I said this when Alphabet acquired Wiz, and I’ll say it again: you’ll remember where you were and what you were doing the day you found out Proofpoint acquired Varonis.

We see a deal at the scale and magnitude of Proofpoint-Varonis about once a year (lately) in the cybersecurity industry.

There are hardly enough superlatives for this one: largest data security acquisition ever¹, top ten (pure-play cybersecurity) strategic acquisition by deal size, Proofpoint’s largest acquisition by ~3.5x…I could go on.

It’s easy for a critic to look at large strategic acquisitions and nitpick the company being acquired. I’ve seen people’s skepticism about this one.

I get why that happens, but here’s the thing: Varonis did not need saving.

It had a clear path to $1 billion in annual revenue, modernized its platform by going all-in on SaaS, and assembled a team that built one of the defining data security businesses over the course of 21 years, including more than 12 years as a public company.

That context makes Proofpoint’s intended $6.3 billion acquisition of Varonis even more interesting.

It came down to a choice about what both companies could become together and how their combined strategy could lock in a position in cybersecurity’s ongoing quest for platformization.

This is a deal for the ages. We’ve got a lot to unpack here. Let’s go.

Varonis built an iconic cybersecurity company

I’ve grown to admire what Varonis has built: a durable company with deep domain expertise, competence, and strong products. Their leadership team is a model of stability. They went public with ~$30 million in total capital raised and $74 million of revenue, then methodically grew themselves into the iconic company you see today.

One other point that should not get lost in the industry discussion about Varonis: this is one of the largest outcomes we’ve ever seen for a strategic acquisition in the entire history of the cybersecurity industry.

On a personal level, Varonis was one of my first channel partnership opportunities at PwC, a joint client proposal to implement and execute a data security engagement at a large financial services institution. I was too early in my career to help with something like this, but I’ll always remember that time as my introduction to both Varonis and data security.

Nostalgia aside, I think Varonis had a viable standalone future had it chosen to continue that path. We don’t need to fully re-hash what might have been, but some context is still important.

The short version is many of the difficult obstacles they had been facing as a company were either behind them or under control:

• Their SaaS transition was effectively over.
• They were shipping faster than ever.
• Savvy acquisitions had been made across AI security, database access management, and email security.
• They were winning larger enterprise deals with larger deployments.
• Channel partnerships were coming together.
• The brand refresh was epic.

More importantly, data security has become more important than ever as a core security capability in the AI era. Regulation is and will continue to be a driver, but security alone is now a good reason to do data security well.

What all of this means to me is that Varonis had the ingredients it needed to remain independent, stay competitive, and eventually become one of cybersecurity’s next companies with $1B+ ARR.

You don’t have to squint very hard to see the trajectory:

The hard and often brutal part about strategy is that you don’t get to play out different scenarios in parallel universes. Difficult choices and one-way doors are part of the job.

As much as I wanted Varonis to stay at it on their own, the rational part of me understands why they decided an offer from Proofpoint was their best option.

A viable path that was getting harder

Even though Varonis had a viable independent future, its path was becoming increasingly difficult. Its SaaS transition, acquisitions, and other tactical wins I discussed earlier all created momentum, but their scenario was a lot more complex than the factors they could control.

Undertaking strategic moves like a SaaS transition, multiple acquisitions, and more as a public company is difficult on its own. There is a long and distinguished list of cybersecurity companies who have opted to make similar moves as private companies — some of which haven’t made it back yet.

Varonis did all of this in hard mode. Being a public company while simultaneously competing against Cyera’s aggressive, heavily funded growth and larger platforms expanding into data security created compounding pressures, especially in the face of the SaaSpocalypse the software industry faced earlier this year. Accomplishing what they did is a severely underrated feat.

I had quietly been viewing Varonis as an attractive platform acquisition for a top-tier private equity firm to build on.² They share a lot of positive attributes with other Thoma Bravo cybersecurity acquisitions. The rationale was there with the convergence of data security, identity, and AI. But, alas — a dose of private equity rocket fuel wasn’t in the cards, at least not as the featured company to build and shape for a return to public markets.

Joining Proofpoint under the Thoma Bravo umbrella was the next closest thing, with the added benefits of a larger revenue base and stronger competitive resources. Those factors (and more) made private ownership within a larger company an understandable strategic choice.

Proofpoint (via Thoma Bravo) had its own reasons for wanting to acquire Varonis. Let’s talk about some of those.

Proofpoint needed a more defensible strategic position, not just a product

Proofpoint was already a major cybersecurity company before this deal. They disclosed nearly $2.5 billion in annual recurring revenue as of mid-2026.

Email security got Proofpoint to $1.05 billion of annual revenue in 2020 and a nine-year run as a public company the first time around before Thoma Bravo took them private for $12.3 billion in 2021. “Still email security but bigger” was never going to be enough for a return to public markets. They knew that, and they’ve been steadily diversifying in the five years they’ve been private.

From a market standpoint, Proofpoint’s strategic challenge was finding a distinct position among the industry's largest independent competitors. A “podium position,” in Nadav Zafrir terms.

Collaboration security (or however you want to describe email security plus some adjacent coverage) was not a broad enough answer to Palo Alto Networks, CrowdStrike, or other relative peers at $2B+ revenue scale.

Buying a relatively established endpoint, SASE, identity, or SecOps company would have added scale but not enough differentiation from its larger peer group. Those categories are also a further reach from Proofpoint’s core platform and customer base.

Data security is a more natural extension of what Proofpoint already does in email, communications, and DLP. They already acquired Normalyze in 2024 to extend further into DSPM, but buying an early stage startup with DSPM alone doesn’t get you Varonis’s product breadth or ability to compete in large data security deals.

As Proofpoint moved deeper into data security, Varonis was (fortuitously?) moving toward Proofpoint’s core market. Their 2025 SlashNext acquisition brought Interceptor, an email security product. Interceptor targets newer email threats (more like Abnormal than Proofpoint). It’s intended to augment (not replace) core email security platforms like Proofpoint, roughly analogous to DSPM only addressing part of a core data security platform.

Those smaller deals extended both companies into each others’ respective markets, but it was still going to take some time before meaningful competition showed up. This combination accelerates the process and puts them on the same team. Varonis gives Proofpoint a position it could not have built quickly with smaller acquisitions.

Once the transaction closes, Varonis immediately gives Proofpoint a substantial position in the data security market. It’s a page out of the Nikesh Arora playbook for major cybersecurity market entry: if you want to compete right away, you have to buy a market leader.

More importantly, it makes Proofpoint a more distinct and scaled competitor in the cybersecurity platform race. The combined entity is a top five pure-play cybersecurity company by GAAP revenue, estimated at ~$3.4B (likely higher) by the time the transaction closes:

(Note: This chart doesn’t include diversified technology companies like Microsoft, Cisco, etc. or hybrid companies like Cloudflare or Rubrik. The intent is to do an illustrative comparison of scale based on reported or disclosed cybersecurity revenue figures.)

Scale was one of the primary rationale for the deal — Thoma Bravo said it themselves. Strategic positioning, scale, and a return to public markets made this worth doing for Proofpoint and its sponsor Thoma Bravo.

The announcement is just the start of a longer journey, though. Deal rationale and strategy meet reality once the transaction closes. I want to share some thoughts with you on that part, too.

Unlocking larger opportunities

Beyond the broad strategy and financial drivers, the upside for the combined company is about bigger deals in large customer segments. AI security is a calculated bet on top of that.

Varonis was already moving upmarket into larger enterprises and broader platform deals. That’s important progress, but it takes an inordinate amount of time.

Proofpoint is at the very top of the enterprise market. They have more than 80% of the Fortune 100 as customers. That’s a lot for any cybersecurity company, and certainly more than Varonis has on its own today. Proofpoint gives Varonis a chance to climb the enterprise ladder faster.

Cross-selling Varonis to new enterprise customers is obvious, but the full opportunity is much broader. Even shared customers may need to expand their data security deployments as AI raises the importance of finding, governing, and protecting data. There’s no reason to get picky about net new customers versus expansion. Any type of larger commitment is a win.

An added wrinkle (and open question) is the degree of protection a combined Proofpoint-Varonis offering gives them against increasing competition in the data security market. Joining Proofpoint doesn’t make that competition go away, but it makes the combined company financially sturdier with a wider set of enterprise relationships behind it. Defending its place in major accounts and competing for deals that would have been hard to win alone is a big win, too.

Proofpoint doesn’t need to win every data security opportunity for this deal to work. They have over 14,000 large enterprise customers, many of which don’t own DSPM yet. These companies are (or will, or should be in the market soon because of AI). There is still a lot of greenfield out there.

Microsoft, Cyera, and others are still going to win some. But if Proofpoint can improve Varonis’s chances in data and AI security during this critical AI-driven buying window, data security can become a much larger business within Proofpoint.

Cyral’s database activity monitoring is a slightly smaller, more predictable part of the upside. I expect it to keep displacing legacy DAM tools at a steady pace. Proofpoint’s reach into large accounts potentially speeds that up. DAM doesn’t need to be a flashy new category-defining business to add value.

AI security is the wildcard with the highest potential upside. For Varonis, it’s been so far so good with Atlas (from their AllTrue.ai acquisition), which could end up being a gem. AI security is very much an emerging market with all the properties that go with it, which is why I called it a wildcard.

I’m sure the financial model for the deal would have accounted for any existing AI security revenue and pipeline Varonis has today, but the long-term projection has a lot of variance. It’s a bet worth taking, though. Meaningful success in AI security is the difference between a solid deal and pure brilliance.

Speaking of platforms…that’s an open question about how Proofpoint approaches its portfolio and product strategy post-close.

What Proofpoint builds from here

Aside from the commercial and market opportunities, the other long-term component is Proofpoint’s product strategy and combined roadmap. Proofpoint says it hasn’t made decisions about the combined products yet.

I would assume the combined offering will look more like a multi-platform portfolio (a la Palo Alto Networks) than a fully integrated one across messaging, data, and AI security. That architecture still works, especially in established markets.

Integrating Varonis’s data and access context more deeply with Proofpoint’s email, communications, and DLP systems is still super helpful for customers, even without a full integration of the respective platforms. Similar story for AI security, which Varonis has already started doing between their data security platform and Atlas.

As much as people rave about (and criticize) platformization, many leaders still see value in consolidation and integration. Seth Boro put it bluntly, as PE people often do: “they want their existing strategic vendors to provide more.”

This has market implications, though. This time feels painful, at least right now.

Welcome to the new era of data security

The strange and tragic irony about the future of the data security market is that it may not be a standalone market at all. Not at billion-dollar, public company scale, anyway.

Varonis was one of the first — and potentially one of the last — companies of its size and stature in the data security market.

I doubt Cyera would even call itself a pure data security company anymore. Not after its entry into identity with Oasis, and certainly not after setting its ambitions on AI security market leadership with its most recent funding rounds.

As a practitioner, this is the part that’s painful for me to say: Data security has always made logical sense, but it usually takes regulation or a breach to force action.

I want a world where protecting data is a first-class priority in most security programs. Maybe that’s naive, but I’m not giving up.

AI gives us a really good reason to get there. Companies want agents to use their data, and protecting it is part of making that possible. For once, there’s a carrot alongside the stick.

This deal closes a chapter for Varonis and the standalone data security market many of us grew up with. I’m sad to see it end, even if I understand why.

I’m still hopeful data security will get the importance it deserves. It may just arrive inside a company that looks more like Proofpoint.

Footnotes

¹ Excluding backup and recovery (or cyber resilience, pick your favorite term).

² Purely my opinion and interpretation of their strategic options. I don’t know if this was ever under consideration beyond the same speculative reporting all of us saw periodically.