Proofpoint, the email security company owned by private equity firm Thoma Bravo, agreed to acquire data security vendor Varonis Systems for about $6.3 billion in cash, the companies said Thursday. The deal is framed around a problem many boards are now confronting: AI agents that can read and act on sensitive corporate data, and the need to control what they can reach.

What Happened

Under the merger agreement signed Oct. 15 and described in a Varonis filing with the Securities and Exchange Commission, Varonis shareholders will receive $49.75 in cash per share. Proofpoint and its merger subsidiary are affiliates of funds advised by Thoma Bravo.

The joint press release said the price is a 52% premium to Varonis' $32.71 close on June 22, the last full trading day before initial sale rumors, and 17% above its $42.35 close on Sept. 1. It equals about 53 times trailing free cash flow and 8.4 times trailing revenue as of June 30, according to the release.

RelatedFirmus Pulls A$44 Billion ASX Listing After Weak Investor Demand

Thoma Bravo is providing committed equity and has secured debt financing commitments, and Ontario Teachers' Pension Plan agreed to invest in Proofpoint in connection with the deal. The filing says Proofpoint's obligations are not subject to any financing condition.

Varonis' board approved the deal unanimously. The companies expect to close in the first half of 2027, after which Varonis would leave Nasdaq and become private. Until then, they will operate separately.

Why It Matters

Varonis sells software that maps where sensitive data sits, who can access it and how it is used. Proofpoint focuses mainly on threats that arrive by email, such as phishing and fraud, and reports 3.4 million customers, CyberScoop reported. Proofpoint plans to combine the two into a single data and AI security platform after closing, SecurityWeek reported.

Proofpoint Chief Executive Sumit Dhawan made the AI case directly in the release: "As AI becomes embedded across the enterprise, the data it can access determines both its value and its risk." He said AI agents are increasingly accessing sensitive information and taking actions across systems, so organizations need to know not only who can reach data but how it is used.

For executives, the practical point is that an AI agent given broad file permissions inherits every overly generous access setting already in place. Tools that inventory and tighten those permissions are becoming a precondition for deploying agents safely, and the price shows how much investors value that capability. SecurityWeek called it the largest cybersecurity acquisition announced so far in 2026.

Customers of either company should expect product and contract changes over time and may want to ask about roadmap commitments before renewals.

Context

Both companies have been buying AI security capabilities. CyberScoop reported that Proofpoint acquired AI security startup Acuvity in February and earlier bought Hornetsecurity, a German provider of Microsoft 365 security services, in a deal reportedly worth more than $1 billion. Varonis bought AI security firm AllTrue.ai for $150 million.

Goldman Sachs is advising Varonis. BofA Securities, Morgan Stanley, J.P. Morgan, UBS and Mizuho are advising Proofpoint.

What to Watch

Closing requires approval from holders of a majority of Varonis shares, expiration of the waiting period under the Hart-Scott-Rodino Act, the U.S. premerger antitrust review law, and clearance under specified foreign regulatory laws. Varonis Chief Executive Yaki Faitelson, who owns about 0.67% of the shares, agreed to vote for the deal and is to serve as a non-executive officer for 18 months after closing.

The agreement bars Varonis from soliciting rival offers, subject to customary exceptions. Varonis would owe a $211.7 million termination fee in specified cases, including accepting a superior proposal, while Proofpoint would owe a $423.3 million reverse termination fee in cases such as failing to close once conditions are met. The outside date is July 15, 2027, extendable by three months to obtain regulatory approvals.