Proofpoint buys Varonis for $6.3B: map what your AI agents can read

Proofpoint is paying $6.3 billion in cash for Varonis, and the deal is about one question: what can your AI read? The Thoma Bravo-owned email security company announced the Varonis acquisition on October 15. Varonis built its business on mapping who has access to which files. Now the "who" includes AI agents. A ten-person shop has the same problem at a smaller scale, and it does not need a $6.3B platform to start on it.

What actually happened

Per the announcement Varonis filed with the SEC:

• The price: $49.75 per share in cash, about $6.3 billion in total.
• The premium: 52% over the June 22 close, before the first sale rumors. 17% over the September 1 close, the day before Bloomberg reported the talks.
• The multiples: About 8.4x trailing revenue and 53x trailing free cash flow.
• The money: Thoma Bravo provides committed equity. Ontario Teachers' Pension Plan also invests in Proofpoint as part of the deal.
• The timeline: Expected to close in the first half of 2027, after a Varonis stockholder vote and regulatory approvals. Varonis then leaves Nasdaq.
• The pitch: One platform for finding sensitive data, controlling access "by people and AI," and stopping data loss. Varonis CEO Yaki Faitelson framed the mission as securing AI "and the data that powers it."

Why it matters for your business

An AI agent with access to your Google Drive or SharePoint reads everything its account can read. Not what you meant it to read. Everything. If the "All Staff" folder holds last year's payroll export, the agent can surface it to anyone who asks the right question.

That is the risk Varonis and Proofpoint sell against. The fix for a small business is mostly housekeeping:

• Audit shared folders before you connect an agent. Look for "anyone with the link" shares and old exports in common folders.
• Give each agent its own account. Do not connect an agent with the owner's login. A service account with scoped access is easy to audit and easy to cut off.
• Grant read access per folder, not per drive. The agent that drafts quotes needs the price list, not HR.
• Log what the agent reads. If your stack can't tell you which files an agent opened last week, fix that first.

If you are a Varonis or Proofpoint customer, nothing changes until 2027. Watch the renewal. Private-equity deals at 8.4x revenue tend to show up in pricing later.

Sources: Varonis 8-K exhibit (SEC), GovInfoSecurity.