Proofpoint announced the Proofpoint Agentic Data and AI Security system, built to secure AI and data as one connected risk. Its innovative capabilities enable organisations to safely deploy AI agents with access to only the data they need based on intent, while translating existing business policies into runtime controls and continuously uncovering emerging risks across human and autonomous AI activity.
AI agents now discover, access, transform, and act on sensitive data at a scale no manual review can match. AI tools often see intent but not data access, and data tools see sensitive data but not agent intent. As those interactions multiply, seeing only half the picture leaves critical risk unseen. Securing AI and data separately is no longer enough; it takes a system that can act as fast as the risk appears.
Additionally, AI governance now extends beyond data loss. Agents can interact with enterprise systems, make decisions, and execute transactions, creating financial, operational, compliance, and safety risks. Proofpoint’s 2026 AI and Human Risk Landscape report found that 87% of organisations have moved AI assistants beyond pilot, yet 52% aren’t confident their controls could detect a compromise. Security teams now need to define and enforce AI behaviour in real time.
“You cannot secure AI without securing the data it acts on, and you cannot secure data without understanding how AI is using it,” said Mayank Choudhary, executive vice president and general manager, Data Security and Governance Group, Proofpoint. “Intent and access are two sides of the same coin. Securing them separately leaves critical context behind. Bringing AI run-time protections and AI data governance together gives organisations that context, and the ability to act on risk at the speed AI now moves.”
One agentic system for AI
The agentic system reasons at the agent level, using the same identity, access, and data context that already secures more than 14,000 enterprises’ data today. It is built on the Proofpoint Knowledge Graph, which is the foundation, connecting AI activity with data sensitivity, identity, access, behaviour, and intent through Nexus models. On top of it, three new agents work from one shared understanding of risk instead of three partial ones:
- Zero-touch detection: The Detection Agent sees intent and access as a single signal, surfacing the handful of actions that matter instead of the flood of anomalies traditional tools can’t stop generating.
- Instant investigation: The Investigation Agent reconstructs what happened across data, identity and behaviour automatically, turning an investigation that once took days of manual correlation into minutes.
- Protection optimisation: The Remediation Agent turns that understanding into action, from access remediation to DLP policy optimisation, with a human in the loop for governance.
Deepening AI runtime security: Turning business intent into AI runtime controls
Organisations need to enforce the rules they’ve already set for how AI should behave and catch the risks they never thought of writing a rule for in the first place.
Proofpoint Semantic Business Policies translate existing governance requirements into continuously enforced AI controls. An organisation can take a rule already written into its code of conduct, such as prohibiting interactions with gambling content, and express it in plain language: “Do not allow interactions with gambling content.” Proofpoint interprets the intent behind the policy, identifies the systems capable of carrying it out, and generates the runtime controls to enforce it automatically. Combined with Proofpoint Intent-Based Access Control, these policies evaluate AI behaviour against both enterprise requirements and an agent’s intended purpose, whether an employee is acting through an AI assistant or an autonomous agent is acting on their behalf at AI speed.
Finding the risks enterprises have not yet defined
Agentic Insights uses autonomous reasoning agents to analyse AI interactions, tool usage, policy decisions, and behavioural patterns to uncover emerging risks. When a risk is validated, Proofpoint can recommend a Semantic Business Policy to govern similar behaviour, turning new intelligence into enforceable protection.
Across AI and data security workflows, purpose-built detection, investigation, and remediation capabilities turn connected context into autonomous action, while Semantic Business Policies and Agentic Insights keep pace with risks the organisation hasn’t defined yet. Together, they prioritise real risk, speed investigations with data, identity, access, and behavioural signals, and reduce exposure through actions like access remediation, DLP policy optimisation, and enforceable runtime controls to cut manual work as AI activity scales.
“Organisations have spent decades defining how their businesses should operate,” said Ryan Kalember, chief strategy officer, Proofpoint. “The challenge now is making those rules enforceable as AI takes on more consequential work. Business intent needs to become part of the security control itself, with the ability to identify new risks and adapt as AI behaviour evolves.”
Availability
Capabilities within the Proofpoint Agentic Data and AI Security System, as well as Semantic Business Policies and Agentic Insights, are expected to be available by year-end 2026.
Discussion about this post