In 2003, a large oil and gas company discovered that a trove of high-resolution images of the ocean floor had vanished. The files had cost millions to create. The obvious questions arrived quickly: Were they deleted by mistake? Had someone stolen them? The useful answers did not arrive at all. The systems could not produce a clean record of who had touched what, much less narrow the suspects. Two security and systems specialists working on the problem, Yaki Faitelson and Ohad Korkus, found a blank space in enterprise computing. Companies were creating data faster than they could understand its ownership, access or history.
That failure came first. Varonis followed in 2005. Faitelson and Korkus built a metadata framework around an unfashionable but durable set of questions: Where is the sensitive information? Who can reach it? Who actually uses it? What changed? If an employee suddenly opens a thousand files at 2 a.m., is that normal? The company did not begin by promising to stop every attacker at the gate. It began by making the contents of the building legible.
The access graph is the product
Today the Varonis Data Security Platform continuously scans files, folders, databases and SaaS objects; classifies sensitive material; maps permissions and sharing links; and records data activity. It builds behavior baselines for people, machines and agents, then looks for deviations. The platform can remove unnecessary access, fix risky configurations, apply labels, enforce data-loss policies and trigger responses when behavior looks wrong.
The distinction matters because data security posture management, or DSPM, can otherwise become a discovery exercise with excellent charts and a dreadful Monday morning. Finding 40,000 exposures is not the same as fixing them. Varonis's competitive argument is that sensitivity, permissions and activity belong in the same graph - and that the system should be able to act on the answer. Cyera, BigID, Sentra and Securiti approach parts of the same market. Microsoft Purview can be compelling for companies already deep in Microsoft licensing. Wiz and cloud-native tools arrive from the infrastructure side. Varonis leans on hybrid coverage, long experience with access rights, and automated remediation.
Buyers are security operations teams, infrastructure groups, privacy officers and compliance leaders in data-heavy enterprises. Varonis names the U.S. Army, Nasdaq, E*TRADE, Aflac, Cintas and Tampa General Hospital among organizations that trust the platform. Webster Bank has described using it across more than one million data resources while adopting Snowflake and Microsoft Copilot. The recurring problem is not a lack of security products. It is that data now sits in Microsoft 365, Salesforce, Slack, GitHub, Databricks, cloud buckets, databases and old file shares, all governed by different permission models.
“Other products protect the infrastructure, but they do nothing to protect your most precious commodity - your data.”Deborah Haworth, Director of Information Security, Penguin Random House
The migration that changed the company
For most of its life, Varonis sold self-hosted software in separately licensed modules. That architecture matched the file-server world in which it grew up, but it made deployment and updates heavier. Meanwhile, the data escaped the data center. The company concluded that it could not deliver rapid deployment, continuous detection improvements, persistent automation or a 24-hour managed response service while treating the cloud as an accessory.
So management changed the model. The SaaS platform bundles five widely used capabilities into a core license and sells protection packages for Microsoft 365, Windows and NAS, hybrid environments, and cloud services. Add-ons cover areas such as Exchange, Copilot and ChatGPT Enterprise. Managed Data Detection and Response, or MDDR, adds round-the-clock monitoring by Varonis specialists. Substantially all sales still run through distributors and resellers, but the economic engine is now recurring cloud subscription revenue.
The numbers say the bet moved quickly. SaaS revenue rose from $44.4 million in 2023 to $462.6 million in 2025. SaaS ARR reached $638.5 million, or 86 percent of total ARR, by year-end 2025. Varonis said it completed the planned transition more than two years ahead of schedule. Total 2025 revenue grew 13 percent to $623.5 million.
It was not cheap. Varonis spent $237.8 million on research and development and $301.3 million on sales and marketing in 2025. Total operating expenses reached $638.1 million, and the company recorded a $129.3 million net loss. A further $123.5 million of cash, net of cash acquired, went to acquisitions. The company bought database-monitoring specialist Cyral in a transaction priced at $25.5 million in cash and AI-native email security company SlashNext for $106 million in cash. The strategic picture is a breach path: catch the phishing lure, monitor the compromised identity, see which data it reaches, and stop the exit.
The difficult clause sits at the end of the plan: Varonis will end its self-hosted products after December 31, 2026. For management, the cutoff concentrates engineering and lets every customer receive the same new capabilities. For a customer with air-gapped workloads, strict residency constraints or a recent investment in on-premises hardware, the logic can feel less elegant. A successful platform transition for the vendor can still be a forced migration for the buyer.
AI made old permissions dangerous
Generative AI did not replace the founding thesis. It multiplied its importance. Copilots inherit the access of the person using them. Agents can read, write and act across tools without clicking through familiar screens. A stale group membership that once exposed a forgotten folder to an employee can now expose the same folder to a machine that retrieves, summarizes and moves information at speed.
Varonis Atlas, launched in 2026, extends the platform into AI inventory, posture management, security testing, runtime protection, detection and compliance. Its Claude integration illustrates the new boundary. Using Anthropic's Inference hooks, Atlas can inspect a prompt and attachment, apply policy with the context of data sensitivity and access, and return an allow-or-deny decision before the prompt reaches the model. It also records prompts, responses and tool execution for investigation. The product covers Claude Enterprise, Claude Platform, Claude Code and Claude Cowork, as well as broader AI environments.
A strategic Microsoft collaboration serves the same thesis from another direction. Varonis and Microsoft are deepening ties between the platform and Purview so classification, permissions enforcement and policy can extend beyond Microsoft 365 and Azure into services such as Salesforce, Databricks and ServiceNow. It is both partnership and competitive hedge: Microsoft owns the productivity layer, while Varonis wants to remain the data-security layer that crosses vendors.
“AI completely disrupts the enterprise security model. Instead of humans clicking through UIs, agents are accessing data directly.”Yaki Faitelson, co-founder and CEO
The bill, the copyable lesson, the catch
What does it cost? There is no honest universal figure. Varonis uses quote-based enterprise pricing shaped by users, protected environments, coverage packages, contract length and channel negotiation. Marketplace listings direct buyers to custom orders. For scale rather than a promise, a Forrester composite study modeled $805,000 in Varonis license costs over three years and a $2,075 collector price per user. That is a constructed example, not a menu. The sensible buying motion is to run the free data risk assessment, define the exposures worth fixing, and price the narrowest useful coverage before expanding.
The lesson worth copying has little to do with cybersecurity vocabulary. Varonis picked one durable object - enterprise data - and followed it across technical eras. File servers became SaaS apps, databases, copilots and agents. The interfaces changed; the questions did not. Who owns the information? Who can reach it? What are they doing? Can the dangerous path be removed automatically? A product grows coherently when expansion makes the original question more useful.
The second lesson is more operational: a finding is not an outcome. Teams evaluating DSPM should test whether automated changes are precise enough to run continuously, whether the access graph explains how permission was inherited, whether alert volume is tolerable, and whether rollback and exceptions fit actual business work. A dazzling inventory that nobody trusts enough to remediate becomes another compliance artifact.
Where the playbook breaks
- An organization requires indefinite self-hosted or air-gapped operation beyond Varonis's 2026 cutoff.
- The estate is narrow enough that a bundled control, especially Microsoft Purview, covers the useful requirement at lower complexity.
- No team owns remediation, or the business cannot tolerate automated permission changes without lengthy manual review.
- The buyer needs a lightweight discovery scan, not an ongoing platform and managed response relationship.
- Data sources, residency rules or specialized systems fall outside supported connectors and deployment patterns.
Varonis is now a 2,658-person public company headquartered in Miami, with much of its research and development in Israel and customers around the world. Its 2025 revenue is substantial; its losses are, too. Its product surface has widened from file permissions to databases, email and AI. Yet the company is most legible when stripped back to the first missing file. The perimeter did not know what happened. The data's history did. Varonis has spent 21 years trying to make that history visible soon enough to matter.