If you still run Varonis on your own servers, you will sign a SaaS migration contract before December 31, 2026, and a few months later Proofpoint will own the other side of it. Varonis has set the end of life of its self-hosted product for December 31, 2026. On October 15, Proofpoint agreed to buy Varonis for $49.75 a share in cash, about $6.3 billion, with closing expected in the first half of 2027. The terms you negotiate this quarter are the ones Proofpoint inherits, so the change-of-control, price-hold and data-export language has to go into the SaaS contract now, while Varonis still needs your signature to finish its migration.
What Proofpoint Agreed to Pay, and What It Left Out
Proofpoint is paying a full price for an installed base, and its announcement makes no promise about what that base keeps. The deal announcement puts the premium at 52% over Varonis's $32.71 close on June 22, 2026, the last trading day before sale rumors, and at roughly 8.4 times trailing revenue and 53 times trailing free cash flow. Thoma Bravo, which owns Proofpoint, is providing committed equity and has lined up debt financing, and Ontario Teachers' Pension Plan is investing alongside. The deal still needs Varonis shareholder approval and regulatory clearance.
The release states the plan plainly: after closing, Proofpoint "intends to move quickly to integrate capabilities, align go-to-market efforts" and deliver one platform covering data discovery, access control for people and AI, and data loss prevention. It says nothing about the Varonis brand, the Varonis price list, or how long current Varonis products stay on sale. Until closing, the two companies operate separately. Varonis will report third-quarter results on November 3 without an earnings call, which removes the usual place an analyst would ask what happens to customers.
Proofpoint has done this before at smaller scale. Thoma Bravo took Proofpoint private for $12.3 billion in 2021, and Proofpoint built its data security line by acquisition: Dathena in 2022, Tessian in 2023, and Normalyze in 2024, according to BankInfoSecurity's reporting on the talks. Futurum analyst Montenegro notes that Proofpoint has not yet run an integration of this size, describing the earlier deals as small capability purchases and Varonis as "the scale step."
Why the December 31 Deadline Is the Real Problem
The deadline puts your migration decision inside the pre-close window, when Varonis can sign a contract and Proofpoint cannot yet stand behind it. Varonis CEO Yaki Faitelson announced the cut-off on the October 2025 earnings call: "we are now announcing the end of life of our self-hosted solution as of December 31, 2026." He added that Varonis expected "increased uncertainty with our remaining OPS business going forward." CFO Guy Melamed explained the reason as cost: "we didn't want to maintain 2 types of code, and there are significant financial benefits for the organization." He also said the company moved the announcement up after on-prem renewal rates dropped in the final two weeks of that quarter. The shares fell 48.7% to $32.34 the next day, and a securities class action followed.
Varonis's own migration page promises "no gap in protection" and says "All we need is access to your self-hosted environment and we'll handle the rest." It does not mention price. A competitor's marketing blog, ManageEngine's, says Varonis has confirmed no further updates after the date and has not said whether emergency patches exist for customers who miss it. Treat that as a rival's reading, and get Varonis's answer in writing.
Most of the base has already moved. Varonis reported SaaS annual recurring revenue of $726.0 million at June 30, 2026, up 52%, while term license subscription revenue fell to $4.2 million from $32.4 million a year earlier, which the company attributed mainly to customers converting. If you are still self-hosted, you are in the tail Varonis is trying to close out before year end, which gives you more leverage than the deadline suggests.
Where Proofpoint and Varonis Overlap
The two product lines overlap in data security posture management, and overlap is where post-merger product cuts usually land. DSPM is software that finds sensitive data across cloud and on-prem stores, classifies it, and flags who can reach it. Both companies sell it: Varonis built its own, and Proofpoint bought Normalyze, whose agentless scanner does discovery and classification, in 2024.
BankInfoSecurity lists what each side has that the other lacks. Varonis brings data access intelligence, data activity monitoring, data detection and response, and user behavior analytics. Proofpoint brings enterprise DLP, adaptive email DLP and insider threat management. The same report notes that Forrester's 2025 evaluation rated Proofpoint's data security platform the weakest of the 10 vendors it assessed and put Varonis at the top. That makes Varonis's engine the likelier survivor in the DSPM overlap, though nobody has said so, and Normalyze customers should ask the same continuity questions as Varonis customers.
The strongest case for the deal is the one Proofpoint is making. Proofpoint knows which people are being targeted by email; Varonis knows what each identity can reach. Montenegro's analysis names cleaning up permissions before a Microsoft 365 Copilot rollout as the obvious first use. In Futurum's October 2026 spending-intentions survey, 53% of organizations citing Varonis also cite Proofpoint (63 organizations cite both), which suggests many Varonis buyers already pay both vendors and could be offered a bundle price. Montenegro is also clear about the limit on AI agents: "file activity shows where an agent went, not whether it should have gone there."
Why Your Current Contract Probably Won't Protect You
A standard anti-assignment clause usually does nothing in a deal shaped like this one. Proofpoint is buying Varonis through a merger subsidiary, and the release says Varonis becomes a private company at closing. Your contracting party stays the same legal entity with a new owner, so nothing is assigned and the clause never triggers. Only an explicit change-of-control clause gives you a right to act.
The SaaS migration contract is your chance to add one. Varonis wants the conversion booked before December 31, and SaaS ARR is the first key metric in its earnings releases. Proofpoint, paying 8.4 times revenue, needs that ARR to renew. Both facts point the same way: ask for the terms now, while the person across the table needs the signature. The general clause set is in this review of AI vendor exit clauses, and the private-equity version of the same problem in CCC's $6.1B sale to GTCR.
What to Put in the SaaS Contract
This Week:
- Pull your Varonis order forms and master agreement and find three things: the self-hosted subscription end date, any change-of-control language, and what data you can export at termination. Note whether your self-hosted licence runs past December 31; if it does, you are being asked to give up paid term.
- Ask your Varonis account team, in writing, what support and security patching a self-hosted deployment gets after December 31, 2026, and what the SaaS price is relative to your current spend. Get the number on paper before you negotiate anything else.
- If you also run Proofpoint, list both renewal dates side by side. A bundle offer will come; know your combined spend before it does.
This Month:
- Add a change-of-control clause to the SaaS order: if Varonis is acquired, you may terminate without penalty within 12 months of closing and receive a pro-rata refund of prepaid fees.
- Ask for a price hold through at least one renewal after closing, with a cap on any increase at renewal. Make it apply to any successor product that replaces the one you buy.
- Write a product continuity term: the modules you buy (data access governance, activity monitoring, DSPM) stay available for the contract term, and if Proofpoint retires one, you get the replacement at no added cost and with 12 months' notice.
- Define the export. Permissions maps, classification results and activity audit logs are what you would lose in a switch, so name them, name a format, and set a delivery window at termination.
Before You Sign a Multi-Year Term:
- Run a short bake-off against at least one alternative. Futurum names Cyera, BigID and Microsoft's bundled data protection as the main competitors. You may not switch, but a priced alternative is the strongest term you can bring to the table.
- Keep the term length matched to the close. A 12- or 24-month term with renewal caps leaves you a decision point after Proofpoint's integration plan is public; a three-year prepay gives that decision away.
- Confirm where the SaaS tenant stores data and what on-prem collectors it needs. Varonis's page says the platform "respects data sovereignty" but names no regions, which your privacy team will need.
The Bottom Line
Since Thoma Bravo bought it in 2021, Proofpoint has added Dathena, Tessian and Normalyze to its data security line, and Varonis is by far the largest of the four. A change of owner mid-contract is the pattern Bending Spoons buyers met with Airtable and Miro and that Torii customers now face with Freshworks: the product usually survives, and the price and the contract are what change. For anyone rolling out Copilot or agents on top of file shares, Varonis is the system that says who can see what, and swapping it out mid-rollout is expensive. If you already use Varonis Atlas for AI agents, the same terms apply to it.
Get the change-of-control clause, the price hold and the export definition into the SaaS order before Varonis's December 31 cut-off.
Continue Reading
- AI Vendor Exit Clauses: Standard Terms Give 0 to 90 Days to Get Out
- Kiteworks Bought Bonfy. Ask for the Terms WAMNET Got.
- CCC's $6.1B Sale to GTCR Puts Insurers' Claims AI on PE Terms
- Freshworks Buys Torii, Silent on Customers Running ServiceNow
- Varonis Atlas Secures AI Agents From Discovery to Compliance
- Glean vs Copilot vs Dust: Buy the Permission Model