Proofpoint to buy Varonis for $6.3 billion

The deal pairs the email security giant's massive threat intelligence with Varonis' visibility into corporate data, as both companies race to secure the AI agents now roaming enterprise networks.

Proofpoint agreed Thursday to acquire Varonis Systems in a cash transaction valued at approximately $6.3 billion, combining two companies that have positioned themselves around a shared bet: that securing data has become the central problem of the AI era.

The acquisition pairs two distinct approaches to security. Varonis specializes in data security, mapping where sensitive information sits inside an organization, who can reach it, and how it is actually used. Proofpoint, owned by private equity company Thoma Bravo, built its business around protecting people, blocking phishing, fraud and other attacks that arrive primarily through email and target employees rather than machines.

Sumit Dhawan, Proofpoint’s CEO, wrote in a blog post Wednesday that AI is changing the security equation on two fronts. Outside the enterprise, attackers are using AI to launch faster and more advanced campaigns aimed at data and critical systems. Inside, companies are deploying AI agents that have wide-ranging access to sensitive information, creating new categories of insider risk.

“Data Security — protecting data from compromise, loss, and misuse by people or AI agents — has become the defining priority for organizations seeking to realize AI’s full potential,” Dhawan wrote.

The companies frame the deal as a response to that dual pressure. In a joint announcement, they said the combined organization would serve millions of organizations globally, and described plans for helping organizations adopt and secure AI.

Proofpoint’s global reach, he wrote, includes 3.4 million customers, 2.37 trillion emails scanned annually, 410 billion data security events ingested, and more than 13,000 sensors across 105 countries. Those signals feed what the company calls its Knowledge Graph, which strengthens its AI models with intelligence on threats, human behavior and data risk. Combined with Varonis’ visibility into sensitive data, the companies envision a foundation for discovering and remediating risks at machine speed.

“For CISOs and CIOs, this also means stronger protection with less complexity and lower costs,” Dhwan wrote. “Our goal is to simplify security operations, enable vendor consolidation, and free up resources for reinvestment in innovation, while maintaining open integrations across the broader cybersecurity ecosystem.”

The deal extends a buying pattern for both companies. In February, Proofpoint acquired Acuvity, an AI security startup whose platform monitors how employees and automated systems interact with external AI services. Financial terms were not disclosed. 

That purchase followed Proofpoint’s acquisition of Hornetsecurity, a German provider of Microsoft 365 security services, in a deal reportedly worth more than $1 billion. Varonis, for its part, acquired the AI security firm AllTrue.ai for $150 million. 

Yaki Faitelson, Varonis’ CEO and co-founder, said the company’s mission is “to secure AI and the data that powers it” and that joining Proofpoint would advance that goal faster than the company could on its own.

The deal, approved unanimously by Varonis’ board, is expected to close in the first half of 2027, subject to shareholder and regulatory approvals.

Government

• Senators press Trump admin to rally federal government around AI safety, security 

• FTC says ‘sextortion’ protection companies deceived customers about services 

• Anthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software

• DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub

Technology

• OpenAI says Iran, Russia used AI journalists, think tanks to influence Western media

• FBI, French authorities seize deepfake CSAM-for-sale websites 

• The legal questions raised by agentic AI hacks

• As AI world debates security, NVIDIA releases open source tools for agents

Threats

• Authorities charge alleged OLVX cybercrime marketplace operator in North Macedonia

• Microsoft drops an actively exploited zero-day among record high of 1,413 vulnerabilities

• Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day

• DOJ charges 14 over a sprawling North Korean remote work scheme

Policy

• Major rules for federal contractors handling sensitive data are nearing the finish line

• Wiretapping change sparks big privacy fight in the Golden State

• Here’s how experts think CISA should tell agencies to protect OT

• National cyber director: Government-industry collaboration vital to managing AI risks, competition with nations