Tracking who and what can reach sensitive files is about to sit inside one of the largest email and human-risk security platforms. Proofpoint has agreed to buy Varonis for about $US6.3 billion as AI agents gain broad access to corporate data.
Proofpoint, owned by private equity firm Thoma Bravo, announced the all-cash deal with Varonis on 15 October. Varonis shareholders will receive US$49.75 a share.
That is a 52% premium to Varonis' closing price on 22 June, before rumours of a sale first surfaced. The deal values Varonis at about 8.4 times its trailing revenue.
The two companies come from different ends of security. Varonis maps where sensitive data sits, who can reach it and how it is used. Proofpoint built its business blocking phishing, fraud and other attacks aimed at employees.
"Cybersecurity has evolved from securing networks and infrastructure to protecting people," Proofpoint CEO Sumit Dhawan wrote in a blog post announcing the deal. "AI is now driving the next fundamental shift: securing the data that powers AI and governing how AI agents and people interact with it."
Dhawan said AI is changing the equation on two fronts. Outside the enterprise, attackers are using AI to launch faster, more sophisticated attacks on data and critical systems.
Inside, organisations are deploying AI agents to augment employees, "giving them unprecedented access to sensitive data and creating new insider risks", he wrote. "AI agents can access, analyze, and move enormous volumes of data in seconds."
The combined company plans to span data security posture management, data access governance, insider risk, data loss prevention and AI governance.
"By connecting what people and AI agents can access with how they interact with and use data, we intend to unify threat protection, data security, and AI governance," Dhawan wrote.
He pointed to Proofpoint's scale: 2.37 trillion emails scanned a year and 410 billion data security events ingested, feeding its Knowledge Graph. Add Varonis' view of sensitive data, access privileges and usage, and the aim is to find, protect and fix data risks "at machine speed".
Dhawan also made a consolidation pitch. "For CISOs and CIOs, this also means stronger protection with less complexity and lower costs," he wrote, while promising to maintain "open integrations across the broader cybersecurity ecosystem".
"This is not an incremental evolution; it is a structural shift in cybersecurity," he wrote.
Varonis CEO and co-founder Yaki Faitelson said in the joint announcement: "Our mission is to secure AI and the data that powers it. By joining forces with Proofpoint, we can achieve this mission faster than ever."
The combined company will serve more than 16,000 enterprises. The deal is expected to close in the first half of 2027, subject to Varonis shareholder and regulatory approvals. Varonis will then delist from Nasdaq and become a private company.
Microsoft 365 oversharing
On the same day, Proofpoint's MSP Platform business announced Microsoft 365 updates aimed at the same exposure. A new Tenant Risk Exposure feature gives managed service providers and administrators a visual overview of permission and sharing risks across M365 tenants.
Dashboard widgets flag anonymous access, external users, organisation-wide permissions, public groups, inactive guests and orphaned accounts. Shortcuts let administrators fix them manually or automatically, and a report shows tenant status at a glance. The feature complements Proofpoint's 365 Permission Manager.
Proofpoint said the updates are designed to "strengthen the foundations for secure AI adoption". They roll out in the fourth quarter of 2026.
A new Explainability feature in Email Live Tracking shows why an email was judged suspicious or legitimate. This is intended to help security teams investigate false positives more efficiently.
Security awareness training is moving into Microsoft Teams. After an e-learning session, Proofpoint's AI.MY assistant asks employees three questions tailored to their awareness level and gives immediate feedback. The results update each person's knowledge profile.
An AI Cyber Assistant Agent in the Control Panel adds conversational help with onboarding, configuration and security operations for partners and administrators.
Proofpoint has made a run of Microsoft 365 and AI security acquisitions. It acquired German M365 security provider Hornetsecurity in a deal reportedly worth more than US$1 billion, and AI security startup Acuvity in February, CyberScoop reported. Varonis bought AI security firm AllTrue.ai for US$150 million.