Proofpoint to Buy Varonis for $6.3 Billion as AI Agents Redraw the Security Perimeter

Proofpoint, the cybersecurity company owned by Thoma Bravo, agreed on Thursday, 15 October 2026 to buy Varonis Systems in an all-cash deal valued at about $6.3 billion. Varonis shareholders will receive $49.75 a share. The board approved the agreement unanimously, and the companies expect to close in the first half of 2027, subject to a shareholder vote and regulatory approvals. Until then they remain separate businesses. On completion, Varonis stops trading on Nasdaq and becomes private.

Related reading: Leakers$ Hijacked Public LED Billboards in Egypt, Malaysia and Brazil · CISA Flags PolyShell as Exploited While the Magento Campaign Hits Hundreds of Stores.

SecurityWeek calls it the largest cybersecurity acquisition announced so far in 2026, based on its running tally of more than 300 security M&A deals this year. The size is the headline, but the reasoning behind it is narrower. Proofpoint is buying the layer of software that works out where sensitive data sits and who, or what, can reach it, because AI agents now hold credentials and act inside the same systems.

The announcement is a definitive agreement, not a completed deal, and that matters for customers, employees and shareholders.

What the two companies actually sell

Varonis, based in Miami and founded in 2005, sells a SaaS platform that finds and classifies sensitive data across cloud, SaaS and on-premises systems, maps who can reach it, and monitors how it is used. Atlas, its AI product, inventories models and agents, manages posture, tests security, sets runtime guardrails and reports for compliance. Varonis also sells email and browser security and a managed data detection and response service, and announced a $150 million deal to buy AI trust provider AllTrue.ai earlier in 2026, SecurityWeek reported.

Proofpoint, based in California and founded in 2002, built its business on email protection against phishing, business email compromise and malware. It has since added identity threat defense, data loss prevention, insider risk and data security posture management. Its AI security product watches how employees and agents use AI tools and flags actions that depart from the user's request or company policy. Proofpoint bought the AI governance company Acuvity in February 2026 and says it serves more than 80 of the Fortune 100 and 14,000 large enterprises, according to the announcement.

Both companies now sell something called data security, which makes the overlap look larger than it is. Varonis starts from the data: what exists, where it lives, which identities can open it. Proofpoint starts from behaviour: what a person or an agent is doing in email, in a browser or in a cloud app. Sumit Dhawan, Proofpoint's chief executive, described the split to CRN as signals of intent on one side, signals at the data layer on the other.

The companies say the combined business would have more than 8,000 employees and more than $3 billion in annual recurring revenue, figures from the companies rather than a filing. Varonis had just under $800 million in ARR at the end of June and Proofpoint about $2.5 billion, according to CRN.

The arithmetic behind $6.3 billion

The premium has two numbers, and which one you use changes the story. The $49.75 offer is 52% above Varonis' close of $32.71 on 22 June 2026, the last full trading day before the first rumours of a sale. It is 17% above the $42.35 close on 1 September 2026, the last trading day before further media reports.

The multiples are steeper than the premium suggests. Proofpoint values Varonis at roughly 53 times trailing twelve-month free cash flow and 8.4 times trailing revenue, both measured to 30 June 2026. The press release footnotes the first as market capitalisation divided by free cash flow and the second as enterprise value divided by revenue, which means the two ratios do not share a denominator.

Run the announced figures backwards and they imply about $750 million of trailing revenue and $119 million of trailing free cash flow. Those are derived numbers, not disclosed ones: they assume the $6.3 billion valuation maps cleanly onto both multiples, and the footnotes show the two use different bases. The revenue figure is close to the roughly $800 million ARR Varonis reported for June, which makes the 8.4x revenue multiple the easier one to defend. At 53 times cash flow, the price leaves little room for a slow integration.

Thoma Bravo is funding it with committed equity and secured debt. Ontario Teachers' Pension Plan has agreed to invest into Proofpoint alongside the transaction. Goldman Sachs advised Varonis; BofA, Morgan Stanley, J.P. Morgan, UBS and Mizuho advised Proofpoint.

Why agents moved data to the centre

For most of the past decade, the security industry treated identity as the perimeter: verify the user, apply least privilege, watch for anomalous logins. That model assumes a person behind every session and a login that can be challenged. AI agents break both assumptions. They authenticate with tokens or service accounts, inherit the permissions of whoever deployed them, chain tools together, and act faster than any human approval step. A permission that was tolerable for an employee becomes a much larger exposure when software can use it thousands of times an hour.

The useful question becomes what an agent can reach, and what it is touching right now. Answering it requires an inventory of sensitive data, a map of the permission paths that lead to it, and runtime visibility into the access that actually happens. Varonis supplies the first two. Proofpoint supplies the third, at least for the channels it already covers.

Dhawan's argument in the announcement is that AI's value and its risk both depend on the data it can reach. He added that agents increasingly reach sensitive information and act across systems, so companies need to know what has to be protected, who can reach it, and how it is used.

"As AI becomes embedded across the enterprise, the data it can access determines both its value and its risk."

Both companies have research teams that give the pitch some substance. Varonis researchers got attention in August by manipulating Microsoft's Copilot Personal assistant into explaining how to hack itself, The Register reported. Proofpoint analysts published research this month on an apparently China-backed phishing campaign aimed at espionage, The Record reported. Research output is not the same as product quality. It does show both firms can find flaws in the systems they claim to secure.

What no one has shown yet is the combined platform. Proofpoint says it intends to move quickly after closing to integrate the products, align sales and deliver a unified platform. The two product sets were built separately and will need a shared data model before the agent-visibility story becomes something a customer can buy in one contract.

Why private equity is paying up

Thoma Bravo took Proofpoint private in 2021, and the Varonis deal is a portfolio company buying a public company with equity and debt. That structure explains why the price is easier to bear in private hands. A private owner can absorb integration costs and a year of thin margins without quarterly explanations to public shareholders.

Dhawan told CRN that the combined company would be more attractive to public investors, and that assessing an IPO would be a goal after closing. That points to a familiar endgame: roll two adjacent security assets together, show a larger platform with more recurring revenue, then relist or sell when markets allow. The Varonis purchase is a bet that a data security franchise is worth more inside a bigger platform than on its own.

The price also reflects scarcity. Varonis is one of the few independent, scaled data security companies left; most peers have been absorbed into larger platforms. Security buyers, meanwhile, keep consolidating vendors. SecurityWeek counted more than 300 cybersecurity M&A deals in 2026 to date. The Record noted two large ones: Accenture's plan to take a majority stake in Dragos as part of a broader $4.175 billion transaction, and Cyera's $1 billion purchase of Oasis Security, which closed in September.

The financial case rests on cross-selling. Proofpoint has 14,000 large enterprise customers; Varonis sells a data security product many of them do not buy today. Selling Varonis into that base, and Proofpoint's email and agent controls into Varonis accounts, is the obvious route to growth. The companies have published no synergy target, layoff figure or integration budget, so the return implied by the 53x multiple cannot be checked from outside. Buyers of the debt will have seen more detail than the public has.

What has to happen before it closes

Two approvals stand between the announcement and closing. Varonis needs its owners to vote yes, and the board's unanimous support helps but does not settle it. Regulators must also clear the deal, and the companies have not said which jurisdictions will examine it or what conditions might apply. The first-half 2027 target leaves room for a review, not a long dispute.

Three figures in the announcement need context. The 16,000-enterprise count and the claim to be "the industry's largest data and AI cybersecurity organization" are company statements. The 53x and 8.4x multiples are non-GAAP, use trailing figures to 30 June 2026, and mix enterprise value with market capitalisation. The premiums depend on the date you choose.

Other details remain open. Proofpoint has not said whether it will keep the Varonis brand; Dhawan told CRN the decision would be worked out before closing. There are no announced layoffs, and no detail on how the products will be combined. Varonis reports third-quarter results on 3 November and will skip the earnings call because of the pending transaction, removing the usual venue for questions about the deal. Until closing, the two companies compete in some accounts and partner in others, and nothing changes for customers on the announcement alone.

Integration is the open question. Data security is where AI adoption and agent risk meet, and a vendor that can show a customer what an agent can reach has an easier sales conversation. The price assumes that two separately built platforms can become one product a security team can run. No combined product exists yet. The first release will say more about the price than the multiple does.

Cover image: "Varonis building, Herzliya" by David Shi (דוד שי), CC BY-SA 4.0, via Wikimedia Commons.