{
  "@context": "https://orbyd.app/schemas/dossier.v1.json",
  "ticker": "VRNS",
  "name": "Varonis Systems, Inc.",
  "url": "https://orbyd.app/dossiers/VRNS/",
  "json_url": "https://orbyd.app/dossiers/VRNS.json",
  "status": "DORMANT",
  "current_conviction": "MEDIUM",
  "graded_conviction": null,
  "archetype": {
    "code": "a5",
    "n": 5
  },
  "current_thesis": "Post-print air pocket in a live special situation: Q2 (2026-07-28) beat and lifted FY26 revenue to $735–739M, ~10 targets moved to $45–58, and the stock still closed 2026-08-07 at $43.52 — below every one of them, RSI 38.3. The 2026-06-23 Bloomberg take-private report is seven weeks old with no follow-up, and that premium decays until a headline confirms or kills it.",
  "invalidation_trigger": "A weekly close below $39 — roughly midway between the 2026-06-23 takeover-report close of $35.03 and the 2026-08-07 close of $43.52 — cedes the post-report advance; a \"talks ended\" report, or a Q3 SaaS ARR ex-conversions print under the 20–21% FY guide, compounds it.",
  "catalyst_date": "2026-08-14",
  "outcome": "OPEN",
  "outcome_date": null,
  "invalidation_fired": null,
  "themes": [
    "cybersecurity",
    "ai-datacenter-infrastructure"
  ],
  "tags": [],
  "sources": [],
  "notes": [
    "Take-private report (Bloomberg, 2026-06-23) is preliminary — no formal process, bidder or price confirmed; the name gaps on headlines rather than trending cleanly.",
    "Total SaaS ARR growth is flattered by perpetual-to-SaaS conversions: +52% YoY in Q2 2026 versus +25% excluding conversions. The ex-conversions line is the clean one.",
    "Q2 2026 non-GAAP operating income was $3.7M while the GAAP result stayed a loss; the valuation debate runs on ARR and free cash flow, not EPS.",
    "Next scheduled company event is the Q3 2026 print, historically late October — no company-scheduled catalyst sits inside the next 30 days.",
    "Still 31.3% below the $63.31 52-week high as of 2026-08-07; that discount to cyber peers is the reason private equity was reported circling."
  ],
  "body_markdown": "## Current Thesis\nTwo legs are carrying this name and only one of them has produced a dated event since the last note. The Bloomberg report of 2026-06-23 — Varonis working with advisers on preliminary takeover interest from Blackstone, Thoma Bravo and Vista Equity — is now seven weeks old with no confirmed process, bidder or price. The second leg did print: Q2 2026 on 2026-07-28 beat on revenue ($180.0M vs $176.8M consensus) and adjusted EPS ($0.04 vs $0.01), and FY26 revenue guidance went up to $735–739M from $731–737M. Roughly ten sell-side targets moved to a $45–58 band on 2026-07-29/30. The stock closed 2026-08-07 at $43.52 — under every one of them, with RSI(14) at 38.3. The narrative leg an investor is buying here is a discounted, sticky-ARR data-security asset that private equity has already looked at, now with a beat-and-raise underneath it. What the tape says is that neither leg is attracting incremental money at $43.52.\n\n## Bull Case\n- **Q2 2026 (2026-07-28) beat on both lines.** Revenue $180.0M versus $152.2M in Q2 2025 and $176.8M consensus; adjusted EPS $0.04 versus $0.01 estimate. SaaS revenue $171.7M versus $105.9M a year earlier.\n- **ARR base is large and still compounding.** Total SaaS ARR $726.0M, +52% YoY; SaaS ARR excluding conversions +25% YoY; SaaS ARR from new logos up more than 20% (Q2 2026 release).\n- **Guidance raised, not merely maintained.** FY26 revenue $735–739M (from $731–737M), FY26 adjusted EPS $0.14–0.15 (from $0.11–0.12) against a $0.12 consensus, and FY26 SaaS ARR excluding conversions lifted to $769–775M.\n- **Profitability crossed over.** Non-GAAP operating income $3.7M in Q2 2026 against a $1.9M non-GAAP operating loss in Q2 2025; non-GAAP net income $5.3M.\n- **The whole cluster sits above the tape.** Piper Sandler $58, Susquehanna $55, Cantor $55, TD Cowen $53, Needham $50, Baird $45 (all 2026-07-29), Citi $45 (2026-07-30), JP Morgan $55 (2026-07-27), UBS $58 (2026-07-21). The 2026-08-07 close of $43.52 is below the lowest of them.\n- **Product answers the disruption bear case with dates on it.** GovRAMP authorization for the Data Security Platform on 2026-06-30; Agent Intent-Based Access Control shipped inside Atlas in early August 2026, monitoring AI-agent reasoning, tool use and data access.\n- **The option has not been withdrawn.** No report since 2026-06-23 has said talks ended.\n\n## Bear Case\n- **Deal premium decays with silence.** Seven weeks after the Bloomberg report there is still no formal process, named price or 13D. Roughly $8 of the current quote sits above the 2026-06-23 report-day close of $35.03, and that spread is paying for an unsigned outcome.\n- **The beat did not hold the bid.** $43.52 on 2026-08-07 against $42.73 on 2026-07-12 — four weeks that contained an earnings beat, a raised FY guide and about ten target increases produced almost no net price progress, and RSI(14) cooled to 38.3.\n- **Clean growth is decelerating on schedule.** SaaS ARR excluding conversions: +29% in Q1 2026, +25% in Q2 2026, guided to 20–21% for FY26. The headline +52% total SaaS ARR is carried by perpetual-to-SaaS conversions and steps down from +69% in Q1.\n- **Q3 guide is in line, not a raise.** Revenue $185–188M against $186.1M consensus; adjusted EPS $0.02–0.03 against $0.02.\n- **One target went the other way.** Barclays cut to $50 from $52 on 2026-07-29 while the rest of the cluster raised — the only reduction in the post-print batch.\n- **The 2026 de-rating cause is unresolved.** Bloomberg (2026-06-23) tied the roughly 30% earlier-2026 decline to Anthropic and OpenAI shipping vulnerability-detection tooling. The stock is still 31.3% below its $63.31 52-week high as of 2026-08-07.\n- **Back-half weighting.** Seeking Alpha's post-Q2 review argues Q4 2026 still requires a significant acceleration in net new ARR for the raised FY plan to land.\n\n## Setup & Price Structure\n- Basis: 2026-08-07 close $43.52; 52-week high $63.31 (-31.3%); three-month return +52.5%; RSI(14) 38.3.\n- Reference shelf below: the 2026-06-23 takeover-report close of $35.03, with the pre-rumor base in the low $30s. Nothing in the record since shows that shelf being retested.\n- $39 sits roughly midway between the $35.03 report-day close and the $43.52 basis — the level where the post-report advance has been half surrendered and the gap base comes back into the conversation.\n- Positioning observables, stated as observed: nine post-print targets clustered $45–58 all sit above spot; the two attention clusters (2026-06-23/24 and 2026-07-28/29) are behind; no company-scheduled event falls inside the next 30 days; no insider or company filings appear in the recent window; VRNS appeared in Benzinga's unusual-options-activity roundup dated 2026-07-22.\n- Life-cycle: **MATURING**. Fresh attention arrived twice on datable events — the takeover report and upgrade cluster of 2026-06-23/24, then the print and target cluster of 2026-07-28/29 — and price is now flat-to-lower against both while momentum bleeds. That is a well-known story that still holds its base with moderating flow. It flips to SATURATED on a weekly close under $40 with no deal headline and the target cluster going static or lower.\n- One caveat on the basis: Simply Wall St, in a piece dated 2026-08-08, attributed an 8.9% move to the Agent Intent-Based Access Control launch. That postdates the 2026-08-07 close used throughout this note and is not reflected in the levels above.\n\n## Catalyst Calendar (next 30 days)\n\n- **2026-08-14** — Q2 2026 13F filing deadline for the quarter ended 2026-06-30. That quarter contains the 2026-06-23 takeover report; the filings show whether event-driven and merger-arb money built positions into it.\n- **~2026-10-27 (est.)** — Q3 2026 results. Outside the 30-day window; guided to revenue $185–188M and adjusted EPS $0.02–0.03. This is the next scheduled binary, and nothing company-scheduled sits between now and then.\n\n## Elapsed catalysts\n\n- **Undated, live since 2026-06-23** — any follow-up on the reported sale process: exclusivity, a signed agreement, or a \"talks ended\" report. There is no scheduled date for this and none should be assumed. *(passed 47d ago)*\n\n## What Would Change Our Mind\nThe deal leg does not have to be denied to fail — it can simply go stale, and it has been quiet since 2026-06-23. A report that talks ended, or a Q3 call in late October that passes without any process reference, removes the reason the stock trades more than $8 above its report-day close. On the fundamental side, the number that matters is SaaS ARR excluding conversions: it has gone +29% (Q1) to +25% (Q2) against a 20–21% FY guide, and a Q3 print below that guided band, or a trim to the $769–775M FY ex-conversions outlook, would say the raise was front-loaded. Priced: a weekly close below $39 cedes half the post-report advance and puts the $35.03 base back in play. In the other direction, a confirmed exclusivity or signed transaction, or a Q3 print that re-accelerates ex-conversions ARR above the 25% Q2 rate, moves this from a decaying special situation back to a name where the $45–58 target cluster is the reference rather than the ceiling.\n\n## Correlation Notes\n- Moves with the take-private-of-software complex: the buyers named on 2026-06-23 (Blackstone, Thoma Bravo, Vista) are the same sponsors that set the clearing multiple for mid-cap security assets, so leveraged-credit conditions feed directly into deal probability here.\n- Idiosyncratic residual is large. Roughly $8 of the 2026-08-07 quote sits above the 2026-06-23 report-day close, and index or sector beta explains little of that spread.\n- Sensitive to platform-AI product announcements rather than to cyber budgets alone — Bloomberg tied the earlier-2026 drawdown to Anthropic and OpenAI security tooling, so a data-security feature shipped by a frontier lab is a live multiple risk independent of Varonis's own ARR.\n- The valuation gap that drew private-equity attention (about 3.9x 2027 EV/revenue against roughly 7.3x for comparable cyber names, per Bloomberg 2026-06-23) means the name re-rates with the peer group's multiple as much as with its own execution.",
  "first_seen": "2026-07-12",
  "last_analyzed": "2026-08-09T19:05:50+00:00",
  "last_synthesized": "2026-08-09",
  "last_update_source": "watchlist_research",
  "license": "Content © orbyd. Cite the canonical URL."
}