Report: Thoma Bravo's Proofpoint in Talks to Acquire Varonis in Major Data Security Consolidation

Proofpoint, the email security and insider-threat vendor owned by private equity firm Thoma Bravo, is reportedly in talks to acquire Varonis Systems, according to a Bloomberg report citing people familiar with the matter. If it comes together, the deal would rank among the largest technology take-privates since this year’s software-stock selloff.

According to the report, Proofpoint is negotiating deal terms with Varonis, which has been working with advisers to field acquisition interest. The market responded immediately: Varonis shares jumped roughly 13% on the news, with the company carrying a market value of approximately $4.7 billion prior to the report. Sources cautioned that an announcement could come in the coming weeks, but stressed no final decision has been made, and either the talks could collapse or a competing bidder could still surface. Neither Proofpoint, Thoma Bravo, nor Varonis has confirmed the talks publicly.

For practitioners tracking the DLP and DSPM markets, this is a meaningful consolidation signal regardless of whether it ultimately closes. Proofpoint already acquired DSPM pioneer Normalyze in 2024 to bolt data-security posture management onto its email and insider-threat DLP portfolio. Adding Varonis — one of the largest independent data security platforms, with deep capabilities in DSPM, data access governance, and insider-risk analytics — would create a combined vendor spanning nearly the full data-security stack: DLP, DSPM, data access governance, and insider-risk monitoring under one roof. That would put Proofpoint in more direct competition with Cyera, which has been aggressively building out its own platform through acquisitions (including a recent NHI governance deal with Oasis Security), as well as with Securiti, Sentra, and Concentric AI.

Worth flagging clearly: this is reported deal talk sourced to unnamed insiders, not a signed or announced transaction. Terms, timing, and even whether the deal happens at all remain unconfirmed. Still, organizations currently running Varonis DSPM or DAG alongside Proofpoint DLP — or evaluating either vendor for a data security platform consolidation — should watch this closely, since a completed acquisition would directly affect roadmap, licensing, and integration decisions for both product lines.