What the filing says. Varonis filed its preliminary proxy, dated Nov. 5, for its $6.3 billion all-cash sale to Proofpoint, which Thoma Bravo owns. Ctech walked through it on Sunday. Goldman Sachs was cleared on May 4 to approach eight strategic buyers, meaning operating companies rather than private equity. Within days, four had declined. By July 20, one was left, and it showed limited interest. None is described as making an offer. The only rival private-equity indication was $38 to $40 a share, which BankInfoSecurity notes was roughly an 8% to 12% discount to where the stock traded. The board turned it down.
The haggling. Proofpoint opened at $36 on May 17, about a 28% premium to the prior close, per Ctech. Thoma Bravo went to $43, then $46.50. On Aug. 16 the board asked for $54, roughly 20% above the stock. Thoma Bravo came back at $49.50. The board authorized a $50 counter. That afternoon Thoma Bravo said $49.75 was its best and final offer, and the board took it. The agreement was signed Oct. 15.
The sentence that matters. When the board decided to explore a sale on April 27, it cited “the uncertainty created by the macroeconomic environment,” credible inbound interest from Thoma Bravo, and “potential for continued disruption from artificial intelligence models.” Read that last one again. A $6 billion security company’s board put AI disruption in writing as a reason to sell. That is new, and it will not be the last proxy that says it.
Who carried the risk. After the price was set, Ctech says most of the negotiation was about break fees. The fee Varonis would owe if it took a better offer settled at 3.375%, or $211.7 million. The fee Thoma Bravo would owe if it walked settled at 6.75%, or $423.3 million, exactly double. Varonis had no leverage on price because nobody else was bidding. It did have leverage on certainty, and it used it.
The other side of the tape. Monday morning, Ctech reported that Cyera is in advanced stages of raising about $800 million at roughly a $20 billion valuation, nearly double the $12 billion it was valued at in June. Cyberstarts, an early-stage fund, would write about $300 million of it. Ctech estimates Cyera’s annual recurring revenue at around $300 million. All of that is reported, not confirmed by Cyera. Be careful with the comparison. A private round prices a slice of preferred stock to the most eager buyer. A take-private prices the whole company to the only buyer. They are not the same number. But the direction is hard to miss: the same category, data security, is getting a PE floor for the incumbent and a premium for the newcomer.
Our read. Strategics didn’t pass on data security. They passed on data security as it was first built: file shares, on-prem permissions and a 20-year install base. What they are paying for is control over what AI agents can reach. Ctech describes Cyera’s products as watching AI agents, the tools they use and the databases they query. Cyera has spent about $1.35 billion on six acquisitions since 2024, per Ctech, including roughly $1 billion for Oasis Security, which secures non-human identities like service accounts and agents. Varonis sees the same thing. On Monday it extended its Atlas line to the browser, the endpoint and an AI gateway for model and agent traffic. It is the right move. The proxy suggests buyers thought it came late.
What it means. For founders, the exit market has split in two. Assets that sit close to AI access get strategic bids. Mature franchises get private equity, at a price PE sets. For Thoma Bravo, the logic is simple: buy a cash-generating install base and bolt it onto Proofpoint’s email and DLP business. For CISOs who run Varonis, the deal is expected to close in the first half of 2027. Ask now what the roadmap and renewal terms look like under Proofpoint, before the integration plan is written without you.
If you run Varonis today, does Proofpoint ownership change your next renewal, and would you pay a Cyera-style premium for agent-era data control instead?