Business

Proofpoint agrees $6.3bn cash deal to buy data security firm Varonis

Thoma Bravo-owned Proofpoint will buy Varonis for $49.75 a share. What the $6.3bn deal means for UK customers of both vendors.

Illustration with a rising chart motif and the headline Proofpoint to buy Varonis for $6.3bn

Thoma Bravo-owned Proofpoint has agreed to buy Varonis Systems for $49.75 a share in cash, a deal worth about $6.3bn. For UK organisations that use either vendor, this is the moment to start planning for contract renewals, product roadmaps and a smaller choice of independent data security suppliers.

What happened

On 15 October 2026, Proofpoint and Varonis announced a definitive merger agreement under which the email and human-risk security company will take the Nasdaq-listed data security specialist private. Varonis shareholders will receive $49.75 for each share, valuing the business at roughly $6.3bn.

The companies set the price against two earlier reference points. Measured against Varonis’s $32.71 close on 22 June, the last full trading day before sale rumours first circulated, it is a 52% premium. Against the $42.35 close on 1 September, just before further press reports of talks, it is a 17% premium. The joint release puts the valuation at about 8.4 times trailing revenue and 53 times trailing free cash flow.

In early September, Reuters and The Wall Street Journal reported talks between the two, lifting Varonis shares by more than 10%, according to Verdict and Calcalist. Bloomberg Law reported that the companies confirmed the agreement after an earlier Bloomberg News scoop, and placed the deal within a wider recovery in private equity-backed technology dealmaking following this year’s slump in software valuations.

The Varonis board approved the deal unanimously, following what the company described as a review led by a committee of independent directors. The parties are aiming to complete during the first six months of 2027, once Varonis shareholders have voted and regulators have signed off. Until then the two businesses will operate separately. Varonis will publish third-quarter results on 3 November but will not hold an earnings call.

The detail

Funding comes from Thoma Bravo, which is supplying committed equity and has arranged debt financing commitments. Thoma Bravo took Proofpoint private in 2021 for about $12.3bn. The Canadian pension fund Ontario Teachers’ is putting money into Proofpoint as part of the deal.

According to a TradingView summary of the related 8-K filing, Varonis would owe a $211.7m termination fee in certain circumstances, and Proofpoint would owe a reverse termination fee of $423.3m. Yaki Faitelson, Varonis’s co-founder and chief executive, has also signed a support agreement to vote his stake, roughly 0.67%, in favour of the deal.

The strategic case rests on AI. Proofpoint chief executive Sumit Dhawan argued that as AI agents reach into sensitive information and act across systems, organisations need to know how data is actually being used, not only who can reach it. He described the deal as a defining step in Proofpoint’s move to an AI-era platform. Faitelson summed up the Varonis mission as securing “AI and the data that powers it”.

Once merged, the business says it will serve more than 16,000 enterprises. It plans a single platform that discovers and protects sensitive data, controls what people and AI tools can access, and prevents data loss. Calcalist reported in September that Varonis was forecast to make about $735m of revenue in 2026 with only a thin operating profit.

Timeline of Proofpoint's acquisition of Varonis from June 2026 rumours to expected completion in the first half of 2027

Why it matters for UK organisations

Neither company’s announcement mentions the UK, so what follows is my own assessment, not a claim made by the companies or by the press coverage.

Both vendors are widely used across UK organisations: Proofpoint commonly sits in front of Microsoft 365 mailboxes, and Varonis is often used to map permissions on file shares, SharePoint and cloud storage. Once the deal completes, those customers will be dealing with a single, larger supplier owned by private equity, with all the change in commercial behaviour that can bring.

Three practical issues stand out. First, contracts. A take-private backed by debt usually brings pressure to grow revenue, and in my experience that tends to show up as repackaging, bundling and tougher renewal terms. Second, roadmaps. During any integration some products receive investment while others are left to drift, so organisations relying on a particular Varonis module or Proofpoint add-on should ask directly what happens to it. Third, concentration risk. If one supplier handles email filtering, data classification, access analytics and data loss prevention, that supplier becomes a single point of failure and a high-value target for attackers.

There is a regulatory angle too. Data discovery and access governance tooling often forms part of the evidence UK organisations rely on under UK GDPR, and for operators who may fall under the Cyber Security and Resilience Bill once it passes. Any disruption to that tooling, or a forced migration to a different product, needs to be handled without leaving gaps in that evidence.

Expert view

The logic here is sound. Email is still one of the most common ways in for attackers, and data is what they are after. Joining the control at the front door to the visibility over what sits behind it is a reasonable bet, especially now that AI assistants can surface overshared files in seconds. When we test Microsoft 365 environments, excessive permissions on file shares and collaboration sites are among the most dependable ways to escalate access, and AI tools only make that exposure easier to exploit.

That said, a joined-up platform on a slide is not the same as a joined-up product. Mergers on this scale tend to take years to integrate properly, and customers often spend that time running two consoles, two agents and two support routes. Paying more than eight times revenue for a business with modest profits also means the new owner will want returns, and customers will be part of how it gets them.

There is no security reason to rip anything out today, but there is a commercial and resilience reason to know your position before the deal closes.

What to do now

  1. Map your exposure. List every Proofpoint and Varonis product you run, the renewal date for each, and which business processes or compliance evidence rely on it.
  2. Review contract terms. Look for change-of-control clauses, price caps and termination rights. If a renewal falls due before mid-2027, think about locking in terms now rather than negotiating with the merged company later.
  3. Ask about roadmaps in writing. Get written statements from your account teams on support lifetimes for the modules you depend on.
  4. Do not let access hygiene depend on one tool. Keep tightening permissions and removing stale accounts whatever happens to the vendor. This maps directly to the Cyber Essentials user access control and secure configuration requirements.
  5. Assess concentration risk. If one supplier will cover email, data loss prevention and data governance, record that in your third-party risk register and test what happens if that platform fails or is compromised.
  6. Keep an exit option warm. Make sure data classification labels, policies and reports can be exported in formats another tool could use.

Bottom line

Proofpoint’s $6.3bn deal for Varonis is a big bet that email security and data governance belong together in the AI era. It may well pay off, but for UK customers the next 12 months are about commercial discipline: know which contracts you hold, understand your dependencies and keep control of your data posture whatever the vendor landscape looks like.

Sources

Related Posts