Proofpoint (Thoma Bravo) to buy Varonis for $6.3bn

Hussain Jeddy · 16 October 2026

Target: Varonis Systems, Inc. (Nasdaq: VRNS)
Buyer: Proofpoint, Inc.
Deal value: About $6.3bn
Price/share: $49.75 per share in cash

On 15 October 2026, Varonis Systems, a Nasdaq listed data security company based in Miami, signed an agreement to be bought by Proofpoint, the email and cybersecurity group owned by the private equity firm Thoma Bravo. Every Varonis shareholder will receive $49.75 in cash for each share, in a deal the companies value at about $6.3bn. Once it closes, which the parties expect in the first half of 2027, Varonis will leave Nasdaq and become a private company inside the Proofpoint group.

The headline premium is particularly interesting. The companies say $49.75 is 52% above Varonis's closing price of $32.71 on 22 June 2026, the last full trading day before the first rumours of a sale, and 17% above its $42.35 close on 1 September 2026, the last trading day before further media reports. They do not measure the premium against the price on the day before signing, because by then the market had already priced in much of the takeover talk. The deal values Varonis at about 53 times its last twelve months of free cash flow and 8.4 times its revenue over the same period.

The Parties

Varonis describes itself as a company that "secures AI and the data that powers it". In simple terms, its software tells a business where its sensitive files sit, who can open them, and whether anyone (or any AI tool) is touching them in a suspicious way, backed by a round the clock monitoring service. Its chief executive, chairman, and one of its founders, Yaki Faitelson, called the deal the result of "the incredible work of the Varonis team over two decades." According to Terrain's reading of its latest quarterly report, Varonis made $353.1m of revenue in the first six months of 2026.

Proofpoint is best known for filtering dangerous emails. It says it works with more than 80 of the Fortune 100 and over 14,000 large enterprises, and it now pitches itself as protecting "human and agent" users, meaning both employees and the AI agents that act on their behalf. Proofpoint has been privately owned since Thoma Bravo bought it in a take private valued at about $12.3bn, announced in April 2021.

Thoma Bravo is one of the largest private equity investors in software. It is not the named buyer here, but its funds provide the equity cheque. Ontario Teachers' Pension Plan, one of Canada's biggest pension funds, has also agreed to invest in Proofpoint alongside the deal.

Structure & Process

The deal is a reverse triangular merger. Here the shell is Vail Merger Sub, Inc., a Delaware company owned by Proofpoint. At closing it merges into Varonis, and Varonis carries on as a wholly owned subsidiary of Proofpoint. Each Varonis share is automatically converted into the right to $49.75 in cash, except for shares whose holders exercise appraisal rights.

The merger needs approval from holders of a majority of all outstanding Varonis shares at a special meeting, for which Varonis will file a proxy statement with the SEC. It also needs the Hart Scott Rodino waiting period to end, clearance under "certain specified foreign regulatory laws", and no Material Adverse Effect since signing. If the deal has not closed by 15 July 2027, either side can walk away, although that date can be pushed back three months if regulatory approvals are still pending.

The agreement contains a no shop clause, but the board keeps a fiduciary out: it can still accept a genuinely better offer, known as a superior proposal. If it does, or if the board changes its recommendation, Varonis must pay Proofpoint a break fee of $211.7m. Going the other way, Proofpoint owes Varonis a reverse termination fee of $423.3m in specified cases, including if all the conditions are met and Varonis confirms it is ready to close but Proofpoint fails to do so. By our own calculation, those fees are about 3.4% and 6.7% of the $6.3bn headline value.

Two smaller documents also fit into the picture. Faitelson signed a support agreement, covering about 0.67% of Varonis's shares. He also signed a term sheet to serve as a non executive officer of the business for 18 months after closing.

The Financing Angle

This is a standard private equity add on acquisition. The cash comes from two places. Funds managed by Thoma Bravo have signed an equity commitment letter, and "certain financial institutions" have signed a debt commitment letter. The filings do not say how much debt is involved or name the lenders. Ontario Teachers' separate investment into Proofpoint adds a further source of equity.

Importantly for Varonis shareholders, there is no financing condition. Proofpoint cannot refuse to close just because its loans fall through. Varonis can even ask a court for specific performance to make Proofpoint draw down Thoma Bravo's equity and close, but only if the debt has been or will be funded at closing. The $423.3m reverse termination fee is the backstop if that route is not available.

One smaller detail concerns Varonis's own borrowing. The 8 K confirms the merger counts as a "make whole fundamental change" under the terms of its 1.00% convertible notes due 2029. According to an analysis of the bond terms by the credit research publication Terrain, the $49.75 price sits below the lowest share price in the notes' make whole table, so holders who convert would get no extra shares as compensation. Terrain also reads the deal as giving holders the right to sell the notes back at face value.

Why It Matters

First, it is another sign that cybersecurity is consolidating into a few large platforms. Momentum Cyber, an investment bank that specialises in the sector, counted a record 219 cybersecurity M&A deals in the first half of 2026 and said that large vendors offering a broad platform are commanding serious premiums while smaller, single product specialists struggle to find a footing. Varonis, a specialist with a single focus, has now chosen to join a bigger platform.

Second, it shows how AI is reshaping what investors think security is worth. Proofpoint's whole pitch is about AI agents reading and acting on company data, and IBM's 2026 Cost of a Data Breach Report found that 92% of organisations that suffered an AI related breach lacked proper AI access controls. Controlling what data AI tools can see is exactly the gap Varonis sells into.

Third, for students it is a textbook US public to private deal. A Delaware reverse triangular merger, a no shop with a fiduciary out, two way termination fees, financing commitments with no financing condition, and a convertible bond clause.

Real World Impact

Most people will never buy anything from Varonis. But the company's software sits behind the scenes at banks, hospitals, employers and public bodies, watching who opens files that may include your bank details, medical records or payslips. When that protection fails, the cost lands on ordinary people. IBM's 2026 report found that customer personal information was the most frequently stolen type of data, appearing in 52% of breaches, and put the average breach at a record $4.99m.

What could change for you? Possibly very little at first, since the two companies will keep running separately until the deal closes. Over time, if Proofpoint delivers on its plan, the organisations holding your data might get one joined up system that spots risky behaviour faster, including by the AI assistants now built into everyday work tools. That would be good news for your privacy. The other side of the coin is that fewer, bigger security suppliers means that when one of them has a problem, more organisations could be affected at once, and customers may have fewer alternatives if prices rise.

Why they did it this way

Recommended, not hostile. Varonis says the deal followed "a comprehensive evaluation led by a committee of independent members of our Board of Directors", including "extensive outreach to a range of potential strategic and financial buyers", and that the price is well above what Varonis could have expected to deliver on its own once risk is taken into account. For a private equity backed buyer, a friendly deal is almost always the starting point. Buyout firms need access to the target's books to secure bank financing, and a target board that has run a proper sale process is in a much stronger position to defend the price to shareholders and in any later court challenge.

A one step merger rather than a tender offer. For a Delaware company, the two standard routes are a shareholder vote on a merger or a tender offer (buying shares directly from investors, followed by a quick squeeze out merger). A vote takes a little longer, but when a deal faces a long regulatory review anyway, there is little to gain from the speed of a tender offer. A single vote also gives the board one clear moment of shareholder approval to point to.

Why a reverse triangular merger. Because Varonis itself survives, its customer contracts, licences and permits normally stay in place without each counterparty's consent. That matters for a software business whose value lies in thousands of customer relationships. Using a fresh merger subsidiary also keeps Varonis's liabilities ring fenced inside its own company rather than mixed with Proofpoint's.

Buying through Proofpoint, not a new Thoma Bravo vehicle. Proofpoint's CEO Sumit Dhawan says the aim is to connect "communications, identities, permissions, data, and AI" in one platform. An add on lets the fund put the target straight into an existing business so the two can share sales teams and technology. Thoma Bravo's equity backs the deal from behind, and Ontario Teachers' investment spreads the cheque across more than one investor.

The deal protections. A no shop with a fiduciary out is the standard balance in US public deals: the buyer gets some protection for its time and money, while directors keep their legal duty to accept a clearly better offer. A reverse fee roughly double the target's fee is common in private equity deals, because the main risk for the seller is that the buyer's financing or regulatory clearance fails, not that a rival turns up.

Regulation and timing. Both companies sell security software to large businesses, so competition regulators in the US and some other countries are given time to look. The July 2027 outside date, with a three month extension for regulatory delay, builds in room for a longer review. The "first half of 2027" target suggests the parties expect clearance without major problems, but that is a planning assumption, not a guarantee.