Microsoft is pulling third-party email detections into its own Defender console, and Proofpoint has now signed on. Proofpoint said on October 26 that it has joined the Integrated Cloud Email Security (ICES) vendor ecosystem for Microsoft Defender for Office 365.
According to Proofpoint’s announcement, the integration lets Microsoft 365 customers add Proofpoint’s API-based Core Email Protection on top of Microsoft’s native controls and see Proofpoint detections in the Microsoft Defender portal, beside Microsoft’s own. Proofpoint says it protects more than 1.8 million Microsoft customers. “By extending Proofpoint’s interoperability across ICES, we’re delivering a more unified security experience that strengthens defense-in-depth and simplifies operations for our shared customers,” said Tom Corn, executive vice president and general manager of the Threat Protection Group at Proofpoint. Oz Wilder, partner director for email and collaboration security at Microsoft, said the company’s focus is a defense fabric “anchored in Microsoft Defender.”
For SOC teams that run both products, the change is about where email alerts are triaged. Proofpoint says analysts will switch between consoles less often, with Proofpoint and Microsoft detections in one queue. The release does not say how conflicting verdicts on the same message are handled, which is worth asking before the integration goes live.
In our reading, the integration changes the buying test for Microsoft 365 shops. With Defender as the shared queue, a second email layer earns its place on the misses it catches on your own mail, measured against what Defender already flagged. Proofpoint claims 99.999% detection efficacy for the API, and a pilot on your own traffic is how to test that figure. The announcement follows by a week Proofpoint’s agreement to acquire Varonis. Email detection covers one route into a tenant, and the token replay campaign that reached 79 Microsoft 365 organizations last week used another.
