Your Security Vendor Was Just Bought: What CISOs Must Ask

In a single week in October, three security products changed owners, and none of the three buyers wanted exactly what the customers had bought.

Proofpoint is buying Varonis, IonQ has bought Elisity, and Absolute Security has absorbed FirmGuard.

The press releases describe platforms, synergies, and AI. For customers, the buyer's motive matters more: it sets the product roadmap for the next three years. Your leverage is highest between announcement and integration, so negotiate now. For Elisity customers, that window has already closed.

This post looks at what each buyer was purchasing, what the deal means if you run the acquired product, and six questions to ask before you renew.

Read the Buyer's Motive, Not the Press Release

The three deals look unrelated, but they share one feature: the acquired product now serves a strategy set somewhere else.

Deal	Buyer	Paid with	Status	What the buyer wanted
Proofpoint / Varonis	Platform owned by Thoma Bravo	$6.3 billion cash, funded by equity and debt	Signed October 15, close expected in the first half of 2027	The data and permissions layer for a "unified platform"
IonQ / Elisity	Quantum computing company	$1.15 billion stock, plus up to $150 million earnout	Closed November 4	CISO relationships and a channel for quantum security
Absolute Security / FirmGuard	Endpoint resilience platform	Undisclosed	Completed	Firmware features for an existing platform

Beyond the headline numbers, three signals in the table stand out.

• The currency shows who pays. Proofpoint is paying 8.4 times trailing revenue and 53 times free cash flow, partly with debt. That price is recovered from the combined customer base through cross-sell, pricing, and cost reduction.
• The clock shows your leverage. Varonis customers have six months or more before closing. Elisity customers had 23 days between announcement and completion.
• The narrative shows the direction. All three announcements cite AI agents or AI devices as the reason for the deal. None says which control an existing customer gains.

KuppingerCole has tracked this consolidation in Navigating the Agentic AI Security Landscape. The pattern there holds here: specialists exit into platforms, and the platform's priorities win.

Proofpoint and Varonis: Your Deployment Is an Integration Candidate

Varonis customers now own a product whose roadmap will be decided inside a larger platform, and the decision is at least six months away.

The capability fit is real, as we argued in Proofpoint Buys Varonis: Two Bets, and Only One of Them Is Priced. Proofpoint covers people and messages. Varonis covers data and permissions. The stated intent is a unified platform for more than 16,000 enterprises.

Unified platforms rationalize overlap, and here it runs in both directions:

• Proofpoint already sells data loss prevention, insider risk, and data security posture management.
• Varonis recently added email security, which is Proofpoint's home market.
• Proofpoint is also still absorbing Hornetsecurity, a $1.8 billion deal that closed in December 2025.

Two factors limit what customers can learn before then. Both companies must operate separately until closing, so nobody can make a binding joint roadmap commitment. And Varonis has stopped giving guidance and holding earnings calls, even as it reported SaaS annual recurring revenue of $774.6 million, up 42% year over year.

This is why renewals signed before closing deserve the closest scrutiny. A multi-year commitment made now locks in a product direction that neither company is allowed to describe yet.

If you already buy from Proofpoint, treat the deal as leverage at renewal rather than a reason to switch. For the wider market, the new Leadership Compass Data Security Platforms shows which alternatives enforce policy at the data layer and which only report on exposure.

IonQ and Elisity: The Customer Base Is the Product

IonQ paid $1.15 billion in stock for a company with just over 100 deployments, which is up to $11.5 million per deployment. At that price, IonQ is paying for access to Elisity's customers rather than for its installed revenue.

IonQ has been open about this. Its announcement describes Elisity's CISO relationships as a channel for post-quantum cryptography (PQC), quantum key distribution, and quantum computing offerings. The first planned integration adds cryptographic inventory and risk data to Elisity's IdentityGraph.

On paper, the logic is sound, because a cryptographic inventory starts with asset discovery, which Elisity already does. Segmentation is also a reasonable compensating control during a migration that takes years, a point our Leadership Brief on Crypto-Agility develops.

The risk is that engineering attention shifts elsewhere. Customers bought Elisity to stop lateral movement, many of them in healthcare. Its engineering budget now competes with quantum hardware and a chip foundry inside the same company.

The earnout gives a useful date. Sellers can earn up to $150 million more against revenue milestones through January 2028. Expect three effects:

• Management stays and keeps selling the core product until then.
• Cross-sell and bundle offers arrive early, because revenue is the measure.
• The real test of commitment to microsegmentation comes after January 2028.

You will need a cryptographic inventory regardless. Run that project on your own timetable, not as a renewal bundle. If microsegmentation carries weight in your architecture, keep a named alternative from the Leadership Compass Zero Trust Platforms on the bench.

Absolute Security and FirmGuard: A Service Becomes a Feature

The smallest deal of the three brings the fastest change, because it has already completed and the first integration phase has already been defined.

FirmGuard was Phoenix Technologies' service for securing and managing UEFI BIOS firmware. Absolute will fold it into Absolute Persistence, the technology that device makers embed in the firmware of 600 million endpoints.

Absolute's announcement lists what the first phase delivers:

• Broader management below the operating system
• Continuous firmware integrity monitoring and patching
• Expanded data-wipe options
• One console from firmware to cloud

For a FirmGuard customer, that list implies a console migration and a new licensing model rather than a like-for-like renewal. The product is unlikely to disappear; the practical risk is that a standalone service with its own price is absorbed into a platform tier.

The roadmap will also follow the platform's center of gravity. Absolute sells fleet-scale resilience through device makers, and it positions this deal around AI workstations. Bespoke firmware requirements carry less weight in that model than they did at a firmware specialist.

The deal also concentrates control in one vendor. One vendor now holds both the persistence layer in the firmware and the service that monitors firmware integrity. Ask how the two are separated, and who independently verifies the integrity monitoring.

Before the next renewal, ask Absolute for a written statement on how FirmGuard entitlements map to Absolute products, and what happens to custom integrations.

Six Questions to Ask Before You Renew

An acquisition is the one moment when a vendor's account team is under instruction to keep you calm, so use that moment to your advantage. These questions apply to all three deals and to the next one.

1. Why did the buyer pay? Scale, a sales channel, and a missing feature each lead to a different roadmap. Match your reliance on the product to the motive.
2. Which commitments are in writing? Ask for roadmap, support, and end-of-life dates for the modules you use, in terms that survive closing.
3. What does the contract say about a change of owner? Check the assignment and change-of-control clauses. They decide whether you can renegotiate.
4. How do today's entitlements map to tomorrow's products? Get the mapping and price protection before the new packaging exists.
5. How long should the term be? Do not prepay past the point where the product direction is known. For Varonis, that point is after closing in the first half of 2027.
6. Could you leave? Name an alternative and test data export. For EU financial entities, DORA already requires exit strategies for critical ICT services, and an ownership change is the moment to test one.

A seventh question applies wherever the deal is justified by AI agents. Ask whether the product authorizes what an agent may do or detects what it did afterward. Announcements rarely make this clear, yet the difference determines whether you are buying a preventive control or just a report.

The Takeaway: Negotiate While the Window Is Open

For Varonis customers, the window runs until closing in the first half of 2027. For FirmGuard customers, it runs until the next renewal.

None of these products is going away. Each will be reshaped to serve a strategy its customers did not choose.

If one of these vendors is in your environment, start with the KuppingerCole Leadership Compass reports on Data Security Platforms and Zero Trust Platforms, or book an inquiry with our analysts to pressure-test your renewal position.