Proofpoint Email Protection Reviews

I have been working with Proofpoint Email Protection for the last five years.

Proofpoint Email Protection has an email protection module that ensures email hygiene from a user and recipient filtering point of view. It blocks senders and receivers while safeguarding digital assets through attachment scanning and ensuring there is no malware or URL rewrites. Proofpoint provides URL defense and attachment defense capabilities and ensures the organization's brand identity is protected through SPF, DKIM, and DMARC records.

The information protection module ensures content is safeguarded by filtering sensitive information or flagging it as spam or moving it to the quarantine folder. These modules effectively filter and work as anti-spam agents and can filter up to 99% of spam and phishing attacks.

I also worked on TRAP, which stands for Threat Response Auto-Pull. This is an efficient way to deal with threats on a reactive and proactive basis. If any email with spam or phishing content enters a mailbox, TRAP will automatically access those mailboxes and delete that content across the organization. TRAP performs very efficiently and can work as forensics to identify which computer the threat started from and provide all relevant cyber details.

Overall, these modules safeguard the infrastructure effectively as anti-spam and anti-phishing agents with malware protection, URL and attachment defense capabilities, and they filter many file types. From an authentication and anti-spoofing point of view with SPF, DKIM, and DMARC, Proofpoint provides business email compromise protection that effectively safeguards executive emails and eliminates imposter attacks. The sophisticated dashboard helps analyze which users or recipients are targeted most, protects against vendor fraud, and uses machine learning detection. Based on user behavior patterns, the system automatically identifies and can block or filter certain content.

From an information protection or data loss prevention point of view, Proofpoint detects sensitive information including PAN cards, HIPAA-related data, PCI information, financial data, credit card information, and fraud-related content. Based on AI and ML algorithms, it automatically flags these as spam. Marketing emails are also marked, and external emails can be labeled with cautions to end users.

Proofpoint provides encryption capabilities including TLS enforcement and Proofpoint Secure Email for attachment sharing. For large organizations, Proofpoint Secure Mail is a very secure way to transmit content or files. Policy-based rules and encryptions can be defined as well.

From an integration point of view, Proofpoint integrates with all Microsoft online solutions, Microsoft Defender for Office 365, and Entra ID. It also integrates with on-premises Exchange and can perform scanning on all on-premises mailboxes. Additional API capabilities are available, and Proofpoint Journaling and SIEM integration support exporting logs for analysis.

Logging and reporting capabilities provide audit trails showing who performed which action and end user navigation features. End users can release spam, mark emails as spam, or report suspicious emails or attachments. Incident investigation features help identify why emails are not being delivered or provide message tracking for blocked or quarantined messages. If spam mail is delivered as a false positive, tracking logs help fine-tune the system to understand why it was delivered when it should have been blocked.

For a large enterprise organization, we were receiving approximately 100 spam and mail flow issues per month. After implementing Proofpoint Email Protection, this reduced to 60 plus issues, representing a 40% reduction. Proofpoint blocked unnecessary content, marketing spam emails, campaign emails, fraud-related emails, and attachments with suspicious links before they generated issues. Proofpoint validates sender and sender domains for all authentication protocols and properly validates user mail flow related issues from internal to external communications.

The dashboard helped us identify the most attacked users and enroll them for education sessions so they would not click suspicious links or cause additional issues or incidents within the organization. Proofpoint automatically resolved some issues by default through blocking and quarantining emails. The statistics helped us proactively safeguard and reduce the number of issues being reported.

We leverage the PCSC portal or support portal to log in and raise incidents, or we can directly engage through email. We engage with the Proofpoint TAM or account manager based on the support model (Gold, Bronze, Diamond) for 24/5 or 24/7 support depending on priority. Generally, we refer to the knowledge base and support portal to raise support tickets and inform the TAM for any critical incidents to engage with. Proofpoint provides good support with well-maintained ETAs and approachable representatives.

Proofpoint Email Protection serves as a first level of defense and can reduce phishing attacks and malware protection. Advanced analytics with AI and ML capabilities protect against business email compromise attacks. It maintains email hygiene and serves as a compliance support tool with audit and compliance mail logs and traces for certain financial organizations.

Proofpoint integrates with all SaaS applications, cloud deployments, hybrid environments, and M365 very effectively as well as with on-premises Exchange. It provides significant benefits for mail hygiene purposes, filtering, reporting, auditing, compliance, and advanced malware protection with reduced phishing attack rates.

Proofpoint has helped safeguard and protect digital assets by filtering a lot of spam content, with approximately 90% of junk and spam being filtered out. This helps end user productivity significantly. Some users may be deceived by false phishing emails and become prey for scammers and intruders, but Proofpoint effectively filters such emails before reaching user mailboxes.

The value of this product investment is substantial. One user at another organization before Proofpoint adoption was about to pay millions of dollars based on a spam email, which would have been a significant financial scam. Proofpoint effectively eliminates fraud where people spoof senders to appear as if they are coming from trusted partners or the CFO or CIO asking for money. All such financial fraud and scam emails are filtered effectively.

The percentage and dashboard statistics show how much has been filtered and how much has been safeguarded each month, including how many genuine emails were received and how many users accessed them. We can conduct drills to determine how many users are accessing suspicious content and reach out to them directly to educate them. Although we have sophisticated products in place, we still need end user education as part of safeguarding assets and ensuring users will not become victims of scams, particularly financial-related scams and organization sensitive details.

As things are evolving and threats develop in unpredictable ways, Proofpoint must adopt AI solutions and agentic solutions more aggressively and provide them to customers as part of service offerings. Inbuilt AI solutions would add more value and make Proofpoint a more premium choice for customers. With the help of AI solutions, agentic AI, and generative AI capabilities, the product would be more efficient than it currently is.

Filtering false positives is highly challenging because it is impossible for humans to identify which emails are genuine and which are spam. Proofpoint should focus more on this area with back-end agents or other tools. Proofpoint should decide which emails are genuine and which are spam so it is not a challenge for end users. When receiving an email, end users should not have to determine whether to respond or not. Proofpoint should not release such spam emails and should strictly block such spam and spoof emails based on connection IPs. Currently, false positives occur in the product, and while this occurs in every product, it is an area where Proofpoint can focus on improving and reducing false positives. One email is enough for an end user to be deceived and lose money, so addressing this area is critical.

I have been working with Proofpoint Email Protection for the last five years.

Proofpoint is absolutely stable and reliable. We have multiple instances running simultaneously and have never experienced any downtime or glitches on Proofpoint's side in five to six years. Proofpoint handles approved maintenance windows probably on weekends, but we have never faced any issues during business days. Proofpoint is stable and highly available.

The complexity of installation and infrastructure details presents a challenge. Since Proofpoint runs on Linux machines, for on-premises solutions specifically, there is a challenge with deployment and scaling up the solution. Proofpoint provides flexibility to scale up and scale out, but on-premises deployments have limitations or are somewhat more complex compared to cloud instances.

I would rate the capabilities, time taken to resolve issues, and technical skills as eight out of ten.

We leverage the PCSC portal or support portal to log in and raise incidents, or we can directly engage through email. We engage with the Proofpoint TAM or account manager based on the support model including Gold, Bronze, and Diamond models for 24/5 or 24/7 support depending on priority. Generally, we refer to the knowledge base and support portal to raise support tickets and inform the TAM for any critical incidents to engage with. Proofpoint provides good support with well-maintained ETAs and approachable representatives.

I have exposure to IronPort, Symantec MessageLabs, Forcepoint, and FireEye. I also had a chance to work with and review Mimecast, as well as Microsoft Defender for Office 365 and EOP. Proofpoint is much more advanced and capable of safeguarding the infrastructure and protecting the customer landscape, specifically from an email and attachment point of view, in day-to-day operations compared to these solutions.

The available products and instructions are absolutely fine. The only thing is to configure appropriately what features are needed based on requirements. Various capabilities can be configured based on specific needs. Since we have many capabilities available, we only leverage what we need. The only limitations around on-premises deployment remain the same, but there is nothing to call out explicitly.

For on-premises TRAP and other HFT solutions, Windows admins with a Windows background may face challenges. If the instructions can be improved or made more flexible, this could help a lot so that a general IT admin can follow and complete the deployment without a Proofpoint consultant. Currently, without a Proofpoint consultant, you will not be able to successfully deploy the solution.

When you have a good product in place and reduce the number of incidents, the benefits become apparent. We were receiving spam that is now reduced because users do not get such spam. Mail delivery-related issues are also reduced once appropriate configuration is in place. This is a key differentiator from an operational point of view and ensures that only genuine emails are delivered, improving email hygiene.

Teams can focus on other areas instead of dealing with 100 incidents per week. If we receive only 60 to 70 incidents, that 30 incidents of time is saved for the operations team who can add more value in other areas where there are critical gaps. This has helped improve efficiency by reducing the time required from email analysts or SOC analysts.

We reach out to Proofpoint directly as partners to help customers adapt to Proofpoint and drive enablement. We work with Proofpoint directly as well as with some partners and consultants to ensure adoption is successful from an upskilling and upselling point of view, including purchasing Proofpoint licenses or helping with user adoption. We predominantly work with Proofpoint partners.

From Microsoft 365, we have M365 Exchange Online solutions and on-premises solutions, and some customers are on Google Workspace. Proofpoint efficiently handles all these workloads including Microsoft and Google mail solutions.

Proofpoint is one of the premium products with inbuilt AI and ML capabilities and has significant presence across the globe to help incorporate and adapt to large organizations, especially financial and government organizations. Proofpoint is the choice for such large organizations and can deliver customer expectations efficiently with all the proven data. By default, all filters are updated across all instances. For example, if someone reports a malware, it will not be delivered to any other organizations. This is a very efficient feature.

With existing capabilities and upcoming advancements specifically using AI for security and agents, Proofpoint will be the choice for organizations in the new age. The security landscape is critical for any organization, and Proofpoint will be the choice of product for enterprises.

I have been working in this field for the last 18 years. Cloud deployments are absolutely fine since you do not have to deal with all the infrastructure configuration, deployment, and setup. Cloud is comparatively easier and more efficient as well.

I would rate this product an overall eight out of ten.

I am managing the entire Proofpoint Email Protection Email Security applications for one of the largest healthcare industries. The organization uses this tool to protect their entire infrastructure based on email security. Proofpoint Email Protection is one of the leading tools for email security protection, utilizing advanced AI-driven and machine learning technology to review all emails.

Proofpoint Email Protection performs very deep investigation on all incoming emails. It scans through multiple Proofpoint cloud applications such as TAP, TRAP, Email Fraud Defense, a customer support portal, and Proofpoint Security Awareness tool, supporting six to seven applications total. All these applications are cooperated and cloud-native, working together to determine whether an email is actually malicious or not. It is very easy to perform sandboxing of the incoming email, conduct investigations, and run checks on multiple sender intelligence and email firewall rules to easily identify incoming emails. Based on the decision, emails can be allowed, sent, or quarantined at the gateway level.

Proofpoint Email Protection can easily integrate with Office 365 cloud application and should be easy to integrate with Exchange on-prem as well, with both working simultaneously. User sync is easy, SSO configuration is straightforward, and managing all incoming domains on the Proofpoint cluster is simple. Most organizations are moving forward with Proofpoint Email Protection because of these capabilities as it is one solution for many problems.

We generally use this service directly from the vendor. We discuss the requirement and enterprise level design, considering how large, small, or medium the organization is. Based on that assessment, any customer decides whether to go ahead with licensing all features or limited functionality. For big or broader organizations, Proofpoint Email Protection is really helpful because they can utilize all applications for protecting emails. However, for low-size or mid-level organizations, it can be challenging in terms of cost, management, and resource utilization, which could be a problem for low-level enterprises.

Proofpoint Email Protection performs very deep investigation on all incoming emails. It scans through multiple Proofpoint cloud applications such as TAP, TRAP, Email Fraud Defense, a customer support portal, and Proofpoint Security Awareness tool, supporting six to seven applications total. All these applications are cooperated and cloud-native, working together to determine whether an email is actually malicious or not. It is very easy to perform sandboxing of the incoming email, conduct investigations, and run checks on multiple sender intelligence and email firewall rules to easily identify incoming emails. Based on the decision, emails can be allowed, sent, or quarantined at the gateway level.

Proofpoint Email Protection can easily integrate with Office 365 cloud application and should be easy to integrate with Exchange on-prem as well, with both working simultaneously. User sync is easy, SSO configuration is straightforward, and managing all incoming domains on the Proofpoint cluster is simple. Most organizations are moving forward with Proofpoint Email Protection because of these capabilities as it is one solution for many problems.

There are many things that could be improved, but once you are very well-known about this application, you could perform that improvement plan. There are many scenarios where I have worked with Proofpoint Email Protection where a requirement was not fulfilled due to the limitation of the product.

For example, we have Report Phish automation. With Proofpoint Email Protection, we can configure Report Phish and forward the email to any email addresses or shared mailboxes that we provide in the configuration. That email is forwarded as is with whatever the user reports as a phishing email. However, some organizations do not want the reported phishing email to go as is into their ticketing tool because it might contain malicious attachments and malicious links that are not required to go into their internal organization. Proofpoint Email Protection has that limitation. They cannot forward or restrict, but could forward only limited information such as some header information, sender subject details, or only limited information. As it is, the email can be forwarded, not as limited information.

Proofpoint TRAP solution also has limitations. It cannot create alert notifications for some specific requirements because Proofpoint works the way it is designed, and if you want it to work based on our requirement, that should not be possible. There is a scope of limitations here.

There are many improvements that should be made. First, they should work on their false positive minimization. Proofpoint generally takes all emails, investigates them, and classifies them. There are many situations where legit emails are blocked because that domain is found to be under a malicious category somehow, but actually it is not. False positive minimization could be improved, and they could enhance their other applications or solutions. There are many things that they could improve from each application and each portal.

I have been working with Proofpoint Email Protection for a total of eight years.

There are no performance issues. Performance issues only happen when there is a break-fix situation. For example, if TRAP is not connected with Exchange Online or Exchange on-prem server, there is a problem for the company because if the solution is not connected, it will not work. There is a feature where we can enable the auto-alerting system. We can easily create or configure alerts whenever any node is down, and it can send an alert to a monitored mailbox where anyone can take a look at that priority. Everything looks good and there are no performance issues.

We generally use this service directly from the vendor. We discuss the requirement and enterprise level design, considering how big, small, or medium level the organization is. Based on that assessment, any customer decides whether to go ahead with licensing all features or limited functionality. For big or broader organizations, Proofpoint Email Protection is really helpful because they can utilize all applications for protecting emails. However, for low-size or mid-level organizations, it can be challenging in terms of cost, management, and resource utilization, which could be a problem for low-level enterprises.

Proofpoint customer service is excellent, deserving a 10 out of 10 rating. They are very supportive. I work with four or five calls every day with the Proofpoint vendor support whenever any issue occurs. Any break-fix issue can be categorized into P1, P2, P3, or P4 levels. Based on the criticality and priority, we raise a ticket. Support can be obtained within 24 hours, 6 hours, or 4 hours depending on the severity. The response is very quick and their support is very good. Additionally, professional services are available whenever deployment is needed, whenever additional features or licensing are required, or whenever professional support is requested. Sometimes it requires some cost, and sometimes it is part of your license. It is easy to obtain professional support help as well.

Positive

I have worked with FireEye EMPS, which is the FireEye Email Protection system, and I have also worked with Cisco IronPort and Microsoft Defender for Office 365. Proofpoint Email Protection is superior to other third-party applications such as Cisco IronPort or FireEye. It is really very comfortable to use, easy to operate, easy to manage, easy to take actions, easy to deploy, and easy to migrate.

Most importantly, the data center location is very important. Some organizations in the UAE and Gulf countries do not want their data to go outside of the UAE location and are very concerned about creating a data center within their location. Most other third-party applications do not generally support that feature. However, Proofpoint is globally capturing the market and now has data centers in all nearby locations such as the US, UAE, Europe, and the Asia-Pacific region. This is really good for customers who want to retain their data.

Proofpoint Email Protection deployment is very straightforward. When you get the license and have all discussions with Proofpoint about your requirements, they will easily provide the configuration for a dedicated cluster for your organization. They will send an initial advisory email from the sales team from the US containing all details about the MX record for all domains and the predefined cluster configurations that will have all basic email firewall rules and basic cluster configurations.

Once you take the services, they will schedule a call and go through migration or deployment. They will go through the step-by-step process of each email protection system health. They will perform configuration, onboard new domains within the portal and within Proofpoint cluster, perform checks, and update DNS records for all those domains. At the DNS level, they will verify, test, generate DKIM keys, and update SPF records. Once everything is aligned, they will test inbound email and send inbound emails. It is a very easy step-by-step process and they will definitely assist. I have done the migration for Proofpoint multiple projects in the past and understand it is not very challenging when you have support from the vendor.

We generally use this service directly from the vendor.

I am currently working with Proofpoint Email Protection as well.

Proofpoint Email Protection is basically a cloud-based application. Proofpoint Email Protection has Proofpoint POD, which is Proofpoint On-Demand. We also have TAP, Targeted Attack Protection, and Threat Response Auto-Pull. Of all these applications, POD and TAP are cloud-based, and Email Fraud Defense is as well. All of these are cloud-based solutions with no on-prem situation. Proofpoint TRAP, which is Threat Response Auto-Pull, is on-prem and can be installed on the Linux server. This is the only solution which is hosted on-prem, but the vendor has now also migrated to CTR, which is called Cloud Threat Response platform. Rather than going for the on-prem TRAP solution, vendors are suggesting migration to Cloud Threat Response, which is very easy to handle, make decisions, perform automated analysis of reported phishing emails, and is very easy to understand with a very good GUI platform that any analyst can easily work on the incident created on the TRAP solution. Every solution is now migrated to Proofpoint cloud application.

Proofpoint Email Protection can easily be integrated with Azure. Whatever users are created on the Azure, Proofpoint POD has a sync-up policy which can fetch the tenant information, client information, and the client key. Based on all those details, it can easily connect to the Azure platform and perform all required actions such as Azure SSO and Azure user sync policies. AWS is not frequently used for Proofpoint Email Protection application.

There is a quick example to illustrate this. If there is a phishing campaign deployed to 100 users, some users might have clicked on the phishing link and some might access the URL and get compromised. Proofpoint Email Protection protects the work effort from the SOC team by working in the backend. Whenever any malicious email is identified, Proofpoint performs the sandbox analysis on the backend. Whenever any signature gets updated or this email was determined to be malicious when it was delivered, it automatically gets quarantined from the TRAP solution. This protects the risk and saves efforts from the SOC analyst to manually investigate that email, quarantine it, and take action. Proofpoint can give visibility and automatically delete that email. It can identify out of 100 users who all have only clicked on that link. This saves time from an investigation point of view and minimizes efforts for the SOC. Even if there is no resource or the SOC resource has not taken a look at that phishing campaign, TRAP can work in the backend and save the organization from the threats.

Proofpoint TRAP is giving visibility about this threat landscape. We have the feature to upload the VAP, which is called Very Attacked People. There is another option to upload that executive list. Whenever that person is being targeted, it could have the flag of high risk or very important people. This can give visibility by looking at the asterisk sign near the user. Any analyst working on the ticket could easily understand that this is high priority, an executive has clicked on the link, or an executive has received that phishing email. This could give visibility to further investigate on the priority and basically lets us decide what is important and how we can work.

Proofpoint Email Protection is all about the licensing. If the organization requires a broader picture of email security protection and wants to take all services from Proofpoint Email Protection, they could take the licenses for all its applications. If they want to integrate Proofpoint Email Protection with their SIEM solution, they would obviously require Proofpoint API keys for that. For that, it is again a license-based requirement, and a license comes with an additional cost. If the organization is big, you could go ahead with all licenses, take all features, enable all services, take the professional services as well for the deployment, and it will help in thinking in the direction of cost as well as the service agreement.

Proofpoint Email Protection is very smooth in terms of the operational point of view. It is very easy to operate, easy to manage, and easy to handle threats. It is a great tool. The reason is that you do not need to investigate any bad thing that happens within your organization as it can create an alert. For email, the only concern is when the user clicks on a malicious link. Whenever a user clicks on this malicious link, it can trigger an alert for that. Once the alert is triggered, any analyst can investigate that. There is very good operational efficiency.

Security posture includes Email Fraud Defense, which gives insight of all security information and security-related issues. For example, if someone is trying to spoof your domain or trying to send an email on behalf of your domain, the application can give an idea or view of who is utilizing your domain. You could easily go and check into that and easily identify whether that email is legitimate or not. If that email is not legitimate, you could directly go and block that sender into your gateway. Additionally, by looking into all email DMARC posture reports, you could utilize that report to put your domains into the DMARC. If your domain is not protected with the DMARC reject policy, you could easily review all those emails, identify which one is legitimate and which one is not, break it down, and easily put your domain into the reject policy and save your emails from getting bounced back with legitimate emails not getting bounced back.

Proofpoint Email Protection has the capability to address zero-day attacks. If there is a zero-day attack or an active campaign which is going on with IOCs related to a ransomware attack that was deployed through email, Proofpoint has that capability to easily identify the active threats or emerging threats. The best part to address this issue regarding emerging threats is that you could easily integrate your Proofpoint TAP application with different other third-party applications such as Palo Alto WildFire or CrowdStrike. Through API, you could easily connect with those solutions. Whenever the email arrives into the POD console, it sends one copy of that email to Proofpoint WildFire or CrowdStrike for further investigation. If that email or that threat is already flagged as an emerging threat within that global Palo Alto WildFire category (because most organizations are using Palo Alto solutions with signatures being updated every day and millions of signatures being identified and updated under the emerging threat category), since Proofpoint TAP is easily synced with this WildFire solution or CrowdStrike, it can protect from emerging threats very easily or quickly.

Whenever any new user is getting the service from Proofpoint Email Protection, they should have a very detailed discussion about what services within that license will be provided. The reason for saying this is that once you take the service and then come up with "I need to integrate the solution with our SIEM solution," you reach out to your Proofpoint account manager and they will say "we can do that, but there is an additional license for that which does not come with the basic license." In that case, there might be challenges or risks for the organization if it is a low level or not a very big organization or big revenue-generating company. For that reason, you should have an understanding of what Proofpoint Email Protection applications and tools they have first. What services they provide through each application and whether it is required for your business or not. What specific service do you want to incorporate into your organization? Whether you want to educate your users (that comes with Proofpoint Security Awareness platform tool), you could easily educate your users and send a simulated phishing email or campaigns to all users, and track how many users clicked on the link and how many reported. They have all the services. Now you need to decide what your requirement is. Based on the requirement, you need to discuss with your account manager, and they will come up with the solution and provide the licensing requirement, cost requirement, and how much time they would require for deployment. My overall rating for Proofpoint Email Protection is 9 out of 10.

We are currently planning to purchase Proofpoint Email Protection further for TRAP and endpoint security, as we already have TAP implemented.

In my company, I primarily use Proofpoint Email Protection for advanced protection against today's threats. This includes email filtering for malicious content, email encryption, threat protection, and filtering out spam and phishing emails. Additionally, I conduct security simulations for employees and sometimes conduct IT security training.

The best features of Proofpoint Email Protection are the advanced level of anti-spam and antivirus technology. It has the TAP feature, which is Targeted Attack Protection, that helps me scan URLs and provides URL defense. The solution also has outbound filtering and prevention capabilities. I particularly like the TRAP feature where I can pull out all phishing emails from all users' mailboxes in a single click. The level of security is good, though I feel the pricing could be reduced.

Proofpoint Email Protection automates URL prediction, defense, prevention, and outbound filtering. This means I do not have to manually check who all my risky users are or what kind of emails my users are receiving every day. I do not have to manually check what specific kinds of emails my top management level users are receiving or whether they are receiving phishing emails. The solution takes care of risky sign-in users and performs URL filtering so I do not have to manually do URL filtering myself from separate websites.

My organization is a big organization with 1,300 plus users. To take care of all these users requires a good product because there are so many emails in one day that need to be filtered before they reach the user. I have visibility of the dashboard where I can see how many actual emails there are, how many emails are whitelisted, and how many emails are blacklisted. The solution provides a graphical representation and dashboard view showing how many threats are getting blocked on a daily and monthly basis, allowing me to present this information to management and discuss it with users.

I feel Proofpoint Email Protection is overpriced. I cannot say that the security level being provided does not justify the cost, but when comparing the similar level of security with other applications or security systems, it is overpriced. If Proofpoint could provide offers or discounts for customers who are already using the product or for new customers implementing it, along with some free services or add-ons, that would be helpful in terms of financial expense.

Proofpoint Email Protection has recently introduced AI functionality in terms of data security capabilities and protecting AI assistance from targeted attacks. This is important since everything is now related to AI. The solution is doing threat detection and real-time threat detection and response pretty well.

There are a few things I would like to see improved. Sometimes Proofpoint Email Protection takes time to analyze the workflow and the nature of the email. In this age of AI, the solution should analyze an email on the first receipt and determine whether it should pass or be marked as spam without checking previous data. Another improvement would be to have a more user-friendly dashboard. Additionally, if Proofpoint could add the same features in BCP as part of email protection in BCP, it would be helpful since I currently have to take a different add-on for BCP, and integrating it would save costs.

I cannot say that threats have increased or decreased with Proofpoint Email Protection because it depends on the mail flow. The solution captures and filters out all threats, and the email threats vary every day depending on how many users are receiving how many emails per day. Today there might be 1,000 emails, tomorrow 5,000, and the day after 500. Proofpoint Email Protection does its job by scanning all emails and threats are reduced to some extent. Since I am aware that virus definitions are updated every day, I cannot blame Proofpoint Email Protection if they take time to determine the nature of an email being received. There are sometimes emails that are false positives, and Proofpoint Email Protection is a bit strict in analyzing false positives, sometimes stopping emails that are actually required. It analyzes the previous nature of an email and if a template looks like an informational template or related to spam, it blocks it because it looks similar to one blocked earlier. However, the template might actually be required. If I receive the same template today that is also blocked by Proofpoint Email Protection, that particular template might be useful and should not be blocked. In such cases, I have to raise it as a false positive stating that this is something in use or my users use and should be released. When AI starts doing its work, it analyzes the email from a sender with a particular template and releases it, but if the same email and template come from another sender, it blocks it according to the policies.

I have been using Proofpoint Email Protection for more than two years.

Proofpoint Email Protection is a cloud-based SaaS solution.

My organization is a big organization with 1,300 plus users. To take care of all these users requires a good product because there are so many emails in one day that need to be filtered before they reach the user. I have visibility of the dashboard where I can see how many actual emails there are, how many emails are whitelisted, and how many emails are blacklisted. The solution provides a graphical representation and dashboard view showing how many threats are getting blocked on a daily and monthly basis, which allows me to present this information to management and discuss it with users.

The customer service team is average. I would not say they are too experienced, nor would I say they are only first level support, but they are average. Sometimes we have to tell them what we wanted versus what we received. The technical support is average, and contact-wise, sometimes we have to wait for them to get on a call or chat. However, they do get on the chat or call and try to fix the issue, and they manage to get the issue fixed most of the time.

Neutral

Microsoft Defender was not protecting my organization thoroughly because so many emails that are spam or phishing were getting released. Even if those emails are spam or phishing, Microsoft sometimes releases those emails maybe based on previous emails or something. That is one reason why I implemented another security layer on top of Defender. Another thing is that Microsoft has many options readily available, but there is still manual work required when it comes to automated threats or advanced level of threat protection. Admins have to approve false positives or approve phishing emails or release phishing emails or block phishing emails that have been delivered to multiple users. For these reasons, we decided to switch from Microsoft Defender.

When we did the POC for Proofpoint Email Protection, they took a little bit of time to create the connectors so they could analyze all emails. It hardly took a few minutes. However, implementing the entire process and guiding us on how to do all these things at our end required a little bit more training. After you start working on any platform, you automatically get to know things, but it would have been better if all these things were trained in advance to the IT SOC engineer or to me or to someone taking care of IT security. More hands-on training would have been beneficial before actual implementation because after implementation, we had to explore so many options that we came to know about later.

It is sometimes the case when there are false positives that are too restrictive, and I have to get back to Proofpoint Email Protection stating that something should not be blocked or should not be released. Then they start working and analyzing things, and sometimes those things take time. Overall, it is okay. Because the email has to go through my Defender and through Proofpoint Email Protection before reaching the user, it sometimes delays a little bit. Apart from that, it is acceptable.

In terms of pricing with Proofpoint Email Protection, if the budget of the company is big or larger, they should go with Proofpoint Email Protection. Otherwise, they can explore other options. There are many options available that are much cheaper than Proofpoint Email Protection, but if it is a big company, they should have security like Proofpoint Email Protection if it is being provided at a good cost. My recommendation to other companies is that they should always check the pricing to see if it actually justifies the features they are having and whether they truly require those features. They should not implement Proofpoint Email Protection just to see later if a particular feature is of use. If it is of no use, they are simply paying additional cost which they may not require in the future.

We did evaluate two to three more solutions.

The pros of Proofpoint Email Protection were the advanced level of security. Additionally, it takes care of risky sign-in users to the extent where it checks the nature of emails that risky users are receiving every day. I can go to that particular option and see only those risky users, maybe 15, 20, 30, or 40 users who are receiving this kind of emails every day. In other solutions, I could not find this particular option where it analyzes the email pattern of risky users. The second thing is that because the level of security is advanced and I see that Proofpoint Email Protection is partnered with many big companies, I thought to go with this one. I also want to see how they will integrate with AI in the future. I did the POC for other few security options, but I again could not find that so many emails were getting blocked even if those things should have been blocked. Still, those were getting released, similar to what Microsoft Defender was doing earlier. So I still have to do manual work to tell them that something is a phishing email and should have been blocked, but why it was not blocked at the first point.

Sometimes Proofpoint Email Protection takes time to analyze the workflow and the nature of the email. In this age of AI, the solution should analyze an email on the first receipt and determine whether it should pass or be marked as spam.

I cannot say that threats have increased or decreased with Proofpoint Email Protection because it depends on the mail flow. The solution captures and filters out all threats, and the email threats vary every day depending on how many users are receiving how many emails per day. Today there might be 1,000 emails, tomorrow 5,000, and the day after 500. Proofpoint Email Protection does its job by scanning all emails and threats are reduced to some extent. Since I am aware that virus definitions are updated every day, I cannot blame Proofpoint Email Protection if they take time to determine the nature of an email being received. There are sometimes emails that are false positives, and Proofpoint Email Protection is a bit strict in analyzing false positives, sometimes stopping emails that are actually required. It analyzes the previous nature of an email and if a template looks like an informational template or related to spam, it blocks it because it looks similar to one blocked earlier. However, the template might actually be required. If I receive the same template today that is also blocked by Proofpoint Email Protection, that particular template might be useful and should not be blocked. In such cases, I have to raise it as a false positive stating that this is something in use or my users use and should be released. When AI starts doing its work, it analyzes the email from a sender with a particular template and releases it, but if the same email and template come from another sender, it blocks it according to the policies.

We did evaluate two to three more solutions. I would give this product an overall review rating of 8.

I pretty much summarize and cover everything about my main use case or how I use Proofpoint Email Protection.

If I look at the statistics of our daily inbound email, I can gladly say that one of the best features Proofpoint Email Protection offers is that approximately 60 to 65% of the emails that are being targeted to my organization are being blocked. All of the spam, the junk, the bulk, the low reputation, the unwanted emails, and those that have bad intention with viruses are all stopped at the gate. I think this is one of the best use cases that I can call out with Proofpoint Email Protection. The subsequent best use case would be Clear and TRAP, which helps to reduce the time we spend on investigating every email that gets reported from the end user. Lastly, TAP ATO gives us a bit of peace of mind to monitor logins and tell us when there is a suspicious login that we should be aware of.

Before, what would happen in the past is every single email that gets reported, we would have to reply and triage those emails individually. I would look at the email and then have to reply to the reporter and tell them whether this is good or bad, and why. The entire process was manual. With TRAP and Clear working hand in hand together, I have automated analysis. If there is a manual review required, we have pre-configured workflows on Proofpoint Email Protection. All we have to do is trigger the workflow based on what we feel the classification of the reported email is. The percentage is still not up to par. We were expecting more automated classification or automated dispositions from Proofpoint Email Protection. Nevertheless, the good thing is we are not triaging every single email individually and not typing out the reply individually as well. That is a good feature to call out, but I would expect a little more enhancement from Proofpoint Email Protection in the future.

We have seen a reduction in phishing incidents with Proofpoint Email Protection, but not fully. It is not 100%. There are still cracks within the walls of Proofpoint Email Protection that let this type of email in for various reasons. Either the content is sitting behind a password protected page or document. We do see a reduction. I unfortunately cannot put a statistic to it yet, but there is reduction, and this could even be a little better.

We use Proofpoint Email Protection for their email security, which is POD. We use their TAP, TRAP, Clear, and we use the TAP ATO.

Proofpoint Email Protection is to keep the bad emails out of the gate. TRAP is to help me analyze user-reported emails to make sure that there is automation behind user-reported emails to reduce manual intervention. Clear does the same thing as well. Clear and TRAP work hand in hand. Then you have TAP ATO that actually monitors suspicious login and suspicious activity that's happening in our environment and alerts us when there is something wrong. Lastly, TAP is to give us the threat that is targeted to our industry.

Proofpoint Email Protection has impacted us by keeping the bad emails and the unwanted emails out. If you are the end user, I am sure you do not want to see a lot of spammy, graymail, cluttering your inbox and then you actually miss the most important email that you are actually supposed to be interacting with. When those bad emails are kept out of the gate, and the user can just focus on the email that matters most to them, I think that is how much Proofpoint Email Protection is impacting the entire organization.

Proofpoint Email Protection provides very attacked individuals visibility into people-based risk within our organization, where we can see all those very attacked individuals in the organization. That is a list that gives us visibility into who will need additional protection from a policy perspective or from a hardening perspective so that we really protect them. The risk score you get from that is very helpful to the organization.

A few things about how Proofpoint Email Protection can be improved include implementing artificial intelligence within their platform to start really understanding the organization that is using their product, what sort of emails they are expecting and if the emails that are being expected should be let in and if the emails that are not being expected should not be let in. I'll give you a further example for this. If someone just tries to send an email from a Gmail address, which is a free public service email service provider, then because anyone in the world can create a Gmail account, I think it is nice and good for Proofpoint Email Protection to actually first check and do a reality check if we have received an email from this address and look at the intent of the email to really see what the email is trying to do and then classify based on that. I still see there is a lack. Hence why I started this conversation with AI and hoping that Proofpoint Email Protection will bring AI in and to really start analyzing these emails, the intent, and whether they really fit the customer organization. We are a manufacturing company, so whether it really fits that profile.

I would say if we can get a better user experience from Proofpoint Email Protection products, that would be good. For example, other service providers that provide secure email gateway have the functionality where you can split promotional and bulk email and have them sent to a separate folder. I think if we can have that sort of feature, that would be great where Proofpoint Email Protection just keeps the important emails in the inbox folder and move everything else that is not really business related into a promotional, spam, bulk folder. This is an improvement that I would really like to see.

I give it an eight because I am expecting a lot more from Proofpoint Email Protection, more automations, more understanding of who their customer is, what sort of business they do, and what sort of email they are supposed to be receiving and letting through. I think the day when I really have only 1% of work to do and 99% is automated by whatever automation services Proofpoint Email Protection uses would be ideal.

I think I have covered any other improvements needed for Proofpoint Email Protection pretty well right from AI to splitting emails based on priorities. I think I have given some pretty broad and good examples.

Proofpoint Email Protection is quite scalable. You can scale this up to senders, up to recipients, up to domain. You can scale this up to keywords within. You can scale this up to attachments, up to the extension of the attachment. It is pretty scalable if you know how to scale it.

I would rate customer support an eight for Proofpoint Email Protection. There are some days where their support is pretty quick, pretty fast and decent, and there are some days where it takes days for their support to get back to us. But those are very, very rare situations, so hence why eight out of 10, which is pretty good and decent, but I think there is room for improvement.

I would rate the customer support for Proofpoint Email Protection an eight on a scale of one to 10.

Positive

We previously used Cisco IronPort, or it is called CES, Cisco Email Security. The reason for us to switch is due to how many false negatives that we have with Cisco IronPort. That is the first thing. The second thing is we have no visibility in what sort of emails that are coming in and action to be taken on the email that used to come in. When we used to use Cisco IronPort, Cisco IronPort was just filtering these emails, but if we need to triage, then we are using a completely different platform to triage these emails, which is Microsoft Security Portal themselves. Two different solutions, lack of automations, lack of visibility, that is the reason why we switched to Proofpoint Email Protection.

Unfortunately, I was not involved in the pricing and the setup costs for Proofpoint Email Protection. It was done by the procurement team. But to set up Proofpoint Email Protection itself, it was pretty straightforward.

The return on investment for Proofpoint Email Protection is going to go back to the same data I gave at the start. We have fewer emails that need to be triaged now. We take much, much lesser time to triage. For example, if it takes five minutes to triage one email in the past, we are taking one minute at this present moment. There is a four-minute save to triage a single email. Proofpoint Email Protection has browser isolation. Whenever an email gets reported, instead of taking the data out of the reported email to a sandbox, you now can use Proofpoint Email Protection isolation to triage that email. If it is a URL-based threat, then you can get an understanding or an idea of what the URL is trying to do. If I want to give you a quick metric from five minutes to a four minute saving time that we can see right now, which is huge for us.

We evaluated other options before choosing Proofpoint Email Protection and found it to be very stable.

Proofpoint Email Protection provides an overall scope and range of threat protection capabilities in addressing modern security challenges that I would assess as a nine on a scale of one to 10.

We do utilize messaging security for protection across cloud apps and file-sharing services with Proofpoint Email Protection TAP ATO that is integrated with our single sign-on service provider which is Okta, and integrated with our messaging platform which is Office 365. Since the three talk to each other, Okta, Office 365, and Proofpoint Email Protection, I think it has really helped us to understand what is going on within the organization. I will give an example. Threat, primarily delivered through email, is seen by Proofpoint Email Protection, and that information is taken with the sign-in information and plugged both of the informations together to give a complete picture on what is happening. Office 365 sees a suspicious sign-in and when you add both of them together, you can then get a complete picture.

I would summarize my advice for others looking into using Proofpoint Email Protection by saying that it is a good tool. You will get a lot out of what you are signing up for. Hopefully, Proofpoint Email Protection is going to bring more new features in because if you compare Proofpoint Email Protection, it has been in the market for over 10 years and then the new companies that are coming up right now are doing things differently which is a little more modern compared to Proofpoint Email Protection. But having said all of that, Proofpoint Email Protection is still a top leader in email security gateway. But I am just hoping that Proofpoint Email Protection would pick some features that these new companies are bringing in and make Proofpoint Email Protection even a greater product.

I do not have any additional thoughts about Proofpoint Email Protection before we wrap up. I want to say it is a great tool. Nevertheless, there is still room for improvement, but I look forward to the future innovation from Proofpoint Email Protection research and development team for more creative features. I rate Proofpoint Email Protection an eight overall.

I initially brought Proofpoint Email Protection in to stop spam back in the early days when it was mostly just an annoying thing. As the threat landscape expanded to include malware and phishing campaigns, I rode along with their expanded services for those. It covers basically anything email protection related that is used by bad actors as initial access brokers. They have also expanded their services to include URL protection and sandboxing of attachments.

They have expanded their areas in the back end like threat response, pulling emails out that are bad, and giving our security operations centers more insights into what is going on in the email. They have expanded from their initial footprint of email into a broader space for cybersecurity.

Currently, I have Proofpoint Email Protection deployed primarily in the cloud with POD, Proofpoint on Demand. Most organizations where I have been working have it in their POD on Demand, which is a cloud service. They also have other services related to that which are in various places such as AWS. They do not hide the fact that these are cloud and SaaS services, but that is where most of this work is done.

In my organization, the approximate number of users using Proofpoint Email Protection includes 300,000 users from one major organization I retired from, and now I am working with another organization that has about 4,000 users.

Overall, the best features of Proofpoint Email Protection in my opinion are that their systems worked and they owned their mess-ups. I had some early issues early on in the relationship, and they said that the problem was theirs and they did things to fix it. I measure a vendor by how they deal with meeting their promises and getting things done as they said they would, and when things mess up, whether they own it and take care of it. They did both of those things.

Feature-wise, what I appreciate most about Proofpoint Email Protection is that their bread and butter is their email security gateway. That provides top-level, best of breed protections for email services. Then they provide a set of support suites around that to support implementation of security postures.

Proofpoint Email Protection is improving on the level of visibility it provides when it comes to people-based risk within my organization. They have a tool that identifies the most attacked people, called VAPs. It helps me understand who in the organization is being attacked most. They also allow me to identify people who are VIPs, so I can provide reporting on what is happening to them. In general, their visibility is very good on what happened to a message, what was processed, and what was delivered. I can see the characteristics of that message, the recipients, and the senders. This gives me great visibility into the email flow.

The areas that have room for improvement in Proofpoint Email Protection include their cost of ownership, which is fairly high. To manage and run all their products, I have to list and manage administrators in seven or eight different places. That is too many places to keep track of since for this tool I have to go to one location, and for another tool I have to go to a different location. They need to simplify the administration management of administrators and consolidate that into one place for all their products. Access to all the different products is very scattered. For some products I go to one URL, and for different products I go to a different URL. They have a threat URL that has most of their products in it, but not all. They need to simplify the interface to show all the products I have access to in one location.

I have been using Proofpoint Email Protection for over 20 years.

When evaluating the stability of Proofpoint Email Protection in regards to downtime, bugs, and glitches, it comes and goes in waves. Their move to the cloud has had some issues, so I would rate them an 8.

Proofpoint Email Protection is a scalable solution that very much fits our capacity requirements. I would rate them a 9 or 10 on that, definitely.

I would rate the vendor support for Proofpoint Email Protection as not consistent. Sometimes their support is really good and sometimes their support is questionable and not so good. I would say it is between 8 and 9 for the most part. Sometimes I get some really great responses and analysts, but sometimes when their cloud services have a failure, they are slow to respond and tell me about it, though they have been improving. The RCAs are kind of nothing that says here is the thing and here is what we are going to do to correct it. In that regard, it is only about a 7 or 8. So it varies, but when I call the help desk, I may not be a good example because I know more about their systems than their level one support person. When I get a level one support person and their answer does not make sense, I can call them out on it. But somebody who does not work with the systems may not know that. I would say typically for the most part, it is around 8 to 9-ish. If I had to decide on a solid number for the vendor support, I would say it is 8.5.

Positive

I have not done any active comparisons of Proofpoint Email Protection with other vendors or products on the market. I have looked at the Gartner reports and the Forrester reports to see how things rate. I recently helped migrate a system from a company that was using Mimecast to Proofpoint, and the services available with Proofpoint looked to be far and away more services available with better insights than Mimecast seems to have. Mimecast has not kept up pace.

Feature-wise, what I appreciate most about Proofpoint Email Protection is that their bread and butter is their email security gateway. That provides top-level, best of breed protections for email services. Then they provide a set of support suites around that to support implementation of security postures.

Proofpoint Email Protection can either require me to manage upgrades and control them where I can say I am going to want this upgrade to go through my non-prod systems first and I can test it, or I can trust the vendor and let them do the patching and upgrades. I have worked with one organization that went that route, while another said they did not have the time to deal with this. This is not a burden-free service. It is very complex and provides lots of different capabilities. As such, I am constantly tuning, adjusting, and making use of those capabilities. I am constantly working with the product set.

I am not a SOC analyst, so I cannot answer directly to how Proofpoint Email Protection has impacted SOC analysts' workloads. But I know that they very much appreciate their Targeted Attack Protection, the TAP dashboard, which provides insights into what happens with URLs clicked in emails. Some of their other services allow them to pull messages out because they deem them to be bad. Proofpoint has provided some critical tools for their use in the email space and the URL space.

Proofpoint Email Protection has provided top shelf email protection services and has prevented breaches and loss of data. How do I measure that when it has not happened because it has been effective? It is expensive and does take manpower to operate and manage it. There is that side, but it gets the job done.

When I first brought in Proofpoint Email Protection, I was trying to do things myself because there were no vendors. I had an RFI and RFP and three vendors showed up, and they were the only one that worked. The problem is too broad to do in-house. This is one of those things that cannot be done oneself. It is just too hard. If I am in a large organization with a security operations center and a risk organization that is managing the risk for the organization, Proofpoint is a great fit. If I am a small company of 50, 100 people, or even 1,000 people, it may be too big of a fish to swallow and control. I may want to go with something a little less or more packaged like what Microsoft is offering. It is geared more in my mind towards larger organizations that have a threat organization that can help manage and guide it.

The quantity of threats that Proofpoint Email Protection helps my organization protect against has gone up because bad actors are doing more and changing their tactics. In the mid-2000s, it was strictly volume, how much data can they throw at gateways to overwhelm them. Now the volumes have come down some, and it is more about how tricky they can be. It is a lot of social engineering and phishing, and they have gone to that approach. Proofpoint has adapted as the threat landscape has changed. Now I know that my organizations have not been breached, although there have been some cases of major impact. People are still the last line of defense. I can use technology to block out a lot of junk coming in, but if someone is not careful and clicks on something that got through that they should not have clicked on, it is still going to cause damage. Nothing is perfect 100 percent, but Proofpoint does a very good job of reducing the number of threats that get into end users. They also have a philosophy that says they know they are not going to stop everything upfront. They have provided tools to help me see things that got through that I now know are bad, so I can pull those out. Or they know that a URL came in and when they first saw it, that URL was okay, but now they are seeing that URL is not okay, and they are going to block it. They have a philosophy that says they are going to stop as much as possible upfront. And if things get through, which they know will because nobody is perfect, they are going to help me identify that and take corrective actions.

My advice to others looking into Proofpoint Email Protection is that if they are a large organization serious about cybersecurity, they definitely want to consider it and its broad set of services they can provide. They seem to be very good at doing the blocking and very good at visibility into what is going on and what happened. I would rate this product overall a 9.

I use Proofpoint Email Protection as a standard solution that offers email protection primarily to block phishing and check for malware that might be contained within emails or other suspicious content, which is clarified and categorized. Suspicious content inside the emails does not necessarily have to be attachments but can include links that have been fired in a sandbox. There has been protection in the background about spoofing and some spoofed domains. Mostly, we have not directly used the authentication because it is a recent addition. We are using a different vendor now, but we have been preparing for DMARC, DKIM, SPF, and such cases. No AI analysis has been implemented; primarily, we are handling the email protection itself.

I like the user-friendly interface about Proofpoint Email Protection the most; in both the user view and the administrator view, they are doing great. It is easy to navigate and find the areas where you are heading. From the administrator perspective, there is another benefit because complex data tied with functions are organized well. If you are looking for something on the phishing part, they are quite quick in analyzing the data, and it is based on internal policies that allow quick analysis of many emails. From a user perspective, it is easy to access, for example, how interactive it is while working with the anti-spam filter, where users can go into their Proofpoint Email Protection mailbox to manage trusted and untrusted senders and domains easily without additional login steps. It has been comprehensive and easy to use for both users and administrators.

The level of visibility Proofpoint Email Protection provides into people-based risk within our company shows how we are protecting our employees and company from incoming emails. It is complex because our employees share their contacts, and when we educate them to not use their email addresses anywhere, we gauge our effectiveness in this area. The visibility helps us understand how effective our user education is against email spoofing and spam attacks. On the other side, if a computer gets infected, we gather metrics reflecting how our users are impacted by malware spam, which allows us to target education for those users better. The visibility has been based on two factors: incoming emails and outgoing emails that are marked as suspicious, which aids us greatly.

Proofpoint Email Protection has primarily impacted my SOC analyst workloads by focusing on metrics. If I have an administrator view, I get something from the tool itself, while from a management perspective, they would want to see it differently. The metrics we extract from the tool enable us to comprehensively understand how quickly we act and how effective we are in cybersecurity against public threats, as we are protecting the company and our users.

There are a couple of things about Proofpoint Email Protection I do not prefer. We have identified a couple of issues, and in any software product, you always have some troubles that need to be fixed. I would say their support has not been completely correct in handling things as we have expected. As an enterprise, we have high demands on the services, and if we have to wait for something like a week or weeks, it is not acceptable; we need solutions in one or two days sometimes because if there is spam going around, you cannot wait weeks. You have to fix it immediately.

It has been a long time since I have been working with Proofpoint Email Protection; it was more than five years ago, definitely.

I have seen some lagging, crashing, or downtime with Proofpoint Email Protection a couple of times, maybe two or three over its history due to software updates or other reasons. When this happened, I remember it being opened with support to get it fixed quickly; it was a longer time ago, and it was resolved. Software does experience occasional issues.

I find the scalability of Proofpoint Email Protection fine; it has two areas to consider. One is related to their own products, and the other is how you connect with other products. Within their product, they have done their best, but comparing it to others such as SIEM, which is an important aspect in every company, we had some struggles with getting data formatted correctly and automations. We have used APIs, and overall, it has been fine; if I were to rate their scalability from one to ten, I would give it a seven since there is still room for improvement. Comparing to other vendors, Proofpoint Email Protection has been acceptable for us.

The quality of the answers their support provides has been fine; they have responded quite quickly in the past. However, last time, when we were stopping work with them, it felt as though they had switched to some other support. I also noticed this trend with other companies and service products. They have stopped responding quickly and start asking for more details even when they had those details in the initial request or incident, which felt unusual for me. They need to be more concise about what they are asking for regarding troubleshooting. Sometimes when you created a case for them, you got an answer that was not tied to your issue, making me feel as though they were not providing relevant support. It felt as though they were collecting general information just to keep the time and case going; they responded but did not provide any value.

Overall, I would rate their support a six on a scale of one to ten.

I was not directly involved in the initial deployment of Proofpoint Email Protection because it was implemented by another team, but we implemented several functions, and it was fine; with the initial support they provided, I would say no major dramatic issues were identified there.

I am not directly tied to the pricing of Proofpoint Email Protection, but I know they have been more expensive than some concurrent vendors we researched. Given the nice-to-have and must-have parameters, considering support and other factors, we chose the other vendor, as the pricing at that time was quite high for us.

I last used Proofpoint Email Protection in February of 2025. I have been working in my current field with Proofpoint Email Protection for approximately two to three years. I use Proofpoint Email Protection as an email protection service. In my previous company, we used several other email protection services including Viper email security, Mimecast email security, and Zix protection. However, based on my opinion and feedback, I really love Proofpoint Email Protection. Proofpoint Email Protection is intuitive for administrative people and is easier to handle than other services. It is stronger than other services and is easier to configure and apply settings for anti-spam, anti-spoofing, and other tools that the service offers. In my opinion, it was an awesome tool and my favorite to use with the multiple customers that I had in the past.

I have a few favorite features about Proofpoint Email Protection. One of my favorites was the ability to create filters. Under Proofpoint Email Protection, unlike other types of services, an administrator can create global filters or global policies. However, I think that one opportunity area for Proofpoint Email Protection is at the end-user level, where users can create their own policies and settings that will overwrite the global policy and settings. From a security perspective, this can be both an advantage and a gap because if an end-user creates a policy and setting on their end, it will overwrite any policy that the administrator has already set.

My favorite aspects included creating filters and policies to allow or block emails and using country-type lists. For example, if you do not want to allow emails from IPs that are not located in the US or want to block emails from different countries, you have that capability. Another favorite of mine was the anti-spoofing feature. The anti-spoofing settings are powerful because, according to current email rules, every domain needs to have SPF, DKIM, and DMARC configurations or authentications already listed. If a domain is not already verified by these methods, Proofpoint Email Protection will block it or provide a warning to an end-user or administrator stating that the domain is not using the correct SPF or that it is sending from a third-party application but its IPs are not listed in the SPF. As an administrator, this provides better visibility to accomplish requirements with customers. These two features were my favorites.

I already shared one area for improvement regarding the policies that administrators can set as global policies, but end-users can overwrite these. From a security perspective, it would be better if the admin rules and settings could not be overwritten by end-users. End-users can do whatever they want without any permissions if they have the ability to create their own rules. I do not remember if you can set and block end-users from creating their own rules, but if that is the case, it is acceptable.

I think that the market has more intuitive tools with Sandbox and URL Defense capabilities. I remember having multiple tickets and cases from customers where when a link was broken or incorrect, URL Defense would start to apply and completely block the URL. As an end-user, there is no chance to see which the URL was. Everything was encrypted by URL Defense. As an end-user or administrator, you are not able to read the actual link. If Proofpoint Email Protection could provide a tool only for administrators inside the console to try to decrypt the link, I think that would be better.

Regarding their integrations with Office 365, at this point I am not sure because I am not completely using that feature. However, I know that they have some integration with Office 365 with automatic buttons. I think that if they could do this with the Workspace console, that would be awesome as well.

I started using this product in 2022 when I was working in a company called Excel Micro. Excel Micro is a partner for Proofpoint and we provide support in the system for multiple customers. I used Proofpoint Email Protection for almost two years.

The most complicated aspect during my years of using Proofpoint Email Protection was the US4 server. I think that the server for US4 was running low. However, I remembered that the US4 server was planned to migrate some things, so it was difficult to search through the logs or make any changes. Additionally, if some changes were applied, they took more time to propagate.

When something comes up, I think that one of the best improvements would be if Proofpoint Email Protection creates a webpage with live updates for that type of bug or problem. This would be better for us as administrators and also for end-users to understand that we have some problems with Proofpoint Email Protection. I know that Proofpoint Email Protection did provide this at one point, but it takes some time until we start to raise tickets and then they say that they have some problems or issues under this server. Just leaving a message on a page stating that they have a problem and are already working on it without any ETA would be better. Do not try to avoid that you have an issue because, in the end, as resellers or partners, we are already limited with our own people or customers and stating that we do not have any update. As partners, we do not have any information. At that point, what happened? I think that this was my last comment on this topic.

Regarding scalability and adding more clients and things to handle, I really love Proofpoint Email Protection more than other mail servers or mail services. If you find the correct people to provide this, I think that you will sell a lot of products from Proofpoint Email Protection because it is intuitive for the administrator perspective and also for end-users. However, it is not completely the job of Proofpoint Email Protection to provide the knowledge. This knowledge needs to be handled and shared by the IT teams for every company. If the administrator for that company understands how the tool and platform works, they can definitely start to share with their own customers and prevent any tickets or cases if something comes up. If you find the correct market for that, you will definitely become successful.

I have had to contact Proofpoint Email Protection's technical support. I think that the quality is pretty awesome and the speed is good. In most of my cases, the people have already answered me about any type of issue that happens with the tool. If I do not have the chance to review something on my end with the actual tools that I have with Proofpoint Email Protection, they are able to help because they have more visibility on their end. Because of my role, I have partner privileges, but Proofpoint Email Protection has everything in the backend. When I raise a ticket to review if some email was sent and it is not visible in the actual logs, they were pretty cool. They provided me with information stating that the email was already blocked on their end because of certain reasons, or they explained what they do not have for that account or those things. I think that if you provide the correct information and describe your case exactly, the service and attention is faster than other options.

If I were to put Proofpoint Email Protection's support on a scale from one to ten, with ten being the highest, I would give them a nine. I really love the support from Proofpoint Email Protection.

Positive

In my previous company, we used several other email protection services including Viper email security, Mimecast email security, and Zix protection.

The initial deployment of Proofpoint Email Protection is easy. The first step that you need to follow is to create your user account and set up the billing details. As soon as you have everything already in place, you need to follow the actual knowledge base. Proofpoint Email Protection has videos to make the correct and proper deployment with your own mail gateways. Proofpoint Email Protection is already working with the most popular and most used mail gateways including Workspace, Gmail, and Office 365, and they have options if you have others. The process is simple and easy to connect or interconnect both.

I sometimes thought about why users buy other security solutions or mail protection if they have their actual security methods from native mail gateways. Office 365 has their own Microsoft 365 Defender, Workspace has their own rules, and all mail gateways have their own security bench or security purposes. However, if you have a second layer to prevent and avoid this, it is definitely a growth opportunity for a company to avoid any spam, malware, or any type of malicious content that is not part of their actual daily basis from the end-user perspective.

If you have the chance and the money to buy a second layer of security method, go ahead. If you are a small company and do not want that, you can stick exactly with the native features and things that you have for your mail gateways. However, if you are one of the big companies like Salesforce, CrowdStrike, or Google, you definitely need to have second, third, and fourth layers before this type of emails arrive because your company will have more risk of being attacked. If you have the money and you are a medium or big company with more than 5,000 users, go ahead. Following only native security methods that the mail gateway has is not enough. You definitely need to start reviewing and seeing more options. Every mail solution has different types of features and I think Proofpoint Email Protection is one of the most complete tools because it has everything including Sandbox, URL Protection, different types of filters, and Attachment Defense. From a mail gateway perspective, I think Proofpoint Email Protection is one of the most complete options compared to others.

I do not think that Proofpoint Email Protection is hard to use because their knowledge base is very complete. However, it has more issues trying to align with the actual way that customers work because every customer has different ways of working. It becomes difficult when some customers have third-party solutions to send mail, such as newsletters or campaigns. If you have something Mailchimp or others, it is difficult to configure with Proofpoint Email Protection because it is completely opposite to them. Proofpoint Email Protection wants to avoid sending emails in a massive way, whereas Mailchimp is ready to send a massive amount of emails to a large number of people. To prevent blacklists and protect your own IPs and domain, both applications are dealing and fighting at the same time. I do not think it is hard to configure Proofpoint Email Protection with any mail gateways or customers only if the companies are using the native ones and just the mail server. If you are using multiple servers, that is when you start to see some problems. The most complicated aspect is with SMTP devices such as printers or faxes or whatever you are using as SMTP. I think that the devices are not fully capable of communicating with SMTP devices and Proofpoint Email Protection while avoiding messages that this is not part of your company or that the IP is not already allowed.

Regarding maintenance of Proofpoint Email Protection, it completely depends on your company and which tasks are needed to make some maintenance, such as reviewing policies, settings, allow lists, and block lists. If you are constantly reviewing this to prevent forgetting some accounts or domains, then it is more of a task for the IT teams than for Proofpoint Email Protection. Proofpoint Email Protection is continuously growing and making new releases. You just need to follow the actual notes for every update from Proofpoint Email Protection. If Proofpoint Email Protection makes any changes on their end, you need to follow the actual patch notes and then configure with your actual end accordingly.

I would rate this product a ten out of ten overall.

I have been using Proofpoint Email Protection for over three years. When I joined the company, they were in the process of switching their appliances from Sophos, which was coming to end of life. Our team evaluated different vendors for email security and selected Proofpoint.

Proofpoint Email Protection has many use cases. It filters all inbound and outbound email. Anything deemed malicious, phishing-related, spam-related, or containing viruses is automatically detected and blocked so it does not get delivered to users' inboxes. The same applies to outbound email—Proofpoint ensures that users in our organization are not sending anything malicious, confidential data, or spam-related content.

Another use case is our secure messages feature. When someone from our environment needs to send important documents for a customer to sign, we have our own portal where they can send those documents securely with full encryption. This works both ways, enabling secure back-and-forth communication. The main use cases are email filtering and our secure message appliance.

Proofpoint Email Protection performs exceptionally well with the TAP appliance, which is the main engine that detects emails. When it detects something suspicious or malicious, it provides a breakdown of extensive information. It shows the sender details including sender name, IP address, subject, and any attachments. For attachments, it clarifies what kind of detection was made and identifies any malicious URLs that have been embedded. This is excellent for gathering comprehensive data and showing snippets of what was picked up, providing a holistic view of what has been detected.

Proofpoint Email Protection has helped our team sit together and gather ideas on how to better the appliance. Recently, we had to deal with numerous spoofing emails. Although we had seen this occur before, once we implemented Proofpoint, we noticed a vast amount of spoofed emails coming into our organization. This type of intelligence helped us see what inconsistencies existed within our rulings and policies. It helped our team sit together, create different policies and rules to prevent such issues, and get a better understanding of what was actually happening in our organization. The information we gathered helped us come together and solve more of the issues occurring.

One area for improvement is reporting with Proofpoint Email Protection. When we have to report our KPI metrics, we try to find out as much information as possible. There is a portion of the reports that shows information about outbound emails being sent from our organization externally. It shows which emails were detected and how many emails were picked up as malicious. For example, it might show that out of 100 emails sent out, four were picked up as malicious. However, the reports do not specify which specific emails those were. The reports show the senders who sent those malicious emails, but not which email each sender sent. This means we have to manually dig through the logs to find those emails. Regarding reporting, if Proofpoint could gather more information and intelligence about detections or reporting and show it on the dashboard rather than requiring us to manually dig through and find what occurred, that would be beneficial.

As far as visibility goes, it is definitely attainable, but additional appliances must be purchased for Proofpoint. I would rate visibility at approximately 50 to 60 percent. We get an idea of when users are sending emails and what kind of emails they are sending. Regarding the outbound phishing situation mentioned earlier, the reports tell us which senders are sending out malicious emails, but they do not specify which emails those were.

For the most part, maintenance is not really required with Proofpoint Email Protection as most of it is cloud-based. On occasion, our TRAP appliance, which is where if an email slips through that was malicious and Proofpoint did not catch, TRAP will remove it, requires maintenance. TRAP is the main appliance and is a server that we push out updates to and maintain. Regarding maintenance, our policies or rules are mainly configured during the implementation process. Afterwards, there is not much maintenance required. I would estimate approximately 40 to 45 percent maintenance when it is in the production environment.

Once in a while, not often, we see issues with secure messages or with our appliances gathering reports. Very occasionally, Proofpoint posts announcements on the environment side indicating server issues, downtime, or servers being down. When this occurs, maximum downtime is around 6 to 10 hours for some services. It is not a major issue on our end. However, around one and a half to two years ago, we were experiencing constant downtime or maintenance on their side. In the past year, we have not had any of these issues.

I feel that Proofpoint has one of the best customer supports in the business. Whenever a case is opened, they respond almost immediately and are more than willing to get on a call to ensure that any issues are resolved on time.

Even if we need assistance, we can always reach out to support and they are always there to support us. It is very easy for us to do this.

Prior to using Proofpoint Email Protection, we were using the Sophos email appliance when I joined the company. It definitely was not as advanced as Proofpoint, but it was still an email protection appliance. It had similar abilities such as blocking email addresses, releasing email addresses, or inspecting emails. However, there were many times when malicious emails that were easily detectable came through the appliance that Proofpoint would have easily picked up.

The initial deployment for Proofpoint Email Protection was amazing. The people we worked with were constantly with us throughout the entire process. Whether it was with the appliance or externally with Exchange, they were on calls with us all the time. Whenever we had any questions, they responded instantly. We would get on meetings regularly and all questions we had were answered. Daniel Del Rosario was the specific person who helped us throughout the process, and he was phenomenal.

We have a contract set in place with Proofpoint for their services.

Proofpoint Email Protection has helped simplify a lot of our internal processes. When we had to report our KPI metrics and find as much information as possible, reporting all the data and detections made by Proofpoint was definitely a plus.

Operational efficiency has improved with Proofpoint Email Protection. Previously, there were four or five different portals that we had to visit regarding Proofpoint and we had to individually log into each one. Now, we can log into one portal and visit the other portal URLs without logging in again. Instead of individually logging into five portals, we can log into one and they all connect as if we had logged into all of them.

My supervisor has all the information for pricing, so I am not able to provide the pricing information at this time. However, we have been using Proofpoint for three years, which demonstrates that the pricing is not really a major issue for the company.

Prior to using Proofpoint Email Protection, we were using the Sophos email appliance when I joined the company. It definitely was not as advanced as Proofpoint, but it was still an email protection appliance. It had similar abilities such as blocking email addresses, releasing email addresses, or inspecting emails.

Configuration adjustments are mainly done within our pod appliance in Proofpoint. Adding users and making adjustments such as setting the minimum and maximum amount of time where emails can stay within our logs through retention policy is very efficient and very easy to do.

Proofpoint Email Protection has improved operational efficiency. Previously, there were four or five different portals that we had to visit regarding Proofpoint and we had to individually log into each one. Now, we can log into one portal and visit the other portal URLs without logging in again. Instead of individually logging into five portals, we can log into one and they all connect as if we had logged into all of them.

The longest amount of time I have seen Proofpoint take to detect a malicious email is around two hours, which is quite impressive. However, I have seen instances where Proofpoint detects the email almost immediately, within a minute or two after the email arrives. Right before a user actually clicks on the email, Proofpoint will detect it and identify it as malicious. Proofpoint has a tool called TRAP, which will automatically remove that email from the user's inbox. They have many valuable tools within the appliances.

I am providing this review with an overall rating of 10.

My main use case for Proofpoint Email Protection is to detect phishing emails or suspicious spam emails incoming to our organization. I will do this with the help of the event names or SPF, DKIM, or DMARC protocols.

When we receive a phishing email, there are two things to check. When I try to ingest the logs from the email gateway, Proofpoint, to Splunk or any SIEM tool that we are using, most of the phishing-related events will be categorized under TI mail data, which is Threat Intel Mail Data. That is the specific event name that I will be looking for. There are some other fields such as spam score and phish score. The higher the spam and phish score, the greater the phishing activity or spam activity may be happening in a user's email inbox. Based on these conditions or fields, I usually try to adjust the use case to detect phishing and spam.

Proofpoint Email Protection offers a very wide range of features such as anti-theft, where it will protect the user identity. It will give a spam-proof, phish-proof experience, and whenever a user receives an email, it will check the content of the email for masquerading or trying to pretend it is from some other person. It will check all these things and then it will allow the email to the user's inbox.

Anti-theft and masquerading are the two main features of the email gateway. It will protect the user's identity. For example, if I am sending an email outside the organization, the email gateway will sit in between the sender and receiver. It will check the alignment and all those things, and it will mask the sender's identity. It will send it as a do-not-reply or send the emails from a do-not-reply email to protect the user's identity. When coming to the masquerading part, it will check for some spelling mistakes and misspelled domain names. These are all the things that I usually see in phishing email cases.

Proofpoint Email Protection has positively impacted our organization in a very fruitful way. The number of phishing attempts that we have seen has gradually decreased by using this email gateway. The number of users that I have started training by using their official manual and the official email protection manual has increased. They have a very good range of trainers from Proofpoint who will deliver trainings on a quarterly basis, so the team will get updated on the active threats that are happening in email activities. It is helping our organization a lot. I can see very good results in the case of phishing emails and spam. They have been reduced drastically.

The phishing emails have been decreased by 60% because of the active threat scanning and URL scanning and all those things. The spam score has been decreased by more than 70%.

It definitely helped the SOC analyst to analyze the events better. It will give a broad range of what things I need to check for when I receive an email. There will be some actions to purge the emails if I find it is suspicious, and I can do the bulk email deletion. Suppose if I received one phishing email, I suspect that many of the members in the organization have received it. In Proofpoint Email Protection gateway, I can search from that sender and I will get all the emails that were received over a period of time. I can purge them all with the same subject line or the emails that I suspect to be a phishing one. That is definitely a time-saver. Otherwise, it would have been hectic work for an IT person to go to each desktop to check whether the email was received or not. It definitely helped a SOC analyst to save time and do more effective and efficient analysis.

Proofpoint Email Protection has enabled the SOC team to save more than 20 hours a week. Before, I used to manually investigate the logs for the phishing emails. Now I have the web gateway or a website where I can check all the phishing and spam emails received. That is definitely very helpful.

Proofpoint Email Protection has influenced the quantity of threats our organization needs to protect against. It will help in analyzing the threats better. It will act as a barrier between the internet and the organization, where it will scan each and every email, incoming and outgoing. If it suspects it to be a phish or spam, it will definitely move it out of the user's inbox. The phish score is a very good thing. By implementing this tool, I have saved more than 20 hours a week and I have got a much more efficient team. The number of threats has also become very low after using this. I used to receive more than 10 to 15 phishing emails before, but after the implementation, only one or two emails will hit the user's inbox. The rest of them will be handled by Proofpoint. For that one or two, I will receive a notification that Proofpoint is suspecting this email, but it wants a confirmation from the user.

While ingesting the logs into our SIEM tool, most organizations don't have the capability to buy the email gateway as it is quite an expensive one. It would be better that if I am providing a service as a SOC, then it is better for the client to buy a premium version where I can ingest the logs into Splunk. However, in Splunk, I should have the ability to check all the fields. All the fields should get ingested. In a majority of the cases, I can see that event names are getting dropped because of this parsing issue. That is the one thing they can improve on with email gateways.

I chose nine for Proofpoint Email Protection because I feel that by using that product, every organization can be safe from phishing and spam emails. I didn't rate it a 10 because there will always be room for improvement. Nowadays the attacks are getting more and more sophisticated. The attackers are trying to gain some more information about the target, then they will send an email. Email gateways also need to be improved in that way, where they should be able to detect more sophisticated phishing emails.

I have been using Proofpoint Email Protection for the last five to six months.

Proofpoint Email Protection is very stable.

Proofpoint Email Protection is scalable. As I have more users, I can easily add them. I don't have any issues with the scalability.

Customer support for Proofpoint Email Protection is a top-notch thing. That is why I went for Proofpoint. Otherwise, I would have gone with Cisco or some other vendors.

Positive

I didn't have an email gateway. I thought of buying some other email gateway, but compared to Proofpoint Email Protection, they had fewer features and the cost was also somewhat similar to Proofpoint Email Protection. I was able to compromise on money, but I was not able to compromise on the features. That is why I went for Proofpoint Email Protection.

I have noticed some changes in operational efficiency after implementing Proofpoint Email Protection. It is saving the time and money that would have gone into the protection of the emails. For example, before buying the email gateway, I would have had six or seven members in a team particularly for email protection. But since Proofpoint is implemented, I can reduce the team size to two or three, where they are able to manage the queue in the email gateway.

The unified admin console in Threat Protection Workbench for managing security operations is a very user-friendly tool, and it is effective for my team.

Proofpoint Email Protection provides a very good return on investment. My email security team would have been seven to eight members per shift. After implementing this, I have moved most of them. I have moved five to six analysts out of that team. The team consists of only two to three people where they are able to manage the queue. They are also happy with the implementation of this Proofpoint Email Protection gateway, where they are able to segregate the alerts into phish and spam. It is definitely a very helpful tool, and the SOC analysts are also happy with the implementation.

Proofpoint Email Protection provides a very good return on investment. My email security team would have been seven to eight members per shift. After implementing this, I have moved most of them. I have moved five to six analysts out of that team. The team consists of only two to three people where they are able to manage the queue. They are also happy with the implementation of this Proofpoint Email Protection gateway, where they are able to segregate the alerts into phish and spam. It is definitely a very helpful tool, and the SOC analysts are also happy with the implementation.

The overall scope and range of Proofpoint Email Protection's threat protection capabilities are very aligned with the industry threat landscape. They are updating their SOPs every week. They will be working on updating everything in the console at least once a month. If there is any new feature coming, they will definitely notify me and roll out an update. The pricing is up to the mark, I think. As compared to the competitors, I get some more benefits here by using Proofpoint Email Protection, so the pricing is fine. For the setup cost, they will get their own team to deploy the email gateway and get it ready. Coming to the licensing part, I can have two-year or four-year licensing based on my needs. I have gone for a trial period of six months. After that, I will confirm whether I am renewing or not going with them.

I considered some other products such as Imperva and Microsoft Defender for email protection. However, they have very limited features. Limited features in the sense that I have more features in Proofpoint Email Protection gateway, as this company is basically working on email security, so they know better than others. That is the reason that I tried to go with Proofpoint Email Protection gateway.

Proofpoint Email Protection is deployed in a private cloud, but I don't have the exact answer for that.

I use Proofpoint as an email protection provider.

Proofpoint Email Protection provides great visibility into people-based risk. I think it depends on how the configurations are made. Based on the configurations made, it does give great visibility to the organization based on the risk.

I don't use Messaging Security for protection across cloud apps and file-sharing services. There is a different team for that. They will be handling these things.

The overall scope and range of Proofpoint Email Protection's threat protection capabilities are very aligned with the industry threat landscape. They are updating their SOPs every week. They will be working on updating everything in the console at least once a month. If there is any new feature coming, they will definitely notify me and roll out an update. The pricing is up to the mark, I think. As compared to the competitors, I get some more benefits here by using Proofpoint Email Protection, so the pricing is fine. For the setup cost, they will get their own team to deploy the email gateway and get it ready. Coming to the licensing part, I can have two-year or four-year licensing based on my needs. I have gone for a trial period of six months. After that, I will confirm whether I am renewing or not going with them.

I would rate Proofpoint Email Protection as a nine.

Proofpoint Email Protection

Proofpoint Email Protection provides advanced email security by protecting organizations against phishing, spoofing, malware, ransomware, and other email-based threats.

All incoming emails are first analyzed by Proofpoint's threat detection engine before reaching the user's mailbox. It inspects email content, attachments, embedded URLs, sender reputation, and suspicious behavior patterns to identify and block malicious messages.

The solution helps reduce the risk of cyberattacks, improves email security posture, and ensures that users receive only legitimate and safe emails in their inboxes

Proofpoint Email Protection has significantly improved our email security by blocking phishing, spoofing, malware, and spam before they reach users. It has reduced security risks, improved user confidence, and provided better visibility into email-based threats through its advanced threat detection and reporting capabilities.

The best features of Proofpoint Email Protection are its advanced phishing and malware detection capabilities, URL Defense (Safe Links), attachment scanning, and automated threat remediation. These features help protect users from phishing attacks, malicious links, spoofing attempts, ransomware, and other email-based threats.

One of the most valuable aspects is its ability to analyze incoming emails, attachments, and embedded URLs before they reach the user's mailbox. If a suspicious email is detected, Proofpoint can automatically quarantine, block, or remove it, significantly reducing the risk of successful cyberattacks.

Another key benefit is Threat Analytics and Protective Intelligence (TAP), which provides automated detection and remediation of malicious emails. This reduces the need for constant manual monitoring by security teams and helps ensure faster response to emerging threats.

Overall, Proofpoint Email Protection offers strong email filtering accuracy, proactive threat prevention, and automated security controls, making it an effective solution for protecting organizations against modern email threats.

While Proofpoint Email Protection provides strong protection against phishing, spoofing, malware, and other email-based threats, there are a few areas where it could be improved.

One area for improvement is reducing the need for continuous policy tuning and whitelist management. In many environments, administrators regularly need to update allow lists, DKIM, SPF, and DMARC-related configurations to avoid false positives. More intelligent automation and adaptive policy management would help reduce administrative overhead.

Another area is reporting and analytics. While the platform provides useful built-in reports, the reporting interface can feel complex, and creating highly customized reports is limited. Enhanced dashboard customization, easier report generation, and more flexible reporting options would improve the overall user experience.

Additionally, the initial deployment and fine-tuning process can be complex and often requires experienced resources. Simplifying configuration, onboarding, and policy management would make the solution more accessible to organizations with smaller security teams.

Overall, stronger automation, improved reporting capabilities, and simplified administration would make Proofpoint Email Protection even more effective and easier to manage

I have been using Proofpoint Email Protection for approximately four years, managing email security, threat protection, policy administration, and email filtering within an enterprise environment.

Yes, Proofpoint Email Protection is a very stable solution. Email is one of the most critical communication channels for any organization, and Proofpoint provides reliable and consistent protection against phishing, spoofing, malware, and other email-based threats.

In our experience, all inbound and outbound emails are routed through Proofpoint first, where they are scanned, filtered, and analyzed before being delivered to the mail server. Its email security gateway, content filtering, threat detection, and policy enforcement capabilities work consistently without impacting email flow. Overall, the platform provides dependable performance, strong security controls, and stable email protection for enterprise environments.

I have not raised many tickets with Proofpoint Email Protection, but when I open a ticket, it is good. If you are asking for a rating, I can give a rating of four out of ten. The reason is that they have a chat box option, but we cannot directly reach engineers if we need immediate support. If we raise a ticket, we need to wait for the assigned engineer and they will reach out over email. But if I need to explain something on a call or on the phone, I think Proofpoint Email Protection does not give support in this way because they provide support through email communications. As per my understanding, support should be provided similar to how Microsoft provides it. If we are raising a ticket, a Proofpoint Email Protection engineer should be assigned and they should reach out over email or over a phone call to understand the issues and provide the support accordingly.

Yes, we previously used Microsoft Defender for Office 365 as our primary email security solution. While it provided good protection against spam, phishing, and malware, we switched to Proofpoint Email Protection to gain more advanced threat detection, enhanced email security controls, and better visibility into email-based threats.

Proofpoint offered stronger phishing protection, URL and attachment defense capabilities, advanced threat intelligence, and more granular email security policies. These features helped improve our overall security posture and reduce the risk of sophisticated email attacks

Proofpoint Email Protection is a premium email security solution, and its pricing is generally higher than some competing products. However, the advanced threat protection, phishing defense, and threat intelligence capabilities justify the investment. The initial setup and licensing process require careful planning and experienced resources, especially for policy configuration and fine-tuning. Overall, while the cost may be higher, the security benefits and protection against email-based threats provide good value for the organization.

Before choosing Proofpoint Email Protection, we evaluated Microsoft Defender for Office 365. Microsoft Defender offers good native integration with Microsoft 365 and basic email security capabilities. However, Proofpoint provided more advanced phishing protection, stronger threat intelligence, better email filtering accuracy, and enhanced URL and attachment defense. While Microsoft Defender is easier to manage within the Microsoft ecosystem, Proofpoint offers deeper email security features and greater visibility into advanced email threat

I would rate Proofpoint Email Protection 8 out of 10.

The solution provides strong protection against phishing, spoofing, malware, and other email-based threats. Its advanced threat detection, automated remediation, alerting capabilities, and integration with SOC operations help organizations respond quickly to security incidents. It also offers granular email security controls, allowing administrators to define policies, restrict risky domains, control attachments, and reduce people-based risks.

My advice to organizations considering Proofpoint Email Protection is to ensure they have experienced resources available for the initial deployment and policy tuning. While the platform is powerful and highly effective, proper configuration is essential to maximize protection and minimize false positives. Organizations looking for advanced email security and threat visibility will find Proofpoint to be a strong choice.