Varonis Systems (VRNS) Risk Analysis

The success of our business and competitive position depends on our ability to obtain, protect and enforce our trade secrets, trademarks, copyrights, patents and other intellectual property rights. We attempt to protect our intellectual property under patent, trademark, copyrights and trade secret laws, and through a combination of confidentiality procedures, contractual provisions and other methods, all of which offer only limited protection and may not now or in the future provide us with a competitive advantage. As of December 31, 2025, we have 116 issued patents in the United States and 63 pending U.S. patent applications. We also had 95 patents issued and 79 applications pending for examination in non-U.S. jurisdictions, and 31 pending PCT patent applications, all of which are counterparts of our U.S. patent applications. We may file additional patent applications in the future. The process of obtaining patent protection is expensive and time-consuming, and we may not be able to prosecute all necessary or desirable patent applications at a reasonable cost or in a timely manner all the way through to the successful issuance of a patent. We may choose not to seek patent protection for certain innovations and may choose not to pursue patent protection in certain jurisdictions. Furthermore, it is possible that our patent applications may not issue as granted patents, that the scope of our issued patents will be insufficient or not have the coverage originally sought, that our issued patents will not provide us with any competitive advantages, and that our patents and other intellectual property rights may be challenged by others or invalidated through administrative process or litigation. In addition, issuance of a patent does not guarantee that we have an absolute right to practice the patented invention. Our policy is to require our employees (and our consultants and service providers that develop intellectual property included in our products) to execute written agreements in which they assign to us their rights in potential inventions and other intellectual property created within the scope of their employment (or, with respect to consultants and service providers, their engagement to develop such intellectual property). However, we may not be able to adequately protect our rights in every such agreement or execute an agreement with every such party. Finally, in order to benefit from patent and other intellectual property protection, we must monitor, detect and pursue infringement claims in certain circumstances in relevant jurisdictions, all of which is costly and time-consuming. As a result, we may not be able to obtain adequate protection or to enforce our issued patents or other intellectual property effectively. In addition to patented technology, we rely on our unpatented proprietary technology and trade secrets. Despite our efforts to protect our proprietary technologies and our intellectual property rights, unauthorized parties, including our employees, consultants, service providers or customers, may attempt to copy aspects of our products or obtain and use our trade secrets or other confidential information. We generally enter into confidentiality agreements with our employees, consultants, service providers, vendors, channel partners and customers, and generally limit access to and distribution of our proprietary information and proprietary technology through certain procedural safeguards. These agreements may not effectively prevent unauthorized use or disclosure of our intellectual property or technology and may not provide an adequate remedy in the event of unauthorized use or disclosure of our intellectual property or technology. We cannot provide assurance that the steps taken by us will prevent misappropriation of our trade secrets or technology or infringement of our intellectual property. In addition, the laws of some foreign countries where we operate do not protect our proprietary rights to as great an extent as the laws of the United States, and many foreign countries do not enforce these laws as diligently as government agencies and private parties in the United States. We have registered the "Varonis" name and logo and "DatAdvantage," "DataPrivilege," "DatAlert," and other names in the United States and, as related to some of these names, certain other countries. However, we cannot provide assurance that any future trademark registrations will be issued for pending or future applications or that any registered trademarks will be enforceable or provide adequate protection of our proprietary rights. Despite our efforts to protect our proprietary technology and trade secrets, unauthorized parties may attempt to misappropriate, reverse engineer or otherwise obtain and use them. In addition, others may independently discover our trade secrets, in which case we would not be able to assert trade secret rights or develop similar technologies and processes. Further, the contractual provisions that we enter into may not prevent unauthorized use or disclosure of our proprietary technology or intellectual property rights and may not provide an adequate remedy in the event of unauthorized use or disclosure of our proprietary technology or intellectual property rights. Moreover, policing unauthorized use of our technologies, trade secrets and intellectual property is difficult, expensive and time-consuming, particularly in foreign countries where the laws may not be as protective of intellectual property rights as those in the United States and where mechanisms for enforcement of intellectual property rights may be weak. We may be unable to determine the extent of any unauthorized use or infringement of our solution, technologies or intellectual property rights. If we are unable to protect our intellectual property rights and ensure that we are not violating the intellectual property rights of others, we may find ourselves at a competitive disadvantage to others who need not incur the additional expense, time and effort required to create the innovative products that have enabled us to be successful to date.

Our corporate infrastructure stores and processes our sensitive, proprietary and other confidential information (including as related to financial, technology, employees, marketing, sales, etc.) which is used on a daily basis in our operations. In addition, our software involves transmission and processing of our customers' confidential, proprietary and sensitive information. We have legal and contractual obligations to protect the confidentiality and appropriate use of customer data. As a leader in the cyber industry, we may be an attractive target for cyber attackers or other data thieves. High-profile cyberattacks and security breaches have increased in recent years, with the potential for such acts heightened as a result of the number of employees working remotely due to many companies adopting a hybrid working model. Security industry experts and government officials have warned about the risks of hackers and cyberattacks targeting IT products and enterprise infrastructure. Because techniques used to obtain unauthorized access or to sabotage systems change frequently and often are not recognized until launched against a specific target, we may be unable to anticipate these techniques or to implement adequate preventative measures. As we continue to increase our client base and expand our brand, we may become more of a target for third parties seeking to compromise our security systems and we anticipate that hacking attempts and cyberattacks will increase in the future. We may not always be successful in preventing or repelling unauthorized access to our systems. We also may face delays in our ability to identify or otherwise respond to any cybersecurity incident or any other breach. Additionally, we use third-party service providers to provide some services to us that involve the cloud hosting, storage or transmission of data, such as SaaS, cloud computing, and internet infrastructure and bandwidth, and they face various cybersecurity threats and also may suffer cybersecurity incidents or other security breaches. Despite our security measures, our IT and infrastructure may be vulnerable to attacks. Threats to IT security can take a variety of forms. Individual and groups of hackers and sophisticated organizations, including state-sponsored organizations or nation-states, continuously undertake attacks that pose threats to our customers and our IT. These actors may use a wide variety of methods, which may include developing and deploying malicious software or exploiting vulnerabilities in hardware, software, or other infrastructure in order to attack our products and services or gain access to our networks, using social engineering techniques to induce our employees, users, partners, or customers to disclose passwords or other sensitive information or take other actions to gain access to our data or our users' or customers' data, or acting in a coordinated manner to launch distributed denial of service or other coordinated attacks. Inadequate account security practices may also result in unauthorized access to confidential and/or sensitive data or loss of SaaS platform availability. Security risks, including, but not limited to, unauthorized use or disclosure of customer data, loss of availability of our SaaS platform offering, cyberattack on our cloud providers, theft of proprietary information, theft of intellectual property, theft of internal employee's PII/PHI information, theft of financial data and financial reports, loss or corruption of customer data and computer hacking attacks or other cyberattacks, could require us to expend significant capital and other resources to alleviate the problem and to improve technologies, may impair our ability to provide services to our customers and protect the privacy of their data, may result in product development delays, may compromise confidential or technical business information, may harm our competitive position, may result in theft or misuse of our intellectual property or other assets and could expose us to substantial litigation expenses and damages, indemnity and other contractual obligations, government fines and penalties, mitigation expenses, costs for remediation and incentives offered to affected parties, including customers, other business partners and employees, in an effort to maintain business relationships after a breach or other incident, and other liabilities. We are continuously working to improve our IT systems, together with creating security boundaries around our critical and sensitive assets. We provide advanced security awareness training to our employees and contractors that focuses on various aspects of the cybersecurity world. All of these steps are taken in order to mitigate the risk of attack and to ensure our readiness to responsibly handle any security violation or attack. If an actual or perceived breach of our security occurs, the market perception of the effectiveness of our security measures and our products could be harmed, we could lose potential sales and existing customers, our ability to operate our business could be impaired, we may incur significant liabilities, we could suffer harm to our reputation and competitive position, and our operating results could be negatively impacted.

Because our software uses complex technology, undetected errors, failures or bugs may occur. Our software is often installed and used in a variety of computing environments with different operating system management software, and equipment and networking configurations, which may cause errors or failures of our software or other aspects of the computing environment into which it is deployed. In addition, deployment of our software into computing environments may expose undetected errors, compatibility issues, failures or bugs in our software. Despite testing by us, errors, failures or bugs may not be found in our software until it is released to our customers. Moreover, our customers could incorrectly implement or inadvertently misuse our software, which could result in customer dissatisfaction and adversely impact the perceived utility of our products as well as our brand. Any of these real or perceived errors, compatibility issues, failures or bugs in our software could result in negative publicity, reputational harm, loss of or delay in market acceptance of our software, loss of competitive position or claims by customers for losses sustained by them. In such an event, we may be required, or may choose, for customer relations or other reasons, to expend additional resources in order to help correct the problem. Alleviating any of these problems could require significant expenditures of our capital and other resources and could cause interruptions or delays in the use of our solutions, which could cause us to lose existing or potential customers and could adversely affect our operating results and growth prospects.

Privacy and data protection laws in the United States and internationally are rapidly evolving and remain subject to uncertainty. U.S. federal, state, and foreign authorities have enacted, and continue to consider, laws governing the collection, use,disclosure, storage, and security of personal information. In the United States, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) impose significant obligations on businesses and grant consumers enhanced rights, such as the ability to opt out of certain sales of personal information. In 2025, additional comprehensive privacy laws took effect in Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, and Maryland, and further state privacy laws are scheduled to take effect in 2026, including in Indiana, Kentucky, and Rhode Island. Collectively, these frameworks generally require detailed disclosures, honoring consumer rights, and implementing robust data protection safeguards, and they expand the patchwork of compliance obligations across the United States. Internationally, nearly every jurisdiction where we operate has established its own privacy and data security framework, often more restrictive than U.S. laws, governing the collection, use, storage, disclosure, and protection of data that identifies or could identify an individual (for example, names, email addresses, and, in some jurisdictions, IP addresses). The European Union's General Data Protection Regulation (GDPR) imposes stringent obligations, and the United Kingdom has implemented similar legislation. In 2025, the United Kingdom enacted the Data (Use and Access) Act 2025, which amends the UK GDPR regime, including targeted changes related to automated decision-making, cookies, recognized legitimate interests, regulator powers, and international transfers. In December 2025, the European Commission renewed its UK adequacy decisions (subject to review), supporting continued data flows between the UK and the EEA. Cross-border data transfers from the European Economic Area and the UK to the United States rely on mechanisms such as standard contractual clauses, the UK's International Data Transfer Agreement (or Addendum), and the EU–U.S. Data Privacy Framework (including its UK extension). In September 2025, the European General Court upheld the validity of the EU–U.S. Data Privacy Framework, providing near-term stability for organizations that self-certify to the framework; however, challenges and appeals remain possible, and the transfer landscape continues to evolve. Compliance with GDPR, the UK regime as amended by the Data (Use and Access) Act 2025, and other international privacy laws may require significant operational changes and costs, while non-compliance could result in substantial fines, litigation, and reputational harm, adversely affecting our business, financial condition, and results of operations. Certain U.S. and international laws also require companies to notify individuals of security breaches involving personal information, whether caused by us or our service providers. Despite contractual protections, a breach could harm our reputation, erode customer trust, reduce sales, lead to customer loss, and expose us to liability or significant remediation costs. Beyond government regulation, privacy advocates and industry groups may introduce new self-regulatory standards that could apply to us. We also anticipate continued legislative and regulatory developments in privacy, data protection, and information security, the impact of which remains uncertain. New laws, amendments, or reinterpretations of existing requirements-as well as evolving industry standards and contractual obligations-may increase compliance costs and restrict our operations. Because interpretation and enforcement of these requirements are uncertain, they may conflict with our current practices or product features. If so, we could face fines, litigation, or be required to make fundamental changes to our business or software, which may not be commercially feasible and could limit our ability to innovate. Failure to adequately address privacy concerns-whether valid or perceived-or to comply with applicable requirements could result in additional costs, liability, reputational harm, inhibited sales, and other adverse effects on our business. Furthermore, compliance costs and other burdens imposed by privacy and data protection laws applicable to our customers may increase the cost of using our products, limit their adoption, and reduce overall demand. In addition, privacy and personal information security concerns-whether well-founded or not-may discourage market acceptance of our products, particularly in certain industries and international markets.

Our Israeli subsidiary has benefited from a status of a "Beneficiary Enterprise" under the Israeli Law for the Encouragement of Capital Investments, 5719-1959, or the Investment Law, since its incorporation. As of December 31, 2025, the tax benefit that we have been utilizing for our Israeli subsidiary terminated. A tax rate of 16% should be paid by our Israeli subsidiary per such eligible income under the terms of the Investment Law, subject to meeting various conditions. To the extent we do not meet these conditions, our Israeli operations will be subject to a corporate tax at the standard rate of 23%. If the Israeli subsidiary is subject to a corporate tax at the standard rate, it may adversely affect our tax expenses and effective tax rates. Additionally, if our Israeli subsidiary increases its activities outside of Israel, for example, through acquisitions, these activities may not be eligible for inclusion in Israeli tax benefit programs. The tax benefit derived from the Investment Law is dependent upon the ability to generate sufficient taxable income. Accordingly, our Israeli subsidiary may be unable to earn enough taxable income in order to fully utilize its tax benefits.

We operate on a global basis and political, social, economic and security conditions in countries in which we operate may limit our ability to develop and sell our products. Specifically, we have operations and do business in Israel, the United Kingdom, France, Brazil and Ukraine. Continued political and social instability and war in these regions, and any other areas in the world where we have operations, may affect our business and operations in those and other neighboring regions. In March 2022, in response to the war between Russia and Ukraine, a number of countries, including the United States, imposed sanctions and export controls on Russia, which in turn imposed counter-sanctions in response. While sales in Russia represented a very small percentage of our overall business, and while our operations in Russia and Ukraine have historically been a small portion of our overall workforce, the conflict is complex and evolving and subjects us to additional regulatory risk and compliance costs. As of December 31, 2025, we do not have any employees or contractors in Russia. We have no way to predict the progress or outcome of the situation, including any impact on the rest of the world, as the conflict and government reactions are rapidly developing. Our principal research and development facility, which also houses a portion of our support and general and administrative teams, is located in Israel. Since the establishment of the State of Israel in 1948, a number of armed conflicts have taken place between Israel and its neighboring countries, as well as incidents of terror activities and other hostilities, and a number of state and non-state actors have publicly committed to its destruction. In addition, Israel is currently in a war and recently experienced social unrest in connection with the judiciary reform bill. Security, political and economic conditions in Israel could directly affect our operations. We could be adversely affected by hostilities involving Israel, including acts of terrorism or any other hostilities involving or threatening Israel, the interruption or curtailment of trade between Israel and its trading partners, a significant increase in inflation or a significant downturn in the economic or financial condition of Israel. Any on-going or future armed conflicts, terrorist activities, tension along the Israeli borders or with other countries in the region, including Lebanon, Syria, Iran or Yemen, or political instability in the region could disrupt international trading activities in Israel and may materially and negatively affect our business and could harm our results of operations. Certain countries, as well as certain companies and organizations, continue to participate in a boycott of Israeli companies, companies with large Israeli operations and others doing business with Israel and Israeli companies. The boycott, restrictive laws, policies or practices directed towards Israel, Israeli businesses or Israeli citizens could, individually or in the aggregate, have a material adverse effect on our business in the future. Some of our employees in Israel are obligated to perform routine military reserve duty in the Israel Defense Forces, depending on their age and position in the armed forces. Furthermore, they have been and may in the future be called to active reserve duty at any time under emergency circumstances for extended periods of time. Currently, due to the war in Israel that began on October 7, 2023, a portion of our employees have been called to active reserve duty and additional employees may be called in the future, if needed. It is possible that our operations could be disrupted if this continues for a significant period of time or if the situation further deteriorates, including, among other things, an expansion of the war to other countries, damage to critical infrastructure and general unrest, which could harm our business. Our insurance does not cover losses that may occur as a result of an event associated with the security situation in the Middle East or for any resulting disruption in our operations. Although the Israeli government has in the past covered the reinstatement value of direct damages that were caused by terrorist attacks or acts of war, we cannot be assured that this government coverage will be maintained or, if maintained, will be sufficient to compensate us fully for damages incurred and the government may cease providing such coverage or the coverage might not suffice to cover potential damages. Any losses or damages incurred by us could have a material adverse effect on our business.

Our business relies on our customers' satisfaction with the technical support, customer success and professional services we provide to support our products. Our customers have no obligation to renew their agreements with us after the initial terms have expired. Our customers have an option to renew their agreements and, for us to maintain and improve our results of operations, it is important that our existing customers renew their agreements, if applicable, when the existing contract term expires. For example, our renewal rate for the years ended December 31, 2025, 2024 and 2023 continued to be over 90%. If we fail to provide technical support services that are responsive, satisfy our customers' expectations and resolve issues that they encounter with our products and services, then they may elect not to purchase or renew contracts and they may choose not to purchase additional products and services from us. Accordingly, our failure to provide satisfactory technical support, customer success or professional services could lead our customers not to renew their agreements with us or renew on terms less favorable to us, and therefore have a material and adverse effect on our business and results of operations.

Our ability to sustain growth and execute our strategy depends heavily on attracting, retaining and scaling a highly productive workforce, particularly in sales, marketing and research and development. As we continue to expand our platform, the complexity of our sales process has increased, requiring a more consultative and technically skilled sales force. This shift has introduced new challenges in hiring and onboarding qualified personnel, especially in competitive markets. We face intense competition for top talent, particularly in regions like Israel where we maintain a significant research and development presence. Recruiting individuals with the right expertise, whether for new geographies, specialized sales roles, or advanced research and development positions is increasingly difficult. Remote hiring and training, high attrition rates and the time required to ramp new hires (which can take up to 12 months for sales personnel to operate at a level that meets our expectations) further complicate our ability to scale effectively. Our growth also depends on retaining key employees and preserving our corporate culture. Any inability to attract or retain skilled personnel, including key managers, could hinder our ability to innovate, deliver new products and compete effectively. Additionally, equity compensation is a critical component of our talent strategy. A decline in our stock price or changes to our equity programs could reduce the attractiveness of our compensation packages, making it harder to recruit and retain top talent. If we fail to maintain or improve the productivity of our teams, or if we are unable to hire and integrate new personnel efficiently, our ability to meet growth targets, expand into new markets and serve our customers effectively could be materially impacted.