Proofpoint Stops the Attacks Traditional Defenses Miss in the AI Era

Intent-based detection and multi-stage AI reasoning identify and stop sophisticated attacks before, during and after they reach people. 

• Stops sophisticated attacks in one connected defense with threat intent, investigation, and user risk so organizations can detect attacks earlier, understand them faster, and respond before they cause harm. 

• Creates multiple opportunities to detect attacks that initially look legitimate, applies progressively deeper AI reasoning before delivery, and continues protection in the inbox to uncover attacks that evade traditional defenses.  

• Strengthens protection around the people at greatest risk, identifying high-risk users and adapts their defenses, while purpose-built agents investigate threats, deliver personalized coaching, and proactively test protections for potential weaknesses. 

SUNNYVALE, Calif. and Proofpoint Protect 2026, San Diego – September 22, 2026 – Proofpoint, Inc., a global leader in human and agent cybersecurity, today announced the Agentic Collaboration Security system, bringing together a new intent-based detection model and agentic capabilities to protect how people communicate and collaborate. The Proofpoint Agentic Collaboration Security system reasons about what an interaction is trying to accomplish, uses context to distinguish malicious intent from legitimate activity, and turns those decisions into action across email, collaboration tools, and the browser. 

The hardest attacks to detect increasingly resemble normal business activity. A compromised supplier can be leveraged to attack through existing email threads, appearing as normal exchanges to users and defenses. A fraudulent payment request can match an established business relationship. An attack targeting one executive may never repeat. In addition, AI has increased the volume, speed, and sophistication of attacks. When the account, conversation, and request all appear familiar, behavioral anomalies alone may not reveal the threat. Detection must understand both the context surrounding an interaction and its intent. 

"Attackers increasingly operate inside the relationships and workflows organizations already trust," said Tom Corn, executive vice president and general manager, Threat Protection Group at Proofpoint. "That changes the detection problem. Security needs to understand what an interaction is trying to accomplish, reason over the context around it, and act before the attacker succeeds. Not with disparate tools, but as one system that gets smarter with every decision it makes."

One Shared Foundation

At the foundation of the Proofpoint Agentic Collaboration Security system is the Proofpoint Knowledge Graph, which combines threat intelligence on active campaigns, industry attack patterns, and compromised suppliers with organizational context including business relationships, communication patterns, data access, and user risk. 

The new Nexus Intent-Based Detection Model reasons over that context using multi-stage analysis that adjusts to the ambiguity of each interaction. Most decisions resolve in under half a second, while ambiguous cases receive deeper analysis to determine what a message is trying to accomplish and whether that objective is plausible in context. 

Together, the Knowledge Graph and Nexus model provide a shared foundation, allowing intelligence from one control point to inform detection, investigation, and user protection across the system. 

From Intent-Based Detection to Agentic Action

Because Proofpoint operates both email gateway and API-based protection, intent analysis can begin before delivery and continue in the inbox, with intelligence learned downstream continuously strengthening pre-delivery detection. Proofpoint is the only secure email gateway to deliver intent-based detection before a message reaches the user. 

• Intent-Based Detection: Proofpoint applies intent reasoning before delivery at the email gateway and in the inbox through the API. For individuals with outsized access or transaction authority, including executives and finance approvers, Privileged User Protection builds dedicated detection models to identify highly targeted attacks engineered for a specific individual. 

• Autonomous Threat Investigation: Proofpoint automatically reconstructs attacks, identifies related messages, determines blast radius, and assembles the evidence needed for response, dramatically reducing the manual effort and time required to investigate attacks across affected users. 

• Adaptive User Protection: Proofpoint continuously identifies and analyzes high-risk users based on each organization's unique environment, explains the factors driving their risk, and dynamically adapts protection and real-time coaching. Behind the scenes, Blue Team and Red Team agents continuously assess risk and test defenses using relevant business context to identify weaknesses and strengthen protection before attackers can exploit them. 

Strengthening Protection at Time of Click

Proofpoint is also introducing Advanced Browser protection, providing a comprehensive security control point that extends continuous collaboration security beyond the gateway and inbox to the browser. Built in partnership with Push Security, the enhanced solution is the first collaboration security offering to unify Proofpoint's industry-leading email threat intelligence with browser-native protection, helping organizations stop post-click phishing and malicious URLs in the browser, malicious browser extensions, OAuth phishing, credential theft, session hijacking, and other browser-borne attacks. Browser telemetry is integrated into Threat Protection Workbench, the Proofpoint Security Graph, and the Investigation Agent, giving security teams unified visibility and investigation workflows across the entire collaboration attack chain—from message delivery through browser interaction. 

Availability

The new capabilities in Proofpoint Agentic Collaboration Security will be delivered in Q1 2027 as an update to Proofpoint’s collaboration security solution, extending the protection customers already use without requiring a migration. Availability may vary in countries with specific data residency requirements. 

To learn more, read our blog: https://www.proofpoint.com/us/blog/threat-protection/stopping-attacks-they-reach-inbox-introducing-proofpoint-agentic.

About Proofpoint, Inc.  

Proofpoint, Inc. is a global leader in human and agent cybersecurity, securing how people, data and AI agents connect across email, cloud and collaboration tools. Proofpoint is a trusted partner to over 80 of the Fortune 100, over 14,000 large enterprises, and millions of smaller organizations in stopping threats, preventing data loss, and building resilience across people and AI workflows. Proofpoint’s collaboration, data, and AI security platform helps organizations of all sizes protect their people, defend their data, and adopt AI securely and confidently. Learn more at www.proofpoint.com.  

  
Connect with Proofpoint on LinkedIn 

Proofpoint is a registered trademark or tradename of Proofpoint, Inc. in the U.S. and/or other countries. All other trademarks contained herein are the property of their respective owners.