period asset acquisition.

The increase in sales and marketing expenses was primarily related to an increase of $9.7$5.2 million in general sales and marketing expenses, including increased travel, marketing events and third-party hosting costs associated with our transition to a SaaS delivery model andmodel, a $1.8$5.0 million increase in salaries andsalaries, benefits and stock-based compensation expense primarilyand duean toincrease increasedof headcount.$2.1 million in facilities and allocated overhead costs.

The increase in general and administrative expenses was primarily related to an increase of $4.9$4.8 million in salaries and benefits and stock-based compensation expense primarily due to increased headcount to support the overall growth of our businessbusiness, a $2.5 million increase in consulting and anservices fees and a $2.1 million increase of $0.5 million in facilitiesacquisition-related andcosts allocatedassociated overheadwith costs.the business acquisitions.

Income taxes for the year ended December 31, 2024,2025, including the decreaseincrease in income taxes, were comprised of foreign and U.S. income taxes.

When selling on-premises subscription products, our quarterly results reflect seasonality in the sale of our products and services. Historically, we have experienced a pattern of increased sales in the fourth quarter. This trend makes it difficult to achieve sequential revenue growth in the first quarter of the following year. Because of purchasing trends, demand for our products and services is typically slowest in the first quarter, resulting in a decrease in quarterly revenues from the fourth quarter to the first quarter of the subsequent fiscal year. Our gross margins and operating margins have been affected by these historical trends because the majority of our expenses are relatively fixed quarter over quarter. Our expenses, which do not vary directly with revenues, and the seasonal pattern described above have an impact on the cost of revenues, research and development expenses, sales and marketing expenses and general and administrative expenses as a percentage of revenues in each calendar quarter during the year. We expecthave seen the impact of these seasonal patternspatterns, due to the ratable revenue recognition of SaaS, decline in 2025 and we expect it to continue to decline, as we seek to sell more of our SaaS offering to new customers and transitioncomplete the end-of-life of our existingself-hosted customers to our SaaS platform, due to the ratable revenue recognition of SaaS.business. The majority of our expenses are personnel-related costs, which consist of salaries (including payroll tax expense related to stock-based compensation), employee benefits (including commissions and bonuses) and stock-based compensation. As a result, we have not experienced significant seasonal fluctuations in the timing of expenses from period to period.

As of December 31, 2024,2025, our cash and cash equivalents, short-term marketable securities and short-term deposits of $568.4$921.0 million were held for working capital purposes. We believe that our existing cash and cash equivalents, short-term marketable securities, short-term deposits and cash flow from operations will be sufficient to fund our operations and capital expenditures for at least the next 12 months. Additionally, as of December 31, 2024,2025, we held $658.9$187.2 million in long-term marketable securities. Our future capital requirements will depend on many factors, including our rate of revenue growth, timing of renewals and renewal rates, the amount and timing of conversions, the expansion of our sales and marketing activities, the timing and extent of spending to support product development efforts and expansion into new geographic locations, the timing of introductions of new software products and enhancements to existing software products, the continuing market acceptance of our software offerings and our use of cash to pay for acquisitions or share repurchases, if any.

Our operating activities are driven by sales of our products less costs and expenses, primarily payroll and related expenses, and adjusted for certain non-cash items, mainly depreciation and amortization, stock-based compensation, amortization of deferred commissions, non-cash operating lease costs, amortization of debt issuance costs, amortization of premium and accretion of discount on marketable securities, acquired in-process research and development costs,securities and changes in operating assets and liabilities. Changes in operating assets and liabilities are driven mainly by collection of accounts receivable from the sales of our software products and deferred revenue, which primarily consists of billed fees for our subscriptions, prior to satisfying the criteria for revenue recognition, which are subsequently recognized as revenue in accordance with our revenue recognition policy.

For 2024,2025, net cash inflowsprovided from ourby operating activities were $115.2$147.4 million. We have historically observed two seasonal patterns that impact our net cash provided by operating activities.activities, which we continue to expect under a SaaS delivery model. First, a majority of our sales are made during the last three weeks of the quarter. Second, the highest dollar amount of sales of our products and services occurs in the fourth quarter. Consequently, we end the fourth quarter with our highest accounts receivable balance of any quarter which in turn generates the greatest amount of collections in the following quarter. In addition, there is negative sequential sales in the first quarter, which results in a relatively lower amount collected during the second quarter. These seasonal trends also impact our operating loss because the majority of our expenses are relatively fixed in the short-term. For 2024,2025, cash inflows were $102.1$80.2 million from our net loss excluding non-cash and acquirednon-operating in-processcash research and developmentflow charges. Additional sources of cash inflows were from changes in our working capital, including a $110.4$148.1 million increase in deferred revenues, a $17.3$52.8 million increase in accrued expenses and other liabilities, a $3.6 million increase in trade payables, a $0.3 million decrease in other long-term assets and a $0.3$2.4 million increase in other long-term liabilities.liabilities and a $1.2 million increase in trade payables. This was partially offset by a $95.2$83.6 million increase in prepaid expenses and other short-term assets (including deferred commissions) and, a $23.7$52.6 million increase in accounts receivable.receivable and a $1.1 million increase in other long-term assets. Our days’ sales outstanding (“DSO”) for the three months and year ended December 31, 20242025 was 7781 and 74,77, respectively.

For 2023,2024, net cash provided by operating activities were $59.4$115.2 million. Sources of cash inflows were $105.3$102.1 million,million which includedfrom our net loss of $100.9 million, offset byexcluding non-cash chargesand ofnon-operating $206.2cash million.flow charges. Additional sources of cash inflows were from changes in our working capital, including a $69.9$110.4 million increase in deferred revenuesrevenues, a $17.3 million increase in accrued expenses and other liabilities, a $3.6 million increase in trade payables, a $0.3 million decrease in other long-term assets and a $0.5$0.3 million increase in other long-term liabilities. This was partially offset by a $75.0$95.2 million increase in prepaid expenses and other short-term assets (including deferred commissions) and a $33.1$23.7 million increase in accounts receivable. Our DSO for the three months and year ended December 31, 20232024 was 8277 and 72,74, respectively. Other sources of cash outflows were from a $5.3 million decrease in accrued expenses and other liabilities, a $2.3 million decrease in trade payables and a $0.6 million decrease in other long-term assets.

Our investing activities consist primarily of acquisitions, capital expenditures to purchase property and equipment, including leasehold improvements, purchasecapitalized in-processinternal-use research and development,software, purchase and sale of deposits and changes in our marketable securities. In the future, we expect to continue to incur capital expenditures to support our expanding operations.

DuringFor 2023,2025, net cash used in investing activities of $143.1$0.8 million was primarily attributable to net$123.5 investmentsmillion of $216.6cash millionpaid infor marketableacquisitions, securitiesnet andof $5.1cash acquired, $12.6 million in capital expenditures to support our growth including hardware, software, office equipment and leasehold improvements mainly in connection with existing office space.space and $2.9 million for capitalized internal-use software expenditures. This was partially offset by net proceeds of $78.6$135.5 million in marketable securities and net proceeds of $2.7 million in deposits.

InFor 2023,2025, net cash used in financing activities of $53.4$129.7 million was attributable to $43.5$115.0 million ofin repurchases of common stockstock, and $21.4$29.2 million in taxes paid related to net share settlement of equity awards,awards and $0.1 million in repayment of 2025 convertible senior note principal, partially offset by $11.5$14.3 million of proceeds from employee stock plans.plans and $0.3 million in proceeds from options to repurchase common stock.

On September 10, 2024, we issued $460.0 million aggregate principal amount of Notes (the "2029 Notes.Notes"). The net proceeds from the offering, after deducting issuance costs, were approximately $449.6 million. In connection with the issuance of the 2029 Notes, we used $55.5 million of the net proceeds to enter into Capped Call Transactions.

On May 11, 2020, we issued $253.0 million aggregate principal amount of Notes (the "2025 Notes.Notes" and together with the 2029 Notes, the "Notes"). The net proceeds from the offering, after deducting issuance costs, were approximately $245.2 million. In connection with the issuance of the 2025 Notes, we used $29.3 million of the net proceeds to enter into Capped Call Transactions. The 2025 Notes were settled prior to or on their maturity date of August 15, 2025 in accordance with the terms of the 2025 Indenture. Additionally, the Capped Call Transactions entered into in connection with the 2025 Notes were executed and net share settled.

We have obligations related to unrecognized tax benefit liabilities totaling $33.3$50.5 million and others related to severance pay, which have been excluded from the table above as we do not believe it is practicable to make reliable estimates of the periods in which payments for these obligations will be made. We also have a contractual minimum purchase commitmentcommitments with a service providerproviders through August 31, 20272027, totalingOctober $7.131, 2028 and May 31, 2031. These commitments total $4.9 million, $2.5 million and $23.9 million due inwithin the next 12 monthsmonths, respectively and $21.0$10.5 duemillion, thereafter$3.8 million and an additional $32.9$377.6 million contractual minimum purchase commitment with another service provider through December 31, 2026 (with no specified annual commitments.commitments), respectively, due thereafter. We expect to fund these obligations with cash flows from operations and cash on our balance sheet.

We prepare our consolidated financial statements in accordance with generally accepted accounting principles in the United States. The preparation of consolidated financial statements also requires us to make estimates and assumptions that affect the reported amounts of assets, liabilities, revenues, costs and expenses and related disclosures. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances. Actual results could differ significantly from the estimates made by our management. To the extent that there are differences between our estimates and actual results, our future financial statement presentation, financial condition, results of operations and cash flows will be affected. We believe that our accounting policies discusseddescribed belowin Note 2. Significant Accounting Policies in Part II, Item 8 of this Annual Report on Form 10-K, the critical accounting policy estimates, assumptions and judgments that have the most significant impact on our consolidated financial statements are criticaldescribed to understanding our historical and future performance, as these policies relate to the more significant areas involving management’s judgments and estimates.below. Critical accounting policies and estimates are those that we consider the most important to the portrayal of our financial condition and results of operations because they require our most difficult, subjective or complex judgments, often as a result of the need to make estimates about the effect of the matters that are inherently uncertain.

Our business depends on our current and prospective customers’ ability and willingness to invest in IT services, including cybersecurity projects, which in turn is dependent upon their overall economic health. Negative conditions in the general economy both in the United States and abroad, including inflationary pressure, currency fluctuations and a higher interest rate environment, changes in gross domestic product growth, instability in connection with political elections, potential future government shutdowns, the federal government’s failure to raise the debt ceiling, financial and credit market fluctuations, the imposition of trade barriers and restrictions such as tariffs, including tariffs implemented around the world by the United States or other countries, political deadlock, restrictions on travel, natural catastrophes, warfare and terrorist attacks, could cause a decrease in business investments, including corporate spending on enterprise software in general and negatively affect the rate of growth of our business. For example, our operations, and the operations of our customers and partners, were affected by geopolitical turmoil and sanctions caused by the war between Russia and Ukraine, and the COVID-19 pandemic and efforts to control its spread, including by mandatory business closures and capacity limitations imposed by the jurisdictions in which we operate. Similar events and restrictions in the future could negatively affect our business.

Uncertainty in the global economy makes it extremely difficult for our customers and us to forecast and plan future business activities accurately. This could cause our customers to reevaluate decisions to purchase our product or to delay their purchasing decisions, which could lengthen our sales cycles and negatively impact our results. In recent years, the European economy experienced economic turmoil that caused the devaluation of local European currencies (specifically, the euro and the pound sterling), inflationary pressures and general economic uncertainty. As a result, there has been, and may in the future be, budgetary tightening and longer sales cycles in the region which may negatively impact our results of operations. In addition, the imposition of tariffs, such as those implemented by the United States or other countries in 2025,tariffs may materially impact business performance for companies operating around the world and may cause budgetary tightening and longer sales cycles for companies in those impacted countries. The United States could also experience a sustained period of elevated inflation, which may put pressure on discretionary spending by our customers, and a lengthening of our sales cycle in the region, which could negatively impact our results.

Privacy and data protection laws in the United States and internationally are rapidly evolving and remain subject to uncertainty. U.S. federal, state, and foreign authorities have enacted, and continue to consider, laws governing the collection, use, disclosure, storage, and security of personal information. In the United States, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) impose significant obligations on businesses and grant consumers enhanced rights, such as the ability to opt out of certain sales of personal information. In 2025,recent additionalyears, numerous U.S. states have enacted comprehensive privacy laws took effect in Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota,laws, and Maryland,additional states continue to consider similar legislation. These laws generally impose obligations relating to the collection, use, disclosure, storage, security, and furtherprocessing stateof privacypersonal information, provide consumers with enhanced rights regarding their personal data, and require businesses to implement specified data protection measures. Because these laws are schedulednot uniform and continue to takeevolve, effectthey inincrease 2026,the includingcomplexity inof Indiana,the Kentucky,regulatory landscape and Rhodemay Island.increase Collectively,our thesecompliance frameworks generallycosts, require detailedchanges disclosures,to honoringour consumerbusiness rights,practices, products and implementing robust data protection safeguards,services, and theyexpose expandus theto patchworkheightened ofregulatory, compliancelitigation, obligationsand acrossreputational the United States.risks.

Cross‑border data transfers from the European Economic Area and the UK to the United States rely on mechanisms such as standard contractual clauses, the UK’s International Data Transfer Agreement (or Addendum), and the EU–U.S. Data Privacy Framework (including its UK extension). In September 2025, the European General Court upheld the validity of the EU–U.S. Data Privacy Framework, providing near‑term stability for organizations that self‑certify to the framework; however, challenges and appeals remain possible, and the transfer landscape continues to evolve. Compliance with GDPR, the UK regime as amended by the Data (Use and Access) Act 2025, and other international privacy laws may require significant operational changes and costs, while non‑compliance could result in substantial fines, litigation, and reputational harm, adversely affecting our business, financial condition, and results of operations.

•our revenues and operating margins may fluctuate more than anticipated as our business model relies increasingly on subscription revenues, which may be more sensitive to renewal rates, customer usage patterns, and macroeconomic conditions;

Our future growth depends upon expanding sales of our products and capabilities to existing customers and their organizations and receivingobtaining renewals. If our customers do not purchase additional products or capabilities, our revenues may grow more slowly than expected, may not grow at allall, or may decline. Our efforts mayto not result in increasedincrease sales to existing customers (“upsells”)may not be successful, and additionalif revenues.we Ifare unable to effectively upsell our efforts to upsell tocustomers, our customersbusiness, areoperating notresults successful,and ourfinancial businesscondition wouldcould suffer.be adversely affected.

Our future growth also dependsdepends, in partpart, uponon increasing our customer base, particularly thoseamong customers with potentially high customer lifetime values. Our ability to achieve significant future revenue growth in revenues in the future will depend,depends in large part,part uponon the effectiveness of our sales and marketing efforts, both domestically and internationally, and our ability to attract new customers. OurExisting and future laws and regulations may restrict sales and marketing activities. Laws governing telemarketing, electronic communications, privacy, data protection and consumer protection continue to evolve and may limit our ability to identify, contact and engage prospective customers or increase the costs associated with our sales and marketing activities. If these laws reduce the effectiveness of our sales and marketing efforts, our ability to attract new customers may be adversely affected by newly enacted laws that may prohibit certain sales and marketing activities, such as legislation passed in the State of New York, pursuant to which unsolicited telemarketing sales calls are prohibited. If we fail to attract new customers and maintain and expand thoseexisting customer relationships, our revenuesrelationships may be adversely affected, andwhich could harm our revenues, business willand beoperating harmed.results.

We have incurred net losses in each year since our inception, including a net loss of $36.9$83.7 million for the threesix months ended MarchJune 31,30, 2026 and net losses of $129.3 million and $95.8 million in each of the years ended December 31, 2025 and 2024, respectively. Because the market for our software is rapidly evolving and has still not yet reached widespread adoption, it is difficult for us to predict our future results of operations. We expect our operating expenses to increase over the next several years as we hire additional personnel, expand and improve the effectiveness of our distribution channels, and continue to develop features and applications for our software.

We rely on channel partners, such as distribution partners and resellers, to sell the Varonis Data Security Platform. In 2025 and for the threesix months ended MarchJune 31,30, 2026, our channel partners fulfilled substantially all of our sales, and we expect that sales to channel partners will continue to account for substantially all of our revenues for the foreseeable future. Our ability to achieve revenue growth in the future will depend in part on our success in maintaining successful relationships with our channel partners.

Historically, we have generated the majority of our revenues from customers in the United States. For the year ended December 31, 2025 and for the threesix months ended MarchJune 31,30, 2026, approximately 71% and 72%, respectively, of our total revenues were derived from sales in the United States. Nevertheless, we have operations across the globe, and we plan to continue to expand our international operations as part of our long-term growth strategy. The further expansion of our international operations will subject us to a variety of risks and challenges, including:

Our business relies on our customers’ satisfaction with the technical support, customer success and professional services we provide to support our products. Our customers have no obligation to renew their agreements with us after the initial terms have expired. Our customers have an option to renew their agreements and, for us to maintain and improve our results of operations, it is important that our existing customers renew their agreements, if applicable, when the existing contract term expires. For example, our SaaS renewal rate for the threesix months ended MarchJune 31,30, 2026 and 2025 is over 90%.

We incorporate machine learning and AI solutions into parts of our platform, offerings, services and features, and these applications may become more important in our operations over time. AI technologies, including generative AI, are complex and rapidly evolving, and we face competition from other companies as well as an evolving regulatory landscape. Several jurisdictions around the globe, including Europe and the United States, have already proposed or enacted laws governing AI, and we may need to commit significant resources to maintain business practices that comply with the evolving regulatory landscape. Our competitors or other third parties may incorporate AI into their products more quickly and successfully than us, which could impair our ability to compete effectively and adversely affect our results of operations. In addition, the increasing adoption of agentic AI technologies may increase the risk of control failures, security vulnerabilities and unauthorized actions. Errors or unintended decisions by autonomous AI systems could result in operational disruptions, regulatory exposure or financial losses.

As of MarchJune 31,30, 2026, we have 117130 issued patents in the United States and 6468 pending U.S. patent applications. We also have 7158 patents issued and 8397 applications pending for examination in non-U.S. jurisdictions, and 3430 pending PCT patent applications, all of which are counterparts of our U.S. patent applications. We may file additional patent applications in the future. The process of obtaining patent protection is expensive and time-consuming, and we may not be able to prosecute all necessary or desirable patent applications at a reasonable cost or in a timely manner all the way through to the successful issuance of a patent. We may choose not to seek patent protection for certain innovations and may choose not to pursue patent protection in certain jurisdictions. Furthermore, it is possible that our patent applications may not issue as granted patents, that the scope of our issued patents will be insufficient or not have the coverage originally sought, that our issued patents will not provide us with any competitive advantages, and that our patents and other intellectual property rights may be challenged by others or invalidated through administrative process or litigation. In addition, issuance of a patent does not guarantee that we have an absolute right to practice the patented invention. Our policy is to require our employees (and our consultants and service providers that develop intellectual property included in our products) to execute written agreements in which they assign to us their rights in potential inventions and other intellectual property created within the scope of their employment (or, with respect to consultants and service providers, their engagement to develop such intellectual property). However, we may not be able to adequately protect our rights in every such agreement or execute an agreement with every such party. Finally, in order to benefit from patent and other intellectual property protection, we must monitor, detect and pursue infringement claims in certain circumstances in relevant jurisdictions, all of which is costly and time-consuming. As a result, we may not be able to obtain adequate protection or to enforce our issued patents or other intellectual property effectively.

As of December 31, 2025, we have accumulated $211.5 million of federal NOL, $182.0 million of state NOL and $10.5 million of federal research credit carryforwards since inception. Future changes in our stock ownership, including future offerings, as well as changes that may be outside of our control, could result in a subsequent ownership change under Section 382, that would impose an annual limitation on NOLs. In addition, the cash tax benefit from our NOLs is dependent upon our ability to generate sufficient taxable income. Accordingly, we may be unable to earn enough taxable income in order to fully utilize our current NOLs.

On December 22, 2017, the Tax Cuts and Jobs Act (the "TCJA") was enacted. The TCJA remains unclear in some respects and has been, and may continue to be, subject to amendments and technical corrections, as well as interpretations and implementing regulations by the Treasury and Internal Revenue Service, any of which could lessen or increase certain adverse impacts of TCJA. Effective in July 2025, the TCJA, as revised by the OBBBA, requires all U.S. companies to capitalize and subsequently amortize research and development expenses that fall within the scope of Section 174 over fifteen years for research and development activities conducted outside of the U.S. As of the firstsecond quarter of 2026, we have accounted for an estimate of the effects of the research and development capitalization, based on interpretation of the law as currently enacted. Once our available NOLs or tax credits are fully utilized, then, due to the capitalization of research and development expenses for those activities conducted outside of the U.S., we would incur a significant increase in our tax expenses and a decrease in our cash flows provided by operations.

In September 2024, we issued the 2029 Notes. As of MarchJune 31,30, 2026, we have $460.0 million outstanding aggregate principal amount of the 2029 Notes. Our indebtedness may limit our ability to borrow additional funds for working capital, capital expenditures, acquisitions or other general business purposes, limit our ability to use our cash flow or obtain additional financing for future working capital, capital expenditures, acquisitions or other general business purposes, require us to use a substantial portion of our cash flow from operations to make debt service payments, limit our flexibility to plan for, or react to, changes in our business and industry, place us at a competitive disadvantage compared to our less leveraged competitors and increase our vulnerability to the impact of adverse economic and industry conditions.

We operate on a global basis and political, social, economic and security conditions in countries in which we operate may limit our ability to develop and sell our products. Specifically, we have operations and do business in Israel, the United Kingdom, France, Brazil and Ukraine. Continued political and social instability and war in these regions, and any other areas in the world where we have operations, may affect our business and operations in those and other neighboring regions. In addition, increased regulatory scrutiny, sanctions, export controls, data‑localization requirements and other legal or regulatory restrictions, including those relating to software, data security and AI‑enabled technologies, could further limit our ability to operate or expand in certain international markets and could increase our compliance costs.

In March 2022, in response to the war between Russia and Ukraine, a number of countries, including the United States, imposed sanctions and export controls on Russia, which in turn imposed counter-sanctions in response. While sales in Russia represented a very small percentage of our overall business, and while our operations in Russia and Ukraine have historically been a small portion of our overall workforce, the conflict is complex and evolving and subjects us to additional regulatory risk and compliance costs. Sanctions and export control regimes are continuously evolving and increasingly complex, including with respect to software, encryption, data security and AI‑related functionality, and compliance with such requirements may restrict sales opportunities, limit customer deployments or require operational changes. AsSince of March 31, 2026,2022, we dohave not havehad any employees or contractors in Russia. We have no way to predict the progress or outcome of the situation, including any impact on the rest of the world, as the conflict and government reactions are rapidly developing.

Our Israeli subsidiary has benefited from a status of a “Beneficiary Enterprise” under the Israeli Law for the Encouragement of Capital Investments, 5719-1959, or the Investment Law, since its incorporation. As of MarchJune 31,30, 2026, the tax benefit that we have been utilizing for our Israeli subsidiary terminated. A tax rate of 16% should be paid by our Israeli subsidiary per such eligible income under the terms of the Investment Law, subject to meeting various conditions. To the extent we do not meet these conditions, our Israeli operations will be subject to a corporate tax at the standard rate of 23%. If the Israeli subsidiary is subject to a corporate tax at the standard rate, it may adversely affect our tax expenses and effective tax rates. Additionally, if our Israeli subsidiary increases its activities outside of Israel, for example, through acquisitions, these activities may not be eligible for inclusion in Israeli tax benefit programs. The tax benefit derived from the Investment Law is dependent upon the ability to generate sufficient taxable income. Accordingly, our Israeli subsidiary may be unable to earn enough taxable income in order to fully utilize its tax benefits.

As of MarchJune 31,30, 2026, we have options, restricted stock units (“RSUs”) and performance stock units (“PSUs”) outstanding that, if fully vested and exercised, would result in the issuance of approximately 9.19.2 million shares of our common stock. All of the shares of our common stock issuable upon exercise of options and vesting of RSUs and PSUs have been registered for public resale under the Securities Act. Accordingly, these shares will be able to be freely sold in the public market upon issuance as permitted by any applicable vesting requirements.

In addition, the stock markets have experienced extreme price and volume fluctuations that have affected and continue to affect the market prices of equity securities of many technology companies. Stock prices of many technology companies have fluctuated in a manner unrelated or disproportionate to the operating performance of those companies. In the past, stockholders have instituted securities class action litigation following periods of market volatility. A significant decline in our stock price has and could in the future subject us to securities class action litigation, such asincluding the purportedsecurities class action litigationlawsuit filed against us and certain of our executive officers in January 2026, as more fully described in Note 1, “Contractual Purchase Obligations and Contingent Liabilities ” of our accompanying Notes to Condensed Consolidated Financial Statements included in Part I, Item 1 of this Quarterly Report on Form 10-Q. Such securities litigation, and any potential securities litigation in the future, could subject us to substantial costs, divert resources and the attention of management from our business and adversely affect our business, results of operations, financial condition and cash flows and may cause a significant increase in the premium paid for our directors and officers insurance.

Our go-to-market model is channel-led and enterprise-focused. We sell through channel partners, including distributors and resellers, which sell to end-user customers, which we refer to in this report as our customers. We believe that our sales model, which combines the leverage of a channel sales model with our highly trained and professional sales force, has and will continue to play a major role in our ability to grow and to successfully deliver our unique value proposition for enterprise data. While our products serve customers of all sizes, across industries and across geographies, the marketing focus and majority of our sales focus is on targeting larger organizations who can make sizable initial purchases with us and, over time, have a greater potential lifetime value. Our customers span leading organizations across financial services, public, healthcare, industrial, insurance, energy and utilities, technology, construction and engineering, education and consumer and retail sectors. Our sales motion leads with a rapid risk assessment that surfaces immediate, high-priority exposure – typically within days of deployment – creating a clear and urgent case for expansion. Our SaaS renewal rate is over 90% for the threesix months ended MarchJune 31,30, 2026.

We believe there is a significant long-term growth opportunity in both domestic and international markets. Any organization that stores data in SaaS applications, IaaS environments, databases, file shares, email systems, or AI platforms is a potential customer. As enterprises accelerate AI adoption, the need to govern, secure, and monitor the data those systems touch will only grow. We believe Varonis is uniquely positioned to meet that demand – not as a company adapting to the AI era, but as one built for it. For the three and six months ended MarchJune 31,30, 2026, approximately 71%72% of our revenues were derived from the United States, while approximately 21%20% of our revenues were derived from EMEA and approximately 8% from ROW. Additionally, despite the revenue recognition variations from the accounting treatment associated with existing customer conversions to SaaS, total revenues still grew approximately 27%22% for the threesix months ended MarchJune 31,30, 2026, compared with the threesix months ended MarchJune 31,30, 2025. We continue to expect expansion in both domestic and international markets to be key components of our long-term growth strategy. Over the last few years, we have seen changes in customer buying patterns including some budgetary tightening and additional scrutiny on enterprise spending as a result of a higher inflation and interest rate environment.

Since inception, we have continued to scale our business and execute on strategic initiatives which we believe have positioned us for durable long-term growth. During the three and six months ended MarchJune 31,30, 2026, we have continued to grow our revenues despite revenue recognition accounting treatment variations associated with existing customer conversions to SaaS. For the three months ended MarchJune 31,30, 2026 and 2025, SaaS revenues were $161.1$171.7 million and $88.6$105.9 million, respectively. For the six months ended June 30, 2026 and 2025, SaaS revenues were $332.8 million and $194.5 million, respectively. For the three months ended MarchJune 31,30, 2026 and 2025, our total revenues were $173.1$180.0 million and $136.4$152.2 million, respectively. For the six months ended June 30, 2026 and 2025, our total revenues were $353.1 million and $288.6 million, respectively. For the three months ended MarchJune 31,30, 2026 and 2025, we have operating losses of $44.5$40.6 million and $43.8$36.6 million and net losses of $36.9$46.8 million and $35.8 million, respectively. For the six months ended June 30, 2026 and 2025, we have operating losses of $85.1 million and $80.3 million and net losses of $83.7 million and $71.6 million, respectively.

As of MarchJune 31,30, 2026 and 2025, SaaS ARR was $683.2$726.0 million and $405.2$478.3 million, respectively, an increase of 69%52% period over period. The annualized value of contracts is a legal and contractual determination made by assessing the contractual terms with our customers. The annualized value of these contracts is not determined by reference to historical revenues, deferred revenues or any other GAAP financial measure over any period. SaaS ARR is not a forecast of future revenues and can be impacted by contract start and end dates and renewal rates. We expect SaaS ARR to continue to increase in absolute dollars.

As we have completed our SaaS transition and announced the end-of-life of our self-hosted business by the end of 2026, the historical renewal rate disclosure has been replaced by the SaaS renewal rate which is over 90% for the threesix months ended MarchJune 31,30, 2026. In addition, throughout 2026, we will also be disclosing SaaS ARR excluding conversions which excludes SaaS ARR associated with self-hosted customers converting to SaaS over the trailing twelve months. As of MarchJune 31,30, 2026, SaaS ARR excluding conversions was $522.6$598.1 million, an increase of 29%25% compared to MarchJune 31,30, 2025 SaaS ARR. We expect SaaS ARR excluding conversions to increase in absolute dollars. These additional performance metrics align with our new business model and how management views the business.

Remaining performance obligations ("RPO") represent contracted revenues that have not yet been recognized, which includes deferred revenues and non-cancelable amounts that will be invoiced in the future. Our RPO was $1,095.4$1,084.5 million as of MarchJune 31,30, 2026 and we expect RPO to increase in absolute dollars.

SaaS Revenues. SaaS revenuesrevenues, including SaaS with MDDR, relate to the Varonis Data Security Platform delivered as a SaaS model. Over the last several years, we began to offer SaaS-delivered solutions and strategically enhanced our platform to safeguard customers' most mission-critical assets, including cloud environments, SaaS applications, on-premises data, email and AI systems. Each of these products allow customers to use hosted software, and the related revenue from these products is recognized ratably over the associated contract period. Our SaaS solutions are the primary driver of our revenues and we expect SaaS revenues to continue to grow considerably. Conversions from a license sold on-premises to our SaaS offering during the original subscription period are accounted for on a prospective basis.

Our SaaS renewal rate for each of the threesix months ended MarchJune 31,30, 2026 and 2025 is over 90%. We measure the SaaS renewal rate for our customers over a 12-month period, based on a dollar renewal rate for SaaS contracts expiring during that time period. The expected increase in SaaS revenues, combined with the timing of conversions and renewals, as well as conversion and renewal rates, may result in significant variation in the revenues we recognize in a given period. We expect term license subscription revenues and perpetual license revenues, including the associated maintenance and support related to perpetual licenses, to continue to decline.

Our products are used by a wide range of enterprises, including Fortune 500 corporations and small and medium-sized businesses. Our customers span a broad array of industries and are located in over 95100 countries.

Gross profit is total revenues less total cost of revenues. Gross margin is gross profit expressed as a percentage of total revenues. As the majority of our expenses are relatively fixed quarter over quarter and due to the seasonality of our business, the first quarter typically results in the lowest gross margin as our first quarter revenues have historically been the lowest for the year. Conversely, the fourth quarter typically results in the highest gross margin as our fourth quarter revenues have historically been the highest for the year. We have seen the impact of these seasonal patterns, due to differences in revenue recognition accounting treatment, decline in 2025 and during the threesix months ended MarchJune 31,30, 2026 and we expect it to continue to decline, as we seek to sell more of our SaaS offering to customers and complete the end-of-life of our self-hosted business.

Benefit (Provision) for Income Taxes

Comparison of the Three Months Ended MarchJune 31,30, 2026 and 2025

The following tables are a summary of our condensed consolidated statements of operations for the three months ended MarchJune 31,30, 2026 and 2025 in dollars and as a percentage of our total revenues.

For the three months ended MarchJune 31,30, 2026, our revenues increased 27%18% compared to the three months ended MarchJune 31,30, 2025 despite existing customer conversions to SaaS which cause variations due to accounting treatment differences in revenue recognition for sales within the respective periods. SaaS revenues increased 82%62% from $88.6$105.9 million for the three months ended MarchJune 31,30, 2025 to $161.1$171.7 million for the three months ended MarchJune 31,30, 2026, as we completed our transition to a SaaS delivery model. The increase in SaaS revenues was driven by (i) new customer acquisitions, which areis happening due to the simplicity and automated outcomes of our SaaS platform and MDDR offering, as well as customer interest in Gensecuring AI,AI and also driven by (i) our high renewal rates, (ii) existing customer conversions and upselling and (iii) ournew highcustomer renewal rates.acquisitions. Consequently, there was an expected decrease to term license subscriptions given the aforementioned transition and customer conversions, a trend we expect to continue in the near future.conversions. SaaS ARR was $683.2$726.0 million and $405.2$478.3 million as of MarchJune 31,30, 2026 and 2025, respectively, representing an increase of 69%.52%. The anticipated decrease in maintenance and services revenues was due to the conversion of existing customers to SaaS and churn. We continue to expect less maintenance and services revenues in the future.

The increase in cost of revenues was primarily related to a $6.1$6.4 million increase in third-party hosting costs associated with our transition to a SaaS delivery model. The increase is also due tomodel, a $3.7$3.0 million increase in salaries, benefits and stock-based compensation expense due to increased headcount for customer success personnel to assist with the completion of our SaaS transition, including our MDDR offering, to ensure high customer satisfaction and to maintain our strong SaaS renewal raterate, and an increase ofa $2.5 million increase in developed technology intangible asset amortization due to the business acquisitions and a $1.2 million increase in facilities and allocated overhead costs.

The increase in generalsales and administrativemarketing expenses was primarily related to an increase of $0.5$2.1 million in acquisition-relatedsalaries, costsbenefits associatedand withstock-based thecompensation businessexpense acquisitions,and a $0.5$0.9 million increase in facilities and allocated overhead costs, partially offset by a $0.3decrease of $0.6 million increase in consultinggeneral sales and servicesmarketing feesexpenses, including travel, marketing events and athird-party $0.2hosting million increase in salaries, benefits and stock-based compensation expense primarily due to increased headcount to support the overall growth of our business.costs.

Financial Income,Income (Expense), Net

The decrease in financial income,income (expense), net was primarily due to lower interest income, foreign currency loss, remeasurement of options to repurchase common stockloss and amortization of premiums on marketable securities, partially offset by less interest and issuance cost amortization expense related to the maturity of the 2025 convertible note.

Benefit (Provision) for Income Taxes

Benefit (provision)Provision for income taxes for the three months ended MarchJune 31,30, 2026, including the change in income taxes, were comprised of foreign and U.S. income taxes. Additionally, we recognized $9,134$0.5 million of a deferred tax liability which relates to measurement period adjustments of the fair value of intangibles, other than goodwill and the fair value adjustments for the tangible assets acquired over their historical cost basis for the AllTrue.ai acquisition. We will file a consolidated tax return in the U.S. to utilize the benefit of our loss carryforwards against future taxable profit and consequently decreased our valuation allowance in an amount equal to the deferred tax liability recognized in the business combination.

As of MarchJune 31,30, 2026, our cash and cash equivalents, short-term marketable securities and short-term deposits of $785.9$698.3 million were held for working capital purposes. We believe that our existing cash and cash equivalents, short-term marketable securities, short-term deposits and cash flow from operations will be sufficient to fund our operations and capital expenditures for at least the next 12 months. Additionally, as of MarchJune 31,30, 2026, we held $113.6$213.3 million in long-term marketable securities. Our future capital requirements will depend on many factors, including our rate of revenue growth, timing of renewals and renewal rates, the amount and timing of conversions, the expansion of our sales and marketing activities, the timing and extent of spending to support product development efforts and expansion into new geographic locations, the timing of introductions of new software products and enhancements to existing software products, the continuing market acceptance of our software offerings and our use of cash to pay for acquisitions or share repurchases, if any.

Our operating activities are driven by sales of our products less costs and expenses, primarily payroll and related expenses, and adjusted for certain non-cash and non-operating cash flow items, mainly depreciation and amortization, stock-based compensation, amortization of deferred commissions, non-cash operating lease costs, amortization of debt issuance costs, amortization of premium and accretion of discount on marketable securities, deferred income taxes, net and remeasurement of options to repurchase common stock, and changes in operating assets and liabilities. Changes in operating assets and liabilities are driven mainly by collection of accounts receivable from the sales of our software products and deferred revenue,revenues, which primarily consists of billed fees for our subscriptions, prior to satisfying the criteria for revenue recognition, which are subsequently recognized as revenue in accordance with our revenue recognition policy.

For the threesix months ended MarchJune 31,30, 2026, net cash provided by operating activities was $55.0$80.1 million. We have historically observed two seasonal patterns that impact our net cash provided by operating activities, which we continue to expect under a SaaS delivery model. First, a majority of our sales are made during the last three weeks of the quarter. Second, the highest dollar amount of sales of our products and services occurs in the fourth quarter. Consequently, we end the fourth quarter with our highest accounts receivable balance of any quarter which in turn generates the greatest amount of collections in the following quarter. In addition, there is negative sequential sales in the first quarter, which results in a relatively lower amount collected during the second quarter. These seasonal trends also impact our operating loss because the majority of our expenses are relatively fixed in the short-term. For the threesix months ended MarchJune 31,30, 2026, cash inflows were $14.0$27.2 million from our net loss excluding non-cash and non-operating cash flow charges. Additional sources of cash inflows were from changes in our working capital, including a $86.2$91.9 million decrease in accounts receivable. Our days sales outstanding (“DSO”) for the three and six months ended MarchJune 31,30, 2026 was 83.78 and 80, respectively. Other sources of cash inflows was from a $5.0$13.6 million increase in accrued expenses and other short-term liabilities, a $6.6 million increase in trade payables and a $0.2$1.7 million increase in other long-term liabilities. This was partially offset by a $22.3$45.4 million increase in prepaid expenses and other short-term assets (including deferred commissions), a $14.1 million decrease in accrued expenses and other short-term liabilities, a $11.3$8.8 million increase in other long-term assets and a $2.8$6.7 million decrease in deferred revenues.

For the threesix months ended MarchJune 31,30, 2025, net cash provided by our operating activities was $68.0$89.3 million. For the threesix months ended MarchJune 31,30, 2025, cash inflows were $13.7$31.8 million from our net loss excluding non-cash charges. Additional sources of cash inflows were from changes in our working capital, including a $65.1$39.0 million decrease in accounts receivable. Our DSO for the three and six months ended MarchJune 31,30, 2025 waswere 79.76 and 78, respectively. Other sources of cash inflows were from a $6.0$34.1 million increase in deferred revenues, a $2.0$16.0 million increase in accrued expenses and other short-term liabilities, a $2.8 million increase in trade payables and a $0.5$1.0 million increase in other long-term liabilities. This was partially offset by a $16.7 million decrease in accrued expenses and other short-term liabilities and a $2.5$34.2 million increase in prepaid expenses and other short-term assets (including deferred commissions). and a $1.1 million increase in other long-term assets.

Our investing activities consist primarily of acquisitions, capital expenditures to purchase property and equipment, including leasehold improvements, capitalized internal-use software, purchasesoftware and the purchase, sale and maturity of deposits and marketable securities. In the future, we expect to continue to incur capital expenditures to support our expanding operations.

For the threesix months ended MarchJune 31,30, 2026, net cash provided by investing activities of $63.3$99.5 million was attributable to net proceeds of $184.1$224.6 million in marketable securities, partially offset by $113.6 million of cash paid for acquisitions, net of cash acquired and escrow refunds, $5.0$9.4 million in capital expenditures to support our growth including hardware, software, office equipment and leasehold improvements mainly in connection with existing office space, net investments of $1.1 million in deposits and $1.0$1.7 million for capitalized internal-use software expenditures.expenditures and net investments of $0.4 million in deposits.

For the threesix months ended MarchJune 31,30, 2025, net cash usedprovided inby investing activities of $25.0$44.9 million was primarily attributable to net proceeds of $68.3 million in marketable securities and net proceeds of $3.4 million in deposits. This was partially offset by $18.6 million of cash paid for an acquisition, net of cash acquired, $2.3$5.7 million in capital expenditures to support our growth including hardware, software, office equipment and leasehold improvements mainly in connection with existing office space, net investments of $2.1 million in deposits, net investments of $1.7 million in marketable securities and $0.3$1.0 million for capitalized internal-use software expenditures.expenditures and $1.5 million for other investing activities

For the threesix months ended MarchJune 31,30, 2026, net cash used in financing activities of $141.5$148.5 million was attributable to $135.0 million in repurchases of common stockstock, and $17.4$20.8 million in taxes paid related to net share settlement of equity awards,awards and $3.5 million for a deferred acquisition payment, partially offset by $8.0 million of proceeds from employee stock plans and $2.9 million in proceeds from options to repurchase common stock.

For the threesix months ended MarchJune 31,30, 2025, net cash used in financing activities of $75.5$120.6 million was attributable to $61.3$100.0 million in repurchases of common stock, $21.4$27.8 million in taxes paid related to net share settlement of equity awardsawards, partially offset by $7.2 million of proceeds from employee stock plans.

In October 2025, our board of directors authorized a share repurchase program of up to $150.0 million of the Company’s common stock (the “October 2025 Share Repurchase Program”). Under the October 2025 Share Repurchase Program, we were authorized to repurchase shares through open market purchases, privately-negotiated transactions or otherwise in accordance with applicable federal securities laws, including through Rule 10b5-1 trading plans and under Rule 10b-18 of the Exchange Act. As of March 31, 2026, we completed ourThe October 2025 Share Repurchase Program.Program was completed in March 2026.

Our principal commitments primarily consist of obligations under leases for office space and motor vehicles. Aggregate minimum rental commitments under non-cancelable leases as of MarchJune 31,30, 2026 for the upcoming years were as follows:

We have obligations related to unrecognized tax benefit liabilities totaling $55.4$63.9 million and others related to severance pay, which have been excluded from the table above as we do not believe it is practicable to make reliable estimates of the periods in which payments for these obligations will be made. We also have contractual minimum purchase commitments with service providers through August 31, 2027, October 31, 2028 and May 31, 2031.2031, Thesewhich commitments total $1.9 million,includes $2.5 million andrelated $11.5to millionthe October 31, 2028 commitment due within the next 12 months, respectivelymonths and $10.5 million, $3.2$2.6 million and $377.6 million (with no specified annual commitments), respectively, due thereafter. We expect to fund these obligations with cash flows from operations and cash on our condensed consolidated balance sheet.sheets.

As of MarchJune 31,30, 2026, we did not have any off-balance sheet arrangements.