Proofpoint to Buy Varonis for $6.3 Billion in Cash, Creating a Data and AI Security Giant

SUNNYVALE, Calif.

Cybersecurity's consolidation wave produced one of its largest deals of the year this week, and it explains itself in a single sentence: the attacks now run through data and artificial intelligence, so the defenses are merging to follow them. Proofpoint, the Thoma Bravo-owned company known for protecting email and people, has agreed to acquire Varonis Systems, the data security company, in an all-cash transaction valued at about 6.3 billion dollars, the companies announced on Thursday, October 15. The deal will take Nasdaq-listed Varonis private, is expected to close in the first half of 2027, and — by the companies' own description — will create one of the world's largest pure-play cybersecurity companies and the industry's largest organization focused specifically on data and AI security.

The price tells the story of how contested this asset was. Varonis shareholders will receive 49.75 dollars per share in cash. That is a premium of 52 percent to Varonis' closing price of 32.71 dollars on June 22, the last full trading day before the first rumors of a possible sale, and a premium of 17 percent over its 42.35-dollar close on September 1, the last trading day before a second round of reporting about a potential deal. Reuters, which had reported in September that the two companies were in discussions, put the equity value of the offer at about 5.71 billion dollars, and Varonis shares rose roughly 2 to 2.7 percent in extended trading after the announcement — a muted move that mostly reflects how much of the premium the market had already priced in during months of speculation. In June, when Varonis was first reported to be weighing a sale after fielding takeover interest from private equity firms, its shares surged about 30 percent.

What each company brings

The two halves of this combination were built for two different eras of the same problem. Proofpoint, based in Sunnyvale and taken private by Thoma Bravo in 2021 in a deal that valued it at about 12.3 billion dollars, sells software that defends the human layer: email security, protection against phishing and impersonation, and increasingly the security of AI agents acting on people's behalf. Varonis, headquartered in Miami and founded in 2004, works from the data outward: its platform finds and classifies sensitive data across cloud storage systems, reduces how much of it is exposed and to whom, tracks employee behavior around it and uses AI-driven automation to detect threats. Reporting by Calcalist put Varonis' workforce at roughly 2,800 people worldwide, including about 1,000 in Israel, where the Israeli-founded company maintains a major development center in Herzliya.

Put together, the companies say, the platform is meant to let organizations adopt AI with confidence: find and protect sensitive data, control what people and AI systems can access, and stop data loss. The combined company will serve more than 16,000 enterprises and, counting smaller organizations reached through partners, millions of organizations globally. Proofpoint said it intends to move quickly after closing to integrate the two companies' capabilities, align their sales efforts and accelerate delivery of the combined platform. The transaction values Varonis at approximately 53 times its last twelve months of free cash flow and 8.4 times its last twelve months of revenue — multiples that only make sense if the buyer believes data security spending is about to be reorganized around AI, and wants to own the shelf when it happens.

How the deal is financed and approved

The structure is standard for a Thoma Bravo take-private, with one notable addition. Thoma Bravo is providing committed equity financing and has secured debt financing commitments to fund the purchase. The Ontario Teachers' Pension Plan has agreed to make an investment into Proofpoint in connection with the transaction, bringing a large institutional co-investor into the combined company's capital structure. The deal has been unanimously approved by Varonis' board of directors and is subject to the customary closing conditions, with completion expected in the first half of 2027 — a long runway that reflects both regulatory review and the practical work of combining two security platforms without breaking either.

The advisory benches were crowded on both sides, as they tend to be at this size. Goldman Sachs advised Varonis. BofA Securities, Morgan Stanley, J.P. Morgan Securities, UBS Securities and Mizuho Securities advised Proofpoint, according to Reuters' reporting of the announcement. Varonis co-founder, chairman and chief executive Yaki Faitelson framed the sale as mission acceleration: Varonis' mission is to secure AI and the data that powers it, he said, and by joining forces with Proofpoint the company can pursue that mission faster than it could alone. He called the transaction an excellent outcome for shareholders, delivering immediate and certain value above what he described as the risk-adjusted value of Varonis' standalone plan.

Why this deal, why now

The strategic logic is the same one driving the week's other cybersecurity news, including the federal courts' contractor incident elsewhere in this morning's coverage: attackers increasingly use AI to find and steal data faster, and defenders are racing to cover the places AI can now reach. Email was the front door of the last era; data stores and AI agents are the front door of this one. A combined Proofpoint and Varonis can, in theory, sell a chief information security officer a single platform that watches both — who and what is trying to get in, and what they would take if they succeeded. Whether integration delivers that in practice is the standard unanswered question of every large security merger, and customers of both companies will spend the months before closing asking it, along with the usual questions about roadmaps, pricing and which overlapping products survive.

There are dates to watch. Varonis said it will release its third-quarter results after the market close on November 3, but will not hold an earnings conference call — the customary quiet of a company with a signed deal in front of it. Shareholder and regulatory steps will follow ahead of the expected first-half 2027 close. And the sector will watch whether this combination triggers the next one: cybersecurity has spent two years consolidating around AI, and a 6.3-billion-dollar all-cash deal at a 52 percent premium to the pre-rumor price is exactly the kind of comparable that bankers carry into the next boardroom. For now, the announcement stands as the clearest price tag yet on a simple industry conclusion — in the AI era, the data is the perimeter, and the perimeter is worth paying up for.