Proofpoint to buy Varonis in $6.3 billion all-cash deal
Proofpoint has agreed to buy Varonis, a company focused on data and AI security, for roughly $6.3 billion in cash. The two firms announced the agreement on Thursday.
It is the largest cybersecurity acquisition announced so far this year, according to SecurityWeek. The publication has tracked more than 300 cybersecurity M&A deals in 2026.
The terms
Varonis shareholders will receive $49.75 for each share they hold. That is a 52% premium over the $32.71 closing price on June 22, 2026. June 22 was the last full trading day before rumors of a possible sale began to circulate.
Thoma Bravo, the private equity firm that owns Proofpoint, is providing committed equity financing for the purchase. It has also secured commitments for debt financing. Ontario Teachers' Pension Plan, one of Canada's large public pension funds, is investing in Proofpoint as part of the transaction.
The companies expect the deal to close in the first half of 2027. Until then, Proofpoint and Varonis will continue to run as separate, independent businesses. Once the acquisition is complete, Varonis will become a private company.
What Varonis brings
Varonis sells a SaaS data security platform. It finds and classifies sensitive data stored in cloud services, SaaS applications and on-premises systems. It also maps which users have access to that data and monitors how it is used.
Its Atlas product focuses on the AI systems an organization builds or uses. Atlas covers:
- an inventory of AI systems
- posture management
- security testing
- runtime guardrails
- compliance reporting
Beyond this, Varonis offers an email and browser security product and a managed data detection and response (MDDR) service.
What Proofpoint already has
Proofpoint is best known for email security. Its products are built to stop phishing, business email compromise (BEC), ransomware and malware, and the company applies similar protection to messaging apps and cloud accounts.
On the data side, Proofpoint offers data loss prevention, insider risk management, and data security posture management for finding and classifying sensitive information.
This year the company launched AI Security. The product controls how employees and AI agents use AI tools. It also flags actions by agents that drift away from what the user actually asked for or that break company policy.
After closing, Proofpoint plans to merge the capabilities of both companies into a single platform for data and AI security.
Earlier AI security deals
Both companies were already buying in this space before the merger. In February, Proofpoint acquired Acuvity, an AI security and governance company. Around the same time, Varonis announced it would buy AllTrue.ai, a provider of AI trust, risk and security management (TRiSM) solutions, for $150 million.
The Bigger Picture
The size of the premium suggests Proofpoint sees Varonis as a strategic piece rather than just a bolt-on product. Proofpoint has long been strong at the email layer, where many attacks begin. Varonis is strong at the data layer, where attackers usually want to end up. Putting the two together could give Proofpoint a view of both the entry point and the target.
The AI angle is hard to miss. Both companies made AI security acquisitions in February, and both have products aimed at controlling how AI tools and agents touch corporate data. This fits a wider push across the industry to put limits on what autonomous agents can do. Standards bodies are moving in the same direction, with the PCI SSC calling for human sign-off before AI agents act on card data. Investors are also still putting money into the area, as seen in Hadrian's $40 million raise for agentic offensive security.
For Varonis customers, the immediate impact should be limited, since the companies stay independent until the deal closes in 2027. Over the longer term, it is worth watching how the integration plays out. Merging two large platforms often means changes to licensing, product names and roadmaps, and customers who chose Varonis as a standalone tool may find it bundled into a broader Proofpoint suite.
It is also worth watching whether regulators take an interest, given the size of the deal, and whether other email or data security vendors respond with acquisitions of their own. With more than 300 deals already tracked this year, consolidation in security does not appear to be slowing down.