Varonis: Israel's Data-Security SaaS Pivot

Nasdaq: VRNS · Founded 2005 by Yaki Faitelson and Ohad Korkus · HQ Miami; R&D Herzliya, Israel · ARR $745M · SaaS ARR $638M (86% of total) · 2,658 employees · $1.1B cash · The Israeli-founded data-security company that bet the entire business on a SaaS pivot in late 2022 — and is now positioning itself as the security layer for enterprise AI deployment.

Varonis is the Israeli-founded data-security company that built the category of data access governance — the discipline of knowing who can access what data, what they do with it, and whether any of it is at risk — and then wagered the company on a full SaaS transformation that is now reshaping its financial profile and strategic positioning for the AI era. Founded in 2005 by Yaki Faitelson and Ohad Korkus, who met the problem at NetApp and NetVision, Varonis launched its first product — DatAdvantage — in 2006 and introduced the Metadata Framework: a system that maps the relationships between users, permissions, and data content across enterprise file systems, email, and cloud environments. The company went public on Nasdaq in February 2014, grew to $745 million in ARR by late 2025, and is now executing a transition to become a fully SaaS company by the end of 2026.

The founding insight

Faitelson and Korkus met the problem before they met each other. Working at NetApp and NetVision respectively, both recognized the same gap: organizations were storing massive volumes of unstructured data — files, emails, spreadsheets, documents — across shared file systems, and nobody could tell who had access to what, who was actually accessing it, or whether any of it was at risk. The firewall protected the perimeter. Identity management controlled who logged in. But once authenticated, users often had access to far more data than they needed, and nobody was monitoring what happened next.

Varonis was founded in 2005 to close that gap. DatAdvantage, launched in 2006, was the first product — and it introduced the Metadata Framework, the company's foundational technology. The Metadata Framework maps three layers of information: who has permissions to access data, who actually accesses it, and what the data contains. By correlating these three layers, Varonis could show enterprises where their data was overexposed, who was accessing sensitive files they shouldn't have, and where insider threats were developing.

The product platform

From the Metadata Framework foundation, Varonis expanded into a full data-security platform spanning five capabilities:

Data access governance. The original category. Mapping and controlling who has access to what data, identifying overexposed sensitive data, and automating permission remediation. This is the "blast radius" reduction Faitelson references — reducing the amount of data any compromised account can reach.

Insider threat detection. Behavioral analytics on data access patterns. The system learns normal user behavior and alerts on anomalies — unusual file access, bulk downloads, privilege escalation, data exfiltration patterns. This is the layer that catches compromised accounts and malicious insiders.

Data classification. Automated identification and tagging of sensitive data — PII, financial records, intellectual property, regulated data — across file servers, cloud storage, email, and databases.

Compliance and audit. Continuous compliance verification for GDPR, HIPAA, SOX, PCI-DSS, and other regulatory frameworks. Audit trail generation and automated remediation of compliance gaps.

AI security. The newest layer. Securing data accessed by AI systems, securing AI deployments themselves, and defending against AI-powered attacks. Products include Atlas (AI-driven security analytics), Interceptor (real-time threat response), and Database Activity Monitoring. Coverage extends across AWS, Azure, GCP, Salesforce, Snowflake, and OpenAI ChatGPT Enterprise.

The SaaS pivot

The most consequential decision in Varonis's history came in late 2022, when Faitelson announced a radical transition from on-premises subscription software to a SaaS-first architecture. The move was designed to simplify deployment, enable automated remediation at cloud scale, and shift the revenue model to pure recurring SaaS — but it came at a significant short-term cost.

The SaaS transition required Varonis to simultaneously build a cloud-native platform, migrate its existing on-premises customer base, and manage the revenue headwind of converting perpetual and term-license customers to SaaS subscriptions. GAAP operating losses widened. The share price dropped. Wall Street questioned the execution risk.

By 2025, the pivot was working. SaaS ARR reached $638.5 million — 86% of total ARR — growing 88% year-over-year (32% excluding conversions from on-premises customers). Cash from operations hit $147.4 million. Free cash flow reached $131.9 million. The company ended the year with $1.1 billion in cash and securities and zero doubt about the SaaS trajectory. Faitelson set the target: Varonis will be a fully SaaS company by the end of 2026.

The AI security thesis

Faitelson has framed the AI era as structurally favorable for Varonis. The argument runs on three axes: enterprises deploying AI need to secure the data AI accesses (Varonis's core competency); enterprises need to secure the AI systems themselves (a new product surface); and enterprises need to defend against AI-powered adversaries who can automate attacks at unprecedented speed and scale.

"AI is forcing companies to prioritize data and AI security," Faitelson said in Q1 2026. "Varonis is uniquely positioned to help customers put the right guardrails in place so they can achieve automated outcomes and safely deploy AI with minimal effort."

The SaaS platform enables this — cloud-native, automated, covering the entire data surface from file servers to cloud platforms to AI deployments. The FedRAMP Authorization achieved in 2025 opens the federal market. The product roadmap targets an autonomous, "self-healing" data security platform that detects, classifies, and remediates data risk continuously without human intervention.

The financial trajectory

Q1 2026: Revenue $173.1 million (+27% YoY). SaaS revenue $161.1 million (+82% YoY). SaaS ARR excluding conversions grew 29%.

Q2 2026: Revenue $180.0 million (+18% YoY). SaaS revenue $171.7 million (+62% YoY). SaaS ARR excluding conversions grew 25%. New-logo SaaS ARR growing 20%+. Momentum from Atlas, Interceptor, and Database Activity Monitoring.

Full-year 2026 guidance: 16–22% revenue growth. $100M+ free cash flow. Fully SaaS by year-end.

2027 financial targets are in place — management has communicated a multi-year path to profitability acceleration as the SaaS transition completes and the operating leverage of the recurring model takes hold.

Varonis in the Israeli cybersecurity landscape

Varonis occupies a unique position in the Israeli cybersecurity stack. Where Check Point protects the network perimeter, CyberArk secures privileged identity, Tufin orchestrates security policy, and Allot inspects traffic, Varonis monitors what happens to data after all those controls are in place. It answers the question: once someone is inside the network, authenticated, and authorized — what data can they reach, what are they doing with it, and is any of it at risk?

At $745 million in ARR, nearly 2,700 employees, and $1.1 billion in cash, Varonis is one of the largest Israeli-founded cybersecurity companies on Nasdaq — comparable in scale to CyberArk before its Palo Alto Networks acquisition. The Herzliya R&D center is one of the most significant Israeli cybersecurity engineering operations outside the Check Point and Wiz campuses.

Watch points

• SaaS completion — whether Varonis achieves "fully SaaS" status by year-end 2026 and what the final revenue headwind from self-hosted end-of-life looks like.
• New-logo momentum — Q2 2026 showed 20%+ new-logo SaaS ARR growth. Whether this sustains as the primary organic growth driver.
• AI security TAM — whether AI deployment security becomes a material new revenue stream or remains a positioning narrative.
• Federal execution — the FedRAMP Authorization is in hand but the federal business underperformed. Whether the government segment converts in 2026–2027.
• 2027 targets — whether the profitability and cash-flow acceleration management has guided for materializes as self-hosted revenue rolls off and SaaS margins take full effect.
• Competitive positioning — how Varonis differentiates against cloud-native data-security entrants and platform consolidation from the hyperscalers.

Frequently Asked Questions

What is Varonis?
Varonis Systems (Nasdaq: VRNS) is an Israeli-founded data and AI security company that monitors who accesses data, what they do with it, and whether it is at risk. Founded 2005 by Yaki Faitelson and Ohad Korkus. Headquartered in Miami; R&D in Herzliya, Israel. ARR $745 million.

Who is Varonis's CEO?
Yaki Faitelson, co-founder, Chairman and CEO since founding in 2005. Known for a high-intensity leadership style and a focus on reducing the "blast radius" of data breaches.

What is Varonis's revenue?
$623.5 million in 2025. Q2 2026 revenue was $180 million. 2026 guidance targets 16–22% revenue growth with $100M+ in free cash flow.

What is the SaaS transition?
In late 2022, Varonis announced a pivot from on-premises subscription software to a SaaS-first architecture. By December 2025, SaaS represented 86% of total ARR ($638.5 million out of $745.4 million). The company targets full SaaS status by end of 2026.

What is the Metadata Framework?
Varonis's foundational technology, introduced in 2006. It maps three layers: who has permissions, who actually accesses data, and what the data contains — enabling data access governance, insider threat detection, and automated risk remediation.

Is Varonis an Israeli company?
Founded in Israel in 2005. Incorporated in the US. Headquartered in Miami, Florida. Principal R&D operations in Herzliya, Israel. Listed on Nasdaq since 2014.

How does AI change Varonis's business?
AI creates three security challenges: securing data accessed by AI systems, securing AI deployments, and defending against AI-powered attacks. Varonis positions its data-security platform as the layer that enables enterprises to safely deploy AI by controlling data access and exposure.

Primary Sources

• Varonis Q2 2026 earnings release (July 28, 2026)
• Varonis Q1 2026 earnings release (April 28, 2026)
• Varonis corporate site (varonis.com)
• Varonis SEC filings via EDGAR

Related Olam Coverage

See also: The Olam Nasdaq 20 · The Builders

---

The Olam Editorial Team