Proofpoint, owned by Thoma Bravo, has agreed to buy Varonis Systems for $49.75 per share in cash, valuing the deal at about $6.3 billion. The announcement went out on 15 October and the filing is on EDGAR.

Almost every write-up led with a 52 percent premium. That number is real and it is in the filing. So is a second one.

Two premiums, two reference dates

Varonis's own announcement gives two premiums for the same price, and names what each is measured against. It is 52 percent over the $32.71 close on 22 June 2026, and it is 17 percent over the $42.35 close on 1 September 2026. Same deal, same $49.75, two reference dates ten weeks apart.

The filing says what each date is. 22 June was "the last full trading day prior to initial rumors about a potential sale of the Company". 1 September was "the last full trading day prior to additional media reports".

Between those two dates the share price rose about thirty percent on rumour alone. Put the three closes side by side and the arithmetic is plain: of the $17.04 between 22 June and the $49.75 offer, $9.64 had already arrived before 1 September. More than half of the headline premium was paid by the market rather than by the buyer.

Neither figure is wrong and neither is hidden. The company disclosed both, which is more than it was obliged to do in a headline. What happened is that the coverage picked the larger one, which is what coverage does, and the smaller one is the better description of what Proofpoint is paying relative to where the stock actually was.

The multiples, which nobody quoted at all

The filing also gives the valuation in terms that are harder to make flattering: roughly 53 times last-twelve-months free cash flow and 8.4 times revenue, as of 30 June 2026. Fifty-three times free cash flow is a growth multiple, not a value one, and it is the number to weigh against the phrase "data and AI security" in the release.

That is a statement about what the buyer expects the asset to become rather than what it currently earns, and it is the part of the announcement that carries the most risk for the buyer.

What the seller actually said

Varonis chief executive Yaki Faitelson's quoted reasoning is unusually direct for this kind of announcement. Alongside the expected line that the company's "mission is to secure AI and the data that powers it", he describes the deal as "immediate, significant, and certain value" that exceeds the risk-adjusted value of the standalone plan.

That is a board explaining why it took cash now rather than executing its own plan, and saying so in the language of risk adjustment. It is the most informative sentence in the release.

Proofpoint's Sumit Dhawan offers the strategic frame: the combination creates "an intelligence advantage that helps customers see risk more clearly", and the release claims the result will be "one of the world's leading pure-play cybersecurity companies".

The structure

Thoma Bravo is providing committed equity and has secured debt financing commitments, with the Ontario Teachers' Pension Plan also investing in Proofpoint.

It is the buyer's second security acquisition in under a year, after Hornetsecurity in December 2025.

The deal is expected to close in the first half of 2027, subject to "customary closing conditions, including approval by Varonis shareholders and receipt of regulatory approvals". Until then, "Proofpoint and Varonis will continue to operate as separate and independent companies".

After the close, the filings stop

On completion, "Varonis' common stock will cease trading on the Nasdaq". That is the line with a consequence for everyone outside the deal. Varonis is a public company today, which means quarterly numbers, disclosed incidents and an obligation to file an 8-K when something material happens. After the close it is none of those things, and one of the larger pure plays in data security goes dark to anybody who was reading those filings.

What to do

  • If you are a Varonis customer, nothing changes before the close, and the companies say they will operate separately until then. Plan around 2027, not this quarter.
  • If you are renewing, the questions worth asking are about roadmap and support commitments beyond the close, in writing.
  • If you track this market, note the disclosure loss. After the close there are no more quarterly filings from one of its larger pure plays.
  • If you read acquisition coverage generally, the lesson is cheaper than any of the above: when a premium is quoted, check the date it is measured from. The filing almost always says.

What is not established

  • Whether the deal closes. Shareholder approval and regulatory clearance are both outstanding, and the expected close is more than a year out.
  • What happens to overlapping products. Neither company has published a roadmap.
  • Whether the regulatory review raises concentration questions, given this is the buyer's second security acquisition in a year.
  • The total debt load on the combined company. The release confirms debt financing commitments without sizing them.
  • What the Ontario Teachers' Pension Plan is investing, or on what terms.