Proofpoint Opens Varonis Talks After a Lender Revolt

Proofpoint is in talks to buy Varonis Systems, people familiar with the matter said Wednesday. Varonis shares rose 10.4%, taking the data-security company’s market value to about $5.4 billion.

The approach landed after lenders rewrote a $5 billion Proofpoint loan in late July. Thoma Bravo, which took Proofpoint private in 2021, is using that platform to bid.

Proofpoint Is Negotiating Terms With Varonis

People familiar with the matter said Proofpoint is negotiating terms of a potential deal with Varonis, which has been working with advisers to field takeover interest. A transaction could be announced in the coming weeks if the talks do not fall apart, they said. There is no signed agreement, and another suitor could still appear.

Thoma Bravo declined a request for comment. Proofpoint and Varonis did not immediately respond. Varonis, based in Miami with research operations in Herzliya, sells software that classifies sensitive data, watches how employees use it, and flags abnormal access. It employs more than 2,400 people across 14 offices.

Before Wednesday’s jump, the company was valued at about $5 billion. That is the tape a buyer now has to beat, not the June price that first put a sale in play.

WHAT WE KNOW

• The talks: Proofpoint is negotiating a potential purchase of Varonis, and Varonis has advisers running a process, according to people familiar with the matter.
• The tape: Varonis shares rose 10.4% on Wednesday, taking the market value to about $5.4 billion from about $5 billion a day earlier.
• The silence: Thoma Bravo declined to comment, and neither company issued a statement on Wednesday.
• The owner: Thoma Bravo has held Proofpoint since a 2021 take-private that valued the email-security firm at $12.3 billion.

WHAT IS UNCONFIRMED

• The price: No bid, multiple, or mix of cash and debt has been disclosed.
• The close: Talks can still collapse, and another bidder can still emerge.
• The financing: It is not public how a purchase would sit beside Proofpoint’s newly amended loan documents.

Until a price lands, the stock is trading the possibility of a bid, not the terms of one.

Forty New Handcuffs on a $5 Billion Loan

Late July was a rough month for Proofpoint’s credit. The company reworked a proposed refinancing of roughly $5 billion of debt after lenders pushed back, a revolt described by people familiar with the loan and a lender presentation. Most lenders agreed to extend the maturity by two years. Proofpoint will pay about $60 million more in annual interest for that extra time.

Negotiations started with about a dozen proposed amendments and, after nine days, ran to about 40 changes in the loan documents. The package tightens limits on extra borrowing, investments, and asset transfers. It also adds checks meant to stop deals that weaken lenders’ claims.

WHAT LENDERS EXTRACTED IN JULY

• Omni blocker: The documents now restrict transactions that could move assets beyond creditors’ reach, add debt senior to existing loans, or otherwise weaken their claims.
• Interest cost: The extension raises Proofpoint’s annual interest bill by about $60 million.
• Quarterly calls: Lenders won mandatory check-ins with management, plus extra limits on moving intellectual property and on privately negotiated debt buybacks.
• What the sponsor kept: The loan remains covenant-lite, and Thoma Bravo did not inject new equity.

That is an awkward backdrop for a multi-billion-dollar purchase. A blocker written to stop collateral from walking away does not automatically kill a strategic buy, but it does mean lenders now sit much closer to any large check Proofpoint writes. The same credit market has been marking software borrowers as more exposed to an AI shakeout, which is why the extension was expensive.

The Inbox Varonis Spent $150 Million to Enter

The product map is less clean than a simple email-plus-data story. On Sept. 2, 2025, Varonis announced the SlashNext email security deal, a purchase valued at up to $150 million including retention awards. SlashNext’s tools sit in the same inbox that made Proofpoint famous. Co-founder and chief executive Yaki Faitelson sold that buy as a way to catch attacks before they become data breaches.

By connecting the dots between email, identity, and data we will dramatically increase the value of our MDDR service and help customers stop threats in their inbox, where many data breaches begin.

Yaki Faitelson, Co-Founder and CEO, Varonis SlashNext announcement

Proofpoint has been walking the other direction. Thoma Bravo’s portfolio history says the company bought Tessian and Normalize in 2024 to assemble a $250 million data-security book, then added Germany’s Hornetsecurity in 2025 to widen its European reach. Each side has been building the other’s original franchise. A combination would collapse two incomplete platforms into one sales motion. It would also force a choice about overlapping email products that Varonis only just paid to own.

Rob Sobers, Varonis’s chief marketing officer, put the buyer logic in one line last year: every CISO wants consolidation. That line now cuts both ways. Proofpoint can argue it is buying the data layer customers already ask it to bundle. Varonis shareholders can argue they already started that bundle, and should be paid for it.

Thoma Bravo Circled Varonis in June

Wednesday’s talks are a second chapter, not a first look. On June 23, people familiar with those discussions said Varonis was weighing a sale after preliminary interest from Blackstone, Thoma Bravo, and Vista Equity Partners. Varonis declined to comment then as well. Shares jumped about 30% after those June reports, which is why a mid-single-digit move on Wednesday looks small only if you ignore the earlier rerating.

A Wells Fargo note at the time called private-equity interest unsurprising and said a takeover at $45 to $50 a share, a 30% to 40% premium, would warrant consideration, even while the firm’s own fundamental target sat at $35. The stock now trades as if that June band is already in the price. A buyer that wants a fresh premium has to clear a higher tape than the one Wells Fargo was using in June.

Thoma Bravo showed up in that June list under its own name. Using Proofpoint as the bid vehicle is the tell. The firm is not shopping a standalone take-private as a financial buyer. It is trying to bolt Varonis onto a company it has held for five years and still has not exited.

HOW THE TWO COMPANIES MOVED INTO RANGE

1. April 26, 2021: Thoma Bravo agrees to take Proofpoint private in a deal valued at $12.3 billion, or $176.00 a share, a 34% premium.
2. August 31, 2021: The Proofpoint take-private closes and the stock leaves Nasdaq.
3. September 2, 2025: Varonis agrees to buy SlashNext for up to $150 million and steps directly into email security.
4. June 23, 2026: Varonis is said to be weighing a sale after interest from Blackstone, Thoma Bravo, and Vista.
5. Late July 2026: Proofpoint reworks a $5 billion loan after a lender revolt and accepts about 40 document changes.
6. July 28, 2026: Varonis reports second-quarter results and raises full-year guidance.
7. September 2, 2026: Proofpoint is said to be negotiating a purchase of Varonis.

The calendar is the argument. Thoma Bravo spent the summer repairing Proofpoint’s debt, then came back to a target it had already sized in June.

Varonis Is Almost a Pure SaaS Company

The operating story is why a process existed at all. Varonis has been converting customers off self-hosted software and has said that product line reaches end of life on December 31, 2026. At the end of 2025, SaaS annual recurring revenue was $638.5 million, or 86% of total ARR. By March 31, the company already reported SaaS ARR of $683.2 million.

Second-quarter results, released July 28, showed the conversion still running. Revenue was $180.0 million, up 18% from a year earlier, with $171.7 million of that from SaaS. Total SaaS ARR reached $726.0 million, up 52%, and 25% excluding conversions from the old term-license base. Faitelson said new logos and newer products, including Atlas, Interceptor, and database activity monitoring, were adding momentum as customers put money into data and AI security.

VARONIS’S LATEST OPERATING MARKERS

Profit is still thin next to that growth. The same guide that gets revenue to the mid-$730 million range only gets non-GAAP operating income to $11 million to $13 million. That gap is one reason the stock was available, and one reason a private owner may think it can squeeze the model harder than the public market has.

What a Combined Email and Data Shop Sells

Proofpoint’s pitch, as people around the talks have framed it, is that the two books sit next to each other. Proofpoint grew up stopping threats in email and then branched into compliance and people-centric security. Varonis grew up watching files, identities, and access, then added AI controls as customers started plugging assistants into corporate data. Sold together, the stack is inbox to repository, with one vendor on the breach that starts in a phish and ends in a shared drive.

Scale still favors the private company. Thoma Bravo’s portfolio page says Proofpoint’s ARR reached $2 billion in 2024, and the firm already counts a $250 million data-security book from Tessian and Normalize. Varonis’s SaaS ARR, at $726.0 million in the second quarter, would more than triple that data layer if a deal closed on today’s figures. It would also land inside a company that just promised lenders tighter control over extra borrowing.

PROOFPOINT AND VARONIS AT A GLANCE

If those two sales forces are merged, independent data-security vendors lose a large standalone competitor and gain a bundled rival that can price email and data together. That is the squeeze hiding behind the 10.4% pop. Remaining specialists would be selling against a private company that does not have to print a quarterly multiple, and against a channel that already talks to security buyers every week about inbound mail.

Cyber dealmaking has been slow, in part because buyers worry that AI tools will chew through older software categories. A Proofpoint-Varonis combination is a bet that data classification, access control, and inbox filtering still get paid even when models write the phishing mail. It is also a bet that a private owner can hold the combined company long enough for those products to look like one platform rather than two overlapping catalogs.

Five Years Private and Still Buying

Thoma Bravo closed the Proofpoint take-private on August 31, 2021, paying stockholders $12.3 billion in cash. Gary Steele was chief executive then. Sumit Dhawan, a former VMware president, took the job in 2023 and now leads a global workforce of over 4,500. Five years in, the firm is still holding the asset, still extending its debt, and still asking that company to buy growth rather than return capital.

Private buyers showed up for Varonis in June when the public multiple was depressed. They are still showing up in September after the stock has already moved. That gap, public markets marking cyber names down on AI fear while a sponsor bids for a data-security book, is the trade Thoma Bravo is making. It may yet lose the process to Blackstone, Vista, or a strategic that has not been named. It may also find that Proofpoint’s new loan language makes a large check slower to write than a press leak implies.

People close to the talks say an announcement could come in the coming weeks if negotiations hold. Until then, Varonis is a $5.4 billion public company with a live bid rumor, a nearly finished SaaS conversion, and an email product it bought only a year ago. Proofpoint is a private platform with a freshly amended $5 billion loan and a sponsor that has decided the way out of a five-year hold is to buy more, not less.

Disclaimer: This article is news reporting and analysis of unconfirmed merger talks and is for information only. It is not investment advice, a solicitation to buy or sell Varonis shares, or a statement that any transaction will be agreed or closed. Readers should consult a licensed financial adviser, and where needed a securities lawyer, before trading around deal rumors or making decisions based on them. Share prices, valuations, loan terms, and the status of the talks reflect company filings and people familiar with the discussions as of the dates named above and can change as negotiations continue.