Setup

Varonis (VRNS) is a data security software company completing a multi-year perpetual-to-SaaS transition. Self-hosted EOL is contractually fixed at December 31, 2026. The Q1 2026 10-Q (filed April 29) is the first quarterly disclosure where the cleaner organic growth metric — SaaS ARR ex-conversion — is visible since management changed the sales comp plan to remove conversion credit and force new-customer hunting.

What the filing says

SaaS ARR $683.2M, +69% YoY. Stripping conversions: $522.6M, +29% YoY organic. The ex-conversion metric strips the one-time conversion contribution and isolates new logo plus expansion. The $117M of organic SaaS ARR added in Q1 sits inside management's $110-120M quarterly cadence referenced on the Q4 2025 call.

Other Q1 disclosures of substance:

• 93% of revenue is SaaS (up from 64.9% Q1 2025); EOL Dec 31, 2026 reaffirmed; SaaS renewal rate >90%
• Operating leverage: opex/revenue improved 910bps YoY; OCF $55M Q1, tracking the $100-105M FY guide
• $150M buyback fully exhausted in Q1 — 5.35M shares (4.6% of float) at avg $24.76; February heaviest at $24.72
• CFO Melamed cancelled his 10b5-1 plan February 11 with zero shares sold
• Daks v. Faitelson derivative action filed April 23 — same allegations as the Molchanov class action

What the market thinks

EV ≈$2.85B / SaaS ARR $683M = 4.2x. Comp set on EV/ARR with growth context:

VRNS sits below the cohort on multiple while growing in line with the higher-multiple platform leaders.

Back-solving market-implied probabilities from the 4.2x discount: ≈30% clean re-rate, ≈50% macro-dampened drift, ≈20% thesis breaks → market 12mo expected return ≈14%. Our scenario distribution puts the re-rate state at 55%, dampened at 30%, breaks at 15% → blended E[r] +27%. The 25-point probability gap on the dominant state is the alpha.

Why the gap exists

The Q1 print did three things the market hasn't fully synthesized:

1. Cohort divergence reveals idio. In the same V-Score WATCH sub-cohort, VRNS prints +29% while TENB and QLYS guide +7-8% organic — a 21-point gap with no equivalent transition catalyst on the other side. The market priced data security as one cohort.

2. Convergent insider positioning at trough. $150M buyback exhausted in February at $24.72; CFO 10b5-1 cancelled with zero sales. Board and CFO acted on the same view of mispricing while the tape was -36.7% YoY.

3. Hard catalyst with template precedent. Dec 31, 2026 EOL is contractual, not aspirational. PTC (≈2020), PEGA (≈2022), and MANH (≈2024) each re-rated 100-160% within 12-18 months of analogous transition completion.

Risks (ranked)

1. Software sector multiple compresses further. Idio variance 65.1% — 35% of return path is factor-explained. IGV down -25% breaks the multiple recompute even on clean execution.
2. Q2 organic growth decelerates below 22%. Comp plan change could compress expansion if reps abandon installed base.
3. Cohort divergence collapses. TENB or QLYS reaccelerates; the +29% signal becomes sectoral and the multiple discount stays.
4. Securities class action gets certified. Class certification quantifies damages.
5. AllTrue.ai becomes operational distraction rather than platform extension. Risk factors already note expanded competitive surface into AI security and governance.

Catalysts and decision points

What would change our mind

• Q2 ex-conversion organic <20% → growth engine wasn't intact; transition was masking deceleration
• TENB or QLYS guide >15% organic in Q2 prints → cohort divergence collapses, signal becomes sectoral
• Class certification with quantifiable damages → multi-quarter overhang
• AllTrue.ai disclosed as material drag → defensive bolt-on became integration distraction
• IGV down -25% from current → no idio thesis can fight a sector that broken
• New 10b5-1 with material sales by CFO/CEO → insider conviction signal reverses

The setup has structural friction either way. The trough trade has been captured: Feb $24.72 to current is +16%, and the stock prints RSI 75 (overbought). The remaining return sits in the 12-24mo re-rate window post-EOL — and in whether the cohort discriminator survives the next two quarterly prints.

Evidence