Proofpoint agrees to buy Varonis for $6.3bn: what changes for Varonis customers before and after the 2027 close

What was announced on 15 October

On 15 October 2026 Proofpoint signed a definitive agreement to acquire Varonis, the data security company listed on Nasdaq as VRNS. Varonis shareholders will receive $49.75 per share in cash. The two companies value the transaction at approximately $6.3bn, and on completion Varonis stock stops trading and the company becomes private.

Proofpoint is itself privately owned: the announcement describes it as a portfolio company of Thoma Bravo, which has provided committed equity and secured debt financing commitments for the deal. Ontario Teachers' Pension Plan has also agreed to invest in Proofpoint. The Varonis board approved the agreement unanimously after a review run by a committee of independent directors, which Varonis says included outreach to both strategic and financial buyers.

The terms in one table

SecurityWeek described it as the largest cybersecurity acquisition announced so far in 2026, in a year in which it has tracked more than 300 deals in the sector. It sits alongside the other consolidation we have been following in our running list of 2026 software acquisitions.

The premium depends on the date you pick

The 52% figure is the one in every headline, and it is accurate, but it is measured against the share price on 22 June 2026, which the filing calls the last full trading day before rumours of a sale. Measured against the close on 1 September, the last full trading day before further media reports, the premium is 17%. Both numbers are in the same press release. The smaller one is the better guide to how much the market had already priced in, and it matters for shareholders more than for customers, but it is a useful early example of reading the announcement for what it says rather than what it leads with.

No earnings call

Varonis will still report third-quarter results after the US market close on 3 November, but the filing says that in light of the transaction it will not hold an earnings conference call. For customers that removes one of the few public forums where management would normally be asked about product direction and the self-hosted migration.

What Proofpoint and Varonis have actually committed to

Proofpoint published a customer-facing page alongside the deal. It is worth reading closely because it separates what is promised before close from what is promised after, and the two are quite different in strength.

Before close: business as usual, by necessity

Until the transaction closes, the companies say they will "continue to operate independently". They do not share customer data, and Varonis customers keep their Varonis team as their point of contact. This is less a commitment than a description of the law: two companies that have agreed to merge but have not yet received regulatory approval cannot behave as one. It is reliable for exactly that reason.

For Proofpoint's own customers the page goes further, saying products, contracts, pricing and support remain unchanged and renewal terms stand as agreed. Partner programmes and agreements are also unchanged.

After close: integration, quickly

The post-close language is where the substance is. Proofpoint says it intends to "simplify the customer experience by streamlining account management, support, and executive engagement", and to integrate the companies' complementary technologies. The SEC filing says Proofpoint "intends to move quickly to integrate the companies' capabilities" and to align go-to-market efforts. The products named for the combined platform span data security posture management, access governance, insider risk, data loss prevention and AI governance.

Against that, two sentences limit how much any of it can be relied on today: "No product decisions have been made" and "Specific plans will be shared after the transaction closes." Neither the press release nor the customer page makes a specific commitment on support levels, product lifetimes or pricing for Varonis customers after close.

Reading the language plainly

"Streamlining account management and support" means fewer account teams and a merged support organisation. That can be good for a customer who buys both products and currently manages two vendor relationships. It can be worse for a Varonis-only customer whose account manager and support engineers knew the product well and who becomes a smaller account inside a larger company. Neither outcome is announced. Both are consistent with the words used.

"Move quickly to integrate" is the phrase to weigh most heavily. Integration is where overlapping products are rationalised, and Proofpoint already sells data loss prevention, insider risk management and data security posture management. Where the two portfolios overlap, one product line usually becomes the strategic one and the other is maintained, merged or retired. Which way that goes for any given Varonis module is not known, and Proofpoint says it has not decided.

If you are comparing the two portfolios now, our Proofpoint vs Varonis comparison sets out where they overlap and where they do not.

The self-hosted deadline that predates the deal

A claim has been circulating, mostly in competitor marketing including from Netwrix, that Varonis is sunsetting its self-hosted product. We checked it against Varonis's own material rather than repeat it, and it is confirmed. In a post by chief executive Yaki Faitelson titled "Why we're going all in on SaaS", Varonis states that it announced the "end-of-life (EOL) of our legacy self-hosted product by December 31, 2026", and says it completed its transition to SaaS two years ahead of that date.

This decision was made before the Proofpoint agreement and is not part of it. It matters here because it lands in the middle of the period before close, and because it means many on-premises Varonis customers face a platform migration and an acquisition at the same time.

What Varonis says about the migration

• A dedicated team of specialists handles the move to the SaaS platform, and Varonis says the only thing it needs from the customer is access to the self-hosted environment.
• Customers can start using the SaaS platform immediately, including its managed data detection and response service and automated remediation.
• Varonis says there will be no gap in protection during the migration.

What it does not say

The Varonis post does not describe what happens to a self-hosted deployment that has not migrated by 31 December, and it does not mention migration pricing. Several competitors have pointed out the first gap, and they have an obvious interest in doing so, but the gap is real in the material we read. If you run Varonis on-premises, those are the two questions to put to your account team in writing: what support and updates you receive after the date, and what the SaaS subscription costs relative to your current one.

Moving from self-hosted to SaaS is also a change in where your file-system metadata and activity data are processed. For organisations with data residency or sovereignty requirements that is a security and compliance review, not just a commercial one, and it is the part of the timetable most likely to slip.

What an acquisition by a PE-owned buyer usually means for customers

Nothing below is announced for Varonis. It is the pattern that private equity-backed software consolidation tends to follow, and it is the reason the post-close language deserves more attention than the pre-close reassurance.

The financial logic

The deal is funded partly with debt, according to the filing, and was struck at about 8.4 times revenue and 53 times free cash flow. A buyer that pays that multiple with borrowed money needs the acquired business to produce more cash than it did as a public company. The usual levers are cost reduction through combined functions, which is what "streamlining account management and support" describes, and revenue growth through cross-selling and price.

What that tends to look like at renewal

• Price increases at renewal, often justified by bundling or by moving customers to a new platform SKU. Multi-year agreements signed before close are the main protection.
• Consolidated support, with merged queues and tiered support plans. Response times and access to senior engineers are what to watch.
• Portfolio rationalisation, where overlapping products are merged and one is eventually retired. Customers on the product that loses get a migration rather than an upgrade.
• Roadmap tilt toward the features that support the combined platform pitch, in this case AI governance and data security posture across Proofpoint's email and collaboration footprint.

The most aggressive version of this playbook is the one Bending Spoons runs, which we described in our analysis of the Bending Spoons playbook. Proofpoint is a strategic buyer integrating an adjacent product rather than an operator buying mature software to cut costs, so the comparison is a ceiling, not a forecast. The useful point from it is that the first year after close is when changes to pricing, packaging and support arrive, and the contract you hold going into that year is your main leverage.

What usually does not happen

Products this size are rarely switched off soon after a deal closes. Varonis is the asset Proofpoint is paying $6.3bn for, and its customers are much of that value. The realistic risk is not that Varonis disappears in 2027. It is that the product you bought becomes a module of something larger, priced and supported on terms set by a company with different priorities. Our tracker of legacy plan retirements shows how often that change arrives through packaging rather than an announcement.

What to do at renewal, and by when

The period between now and close, expected in the first half of 2027, is when a Varonis customer has the most leverage. Varonis is still an independent company with a sales target, and the post-close terms have not been written yet.

If your renewal falls before close

• Consider a multi-year term with a price cap. A fixed uplift ceiling of a stated percentage per year protects you through the integration period. Without one, the first renewal after close is priced by the new owner.
• Ask for change-of-control language. A clause that lets you terminate or renegotiate if the product is materially changed, merged or end-of-lifed is reasonable to request in a contract signed during a pending acquisition.
• Write support terms into the contract. Response times, named contacts and support tiers that sit in an order form survive a reorganisation better than ones that sit in a policy page.
• Check our Varonis pricing page and your own invoice history before the conversation, so that any increase is measured against a known baseline.

If you run Varonis self-hosted

You have two deadlines that interact. The self-hosted end-of-life of 31 December 2026 arrives first, and the acquisition closes some time after. Migrating to Varonis SaaS now means signing a new subscription with a company about to be acquired. Moving to a different product means a replacement project measured in months: discovery, classification and permissions baselines all have to be rebuilt, and eleven weeks is a short runway for that. Get the post-deadline support position in writing before choosing either.

If you buy both Proofpoint and Varonis

You are the customer the deal is designed for, and the one most likely to see a bundled offer. That is leverage as well as a risk: a combined renewal negotiated after close may be cheaper than two, but it also makes both products harder to replace. Compare against Proofpoint alternatives such as Mimecast before accepting a bundle, and see Mimecast vs Proofpoint for the email side.

If your renewal falls after close

Start evaluating now rather than at the renewal date. A data security platform takes months to replace, so a credible alternative has to be tested before the renewal conversation if it is to count as leverage in it.

The alternatives, and what each is good at

Varonis covers a wide surface: data discovery and classification across file systems, SaaS and cloud, permissions and access mapping, user behaviour monitoring, and increasingly AI security. Few alternatives cover all of it, so the useful question is which part of Varonis you rely on. Our full list is on the Varonis alternatives page, and the wider field is in the cybersecurity category.

Netwrix

Netwrix is the closest like-for-like for self-hosted Varonis customers who want to stay on-premises, with auditing for file servers and Active Directory at its core. Netwrix is also the vendor most actively marketing the self-hosted end-of-life to Varonis customers, which is reason to read its comparisons with care, not to dismiss the product. See Netwrix pricing and how it compares with BigID in BigID vs Netwrix.

Cyera

Cyera is a cloud-native data security posture management vendor and the obvious choice for organisations whose sensitive data is now mostly in cloud storage and SaaS. If your Varonis use is weighted toward on-premises Windows file shares, test that coverage specifically. We do not yet have a Cyera profile on Softwr.

BigID

BigID is strongest on discovery and classification across a large number of data sources, and is often bought by privacy and governance teams as well as security. Our BigID vs Varonis comparison covers the overlap, and BigID pricing has what is published.

Microsoft Purview

Purview is Microsoft's data governance and protection suite, and for an organisation whose data lives mostly in Microsoft 365 it may already be partly licensed. It is the lowest-friction option in that estate and the weakest outside it. If you are weighing Microsoft's security stack more broadly, our Microsoft Sentinel vs Varonis comparison covers the monitoring side of that relationship.

Rubrik

Rubrik comes at data security from backup and recovery, adding sensitive data discovery and threat monitoring over the data it protects. It suits organisations that want recovery and data risk in one place; see Rubrik vs Varonis.

Staying with Varonis

Staying is a reasonable decision. The product does not change on 15 October, the companies remain independent until close, and a well-negotiated contract signed in the next few months may be the best-protected position available. The case for evaluating alternatives is not that Varonis is getting worse. It is that a credible alternative is what gives a renewal negotiation its teeth, and if detection is the priority, our CrowdStrike Falcon vs Varonis comparison covers the endpoint-led alternative.

Questions people ask

Who is buying Varonis and for how much?

Proofpoint, a portfolio company of the private equity firm Thoma Bravo, agreed on 15 October 2026 to acquire Varonis for $49.75 per share in cash. The companies value the transaction at approximately $6.3bn. Varonis will be delisted from Nasdaq and become a private company when the deal closes.

When will the Proofpoint and Varonis deal close?

The companies expect to close in the first half of 2027. Completion requires approval from Varonis shareholders and regulators, plus other customary conditions. Until then Proofpoint and Varonis operate as separate, independent companies.

Will Varonis pricing or support change after the acquisition?

Nothing changes before close. After close, Proofpoint says it intends to streamline account management, support and executive engagement and to integrate the products, but it states that no product decisions have been made and that specific plans will be shared after closing. No commitment on post-close pricing or support levels has been published, so the protection available is what you write into your contract now.

Is Varonis ending its self-hosted, on-premises product?

Yes. Varonis has said it set end-of-life for its legacy self-hosted product by 31 December 2026 and is moving customers to its SaaS platform, with a dedicated migration team. This was decided before the Proofpoint agreement. Varonis has not publicly detailed what happens to deployments that have not migrated by that date, so ask your account team in writing.

Should I renew Varonis now or wait?

If your renewal falls before close, a multi-year term with a capped annual increase, change-of-control language and written support terms is usually the best-protected position. If it falls after close, start testing an alternative now so that it counts as leverage at renewal. See our Varonis alternatives.

What are the main alternatives to Varonis?

Netwrix for on-premises file server and Active Directory auditing, Cyera for cloud-native data security posture management, BigID for discovery and classification, Microsoft Purview for Microsoft 365 estates, and Rubrik for data security tied to backup and recovery. Which fits depends on which part of Varonis you rely on.

Is the 52% premium the real premium?

It is measured against $32.71, the Varonis close on 22 June 2026 before sale rumours. Against the $42.35 close on 1 September 2026, the last trading day before further media reports, the premium is 17%. Both figures appear in the same filing.

Sources

Every price, limit and date above was checked against these pages on the day shown. Where a figure has since moved, the vendor’s own page is the authority and this one is a snapshot.

1. 1Proofpoint to Acquire Varonis · Varonis Systems (SEC Form 8-K, Exhibit 99.1)Price per share, both premium reference dates, valuation multiples, financing, expected close, conditions and the cancelled earnings call.Checked 16 October 2026
2. 2Proofpoint to acquire Varonis · ProofpointCustomer-facing commitments: independence until close, no product decisions made, and post-close plans to streamline account management and support.Checked 16 October 2026
3. 3Why We're Going All In on SaaS · VaronisVaronis confirming end-of-life for its self-hosted product by 31 December 2026 and its migration offer.Checked 16 October 2026
4. 4Proofpoint Inks $6.3 Billion All-Cash Deal to Acquire Varonis · SecurityWeekContext on both portfolios and the deal as the largest cybersecurity acquisition announced in 2026 to date.Checked 16 October 2026