Proofpoint has signed a definitive agreement to acquire Varonis, aiming to combine data security and AI governance capabilities.
Proofpoint plans to add Varonis’ visibility into sensitive data, access privileges, and data usage to its own threat intelligence.
The company describes cybersecurity as moving through distinct phases. The focus first shifted from securing networks and infrastructure to protecting people. AI is now prompting a further change, towards securing the data that feeds AI models and governing how employees and AI agents interact with that data.
This change is putting pressure on organisations from two directions. Externally, threat actors are using AI to speed up attacks on data and critical systems. Internally, companies are deploying AI agents to support employees. Those agents gain broad access to sensitive information, which creates new forms of insider risk.
Proofpoint defines data security as protecting data from compromise, loss, and misuse by either people or AI agents, arguing that this has become the main priority for organisations that want to use AI at scale.
What the combined portfolio is set to cover
The two companies intend to combine their capabilities into a single data and AI security offering. It would cover data security posture management (DSPM), data access governance (DAG), insider risk, data loss prevention (DLP), and AI governance.
The plan goes beyond product integration. Proofpoint aims to link what people and AI agents are able to access with how they actually use data. With this in mind, it intends to bring threat protection, data security, and AI governance together. Moreover, Proofpoint expects the deal to simplify security operations, lower costs, and support vendor consolidation. The company also states it will keep open integrations with the wider cybersecurity ecosystem.
Scale of the intelligence base
Proofpoint indicates its operational footprint as a source of differentiation. The company reports 3.4 million customers and 2.37 trillion emails scanned each year. It also ingests 410 billion data security events and operates more than 13,000 sensors across 105 countries. These signals feed its Knowledge Graph, which trains AI models on cyber threats, human behaviour, and data risk.
By mixing this intelligence with Varonis’ data visibility and with agentic security platforms, it aims to let customers continuously discover, classify, and protect sensitive data, enforce policies, and fix risks at the speed at which AI agents operate.
