❌

Reading view

How Thoma Bravo Found a Discount in a Hot Cybersecurity Market

Cybersecurity has been a dealmaking bright spot amid the broader software gloom, fueled by bets that AI adoption will boost demand for security products. But it’s been hard for private equity firms to get in on the sizzling sector. 

Corporate buyers have been snapping up cybersecurity companies, competition that makes it harder for private equity firms to buy at prices that leave room for attractive returns when they eventually sell. Rising interest rates further limit what the firms can pay in debt-heavy buyouts. 

That makes Thoma Bravo–backed cybersecurity company Proofpoint’s agreement last week to acquire data security company Varonis Systems in a $6.3 billion deal a notable example of how private equity can still find an opening in a hot market. And the tech-focused private equity giant is likely to do at least one more deal around this size in the coming year. 

The proposed acquisition values Varonis at around six times forward annual recurring revenue, according to a person close to the deal. That’s a discount compared to similar public companies like cloud security and compliance company Qualys, which is trading at around 8 times forward annual recurring revenue. 

Cybersecurity acquisitions were already booming heading into this year, including Alphabet’s $32 billion agreement to buy Wiz and Palo Alto Networks’ roughly $25 billion deal for CyberArk, both announced in 2025. But interest in the sector has intensified amid much-hyped releases of powerful models like Anthropic’s Mythos and a series of hacking incidents and agents gone rogue. It could further increase after Wednesday’s disclosure of AI finding a security flaw in open-source programming language PHP, which most websites use.

“People ended up realizing that the…threat vector effectively multiplied to infinity,” said Brian Thom, a managing director at middle market investment bank Brown Gibbons Lang & Co. with a focus on infrastructure software and cybersecurity.

Cybersecurity mergers and acquisitions hit a record 170 transactions in Europe and North America during the third quarter, according to an Arrowpoint Advisory report from earlier this month. Corporate buyers have been particularly active, including Accenture, which this summer acquired a majority stake in industrial cybersecurity company Dragos, plus two smaller companies in deals with a combined enterprise value of more than $4 billion. 

Thoma Bravo, for its part, saw an opportunity as Varonis’ stock price came under pressure. Varonis has spent recent years moving customers from licenses to cloud-based subscriptions, temporarily depressing revenue growth, and announced late last year it would phase out older software by the end of 2026. Its shares had tumbled nearly 50% from last October to around $33 this June, right before reports of a potential takeover surfaced. 

More broadly, some software-focused private equity firms are hunting for companies with depressed share prices but still-credible growth prospects that can hold up even under threat of AI disruption. And many are still nursing the hangover from a software binge during the low-interest-rate years of 2020 and 2021. 

The Varonis acquisition comes at a critical time for Thoma Bravo, which has owned Proofpoint since taking it over for $12.3 billion in 2021. Proofpoint is generating more than $1 billion in earnings before interest, taxes, depreciation and amortization, excluding the proposed Varonis acquisition, the person said, while five years under Thoma Bravo ownership puts it at the point when private equity firms typically face growing pressure to cash out. 

Adding Varonis expands Proofpoint’s capabilities beyond its traditional focus of protecting employees from cyberattacks, including phishing and other email threats, to securing sensitive corporate data and controlling who can access it, including employees and AI agents. Though Proofpoint has made previous acquisitions under Thoma Bravo, the Varonis deal is by far its largest and gives it a bigger foothold in AI-related defenses that could arguably help it become a more compelling candidate for an initial public offering. 

Thoma Bravo could be on the hunt for more multibillion-dollar cybersecurity acquisitions following the Varonis deal, which is set to close in the first half of 2027. 

“There’s a finite number of very large cybercompanies that we can invest in,” said Andrew Almeida, a Thoma Bravo partner who oversees cybersecurity and infrastructure software investments. 

The firm is particularly interested in companies that generate revenue from the growing use of AI agents rather than relying solely on traditional pricing models that charge based on the number of human users, he said, and it plans to have another deal similar to the size of Varonis within the next 12 months. 

“Having agentic revenue, not just an agentic vision, but agentic revenue, is a must. And then having a pricing model that can capture this upcoming and ongoing explosion of agents is also a must,” Almeida added. 

Wobbly IPO Window

All eyes are on when Anthropic will finally make its IPO paperwork public, marking one of the final steps toward its hotly anticipated debut. Anthropic announced it had confidentially filed in June, and by late summer was preparing for an IPO as soon as late September.  Now the latest chatter is that the filing could appear by the end of this week. 

Other AI-related IPOs that initially looked poised to go ahead of Anthropic’s have been pulled or delayed amid mounting concerns about the costs of financing data centers and chips, while the broader IPO market has lost momentum in the midst of Treasury volatility. That’s raised questions about who will test the market next—and whether Anthropic’s offering could revive IPOs in general. Some IPO advisers, however, say other companies may need to go public first, paving the way for the AI giant. 

“I don’t think Anthropic going public is going to open the floodgates,” said Edward Best, co-chair of Willkie Farr & Gallagher’s capital markets practice. “I think that Anthropic is going to wait until the water starts moving, and then if Anthropic comes through, it’s just going to widen the river.

“They can’t take the risk that they don’t do well. They’re going to wait until they see a better path, and then other people are going to join right afterwards,” he added.

  •  

Nvidia Expands Deals with Six Chip Component Suppliers

Nvidia on Wednesday announced new deals with chip substrate suppliers Ibiden, Samsung Electro-Mechanics and Unimicron, to ensure it has enough component materials to produce more of its AI server chips in the coming years. It said the deals, which include a multibillion-dollar reservation ...

  •  

Meta Faces $25 Billion New Mexico Penalty

Meta Platforms on Wednesday was ordered to pay $25 billion in penalties following a New Mexico court ruling tied to the Cambridge Analytica data scandal, according to a court judgment.

The ruling by a New Mexico state judge said the violations could have amounted to $219.5 billion, but the judge ...

  •  

How Bank Hackers Got Claude to Do Their Dirty Work

Soon after Anthropic announced its Mythos model in April and said it was exceptionally good at cybersecurity, security professionals said it was only a matter of time before hackers used similar models to supercharge their own attacks.

That time has come, according to an example we reported about today. And it looks like hackers don’t even need a Mythos-class model to automate powerful cyberattacks.

  •  

OpenAI to Bring Models to Google Cloud

OpenAI will make its models available through Google Cloud, the companies announced this morning. The move lessens OpenAI’s reliance on Microsoft, where the companies once shared exclusivity.

The partnership also underlines OpenAI’s pursuit of enterprise clients to diversify its business. The ...

  •  

OpenAI, Anthropic Should Cap Compute for R&D, Say AI Safety Advocates

Ideas are flowing fast and furious on how AI labs can “pace” AI development so safeguards keep up with the technology’s smarts. Last week, OpenAI CEO Sam Altman laid out three scenarios he said have been considered in the industry, including merging all of the AI labs into a single entity to develop new AI safely or creating a global regulatory body like the International Atomic Energy Agency.

In the background, a loose group of safety advocates and researchers have been pushing for AI companies to cap the amount of compute they put towards research and development, a limitation they argue would be particularly effective in slowing AI development.

The researchers are proposing companies commit to dedicating at least some minimum share of their computational resources to safety or monitoring, and another minimum share to running AI for customers, otherwise known as inference. That would limit the share of compute that could be used to develop stronger AI capabilities through R&D, such as training new models.

  •  

Hackers Used Claude and Grok to Automate Attacks on Banks

A hacking group called CyberCartel used a web of AI agents powered by models from companies including Anthropic, SpaceX and Chinese lab Moonshot AI to automate cyberattacks against more than 400 Latin American financial targets, according to an investigation by the cybersecurity startup Straiker.

The research, shared exclusively with The Information, is one of the first detailed reports of cybercriminals using AI models to successfully automate attacks that break into financial institutions. The AI agents used by CyberCartel, which has long targeted Latin American businesses and whose latest targets included banks and payment apps, appear to have stolen passwords and customer data and to have accessed people’s bank accounts autonomously with little human effort, the Straiker research shows.

  •  

SpaceX’s Musk Lauds Its Soaring Cloud Business and Possible Tesla Merger

SpaceX put on a bit of a show for shareholders today—and I’m not referring to the sizzle reel of rocket and space videos it showed on its earnings call. No, the big attention grabber was the update from CEO Elon Musk on the progress of SpaceX’s contemplated merger with Tesla and just how involved—or not involved he is in the whole affair. 

First though, it’s worth mentioning the other big highlight from the call: SpaceX’s booming AI—excuse me, SI—business, a category that includes the company’s X social media service, its Grok Bot agent platform and a cloud infrastructure service it has started to rent to outsiders like Anthropic. The segment is on fire. It saw its third-quarter revenue nearly triple to $7.56 billion, making it the largest business category at SpaceX. And if that wasn’t enough, the SI business swung to an operating profit of $431 million from a $1.26 billion loss in the second quarter. 

SpaceX shares jumped nearly 7% in after-hours trading following the report. 

SpaceX executives made it clear that the big story in its SI (superintelligence) segment is its cloud business. Musk told investors the company’s phone is ringing off the hook with demand from businesses that want to lease SpaceX’s AI compute. “We are hounded relentlessly by every hyperscaler and by dozens of smaller companies to rent more of our compute,” Musk said. “We could rent out our compute several times over if we said yes to everyone.” 

For his part, Bret Johnsen, SpaceX’s chief financial officer, described that demand as “extraordinary” and said at the prices it’s currently charging its cloud customers, SpaceX is “generating a payback in less than a year” on new data centers after it deploys them.

Musk also addressed a question from an investor about his desire to unite SpaceX and Tesla. He said the respective companies have formed special committees to examine a merger, but because he’s CEO of both Tesla and SpaceX, he has needed to recuse himself from those discussions. 

Still, that didn’t stop him from telling everyone listening to the call that he thinks a merger is a grand idea. “I do think there’s a lot of merit to combining both companies,” he said. 

Musk also stated the obvious caveat: Any deal will still need shareholder approval, and there’s no guarantee they’ll bless it. “I think some people assume a SpaceX-Telsa merger is a certainty,” he said. “I think that would be overstating it.” Nonetheless, Musk’s shareholders tend to be very obedient to him. If the companies decide to move forward with a merger, stay tuned for Musk to start turning up his X megaphone and encouraging them to fall in line.

Netflix’s Sad Trombone

The other shoe just dropped at Netflix. Last than a week after announcing the layoffs of about 1,000 employees, or 6% of the company, Netflix reported its weakest quarterly revenue growth in three years—an 11.8% jump to $12.87 billion in revenue. For a figure lower than that, you have to go all the way back to the third quarter of 2023. It didn’t help that Netflix told investors revenue growth will get even worse in the fourth quarter, estimating 11.5% for that period. The company’s shares fell 5% in after-hours trading. 

The weak third-quarter revenue number wasn’t exactly a surprise; it was slightly better than the growth rate Netflix had told analysts to expect last quarter. But it’s obvious from the heads that have rolled at Netflix over the past week that the company’s CEOs, Ted Sarandos and Greg Peters, aren’t happy with the state of its business. The firings included Bela Bajaria, chief content officer, and David Lin, film chief, a sign that the company wants to reset its approach to movies and series. It's still a powerhouse in living rooms: The new season of “The Diplomat” is back on with a vengeance on my TV set. But Netflix feels like it’s looking for a new act. 

In Other News

  • In a draft IPO prospectus, Anthropic disclosed a net loss of more than $80 billion for the first half of the year, reflecting its accounting for financing agreements, The Wall Street Journal reported. Around a fifth of its $16.3 billion in revenue for the period came from two customers. 
  • Elon Musk ordered the slowdown in a military version of Starlink in Ukraine, The Wall Street Journal reported.
  • Salesforce agreed to buy customer engagement platform Braze for roughly $5.66 billion, including debt.
  • Joel Kaplan, Meta Platforms’ chief global affairs officer, plans to leave the company after more than 15 years.

Today on The Information’s TITV

Check out today’s episode of TITV in which Akash Pasricha speaks with analyst Dan Flax about the upcoming quarterly results for Meta Platforms, Alphabet, Microsoft and Amazon.

Recommended Newsletter

Start your day with Applied AI, the newsletter from The Information that uncovers how leading businesses are leveraging AI to automate tasks across the board. Subscribe now for free to get it delivered straight to your inbox twice a week.

Upcoming Events

Tuesday, October 27 — The Information’s 2026 WTF Summit

The Information's WTF Summit returns to Napa Valley, bringing together the women shaping tech, media and finance. Confirmed speakers include Whitney Wolfe Herd (Bumble), Anne Wojcicki (23andMe Research Institute), Kim Posnett (Goldman Sachs) and comedian & entrepreneur Whitney Cummings, with more to come. Expect candid conversations and a room built for meaningful exchange. Tickets are selling fast—reserve your spot now.

More details

Monday, November 9 — Intimate Dinner with The Information and EY Consulting in San Francisco

Jessica Lessin, The Information's Founder & Editor-in-Chief, and Whitt Butler, EY Americas Vice Chair – Consulting, will lead an intimate executive discussion on the latest trends in AI. Request an invite.

More details

Tuesday, November 10 — The Long Road to an IPO

The Information's Dakin Campbell will host a panel discussion on the evolving landscape of public listings and exit opportunities during SF Tech Week, sponsored by NYSE.

More details
  •  

Nvidia Moves to Back GPU Cloud Provider Firmus After Investors Balk at Its IPO

Nvidia is in talks to invest hundreds of millions of dollars in Australian AI cloud provider Firmus, which abruptly pulled its initial public offering early this month, according to people familiar with the talks.

The discussion indicates that Nvidia is likely to continue backing a group of unproven firms known as neoclouds that is facing financial pressure after they stacked up on debt to purchase Nvidia graphics processing units for data centers. Nvidia has already put more than $170 billion on the line for such firms and other large customers, including credit guarantees to help them raise the debt, according to The Information’s analysis.

  •  

Private Equity Firms Weighed $100 Billion-Plus Buyout of Microsoft’s Xbox

A group of private equity firms in recent months considered a potential buyout of Microsoft’s Xbox gaming unit that could have valued it between $100 billion and $150 billion, according to people familiar with the discussions.

The short-lived discussions by the private firms were exploratory and didn’t turn into a negotiation with Microsoft, the people said. But they show the company could find buyers if its turnaround of the struggling gaming division falters. The identities of the PE firms couldn’t be confirmed.

  •  

Nvidia Has Put More Than $170 Billion on the Line for Neoclouds

Nvidia has become something of a central bank for companies expanding the market for its chips beyond tech giants, backstopping customers and demand. But as Nvidia-backed cloud firms come under pressure, the question is how much further it will go.

The chipmaker has already disclosed as much as $164.5 billion in guarantees and other commitments to support new data centers, including agreements to pay landlords if tenants default on leases and promises to buy capacity, filings show, as of the company’s July quarter. That’s on top of more than $7 billion it has invested or agreed to invest directly in AI cloud providers.

  •  

Netflix Revenue Growth Hits Three-Year Low

Netflix reported its slowest quarterly revenue growth in three years on Tuesday, with revenue rising 11.8% to $12.9 billion in the third quarter, in line with its own expectations.

The streaming company now expects revenue to increase 13% to $51.5 billion for the full year, slightly below the ...

  •  
❌