Proofpoint joins Microsoft ICES in Defender portal

Proofpoint has joined Microsoft's Integrated Cloud Email Security vendor ecosystem, adding its email threat detection to Microsoft Defender for Office 365.

The integration lets Microsoft 365 customers view detections from Proofpoint's Core Email Protection API in the Microsoft Defender portal instead of a separate interface.

That places Proofpoint's detections alongside Microsoft's in a single console used by security operations teams investigating email-based threats. The arrangement is intended to reduce the need for analysts to switch between tools during reviews and incident response.

Proofpoint said the integration builds on its existing relationship with Microsoft services and brings that interoperability into the ICES framework. Customers can use its API-based email detection as an additional layer within their current Microsoft security set-up.

Email security remains a central issue for corporate cyber defence because phishing, business email compromise and ransomware campaigns often begin in user inboxes. Suppliers have increasingly focused on making their products visible within the main security platforms used by analysts, as companies seek to consolidate oversight and reduce the operational burden on security teams.

Proofpoint said it protects more than 1.8 million Microsoft customers worldwide and works with more than 80 of the Fortune 100, more than 14,000 large enterprises and millions of smaller organisations.

Single console

Under the arrangement, detections generated by Proofpoint will appear directly in Microsoft Defender, giving analysts a shared view of alerts from both companies in the same environment.

Proofpoint said its Core Email Protection API is intended to supplement Microsoft's native controls with additional detection for email-based attacks, including phishing, business email compromise, ransomware and related threats.

The company also cited a detection efficacy figure of 99.999% for the service, which it said is supported by its Nexus AI technology. Microsoft and Proofpoint framed the integration around layered security, allowing customers to combine Microsoft's protections with third-party detection through the ICES ecosystem.

Tom Corn, Executive Vice President and General Manager, Threat Protection Group at Proofpoint, said the move reflects demand from mutual customers that use both vendors for security.

"Organisations rely on both Microsoft and Proofpoint to protect their most critical communications and data," said Tom Corn, Executive Vice President and General Manager, Threat Protection Group at Proofpoint.

"By extending Proofpoint's interoperability across ICES, we're delivering a more unified security experience that strengthens defence-in-depth and simplifies operations for our shared customers. This milestone reflects our commitment to joint customers worldwide," Corn said.

Microsoft ecosystem

Microsoft has opened the ICES model to let specialist email security providers integrate with Defender for Office 365 while keeping Microsoft Defender as the main operational interface. The approach reflects broader demand from large organisations for security stacks that can accommodate specialist tools without forcing analysts into disconnected workflows.

For Proofpoint, participation in the ICES programme offers a more direct route into the Microsoft security console already used by many customers. For Microsoft, the arrangement broadens the range of third-party email security tools that can plug into Defender while keeping customer activity centred on its platform.

Oz Wilder, Partner Director for Email and Collaboration Security at Microsoft, said the programme is aimed at improving operational efficiency for security operations centres.

"Our focus is on building a cohesive defence fabric that drives real efficiency for security operations centres, anchored in Microsoft Defender," said Oz Wilder, Partner Director for Email and Collaboration Security at Microsoft.

"The ICES ecosystem enables customers to adapt and scale with the evolving threat landscape. By integrating with Microsoft Defender, Proofpoint helps deliver a more consistent and simplified security operations experience for shared customers in Microsoft Defender," Wilder said.

The announcement also underlines how email security vendors are responding to customer pressure for fewer consoles and clearer alert management, particularly as cyber teams face persistent staffing shortages and rising volumes of security data. In that context, integrations that place third-party findings directly into a core operations dashboard have become a competitive point for both platform providers and specialist security companies.