Proofpoint: Underwriting the Unknown

Welcome to the 207th Pari Passu newsletter.

In July 2026, Thoma Bravo went to lenders asking for two more years on Proofpoint's term loan. Nothing was wrong with the company. Revenue and annual recurring revenue were both growing close to 20%, and Proofpoint remained the leader in secure email. Thoma Bravo had taken the company private in 2021 for $12.3bn, delivered the margin expansion it underwrote, and spent the following years adding debt into a market that kept saying yes. By July, that market had stopped saying yes to software, and a maturity that once would have been refinanced quietly and years ahead of schedule had become a negotiation.

Goldman Sachs launched the amend and extend in July, offering to move $5bn+ of 1L term loans from August 2028 to August 2030. The book came up roughly $2bn short at the first commitment deadline. Over the next nine days, an opening package of roughly a dozen amendments grew to approximately forty, including tighter baskets, new LME protections and a mandatory quarterly lender call. The pricing never changed. The loan cleared on August 6 at $4,300mm and S + 4.50%, making the interesting question not what spread Proofpoint paid, but what lenders required instead.

This is not a restructuring, which makes it a different case study than we usually cover. We’ll start with the business model lenders were ultimately underwriting. We’ll then follow the company through the 2021 take-private and five years of sponsor ownership, tracking how the capital structure was built, refinanced, and levered further. From there we’ll walk through the July transaction before turning to what the negotiation says about how creditors now underwrite software.

An email arrives on a Tuesday afternoon, and it appears to come from your CFO. The signature block is correct, and it references a transaction you know is in progress. It asks you to approve a wire to a new counterparty by end of day. There is no attachment and no link, so there is nothing for antivirus software to detect. The only thing between the company and the wire is whether someone notices that the sender's domain is off by one character. 

That kind of attack illustrates the problem Proofpoint was built to solve: the most effective cyberattacks increasingly target people rather than machines. Proofpoint sits between employees and the outside world, trying to identify the fraudulent message, compromised account, or sensitive-data leak before the human interaction becomes a security incident. 

Headquartered in Sunnyvale, California, the company builds cloud-delivered software that inspects a company's email before it reaches employees, controls what data those employees send outward, retains the resulting records for regulators, and trains the employees themselves. The business runs across three product families: threat protection, information protection and compliance, and cloud and agentic security. Roughly 14,000 large enterprises use the platform, including more than 80 of the Fortune 100. After the December 2025 acquisition of a German provider called Hornetsecurity, the total customer count sits above 200,000 organizations [1]. Nearly all revenue is recurring subscription, and net revenue retention has held above 105%, meaning existing customers on average spend more at each renewal than the year before [2]. A meaningful amount of distribution runs through partners, and one of the larger relationships will be familiar from a piece of ours, as Proofpoint and Optiv have crossed a billion dollars in cumulative sales. To best understand Proofpoint’s model, we’ll walk through each product family, then turn to the competition.

Threat Protection is Proofpoint’s original business and remains the core of the platform. At its simplest, Proofpoint inserts itself between the public internet and a customer’s email environment, screening inbound traffic before it ever reaches an employee. That position in the mail flow gives the company visibility into both the message itself and the behavior surrounding it, making email security the foundation for the broader product suite.

The platform evaluates attachments in isolated sandboxes, rewrites links so destinations can be checked again at the moment of a click, and uses intelligence gathered across trillions of messages to identify emerging attack patterns across customers. The latter is particularly important because phishing infrastructure is often changed after a message is delivered; a benign destination can become malicious days later. Proofpoint supplements the gateway with security awareness training and behavioral technology, which it acquired through Tessian in 2023, and is designed to identify suspicious user activity and other threats that traditional content-based filters may miss [1]. 

Where threat protection governs what enters the organization, information protection governs what leaves it and what must be preserved. Data loss prevention, commonly shortened to DLP, inspects outbound content and enforces policy on what is permitted to exit the environment, whether that is a customer list moving to a personal cloud drive or regulated data leaving in an attachment. Proofpoint holds roughly a quarter of the global market for cloud and SaaS-delivered DLP, and sells the capability alongside insider threat management, which monitors user behavior rather than content and flags activity that departs from an established baseline [1]. 

The compliance and archiving business is less visible and considerably more durable. Financial institutions, insurers, healthcare providers, and law firms are required to retain communications for defined periods and to produce them on demand in examination or litigation, and Proofpoint maintains those records in a searchable archive. Once several years of mandated records reside with a single vendor, replacing that vendor becomes a huge compliance undertaking. 

Cloud and Agentic Security:

The third family is the newest and the least settled. A cloud access security broker, or CASB, applies the same visibility and control logic beyond email to the wider set of cloud applications employees use, identifying which are in use, who has access, and what data moves through them. Proofpoint extended the family in February 2026 with the acquisition of Acuvity, a startup focused on artificial intelligence agents, which read internal documents and act on behalf of employees while holding the access rights of a person without the accompanying judgment. The resulting products sit between corporate data and large language models, monitoring what agents request and redacting sensitive material before it leaves the environment [1]. 

Competition and Market Positioning

Proofpoint's most significant competitor is Microsoft, which does not sell email security as a standalone business. Instead, Microsoft bundles its filtering product, Defender for Office 365, into the highest tier of Microsoft 365 licensing, which makes the capability effectively free for customers already paying for that tier and places any standalone gateway subscription under review whenever budgets tighten. Proofpoint's response is that its detection is materially stronger and its compliance tooling considerably deeper, an argument that holds among large regulated enterprises and holds far less well among mid-market customers that have fewer compliance requirements [1]. 

Another competitive threat is a newer generation of vendors, of which Abnormal is the most prominent, which bypass the gateway entirely by connecting directly to the mailbox through the cloud provider's application programming interface, or API, and analyzing messages after delivery. Installing a gateway requires re-routing mail for the entire organization, a substantial operational undertaking at a company with tens of thousands of employees and contractors, while an API-based product can be deployed in minutes without touching mail routing at all [1]. 

Proofpoint's defensibility currently resides in the operational risk of re-routing enterprise mail, the regulated records already held in its archive, and the detection advantage that follows from processing trillions of messages a year. Each is real, and each is strongest in the customer segment that moves most slowly. None of them wins new business in the segment that moves fastest, an asymmetry we return to when we examine how lenders priced the company's debt. 

Eric Hahn, formerly chief technology officer of Netscape, incorporated Proofpoint in Sunnyvale, California in mid-2002 and launched it the following July around a single product, the Proofpoint Protection Server, which applied machine learning to inbound mail to separate legitimate messages from spam. The company raised roughly $85mm of venture capital across six rounds before eventually going public on the Nasdaq in April 2012 at $13.00 per share, raising a little over $80mm [3]. 

The platform we described in the business model section was assembled largely by purchase rather than organically. As a new public company, Proofpoint financed much of its early M&A activity through the convertible bond market while the company was still unprofitable, and each of the three product families traces to a specific transaction. Cloudmark, acquired for $110mm in November 2017, brought messaging telemetry from internet service providers and mobile carriers that fed the detection engine [4]. Wombat Security followed in February 2018 for $225mm and established the security awareness training business [5]. ObserveIT, bought for $225mm in November 2019, supplied insider threat management, and InteliSecure added data protection services in 2020 [6]. By the end of 2020, Proofpoint reported $1.05bn of revenue and became the first software-as-a-service security and compliance company to pass a billion dollars in revenue, though it remained unprofitable on a reported basis, with an operating loss of roughly $95mm [7].

In April 2021, Thoma Bravo announced its agreement to acquire the company at $176.00 per share in cash, valuing Proofpoint at approximately $12.3bn. The price represented a premium of roughly 34% to the last unaffected closing price. Shareholders approved the transaction on 23 July, and it closed on 31 August 2021, making it the largest take-private in software history at the time [8]. 

Measured against 2020 revenue of $1.05bn, the price works out to roughly 11.7x revenue. Measured against earnings, it depends entirely on which earnings figure is used. A rough estimate of true Adjusted EBITDA at the time of the acquisition was approximately $250mm, a figure that simply adds back stock-based compensation and acquisition-related amortization given the reported operating loss above. On that basis, the entry multiple was roughly 49x. However, subsequent reporting on the 2026 refinancing put the marketed entry multiple at 25x pro forma adj. EBITDA, which implies a PF earnings base closer to $490mm. While both figures are high, the gap between the two is the whole point, as Thoma Bravo was underwriting margin it intended to create rather than margin that existed, and the marketed multiple was struck on the former [9]. 

The capital structure at closing reflected that. Proofpoint funded the buyout with a $2.6bn 1L term loan due August 2028, an $800mm 2L term loan due August 2029, and a $300mm RCF, for roughly $3.4bn of funded debt against a $12.3bn purchase price [10]. The implied equity check was therefore more than $9bn, or roughly 70% of the capitalization, which is an unusually large amount of equity for a sponsor deal of this size. Liquidity at closing consisted of approximately $850mm: $550mm of balance sheet cash alongside the undrawn RCF. However, most of the large cash balance was effectively pre-reserved to fund substantial deferred RSU payments [11]. 

That equity cushion was doing necessary work. Against approximately $250mm of “true” adj. EBITDA, $3.4bn of funded debt is roughly 13.6x, which no lender would underwrite on a static view of the business. Moody's expected leverage to fall toward 7.5x within eighteen months, which implies EBITDA of roughly $450mm, a number much closer to Thoma Bravo’s $490mm marketed figure. 

Most sponsor transactions covered in our research involve a cyclical or structurally challenged business bought at a reasonable multiple and financed aggressively, with the equity effectively a thin option on things going right. Proofpoint was the inverse. Thoma Bravo paid a very full entry multiple for a fast-growing and unprofitable business with retention above 105%, and a leading position in its category. The firm then funded roughly 70% of the purchase price with equity. Buying excellent businesses at full prices and creating the margin afterward is the Thoma Bravo model, and it is different from the one we usually see. 

Thoma Bravo’s plan worked. Revenue kept compounding through the first two years of sponsor ownership and grew 15% in 2023 while margins expanded materially. That organic growth has since stayed in the high single digits, with acquisitions layering additional growth on top. By December 2023, Moody's calculated leverage at just over 7x. Working backward from the roughly $3.4bn of funded debt, that implies EBITDA of approximately $485mm, meaning the doubling that was marketed and underwritten at closing had been delivered inside of two and a half years. Liquidity remained comfortable, with $366mm of balance sheet cash and an undrawn revolver at year-end 2023 [12]. 

While Thoma Bravo’s entry multiple was aggressive, the subsequent operating performance clearly explains why the firm was willing to pay it. With earnings delivered, Proofpoint spent 2024 and early 2025 doing what a performing software credit could do in a market with abundant demand for it.

In March 2024, the company upsized its 1L term loan by $800mm and used the proceeds to repay the $800mm 2L in full, leaving the 1L as substantially all of the funded debt. The transaction was leverage neutral and reduced interest expense, and Fitch expected gross leverage below 6.0x for the year [13]. In May 2024, Proofpoint repriced the resulting $3.34bn term loan to S + 3.00%, joining a wave of large technology issuers shaving spread off loans that year. 

In January 2025, the company raised an incremental first lien term loan to fund a distribution to shareholders. The deal launched at $1bn and was upsized to $1.35bn on demand, which is a great indicator of where sentiment sat at the time. Funded debt rose to roughly $4.7bn and leverage moved to 8.9x, with the expectation that it would fall back toward 6.5x by the end of 2026 on continued growth [14]. While the 8.9x leverage figure sounds aggressive in isolation, Proofpoint was likely still worth a high-teens to 20x+ EBITDA multiple, so the implied LTV remained relatively conservative. Liquidity sat at approximately $575mm following the issuance, consisting of the $300mm undrawn revolver and $275mm of cash. Free cash flow was expected to be $100mm+ annually [15]. 

Six months later, Proofpoint raised again, this time to buy something. Proofpoint agreed to acquire Hornetsecurity in May 2025 for approximately $1.8bn and funded the deal with a $444mm incremental 1L term loan alongside a privately placed $1.22bn 2L term loan due 2033, split evenly between dollar and euro tranches at S + 5.75% and E + 5.75%. The acquisition brought roughly 12,000 channel partners and more than 125,000 small and mid-sized business customers across Europe, added approximately $60mm of EBITDA, and carried $15mm of identified cost savings. It also gave the historically U.S.-focused company a much deeper European presence, particularly across the SMB and channel markets. Funded debt now stood at approximately $6.26bn, comprising roughly $5.04bn of 1L term debt due August 2028 and the $1.22bn 2L, and Fitch calculated PF 2025 leverage at approximately 8.2x. Liquidity remained strong at roughly $500mm ($200mm cash plus the undrawn RCF) [16]. At approximately $1.8bn against roughly $60mm of acquired EBITDA, Proofpoint paid close to 30x, or 24x when crediting the full $15mm of identified savings. That is roughly the multiple Thoma Bravo paid for Proofpoint itself four years earlier, struck in mid-2025 and funded entirely with debt. 

Thoma Bravo bought the business with roughly $3.4bn of debt and close to $9bn of equity. Five years later, funded debt had nearly doubled while the equity check had been partially returned through the $1bn+ dividend in January 2025, and the business supporting it was considerably larger and considerably more profitable.

Through the end of 2025, this was a textbook private equity growth story. Thoma Bravo had paid a high multiple for an excellent business, the thesis played out, and the company kept growing while margins expanded. Debt-funded add-on acquisitions provided incremental growth, and the sponsor took cash back out through the January 2025 dividend, with credit markets cooperating the entire way. Proofpoint issued at S + 3.00%, and the term loans traded at or above par, and rightfully so. Leverage sat in the high single digits, but any reasonable valuation remained many turns above the debt stack, leaving billions of equity beneath the first lien.

However, in late January 2026, Proofpoint’s term loan began to fall, and by March it had reached approximately 95.5. It recovered to around 98 through the spring, slipped again toward 96 in early June, and did not return to the high nineties until August. None of that movement was driven by Proofpoint's own results, though, which continued to improve throughout. 

Instead, the cause was market-wide. Investors concluded that artificial intelligence posed a terminal value question for subscription software; collateralized loan obligation managers cut their software exposure, and refinancings that had historically been completed years ahead of maturity slowed sharply. Sponsors had spent a decade underwriting software on the assumption that recurring revenue made future cash flows unusually predictable. In 2026, lenders started questioning that assumption. Current EBITDA still supported the debt. What lenders were less willing to underwrite was whether Proofpoint’s product position, retention, and economics would look the same four or five years later. Thoma Bravo entered this period with roughly $9bn of portfolio company debt maturing by the end of 2028, making Proofpoint one of several tests of whether the old software financing model still cleared in the new market [17].  

With the first lien due August 2028, Proofpoint would move inside two years to maturity that summer, a point at which refinancing pressure starts to become more immediate. The company therefore had a window to extend rather than unlimited time to wait for markets to normalize. Proofpoint did not go to market with the loan at 95.5. Instead, it waited until July, after the paper had recovered toward par and lender sentiment had clearly improved enough to support an extension. 

Meanwhile, Proofpoint’s business kept growing. S&P projected revenue growth of nearly 20% for 2026 and low-to-mid teens for 2027, with annual recurring revenue up almost 20% in the first quarter [2]. Part of that is acquired rather than organic, since Hornetsecurity entered the comparison in December, and market participants put underlying organic growth in the high single digits. By the time Goldman Sachs began sounding out lenders in July, Proofpoint was marketed on $2.43bn of revenue and $972mm of LTM adj. EBITDA [9]. At the same time, approximately $5,035mm of S + 3.00% 1L term loans were coming due in August 2028, alongside a revolver due June 2028.

Proofpoint had also been signalling an eventual exit for some time. Dhawan told CNBC in 2024 that the company aimed to go public by the end of 2026, and raised the IPO ambition again on the July lender call, which is a deliberate thing to say to people being asked to fund a two-year extension.

In July 2026, Goldman Sachs launched an amend and extend, offering to move the maturity on Proofpoint's $5,035mm 1L term loan from August 2028 to August 2030. The template came from within the same portfolio.