Proofpoint announced the Agentic Collaboration Security system, bringing together a new intent-based detection model and agentic capabilities to protect how people communicate and collaborate. The Proofpoint Agentic Collaboration Security system reasons about what an interaction is trying to accomplish, uses context to distinguish malicious intent from legitimate activity, and turns those decisions into action across email, collaboration tools, and the browser.
The hardest attacks to detect increasingly resemble normal business activity. A compromised supplier can be leveraged to attack through existing email threads, appearing as normal exchanges to users and defenses. A fraudulent payment request can match an established business relationship. An attack targeting one executive may never repeat. In addition, AI has increased the volume, speed, and sophistication of attacks. When the account, conversation, and request all appear familiar, behavioral anomalies alone may not reveal the threat. Detection must understand both the context surrounding an interaction and its intent.
“Attackers increasingly operate inside the relationships and workflows organizations already trust,” said Tom Corn, executive vice president and general manager, Threat Protection Group at Proofpoint. “That changes the detection problem. Security needs to understand what an interaction is trying to accomplish, reason over the context around it, and act before the attacker succeeds. Not with disparate tools, but as one system that gets smarter with every decision it makes.”
One shared foundation
At the foundation of the Proofpoint Agentic Collaboration Security system is the Proofpoint Knowledge Graph, which combines threat intelligence on active campaigns, industry attack patterns, and compromised suppliers with organizational context including business relationships, communication patterns, data access, and user risk.
The new Nexus Intent-Based Detection Model reasons over that context using multi-stage analysis that adjusts to the ambiguity of each interaction. Most decisions resolve in under half a second, while ambiguous cases receive deeper analysis to determine what a message is trying to accomplish and whether that objective is plausible in context.
Together, the Knowledge Graph and Nexus model provide a shared foundation, allowing intelligence from one control point to inform detection, investigation, and user protection across the system.
From intent-based detection to agentic action
Because Proofpoint operates both email gateway and API-based protection, intent analysis can begin before delivery and continue in the inbox, with intelligence learned downstream continuously strengthening pre-delivery detection. Proofpoint is the only secure email gateway to deliver intent-based detection before a message reaches the user.
- Intent-based detection: Proofpoint applies intent reasoning before delivery at the email gateway and in the inbox through the API. For individuals with outsized access or transaction authority, including executives and finance approvers, Privileged User Protection builds dedicated detection models to identify highly targeted attacks engineered for a specific individual.
- Autonomous threat investigation: Proofpoint automatically reconstructs attacks, identifies related messages, determines blast radius, and assembles the evidence needed for response, dramatically reducing the manual effort and time required to investigate attacks across affected users.
- Adaptive user protection: Proofpoint continuously identifies and analyzes high-risk users based on each organization’s unique environment, explains the factors driving their risk, and dynamically adapts protection and real-time coaching. Behind the scenes, Blue Team and Red Team agents continuously assess risk and test defenses using relevant business context to identify weaknesses and strengthen protection before attackers can exploit them.
Strengthening protection at time of click
Proofpoint is also introducing Advanced Browser protection, providing a comprehensive security control point that extends continuous collaboration security beyond the gateway and inbox to the browser. Built in partnership with Push Security, the enhanced solution is the first collaboration security offering to unify Proofpoint’s industry-leading email threat intelligence with browser-native protection, helping organizations stop post-click phishing and malicious URLs in the browser, malicious browser extensions, OAuth phishing, credential theft, session hijacking, and other browser-borne attacks. Browser telemetry is integrated into Threat Protection Workbench, the Proofpoint Security Graph, and the Investigation Agent, giving security teams unified visibility and investigation workflows across the entire collaboration attack chain – from message delivery through browser interaction.
Discussion about this post