Proofpoint unveils agentic security systems as AI-driven cyberattacks blend into normal emails

Proofpoint shifts security approach as AI-driven cyberattacks mimic legitimate business activity

Proofpoint introduced two new agentic security systems at Proofpoint Protect 2026 in San Diego, marking a fundamental shift in how organizations defend against AI-driven cyberattacks that increasingly resemble normal business communications1

1

. The Agentic Collaboration Security system and Agentic Data and AI Security System both address a growing challenge: attacks now operate inside trusted relationships and workflows, making traditional warning signs ineffective2

2

. Tom Corn, executive vice president at Proofpoint, explained that attackers increasingly operate inside the relationships and workflows organizations already trust, fundamentally changing the detection problem3

3

.

Intent-based security becomes foundation for detecting sophisticated threats

The new systems are built on the Proofpoint Knowledge Graph, which combines threat intelligence on active campaigns, industry attack patterns, and compromised suppliers with organizational context including business relationships, communication patterns, data access, and user risk3

3

. The Nexus Intent-Based Detection Model reasons over that context using multi-stage analysis that adjusts to the ambiguity of each interaction, with most decisions resolving in under half a second3

3

. Sumit Dhawan, CEO of Proofpoint, emphasized that because no company can patch every vulnerability, enterprises need compensating controls that judge the intent of every human and agent1

1

. This intent-based security approach addresses attacks that hijack legitimate supplier email threads without using malware, making them nearly impossible to detect with traditional methods1

1

.

Real-world attacks demonstrate urgency of new detection capabilities

Proofpoint's threat intelligence reveals how AI is making cyberattacks look like normal emails through campaigns like UNK_CondorFiltration, which targeted more than 5,700 Microsoft 365 accounts across 28 tenants in Latin America2

2

. Seven accounts were compromised, with six taken over within minutes. In one case, within 90 seconds of gaining access, the attacker switched to a German VPN, probed the corporate VPN, accessed Azure Portal and SharePoint, and requested a Microsoft Graph API token2

2

. The activity was consistent with attempts to access or exfiltrate corporate data, illustrating why security must shift from checking access permissions to understanding intent. Skilled threat actors now use AI to speed up malware development and copy lures into as many as 16 languages, while static detections lose their value quickly1

1

.

Agentic Collaboration Security system delivers multi-layered protection

The Agentic Collaboration Security system provides intent-based detection before delivery at the email gateway and in the inbox through API integration, making Proofpoint the only secure email gateway to deliver intent-based detection before a message reaches the user3

3

. For individuals with outsized access or transaction authority, Privileged User Protection builds dedicated detection models to identify highly targeted attacks engineered for a specific individual3

3

. Autonomous Threat Investigation automatically reconstructs attacks, identifies related messages, determines blast radius, and assembles evidence needed for response, dramatically reducing manual effort3

3

. Advanced Browser Protection, built in partnership with Push Security, extends continuous collaboration security beyond the gateway and inbox to the browser, helping organizations stop post-click phishing, malicious browser extensions, OAuth phishing, and credential theft3

3

.

AI agents emerge as concentrated insider risks on enterprise endpoints

About 99% of the agentic activity Proofpoint monitors runs on ordinary endpoints rather than in the cloud, which makes its tens of millions of endpoint sensors the foundation for agent security1

1

. Ryan Kalember, chief strategy officer of Proofpoint, emphasized that governance policies written for humans must be turned into real-time controls that agents can understand1

1

. The company's 2026 AI and Human Risk Landscape report found that 87% of organizations have moved AI assistants beyond pilot, yet 52% aren't confident their controls could detect a compromise4

4

. This gap highlights why secure AI agents require fundamentally different approaches than traditional cybersecurity measures.

Agentic Data and AI Security System translates policies into runtime controls

The Agentic Data and AI Security System addresses the challenge that AI tools often see intent but not data access, while data tools see sensitive data but not agent intent4

4

. Three new agents work from one shared understanding of risk: Zero-Touch Detection surfaces the handful of actions that matter instead of generating floods of anomalies, Instant Investigation reconstructs what happened across data, identity and behavior automatically, and Protection Optimization turns understanding into action from access remediation to DLP policy optimization4

4

. Proofpoint Semantic Business Policies translate existing governance requirements into continuously enforced AI controls, allowing organizations to express rules in plain language that the system interprets and enforces automatically4

4

. Capabilities within the system are expected to be available by year-end 20264

4

.

Anthropic partnership emphasizes trust engineering before scaling agents

Anthropic held back general release of its Mythos Preview model to build guardrails and get it to defenders first, since new models can chain low-severity vulnerabilities into serious exploits1

1

. Robert Bair, head of national security partnerships at Anthropic, advised companies to write policy, set up sandboxing and visibility, and start small with a clear view of the blast radius1

1

. This trust engineering approach reflects broader industry recognition that enterprises must engineer for trust before scaling agents. The collaboration between Proofpoint and Anthropic demonstrates how frontier labs are expanding initiatives like Project Glasswing to put vulnerability-hunting models in more defenders' hands1

1

.

Platform consolidation drives growth as enterprises prioritize AI security

Proofpoint's annual recurring revenue is close to $2.5 billion and growing nearly 20%, including Hornetsecurity, after doubling since Thoma Bravo took it private in 20211

1

. Remi Thomas, chief financial officer of Proofpoint, shared that security chiefs are consolidating providers to free up budget for AI, including a Canadian bank that replaced four suppliers in a $25 million, five-year deal1

1

. This consolidation trend reflects how large enterprises view transformation as competitive advantage, with speed as their primary game according to theCUBE Research executive analyst John Furrier1

1

. Organizations now recognize that if they can beat competition with better products and better outcomes through AI adoption, they win—but only if they manage the security piece effectively1

1

.