XDR platform correlating Trend Micro's endpoint, email, server, cloud and network sensors, licensed through a shared credit pool.
From $75/yr10 researched notes
Proofpoint
Email security and data protection suite from a private company owned by Thoma Bravo, licensed per user with modules sold separately.
As of 13 November 2026, Proofpoint starts at $6/month. An inline email gateway with a strong attachment and URL analysis stack, surrounded by acquired products for training, data loss prevention and insider threat. Softwr lists it under Cybersecurity. Proofpoint is made by Proofpoint, Inc., launched in 2002, available on Web.
Overview
What Proofpoint does
Proofpoint's core product is a secure email gateway. Your MX records point at Proofpoint rather than at your mailbox provider, and mail passes through its filtering, attachment sandboxing and URL rewriting before delivery. Around that core sits a portfolio largely assembled by acquisition: Targeted Attack Protection for detonation and click-time analysis, Threat Response Auto-Pull for retracting messages already delivered, Email Fraud Defense for DMARC enforcement, Security Awareness Training from the Wombat acquisition, Insider Threat Management from ObserveIT, enterprise data loss prevention, cloud application security and archiving. It is delivered as SaaS with an on-premises gateway option. Thoma Bravo took the company private in 2021, and it has continued acquiring since, adding Illusive, Tessian, Normalyze and Hornetsecurity. The distinguishing thing is not detection quality, which is contested and moves every year. It is the architectural position. Being inline means Proofpoint can stop a message before it reaches a mailbox rather than pulling it out afterwards, and it means the organisation's most business-critical system depends on Proofpoint's availability. That position is also why the product is difficult to displace. Removing it requires a mail cutover with queueing, a rollback plan and a maintenance window, and the person proposing it has to explain what happens if mail is lost. Vendors know this, which is why renewal conversations with an inline gateway rarely feel competitive. Buyers are typically regulated enterprises and organisations that concluded their mailbox provider's built-in filtering was insufficient after an incident. The trade-off is that most of them are already paying for native filtering inside a Microsoft 365 E5 or Google Workspace Enterprise agreement, so Proofpoint is a second licence over a capability they own, and finance revisits that at every renewal. The second trade-off is modularity: the platform demonstrated in a proof of concept is usually four or five separately licensed products, and each addition later is a new negotiation rather than a toggle.
What people use it for
- A regulated organisation that needs a filtering layer, DMARC enforcement and archiving with an auditable trail across all three
- An organisation that suffered a business email compromise and must show its board a control that stops delivery rather than remediating afterwards
- Concentrating stronger controls and training on the specific individuals who actually receive targeted attacks rather than applying uniform policy
- Retracting a phishing message from thousands of mailboxes after the verdict changes, including copies that were forwarded internally
Related searches
The honest half
Where it falls short
Concrete and checkable, so you can decide whether any of them matter to you. This is the half of a review a vendor will not write about Proofpoint.
- Licensing is per user per year with each capability as a separate stock item, so the platform shown in a proof of concept is normally several products, and adding awareness training, data loss prevention or insider threat monitoring later is a fresh negotiation rather than enabling a feature.
- It sits inline with MX records pointed at it, so any service degradation is a mail outage for the entire organisation, and both migrating on and migrating off are cutovers with queueing, rollback planning and a real risk of message loss.
- Most customers on Microsoft 365 E5 or Google Workspace Enterprise are already paying for native filtering, so Proofpoint is a second licence layered over a capability the organisation owns, and that comparison is raised by finance at every single renewal.
- The administration console carries a decade of acquisitions: the classic gateway policy routes and filters do not share a model with the newer module interfaces, rule evaluation is order-sensitive in ways that surprise untrained administrators, and mistakes there silently change what is delivered.
- Quarantine management is a standing helpdesk workload because legitimate bulk mail, invoices and supplier notifications are held, and unless end-user digests are configured and users are taught to use them, the security team becomes the mail release desk.
Pricing
What Proofpoint costs
Taken from the vendor's own pricing page. Prices move, so check before you buy.
Email Protection
$6 /mo
- Per user
- Advanced threat detection
- Data loss prevention
- Encryption
Compliance
$8 /mo
- All Email Protection
- Archive & search
- eDiscovery
- Compliance reporting
Advanced Threat
$10 /mo
- All Compliance features
- Targeted attack detection
- Behavior analytics
- Sandbox isolation
Capabilities
Features
Inline secure email gateway
MX-level filtering that blocks or quarantines before a message reaches the mailbox rather than remediating afterwards
Attachment sandboxing
Detonates attachments in an instrumented environment and holds delivery pending the verdict
URL rewriting and click-time analysis
Rewrites links so the destination is evaluated at the moment the user clicks, not only at delivery
Threat Response Auto-Pull
Retracts messages from mailboxes after delivery when a verdict changes, including forwarded copies
Email Fraud Defense
DMARC, SPF and DKIM implementation and enforcement with visibility into who is sending as your domain
Security awareness training
Phishing simulation and training modules tied to which users actually clicked, from the Wombat acquisition
Insider Threat Management
User activity monitoring and session recording for data misuse investigations, from the ObserveIT acquisition
Enterprise DLP
Content and behaviour-based data loss policies across email, cloud and endpoint
Archiving and supervision
Retention, legal hold and supervisory review for regulated communications
Very Attacked People analytics
Identifies which individuals receive the most targeted attacks so controls can be concentrated on them
Answered, with sources
Questions people ask
Each answer names the page it came from, so you can check it rather than take our word for it.
Does it replace Microsoft Defender for Office 365?
Functionally it overlaps heavily, and running both means paying twice for filtering. Most Proofpoint customers on Microsoft 365 keep Defender licensed because it is bundled in E5 and use Proofpoint as the inline gateway. Expect to justify that duplication annually.
Who owns Proofpoint?
Thoma Bravo, a private equity firm, which took the company private in 2021. It has continued to acquire since, including Tessian, Normalyze and Hornetsecurity, which is why the portfolio spans so many adjacent categories.
Do I have to change my MX records?
For the gateway, yes. That is what makes it inline and able to block before delivery. Some newer capabilities integrate through the mailbox API instead, but the core protection model is MX-level.
Is security awareness training included?
No, it is a separate subscription. It integrates well with the threat data, so training can target the users actually being attacked, but it is a distinct line item on the quote.
What does Threat Response Auto-Pull actually do?
It removes messages from mailboxes after delivery when the verdict changes, including copies that users forwarded internally. It is the answer to the case where a link was clean at delivery and weaponised an hour later.
Behind it
Who makes Proofpoint
- Company
- Proofpoint, Inc.
- Based in
- Sunnyvale, California, USA
Keep looking
Where to go from Proofpoint
- Proofpoint alternativesEvery product people weigh against it
- Proofpoint pricingPlans, floors and what the tiers exclude
- Proofpoint badgesWhich rules it meets, and the figure behind each
- All Cybersecurity softwareThe full category
- Best Cybersecurity softwareThe shortlist, and how it was cut
Best Cybersecurity software for
Compare Proofpoint with
- Trend Micro Vision One
- Mimecast
- Qualys VMDR
- Zscaler Internet Access
- IBM QRadar
- Varonis Data Security Platform
- VMware Carbon Black
- Sysdig
- Fortinet FortiGate
- Recorded Future
- SentinelOne
- Unit21
- Veracode
- Very Good Security
- VIVOTEK VAST Security Station
- Windscribe
- Yoti
- SentinelOne Singularity
Other Cybersecurity software
Cloud-delivered vulnerability management licensed per asset, using scanner appliances and a lightweight agent.
From $3/mo10 researched notesEnterprise SIEM licensed by events per second, whose cloud business IBM sold to Palo Alto Networks in 2024.
10 researched notesData security platform that maps effective permissions, content classification and access activity across file shares, Microsoft 365 and SaaS.
From $100/yr10 researched notesCloud-delivered endpoint protection and EDR, now owned by Broadcom and positioned alongside Symantec.
10 researched notesCloud-native runtime security platform with real-time detection and response
Pricing on request12 researched notesNext-generation firewall with AI-powered threat protection
From $500/yr6 researched notesNo-code fraud and AML risk operations platform for fintechs and neobanks
Pricing on request10 researched notesApplication risk management platform for finding and fixing software vulnerabilities.
Pricing on request8 researched notesTokenisation proxy that keeps card and personal data out of your own systems and out of PCI scope
From $1,000/mo12 researched notesCamera-vendor video management software with a free 32-channel tier for VIVOTEK devices
12 researched notesVPN and firewall service with a generous free data tier and a customizable Build-A-Plan option
Free, then $3/mo6 researched notesReusable digital identity, facial age estimation and identity verification
Pricing on request11 researched notes
Softwr does not host reviews and shows no star rating for Proofpoint, because a rating we did not collect is not ours to publish. What is here is the pricing and platform detail from the vendor’s own pages, limitations we could state concretely, and alternatives a reviewer confirmed people weigh against it. Tell us if any of it is wrong.
More on Proofpoint
Proofpoint alternatives
What people switch to, and what they give up
Proofpoint pricing
Every tier, and where the cost actually lands
Compare Proofpoint
Put it head to head with anything we hold
Proofpoint badge
Its rating, and an embed for your own site
Best Cybersecurity software alternatives
Large Chinese video platform that US federal buyers and federal contractors cannot lawfully use
quote
Managed video loss prevention with human auditors for restaurants, convenience stores and retail
quote
Workforce and customer authentication from a certificate authority
Per user per month
Privileged access management, endpoint privilege management and secure remote access
quote
Cloud video surveillance billed per camera per month, where retention length drives the bill more than anything else
Per camera per month
AI video search that runs on cameras you already own, starting near five dollars per camera per month
Per camera per month
Phishing-resistant passwordless authentication with device trust enforced at every login
quote