Proofpoint joins Microsoft's ICES ecosystem for Defender email security

What the integration does

Under the new integration, Microsoft 365 customers can add Proofpoint's Core Email Protection API to their existing Microsoft security environment. Detections from Proofpoint appear in the Microsoft Defender portal rather than in a separate tool.

Proofpoint says the move builds on its growing integration with Microsoft services and extends that interoperability into the ICES ecosystem. The company states that combining its human-centric threat detection with Microsoft's native protection gives more comprehensive, layered defense against email-based threats.

Tom Corn, Executive Vice President and General Manager of the Threat Protection Group at Proofpoint, said: "Organizations rely on both Microsoft and Proofpoint to protect their most critical communications and data." He added that the extended interoperability strengthens defense-in-depth and simplifies operations for shared customers.

Benefits claimed for security teams

Proofpoint says the integration reduces friction for security operations center (SOC) teams by cutting context switching and streamlining investigative workflows. It lists three main benefits:

• Integrated visibility: Security teams can view Proofpoint detections next to Microsoft detections in a single console, which the company says speeds up investigations and improves response times.
• Layered protection: Powered by Proofpoint Nexus AI, the Core Email Protection API enhances Microsoft's native controls with what Proofpoint describes as 99.999% detection efficacy. The company says this targets phishing, business email compromise, ransomware and other sophisticated email-based attacks.
• Operational efficiency: Streamlined workflows reduce analyst burden and allow faster, more coordinated threat response, according to Proofpoint.

The detection efficacy figure is Proofpoint's own claim, and the announcement does not describe how it was measured.

Microsoft's view and the partnership

Oz Wilder, Partner Director for email and collaboration security at Microsoft, said the focus is on "building a cohesive defense fabric that drives real efficiency for security operations centers, anchored in Microsoft Defender." He said the ICES ecosystem lets customers adapt and scale with the evolving threat landscape, and that Proofpoint's integration helps deliver a more consistent and simplified experience in Microsoft Defender.

Proofpoint says it protects more than 1.8 million Microsoft customers worldwide, and calls its participation in ICES a natural evolution of the partnership. The company describes itself as a trusted partner to over 80 of the Fortune 100 and over 14,000 large enterprises.

What it means for customers

For organizations that run Microsoft 365 and also use Proofpoint, the practical change is consolidation: email threat findings from both vendors can be reviewed in the Microsoft Defender portal. Security teams that already work in Defender may no longer need to move between consoles to compare detections.

The announcement does not give pricing, rollout timing or technical requirements. Proofpoint points readers to its API email security page and its blog for more information.