Proofpoint to Acquire Varonis for $6.3 Billion Deal

Proofpoint, owned by Thoma Bravo, has signed an agreement to acquire Varonis Systems for approximately $6.3 billion, entirely in cash. The announcement was made on Thursday, October 15. Varonis shareholders will receive $49.75 per share, a 52% premium over the closing price of June 22, which was $32.71, the last trading day before rumors of the sale surfaced, according to the companies' statement.

The Varonis board unanimously approved the transaction. The closing is expected in the first half of 2027, subject to shareholder votes and regulatory approvals. Upon completion, the company will delist from Nasdaq and become privately held.

Who Pays and How

Thoma Bravo will contribute committed equity and has already secured debt commitments to finance the purchase. The Ontario Teachers' Pension Plan, the pension fund for teachers in the Canadian province of Ontario, has agreed to invest in Proofpoint as part of the deal, according to the statement.

The structure follows a formula that Thoma Bravo employs in security software: taking a recurring revenue asset public and consolidating it within a platform it already controls. The firm has owned Proofpoint since 2021, and in June, Bloomberg reported that Varonis was receiving inquiries from funds such as Blackstone, Thoma Bravo, and Vista Equity Partners. The winner was someone who already had the complementary piece at home.

Bloomberg Law treated the agreement as a sign of a resurgence in technology mergers, and the price helps explain why: $49.75 per share offered by Varonis is much higher than the market accepted in June, when the stock was valued at $32.71.

Why Data, and Why Now

Proofpoint has built its business around protecting email and users. Varonis does something different: it maps where sensitive data resides within a company, who is authorized to access it, and who actually accesses it. Together, according to the statement, they will serve over 16,000 businesses.

Sumit Dhawan, CEO of Proofpoint, justified the acquisition by pointing to AI agents: they are increasingly accessing sensitive information and performing actions across systems, requiring companies to understand how data is actually used. This is the business argument for 2026 for the category. A corporate copilot inherits the permissions of its user; if a junior analyst has unauthorized access to an HR folder, the agent does too. Knowing who can read what has transitioned from a task for annual audits to a prerequisite for activating the agent.

Yaki Faitelson, co-founder and CEO of Varonis, stated that the deal results from an evaluation conducted by a committee of independent advisors and called the sale a recognition of the two decades of work by the team.

What Changes for Those Purchasing Security

For the CISO, the first consequence is contractual. Varonis clients who signed on with the expectation of an independent, publicly listed provider will now negotiate with a privately held, private equity-controlled company that has a different pricing and packaging logic. In mergers driven by private equity in software, the portfolio often becomes a suite, and discounts tend to depend on how many modules the client takes.

In the United States, the immediate effect is the exit of another mid-sized security name from the stock market, reducing options for investors seeking pure exposure to data protection. In Canada, the entry of Ontario Teachers' shows that pension funds remain willing to finance leveraged security software despite higher interest rates.

In Europe, the channel is regulatory. Companies subject to GDPR and operational resilience rules in the financial sector, such as DORA, purchase data governance tools specifically to prove to regulators who accesses personal information. For them, the practical question is whether Varonis's product will continue to be sold separately or will require the entire Proofpoint platform.

In Brazil, the interpretation is similar, with LGPD standing in place of GDPR. Banks and insurers that use classification and access monitoring tools to respond to ANPD and the Central Bank rely on local integrators, and renegotiating reseller contracts is often the first move after a change in control.

The closing timeline creates a useful window for the corporate buyer. Until the first half of 2027, Varonis and Proofpoint will continue as separate companies, subject to antitrust rules that prevent commercial coordination before approval. Those with renewals scheduled in the coming months negotiate with a supplier that still needs to demonstrate independence, and this bargaining power evaporates on the day the deal is completed.