Varonis will stop supporting its self-hosted platform on December 31, 2026. For the world’s most regulated organizations, “just move to SaaS” isn’t a plan. Here’s what to do next.
For more than a decade, Varonis was the default answer for protecting unstructured data on-premises. That chapter is closing. Varonis has confirmed it is going all-in on SaaS and will end support for its self-hosted Data Security Platform on December 31, 2026. Its leadership calls this the completion of a three-year strategy that finished two years early.
For many customers, a SaaS move will be fine. For others — banks under DORA, hospitals, defense suppliers, public-sector agencies, critical infrastructure operators under NIS2 — it raises a hard question. What happens when your data security vendor no longer runs where your data has to live?
What’s changing, and when
The deadline is fixed; much of what follows it is not. Here’s what’s known today:
- End of support: December 31, 2026 for the self-hosted Data Security Platform.
- The path Varonis offers: migration to Varonis SaaS, which the company describes as a re-architecture rather than a hosted copy of the on-prem product.
- After the deadline: not publicly documented. Whether support ends abruptly, shrinks to emergency fixes, or stops patches entirely is a question to put to your Varonis account team now.
One thing is clear. Running unsupported security software means no patches, no updated threat models and no vendor incident response. In a regulated environment, auditors tend to treat that as a finding, not an accepted risk.
The clock is also tighter than it looks. Replacing a data security platform in a mid-sized organization typically takes six to twelve months. Add procurement, security reviews and parallel running in a regulated shop, and many teams are already behind.
Why regulated organizations can’t simply follow Varonis to the cloud
SaaS solves real problems: no SQL Server licenses, no patching, no fleet of VMs to manage. But for a large part of the market, the reason data sits on-premises was never about convenience.
- Sovereignty. Many organizations must keep data, and metadata about that data, inside national or organizational borders. Sending file activity, permissions and classification results to a third-party cloud can itself be a compliance problem.
- Air-gapped and isolated networks. Defense, critical infrastructure and some research environments have no path to the internet by design. A cloud-only tool can’t see them.
- Regulatory scrutiny. DORA, NIS2, HIPAA and sector rules all ask who can reach your sensitive data and how you prove control. Adding a new cloud processor means new third-party risk reviews, contracts and audit evidence.
- AI readiness. The data most valuable for AI — contracts, patient records, engineering files — is often the data that can’t leave the building. Organizations need to know, clean and govern it where it lives before any model touches it.
For these organizations, the end of Varonis on-prem isn’t a migration project. It’s a vendor decision.
Seven questions to ask any replacement
Don’t settle for a like-for-like swap. Use the transition to raise the bar.
- Will it run where your data must stay? On-premises, hybrid and fully air-gapped — with a public, long-term commitment, not a roadmap slide.
- Does it cover all six DSPM capabilities? Discover, classify, control access, monitor, detect and respond, in one product.
- How fast does it deploy? Agentless approaches that stream data events connect in days, not quarters.
- Can it stop an attack, not just report one? Look for ransomware and malware blocking at the point of write, plus proof your data is recoverable.
- Will it prove compliance? Evidence for DORA, NIS2 and GDPR audits should come out of the product, not out of spreadsheets.
- Is it ready for AI? You need to know which sensitive data could reach an AI model, and govern it before it does.
- Can you run it in parallel? Plan overlap, validate detection coverage and leave a buffer before December 31, 2026.
Where ProLion fits
ProLion was built for exactly the organizations SaaS-only vendors are leaving behind. Our mission is to help the world’s most regulated organizations know, protect and control their data, wherever it lives, so they can move confidently into the AI era.
- On-prem and air-gapped by design. ProLion runs inside your environment, including fully isolated networks. Your data and its metadata never have to leave.
- One DSPM product, two tiers. DataDefense protects your file data. DataGovernance adds the governance layer and connectors such as SharePoint on-premises and Microsoft 365, built for CISOs, compliance teams and DPOs working under NIS2 and DORA.
- Fast to connect. An agentless approach streams data events from NetApp, Dell, and Windows File Server, so you see results quickly.
- Classification, generally available. Find and label sensitive data across your estate, so you know what you hold before you decide who can reach it — or which AI can.
- Protection that acts. ProLion blocks ransomware and malware at the point of write and supports post-attack recovery assurance.
- Built for the AI era. With AI-Trust, ProLion helps you govern the data your AI initiatives depend on, on-premises.
You don’t have to choose between AI innovation and control of your data. You shouldn’t have to choose between your security vendor and your regulator either.
Your next step
December 31 is less than two months away. If you run Varonis on-premises, start now:
- Ask your Varonis account team, in writing, what support looks like after December 31, 2026.
- Confirm with your compliance and legal teams whether a SaaS-only model is acceptable for your data.
- Book a ProLion assessment. We’ll map your environment, show you what we find, and plan a parallel run that keeps you covered through the cutover.
Want to see it first? DataDefense is free up to 5 TB, with full features and self-install.
More on what is changing and what it means for an on-prem estate: the Varonis situation, set out in full, and the row-by-row comparison.
Talk to ProLion about your Varonis transition →
Source: Varonis blog, “Why we’re going all in on SaaS” — the primary source for the announcement.
