Analysis
Proofpoint, the cybersecurity company Thoma Bravo took private in 2021, agreed to buy publicly traded data-security firm Varonis Systems for $6.3 billion in cash, according to PYMNTS. Proofpoint says the combination creates the largest data-and-AI cybersecurity organization and a leading pure-play security company, with the deal expected to close in the first half of 2027.
Varonis, founded in 2004 and run by CEO Yaki Faitelson, has been covered by Pulse before around a Microsoft Copilot data-exposure exploit its researchers found. The company builds software that tracks and locks down sensitive data across cloud and on-premise systems — exactly the kind of visibility Proofpoint needs as AI agents start reading and acting on that same data. Varonis posted $623.5 million in revenue for fiscal 2025, up more than 13% year over year, and traded at roughly a $4.7 billion market cap heading into the deal, meaning Proofpoint is paying a premium north of 30%.
This isn't Proofpoint's first bolt-on since going private. It announced the acquisition of email-security vendor Hornetsecurity in May 2025 to reach small and midsize businesses through managed service providers, then added agentic-workspace protection vendor Acuvity in February 2026. Varonis is by far the largest of the three, and it plants Proofpoint squarely against data-security specialists like Rubrik, BigID and Securiti, all racing to sell "what can your AI agents actually touch" dashboards to the same CISOs.
“Watch whether Rubrik or BigID respond with their own M&A, and whether Thoma Bravo signals plans for a combined IPO once integration is further along.”
Thoma Bravo's own history with Proofpoint sets the scale here: the private-equity firm paid $12.3 billion to take Proofpoint off Nasdaq in 2021 at $176 a share, via a deal reported by TechRadar. Spending roughly half that amount again, four years later, to buy a company a fraction of Proofpoint's size signals Thoma Bravo believes data-and-AI security is still consolidating rather than peaking.
The counterweight: announced is not closed. The deal isn't expected to complete until the first half of 2027, leaving more than a year for financing conditions, regulators or a rival bid to change the math — and Varonis and Proofpoint will keep operating independently in the meantime, a long runway for integration risk to show up before a single system gets merged. Varonis CEO Yaki Faitelson told customers the combination would mean fewer vendors to manage, but 16,000 enterprise customers is also 16,000 renewal conversations that now have to go through a company mid-acquisition.
Watch whether Rubrik or BigID respond with their own M&A, and whether Thoma Bravo signals plans for a combined IPO once integration is further along.
