VRNS Cybersecurity · SaaS · Data security · AI security · Thesis updated July 1, 2026

AI security helps SaaS transition, price still matters

SaaS ARR reached $683.2 million at March 31, 2026, up 69% from the prior year period.
Management now expects 2026 total SaaS ARR growth of 27% to 32%.
The key growth test is SaaS ARR excluding conversions, which grew 29% year over year in Q1.
About $83.7 million of non-SaaS ARR still needs to convert or churn before the December 31, 2026 end-of-life date.
Legal risk rose after an April 2026 shareholder derivative action was added to the existing securities class action overhang.

01 Running thesis

SaaS risk is fading, not gone

Varonis has moved from a self-hosted software story to a cloud subscription story. That matters because recurring SaaS sales are easier to track and can grow faster when customers expand. At March 31, 2026, SaaS ARR was $683.2 million, and SaaS ARR excluding conversions grew 29% year over year.

The bull case is that the hard part of the transition is mostly over. Sales teams can focus on new customers instead of moving old customers to the cloud. Enterprise AI also gives Varonis a clear reason to exist: companies need to know which data AI tools and agents can see before they let those tools loose.

The bear case is that the last stretch can still hurt. Varonis ended Q1 with about $83.7 million of non-SaaS ARR left. Some of those customers may leave instead of converting before the December 31, 2026 end-of-life date. The lawsuits also add cost and distraction at a time when investors need clean proof that new SaaS demand is durable.

This is why the stock is not a simple victory lap. The operating story is better than it was after the Q3 2025 renewal scare, but valuation remains a real question. Varonis needs to show that 20% to 21% SaaS ARR growth excluding conversions can last beyond the migration tailwind.

Apr 2026▼The Q1 2026 10-Q confirmed SaaS ARR of $683.2 million, but added a shareholder derivative action filed in April 2026. The legal overhang is larger, even though the operating thesis stayed intact.

Apr 2026▲Q1 results de-risked the SaaS transition. Management raised 2026 total SaaS ARR growth guidance to 27% to 32% and said new customer contribution accelerated.

Feb 2026▲The 2025 10-K showed SaaS had reached about 86% of total ARR at year-end. It also added a new securities class action risk tied to SaaS transition disclosures.

Oct 2025→Varonis formally set December 31, 2026 as the end-of-life date for its term license subscription business. That made the end state cleaner but raised uncertainty for the remaining legacy customers.

Oct 2025▼Q3 2025 brought a revenue shortfall and lower full-year guidance after unexpected weakness in on-premise renewals, especially in federal. The SaaS mix improved, but execution risk rose.

Jul 2025→The Q2 2025 10-Q confirmed ARR of $693.2 million and SaaS at about 69% of ARR. No new material risk changed the view.

Jul 2025▲Q2 2025 showed the SaaS transition moving faster, with SaaS at about 69% of total ARR. FedRAMP Authorization opened a clearer path into the U.S. federal market.

May 2025▲Q1 2025 showed ARR growth of 19% year over year and SaaS at about 61% of total ARR. The early transition evidence strengthened the bull case.

02 Business model

Subscription data security

Varonis makes money mainly by selling subscriptions to its Data Security Platform. The platform helps large companies find sensitive data, see who can access it, alert on risky behavior, and fix overexposed files. Customers usually buy through distributors and resellers, not directly from Varonis alone.

The business is now mostly SaaS. As of December 31, 2025, SaaS was about 86% of total ARR. In Q1 2026, SaaS revenue was $161.1 million out of $173.1 million of total revenue, while term license subscriptions and maintenance were much smaller pieces.

The model works best when customers keep renewing and then add more data stores, cloud apps, databases, email protection, MDDR, and AI security use cases. Varonis said its renewal rate for 2025 stayed over 90%, which points to a sticky customer base.

Where it breaks is conversion friction. The company has set December 31, 2026 as the end-of-life date for the term license subscription business. That makes the future cleaner if customers move, but it also creates a deadline that could push some legacy customers to leave.

03 Product portfolio

What Varonis sells

Cash cow

Varonis Data Security Platform

This is the core platform. It finds sensitive data, checks who can reach it, alerts on risky activity, and can help lock down access.

Growth engine

Managed Data Detection and Response

MDDR is a 24/7 managed service for SaaS customers. It mixes Varonis software with human threat hunters who look for attacks and data misuse.

Option

AI security and Atlas capabilities

Varonis is positioning Atlas as a control layer for AI agents, models, and data pipelines. The open question is how much ARR this adds.

Option

Database Activity Monitoring from Cyral

Cyral expanded Varonis into database security. This helps the platform cover more places where sensitive company data lives.

Option

SlashNext email security

SlashNext adds AI-native email protection against phishing and social engineering. That broadens Varonis beyond files and databases into a major attack path.

Growth engine

Federal SaaS platform

FedRAMP Authorization lets Varonis offer its full SaaS platform to U.S. federal customers. That could help repair the federal renewal softness seen in 2025, but execution still has to show up.

04 Business segments

SaaS now dominates revenue

SaaS93%growing fast

Term license subscriptions4%declining

Maintenance and services3%declining

Mix is based on revenue by type for the three months ended March 31, 2026. Varonis also says the United States remains its main revenue source, but the clearest current mix is the SaaS, term license, and maintenance split.

05 Risk factors

What could break the story

Legacy customer churn

High impact · Medium odds

Varonis still had about $83.7 million of non-SaaS ARR left at the end of Q1 2026. The company plans to end the term license subscription business on December 31, 2026. If too many legacy customers refuse to move to SaaS, ARR growth could slow and revenue could become choppy again.

We watchNon-SaaS ARR remaining, conversion ARR, and renewal commentary each quarter.

New SaaS growth fades

High impact · Medium odds

The bull case depends on new SaaS demand, not only moving old customers to the cloud. Management guided to 20% to 21% SaaS ARR growth excluding conversions for 2026. If that rate drops after the conversion wave fades, investors may question the true growth rate.

We watchSaaS ARR excluding conversions and new customer contribution.

Legal overhang grows

Medium impact · Medium odds

A securities class action was filed in January 2026. A related shareholder derivative action was filed in April 2026. These cases may not change the product, but they can raise legal costs, distract leaders, and weigh on trust.

We watchCourt updates, settlement talks, insurance recoveries, and legal expense comments.

AI security hype outruns ARR

Medium impact · Medium odds

AI is a real demand driver because companies need to secure data before using AI tools. Still, Varonis has not yet given a clear ARR number for Atlas or the broader AI security push. If customers test but do not buy, the market may lower its growth expectations.

We watchNamed AI wins, Atlas ARR contribution, and management comments on attach rates.

Israel operating exposure

Medium impact · Low odds

Varonis has significant research and development operations in Israel. Geopolitical instability could disrupt workers, product delivery, or costs. This risk is hard to time but important because product pace matters in cybersecurity.

We watchCompany risk disclosures on Israel operations and any change in R&D productivity.

06 Quick answers

In one breath

What does Varonis do?

Varonis helps companies protect sensitive data. Its software finds data, checks access, watches user and AI activity, and helps fix risky permissions.

Why does the SaaS transition matter for VRNS?

SaaS means customers use Varonis through cloud subscriptions instead of self-hosted licenses. That can make revenue more recurring, but the remaining legacy customers must convert or churn before the December 31, 2026 deadline.

How is AI helping Varonis?

AI tools need access to company data, which creates a security problem. Varonis sells tools that help companies see what data AI can touch and reduce the chance that sensitive data leaks.

What is the biggest number to watch next?

Watch SaaS ARR excluding conversions. It grew 29% year over year in Q1 2026, and management guided to 20% to 21% growth for the full year.