Proofpoint Is Buying Varonis for $6.3 Billion.

Proofpoint announced on October 15 that it has agreed to acquire Varonis Systems for approximately $6.3 billion in cash, at $49.75 a share. That is a 52 percent premium over where Varonis traded before sale rumors started, and the deal is expected to close in the first half of 2027. The combined company would serve more than 16,000 enterprises. The press releases talk about AI security platforms and unified data protection. All true. But none of it explains why the product is actually worth that money, so let me tell you what it looks like from inside a merger at a highly regulated company.

Every merger at a highly regulated company inherits a file system nobody mapped

When highly regulated companies merge, the scariest asset is not on the balance sheet. It is the file shares. Decades of them. Open permissions set by people who left years ago, customer data sitting in folders it was never supposed to reach, stale access nobody revoked because nobody knew it existed. You cannot secure what you cannot see, and on day one of a merger you cannot see most of it.

I have run Varonis through several of these. Its real job in that moment is brutally simple: show me where the sensitive data actually lives, and show me exactly who can touch it. Then, before I change a single permission or migrate a single share, it lets me sandbox the change and predict what breaks. You stop guessing about blast radius. In a merger, where one wrong permission change can expose customer data or halt a business unit, that is not a nice feature. It is the whole product.

The ROI nobody puts in the press release

Here is the part the acquisition coverage will miss. In every engagement, the fastest payback had nothing to do with threats. It was retention. Varonis finds the data that is past its compliance retention requirements, the stuff you are legally allowed to stop keeping on expensive primary storage, and you tier it to cold storage. The storage savings alone paid for the product. Security tools that fund themselves are rare. This one did, more than once.

That is the quiet reason a $6.3 billion price tag makes sense to me. Varonis is not just a security control. It is a cost control wearing a security badge, and CFOs understand that language fluently.

Why Proofpoint wants it

Proofpoint owns email and collaboration security. Varonis owns the data layer underneath it: where the files live, who can reach them, how they are used. Put them together and you finally get the complete picture of what people can access, whether they should be able to, and what happens when they do. With AI agents now reading files and acting across business systems, that access map is the entire game. You cannot govern what an agent touches if you never mapped what it can reach.

The deal still needs shareholder and regulatory approval, and the companies will operate independently until it closes. Integration at this scale is never clean. But strategically, this is the right pairing: communications security plus data security, aimed squarely at the AI access problem every enterprise is about to have.

The takeaway for defenders

If you run data security at a highly regulated company, watch how this integration lands. And if you are sitting on file shares inherited from your last three acquisitions that nobody has ever inventoried, that is your highest-leverage project this quarter. Map it before something else maps it for you.

Deal details: Proofpoint press release, BigGo Finance summary.

← kevintswaney.com