Proofpoint

What Proofpoint actually does

Proofpoint’s core product is Proofpoint Targeted Attack Protection (TAP), a cloud-based email security gateway that sits in front of Microsoft 365 or Google Workspace. It scans inbound and outbound email for phishing, malware, BEC (business email compromise), and credential harvesting. The detection engine uses sandboxing, URL rewriting, and behavioral analysis. TAP is genuinely good at catching threats that slip past native Microsoft Defender for Office 365.

Beyond email security, Proofpoint sells Proofpoint Security Awareness Training (formerly Wombat), which delivers phishing simulations and training modules. There is also Proofpoint Information Protection for DLP and insider threat detection, Proofpoint Archive for compliance email retention, and Proofpoint Threat Intelligence for IOC feeds and campaign tracking. Since going private under Thoma Bravo in 2021, the company has been consolidating these into tighter bundles.

The breadth is both the strength and the trap. Proofpoint can genuinely cover email security, DLP, archiving, and user training. But each module is its own product with its own console, its own deployment, and its own line item. Buying the full suite means managing the full suite.

Who it’s best for

• Enterprises with 1,000+ mailboxes running Microsoft 365 that need stronger email security than Defender provides out of the box
• Compliance-heavy industries (financial services, healthcare, legal) that need email archiving and DLP in addition to threat protection
• Security teams that want phishing simulation and awareness training integrated with their email threat data
• Organizations with a dedicated email security administrator who can manage policy tuning and incident triage
• Teams already running Proofpoint that want to consolidate awareness training or DLP under the same vendor

Pricing reality check

Proofpoint prices per user, per year, tiered by bundle. The entry-level email security bundle (TAP Essentials) starts in the low double digits per user per year. The full platform with DLP, archiving, and awareness training pushes into the $40-80+ per user range depending on negotiation and volume.

The licensing can get confusing. Proofpoint sells named bundles (P0, P1, P3) and add-on modules. Ask your rep for a plain-language breakdown of what is included and what is extra. Watch for auto-renewal clauses and multi-year lock-ins. Proofpoint knows it is expensive and will offer discounts for longer commitments, but you lose flexibility.

Alternatives to consider

• Abnormal Security — If your primary concern is BEC and account takeover, Abnormal’s API-based approach catches social engineering attacks without requiring MX record changes. Faster to deploy, narrower scope.
• Mimecast — Covers similar ground on email security and archiving, often at a lower price point. Worth evaluating head-to-head if you are not locked into Proofpoint.
• Microsoft Defender for Office 365 Plan 2 — If you already have E5 licensing, Defender handles basic email security. The gap with Proofpoint is real but narrowing. Test before you buy an overlay.
• KnowBe4 — If you only need security awareness training and phishing simulation, KnowBe4 is the market leader in that specific category and costs less than bundling Proofpoint’s training module.

The Charting Cyber take

Proofpoint is the safe enterprise pick for email security. TAP works. The threat intelligence is strong. If you are a CISO who needs to defend the email channel and check compliance boxes, Proofpoint covers a lot of ground in one vendor relationship.

The honest caveat: Proofpoint is built for a world where email security means an inline gateway with MX record changes. The market is shifting toward API-based, post-delivery detection. Proofpoint has added API capabilities, but the architecture still favors the gateway model. If you are evaluating for the first time today, compare Proofpoint’s approach against API-first vendors like Abnormal Security before committing. If you are already running Proofpoint and it is working, there is no urgent reason to rip it out.