Proofpoint has agreed to acquire data security company Varonis for about $6.3 billion in cash, the companies announced on October 15. Varonis shareholders would receive $49.75 per share. Varonis' board approved the transaction unanimously. The deal still needs approval from Varonis shareholders and regulators, and the companies expect it to close in the first half of 2027.
This is a corporate transaction, not a security incident. No vulnerability, breach, or active exploitation is involved. The people most directly affected are organizations that use Varonis or Proofpoint products, or both. Their vendor relationships, product roadmaps, and contracts may change once the two companies combine.
The terms
According to Proofpoint's announcement, the $49.75 per-share price is a 52% premium over Varonis' closing price of $32.71 on June 22, 2026. The companies describe June 22 as the last full trading day before rumors of a possible sale began to circulate. The offer is also a 17% premium over Varonis' $42.35 close on September 1, 2026, which the companies identify as the last trading day before further media reports about a deal.
The deal is all cash. Proofpoint is owned by the private equity firm Thoma Bravo, which is providing committed equity financing and has secured debt financing commitments. Proofpoint says Ontario Teachers' Pension Plan will also invest in the company. Varonis is publicly traded, so its shareholders must vote on the deal, and SecurityWeek reports that Varonis will become a private company once it closes. Regulators must also approve it.
Goldman Sachs is serving as financial advisor to Varonis, and Paul Hastings as its legal counsel. Proofpoint's financial advisors are BofA Securities, Morgan Stanley, J.P. Morgan, UBS and Mizuho, and Kirkland & Ellis is its legal counsel.
Who the two companies are
The Record reports that Varonis was founded in 2005 and is based in Miami. Proofpoint was founded in 2002 and is based in California. The companies say the combined business will serve "more than 16,000 enterprises and millions of organizations globally." Proofpoint's announcement also says the combination will create one of the world's leading pure-play cybersecurity companies.
The companies are presenting the deal as a bet on data and AI security. That covers finding and protecting sensitive data, controlling which people and AI systems can reach it, and data loss prevention (DLP). Both chief executives made AI the center of their statements.
"Our mission is to secure AI and the data that powers it," said Yaki Faitelson, Varonis' CEO, co-founder and chairman.
Sumit Dhawan, Proofpoint's CEO, called the acquisition "a defining step in Proofpoint's evolution into a cybersecurity platform built for the future of AI."
Why AI is central to the pitch
The announcement puts controlling access by AI systems alongside controlling access by people. Enterprises are connecting AI assistants and agents to file shares, collaboration platforms and other data stores. Each of those systems is another identity that can read and move data. Controlling what an AI tool can reach comes down to the same question data security vendors have always tried to answer: who, or what, can see this file, and should it be able to?
SecurityWeek reports that both companies had already been building in this direction. Earlier this year Proofpoint acquired AI security and governance company Acuvity, and Varonis acquired AllTrue.ai for $150 million. According to SecurityWeek, Proofpoint plans to combine the two companies into a unified data and AI security platform after closing. The companies have not given a timeline or said which specific products will be merged.
One of the year's largest security deals
The deal adds to a busy year for cybersecurity acquisitions. SecurityWeek calls it the largest cybersecurity acquisition announced so far in 2026 and says it has tracked more than 300 cybersecurity M&A deals this year. The Record notes that Accenture plans to acquire a majority stake in industrial cybersecurity company Dragos as part of a broader $4.175 billion deal, and that Cyera's $1 billion acquisition of Oasis Security closed in September. The Proofpoint-Varonis price shows that buyers are paying high prices for data and identity controls marketed as answers to AI risk.
What happens next
The companies gave this sequence:
- Now: the definitive agreement is signed and Varonis' board has approved it unanimously.
- Pending: a Varonis shareholder vote, regulatory approvals and other customary closing conditions.
- Expected close: first half of 2027.
Until the deal closes, Proofpoint and Varonis will operate as separate, independent companies.
What It Means for Defenders
No patch is needed, and nothing needs to be done right away. Security teams that depend on either vendor can still prepare for a long integration period.
- Note your contract renewal dates. If a Varonis or Proofpoint renewal falls between now and mid-2027, decide whether you want a shorter term, price protection, or terms that let you exit after a change of control. Talk to your procurement and legal teams before the renewal arrives.
- Get roadmap commitments in writing. Ask your account teams which products, deployment models and integrations they will keep supporting. Spoken assurances given during an acquisition do not always last through integration.
- Update your third-party risk records. A change of ownership is a normal trigger for a vendor risk review. Record the pending acquisition and plan to review the vendor's security attestations and data processing agreements again after closing. Data residency and subprocessor lists can change when two companies combine their infrastructure.
- Check where vendor data flows. DLP and data security tools often hold metadata about your most sensitive files and about who can access them. Make sure you know where that data is stored, who at the vendor can reach it, and how notifications would work if subprocessors or hosting change.
- Review service accounts and API credentials. Data security tools usually need broad read permissions on file servers, cloud tenants and directories. Use this transition to check that the service accounts and API tokens used by these tools have only the permissions they need. Make sure they are inventoried and on a credential rotation schedule.
- Inventory AI access to data. The companies' own pitch shows why this matters. Whatever tools you use, keep a current list of AI assistants and agents that can read your data stores, and apply the same least-privilege reviews you use for human accounts.
- Watch for transition-themed phishing. Deals that get a lot of attention are often used as phishing lures, such as fake "account migration" or "license transfer" notices. Tell admin teams to confirm any instructions about account changes through their existing vendor contacts and portals, not through links in unsolicited email.
Customers who use products from both companies should ask both account teams how overlapping capabilities, especially DLP, will be combined and when. Find that out before planning any consolidation of your own.
