Proofpoint joins Microsoft ICES vendor ecosystem

Proofpoint has announced that it has joined the Microsoft Defender for Office 365 Integrated Cloud Email Security (ICES) vendor ecosystem.

According to Proofpoint, joining the ecosystem allows Microsoft 365 customers to add Proofpoint’s Core Email Protection API to their existing Microsoft security environments. 

Threat detection and response

When Proofpoint identifies a threat in a message that has already been delivered, it sends a detection verdict, confidence level and relevant threat details to Microsoft Defender through the Microsoft Graph API.

Defender then determines the highest-severity verdict, using the same precedence logic it applies to its own detection sources, and initiates its standard post-delivery remediation processes. This includes quarantining affected messages, with the same workflow applied regardless of whether the threat was identified by Microsoft or Proofpoint.

Proofpoint added security teams can also access its detections through Microsoft’s Threat Explorer and Advanced Hunting tools. The integration extends to Microsoft’s Email entity page, where analysts can view message headers, delivery events, detection verdicts and user actions, as well as reporting tools that measure the additional detection value contributed by Proofpoint.

At the same time, Microsoft customers will be able to view Proofpoint’s email threat detections directly within the Microsoft Defender portal. Proofpoint said this will allow security operations centre teams to view Proofpoint detections alongside Microsoft detections in a single console, improving response time and speeding up investigations. 

Leadership perspectives

“Organisations rely on both Microsoft and Proofpoint to protect their most critical communications and data,” Proofpoint threat protection group executive vice president and general manager Tom Corn said.

“By extending Proofpoint’s interoperability across ICES, we’re delivering a more unified security experience that strengthens defence-in-depth and simplifies operations for our shared customers. This milestone reflects our commitment to joint customers worldwide.”

Ecosystem context and growth

The move by Proofpoint comes as the company continues to grow its integration with Microsoft services and extends that interoperability into the ICES ecosystem. Other vendors approved in the ecosystem include Darktrace, KnowBe4, Cisco and Vipre Security Group.

“Our focus is on building a cohesive defence fabric that drives real efficiency for security operations centres, anchored in Microsoft Defender,” Microsoft email and collaboration security partner director Oz Wilder said. 

“The ICES ecosystem enables customers to adapt and scale with the evolving threat landscape. By integrating with Microsoft Defender, Proofpoint helps deliver a more consistent and simplified security operations experience for shared customers in Microsoft Defender.”

You might also be interested

• Cisco wants to put AI agents’ security boundaries beyond their reach
• Zero trust for SMBs only works when complexity disappears
• Zscaler and Carahsoft turn zero trust into a repeatable mid-market service
• Your security dashboard says “covered”. Can you prove every control is working?