Enterprise cybersecurity leader Proofpoint recently announced an agreement to purchase data and AI security platform Varonis. The acquisition is an all-cash deal valued at $6.3 billion, or $49.75 per share, an increase of 52% over the closing price of Varonis in June before reports of the sale began. Proofpoint, owned by Thoma Bravo, is absorbing a Nasdaq company with over 20 years of history. The company is making this move to expand data and AI security capabilities.
Inside Threats Fueling Changes
The rise of AI tools and agent use in enterprise environments is a significant impetus behind industry-wide changes that manifest in part in major companies making moves like this. Agentic AI is able to access sensitive data and act across systems, and these non-human identities (NHIs) often inherit permissions that haven’t been reviewed in years. Malicious actors can take advantage of agentic AI rules and operations in order to obtain access and cause damage.
Agentic AI is an identity often accorded excessive privileges and permissions—often more than the average human user within an organization. Yet, in contrast with human users, AI agents do not go through phishing training, have HR files, or give exit interviews. They cannot be truly held accountable for either their own mistakes or exploitation by malicious actors. This massive landscape shift creates a significant need for improved data and AI security.
Two Approaches to the Same Problem
Proofpoint and Varonis coming together represents the synthesis of the two companies’ differing approaches to cybersecurity. Proofpoint relies on a people-centric model, built on communications and identity. Varonis, on the other hand, focuses on permissions, data classification, and data usage.
Sumit Dhawan, CEO of Proofpoint, notes that what data is accessible to a given AI tool or agent is a defining factor in more than one way. “As AI becomes embedded across the enterprise, the data it can access determines both its value and its risk. AI agents are increasingly accessing sensitive information and taking action across systems, making it critical for organizations to understand not only what data needs protecting and who can access it, but how it is actually being used.”
Betting on Certainty
The amount that Proofpoint is paying for Varonis is indicative of the expected value of the deal. With a price at 8.4 times the company’s trailing 12-month revenue and a 17% premium over its closing price on September 1st, this acquisition is a clear signal of Proofpoint’s faith in the benefits of integrating Varonis and its capabilities.
On the Varonis side of the deal, the board process included outreach to strategic and financial buyers to ensure the best possible value for the company and its customers. Being acquired by Proofpoint and delivering security in a combined platform is an offer of sure value, where the company’s standalone plan would be a risk.
The plan for what happens after the deal goes through—expected in the first half of 2027, pending shareholder and regulatory approval—is for Proofpoint to integrate the technology stacks of both companies, align go-to-market operations, and expedite efforts to deliver a combined security platform. Both companies are taking big steps and treating this acquisition as a deliverer of value and benefit to both sides and their customers.
What Security Leaders Should Do Before the Deal Closes
Defenders and leaders keeping an eye on this deal are recommended to make efforts to secure their data and AI before the acquisition is finalized. It is crucial to fully inventory which AI agents touch which data stores and monitor and log their activity and access. Agent permissions should be treated as a critical aspect of identity governance, not just app configuration.
The combination of the two companies will result in some changes, but looking to the history of both Proofpoint and Varonis will also be helpful in preparing for the future. Security leaders are encouraged to ask existing Proofpoint and Varonis vendors for concrete roadmaps.
Access as the Critical Barrier
This acquisition is a major signal of what industry leaders see as the most important areas in the future of cybersecurity. Consolidation in the form of mergers and acquisitions usually follows where risk is concentrated, highlighting the most pressing issues. Human and non-human actors are converging under one control model that is built to handle both. The real test of its success will be visibility into what AI agents are able to reach.
