Forms of Performance-Based Restricted Stock Unit Award Grant Notice and Performance-Based Restricted Stock Unit Award Agreement under the 2023 Omnibus Equity Incentive Plan (Israeli Employees)

Vesting Schedule: The number of PSUs earned with respect to the Performance Period shall be determined in accordance with the performance metrics attached as Exhibit A to this Notice (the “Performance Metrics”), as determined by the Administrator in its sole discretion, and such earned PSUs shall vest on _____________ subject to the Participant’s continued employment or service with the Company or an Affiliate thereof through such vesting date (each PSU earned in accordance with the Performance Metrics, an “Earned PSU”). PSUs deemed by the Administrator not to have been earned in accordance with the Performance Metrics shall immediately terminate.

Termination: Except to the extent paid in accordance with the above vesting schedule, the PSUs shall terminate, become forfeited or expire without settlement in accordance with the terms of the Agreement.

By his or her signature, the Participant hereby:

VARONIS SYSTEMS, INC.     PARTICIPANT

__________________________            __________________________                        

    

Pursuant to the Performance-Based Restricted Stock Unit Award Grant Notice (the “Notice”) to which this Performance-Based Restricted Stock Unit Award Agreement (this “Agreement”) is attached, Varonis Systems, Inc. (the “Company”) has granted to the Participant an Award of performance-based restricted stock units (“PSUs”) under the Company's 2023 Omnibus Equity Incentive Plan including the sub-Plan for the Israeli Participants (the “Plan”). Each earned and vested PSU represents the right to receive one share of Common Stock of the Company (each a “Share”). Capitalized terms not specifically defined herein shall have the meanings specified in the Plan and Notice.

1.1Incorporation of Terms of Plan. The PSUs are subject to the terms and conditions of the Plan, which are incorporated herein by reference. In the event of any inconsistency between the Plan and this Agreement, the terms of the Plan shall control.

2.1Grant of PSUs. In consideration of the Participant's employment or service to the Company or any Affiliate and other good and valuable consideration, effective as of the Grant Date set forth in the Notice, the Company hereby grants to the Participant an Award of PSUs under the Plan, upon the terms and conditions set forth in the Notice, the Plan and this Agreement.

2.2Unsecured Obligation. Unless and until the PSUs have been earned and vested in the manner set forth in Article 2 hereof, the Participant will have no right to receive Shares with respect to any such PSUs. Prior to actual payment of any earned and vested PSUs, such PSUs will represent an unsecured obligation of the Company, payable (if at all) only from the general assets of the Company.

2.3Vesting Schedule. Subject to Sections 2.5 and 3.1 hereof, the PSUs shall be earned and shall thereafter vest and become nonforfeitable with respect to the applicable portion thereof according to the Vesting Schedule set forth in the Notice (rounding down to the nearest whole Share).

2.4Consideration to the Company. In consideration of the grant of PSUs pursuant hereto, the Participant agrees to render faithful and efficient employment or other service to the Company or any Affiliate. Nothing in the Plan or this Agreement shall confer upon the Participant any right to continue in the employment or service of the Company or any Affiliate or shall interfere with or restrict in any way the rights of the Company and its Affiliates, which rights are hereby expressly reserved, to discharge or terminate the employment or service of the Participant at any time for any reason whatsoever, with or without Cause.

2.5Forfeiture, Termination and Cancellation Upon Termination of Employment or Service.

(a)Upon the Participant's termination of employment or service with the Company and all Affiliates thereof, the PSUs shall be treated as follows, except as specifically provided in an employment agreement between the Company and the Participant:

(i)In the event that the employment or service of the Participant with the Company and all Affiliates thereof ) shall terminate for any reason other than for Cause, unvested PSUs granted to the Participant shall terminate at the close of business on the date of such termination.

(ii)In the event of the termination of the Participant's employment or service for Cause, all outstanding PSUs (whether vested or not and whether an Earned PSU or not) granted to the Participant shall terminate at the commencement of business on the date of such termination.

(b)The Administrator or its delegate shall determine in its sole discretion the manner in which the PSUs shall be affected, both with regard to the vesting schedule and termination, by leaves of absence, including unpaid and un-protected leaves of absence, changes from full-time to part-time employment, partial disability or other changes in the employment status of the Participant.

(c)For purposes of the PSUs, as determined in the Administrator’s or its delegate’s exclusive discretion, the Participant’s Service will be considered terminated as of the date the Participant is no longer actively providing services to the Company or any Affiliate (regardless of the reason for such termination and whether or not later to be found invalid or in breach of Applicable Laws in the jurisdiction where the Participant is employed or retained or the terms of the Participant’s employment or service agreement, if any), and unless otherwise expressly provided in this Agreement or determined by the Administrator or its delegate, the Participant’s right to vest in the PSUs, if any, will terminate as of such date and will not be extended by any notice period (e.g., the Participant’s period of service would not include any contractual notice period or any period of “garden leave” or similar period mandated under Applicable Laws in the jurisdiction where the Participant is employed or retained or the terms of the Participant’s employment or service agreement, if any).

2.6Issuance of Shares upon Vesting.

(a)Earned PSUs to the extent determined by the Compensation Committee after the applicable year-end audit shall represent the right to receive, on the first business day following the applicable vesting date, the number of Shares determined in accordance with the Vesting Schedule set forth in the Notice and provided that the Participant remains employed by the Company or an Affiliate through the applicable vesting date, subject to the provisions of Section 2.5 or Section 3.1. Notwithstanding the above, Shares earned with respect to vested Earned PSUs shall be treated as delivered on the first business day following the applicable vesting date (the “Delivery Date”) provided that they are delivered on a date following the Delivery Date that is in the same calendar year as the vesting date. On the Delivery Date, the Company shall deliver to the Trustee for the benefit of the Participant or to an account controlled by the Trustee (or any transferee permitted under Section 4.2 hereof) a number of Shares (either by delivering one or more certificates for such Shares or by entering

such Shares in book entry form, as determined by the Company in its sole discretion) equal to the number of Earned PSUs that vest on the applicable vesting date, unless such Earned PSUs terminate prior to the applicable vesting date pursuant to Section 2.5 hereof. Notwithstanding the foregoing, in the event Shares cannot be issued pursuant to Section 20 of the Plan, the Shares shall be issued pursuant to the preceding sentence as soon as administratively practicable after the Administrator determines that Shares can again be issued in accordance with such Section.

(b) As set forth in Section 17 of the Plan and Section 5.3 of this Agreement, the Participant satisfy all Tax-Related Items (as defined in Section 5.3 below) in connection with the PSUs. The Company shall not be obligated to deliver any new certificate representing Shares to the Participant or the Participant’s legal representative or enter such Shares in book entry form unless and until the Participant or the Participant’s legal representative shall have paid or otherwise satisfied in full the amount of all Tax-Related Items.

2.7Conditions to Delivery of Shares. The Shares deliverable hereunder may be either previously authorized but unissued Shares, treasury Shares or issued Shares which have then been reacquired by the Company. Such Shares shall be fully paid and nonassessable. The Company shall not be required to issue or deliver any certificates or make any book entries evidencing Shares deliverable hereunder prior to fulfillment of the conditions set forth in Section 20 of the Plan.

The PSUs and the underlying Shares and/or any additional rights, including without limitation any right to receive any dividends or any shares received as a result of an adjustment made under the Plan, that may be granted in connection with the PSUs (the “Additional Rights”) shall be issued to or controlled by the Trustee for the benefit of the Participant under the provisions of the Section 102 under the Capital Gains Route for at least the period stated in Section 102 and the Income Tax Rules (Tax Benefits in Share Issuance to Employees) 5763-2003 (the “Rules”). In the event the PSUs do not meet the requirements of Section 102 of the Ordinance, such PSUs and the underlying Shares shall not qualify for the favorable tax treatment under the Section 102. The Company makes no representations or guarantees that the PSUs will qualify for favorable tax treatment and will not be liable or responsible if favorable tax treatment is not available under Section 102. Any fees associated with any sale, transfer or any act in relation to the PSUs shall be borne by the Participant and the Trustee and/or the Company and/or any Affiliate shall be entitled to withhold or deduct such fees from payments otherwise due to from the Company or an Affiliate or the Trustee. In accordance with the requirements of Section 102 and the Capital Gains Route, the Participant shall not sell nor transfer the Shares or Additional Rights from the Trustee until the end of the required Holding Period. Notwithstanding the above, if any such sale or transfer occurs before the end of the required Holding Period, the sanctions under Section 102 shall apply to and shall be borne by the Participant.

Change in Control. In the event of a Change in Control, the PSUs shall be treated in accordance with Section 13 of the Plan.

5.1.Administration. The Administrator shall have the power and authority to interpret and construe the terms and provisions of this Agreement and to adopt such rules for the administration, interpretation and application of this Agreement as are consistent therewith and to interpret, amend or revoke any such rules. All decisions made by the Administrator shall be final, conclusive and binding on all persons, including the Participant, the Company and any other interested persons and entities.

5.2.Transferability of Grant

Except as otherwise set forth in the Plan:

(a)The PSUs may not be sold, pledged, assigned or transferred in any manner other than by will or the laws of descent and distribution;

(b)Neither the PSUs nor any interest or right therein shall be liable for the debts, contracts or engagements of the Participant or his or her successors in interest or shall be subject to disposition by transfer, alienation, anticipation, pledge, encumbrance, assignment or any other means whether such disposition be voluntary or involuntary or by operation of law by

judgment, levy, attachment, garnishment or any other legal or equitable proceedings (including bankruptcy), and any attempted disposition thereof shall be null and void and of no effect, except to the extent that such disposition is permitted by Section 4.2(a).

5.3.Responsibility for Taxes. Regardless of any action the Company or, if different, the Affiliate to which the Participant provides services takes with respect to any or all income tax, social insurance, payroll tax, fringe benefits tax, payment on account or other tax related items related to the Participant’s participation in the Plan and legally applicable to the Participant (“Tax-Related Items”), the Participant acknowledges that the ultimate liability for all Tax-Related Items is and remains the Participant’s responsibility and may exceed the amount actually withheld by the Company or the Affiliate. The Participant further acknowledges that the Company and/or the Affiliate (i) make no representations or undertakings regarding the treatment of any Tax-Related Items in connection with any aspect of the PSUs, including, but not limited to, the grant, vesting or settlement of the PSUs, the subsequent sale of Shares acquired pursuant to such settlement and the receipt of any dividends and/or dividend equivalent; and (ii) do not commit to and are under no obligation to structure the terms of the grant or any aspect of the PSUs to reduce or eliminate the Participant’s liability for Tax-Related Items or achieve any particular tax result. Further, if the Participant has become subject to tax in more than one jurisdiction, the Participant acknowledges that the Company and/or the Affiliate may be required to withhold or account for Tax-Related Items in more than one jurisdiction.

5.4.Withholding of Taxes. Prior to any relevant taxable or tax withholding event, as applicable, the Participant agrees to make adequate arrangements satisfactory to the Company and/or Trustee and/or the Affiliate to satisfy all Tax-Related Items. In this regard, the Participant authorizes the Company and/or the Trustee and/or the Affiliate, or their respective agents, at their discretion, to satisfy any applicable withholding obligations with regard to all Tax-Related Items by one or a combination of the following:

(a)withholding from the Participant’s wages or other cash compensation paid to the Participant by the Company and/or the Trustee and/or the Affiliate;

(b)withholding from proceeds of the sale of Shares acquired upon settlement of the PSUs either through a voluntary sale or through a mandatory sale arranged by the Company and/or Trustee (on the Participant’s behalf pursuant to this authorization); and

(c)withholding in Shares to be issued upon settlement of the PSUs, unless the use of such withholding method is problematic under Applicable Laws, in which case the obligation for Tax-Related Items may be satisfied by one or a combination of methods (a) and (b) above.

Depending on the withholding method, the Company and/or the Trustee and/or the Affiliate may withhold or account for Tax-Related Items by considering applicable minimum statutory withholding rates or other applicable withholding rates, including maximum applicable rates, in which case the Participant may receive a refund of any over-withheld amount in cash and will have no entitlement to the Share equivalent. If the obligation for Tax-Related Items is satisfied by withholding in Shares, for tax purposes, the Participant is deemed to have been issued the full number of Shares subject to the vested PSUs, notwithstanding that a number of the Shares are held back solely for the purpose of paying the Tax-Related Items.

In addition, the Participant agrees to pay to the Company or the Trustee or the Affiliate any amount of Tax-Related Items that the Company or the Trustee or the Affiliate may be required to withhold or account for as a result of the Participant’s participation in the Plan that cannot be satisfied by the means previously described. The Company may refuse to issue or deliver the Shares or the proceeds of the sale of Shares, if the Participant fails to comply with his or her obligations in connection with the Tax-Related Items.

Finally, the Participant acknowledges that the Company, its Affiliates and/or the employer (i) make no representations or undertakings regarding the treatment of any Tax-Related Items in connection with any aspect of the PSUs including, but not limited to, the grant or vesting of the PSUs, the subsequent sale or transfer of Shares acquired pursuant to the PSUs and the receipt of any dividends; and (ii) do not commit to and are under no obligation to structure the terms of the grant or any aspect of the PSUs to reduce or eliminate Participant's liability for Tax-Related Items or achieve any particular tax result. Further, if Participant has become subject to tax in more than one jurisdiction between the Grant Date and the date of any relevant taxable or tax withholding event, as applicable, Participant acknowledges that the Company, its Affiliates, the employer (or former employer, as applicable) and/or the Trustee may be required to withhold or account for Tax-Related Items in more than one jurisdiction. If Participant is subject to Tax-Related Items in more than one jurisdiction between the Grant Date and the date of any relevant taxable or tax withholding event, as applicable, Participant acknowledges that the Company and/or the employer (or former employer, as applicable) and/or the Trustee may be required to withhold or account for Tax- Related Items in more than one jurisdiction. If the obligation for Tax-Related Items is satisfied by withholding in Shares, for tax purposes, Participant is deemed to have been issued the full number of Shares subject to the PSUs, notwithstanding that a number of the Shares are held back solely for the purpose of paying the Tax-Related Items due as a result of any aspect of Participant's participation in the Plan. The ramifications of any future modification of applicable laws regarding the taxation of the PSUs granted to Participant shall apply to the Participant accordingly and the Participant shall bear the full cost thereof, unless such modified laws expressly provide otherwise.

5.5.Notices. Any notice to be given under the terms of this Agreement to the Company shall be addressed to the Company in care of the Legal Department at the Company's principal office, and any notice to be given to the Participant shall be addressed to the Participant at the Participant's last address reflected on the Company's records. Any notice which is required to be given to the Participant shall, if the Participant is then deceased, be given to the person entitled to the PSUs pursuant to Section 4.2(a) hereof by written notice under this Section 4.7.

5.6.Participant’s Representations. If the Shares issuable hereunder have not been registered under the Securities Act or any applicable state laws on an effective registration statement at the time of such issuance, the Participant shall, if required by the Company, concurrently with such issuance, make such written representations as are deemed necessary or appropriate by the Company and/or its counsel.

5.7.Titles. Titles are provided herein for convenience only and are not to serve as a basis for interpretation or construction of this Agreement.

5.8.Governing Law and Venue. The laws of the State of Delaware shall govern the interpretation, validity, administration, enforcement and performance of the terms of this Agreement regardless of the law that might be applied under principles of conflicts

of laws. For purposes of litigating any dispute that arises under this grant or this Agreement, the parties hereby submit to and consent to the exclusive jurisdiction of the State of New York, agree that such litigation shall be conducted in the courts of New York County, New York, or the federal courts for the U.S. for the Southern District of New York, where this grant is made and/or to be performed.

5.9.Conformity to Securities Laws. The Participant acknowledges that the Plan and this Agreement are intended to conform to the extent necessary with all provisions of the Securities Act and the Exchange Act and any and all regulations and rules promulgated by the Securities and Exchange Commission thereunder, and state securities laws and regulations. Notwithstanding anything herein to the contrary, the Plan shall be administered, and the PSUs are granted and settled, only in such a manner as to conform to such laws, rules and regulations. To the extent permitted by applicable law, the Plan and this Agreement shall be deemed amended to the extent necessary to conform to such laws, rules and regulations.

5.10.Clawback. The Participant hereby acknowledges the PSUs are subject to, and agrees to be bound by, the Clawback Policy, as in effect or as may be adopted and/or modified from time to time by the Company in its discretion in accordance with Section 22 of the Plan.

5.11.Amendments and Termination. To the extent permitted by the Plan, this Agreement may be wholly or partially amended, altered or terminated at any time or from time to time by the Administrator or the Board.

5.12.Successors and Assigns. The Company may assign any of its rights under this Agreement to single or multiple assignees, and this Agreement shall inure to the benefit of the successors and assigns of the Company. Subject to the restrictions on transfer herein set forth in Section 4.2 hereof, this Agreement shall be binding upon the Participant and his or her heirs, executors, administrators, successors and assigns.

5.13.Limitations Applicable to Section 16 Persons. Notwithstanding any other provision of the Plan or this Agreement, if the Participant is subject to Section 16 of the Exchange Act, then the Plan, the PSUs and this Agreement shall be subject to any additional limitations set forth in any applicable exemptive rule under Section 16 of the Exchange Act (including any amendment to Rule 16b-3 of the Exchange Act) that are requirements for the application of such exemptive rule. To the extent permitted by applicable law, this Agreement shall be deemed amended to the extent necessary to conform to such applicable exemptive rule.

5.14.Entire Agreement. The Plan, the Notice and this Agreement (including all Exhibits thereto, if any) constitute the entire agreement of the parties and supersede in their entirety all prior undertakings and agreements of the Company and the Participant with respect to the subject matter hereof.

5.15.Section 409A. This PSU Award is intended to comply with Code Section 409A to the extent subject thereto and shall be interpreted in accordance with Code Section 409A and Department of Treasury regulations and other interpretive guidance issued thereunder, including without limitation any such regulations or other guidance that may be issued after the Grant Date. Notwithstanding any provision in the Plan or Agreement to the contrary, no payment or distribution under this Agreement that constitutes an item of deferred compensation under Code Section 409A and becomes payable by reason of the Participant's

termination of employment or service with the Company will be made to the Participant until the Participant's termination of employment or service constitutes a “separation from service” (as defined in Code Section 409A). For purposes of this Agreement, each amount to be paid or benefit to be provided shall be construed as a separate identified payment for purposes of Code Section 409A. If the Participant is a “specified employee” (as defined in Code Section 409A), then to the extent necessary to avoid the imposition of taxes under Code Section 409A, the Participant shall not be entitled to any payments upon a termination of his or her employment or service until the earlier of: (i) the expiration of the six (6)-month period measured from the date of such Participant's “separation from service” or (ii) the date of the Participant's death. Upon the expiration of the applicable waiting period set forth in the preceding sentence, all payments and benefits deferred pursuant to this Section 4.17 (whether they would have otherwise been payable in a single lump sum or in installments in the absence of such deferral) shall be paid to the Participant in a lump sum as soon as practicable, but in no event later than sixty (60) calendar days, following such expired period, and any remaining payments due under this Agreement will be paid in accordance with the normal payment dates specified for them herein. The Administrator may, in its discretion, adopt such amendments to the Plan, this Agreement or the Notice or adopt other policies and procedures (including amendments, policies and procedures with retroactive effect), or take any other actions, as the Administrator determines are necessary or appropriate to comply with the requirements of Code Section 409A.

5.16.Electronic Signature; Electronic Delivery and Acceptance. The Participant's electronic signature of this Agreement shall have the same validity and effect as a signature affixed by hand. The Company may, in its sole discretion, decide to deliver any documents related to the Participant’s current or future participation in the Plan by electronic means. The Participant hereby consents to receive such documents by electronic delivery and agrees to participate in the Plan through an on-line or electronic system established and maintained by the Company or a third party designated by the Company.

5.17.Waiver. The Participant acknowledges that a waiver by the Company of a breach of any provision of this Agreement shall not operate or be construed as a waiver of any other provision of this Agreement, or of any subsequent breach by the Participant.

5.18.Severability. The provisions of this Agreement are severable and if any one or more provisions are determined to be illegal or otherwise unenforceable, in whole or in part, the remaining provisions shall nevertheless be binding and enforceable.

5.19.The Company has obtained an exemption from the requirement to file a prospectus in Israel with respect to the offer of securities of the Company under the Plan (including the Israeli Sub-Plan). Copies of the Plan and the Form S-8 registration statement for the Plan filed with the U.S. Securities and Exchange Commission will be made available by request from the Company’s Legal Department.

5.20.Data Privacy Notice and Consents.

(a)What personal data we collect and for which purpose? The Company collects, processes and uses personal data of the Participant, including, but not limited to, his or her name, home address and telephone number, email address, date of birth, social insurance, passport or other identification number (e.g., resident registration number), nationality, job

title, any Shares or directorships held in the Company, details of all PSUs or any other entitlement to Shares awarded, canceled, exercised, vested, unvested or outstanding in the Participant’s favor. If the Company offers the Participant a grant of PSUs under the Plan, then the Company will collect the Participant’s personal data for purposes of allocating stock and implementing, administering and managing the Plan.

(b)Legal basis for processing of personal data. The Company’s legal basis for the processing of the Participant’s personal data would be his or her consent, and where applicable, the performance of the Company's legal duties as an employer and/or issuer of PSUs.

(c)To whom do we disclose such personal data? The Company transfers participant data to Stock Plan Administration Service Providers such as Morgan Stanley, an independent service provider based in the United States, which assists the Company with the implementation, administration and management of the Plan. In the future, the Company may select a different service provider and may share the Participant’s data with another company that serves in a similar manner. The Company’s service provider(s) will open an account for the Participant to receive and trade Shares.

(d)What safeguards are applied to your personal data? We apply and contractually enforce on any service provider or recipient with which we share personal data, separate terms and data processing agreements, to protect the personal data, including by applying various technical and organizational safeguards. Where required we also rely on additional data transfer mechanisms, as further described in the 'International Data Transfers' section below.

(e)Data Retention. The Company will use the Participant’s personal data only as long as is necessary to implement, administer and manage the Participant’s participation in the Plan or as required to comply with legal or regulatory obligations, including under tax and securities laws. When the Company no longer needs the Participant’s personal data, which will generally be seven years after the Participant is granted PSUs under the Plan, the Company will remove it from its systems. If the Company keeps data longer, it would be to satisfy legal or regulatory obligations and the Company’s legal basis would be relevant laws or regulations.

(f)Voluntariness and Consequences of Consent Denial or Withdrawal. The Participant’s participation in the Plan and the Participant’s grant of consent is purely voluntary. The Participant may deny or withdraw his or her consent at any time. If the Participant does not consent, or if the Participant withdraws his or her consent, the Participant cannot participate in the Plan. This would not affect the Participant’s salary as an employee or his or her career; the Participant would merely forfeit the opportunities associated with the Plan.

(g)Data Protection Officer - The Company has appointed a “Data Protection Officer” who is responsible for matters relating to privacy and data protection. If you have any questions about this Policy, please contact our Data Protection Officer via privacy@varonis.com.

5.21.Insider-Trading/Market-Abuse Laws. The Participant acknowledges that, depending on his or her country of residence or the country of residence of the Participant’s broker, the Participant may be subject to insider-trading restrictions and/or market-abuse laws, which may affect his or her ability to accept, acquire, sell or otherwise dispose of Shares, rights to Shares (e.g., PSUs) or rights linked to the value of Shares during such times as the Participant is considered to have “inside information” regarding the Company, as defined by the laws or regulations in the Participant’s country. Local insider trading laws and regulations may prohibit the cancellation or amendment of orders placed by the Participant before the Participant possessed inside information. Furthermore, the Participant could be prohibited from (i) disclosing the inside information to any third party (other than on a “need to know” basis) and (ii) “tipping” third parties or causing them otherwise to buy or sell securities. Note that third parties include fellow employees. Any restrictions under these laws or regulations are separate from and in addition to any restrictions that may be imposed under any applicable Company insider trading policy. The Participant acknowledges that it is his or her responsibility to be informed of and compliant with such regulations, and the Participant should speak to his or her personal legal advisor on this matter.

5.22.Language. If the Participant has received this Agreement or any other document related to the Plan translated into a language other than English and if the meaning of the translated version is different than the English version, the English version will control.

5.23.Imposition of Other Requirements. The Company reserves the right to impose other requirements on the Participant’s participation in the Plan, on the PSUs and on any Shares acquired under the Plan, to the extent the Company determines it is necessary or advisable for legal or administrative reasons, and to require the Participant to sign any additional agreements or undertakings that may be necessary to accomplish the foregoing.