The 20-year incumbent reinventing itself as a SaaS-native AI data security platform — and proving that longevity and innovation aren't mutually exclusive.
www.varonis.com ↗Varonis was founded in 2005 by Yaki Faitelson and Ohad Korkus to address the visibility gap in unstructured data security — specifically, who accessed sensitive files and whether those access rights were appropriate. Headquartered in New York with R&D in Israel, Varonis pioneered Data Security Intelligence and went public on NASDAQ (VRNS) in February 2014. For two decades it has been the reference standard for file-system-level data protection in enterprise environments, accumulating thousands of enterprise customers across financial services, healthcare, manufacturing, and government.
Since 2023, Varonis has executed a strategic transformation from a term-license model to a SaaS subscription platform. By Q4 2025, SaaS ARR reached $638.5M (86% of total ARR), up 88% year-over-year, while total ARR hit $745.4M and full-year 2025 revenue was $623.5M, up 13% year-over-year. In September 2025 Varonis acquired SlashNext, an AI-native email security vendor, for up to $150M. In February 2026 it acquired AllTrue.ai, an AI trust and security management startup, for approximately $125-150M — signaling a strategic push into AI agent governance alongside its core data security platform.
Varonis's technical edge remains its depth: unlike agentless DSPM tools that provide point-in-time snapshots, Varonis performs continuous, event-driven scanning at petabyte scale, maintains indefinite audit trails of every data access, and applies behavioral analytics (UEBA) to detect insider threats and active attacks in real time. Its Managed Data Detection and Response (MDDR) service, launched in 2024, provides 24/7 expert coverage with a 30-minute ransomware response SLA — the first managed service dedicated to data-layer threat response.
Varonis is the only company in this cohort that has been doing data security for 20 years and has the revenue scale ($623M) to prove product-market fit across economic cycles. Its SaaS transition is nearly complete — a transformation that is operationally painful (term license revenue collapses before SaaS ARR catches up) but strategically necessary. The SlashNext and AllTrue.ai acquisitions signal that Varonis intends to own the full threat detection-to-response stack from email to data layer to AI agent — a differentiated positioning that neither pure-play DSPM startups nor governance platforms can match. For CISOs who want a single vendor to handle endpoint, identity, data, email, and AI risk, Varonis is increasingly the answer. Its $2.8B market cap, while depressed relative to peak, remains the largest publicly traded pure-play data security company globally.
Varonis holds a structural moat in enterprise organizations with complex on-premises and hybrid environments where its deep permission analytics and behavioral monitoring are unmatched. Its SaaS transition positions it to compete in cloud-native environments where it historically struggled against agentless competitors like Cyera. The AllTrue.ai and SlashNext acquisitions extend the platform into AI governance and email security, addressing gaps that had allowed point-solution competitors to displace Varonis in specific use cases. The key risk is execution: the SaaS transition depresses near-term earnings, the stock is down significantly from 2021 highs, and Cyera's $9B private valuation (despite much lower revenue) suggests investors favor the next-generation story. Varonis must demonstrate it can grow SaaS ARR organically at 30%+ while integrating two acquisitions and reaching profitability by 2027.
206 companies across 10 categories — the most comprehensive AI security company tracker.
Browse All Companies →