Proofpoint’s $1B Acquisition Ignites Cybersecurity Shakeup Ahead of IPO
At a glance:
- Proofpoint has agreed to buy Hornetsecurity, a European cybersecurity firm based in Hanover, Germany, for more than $1 billion.
- The deal adds Microsoft 365 email security for small businesses and managed service providers and expands Proofpoint’s European presence.
- Proofpoint, owned by Thoma Bravo, is exploring a return to public markets.
- Analysts are watching how the acquisition will change competition in email security.
Proofpoint’s biggest deal yet
Proofpoint, a cybersecurity and compliance company, announced on May 15, 2025 that it will acquire Hornetsecurity. The price is reported at more than $1 billion, the largest acquisition in Proofpoint’s history. It also comes as the company, owned by private equity firm Thoma Bravo, weighs a return to the stock market.
What Proofpoint gets
Hornetsecurity sells cloud security for Microsoft 365, including email protection, backup, compliance and security awareness training, mostly through managed service providers. That fills a gap for Proofpoint, whose products have long targeted large enterprises. Phishing and ransomware hit small businesses hard. Proofpoint now has a way to sell to them.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Hornetsecurity has grown quickly in Europe, so the deal gives Proofpoint a much bigger footprint there. Proofpoint said it plans to deepen its investment in European markets, and Hornetsecurity’s leadership will stay on to run the business.
An eye on the stock market
The timing matters. Proofpoint has said it remains interested in going public and will do so when the time is right. Investors like security companies that sell broad platforms, and adding a fast-growing small-business line makes Proofpoint’s story easier to tell.
Proofpoint CEO Sumit Dhawan said the deal extends the company’s human-centric security platform to managed service providers and small and midsize businesses, and that it deepens Proofpoint’s investment in Europe.
How the market reads it
Analysts have broadly welcomed the move. Adding Hornetsecurity could speed up growth inside Proofpoint and gives it a new channel to market.
Others urge caution. Integrations are hard, and if the cultures or product lines don’t mesh, the costs can outweigh the early gains.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
What it means for competitors
Rivals in email security will feel this. Proofpoint now competes more directly for small business and MSP customers, and other vendors may respond with acquisitions of their own. Expect more consolidation.
Our read
The Hornetsecurity deal puts Proofpoint in a stronger position in Europe and in the small-business market heading into any IPO. It also shows how security companies are using acquisitions to fill gaps quickly.
The harder part comes next. Proofpoint has to integrate the business well while preparing to go public, and investors will judge both.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Citrix NetScaler CVE-2026-19490: The Auth Bypass That Went From PoC to Probes in a Day
CVE-2026-19490 is a CVSS 9.3 NetScaler Gateway/AAA auth bypass. A public PoC on Sept 2 was followed by live probes within a...
PaperCut NG/MF: The Print Server That Learned Remote Code Execution Again
CVE-2026-81578 and CVE-2026-82078 chain to pre-auth RCE on PaperCut Application Server. Confirm Emergency Patch Release 2, restrict admin exposure, and hunt like...
JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners
CVE-2026-82329 lets attackers forge Artifactory admin tokens via a deterministic empty join key. Mass scanning peaked near 406,000 attempts; patch fixed builds...
Friday’s brief: GitLab’s 10.0 fix, then VeloCloud attacks, a poisoned LiteLLM release and PHP2Shell logs to check
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.