In September we wrote that talks are not a close. Now there’s a signature.
On Oct 15, Proofpoint, a Thoma Bravo portfolio company, signed a definitive agreement to buy Varonis for $49.75 a share in cash, about $6.3B. The Varonis board approved it unanimously. Close is expected in the first half of 2027, pending a shareholder vote and regulatory approvals. Thoma Bravo is providing committed equity and has debt commitments in hand. Ontario Teachers’ Pension Plan is also investing in Proofpoint alongside the deal (per the joint release).
Read the multiples twice. The release quotes 8.4x LTM revenue and 53x LTM free cash flow. Check the footnote. The revenue multiple is enterprise value over LTM revenue. The FCF multiple is market capitalization over LTM free cash flow. Both are as of June 30. Mixing EV and market cap is fine in a press release. It’s sloppy in a comp table. If you’re building a data security comp set off this deal, rebuild both on one basis before you quote them.
Read the ARR twice too. Varonis reported SaaS ARR of $726.0M at June 30, up 52% year over year. Excluding conversions, meaning existing self-hosted customers moving to SaaS, growth was 25%. The full-year guide is SaaS ARR of $819M to $850M, 20% to 21% growth excluding conversions, and free cash flow of $105M to $110M (per the Q2 release). The 52% is real money, but a lot of it is the same customers paying in a new format. The 25% is the business. That’s the growth Proofpoint is underwriting.
The premium was already priced in. $49.75 is 52% over the $32.71 close on June 22, before the first sale rumors, and 17% over the $42.35 close on Sept 1, the day before the talks were reported. Most of the takeover story ran through the tape weeks ago.
What Proofpoint is actually buying. Not another DLP engine. Proofpoint already sells DLP, insider risk and DSPM (per SecurityWeek). It’s buying the map: which data is sensitive, who can open it, and who actually does. That covers file shares, Microsoft 365, cloud stores and now AI tools, with a 24x7 MDR team on top. Proofpoint owns the human attack path: the inbox, the click, the compromised account. Varonis owns the blast radius. Join them and a phished identity, an oversized permission set and an exfil attempt become one incident instead of three tickets in three consoles. That’s what CEO Sumit Dhawan means by connecting “communications, identities, permissions, data, and AI.”
Both sides had already been shopping for AI. Proofpoint bought Acuvity in February. Varonis bought AllTrue.ai for $150M around the same time (per SecurityWeek). Varonis also added Cursor support and deepened its Claude Enterprise and Claude Code integrations (per the Q2 release). Copilots and agents turned “who can read this folder” back into a security question, because an agent reads whatever its identity can reach. Permission hygiene went from audit chore to AI blast-radius control.
Best-of-breed vs platform. Varonis was one of the last public independents in data security. Its board says it ran outreach to both strategic and financial buyers. The winner was a sponsor-backed platform, not a hyperscaler and not a firewall vendor. Private independents like Cyera and BigID should read that closely. The next big check in this category may come from a sponsor stitching a suite, not from a strategic filling a gap.
What we’d do as a Varonis customer this quarter. Pull the contract. Read the change-of-control language, renewal caps and termination rights. Ask in writing whether self-hosted deployments and the SaaS conversion path survive integration, and on what dates. Ask whether MDR staffing and SLAs hold through close. If your renewal lands in the first half of 2027, push for a multi-year price lock now, while the seller still needs clean numbers.
What we’d watch. The proxy’s background section: how many bidders, and at what prices. Termination fee terms. Varonis’ Q3 print on Nov 3, which comes with no call. And Microsoft Purview pricing inside E5 renewals. Purview is the default alternative for every Varonis buyer who now has to choose between a merger and a bundle.
The read. Email security alone is a mature market. Email plus data access is a control plane for how humans and agents touch sensitive information. Proofpoint is paying for that thesis with sponsor equity and new debt. The deal doesn’t prove the thesis. Integration does.