Proofpoint to acquire Varonis Systems in $6.3 billion cybersecurity deal

Proofpoint, the email-security company controlled by private equity firm Thoma Bravo, has agreed to acquire Varonis Systems, a publicly traded data-security specialist, in an all-cash deal valued at roughly $6.3 billion. The companies announced the definitive merger agreement on Thursday, setting up one of the largest cybersecurity transactions of the year and extending a wave of consolidation among companies that sell tools to protect corporate data as artificial intelligence systems gain broader access to it.

Under the terms disclosed in a securities filing, Varonis shareholders will receive $49.75 in cash for each share they hold. That price is a 52 percent premium over the company's closing price on June 22, the last full trading day before reports of a possible sale first surfaced, and a 17 percent premium over its September 1 close, the day before a fresh round of media reports on the talks. The transaction, outlined in a filing with the Securities and Exchange Commission, values Varonis at about 53 times trailing free cash flow and 8.4 times trailing revenue for the twelve months ended June 30. The equity component of the deal comes to roughly $5.71 billion; the balance of the headline $6.3 billion figure reflects debt and other obligations the combined company will carry. Varonis shares rose about 2.7 percent in after-hours trading once the news broke, a modest move that reflected how closely the final price tracked the terms that had already leaked to the market in the preceding weeks.

A consolidation wave built on AI anxiety

The deal is as much a story about Thoma Bravo's ambitions as it is about any single company. The buyout firm took Proofpoint private in 2021 in a transaction that valued it at about $12.3 billion, and it has since used the company as a platform to bolt on smaller acquisitions, including email-security provider Hornetsecurity, reportedly bought for more than $1 billion, and the AI-security startup Acuvity earlier this year. Varonis, for its part, bought the AI-security firm AllTrue.ai for $150 million, a deal that previewed the thinking now driving its own sale.

That thinking centers on a shift in how corporate data gets exposed. Where traditional cybersecurity spending focused on keeping intruders out of networks and inboxes, both companies have been racing to address a newer problem: AI agents and large language models that are granted sweeping access to internal files, customer records and intellectual property, often with far less oversight than a human employee would face. Proofpoint's pitch is that pairing its threat-intelligence and email-security business, which it says screens more than 2 trillion emails a year for its customers, with Varonis's data-mapping technology, which tracks where sensitive files live and who or what can reach them, creates a single platform that can both stop external attacks and police internal access by people and software alike. A statement from Thoma Bravo framed the combination as creating what the firms are calling the industry's largest dedicated data and AI security organization, serving more than 16,000 enterprise customers between them.

Who stands to be affected

Varonis employs roughly 2,800 people worldwide, including about 1,000 at its research-and-development hub in Herzliya, Israel, where the New York-listed company traces its founding roots. Those employees now face the standard uncertainty of a take-private transaction: Proofpoint has said only that it intends to integrate the two companies' technology and go-to-market operations quickly after closing, without detailing specific plans for overlapping staff, offices or product lines. Varonis shareholders, by contrast, get a clean and immediate outcome — a cash exit at a fixed price rather than continued exposure to the stock's volatility, which had swung sharply in both directions as sale speculation built over the summer. Once the deal closes, Varonis shares will stop trading on the Nasdaq and the company will report financial results only as part of Proofpoint's private operations; it has already said it will release third-quarter results on November 3 without holding an earnings call, a detail that signals management does not expect the deal timeline to be disrupted by a disappointing quarter.

The financing structure also pulls in outside capital. Thoma Bravo is supplying committed equity and has lined up debt financing commitments to fund the purchase, and Ontario Teachers' Pension Plan has agreed to invest in Proofpoint as part of the transaction, giving the Canadian pension fund a stake in the combined company. On the advisory side, Goldman Sachs served as Varonis's financial adviser while Proofpoint lined up BofA Securities, Morgan Stanley, J.P. Morgan, UBS and Mizuho, a roster that underscores how large banks view even a mid-sized cybersecurity deal as worth a multi-bank syndicate.

What the companies are saying

Varonis co-founder, chief executive and chairman Yaki Faitelson framed the sale as the product of a board review that weighed the certainty of a cash deal against the risks of remaining independent in a market he has repeatedly described as being reshaped by artificial intelligence.

"Our mission is to secure AI and the data that powers it," Faitelson said in the companies' joint announcement, describing the agreement as representing "a realization of immediate, significant, and certain value" for shareholders.

Proofpoint chief executive Sumit Dhawan, in turn, cast the acquisition less as a bolt-on than as a redefinition of his company's core business. "This is a defining step in Proofpoint's evolution into a cybersecurity platform built for the future of AI," Dhawan said, adding in commentary reported by the cybersecurity outlet CyberScoop that the data an AI system can reach now determines both its usefulness and its risk to the organization that deployed it. Neither executive's public remarks addressed headcount or office consolidation directly, and the companies' statements have so far been largely silent on integration specifics beyond the broad commitment to a unified product platform.

Regulatory hurdles and a long runway to closing

The deal still needs clearance on two fronts: approval from Varonis shareholders and the usual antitrust and foreign-investment review that accompanies a transaction of this size, particularly one involving a company with a substantial Israeli research and development presence. The companies are not projecting a quick turnaround. They have told investors to expect the acquisition to close in the first half of 2027, a runway of several months that gives regulators time to scrutinize the tie-up and gives Proofpoint time to plan the integration it has promised. Reuters reported in September that Proofpoint was already in talks to acquire Varonis, meaning the formal announcement capped weeks of market speculation rather than introducing a surprise.

Until the deal closes, Varonis and Proofpoint will continue operating as separate, independent companies, each run by its existing management team. Analysts covering the broader cybersecurity sector will be watching whether the price Thoma Bravo agreed to pay — a premium well above where Varonis traded before sale rumors began, but one still built on a trailing-revenue multiple that some growth-software investors would consider conservative for an AI-adjacent asset — sets a marker for how the market values data-security specialists going forward. Coverage from the Israeli outlet Calcalist noted that the deal adds to a lengthening list of Israeli-founded cybersecurity companies absorbed by larger, often private-equity-backed buyers this year, a trend that has drawn attention in Israel's tech sector even as it has barely registered as a macro story in the United States.