The quarter nobody got to trade. Varonis reported Q3 on Nov 4. Revenue was $189.5 million, up from $161.6 million a year ago. SaaS revenue was $185.1 million. SaaS ARR hit $774.6 million, up 42% year over year. Normally that is a stock-moving print. This time there was no earnings call, no webcast and no updated guidance, because Proofpoint, owned by Thoma Bravo, has agreed to buy the company for $49.75 a share in cash. The stock closed at $48.96. The market already did its math.
Read the growth number twice. Varonis is moving every customer from software they run themselves to its cloud service. When an old customer switches, their spend gets counted as new SaaS ARR. That is real revenue, but it isn’t new demand. Varonis reports both numbers. Headline SaaS ARR growth: 42%. Excluding conversions: 24%. The gap is customers changing how they pay, not new customers showing up.
The tailwind has an end date. Varonis says its self-hosted products reach end of life on Dec. 31, 2026. After that, there is very little left to convert. The 42% stops being a useful number. What’s left is a data security business growing in the mid-20s. That’s still good. It’s just a different company than the headline suggests.
So what did Proofpoint actually buy? The deal values Varonis at $6.3 billion. The deal release quoted 8.4x trailing revenue. A Simply Wall St note on Yahoo Finance puts the stock at 8.2x sales, against 4.6x for peers. Paying a premium multiple for 24% growth is defensible if two things hold. First, the converted customers stay and buy more once they’re on SaaS. Second, the product becomes the data layer Proofpoint sells next to email security. Proofpoint already owns the inbox. Varonis knows who can open which file. Put together, that’s a map of how sensitive data leaks, by email or by over-shared folders. That’s the platform logic.
The quality check. Look at cash, not ARR. Free cash flow for the first nine months was $94.8 million, down from $111.6 million a year earlier. GAAP operating loss for the quarter widened to $47.7 million. Switching to SaaS costs money up front. Varonis earns that money back over the contract, and Proofpoint is betting the payback comes. For a private equity owner with debt to service, cash timing matters more than the ARR headline.
The Q4 test. Back in July, Varonis guided full-year SaaS ARR to $819 million to $850 million. It didn’t update that guide this quarter. Starting from $774.6 million, hitting the range means adding roughly $44 million to $75 million in Q4. That is the quarter where the last conversions land. If the low end shows up, the story holds. If the number lands short, the conversion wave was the growth.
Why practitioners should care. If you run Varonis on-prem, your clock runs out on Dec. 31. You are moving to SaaS or moving off. Use that. Proofpoint wants your renewal to prove the deal. You have more leverage on price and terms in this window than you will once you’re a line inside a bigger bundle.
The bigger read. Data security is getting priced two ways at once. Private names like Cyera are reportedly talking about $20 billion. A public, profitable-on-adjusted-basis incumbent sold for $6.3 billion. The gap isn’t about who finds sensitive files better. It’s about who investors believe controls what AI agents can touch. Varonis’s 24% is the honest number for an incumbent. Startups priced at many times that will have to show they grow far faster, for longer.
So here’s the question for buyers and analysts: when the conversions run out on Dec. 31, does a data security incumbent growing in the mid-20s deserve 8x sales, or does it just get absorbed by a bigger platform?