AI security acquisitions: Proofpoint buys Varonis for $6.3 billion and Cohere moves on AISLE. What the deals say

Two AI security acquisitions landed on October 15, 2026. Proofpoint, the email and data security company owned by private equity firm Thoma Bravo, agreed to buy Varonis for about $6.3 billion in cash. Cohere, the Toronto-based AI model maker, signed a letter of intent to acquire AISLE, a year-old startup whose AI systems hunt for unknown software vulnerabilities. Two days earlier, The Information reported that OpenAI is in early talks to buy the security firm Trail of Bits. The deals show where security money is flowing as frontier models get better at both attacking and defending software.

This analysis is based on the companies' announcements, Varonis' SEC filing, AISLE's and Cohere's posts, and reporting by Reuters, BetaKit and The Logic, checked October 16, 2026.

The short version

• Proofpoint–Varonis (signed): $49.75 a share in cash, about $6.3 billion, expected to close in the first half of 2027. Both companies pitch it around AI; Varonis CEO Yaki Faitelson describes the mission as securing "AI and the data that powers it."
• Cohere–AISLE (letter of intent): no price disclosed. AISLE's founders would lead a new Cohere Cyber unit and Cohere's security research.
• OpenAI–Trail of Bits (reported only): early talks, per The Information; neither company has commented (our report).
• The pattern: two bets. One is about controlling what data AI agents can reach. The other is about owning the AI, and the human experts, that turn bug findings into fixes.
• The caveat: none of these deals has closed, and two haven't reached a definitive agreement.

What are the terms of the Proofpoint–Varonis deal?

Last verified: October 16, 2026 (Proofpoint and Varonis joint release, October 15, 2026; Varonis Form 8-K exhibit 99.1)

The 52% headline premium needs context. The companies measured it against Varonis' price on June 22, the last full trading day before "initial rumors" of a sale. By September 1, before further media reports, the stock had already risen to $42.35, so the offer is 17% above that level. Reuters reported in September that Proofpoint was in talks to buy Varonis. After the announcement, Varonis shares rose about 2.7% in extended trading, Reuters reported.

Varonis, based in Miami, sells software that finds and classifies sensitive data across cloud and on-premises storage and watches who accesses it. Proofpoint, based in Sunnyvale, California, says it serves more than 80 of the Fortune 100. Thoma Bravo took it private in 2021 in a deal valuing it at about $12.3 billion, according to Reuters. Varonis is skipping its usual earnings call because of the deal and will report third-quarter results after the market closes on November 3.

Why is Proofpoint paying for data security?

Both CEOs frame the deal around AI agents, not email. "As AI becomes embedded across the enterprise, the data it can access determines both its value and its risk," Proofpoint CEO Sumit Dhawan said in the release. He added that "AI agents are increasingly accessing sensitive information and taking action across systems." Varonis CEO Yaki Faitelson said: "Our mission is to secure AI and the data that powers it."

The logic is simple. An AI assistant or agent connected to a company's file shares, mailboxes and cloud storage can read whatever its permissions allow. If those permissions are too broad, as they often are, the agent becomes a fast way to find and move sensitive data, whether a person asks it to or an attacker steers it with a prompt injection (our explainer). Knowing where sensitive data lives and who, or what, can touch it is Varonis' core business. The companies say the combined platform will find and protect sensitive data, control "what people and AI can access," and stop data loss.

That's the companies' pitch. Whether the combined product works better than the two did apart won't be clear until after closing.

What is AISLE, and what is Cohere buying?

AISLE builds autonomous systems that find, validate and help fix unknown vulnerabilities in production software. Its founders are Ondrej Vlcek, a former CEO of Avast, Jaya Baloo and Stanislav Fort. BetaKit reported that Fort previously worked at Anthropic and Google DeepMind and that AISLE has about 50 full-time employees.

AISLE says that in its first year it discovered "more than 500 previously unknown vulnerabilities assigned CVEs across more than 100 codebases," including all 12 vulnerabilities in OpenSSL's January security release and 18 of the 24 CVEs in curl's latest release. Cohere repeats the same figures. They are company-reported. CVE assignment means a vulnerability was accepted and catalogued, but the count says nothing about severity or about how many AISLE reports were rejected.

On October 15, the two companies signed a letter of intent for Cohere to acquire AISLE. A letter of intent comes before a definitive agreement. Neither company disclosed a price or a timeline, and AISLE says it will share more "as the transaction progresses." If the deal completes:

• Vlcek becomes senior vice president of Cohere Cyber, a new global cybersecurity business that Cohere says will help enterprises and governments secure AI systems. The Logic reported it will sell cybersecurity tools to government and business customers, particularly in regulated industries.
• Baloo becomes Cohere's global chief information security officer.
• Fort becomes vice president of AI security, working with Cohere co-founder and CTO Ivan Zhang on model development and training.

Cohere says it wants to bring AISLE's security research "closer to frontier model development and training," both to build stronger security systems and to evaluate future models. The deal also fits Cohere's push into Europe after it acquired Reliant AI and Germany's Aleph Alpha.

One detail conflicts. AISLE's post says its Prague headquarters will become Cohere's Prague office, and BetaKit calls it Prague-based. Reuters described AISLE as San Francisco-based with an engineering hub in Prague. We use AISLE's own description.

How does this connect to OpenAI and Trail of Bits?

On October 13, The Information reported that OpenAI is in early talks to acquire Trail of Bits, the security firm it works with on Patch the Planet, an effort to get AI-found bugs fixed in open-source projects. The deal size "couldn't be learned," and neither company has commented. As of October 16, no other outlet had confirmed the talks. Our report on the talks has the details.

If the Cohere and OpenAI moves go through, they would follow the same playbook: a model maker buys a team that already turns AI vulnerability findings into fixes maintainers accept. Anthropic is pursuing the same market without an acquisition, through its Cyber Mission and free OSS Scanner.

What do the three deals have in common?

Read together, they point to two separate bets.

Bet 1: securing what AI can reach. Proofpoint–Varonis is about governing data access as AI agents spread through companies. It doesn't depend on any particular model getting better at security work. It depends on companies connecting more AI to more of their data.

Bet 2: owning the AI that finds and fixes bugs. Cohere–AISLE and the reported OpenAI–Trail of Bits talks are about vulnerability discovery and repair. Here the bottleneck is no longer finding bugs. It's triaging and fixing them:

• Microsoft's October 13 Patch Tuesday fixed more than 1,400 CVEs, a record by BleepingComputer's count. Microsoft's security response blog says AI-assisted research is contributing to vulnerability discovery (our Patch Tuesday story).
• Anthropic said in an October 8 post that it found more than 29,000 candidate vulnerabilities in open-source code over six months but could manually triage only about 6,000.
• Bank of America CEO Brian Moynihan said on October 14 that the bank brought in 1,000 contractors to patch flaws found with Anthropic's Mythos models (our Bank of America story).

AISLE and Trail of Bits both sell the human-plus-AI layer that closes that gap. A model maker that owns such a team gets a security product and a source of evaluation data for its own models' cyber abilities. Cohere says as much.

What could go wrong?

• Deals can fall apart. Proofpoint–Varonis needs shareholder and regulatory approval. Cohere–AISLE is only a letter of intent, and OpenAI–Trail of Bits is an unconfirmed report.
• Vendor numbers. AISLE's 500-plus CVEs and Anthropic's triage figures are company-reported, not independently audited.
• Conflicts of interest. A lab that sells offensive-capable models and the tools to defend against them is grading its own homework. That's the same question we raised about independent evaluators.
• Price discipline. Proofpoint is paying about 53 times Varonis' trailing free cash flow, a bet that AI-driven data security demand will keep growing.

What's confirmed, reported and uncertain

• Confirmed (company documents): Proofpoint–Varonis price, value, premiums, financing, approvals and expected close (joint release; Varonis 8-K); the Cohere–AISLE letter of intent, AISLE's vulnerability figures as the company states them, the new Cohere Cyber unit and the planned roles (AISLE and Cohere posts, October 15).
• Reported: Varonis' after-hours share move and Proofpoint's 2021 deal value (Reuters); AISLE's headcount and Fort's background (BetaKit); Cohere Cyber's focus on regulated industries (The Logic); OpenAI–Trail of Bits talks (The Information, October 13).
• Uncertain: the Cohere–AISLE price and timeline; whether OpenAI and Trail of Bits reach a deal; AISLE's headquarters (AISLE says Prague, Reuters said San Francisco); and how the combined Proofpoint–Varonis product will work.