The ocean floor had disappeared. More precisely, the expensive digital images of it had vanished from an oil and gas company’s file servers. The seabed itself was behaving impeccably. The computers were less forthcoming. Who had removed the files? Was it an accident? Had someone taken them? There was no useful record to settle the matter.
Yaki Faitelson and Ohad Korkus encountered this problem while working for NetApp on a customer project in Angola. The incident became part of the founding story of Varonis, the data security company they started in 2005. It offered an unusually concrete introduction to an abstract business: a company could spend millions creating information and still know remarkably little about what happened to it.
Faitelson has now spent more than twenty years pursuing the questions those missing images left behind. His subjects have expanded from file servers to cloud systems, databases and autonomous AI. His job title has expanded too: chief executive, president, co-founder and chairman. Beneath the titles sits a fairly stubborn preoccupation with who can touch the information.
On October 15, 2026, that preoccupation acquired a new financial marker. Proofpoint announced an agreement to buy Varonis for approximately $6.3 billion in cash. The deal awaits approvals and is expected to close in the first half of 2027. For now, Faitelson remains at the company he helped build, with another transition to manage.
The boy who could fix the ATV
Long before the file servers, there were broken all-terrain vehicles. A childhood friend’s account of growing up with Faitelson in Elkana describes a practical, restless boy who could repair ATVs, ride donkeys from a nearby village and run fast. Sitting through the expected educational routine was less of a specialty.
That recollection is useful because it gives the later technical career some texture without turning childhood into a business-school prophecy. Fixing an ATV does not predict a Nasdaq listing. It does establish an early acquaintance with things that fail, and with the satisfaction of getting them to work again.
The same friend remembered meeting him in New York years later, sharing Korean soup and listening to him discuss economics. Formal study in economics or computing had not been the route described in that account. The conversation had travelled considerably farther than the childhood village.
His working education included leadership positions at NetVision and Network Appliance, now NetApp, in professional services and systems integration. Those jobs put him near the awkward junction between what technology promises and what a customer can actually make it do. By the time he and Korkus started Varonis, they had encountered a problem that survived the installation of expensive equipment.
A file needs a biography
Faitelson and Korkus developed the MetaData Framework that became the foundation of the Varonis platform. The technical name conceals a familiar idea. A document has contents, but it also has a surrounding life: permissions, owners, readers, changes and patterns of use. That surrounding information can explain a great deal about its safety.
In 2011, writing about the lessons of WikiLeaks, Faitelson argued for using metadata to understand access and automate authorization reviews. His concern extended beyond passwords. Organizations needed to know which people could reach their information, which people actually did, and when access ought to be removed.
Consider an ordinary office folder as an illustration. Permission granted for an old project can outlive the project. A new colleague joins a group and inherits access. Another person changes jobs. Nothing dramatic happens to the folder itself. Its audience quietly changes. A locked front door offers limited comfort when the guest list has become a work of speculative fiction.
The appeal of his approach lay in treating these relationships as something software could examine continuously. Faitelson and Korkus hold patents covering permissions visualization, simulation and data analysis. The commercial ambition was to give organizations a usable account of their information’s life, including the parts nobody had remembered to ask about.
A stock ticker can wait
Varonis went public on Nasdaq in February 2014. Its offering price was $22 a share; the first trading day ended at $44. A company occupied with the less glamorous details of file access had received a very public welcome.
The following Monday, Faitelson told an interviewer he had not yet checked the ticker that morning. He described the flotation as a milestone and said he had expected it to go well. There is a pleasing incongruity in a data security executive declining, for a moment, to inspect a highly visible piece of data.
The listing also changed the duration of his assignment. A founder can reach an IPO and leave the next phase to someone else. Faitelson continued running Varonis through subsequent changes in how companies stored, bought and used software. The public-market milestone became one date within a much longer operating career.
Two notes, and room for other people
Ask Faitelson about leadership and the answer moves away from architecture. He credits Tom Mendoza, the NetApp executive and Varonis board member, with teaching him that people need to feel their leader cares about them. Technical knowledge alone cannot do that job.
In describing his responsibilities, Faitelson talks about helping employees realize their potential and making customers successful. His account places service near the center of the chief executive’s work. For someone whose company sells control over access, he gives considerable weight to the relationships that cannot be administered through a permissions console.
He also describes a metaphorical pair of notes: one conveys the conviction that the world was created for him; the other reminds him that he is ashes and dust. The pairing allows for ambition without an exemption from humility. It is quite a lot of management guidance to keep in a pocket.
“Being humble is very important.”
Yaki Faitelson, in a leadership interview
His discussion of persistence is similarly practical. He has spoken about products that took two years to gain traction and the conviction required to keep pursuing them. He pairs belief with planning, execution and following through. Patience, in this account, still has a job description.
Looking back at his younger self, he has emphasized how much his quality of life depends on friends, family, customers and close relationships. “Heaven is other people,” he said. It is a warmly sociable conclusion for an executive who spends so much working time considering the trouble people can cause with a file.
Changing the machinery while it runs
The founder’s endurance has involved changing the business he built. In November 2025, Faitelson explained the decision to end the legacy self-hosted product by December 31, 2026, and concentrate on software delivered as a service. He argued that maintaining both systems divided the attention needed to automate protection.
His reasoning was about responsibility as much as delivery. Operating the software stack would let Varonis take more responsibility for results. The company’s managed detection and response service, combining analysts with automation, was central to that argument. Customers would receive help responding to threats rather than simply receiving another list of things to fix.
A cutoff date gives that philosophy consequences. Existing customers have to move. Migration becomes part of the promise the chief executive must deliver. The decision offers a useful measure of Faitelson’s role at this stage: he is still choosing which parts of the original business to stop maintaining so the next version can develop.
AI inherits the keys
Artificial intelligence gave his old questions fresh urgency. In a 2026 conversation with Ron Bennatan, the founder of AllTrue.ai and a Varonis strategy executive, Faitelson discussed the risks of agents that access data and take action across systems. Permissions once used intermittently by a human can become working instructions for a tireless machine.
In an illustrative office scenario, an employee might never discover an unnecessarily accessible folder. An assistant asked to assemble an answer could find it immediately. The permission was already excessive; the assistant makes it useful, and potentially consequential, much faster. Faitelson’s argument is that businesses need to understand that reach while allowing AI to do productive work.
Varonis announced its acquisition of AllTrue.ai in February 2026 to add visibility into AI systems and controls over their behavior. The move brought Bennatan’s experience into the company and extended the investigation from data access to the systems doing the accessing. A database-monitoring acquisition, Cyral, had already broadened the company’s coverage in 2025.
By March 2026, Faitelson was delivering an RSA Conference presentation called “Robots vs. Robots.” The title suits the stage photograph: a human executive, a presentation remote and a very large mechanical presence. His underlying subject remains recognizable from the missing images. What can the system reach, what is it doing, and how will anyone know?
The next set of keys
The proposed Proofpoint combination extends that line of inquiry. Proofpoint brings experience in attacks reaching people through communications; Varonis brings its account of the data those attacks seek. The companies intend to connect those views. Under the announced terms, Varonis shareholders would receive $49.75 a share in cash.
Faitelson’s October announcement to customers stressed that the companies would continue operating separately until closing. He also described a possible future return of the combined business to public markets. Both the integration and that longer ambition remain ahead. An agreement creates work as well as a valuation.
For Faitelson, the route has run from hands-on systems work to a public company and now a proposed combination with another security business. The scenery has changed considerably. The question that started the journey is still short enough for a customer to ask without any technical training: what happened to our information?