Proofpoint, owned by Thoma Bravo, has agreed to buy Varonis Systems for $49.75 per share in cash, valuing the deal at about $6.3 billion. The announcement went out on 15 October and the filing is on EDGAR.

Almost every write-up led with a 52 percent premium. That number is real and it is in the filing. So is a second one.

Two premiums, two reference dates

Varonis's own announcement gives both, and names what each is measured against:

52 percent over the $32.71 close on 22 June 2026, described as "the last full trading day prior to initial rumors about a potential sale of the Company".

17 percent over the $42.35 close on 1 September 2026, "the last full trading day prior to additional media reports".

Between those two dates the share price rose about thirty percent on rumour alone. By the time the deal was signed, roughly two thirds of the headline premium had already been paid by the market rather than by the buyer.

Neither figure is wrong and neither is hidden. The company disclosed both, which is more than it was obliged to do in a headline. What happened is that the coverage picked the larger one, which is what coverage does, and the smaller one is the better description of what Proofpoint is paying relative to where the stock actually was.

The multiples, which nobody quoted at all

The filing also gives the valuation in terms that are harder to make flattering: roughly 53 times last-twelve-months free cash flow and 8.4 times last-twelve-months revenue, as of 30 June 2026.

Fifty-three times free cash flow is a growth multiple, not a value one. That is a statement about what the buyer expects the asset to become, and it is the number a reader should weigh against the phrase "data and AI security" in the press release.

What the seller actually said

Varonis chief executive Yaki Faitelson's quoted reasoning is unusually direct for this kind of announcement. Alongside the expected line that the company's "mission is to secure AI and the data that powers it", he describes the deal as "immediate, significant, and certain value" that exceeds the risk-adjusted value of the standalone plan.

That is a board explaining why it took cash now rather than executing its own plan, and saying so in the language of risk adjustment. It is the most informative sentence in the release.

Proofpoint's Sumit Dhawan offers the strategic frame: the combination creates "an intelligence advantage that helps customers see risk more clearly", and the release claims the result will be "one of the world's leading pure-play cybersecurity companies".

The structure

Thoma Bravo is providing committed equity and has secured debt financing commitments, and the Ontario Teachers' Pension Plan will also invest in Proofpoint. This follows Proofpoint's $1.8 billion purchase of Hornetsecurity in December 2025, so it is the second acquisition in under a year by a private-equity-owned buyer assembling a suite.

The deal is expected to close in the first half of 2027, subject to "customary closing conditions, including approval by Varonis shareholders and receipt of regulatory approvals". Until then, "Proofpoint and Varonis will continue to operate as separate and independent companies", and on completion "Varonis' common stock will cease trading on the Nasdaq".

That last point is the one with a consequence for everyone outside the deal. Varonis is a public company today, which means quarterly numbers, disclosed incidents and an 8-K obligation. After the close it is not, and a chunk of the data-security market goes dark to anyone who was reading those filings.

What to do

  • If you are a Varonis customer, nothing changes before the close, and the companies say they will operate separately until then. Plan around 2027, not this quarter.
  • If you are renewing, the questions worth asking are about roadmap and support commitments beyond the close, in writing.
  • If you track this market, note the disclosure loss. After the close there are no more quarterly filings from one of its larger pure plays.
  • If you read acquisition coverage generally, the lesson is cheaper than any of the above: when a premium is quoted, check the date it is measured from. The filing almost always says.

What is not established

  • Whether the deal closes. Shareholder approval and regulatory clearance are both outstanding, and the expected close is more than a year out.
  • What happens to overlapping products. Neither company has published a roadmap.
  • Whether the regulatory review raises concentration questions, given this is the buyer's second security acquisition in a year.
  • The total debt load on the combined company. The release confirms debt financing commitments without sizing them.
  • What the Ontario Teachers' Pension Plan is investing, or on what terms.