Proofpoint pays $6.3bn for Varonis: DLP guarded the exits, DSPM guards the permissions

01Exits versus entitlements

Classic DLP, Proofpoint’s second business after email, watches the exits. It sits on the mail gateway, the browser upload and the USB port and pattern-matches content on the way out: a PAN, a card number, a file stamped confidential. It fails when the problem is not the exit but the entitlement. A SharePoint site open to “Everyone” or a file share nobody has reviewed in years is not a loss event, so nothing fires. Varonis sells the other half: it computes effective access, through nested groups, inherited rights and share links, to every piece of data it classifies, then removes the access nobody uses. The trade calls the first part DSPM and the second Data Access Governance.⁹

Copilots and agents turned that from a hygiene project into the binding constraint. An assistant will surface anything its user can read, so over-permissioning becomes a leak no content rule can describe. The regulated form of the question, where personal data lives and who can reach it, is what the DPDP Rules on breach reporting and erasure ask from 13 May 2027.⁷ Proofpoint already owns a DSPM, Normalyze, and an India data centre opened in 2025.⁸ It is paying 8.4 times Varonis’s trailing revenue and 53 times its trailing free cash flow for the deeper version, and for the permission data of 16,000 enterprises to sit beside its own email and identity telemetry.¹

02The price, against the year's other deals

Three 2026 transactions set the scale. Google completed Wiz at $32 billion on 11 March;⁴ Palo Alto Networks completed CyberArk at $25 billion in February;⁵ Visa agreed to buy BioCatch for $2.4 billion on 3 August.⁶ Varonis is the only one of the four bought by a private-equity-owned company, and private equity does not pay 52% over the undisturbed price for a product it admires. It pays because the combined company removes a vendor and a dataset from the customer’s stack; the pricing power that follows is what a 53-times-cash-flow multiple assumes.¹

03What to ask before the close

Nothing changes contractually until the deal closes, and Proofpoint says product plans will be shared only after that.² The next six to eight months are therefore when an Indian customer of either company has the most room to negotiate.

1. Change of control. Read the assignment clause in your order form. If you are RBI- or SEBI-regulated, your outsourcing policy almost certainly requires notice of a vendor’s change of ownership; ask who will send it and when.
2. Roadmap overlap. Proofpoint owns Normalyze; Varonis sells DSPM. Ask in writing which survives, with a no-charge migration if yours does not.
3. India support and residency. Proofpoint’s India data centre exists for DPDP residency;⁸ Varonis’s India residency is unverified on our guide.⁹ Ask whether Varonis tenants will move into the India region, on what timetable, and who answers the phone in IST.
4. Pricing. Both vendors are quote-priced in USD; TechBag invoices in INR with 18% GST on top. A multi-year renewal signed before the close locks today’s price list; signed after, you are negotiating with the largest data-security vendor there is.