Proofpoint to buy Varonis for $6.3 billion in year's largest cybersecurity deal

Proofpoint, the email-security company owned by the private equity firm Thoma Bravo, agreed to buy the data-security vendor Varonis Systems for roughly $6.3 billion in cash, the two companies announced Thursday, in what trade publication SecurityWeek described as the largest cybersecurity acquisition announced so far this year. The deal combines a company built on stopping email-borne attacks with one built on tracking who, or what, can touch an organization's data, and both companies frame the combination around a specific new worry: software agents that can read and move corporate data on their own.

Under the terms disclosed in Proofpoint's announcement, Varonis shareholders will receive $49.75 in cash per share. Varonis's board approved the merger agreement unanimously after a committee of independent directors solicited interest from other potential buyers, according to the companies.

The numbers

The per-share price represents a 52 percent premium over Varonis's $32.71 closing price on June 22, 2026, the last full trading day before the first reports that the company had drawn takeover interest, and a 17 percent premium over its $42.35 close on September 1, the day before a second round of deal reports surfaced. Based on figures in the merger announcement filed with the Securities and Exchange Commission, the transaction values Varonis at roughly 8.4 times its trailing 12-month revenue and about 53 times its trailing free cash flow, measured as of June 30.

Thoma Bravo is financing the purchase with committed equity and secured debt financing, and the Ontario Teachers' Pension Plan has agreed to invest in Proofpoint alongside the buyout firm as part of the transaction, the filing says. The deal includes a $211.7 million termination fee payable by Varonis and a $423.3 million reverse termination fee payable by Proofpoint under specified circumstances, according to the SEC filing. Varonis's chief executive, Yaki Faitelson, has signed a support agreement backing the deal with his roughly 0.67 percent stake in the company.

The companies expect the deal to close in the first half of 2027, pending approval from Varonis shareholders and regulators. Varonis will stop trading on the Nasdaq exchange and become a private company once the transaction closes, and in the meantime the two firms will continue operating separately. Varonis said it will still report third-quarter results after markets close on November 3 but will not hold an earnings call because of the pending transaction.

How the deal came together

Thoma Bravo took Proofpoint private in 2021 in a deal valuing the company at about $12.3 billion, and has since been folding in smaller acquisitions to build out an "agentic" security product line; Proofpoint bought the AI security and governance startup Acuvity in February. Varonis, founded in 2004 and taken public a decade later, built its business on a comparatively narrow premise — that most breaches hinge less on the perimeter than on exactly which files, databases and cloud repositories an attacker (or an unauthorized employee) can actually reach. That same logic, the companies now argue, applies to AI systems: an autonomous agent with excessive access to sensitive data is itself a security gap, whether or not a human is doing anything wrong.

Reports that Proofpoint was circling Varonis first surfaced over the summer, when Bloomberg and other outlets described early-stage talks and no agreed price; Varonis shares jumped on each round of reporting before Thursday's formal announcement made the numbers official. Varonis itself had been shopping in the same direction, closing its purchase of the AI-risk startup AllTrue.ai in February for a price reported at around $150 million.

Who is affected

The companies say the combined business will serve more than 16,000 enterprise customers. On the Proofpoint side, that includes, by the company's own account, more than 80 of the Fortune 100 and some 14,000 large organizations that rely on it to filter phishing, business email compromise and malware out of inboxes and collaboration tools. Varonis told its customers in a blog post that account teams, contract terms and support channels will not change for the time being, and that nothing is different for them until the deal closes next year.

Varonis's roughly 2,400 employees face the more immediate uncertainty that typically accompanies a take-private acquisition, including how much of the company's engineering, sales and support organization survives an eventual integration with Proofpoint's. Neither company's public materials address staffing or site plans beyond generic language about combining capabilities after the deal closes.

Shareholders, for their part, are being offered a clean cash exit rather than the stock-and-uncertainty structure of many tech mergers — a detail that analysts following the deal flagged as part of why Varonis's board accepted a bid at single-digit revenue multiples rather than holding out, or going public with a sale process, during what has otherwise been a hot market for cybersecurity assets.

Reaction

Both chief executives framed the deal in almost identical language, around the idea that AI agents now represent a new category of insider risk.

"AI agents are increasingly accessing sensitive information and taking action across systems," said Sumit Dhawan, Proofpoint's chief executive, who called the acquisition "a defining step in Proofpoint's evolution into a cybersecurity platform built for the future of AI."

Faitelson, who co-founded Varonis and has run it since its public listing, said in the same announcement that the deal would let the two companies "become one of the leading cybersecurity companies in the world," and described the all-cash offer as delivering "immediate, significant, and certain value" relative to the risks of continuing as a standalone public company. He added that Varonis and Proofpoint will operate independently "until the combination closes as expected in the first half of 2027."

SecurityWeek, which has tracked more than 300 cybersecurity mergers and acquisitions so far in 2026, noted the deal lands amid a broader consolidation wave in the sector, pointing to the quantum-computing firm IonQ's separate, pending deal to buy the access-security company Elisity for up to $1.3 billion as another recent example of outside capital chasing data- and identity-security assets.

What happens next

The deal still needs sign-off from Varonis shareholders and from antitrust and other regulators, a process the companies expect to take until roughly mid-2027. Varonis is required to file a proxy statement with the SEC ahead of a special shareholder meeting, where investors will get a formal vote on the merger; that filing, once submitted, will likely disclose additional detail on how the board arrived at the $49.75 price, including any competing offers it considered.

Assuming the transaction closes on schedule, Proofpoint has said it intends to integrate Varonis's data-discovery and access-governance tools with its own email- and agent-security products into what the companies are calling a unified data and AI security platform, rather than running Varonis as a separate business line. Until then, Proofpoint and Varonis remain legally separate, competitively run companies — a detail both firms have stressed to customers anxious about disruption to existing contracts in the interim.