VRNS · Research
Thoma Bravo paid 8.4 times revenue for the map of who can open what
Varonis is being taken private. On Oct 15, 2026 it signed an all-cash merger with Proofpoint, a Thoma Bravo portfolio company, valued at about $6.3B and expected to close in the first half of 2027.
Varonis is being taken private. On Oct 15, 2026 it signed an all-cash merger with Proofpoint, a Thoma Bravo portfolio company, valued at about $6.3B and expected to close in the first half of 2027 [1][2].
This is our M&A update ahead of the deal: what the buyer is paying for, what the filings say about the business underneath, and what the remaining spread pays a holder to wait. Once the deal closes, Varonis leaves our public coverage and we will track it internally alongside Thoma Bravo.
| Scorecard | Read |
|---|---|
| Thesis | Proofpoint is buying the record of who and what can open sensitive data, the gate that superintelligence agents have to pass through, at about 8.4 times revenue on the companies' own math |
| What proves it wrong | Growth excluding conversions slows well below 25%, which would mean the price paid for a finished conversion rather than a gate |
| Deal status | Signed Oct 15, 2026; needs the stockholder vote, US antitrust clearance and specified foreign approvals; no financing condition |
| Key multiple | About 8.4 times LTM revenue and about 53 times LTM free cash flow, as disclosed by the companies [2] |
| Spread | 1.3% gross to the cash price, about 3.09% annualized to Mar 31, 2027 or 1.94% to Jun 30, 2027 (our calculation, internal close) |
| Balance sheet | $911.5M of cash and investments at Jun 30, 2026 against $460.0M of 1.00% convertible notes due 2029 [3][4] |
1. What Varonis does
Most companies have millions of files, folders, databases and cloud workspaces, and most employees can open far more of them than their jobs need. Varonis builds the map of that access.
It reads permissions and activity across file shares, Microsoft 365, cloud storage, databases, identity systems and SaaS applications, flags unusual behavior such as an account suddenly pulling thousands of files, and removes access nobody uses [5].
The company's own framing is the cleanest summary of why the product matters: "security outcomes are determined less by perimeter controls and more by how much access exists when something goes wrong" [5]. A firewall decides who gets in.
Varonis decides how much damage someone can do once they are in.
That framing is why the deal is interesting to us. In our toll-gate work, the strongest software positions own a record that the customer cannot easily rebuild elsewhere.
Varonis owns the access record: years of mapped permissions, classified sensitive data and baselines of normal behavior. Moving that to a competitor means rebuilding the map from zero.
2. What the buyer said it was buying
The buyer's own release names the superintelligence case directly. Proofpoint's chief executive said agents are "increasingly accessing sensitive information and taking action across systems," which makes it critical to know "what data needs protecting and who can access it" [2].
In plain terms, every superintelligence agent a company deploys is a new identity with access to data, and the company needs the same map for agents that it already needed for employees.
Varonis was building toward that before the deal. It bought AllTrue.ai to extend the platform to real-time visibility and control over superintelligence agents, models and the data they access [4], and the Q2 release lists deeper integration with Anthropic's Claude enterprise products and support for the Cursor coding tool [3].
In our reading, the access record goes from a compliance tool to a gate once agents arrive: an agent cannot safely act on data unless something has decided what it may open.
The companies disclose the price of that gate in their own terms: "approximately 53x LTM Free Cash Flow and 8.4x LTM Revenue," with the footnote that the multiples "are calculated as Enterprise Value / LTM Revenue and Market Capitalization / LTM Free Cash Flow as of June 30, 2026" [2]. We cross-checked the revenue base.
Revenue for the twelve months to Jun 30, 2026 was $688.10M (our calculation from the 10-K and the Jun 30 10-Q) [4][5]
3. The conversion flatters the growth rate
The headline growth number needs one adjustment before it can support any multiple. Total SaaS annual recurring revenue was $726.0M at Jun 30, 2026, up 52%, but up 25% excluding conversions [3].
Conversions are existing license customers moving to the cloud product. They raise SaaS ARR without adding a new dollar of customer spend, and the company has set Dec 31, 2026 as the end-of-life date for the self-hosted business [5].
The chart shows the conversion close to done. SaaS revenue was $171.7M of $180.0M in Q2 2026, against $105.9M of $152.2M a year earlier [3].
Term license revenue fell to $4.2M from $32.4M, and maintenance and services to $4.1M from $13.9M, "with the vast majority of the decline driven by customers converting to our SaaS platform" [3].
Total revenue grew 18.31% in the quarter (our calculation) [3]. That is the cleanest single growth figure, because it nets the conversion uplift against the license lines running off.
The full-year guide was revenue of $735.0M to $739.0M and SaaS ARR growth excluding conversions of 20% to 21% [3].
So the buyer is paying 8.4 times revenue for a business growing about 18% on reported revenue and about 25% on new and expanded cloud contracts. In our reading, that is a strategic price for the record, not a growth-stock price for the conversion.
4. Building the gate, not just selling it
Where a software company spends its next dollar tells you whether it is extending the gate or decorating it. Varonis spent on building.
Second quarter R&D was $73.3M against $56.2M a year earlier, up 30.39%, while sales and marketing was $79.0M against $76.6M, up 3.13% [4] (growth rates are our calculation). R&D reached 40.74% of revenue.
The acquisitions point the same way: Cyral extended coverage to databases and AllTrue.ai to agents and models [5][4]. Each adds a new kind of data store or identity to the same access record, which is what a gate owner should buy.
The cost shows in the income statement. The GAAP operating loss widened to $40.6M from $36.6M, and the net loss to $46.8M from $35.8M [3][4].
Non-GAAP operating income was only $3.7M, and the full-year guide was $11.0M to $13.0M [3]. Stock pay was $34.6M in the quarter (our calculation from the year-to-date cash flow lines) [4].
Over the twelve months to Jun 30, 2026, stock pay of $132.49M equaled 95.86% of operating cash flow of $138.21M (our calculation from the 10-K and 10-Q cash flow statements)
5. The deal terms
| Term | Detail |
|---|---|
| Buyer | Proofpoint, Inc., through Vail Merger Sub; both affiliates of funds advised by Thoma Bravo [1] |
| Consideration | $49.75 per share in cash, without interest [1] |
| Headline value | About $6.3B, all cash [2] |
| Financing | Thoma Bravo committed equity financing and secured debt financing commitments; Ontario Teachers' Pension Plan is also investing in Proofpoint; no financing condition [1][2] |
| Conditions | Varonis stockholder approval; expiry of the Hart-Scott-Rodino waiting period; clearance under specified foreign regulatory laws; no Material Adverse Effect [1] |
| Expected close | First half of 2027 [1] |
| Outside date | Jul 15, 2027, extendable by three months for regulatory approvals [1] |
| Varonis termination fee | $211.7M, for example if the board changes its recommendation or takes a Superior Proposal [1] |
| Reverse termination fee | $423.3M, payable by the buyer if it fails to close once conditions are met or breaches [1] |
| Shopping | No go-shop; customary no-shop, with a fiduciary out for a Superior Proposal [1] |
| Equity awards | Options, restricted stock units and performance units are canceled for cash payments tied to the deal price, under the terms set out in the 8-K [1] |
Those terms come from the merger agreement summary in the Form 8-K [1] and the joint release [2], and the fee structure tells us how each side sized the risk. The Varonis fee is 3.36% of the headline value and the reverse fee is 6.72% (our calculation) [1][2].
A reverse fee twice the size of the target fee is the buyer's way of telling holders that financing and regulatory risk are on Thoma Bravo's side of the table.
The release also discloses the sale process. It describes "a comprehensive evaluation led by a committee of independent members of our Board of Directors, which included extensive outreach to a range of potential strategic and financial buyers"
6. What the spread pays
The spread prices how much risk the market sees in the remaining steps. Against the Oct 27, 2026 close, the cash price stands 1.3% above the market (our calculation; we do not show the share price).
The annualized yield depends entirely on when the deal closes. We assume payment on the closing date and no dividends before close.
| Close date assumption | Days from Oct 28, 2026 | Annualized yield |
|---|---|---|
| Mar 31, 2027 (early in the window) | 154 | 3.1% |
| Jun 30, 2027 (end of the stated window) | 245 | 1.9% |
| Jul 15, 2027 (outside date) | 260 | 1.8% |
These are simple annualized yields (gross spread times 365 divided by days). At every date the yield is low single digits.
In our reading, the market treats the deal as close to certain and leaves almost no reward for regulatory or financing risk. A spread this tight also tends to show some holders betting on a higher price, though the broad sale process makes a topping bid less likely.
For a holder, the asymmetry is plain. The upside is capped at the cash price unless someone bids more.
The downside if the deal breaks is a return to where the stock traded before the rumors, well below the deal price. The company itself points to that gap: the price is a 52% premium to the close on Jun 22, 2026, the last trading day before the first rumors [2].
A holder collects about 1.3% while carrying that tail.
7. Risks to close
- Antitrust and foreign review. Proofpoint describes itself as a leader in "human and agent cybersecurity" [2]; Varonis sells data security. The overlap looks limited, but the HSR waiting period and the specified foreign clearances must still pass [1]. A second request would push the close toward the outside date and cut the annualized yield.
- Financing. The buyer has equity and debt commitments, and the agreement has no financing condition [1]. The risk is a debt market shock before close. The $423.3M reverse fee covers part of that risk for holders [1].
- Stockholder vote. The board recommends the deal unanimously [1]. An activist holder could argue the price undervalues the agent opportunity; the 52% premium to the pre-rumor close makes that a hard case [2].
- Business deterioration. A Material Adverse Effect is a condition [1]. The Q3 results, not yet filed, are the first test of the business under a pending sale.
- Timing. Every month past the expected window lowers the annualized yield; at the outside date with extension, the yield falls further.
- Convertible notes. The $460.0M of notes due 2029
8. What the deal tells incumbents
For the rest of our software coverage, the read-across is the price. A strategic buyer backed by Thoma Bravo paid about 8.4 times revenue for a business with a GAAP operating loss, because it owns a record that superintelligence agents will need [2][3].
Owning the access record carried a premium that the public market, focused on losses and the conversion noise, had not paid until rumors began.
The companies that own the equivalent record in their own domain (the warehouse, the insurer's policy, the government case file) should read this deal as a marker for what that record is worth when agents arrive.
What to watch
- The definitive proxy: background of the sale, bidder count, banker projections and fairness ranges.
- The HSR filing and any second request; specified foreign clearances [1].
- Q3 2026 results and 10-Q, not yet filed as of Oct 28, 2026, including growth excluding conversions.
- The stockholder meeting date, which anchors the realistic close date for the spread.
- Treatment of the 2029 convertible notes at closing [4].
Stock Profiles & Comparable Companies
VRNS Stock Profile →More Published Research
View All →Oracle's $20B cap leaves out the $288B it signed in data center leases
At its Investor Day on Oct 28, Oracle capped new money at $20B through fiscal 2030 and said new contracts will not need incremental capital from Oracle. Both promises leave out leases.
Anthropic's 900% retention is a growth rate, not a contract
The headline metric in Anthropic's S-1 is Net Revenue Retention of approximately 900%. Read with its definition, a one-quarter base, a $1 entry bar and revenue growth of 1,300%, it mostly measures how fast the whole business grew, not how firmly customers are committed.