Proofpoint agrees to buy Varonis for $6.3 billion to guard what AI agents can reach

Proofpoint agreed on October 15 to buy Varonis Systems for about $6.3 billion in cash. Varonis shareholders will get $49.75 in cash for each share they hold. Thoma Bravo, which owns Proofpoint, is putting up committed equity and has lined up debt commitments. The Ontario Teachers' Pension Plan has also agreed to invest in Proofpoint as part of the transaction. The companies expect to close in the first half of 2027.

What matters is how the two businesses fit together. Proofpoint says its focus is securing the links among people, data and AI agents in email, cloud and collaboration tools. Varonis says it secures AI and the data that powers it. Proofpoint CEO Sumit Dhawan described the goal as "connecting communications, identities, permissions, data, and AI."

The Wall Street Journal's James Rundle framed the buyer's motive as expanding Proofpoint's data-security business as AI changes how corporate information is accessed. That is the central question for security buyers. If software agents now read files and act on them, the controls on what they can reach matter as much as the controls on what arrives in an inbox.

Messages on one side, permissions on the other

Reuters, in a report by Jaspreet Singh, says Varonis's services include data classification on cloud storage systems and tracking of employee behavior. The Miami-based company, founded two decades ago, says its platform gives organizations automated control over, and visibility into, their most critical data no matter where it is stored. It also says the platform helps ensure safe and trustworthy AI "from code to runtime." The Journal summed it up more plainly: Varonis specializes in securing sensitive corporate data and managing access controls.

Proofpoint comes at the problem from the other side. It protects how people, data and AI agents interact across email, cloud and collaboration tools. Its customers include more than 80 of the Fortune 100, more than 14,000 large enterprises and millions of smaller organizations.

Dhawan's argument for the deal turns on agents. He said that as AI spreads through the enterprise, the data it is able to reach decides how valuable it is and also how risky it is. AI agents increasingly reach sensitive information and take actions across systems, so organizations need to know what data needs protecting, who can get to it and how it's actually being used. He pitched the combination as an "intelligence advantage" that helps customers see risk more clearly and respond faster, and called it a defining step in Proofpoint's evolution into a platform built for AI.

Varonis CEO, co-founder and chairman Yaki Faitelson framed it from his side: the mission is securing AI and the data behind it, and Proofpoint lets Varonis do that faster.

Here is our reading, not the companies'. Dhawan's three questions split fairly neatly between the two companies' existing products. Classification answers what needs protecting, and access controls answer who can reach it. Behavior tracking on the Varonis side and Proofpoint's view of email and collaboration traffic both speak to how data is actually used.

That suggests the pitch rests on capabilities each side already sells rather than on something yet to be built. For organizations giving AI assistants or agents access to shared drives and cloud storage, the combined company's goal lines up closely with the controls that rollout calls for. Whether stitching the two views together produces the faster response Dhawan describes is the part that only the integrated product can show.

A premium set by a public run-up

The Wall Street Journal reported that the deal comes as artificial-intelligence security continues to drive deals and investment across the cybersecurity industry. Reuters added the demand side: businesses are ramping up cybersecurity spending to combat cybercrime, where AI is increasingly being used to steal data.

The two premiums rest on two reference prices: a $32.71 close on June 22 and a $42.35 close on September 1, according to the companies' announcement. An insider filing offers one more pre-rumor marker. A Form 4 from general counsel Dov Gottlieb shows shares withheld for taxes on vesting restricted stock units on May 31 were valued at $34.15, and notes that no shares were sold.

Reuters tracked the run-up. In June, media outlets reported that Varonis was weighing a sale after private equity firms showed takeover interest, and the shares jumped about 30%. In September, Reuters itself reported that Proofpoint was in talks. After the announcement, Varonis shares rose about 2.7% in extended trading.

Put those numbers side by side and most of the premium was already in the stock before the deal was signed. The gap between a 52% headline premium and a 17% premium over the September price, plus a modest after-hours move, suggests investors had largely priced in a sale at roughly this level.

Reuters put the offer's equity value at $5.71 billion, against the $6.3 billion headline transaction value. The Varonis board approved the deal unanimously. Faitelson said a committee of independent directors ran the evaluation and contacted both strategic and financial buyers.

His case to shareholders was about certainty. He said the price offers value that is immediate, significant and certain, and that it comes in well above what Varonis could expect, once risk is factored in, from carrying out its standalone plan. That is the board choosing cash now over executing its own roadmap. Goldman Sachs acted as Varonis's exclusive financial advisor, with Paul Hastings as legal counsel. BofA Securities, Morgan Stanley, J.P. Morgan Securities, UBS Securities and Mizuho Securities advised Proofpoint, with Kirkland & Ellis as counsel.

Proofpoint's second big buy in about a year

Varonis is Proofpoint's second large deal in roughly 12 months, as BV Swagath noted for Verdict, a GlobalData brand. In December 2025, Proofpoint closed its $1.8 billion purchase of Hornetsecurity Group, a European provider of AI-powered Microsoft 365 security, data protection, compliance and security awareness tools. Hornetsecurity sells to managed service providers and small and midsize businesses.

The two deals point in different directions. Hornetsecurity extended Proofpoint toward smaller customers reached through service providers, while Varonis adds a data-permissions layer aimed at enterprises. On scale, Reuters noted that Thoma Bravo took Proofpoint private in 2021 in a deal that valued the company at about $12.3 billion, so the Varonis price is roughly half of what Proofpoint itself fetched five years ago.

The companies say the combined business will serve more than 16,000 enterprises and millions of organizations, making it one of the world's leading pure-play cybersecurity companies and, in their words, the industry's largest data and AI cybersecurity organization. Proofpoint alone counts more than 14,000 large enterprises. The two figures use different labels, so they do not line up exactly.

Two vendors until the deal closes

Until closing, Proofpoint and Varonis remain separate, independent companies. Afterward, Proofpoint says it will move quickly to integrate the two companies' capabilities, align their sales efforts and speed up delivery of the combined platform. Varonis will then leave the Nasdaq and become a private company.

That timing is the strongest argument against reading too much into the deal yet. The unified platform is a plan, and it depends on a shareholder vote and regulatory approvals that are still months off. Anyone evaluating data security this quarter is buying each company's products as they ship today.

Varonis scheduled its third-quarter 2026 results for release after the U.S. market close on November 3 and, because of the pending deal, said it would not hold an earnings call. The next documented step is a proxy statement Varonis intends to file with the SEC ahead of a special meeting at which stockholders will vote on the merger agreement. Regulatory approvals must also come through before closing.

The first real look at the combined product will come after closing, when Proofpoint shows what one platform covering both the message and the file permission actually includes.