The situation: a breach that sparked executive action
When a global technology company realized that Microsoft 365 was letting risky emails through—and mistakenly flagging many legitimate messages as malicious—the issue quickly gained executive attention.
What began as a broad exercise in risk reduction for the security team became an urgent, business-critical priority when a C-suite executive assistant’s credentials were compromised.
The company needed to restore trust in its email systems—and fast.
The challenge: missed threats, false positives, and rising executive pressure
At the time, the company was running Microsoft 365 for native email protection and Mimecast for message authentication. They were also a long-time Proofpoint customer, using our security awareness solution as well as our automated tool for removing user-reported suspicious messages.
Despite these layers, cracks were showing:
- Risky messages were slipping through its Mimecast secure email gateway (SEG). This included credential phishing and business email compromise threats.
- False positives were too high, which disrupted communications and frustrated executives.
- Confidence in the security operations center (SOC) team was dropping, as security gaps became visible at the highest levels of the business.
Email protection had suddenly become a board-level topic—and the team knew they needed stronger, more consistent protection.
The evaluation: Proofpoint and Abnormal go head-to-head
The customer’s technology partner coordinated a structured evaluation between Proofpoint and Abnormal.
While the company initially considered Proofpoint’s SEG, they ultimately decided to test Proofpoint’s API-based protection to align with their 2025 roadmap. They wanted the unified management across email and collaboration security provided by the Proofpoint Threat Protection Workbench.
Both solutions were tested in parallel under real-world conditions. The result was decisive.
The results: Proofpoint outperformed Abnormal by 24%
The company’s partner, SHI, consulted on the best solution to meet their requirements. Using SHI’s detailed evaluation rubric, Proofpoint scored 24% higher than competing vendors.
1: Better efficacy
Proofpoint demonstrated higher detection accuracy, catching more real threats and flagging fewer legitimate messages than Abnormal. The reduction in false positives immediately improved user experience and rebuilt executive confidence in the organization’s email defenses.
2: Better platform integration
Proofpoint offered a clearer path to platform consolidation. This meant that the company could replace:
- Mimecast for message authentication
- Recorded Future for domain impersonation takedowns
In the future the company plans to use Proofpoint to unify detection, authentication and fraud defense under a single platform. This will reduce operational complexity and improve visibility.
3: Better price and broader risk reduction
Proofpoint delivered superior performance at a more competitive price point. More importantly, the company recognized the strategic value of integrating email protection with its existing security awareness program. Bringing these two functions together would enable more targeted and realistic phishing simulations in the future.
The outcome: stronger security, simpler operations
By consolidating with Proofpoint, the customer achieved:
- Higher detection efficacy with fewer false positives
- Simplified administration through a unified, API-based solution
- Broader protection coverage across email authentication, fraud defense and user awareness
Executives regained confidence in the organization’s email security posture. At the same time, the SOC gained back valuable time by reducing manual investigations and tool sprawl.
Why it matters for high-tech companies
In high-tech environments, where intellectual property and customer trust are invaluable, email remains the most exploited attack vector. A missed threat can mean far more than a security incident—it can lead to brand damage, data loss or business disruption.
Proofpoint’s human-centric approach gives technology leaders the visibility and control they need to protect not just inboxes, but also user identities, their data, and their brand.
Protect your people and your innovation
If you’re evaluating your Microsoft 365 environment and looking to strengthen defenses while reducing operational complexity, it’s time to take a closer look at Proofpoint Prime Threat Protection. Our platform offers integrated threat protection, authentication, and awareness to help companies reduce collaboration security risk across every communication channel.
Learn more about Proofpoint Prime Threat Protection.
