--- title: "Proofpoint pays $6.3bn for Varonis: DLP guarded the exits, DSPM guards the permissions" summary: "What the 15 October 2026 agreement says, why an email-security company wants a file-permissions company, and what an Indian Varonis or Proofpoint customer should ask before the H1 2027 close." url: https://www.thetechbag.com/blog/proofpoint-varonis-6-3-billion-dlp-to-dspm format: Note desk: "Data & privacy" published: 2026-10-16 facts_checked: 2026-10-16 author: TechBag (The TechBag Journal) tags: ["Proofpoint","Varonis","DSPM","DLP","Data Access Governance","M&A","Thoma Bravo","DPDP"] cover: https://www.thetechbag.com/blog/covers/proofpoint-varonis-6-3-billion-dlp-to-dspm.png --- # Proofpoint pays $6.3bn for Varonis: DLP guarded the exits, DSPM guards the permissions *What the 15 October 2026 agreement says, why an email-security company wants a file-permissions company, and what an Indian Varonis or Proofpoint customer should ask before the H1 2027 close.* Note · Data & privacy · By TechBag · Published 2026-10-16 · Facts checked 2026-10-16 · Canonical: https://www.thetechbag.com/blog/proofpoint-varonis-6-3-billion-dlp-to-dspm Proofpoint will pay $49.75 a share in cash for Varonis, about $6.3 billion and a 52% premium to the $32.71 at which Varonis closed on 22 June 2026, the last full trading day before the sale rumours began.[1] The agreement was signed on 15 October 2026 and approved unanimously by the Varonis board; Thoma Bravo, which owns Proofpoint, is providing the equity with Ontario Teachers’ Pension Plan investing alongside; the close is expected in the first half of 2027.[1] It is the largest cybersecurity acquisition announced so far this year,[3] and an odd one on its face: an email-security company is buying a company whose core product, since 2005, has been a map of who can open which file.[9] The price says why. ## Exits versus entitlements Classic DLP, Proofpoint’s second business after email, watches the exits. It sits on the mail gateway, the browser upload and the USB port and pattern-matches content on the way out: a PAN, a card number, a file stamped confidential. It fails when the problem is not the exit but the entitlement. A SharePoint site open to “Everyone” or a file share nobody has reviewed in years is not a loss event, so nothing fires. Varonis sells the other half: it computes effective access, through nested groups, inherited rights and share links, to every piece of data it classifies, then removes the access nobody uses. The trade calls the first part DSPM and the second Data Access Governance.[9] Copilots and agents turned that from a hygiene project into the binding constraint. An assistant will surface anything its user can read, so over-permissioning becomes a leak no content rule can describe. The regulated form of the question, where personal data lives and who can reach it, is what the DPDP Rules on breach reporting and erasure ask from 13 May 2027.[7] Proofpoint already owns a DSPM, Normalyze, and an India data centre opened in 2025.[8] It is paying 8.4 times Varonis’s trailing revenue and 53 times its trailing free cash flow for the deeper version, and for the permission data of 16,000 enterprises to sit beside its own email and identity telemetry.[1] TechBag countTechBag count On our DSPM guide, 5 of 18 products carry the deepest access-path rating; 3 of the 5 are Varonis. On our DLP guide, Varonis DLP is 1 of 21 products across 14 vendors. Both tables reviewed 24 August 2026. ## The price, against the year's other deals Three 2026 transactions set the scale. Google completed Wiz at $32 billion on 11 March;[4] Palo Alto Networks completed CyberArk at $25 billion in February;[5] Visa agreed to buy BioCatch for $2.4 billion on 3 August.[6] Varonis is the only one of the four bought by a private-equity-owned company, and private equity does not pay 52% over the undisturbed price for a product it admires. It pays because the combined company removes a vendor and a dataset from the customer’s stack; the pricing power that follows is what a 53-times-cash-flow multiple assumes.[1] **Figure: Of four large 2026 security deals, Varonis is third by value and the only one bought by a private-equity owner** *Deal value, US$ billion, January to October 2026* Wiz Google, completed 11 Mar 2026 32 bn CyberArk Palo Alto Networks, completed Feb 2026 25 bn Varonis Proofpoint, announced 15 Oct 2026 6.3 bn BioCatch Visa, announced 3 Aug 2026 2.4 bn | | Value (bn) | | --- | --- | | Wiz | 32 | | CyberArk | 25 | | Varonis | 6.3 | | BioCatch | 2.4 | Source: Varonis 8-K exhibit; Wikipedia (Wiz, CyberArk); Visa press release · as of 16 October 2026 · Wiz and CyberArk completed; Varonis and BioCatch announced, closing 2027 ## What to ask before the close Nothing changes contractually until the deal closes, and Proofpoint says product plans will be shared only after that.[2] The next six to eight months are therefore when an Indian customer of either company has the most room to negotiate. 1. **Change of control.** Read the assignment clause in your order form. If you are RBI- or SEBI-regulated, your outsourcing policy almost certainly requires notice of a vendor’s change of ownership; ask who will send it and when. 2. **Roadmap overlap.** Proofpoint owns Normalyze; Varonis sells DSPM. Ask in writing which survives, with a no-charge migration if yours does not. 3. **India support and residency.** Proofpoint’s India data centre exists for DPDP residency;[8] Varonis’s India residency is unverified on our guide.[9] Ask whether Varonis tenants will move into the India region, on what timetable, and who answers the phone in IST. 4. **Pricing.** Both vendors are quote-priced in USD; TechBag invoices in INR with 18% GST on top. A multi-year renewal signed before the close locks today’s price list; signed after, you are negotiating with the largest data-security vendor there is. Our view Our view: renew early if you were renewing anyway, and do not add Varonis modules you had not already planned to buy. The bundle will be repriced after the close; the discount offered now is funded by the premium above. How we did this Figures as of 16 October 2026 Deal terms, premiums, multiples, financing and the 16,000-enterprise figure are from the Varonis press release filed as Exhibit 99.1 to its Form 8-K of 15 October 2026; the deferral of product plans is from Proofpoint’s announcement page. “Largest of 2026” is SecurityWeek’s characterisation. Comparables come from Wikipedia (Wiz, CyberArk) and Visa’s release; other deals were left out for want of a primary value. DPDP dates are from a practitioner timeline, not the Gazette. Product counts are TechBag’s, from the DSPM and DLP guide tables reviewed 24 August 2026. Not stated: equity value, Varonis ARR or headcount, any India price list or rupee conversion. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Varonis Systems, press release, Exhibit 99.1 to Form 8-K](https://www.sec.gov/Archives/edgar/data/0001361113/000121390026109901/ea030861001ex99-1.htm) — 15 October 2026 2. [Proofpoint, announcement: definitive agreement to acquire Varonis](https://www.proofpoint.com/us/proofpoint-signs-definitive-agreement-to-acquire-varonis) — undated page 3. [SecurityWeek, Proofpoint inks $6.3 billion all-cash deal to acquire Varonis](https://www.securityweek.com/proofpoint-inks-6-3-billion-all-cash-deal-to-acquire-varonis/) — 16 October 2026 4. [Wikipedia, Wiz (company)](https://en.wikipedia.org/wiki/Wiz_(company)) — completed 11 March 2026 5. [Wikipedia, CyberArk](https://en.wikipedia.org/wiki/CyberArk) — closed February 2026 6. [Visa, press release: Visa to acquire BioCatch](https://usa.visa.com/about-visa/newsroom/press-releases.releaseId.22626.html) — 3 August 2026 7. [DPDP Rules 2025, commencement timeline](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025 Practitioner summary; Gazette not fetched. 8. [TechBag, Proofpoint vendor hub](https://www.thetechbag.com/proofpoint) — reviewed mid-2026 9. [TechBag, DSPM decision guide](https://www.thetechbag.com/browse/data-security-privacy/dspm) — 24 August 2026 Related on TechBag: the [Varonis hub](https://www.thetechbag.com/varonis), the [Proofpoint hub](https://www.thetechbag.com/proofpoint), and the [DLP and insider-risk guide](https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk), where the exits-based products are compared. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Varonis vendor hub](https://www.thetechbag.com/varonis) — DSPM, Data Access Governance, DLP, DDR and the rest of the platform, quoted in INR - [Proofpoint vendor hub](https://www.thetechbag.com/proofpoint) — email security, DLP and insider risk, and the India data centre - [DLP & insider risk guide](https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk) — the exits-based products, 21 across 14 vendors