Proofpoint Introduces Agentic Collaboration Security With Intent-Based Detection

Proofpoint said it is delivering Agentic Collaboration Security, a system intended to protect how people communicate and collaborate. The update addresses attack patterns that can resemble normal business activity and emphasizes detection that applies across the email-to-browser flow.

Proofpoint described attacks that can be hard to detect because they align with existing relationships and workflows, including compromised suppliers used through existing email threads and fraudulent payment requests tied to established business relationships. It also said attacks have increased in volume, speed, and sophistication, and that behavioral anomalies alone may not reveal threats.

At the foundation, Proofpoint said the system uses its Knowledge Graph to combine threat intelligence on active campaigns, industry attack patterns, and compromised suppliers with organizational context such as business relationships, communication patterns, data access, and user risk. Proofpoint also said the Nexus Intent-Based Detection Model performs multi-stage analysis that adjusts to interaction ambiguity, with most decisions resolving in under half a second and ambiguous cases receiving deeper analysis.

Proofpoint said intent analysis can begin before delivery at the email gateway and continue in the inbox through an API. It described three capabilities: intent-based detection with Privileged User Protection for individuals with outsized access or transaction authority, autonomous threat investigation that reconstructs attacks and assembles evidence, and adaptive user protection that identifies and analyzes high-risk users and uses Blue Team and Red Team agents to assess risk and test defenses. Proofpoint also said it is introducing Advanced Browser protection built in partnership with Push Security, extending collaboration security beyond the gateway and inbox to the browser, and that the new capabilities will be delivered in Q1 2027 as an update without requiring a migration. “Attackers increasingly operate inside the relationships and workflows organizations already trust,” said Tom Corn, executive vice president and general manager, Threat Protection Group at Proofpoint. “That changes the detection problem. Security needs to understand what an interaction is trying to accomplish, reason over the context around it, and act before the attacker succeeds. Not with disparate tools, but as one system that gets smarter with every decision it makes.”