Cowry Tech News
Security

Proofpoint agrees to buy Varonis: what data security customers should ask before renewal

Thoma Bravo-owned Proofpoint has agreed to buy Varonis for about $6.3 billion in cash, subject to a shareholder vote and regulatory approvals, with closing targeted for the first half of 2027. CTN read the joint release, the Varonis 8-K and independent reports, and sets out the questions Varonis customers can put to vendors on roadmap, product overlap, data handling, contracts and support.

By Arjun Mehta · 16 Oct 2026 · 15 min

Proofpoint logo
Image: Proofpoint

Proofpoint has agreed to buy Varonis Systems. If you run Varonis for data security posture management (DSPM), permissions clean-up or insider-risk alerting, your software works the same today as it did last week. The announcement is still a good reason to review your contract, your data flows and the questions you put to your account team before renewal.

The two companies announced a definitive agreement on 15 October 2026. Under it, Proofpoint, a portfolio company of the private equity firm Thoma Bravo, would buy Varonis in an all-cash transaction the companies value at about $6.3 billion. Varonis shareholders would receive $49.75 per share in cash. The companies say they expect the deal to close in the first half of 2027.

The deal is not done. It still needs a vote of Varonis shareholders and regulatory approvals, along with other customary closing conditions. Until then, according to the joint release, “Proofpoint and Varonis will continue to operate as separate and independent companies.”

This piece is for the people who will field questions about the deal inside their own organizations: security leaders, data protection officers, procurement and vendor-risk teams, and the engineers who keep a Varonis deployment running. It sets out what the companies have said, what the filings add, and what they have not said. It then gives a checklist of questions to ask, tied to controls most organizations already use. CTN has not yet asked Proofpoint or Varonis for comment.

What was announced

The terms come from three places CTN read directly: the joint press release published on Proofpoint’s newsroom, Varonis’s Form 8-K filed with the US Securities and Exchange Commission on 15 October together with the merger agreement filed as Exhibit 2.1, both read on SEC EDGAR, and an independent report from Reuters, as carried by CNA.

The release, the filing and Reuters agree on the core facts. Proofpoint will pay $49.75 a share in cash. The companies put the total value at about $6.3 billion. The release says the price is a 52% premium to Varonis’s closing price of $32.71 on 22 June 2026, which the companies describe as the last full trading day before initial rumors of a possible sale. Reuters reports the same premium and attributes it to the companies.

The release says the Varonis board approved the agreement unanimously. Thoma Bravo is providing committed equity financing and has secured debt financing commitments, the companies say. The release also says Ontario Teachers’ Pension Plan has agreed to make an investment in Proofpoint in connection with the transaction.

If the deal closes, Varonis stock would stop trading on Nasdaq and Varonis would become a private company. The 8-K says Varonis would become a wholly owned subsidiary of Proofpoint.

Reuters, via CNA, adds context the release does not. It reports that Reuters said in September that Proofpoint was in talks to buy Varonis, and that media reports in June said Varonis was weighing a sale after takeover interest from private equity firms. Reuters also notes that Thoma Bravo took Proofpoint private in 2021 in a deal that valued it at about $12.3 billion.

Shareholder and regulatory approvals still needed

Customers should read this as a pending agreement with a timetable, not a finished merger. The 8-K lists the main conditions. Holders of a majority of Varonis’s outstanding shares must vote to adopt the agreement. The applicable waiting period under the US Hart-Scott-Rodino Antitrust Improvements Act of 1976 must expire or be terminated. The 8-K also lists “the clearance or approval under certain specified foreign regulatory laws.” The merger agreement says those consents and clearances are listed in a section of Varonis’s disclosure letter, which was not filed publicly. Neither document names the foreign regulators or countries involved, so CTN does not name them here.

The filing says either side may, subject to conditions, end the agreement if the merger has not closed by 11:59 p.m. New York time on 15 July 2027, “subject to a three month extension to obtain required regulatory approvals.” The merger agreement sets that extended date at 15 October 2027. Those are contract deadlines. The closing date the companies give is their own target of the first half of 2027. It also sets out termination fees: $211.7 million payable by Varonis in specified circumstances, such as a change in its board’s recommendation or a move to accept a superior proposal, and a $423.3 million reverse termination fee payable by Proofpoint’s side in other specified circumstances. The 8-K says Proofpoint’s obligations are not subject to a financing condition.

Varonis CEO Yaki Faitelson has signed a support agreement to vote his shares for the deal; the 8-K says he beneficially owned about 0.67% of outstanding shares. The filing also says Faitelson signed a term sheet with Proofpoint to serve as a non-executive officer for 18 months after closing.

The 8-K says Varonis has agreed to customary interim covenants, including running its business in the ordinary course in all material respects until closing. For customers, it is the filed basis for expecting business as usual during the pending period. It does not commit to any specific product, price or support term.

Varonis says it will report third-quarter 2026 results after US markets close on 3 November and, given the transaction, will not hold an earnings call.

What the companies say they plan

The release describes the combined company’s intent in broad terms. “Together, the combined company intends to deliver a unified platform that helps organizations adopt AI with confidence: finding and protecting sensitive data, controlling what people and AI can access, and stopping data loss,” it says. It adds that after closing, “Proofpoint intends to move quickly to integrate the companies’ capabilities, align go-to-market efforts, and accelerate delivery of the combined platform to customers.”

Proofpoint CEO Sumit Dhawan is quoted in the release: “By connecting communications, identities, permissions, data, and AI, we are creating an intelligence advantage that helps customers see risk more clearly, respond faster, and defend against the next generation of AI risks.”

Faitelson is quoted saying: “Our mission is to secure AI and the data that powers it. By joining forces with Proofpoint, we can achieve this mission faster than ever.” Reuters, via CNA, carries the same quote.

The companies also make scale claims. The release says the combined company “will serve more than 16,000 enterprises and millions of organizations globally” and calls it “the industry’s largest data and AI cybersecurity organization.” These are the companies’ own descriptions. CTN has not independently verified them.

The release names no products that will be kept, merged or retired. It gives no integration timeline beyond “move quickly” after closing. It says nothing about pricing, licensing, support terms, data residency or where customer data will be processed. Deal announcements rarely cover these points, so this is where customer questions belong.

Proofpoint and Varonis product overlap

The companies’ own descriptions show why customers will ask about overlap. In its boilerplate, Varonis says its platform “gives organizations automated visibility and control over their critical data wherever it lives” and is “backed by 24x7x365 managed detection and response.” Reuters describes Varonis as offering services including data classification on cloud storage systems and employee behavior tracking.

Proofpoint describes itself as “securing how people, data and AI agents connect across email, cloud and collaboration tools,” and says its platform helps organizations stop threats and prevent data loss.

Both descriptions cover data protection and loss prevention. Both talk about AI. Neither company has said which capabilities would be combined or how. CTN is not drawing a product map here, because the companies have not published one. If your organization buys from both vendors today, or was evaluating one against the other, the deal raises questions about duplication and future packaging that only the vendors can answer.

Varonis customer checklist: questions to ask vendors

The questions below are grouped by topic. Each group names a control or contract clause that most security and privacy programs already use, so the answers can go straight into an existing vendor-risk file. None of this assumes that anything will go wrong. It is the same diligence a team would do for any change of control at a critical supplier.

1. Roadmap and product continuity

Ask your Varonis account team:

  • Which Varonis products and modules you license today have a published roadmap through your current contract term, and whether that roadmap is in writing.
  • Whether the company will commit, in writing, to the features you rely on most, such as data classification, permissions analysis, activity monitoring or alerting, for the remainder of your term.
  • How product roadmap decisions will be communicated during the pending period and after closing, and through which channel.
  • Whether any planned features have been paused or re-scoped because of the transaction.

Control reference: ISO/IEC 27001:2022 Annex A control 5.22, on monitoring, review and change management of supplier services, asks organizations to track supplier changes that affect security. A change of control is one of those changes. Record the vendor’s answers against that control.

2. Overlap with Proofpoint

If you also buy from Proofpoint, or were weighing it:

  • Ask both vendors which of your current licenses they see as overlapping, and whether that view will be shared with you before renewal.
  • Ask whether any migration between products would be optional, and on what timeline and terms.
  • Ask how detections, policies and classification labels would carry across if products are later combined, and who would do that work.
  • Ask whether integrations you already run between the two vendors’ tools, or with your SIEM, identity provider or ticketing system, would be maintained.

Keep any answers dated. Until the deal closes, the companies say they operate separately, so pre-close answers may be limited. Treat a “we can’t say yet” as an honest answer and put a follow-up date on it.

3. Data handling and sub-processors

DSPM and insider-risk tools see a lot. They index file metadata, map who can access what, and in many deployments log user activity. So the data-handling terms deserve the closest read.

  • Ask where your data, including metadata, activity logs and any classification results, is stored and processed today, and whether that would change after closing.
  • Ask whether the current list of sub-processors would change, and how you would be notified.
  • Ask whether any customer data would be shared with Proofpoint or other Thoma Bravo portfolio companies before or after closing, and under what legal basis.
  • Ask whether data held by the managed detection and response service is covered by the same terms.
  • Ask how and when your data would be returned or deleted if you chose not to renew.

Control reference: for organizations covered by the EU General Data Protection Regulation, Article 28 governs processors. Article 28(2) says a processor shall not engage another processor without the controller’s prior specific or general written authorisation, and under general authorisation the processor must inform the controller of intended changes so the controller can object. Article 28(3)(g) covers deletion or return of personal data at the end of services, and 28(3)(h) covers information and audit rights. Check that your data processing agreement reflects those terms and who the notifying party will be after any change of control. US organizations will have parallel clauses in their own contracts and sector rules.

4. Contract continuity

  • Read your master agreement for assignment and change-of-control clauses. Note whether the agreement can be assigned without your consent, and whether a change of control gives you any rights.
  • Confirm renewal dates, notice windows and any price-increase caps. If renewal falls inside the pending window, decide whether a shorter or longer term better fits your plans.
  • Ask whether multi-year pricing you hold today will be honored through its term.
  • Ask whether any reseller or channel partner you buy through has been told of changes.

Under the 8-K, the deal is structured as a merger in which Varonis continues as the surviving corporation and becomes a Proofpoint subsidiary. Your counsel can tell you what that structure means for your specific contract. CTN is not offering legal advice, and the merger agreement’s effect on any individual customer contract is not described in the public filing.

5. Support and service levels

  • Ask whether support SLAs, escalation paths and named contacts will stay in place through your term.
  • Ask whether the 24x7x365 managed detection and response service the company describes will continue on its current terms, and whether staffing or coverage hours are changing.
  • Ask how incident notification commitments will work if a security event affects Varonis infrastructure during the pending period or after closing.
  • Ask for the current SOC 2 Type II report or ISO/IEC 27001 certificate, and whether the scope or auditor will change.

Control reference: NIST SP 800-53 Rev. 5 control SA-9, External System Services, asks organizations to require that providers of external services comply with organizational security requirements and to monitor that compliance. Control SR-6, Supplier Assessments and Reviews, covers periodic review of suppliers. A pending acquisition is a reasonable trigger for an off-cycle review under both.

6. Insider-risk programs

Insider-risk monitoring depends on trust inside your own workforce. Employee activity data is sensitive, and many organizations have agreed rules with HR, legal and in some countries works councils about who can see it.

  • Ask whether the vendor’s access to that activity data, including support staff access, would change after closing.
  • Ask whether any analytics or model training uses customer activity data, today or under future plans.
  • Check that internal notices or agreements about monitoring still describe the vendor and data flows accurately. If the vendor’s corporate parent changes, some notices may need updating.

7. Your own exit and fallback plan

No customer needs to switch vendors because of an announcement. A written exit plan is ordinary practice for a critical tool anyway.

  • Confirm you can export your policies, classifications, reports and audit logs in a usable format.
  • Document which internal processes depend on the tool, such as access reviews, audit evidence or breach investigations.
  • Note the lead time a replacement would need, so a decision at renewal is not rushed.

ISO/IEC 27001:2022 Annex A control 5.19, on information security in supplier relationships, and control 5.20, on addressing security within supplier agreements, are the usual homes for this documentation.

What to watch

Several public milestones will bring more information.

The proxy statement. Varonis says it will file a proxy statement with the SEC ahead of a special shareholder meeting. Proxy statements usually contain a background-of-the-merger section describing how the deal came together. It will not cover customer terms, but it may add detail on timing.

Regulatory review. The Hart-Scott-Rodino waiting period and the foreign clearances listed in the non-public disclosure letter will affect the timeline, which the companies give as a first-half 2027 target. Any request for more information from regulators would likely push the date out.

Third-quarter results on 3 November. Varonis says it will publish results that day without a call.

Customer communications. Watch for formal notices from Varonis or Proofpoint about product plans, support or data processing. Ask for them in writing if they arrive only by phone.

Closing. Proofpoint says it intends to “move quickly” to integrate after closing. Product and contract changes, if any, would follow that date, not the announcement.

What CTN could not confirm

CTN could not find any public statement from either company on product roadmaps, pricing, support terms, data residency or sub-processor changes. The scale figures in the release, including “more than 16,000 enterprises,” are company claims that CTN has not verified. The financing role of Ontario Teachers’ Pension Plan is described only in the joint release; CTN did not find it in the independent reports it read. The control references above come from the published standards and regulation, not from either company, and are offered as a way to organize questions, not as a claim that either vendor meets or misses them.

CTN has not yet asked Proofpoint or Varonis for comment.

Sources

Method: CTN read each linked page on 16 October 2026. CTN has not yet asked Proofpoint or Varonis for comment.