Varonis’ $6.3 billion sale shows the risks of growing old in cybersecurity
The Israeli-founded company is being acquired after years of struggling to keep pace with the shift to cloud software and the rise of AI. Its exit raises questions about whether younger cybersecurity companies should pursue an IPO or sell while valuations are high.
The $6.3 billion sale of Varonis marks another major Israeli-founded cybersecurity exit, but it is difficult to describe the deal as a dream outcome. The acquisition by American cybersecurity firm Proofpoint looks more like a second chance for a veteran company, now more than 20 years old, that was slow to embrace the cloud transition. Although the offer represents a premium over Varonis’ recent share price and its June price, before reports of a potential sale first emerged, the company has traded at considerably higher valuations in the past.
The deal could reinforce a dilemma facing younger Israeli cybersecurity companies weighing whether to pursue an IPO on Nasdaq, potentially aiming for a multibillion-dollar valuation, or sell early for billions or even tens of billions of dollars. Varonis’ experience suggests that the long and often difficult journey of operating as a public company does not always deliver the returns founders and investors might expect, even when employees, including those in Israel, have accumulated substantial wealth by selling shares over the years.
Ultimately, Varonis is being sold at a lower valuation and revenue multiple than Armis, a cybersecurity company that was only a decade old when it agreed to be acquired. The principal financial beneficiaries of the Varonis deal are likely to include major American institutional investors, notably Vanguard and BlackRock, which hold substantial stakes in the company. For Israel, the direct financial benefits will come in part through taxes on gains realized by employees and other Israeli shareholders. Approximately 1,000 of Varonis’ 2,800 employees work at its development center in Herzliya, although the company is incorporated in the U.S.
In some respects, the deal resembles Palo Alto Networks’ acquisition of CyberArk, another established cybersecurity company that had to adapt its business model to the cloud era. But there is an important difference in the valuations. CyberArk was profitable, while Varonis has struggled to achieve consistent profitability. CyberArk also operates in identity security, a category that has gained prominence as AI agents are integrated into enterprise workflows and organizations seek to control the identities and permissions of both people and machines.
Proofpoint, which is controlled by American investment firm Thoma Bravo, will pay approximately $6.3 billion in cash for Varonis. The transaction implies an enterprise value of approximately $5.7 billion, reflecting Varonis’ cash reserves. Under the agreement, shareholders will receive $49.75 per share. The offer represents a 52% premium to Varonis’ closing price of $32.71 on June 22, the last full trading day before initial reports of a potential sale emerged, and a 17% premium to its September 1 closing price, before further media reports about a possible transaction.
The deal values Varonis at approximately 8.4 times its revenue over the last 12 months, a relatively high multiple for a software company in the current market. Yet it remains below the valuation the company commanded at its peak. In 2021, Varonis shares reached approximately $73, giving the company a market capitalization of more than $10 billion. The shares were also trading at a higher valuation a year ago, before plunging nearly half in a single session following disappointing financial results. The company acknowledged that some long-standing customers using its on-premises software were not renewing their subscriptions as expected.
Over the past five years, Varonis has struggled to keep pace with changes in the software market. Its transition to the cloud came relatively late, while slowing growth and the costs of adapting its business weighed on its ability to achieve profitability. Although the company accelerated its shift to a software-as-a-service model over the past two years, the market has increasingly turned its attention to artificial intelligence, forcing Varonis to reposition itself once again.
This is precisely the kind of situation in which Thoma Bravo has built its investment strategy. The private equity firm is known for acquiring publicly traded software companies, taking them private and seeking to improve their operations and profitability. In this case, it is pursuing that strategy through Proofpoint, which it took private in 2021 in a transaction valued at approximately $12.3 billion.
Thoma Bravo is likely to seek closer integration between the two companies’ technologies, potentially accompanied by workforce reductions at Varonis as overlapping functions are consolidated. The strategic opportunity lies in combining Proofpoint’s focus on email and human security with Varonis’ technology for identifying, monitoring and protecting sensitive corporate data. As companies deploy AI agents that can access information and take actions autonomously, the need to control what those systems can see and do is becoming more important.
The challenge will be to translate that opportunity into stronger growth and profitability. Thoma Bravo’s longer-term options could include taking the combined business public again or selling it to another buyer.
