VARONIS SYSTEMS INC (VRNS)

Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our condensed consolidated financial statements and related notes appearing elsewhere in this Quarterly Report on Form 10-Q and our Annual Report on Form 10-K for our fiscal year ended December 31, 2025.

Special Note Regarding Forward-Looking Statements

This report contains forward-looking statements that involve risks and uncertainties. Our actual results could differ materially from those discussed in the forward-looking statements. The statements contained in this report that are not purely historical are forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended (the “Securities Act”), and Section 21E of the Securities Exchange Act of 1934, as amended (the “Exchange Act”). Forward-looking statements are often identified by the use of words such as, but not limited to, “anticipate,” “believe,” “can,” “continue,” “could,” “estimate,” “expect,” “intend,” “may,” “plan,” “project,” “seek,” “should,” “strategy,” “target,” “will,” “would” and similar expressions or variations intended to identify forward-looking statements. These statements are based on the beliefs and assumptions of our management based on information currently available to management. Such forward-looking statements are subject to risks, uncertainties and other important factors that could cause actual results and the timing of certain events to differ materially from future results expressed or implied by such forward-looking statements. Factors that could cause or contribute to such differences include, but are not limited to, those identified below and those discussed in the section titled “Risk Factors” included under Part II, Item 1A below. Furthermore, such forward-looking statements speak only as of the date of this report. Except as required by law, we undertake no obligation to update any forward-looking statements to reflect events or circumstances after the date of such statements.

Overview

Varonis is a data and AI security company. We protect what matters most to organizations: their data – and how it is accessed, used, and exposed, including by AI systems and agents. Modern enterprises run on data that is created, copied, shared, analyzed, and acted upon across cloud services, SaaS applications, AI-enabled platforms, and on-premises environments – often faster and on a larger scale than security teams can track. Varonis was founded on a simple but durable observation: the capacity to create and share data scales faster than the ability to secure it. That gap has never been wider than it is today.

AI has changed the attack surface in ways most security vendors weren’t built to address. AI agents access sensitive data autonomously, make decisions without human review, and introduce a new class of unpredictable, non-deterministic risk that traditional perimeter and identity-based controls weren’t designed to catch. At the same time, enterprises are under pressure to adopt AI quickly – and the data that powers those systems is frequently over-exposed, under-classified, and inadequately governed. Varonis sits at that intersection: we protect data, secure AI systems, and stop AI threats – including those that traditional security tools were never built to see.

Our transition to a SaaS delivery model was strategic and deliberate. SaaS enables the automation at scale that modern data security demands: continuous classification, real-time risk reduction, faster threat detection, and the ability to deploy and update capabilities across a customers’ environment without friction. Our Managed Data Detection and Response (MDDR) offering extends this further, using agentic AI to deliver 24x7x365 monitoring with a guaranteed response SLA.

We have continued to expand our platform through acquisitions that directly extend our ability to protect data and secure AI systems. The acquisition of Cyral brought database activity monitoring (DAM) into our platform. The acquisition of SlashNext added email and collaboration security, enabling detection and prevention of AI-generated phishing and other threats delivered through the collaboration layer. The acquisition of AllTrue.ai, Inc. ("AllTrue.ai") extended our platform into AI system security giving customers real-time visibility and control over AI agents, models, and the data they access across the enterprise.

We have announced the end-of-life for our self-hosted business effective December 31, 2026. We expect this transition to result in increased variability with our remaining self-hosted customers throughout the end-of-life period and as we seek to convert these remaining customers to SaaS, but we believe it positions us for a more durable, recurring revenue model and accelerates our ability to deliver the automation and intelligence that define our platform’s value.

27

Our go-to-market model is channel-led and enterprise-focused. We sell through channel partners, including distributors and resellers, which sell to end-user customers, which we refer to in this report as our customers. We believe that our sales model, which combines the leverage of a channel sales model with our highly trained and professional sales force, has and will continue to play a major role in our ability to grow and to successfully deliver our unique value proposition for enterprise data. While our products serve customers of all sizes, across industries and across geographies, the marketing focus and majority of our sales focus is on targeting larger organizations who can make sizable initial purchases with us and, over time, have a greater potential lifetime value. Our customers span leading organizations across financial services, public, healthcare, industrial, insurance, energy and utilities, technology, construction and engineering, education and consumer and retail sectors. Our sales motion leads with a rapid risk assessment that surfaces immediate, high-priority exposure – typically within days of deployment – creating a clear and urgent case for expansion. Our SaaS renewal rate is over 90% for the six months ended June 30, 2026.

We believe there is a significant long-term growth opportunity in both domestic and international markets. Any organization that stores data in SaaS applications, IaaS environments, databases, file shares, email systems, or AI platforms is a potential customer. As enterprises accelerate AI adoption, the need to govern, secure, and monitor the data those systems touch will only grow. We believe Varonis is uniquely positioned to meet that demand – not as a company adapting to the AI era, but as one built for it. For the three and six months ended June 30, 2026, approximately 72% of our revenues were derived from the United States, while approximately 20% of our revenues were derived from EMEA and approximately 8% from ROW. Additionally, despite the revenue recognition variations from the accounting treatment associated with existing customer conversions to SaaS, total revenues still grew approximately 22% for the six months ended June 30, 2026, compared with the six months ended June 30, 2025. We continue to expect expansion in both domestic and international markets to be key components of our long-term growth strategy. Over the last few years, we have seen changes in customer buying patterns including some budgetary tightening and additional scrutiny on enterprise spending as a result of a higher inflation and interest rate environment.

We continue to expand our domestic and international operations as part of our long-term growth strategy. While the expansion of our domestic operations is focused primarily on our underpenetrated territories, the expansion of our international operations depends in particular on our ability to hire, integrate and retain local sales leadership and personnel in these international markets, acquire new channel partners and implement an effective marketing strategy. Given the nominal amount of our ROW revenues, our ROW revenue growth rates have fluctuated in the past and may fluctuate in the future based on the timing of deal closures. In addition, the further expansion of our international operations will increase our sales and marketing and general and administrative expenses and will subject us to a variety of risks and challenges, including those related to economic and political conditions in each region, compliance with foreign laws and regulations, and compliance with domestic laws and regulations applicable to our international operations.

Since inception, we have continued to scale our business and execute on strategic initiatives which we believe have positioned us for durable long-term growth. During the three and six months ended June 30, 2026, we have continued to grow our revenues despite revenue recognition accounting treatment variations associated with existing customer conversions to SaaS. For the three months ended June 30, 2026 and 2025, SaaS revenues were $171.7 million and $105.9 million, respectively. For the six months ended June 30, 2026 and 2025, SaaS revenues were $332.8 million and $194.5 million, respectively. For the three months ended June 30, 2026 and 2025, our total revenues were $180.0 million and $152.2 million, respectively. For the six months ended June 30, 2026 and 2025, our total revenues were $353.1 million and $288.6 million, respectively. For the three months ended June 30, 2026 and 2025, we have operating losses of $40.6 million and $36.6 million and net losses of $46.8 million and $35.8 million, respectively. For the six months ended June 30, 2026 and 2025, we have operating losses of $85.1 million and $80.3 million and net losses of $83.7 million and $71.6 million, respectively.

Key Performance Indicators and Recent Business Highlights

SaaS Annual Recurring Revenues

SaaS annual recurring revenues ("SaaS ARR") is a key performance indicator defined as the annualized value of active SaaS contracts in effect at the end of that period. SaaS contracts are annualized by dividing the total contract value by the number of days in the term and multiplying the result by 365. As we have announced the end-of-life of our self-hosted business as of December 31, 2026, we are disclosing SaaS ARR until the end-of-life of the self-hosted business is complete, at which point, ARR and SaaS ARR will be materially consistent.

As of June 30, 2026 and 2025, SaaS ARR was $726.0 million and $478.3 million, respectively, an increase of 52% period over period. The annualized value of contracts is a legal and contractual determination made by assessing the contractual terms with our customers. The annualized value of these contracts is not determined by reference to historical revenues, deferred revenues or any other GAAP financial measure over any period. SaaS ARR is not a forecast of future revenues and can be impacted by contract start and end dates and renewal rates. We expect SaaS ARR to continue to increase in absolute dollars.

28

SaaS Renewal Rate and SaaS ARR Excluding Conversions

As we have completed our SaaS transition and announced the end-of-life of our self-hosted business by the end of 2026, the historical renewal rate disclosure has been replaced by the SaaS renewal rate which is over 90% for the six months ended June 30, 2026. In addition, throughout 2026, we will also be disclosing SaaS ARR excluding conversions which excludes SaaS ARR associated with self-hosted customers converting to SaaS over the trailing twelve months. As of June 30, 2026, SaaS ARR excluding conversions was $598.1 million, an increase of 25% compared to June 30, 2025 SaaS ARR. We expect SaaS ARR excluding conversions to increase in absolute dollars. These additional performance metrics align with our new business model and how management

[Excerpt truncated for page length; source filing is linked above.]

Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our consolidated financial statements and related notes appearing elsewhere in this Annual Report on Form 10-K. This discussion contains forward-looking statements that reflect our plans, estimates and beliefs, and involve risks and uncertainties. Our actual results and the timing of certain events could differ materially from those anticipated in these forward-looking statements as a result of several factors, including those discussed in the section titled “Risk Factors” included under Part I, Item 1A and elsewhere in this Annual Report. See “Special Note Regarding Forward-Looking Statements and Summary Risk Factors” in this Annual Report.

The Transition to a SaaS Delivery Model

In response to the evolving needs of our customers and the growing threat landscape, we strategically transitioned to a SaaS delivery model. As of December 31, 2025, SaaS as a percentage of total ARR was approximately 86%. This transition was driven by the increased importance of an automated, data-centric approach to security and the demand for comprehensive protection in the face of heightened cyber risks, collaboration across multiple platforms, the adoption of generative AI tools and the necessity for compliance. Enterprises now use many different combinations of on-premises and cloud data stores, SaaS applications and IaaS environments and this complexity requires a greater level of automated security. We believe our offering provides comprehensive data coverage and our ability to address this demand has and will continue to be a key driver of our growth.

In the second half of 2021, we launched our first SaaS offering, introducing new products and support for cloud infrastructure environments and applications. At the end of 2022, we announced the availability of our flagship Varonis Data Security Platform as a SaaS solution, which was previously only sold as a self-hosted solution. The benefits of SaaS delivery are widely established for both customers and providers, and we believe this evolution of a SaaS delivery option for the Varonis Data Security Platform is transformational. The advantages include: quicker and easier deployment and maintenance of solutions with reduced infrastructure and personnel requirements; a lower total cost of ownership; faster deployment of risk assessments, which is the core of our sales motion; enhanced threat detection; continual threat model updates; increased automation for securing data in place; and the ability to deliver additional features and functionality to customers more efficiently. In addition, our MDDR offering further reduces both the likelihood of a breach and its potential impact through agentic AI, enabling automated 24x7x365 monitoring with a service level agreement (SLA) that requires Varonis to respond to alerts within a specified time frame. Our MDDR offering is only available for our SaaS customers because of the automation and visibility that’s built into our SaaS platform. In 2025, we further expanded our data coverage through the acquisition of Cyral which allowed us to enter the Database Activity Monitoring (DAM) market and SlashNext, which, together with our MDDR offering, strengthens our ability to stop attacks via email and collaboration apps.

Since launching our SaaS offerings, we have seen SaaS deployments grow significantly and they are now the primary driver of our revenues. We expect SaaS revenues to continue to increase. However, our revenues may be negatively impacted due to revenue recognition accounting treatment variations associated with the increase in SaaS sales and whether and when existing term license subscription customers will continue to convert to SaaS. In addition, we have announced the end-of-life for our self-hosted business as of December 31, 2026. We expect this to result in increased variability with our remaining self-hosted customers going forward and for revenue fluctuations to persist as we seek to convert our remaining term-license customers to SaaS.

Overview

Varonis is a data security company focused on protecting what matters most to organizations: their data. Modern enterprises run on data that is created, copied, shared and accessed across cloud services, SaaS applications and on-premises environments, often faster than security teams can see, understand or control. We started Varonis around a simple observation that we believe has only intensified over time: the ability to create and share data scales far faster than the ability to secure it. Our strategy is built around closing that gap, giving organizations the deep visibility and automated controls to deeply understand their enterprise data, reduce exposure and respond to threats quickly, wherever their data lives.

We sell substantially all of our products and services through channel partners, including distributors and resellers, which sell to end-user customers, which we refer to in this report as our customers. We believe that our sales model, which combines the leverage of a channel sales model with our highly trained and professional sales force, has and will continue to play a major role in our ability to grow and to successfully deliver our unique value proposition for enterprise data. While our products serve customers of all sizes, across industries and across geographies, the marketing focus and majority of our sales focus is on targeting larger organizations who can make sizable initial purchases with us and, over time, have a greater potential lifetime value. Our customers span leading firms in the financial services, public, healthcare, industrial, insurance,

38

energy and utilities, technology, construction and engineering, education and consumer and retail sectors. We believe our existing customer base serves as a strong source of future incremental revenues given our broad platform of products, their growing volumes and complexity of enterprise data and related security concerns. We will continue our focus on targeting larger organizations who can make sizable purchases with us initially and over time. We are also focused on maintaining a high renewal rate by investing in the quality and reliability of our customer service and support teams to ensure our customers receive value from our products and providing software upgrades and enhancements when and if they are available. Our product offering currently contains coverage for most mission-critical cloud and on-premises data stores and cloud infrastructure environments, and many critical SaaS applications. Our renewal rate continued to be over 90% for the year ended December 31, 2025. In addition, our business has substantially transitioned to SaaS and we have announced the end-of-life for our self-hosted business as of December 31, 2026. We expect this to result in increased variability with our remaining self-hosted customers throughout the end-of-life period and as we seek to convert these remaining customers to SaaS.

We believe there is a significant long-term growth opportunity in both domestic and international markets, which could include any organization that relies on data stored in SaaS applications, IaaS environments, NAS devices, file shares, databases and email servers. For the year ended December 31, 2025, approximately 71% of our revenues were derived from the United States, while approximately 21% of our revenues were derived from EMEA and approximately 8% from ROW. Additionally, despite the revenue recognition variations from the accounting treatment associated with the positive trend of our increase in SaaS sales and existing customer conversions to SaaS, total revenues still grew approximately 13% for the year ended December 31, 2025, compared with the year ended December 31, 2024. We continue to expect expansion in both domestic and international markets to be key components of our long-term growth strategy. Over the last few years, we have seen changes in customer buying patterns including some budgetary tightening and additional scrutiny on enterprise spending as a result of a higher inflation and interest rate environment.

We continue to expand our domestic and international operations as part of our long-term growth strategy. While the expansion of our domestic operations is focused primarily on our underpenetrated territories, the expansion of our international operations depends in particular on our ability to hire, integrate and retain local sales leadership and personnel in these international markets, acquire new channel partners and implement an effective marketing strategy. Given the nominal amount of our ROW revenues, our ROW revenue growth rates have fluctuated in the past and may fluctuate in the future based on the timing of deal closures. In addition, the further expansion of our international operations will increase our sales and marketing and general and administrative expenses and will subject us to a variety of risks and challenges, including those related to economic and political conditions in each region, compliance with foreign laws and regulations, and compliance with domestic laws and regulations applicable to our international operations.

Since inception, we have continued to scale our business and execute on strategic initiatives which we believe have positioned us for durable long-term growth. During 2025, we have continued to grow our revenues despite revenue recognition accounting treatment variations associated with the increase in SaaS sales and existing customer conversions to SaaS. For the years ended December 31, 2025, 2024 and 2023, SaaS revenues were $462.6 million, $208.8 million and $44.4 million, respectively. For the years ended December 31, 2025, 2024 and 2023, our total revenues were $623.5 million, $551.0 million and $499.2 million, respectively. For the years ended December 31, 2025, 2024 and 2023, we had operating losses of $146.5 million, $117.7 million and $117.2 million and net losses of $129.3 million, $95.8 million and $100.9 million, respectively.

Key Performance Indicators and Recent Business Highlights

Annual Recurring Revenues

Annual recurring revenues is a key performance indicator defined as the annualized value of active SaaS contracts, term-based subscription license contracts and maintenance contracts in effect at the end of that period. SaaS contracts, term-based subscription license contracts and maintenance contracts are annualized by dividing the total contract value by the number of days in the term and multiplying the result by 365. As we have substantially transitioned to a SaaS delivery model and announced the end-of-life of our self-hosted business as of December 31, 2026, ARR associated with SaaS contracts ("SaaS ARR") will become a key performance indicator throughout 2026. Accordingly, we are disclosing SaaS ARR until the end-of-life of the self-hosted business is complete, at which point, ARR and SaaS ARR will be materially consistent.

As of December 31, 2025, 2024 and 2023, ARR was $745.4 million, $641.9 million and $543.0 million, respectively, an increase of 16% and 18% period over period, respectively. As of December 31, 2025, SaaS ARR is $638.5 million. The annualized value of contracts is a legal and contractual determination made by assessing the contractual terms with our customers. The annualized value of these contracts is not determined by reference to historical revenues, deferred revenues or any other GAAP financial measure over any period. ARR and SaaS ARR is not a forecast of future revenues and can be

39

impacted by contract start and end dates and renewal rates. We expect ARR and SaaS ARR to continue to increase in absolute dollars.

Transition to SaaS Delivery Model, SaaS as a Percentage of ARR and SaaS renewal rate

Over the l

[Excerpt truncated for page length; the complete text is on the linked full-MD&A page.]