Proofpoint has launched its Agentic Collaboration Security system, combining intent-based detection with agentic investigation and user-risk capabilities to counter sophisticated attacks that resemble normal business activity.
The system analyses what an interaction is trying to achieve, uses context to distinguish malicious intent from legitimate activity, and acts across email, collaboration tools and the browser.
The company said traditional defences increasingly struggle because attackers operate within relationships and workflows that organisations already trust. Examples include attacks launched through compromised suppliers in existing email threads, fraudulent payment requests that match established business relationships, and one-off attacks targeting individual executives.
“Attackers increasingly operate inside the relationships and workflows organizations already trust,” said Tom Corn, executive vice-president and general manager of Proofpoint’s Threat Protection Group. “Security needs to understand what an interaction is trying to accomplish, reason over the context around it, and act before the attacker succeeds.”
Intent analysis at the core
At the centre of the system is the Proofpoint Knowledge Graph, which combines intelligence on active campaigns, industry attack patterns and compromised suppliers with organisational context such as business relationships, communication patterns, data access and user risk.
The new Nexus Intent-Based Detection Model applies multi-stage reasoning to that context. Most decisions are completed in under half a second, while ambiguous cases receive deeper analysis to establish what a message is attempting to do and whether that objective is plausible.
Because Proofpoint operates both email gateway and API-based protection, intent analysis can begin before delivery and continue within the inbox. Intelligence gathered after delivery is then used to strengthen pre-delivery detection.
Agents extend protection
The platform includes autonomous threat investigation, which reconstructs attacks, identifies related messages, determines the blast radius and assembles evidence for response. Proofpoint said this reduces the manual effort and time required to investigate incidents across affected users.
It also introduces adaptive user protection for high-risk individuals, including executives and finance approvers. The system builds dedicated detection models for privileged users, explains the factors driving their risk and adjusts protection and real-time coaching accordingly. Blue Team and Red Team agents continuously assess risk and test defences using relevant business context.
Proofpoint is also introducing Advanced Browser Protection, developed with Push Security. The capability extends protection beyond the inbox to defend against post-click phishing, malicious URLs and extensions, OAuth phishing, credential theft and session hijacking. Browser telemetry feeds into Proofpoint’s Threat Protection Workbench, Security Graph and Investigation Agent.
The new Agentic Collaboration Security capabilities are expected to be available in the first quarter of 2027 as an update to Proofpoint’s existing collaboration security solution.
